Network Intrusion Detection Method, Device, Electronic Device and Storage Medium

Abstract

The present invention provides a network intrusion detection method, device, electronic device and storage medium, relating to the field of network security technology. The present invention can obtain target network access behavior data to be detected; use an eccentric model to encode and decode the target network access behavior data to obtain target decoded data; according to the target decoded data, use an LSTM model to perform network intrusion detection on the target network access behavior data to obtain a target detection result; wherein, the LSTM model and the eccentric model are jointly trained. In this way, by cooperating the eccentric model with the LSTM model to detect network attacks, the problem of the limitations of shallow learning is effectively solved, making the detection result more accurate.

Description

Technical Field

[0001] The present invention relates to the field of network security technologies, and in particular, to a network intrusion detection method, apparatus, electronic device, and storage medium. Background Art

[0002] With the continuous development of artificial intelligence technology, deep learning methods have gradually become one of the research hotspots in the field of network security. Among them, the Long Short-Term Memory neural network (LSTM for short), as a special type of Recurrent Neural Network (RNN for short), has been widely used in multiple fields because it can handle long-term dependencies in sequential data. In the field of network security, especially in network attack detection, LSTM has been widely adopted due to its advantages in processing time series data. By analyzing network traffic data, LSTM can identify abnormal behavior patterns, thereby helping to detect potential network attack events.

[0003] Specifically, LSTM controls the flow of information through its unique gating mechanism, enabling the model to remember past data and use this information at the appropriate time. This feature makes it very suitable for handling network attack detection tasks because many network attack behaviors have a certain sequence and temporal correlation. For example, by analyzing network traffic data over a period of time, LSTM can identify specific patterns or sequences that an attacker may use, thereby early warning potential security threats.

[0004] However, in practical applications, LSTM also shows certain limitations. On the one hand, when encountering new types of attacks, due to the lack of samples corresponding to the new types of attacks in the training dataset, LSTM may not be able to accurately identify these unknown types of attacks. On the other hand, for those attack behaviors that have changed in surface features but remain unchanged in deep features, LSTM may also have difficulty distinguishing normal network activities from malicious attack behaviors. Summary of the Invention

[0005] The purpose of the present invention is to provide a network intrusion detection method, apparatus, electronic device, and storage medium to improve the accuracy of detection results.

[0006] In a first aspect, the present invention provides a network intrusion detection method, including:

[0007] Obtain target network access behavior data to be detected;

[0008] Encode and decode the target network access behavior data using an eccentric model to obtain target decoded data;

[0009] Based on the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; among them, the LSTM model and the eccentric model are jointly trained.

[0010] In an alternative embodiment, after obtaining the target network access behavior data to be detected, the above method further includes:

[0011] Perform vectorization processing on the target network access behavior data to obtain the original target vector.

[0012] In an alternative embodiment, use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data, including:

[0013] Input the original target vector obtained by vectorizing the target network access behavior data into the eccentric model, and determine the decoded target vector output by the eccentric model as the target decoded data; wherein, the decoded target vector is obtained by the eccentric model encoding and decoding the original target vector.

[0014] In an alternative embodiment, based on the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result, including:

[0015] Combine the target decoded data and the target network access behavior data to obtain the target combined sequence data;

[0016] Input the target combined sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

[0017] In an alternative embodiment, the above method further includes:

[0018] Obtain multiple sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior;

[0019] Use the current eccentric model to be trained to encode and decode each sample network access behavior data to obtain the sample decoded data;

[0020] Based on each sample decoded data, use the current LSTM model to be trained to perform network intrusion detection on the corresponding sample network access behavior data to obtain the sample detection result;

[0021] Based on each sample detection result and the label of the corresponding sample network access behavior data, simultaneously update the parameters of the current eccentric model and the current LSTM model to obtain the trained eccentric model and LSTM model.

[0022] In an alternative embodiment, after obtaining a plurality of sample network access behavior data and their labels, the above method further includes:

[0023] Perform vectorization processing on each sample network access behavior data to obtain an original sample vector.

[0024] In a second aspect, the present invention provides a network intrusion detection device, including:

[0025] An acquisition module, configured to acquire target network access behavior data to be detected;

[0026] An encoding and decoding module, configured to encode and decode the target network access behavior data by using an eccentric model to obtain target decoded data;

[0027] A detection module, configured to perform network intrusion detection on the target network access behavior data by using an LSTM model according to the target decoded data to obtain a target detection result; wherein, the LSTM model and the eccentric model are jointly trained.

[0028] In an alternative embodiment, the above device further includes a training module, configured to:

[0029] Acquire a plurality of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior;

[0030] Encode and decode each sample network access behavior data by using a current eccentric model to be trained to obtain sample decoded data;

[0031] Perform network intrusion detection on the corresponding sample network access behavior data by using a current LSTM model to be trained according to each sample decoded data to obtain a sample detection result;

[0032] Simultaneously update the parameters of the current eccentric model and the current LSTM model according to each sample detection result and the label of the corresponding sample network access behavior data, so as to obtain a trained eccentric model and an LSTM model.

[0033] In a third aspect, the present invention provides an electronic device, including a memory and a processor. A computer program that can run on the processor is stored in the memory. When the processor executes the computer program, it implements the network intrusion detection method in any one of the foregoing embodiments.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processor, it executes the network intrusion detection method in any one of the foregoing embodiments.

[0035] The network intrusion detection method, device, electronic device and storage medium provided by the present invention can obtain target network access behavior data to be detected; encode and decode the target network access behavior data by using an eccentric model to obtain target decoded data; perform network intrusion detection on the target network access behavior data by using an LSTM model according to the target decoded data to obtain a target detection result; wherein, the LSTM model and the eccentric model are jointly trained. In this way, by cooperating the eccentric model with the LSTM model to detect network attacks, the problem of the limitations of shallow learning is effectively solved, and the detection result is more accurate. Brief Description of the Drawings

[0036] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0037] Figure 1 It is a schematic flowchart of a network intrusion detection method provided by an embodiment of the present invention;

[0038] Figure 2 It is a schematic data flow diagram of a network intrusion detection method provided by an embodiment of the present invention;

[0039] Figure 3 It is a schematic training flowchart of an LSTM model and an eccentric model provided by an embodiment of the present invention;

[0040] Figure 4 It is a schematic flowchart of another network intrusion detection method provided by an embodiment of the present invention;

[0041] Figure 5 It is a schematic structural diagram of a network intrusion detection device provided by an embodiment of the present invention;

[0042] Figure 6 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. Detailed Embodiments

[0043] The following will clearly and completely describe the technical solutions of the present invention in conjunction with the embodiments. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the scope of protection of the present invention.

[0044] Using LSTM (Long Short Term Memory) to detect network attacks is one of the commonly used methods at present. However, LSTM has certain limitations. For example, in the face of new attacks, it will be unable to recognize because the features of new attacks do not exist in the training data. It is also unable to recognize attacks with shallow feature changes but unchanged underlying features. Based on this, an network intrusion detection method, device, electronic device and storage medium provided by an embodiment of the present invention combines a classic LSTM neural network with an eccentric model to detect network intrusion, which can improve the accuracy of the detection results.

[0045] For the convenience of understanding this embodiment, first, a network intrusion detection method disclosed by an embodiment of the present invention will be introduced in detail.

[0046] An embodiment of the present invention provides a network intrusion detection method, which can be executed by an electronic device with data processing capabilities. Refer to Figure 1 the flowchart of a network intrusion detection method shown in the figure. This method mainly includes the following steps S110 to step S130:

[0047] Step S110, obtain the target network access behavior data to be detected.

[0048] Here, the network access behavior data that needs to be detected for network intrusion is used as the target network access behavior data to be detected. The network access behavior data can include various information, such as user identification information, timestamp, accessed URL (Uniform Resource Locator), HTTP (Hyper Text Transfer Protocol) method, browser and operating system information, geographical location information, and download / upload file information, etc.

[0049] Among them, the user identification information may include IP address, device ID, Cookie ID, etc., which are used to identify a specific user or device. The timestamp is the time point when each network request occurs, which helps to track the activity time and frequency of the user. The accessed URL is the specific address of the web page browsed by the user, which may include the protocol (such as HTTP / HTTPS), domain name, path, and query parameters. The HTTP method may be request methods such as GET and POST, indicating whether the user is obtaining resources or submitting data. The browser and operating system information may be the information included in the User-Agent string, such as browser type, version number, operating system platform, etc., which can be used to understand the user's technical environment. The geographical location information may be the location of the user inferred based on the IP address or other positioning technologies. The download / upload file information may include details such as file transfer size and format, which can be used to monitor bandwidth usage or potential security risks.

[0050] Step S120: Use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data.

[0051] The above eccentric model may be a traditional Deep Neural Network (DNN) network. The role of the eccentric model is to encode and then decode the network access behavior data to better extract deep features. The DNN network of the eccentric model may adopt an asymmetric encoding-decoding structure.

[0052] To facilitate the calculation of the eccentric model and the LSTM model, after obtaining the target network access behavior data to be detected, the above method further includes: performing vectorization processing on the target network access behavior data to obtain the original target vector.

[0053] It should be noted that the embodiments of the present invention do not limit the specific vectorization processing method. For example, the above vectorization processing method may adopt One-hot encoding or Bag of Words (BoW, that is, the word bag model), etc. Through One-hot encoding, a one-hot vector can be obtained, and through the word bag model, a word-bag vector can be obtained.

[0054] In some possible embodiments, the above step S120 may include: inputting the original target vector obtained by vectorizing the target network access behavior data into the eccentric model, and determining the decoded target vector output by the eccentric model as the target decoded data; wherein, the decoded target vector is obtained by the eccentric model encoding and decoding the original target vector.

[0055] Step S130: Based on the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; among them, the LSTM model and the eccentric model are jointly trained.

[0056] When the above LSTM model performs network intrusion detection, it not only uses the target network access behavior data, but also combines the target decoded data, which can effectively solve the problem of the limitations of shallow learning. It should be noted that for the network structures of the LSTM model and the eccentric model, their sizes and the number of parameters, etc. can be set according to the data volume of the training data set.

[0057] In some possible embodiments, the above step S130 may include: combining the target decoded data and the target network access behavior data to obtain the target combined sequence data; inputting the target combined sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

[0058] Optionally, the above target decoded data may be a decoded target vector. The target combined sequence data is in vector form. The decoded target vector can be combined with the original target vector corresponding to the target network access behavior data to obtain the target combined sequence vector.

[0059] It should be noted that the combination method of the above target decoded data and the target network access behavior data can be set according to actual needs and is not limited here. For example, if the original target vector is V and the decoded target vector is Dv, the target combined sequence vector can be [V, Dv] or [Dv, V], etc.

[0060] The network intrusion detection method provided by the embodiments of the present invention can obtain the target network access behavior data to be detected; use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data; based on the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; among them, the LSTM model and the eccentric model are jointly trained. In this way, by using the eccentric model in cooperation with the LSTM model to detect network attacks, the problem of the limitations of shallow learning is effectively solved, making the detection result more accurate.

[0061] The embodiment of the present invention also provides a joint training method for the above-mentioned eccentric model and LSTM model, including: obtaining multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; using the current eccentric model to be trained to encode and decode each piece of sample network access behavior data to obtain the decoded sample data; according to each piece of decoded sample data, using the current LSTM model to be trained to perform network intrusion detection on the corresponding sample network access behavior data to obtain sample detection results; according to each sample detection result and the label of the corresponding sample network access behavior data, simultaneously update the parameters of the current eccentric model and the current LSTM model to obtain the trained eccentric model and LSTM model.

[0062] Optionally, multiple pieces of the above-mentioned sample network access behavior data can be selected from a pre-constructed training dataset for training the eccentric model and the LSTM model; the label of the sample network access behavior data can be 0 or 1, where 0 indicates that the corresponding network access behavior is not a network intrusion behavior, and 1 indicates that the corresponding network access behavior is a network intrusion behavior.

[0063] Optionally, after obtaining multiple pieces of sample network access behavior data and their labels, the above method further includes: performing vectorization processing on each piece of sample network access behavior data to obtain an original sample vector. Based on this, the original sample vector can be input into the current eccentric model to obtain the decoded sample vector output by the current eccentric model, that is, the decoded sample data; after combining the decoded sample vector and the original sample vector, a sample combined sequence vector is obtained, and the sample combined sequence vector is input into the current LSTM model, and the current LSTM model outputs the sample detection result; according to the sample detection result and the label, calculate the model loss value, and simultaneously update the current eccentric model and the current LSTM model in the reverse direction according to the model loss value.

[0064] It should be noted that for the steps not described in detail during the training process, reference can be made to the corresponding content in the foregoing network intrusion detection method, which will not be elaborated here.

[0065] For the convenience of understanding, the above network intrusion detection method will be further introduced below.

[0066] The embodiment of the present invention proposes a network intrusion detection method for detecting network attacks by combining an eccentric model and an LSTM model, which can effectively solve the problem of the limitations of shallow learning and make the detection results more accurate.

[0067] The network intrusion detection method provided by the embodiments of the present invention is mainly divided into two parts: First, when training the LSTM model for network attack detection, the intervention of the eccentric model is added to enable the LSTM model to adapt to the existence of the eccentric model; Second, when using the LSTM model for network attack detection, the eccentric model is added to improve the accuracy of the detection results.

[0068] See Figure 2 The data flow diagram of a network intrusion detection method shown in the figure. The network access behavior is first vectorized, and the vector of the network access behavior is directly given to the eccentric model and the LSTM model; The eccentric model encodes and then decodes the vector of the network access behavior, and the vector after encoding and decoding by the eccentric model is then given to the LSTM model; The LSTM model processes the vector of the network access behavior and the decoded vector, and gives the detection result of whether the behavior is a network intrusion behavior.

[0069] See Figure 3 The training process diagram of an LSTM model and an eccentric model shown in the figure. The training process of the LSTM model and the eccentric model is as follows: First, obtain the training data set, and the training data set includes multiple network access behavior data and their labels; Then, vectorize the multiple data in the training data set and output them to the eccentric model and the LSTM model; The vector after encoding and decoding by the eccentric model is output to the LSTM model; The LSTM model outputs the prediction result (i.e., the sample detection result); Calculate the loss between the prediction result and the true result (i.e., the label), and at the same time, update the model parameters of the eccentric model and the LSTM model in reverse. Finally, when the iteration stop condition is met, the training is completed. Among them, the iteration stop condition can be set according to actual needs. For example, the number of iterations reaches the preset number threshold, or both the eccentric model and the LSTM model converge, etc.

[0070] An exemplary training process is as follows:

[0071] 1. Take n pieces of data from the training data set (n can be any integer greater than 0, such as powers of 2 like 2, 4, 8, etc.);

[0072] 2. For each of the n pieces of data taken out, perform vectorization processing. The vectorization can use any method, which can be a one - hot vector or a word - bag vector, and there is no requirement here;

[0073] 3. Let the vector of the above - mentioned piece of data be V;

[0074] Hand V over to the eccentric model D for encoding and decoding processing to obtain Dv;

[0075] V and Dv are combined into the sequence data [V, Dv];

[0076] Use [V, Dv] as input data and submit it to the LSTM model for calculation;

[0077] 4. Calculate the loss based on the prediction result and the true result output by the LSTM model, and simultaneously update the model parameters of the LSTM model and the eccentricity model according to the loss.

[0078] For the application of the above LSTM model + eccentricity model, see Figure 4 The flowchart of another network intrusion detection method shown in this embodiment. In this embodiment, the usage method of the combination of the LSTM model and the eccentricity model is as follows:

[0079] 1. Vectorize the access behavior to be detected to obtain V;

[0080] 2. Encode and decode V using the eccentricity model to obtain Dv;

[0081] 3. Combine Dv and V into a sequence vector [V, Dv];

[0082] 4. Submit [V, Dv] to the LSTM for detecting whether it is a network intrusion, and give a judgment on whether it is a network intrusion to complete the detection.

[0083] Corresponding to the above network intrusion detection method, an embodiment of the present invention also provides a network intrusion detection device. See Figure 5 The structural schematic diagram of a network intrusion detection device shown in this embodiment. The device includes:

[0084] An acquisition module 501, configured to acquire the target network access behavior data to be detected;

[0085] An encoding and decoding module 502, configured to encode and decode the target network access behavior data using the eccentricity model to obtain the target decoded data;

[0086] A detection module 503, configured to perform network intrusion detection on the target network access behavior data using the LSTM model according to the target decoded data to obtain the target detection result; wherein, the LSTM model and the eccentricity model are jointly trained.

[0087] The network intrusion detection device provided by the embodiment of the present invention can obtain the target network access behavior data to be detected; use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data; according to the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; wherein, the LSTM model and the eccentric model are jointly trained. In this way, by using the eccentric model in cooperation with the LSTM model to detect network attacks, the problem of the limitations of shallow learning is effectively solved, and the detection result is more accurate.

[0088] Further, the above device further includes a vectorization module for performing vectorization processing on the target network access behavior data to obtain the original target vector.

[0089] Further, the above encoding and decoding module 502 is specifically configured to: input the original target vector obtained by vectorizing the target network access behavior data into the eccentric model, and determine the decoded target vector output by the eccentric model as the target decoded data; wherein, the decoded target vector is obtained by the eccentric model encoding and decoding the original target vector.

[0090] Further, the above detection module 503 is specifically configured to: combine the target decoded data and the target network access behavior data to obtain the target combined sequence data; input the target combined sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

[0091] Further, the above device further includes a training module for:

[0092] Obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior;

[0093] Use the current eccentric model to be trained to encode and decode each piece of sample network access behavior data to obtain the sample decoded data;

[0094] According to each piece of sample decoded data, use the current LSTM model to be trained to perform network intrusion detection on the corresponding sample network access behavior data to obtain the sample detection result;

[0095] According to each sample detection result and the label of the corresponding sample network access behavior data, update the parameters of the current eccentric model and the current LSTM model simultaneously to obtain the trained eccentric model and LSTM model.

[0096] Further, the above training module is further configured to: perform vectorization processing on each piece of sample network access behavior data to obtain the original sample vector.

[0097] The network intrusion detection device provided in this embodiment has the same implementation principle and technical effects as those in the foregoing embodiment of the network intrusion detection method. For the sake of brief description, for the parts not mentioned in the embodiment of the network intrusion detection device, reference may be made to the corresponding content in the foregoing embodiment of the network intrusion detection method.

[0098] As Figure 6 shown, an electronic device 600 provided in an embodiment of the present invention includes: a processor 601, a memory 602, and a bus. The memory 602 stores a computer program that can run on the processor 601. When the electronic device 600 runs, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the computer program to implement the foregoing network intrusion detection method.

[0099] Specifically, the foregoing memory 602 and processor 601 can be general-purpose memory and processor, and no specific limitation is made here.

[0100] An embodiment of the present invention further provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium, and when the computer program is run by a processor, it executes the network intrusion detection method described in the foregoing method embodiment. The computer-readable storage medium includes: various media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk, or an optical disc that can store program codes.

[0101] The term "and / or" in this article is merely a description of the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B may represent: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the term "at least one" in this article means any one of multiple or any combination of at least two of multiple. For example, including at least one of A, B, and C may represent including any one or more elements selected from the set composed of A, B, and C.

[0102] In all the examples shown and described here, any specific value should be construed as merely exemplary, not as a limitation. Therefore, other examples of the exemplary embodiments may have different values.

[0103] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of devices, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagram may represent a module, a segment of a program, or a part of code that contains one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as combinations of blocks in the block diagram and / or flowchart, may be implemented by a dedicated hardware-based system that performs the specified functions or actions, or may be implemented by a combination of dedicated hardware and computer instructions.

[0104] In several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation. For another example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the couplings or direct couplings or communication connections shown or discussed with each other may be through some communication interfaces, and the indirect couplings or communication connections of the devices or modules may be in electrical, mechanical, or other forms.

[0105] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place, or may be distributed to multiple network modules. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0106] In addition, the functional modules in various embodiments of the present invention can be integrated into one processing module, or each module can exist physically alone, or two or more modules can be integrated into one module.

[0107] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A network intrusion detection method, characterized in that Including: Obtain target network access behavior data to be detected; Encode and decode the target network access behavior data by using an eccentric model to obtain target decoded data; wherein, the eccentric model is a DNN network adopting an asymmetric encoding-decoding structure; According to the target decoded data, use an LSTM model to perform network intrusion detection on the target network access behavior data to obtain a target detection result; wherein, the LSTM model and the eccentric model are jointly trained; The step of, according to the target decoded data, using an LSTM model to perform network intrusion detection on the target network access behavior data to obtain a target detection result includes: Combine the target decoded data and the target network access behavior data to obtain target combined sequence data; Input the target combined sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

2. The method according to claim 1, characterized in that After obtaining the target network access behavior data to be detected, the method further includes: Perform vectorization processing on the target network access behavior data to obtain an original target vector.

3. The method according to claim 1, wherein The step of using an eccentric model to encode and decode the target network access behavior data to obtain target decoded data includes: Input the original target vector obtained by performing vectorization processing on the target network access behavior data into the eccentric model, and determine the decoded target vector output by the eccentric model as the target decoded data; wherein, the decoded target vector is obtained by the eccentric model encoding and decoding the original target vector.

4. The method according to claim 1, wherein The method further includes: Obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Use a current eccentric model to be trained to encode and decode each piece of the sample network access behavior data to obtain sample decoded data; According to each piece of the sample decoded data, use a current LSTM model to be trained to perform network intrusion detection on the corresponding sample network access behavior data to obtain a sample detection result; According to each sample detection result and the label of the corresponding sample network access behavior data, simultaneously update the parameters of the current eccentric model and the current LSTM model to obtain the trained eccentric model and the LSTM model.

5. The method according to claim 4, wherein After obtaining multiple pieces of sample network access behavior data and their labels, the method further includes: Perform vectorization processing on each piece of the sample network access behavior data to obtain an original sample vector.

6. A network intrusion detection device, characterized in that, Including: An acquisition module, configured to obtain target network access behavior data to be detected; An encoding and decoding module, configured to encode and decode the target network access behavior data by using an eccentric model to obtain target decoded data; wherein, the eccentric model is a DNN network adopting an asymmetric encoding-decoding structure; A detection module, configured to, according to the target decoded data, use an LSTM model to perform network intrusion detection on the target network access behavior data to obtain a target detection result; wherein, the LSTM model and the eccentric model are jointly trained; The detection module is specifically configured to: combine the target decoded data and the target network access behavior data to obtain target combined sequence data; input the target combined sequence data into the LSTM model to obtain a target detection result output by the LSTM model.

7. The device according to claim 6, wherein The device further includes a training module, configured to: obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; encode and decode each piece of the sample network access behavior data by using a current eccentric model to be trained to obtain sample decoded data; perform network intrusion detection on each piece of the sample network access behavior data by using a current LSTM model to be trained according to each piece of the sample decoded data to obtain sample detection results; update the parameters of the current eccentric model and the current LSTM model simultaneously according to each sample detection result and the label of the corresponding sample network access behavior data, so as to obtain the trained eccentric model and the LSTM model.

8. An electronic device, comprising a memory and a processor, wherein a computer program capable of running on the processor is stored in the memory, characterized in that, When the processor executes the computer program, it implements the network intrusion detection method according to any one of claims 1-5.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is run by the processor, it executes the network intrusion detection method according to any one of claims 1-5.

Images