Intelligent network attack detection method based on flow analysis and electronic equipment

Abstract

The invention discloses an intelligent network attack detection method based on traffic analysis and electronic equipment. The method comprises the following steps: acquiring traffic data in a network; a pre-trained automatic encoder AE is constructed, the automatic encoder AE comprises an encoder module, a potential space and a decoder module, the encoder module adopts two layers of long short-term memory networks, and a Dropout layer is inserted between the two layers of long short-term memory networks and is used for receiving input traffic data and performing data compression and feature extraction to obtain key traffic features; and the potential space adopts a bidirectional gating circulation unit to carry out key traffic feature classification, and outputs a detection result indicating whether the traffic data has an abnormal traffic type or not through a decoder module. According to the method, the important traffic characteristics in the traffic can be fully extracted, and the problems of low detection rate and high false alarm rate caused by solving the problem of data imbalance by using a sampling technology are avoided while data dimension reduction is completed.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an intelligent network attack detection method based on traffic analysis and an electronic device. Background Art

[0002] The popularity of the Internet has greatly facilitated people's lives, but it also hides an increasing risk of network attacks. In order to identify and prevent attack access and attack behaviors in network traffic, network attack detection technology has been deployed in network systems and computer systems.

[0003] Network attack detection technology ensures the security and availability of the system by continuously monitoring network traffic. However, with the sharp increase in network traffic and the emergence of new attacks, traditional network attack detection technology faces major challenges in accuracy and scalability due to the imbalance of data sets and the inability to efficiently select important features in traffic data. The overall framework of intelligent network attack detection is as follows: Figure 1 As shown, intelligent network attack detection technology can automatically learn useful information features (such as the behavior of normal traffic and the characteristics of attack traffic) from big data with a high accuracy.

[0004] Network attack detection is mainly divided into two categories: misuse-based and anomaly-based attack detection. The misuse-based attack detection system can detect existing attack behaviors well by building a rule library of normal behavior and attack behavior, but its disadvantage is that it cannot effectively detect new attacks; while the anomaly-based attack detection system builds a detection model based on normal network behavior in historical data to learn the deviation between normal behaviors. When the deviation value exceeds a certain threshold, it can be considered that abnormal behavior has occurred. This protection method can detect new and unknown abnormal behaviors, but there are problems with high false alarm and missed alarm rates.

[0005] In recent years, anomaly-based intelligent attack detection methods have become increasingly popular due to their ability to detect new and unknown abnormal behaviors. Generally speaking, the steps of intelligent attack detection technology are as follows: Figure 2 As shown in the figure, its key steps are training data sample balancing, feature selection and anomaly detection. These three key steps are particularly important for improving the performance of network attack detection systems, including how to choose sampling technology to balance training data samples, how to choose data dimension reduction methods to efficiently select features, and how to choose the classification algorithm of the attack detection system. The above three aspects play a vital role in the performance of anomaly-based attack detection, which are explained as follows:

[0006] Regarding the problem of balancing training data samples, the traffic data in the current network environment is seriously unbalanced. The difference in quantity between abnormal traffic and normal traffic is very large. The difference in quantity between the 15 different types of traffic data in the CICIDS2017 dataset is very large, and this will only be worse in the real network environment. Therefore, the commonly used sampling technology solves the problem of data distribution imbalance in common unbalanced datasets from the data level, thereby improving the classification effect of the algorithm. Although sampling technology can handle this kind of data imbalance, whether the minority attack samples generated by oversampling technology are valuable and whether some majority class samples selected by undersampling technology can replace the overall samples is an unresolved issue.

[0007] Regarding the problem of data dimensionality reduction, high-dimensional data features are an important issue in network attack detection, and this problem becomes more prominent as the size of available data sets grows. The main motivation for reducing data dimensions and the number of features is to reduce training time and improve the classification accuracy of the algorithm. Dimensionality reduction methods are mainly divided into dimensionality reduction methods based on feature extraction and dimensionality reduction methods based on feature selection. Feature extraction methods convert existing features into a new feature space with lower dimensions. New features are created based on linear or nonlinear combinations of original features, such as principal component analysis (PCA) and linear discriminant analysis (LDA). Feature selection methods reduce dimensions by selecting a subset of features that minimizes a specific cost function. Common feature selection techniques mainly include filtering methods and classifier-dependent methods. Although the above methods can be used to generate or extract traffic features, they cannot select the most important traffic features.

[0008] Regarding the classification algorithm problem, the current network attack detection model based on traditional machine learning has poor accuracy, while the network attack detection model based on deep learning faces the problem of insufficient real-time performance. Designing a suitable network model to balance accuracy and real-time performance is the third difficulty.

[0009] Therefore, how to provide an intelligent network attack detection method and electronic device based on traffic analysis with a high accuracy is a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0010] In view of the above research status and existing problems, the present invention provides an intelligent network attack detection method and electronic device based on traffic analysis, which can fully extract important traffic features in the traffic, and avoid the low detection rate and high false alarm rate problems caused by using sampling technology to solve the data imbalance problem while completing data dimensionality reduction.

[0011] The present invention provides an intelligent network attack detection method based on traffic analysis, comprising the following steps:

[0012] Obtain network traffic data;

[0013] Construct a pre-trained autoencoder AE, which includes an encoder module, a latent space, and a decoder module:

[0014] The encoder module adopts a two-layer long short-term memory network and inserts a Dropout layer between the two layers of long short-term memory networks to receive input traffic data and perform data compression and feature extraction to obtain key traffic features;

[0015] The latent space uses a bidirectional gated recurrent unit to classify key traffic features, and outputs a detection result indicating whether the traffic data has an abnormal traffic type through a decoder module.

[0016] Preferably, the pre-training step of the autoencoder AE comprises:

[0017] Acquire a training data set, the training data set including flow data and corresponding type labels, the type labels including normal flow types and abnormal flow types, and the quantity difference between flow data of different abnormal flow types is greater than a set value;

[0018] The training data set is input into the autoencoder AE for pre-training until a training end condition is met, thereby obtaining a pre-trained autoencoder AE.

[0019] Preferably, the encoder module includes a first layer LSTM, a Dropout layer and a second layer LSTM in sequence according to the data transmission direction; wherein,

[0020] The first layer LSTM performs a dimensionality reduction on the input high-dimensional traffic data sequence and extracts high-order features in the traffic data sequence;

[0021] The Dropout layer randomly drops a specified number of neurons;

[0022] The second LSTM layer receives the high-order features transmitted from the Dropout layer and performs secondary dimensionality reduction to output the key traffic features.

[0023] Preferably, the latent space includes, in order according to the data transmission direction: a Bi-GRU layer, a Dropout layer, a GRU layer, a normalization layer and a fully connected layer; wherein,

[0024] The Bi-GRU layer includes a forward GRU and a backward GRU, wherein the forward GRU is used to process a positive key flow feature sequence from time t=1 to t=T, and capture semantic information from the past to the present; the backward GRU is used to process a reverse key flow feature sequence from time t=T to t=1, and capture semantic information from the future to the present;

[0025] The Dropout layer randomly drops a specified number of neurons;

[0026] The GRU layer is used to further capture the temporal dependencies between key traffic feature sequences;

[0027] The normalization layer is used to normalize the output of the GRU layer;

[0028] The fully connected layer is used to map the normalized feature vector to the final output space and output the abnormal traffic detection result.

[0029] Preferably, the step of obtaining traffic data in the network includes:

[0030] Preprocessing operations are performed on the traffic data, including one or more of the following: removing noise, deleting invalid values, and mapping string type data to one-hot codes.

[0031] The present invention also provides an electronic device, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the intelligent network attack detection method based on traffic analysis when executing the program.

[0032] The intelligent network attack detection method based on traffic analysis and the electronic device proposed in the present invention have the following beneficial effects compared with the prior art:

[0033] The automatic encoder AE of the present invention adopts a two-layer long short-term memory network to better extract the time series features in the data, without considering the problem of imbalance of the original data set, thereby eliminating the features with low information content in network attack detection. Some neurons are randomly dropped through the Dropout layer to avoid the model from over-relying on certain features, thereby improving the robustness of the neural network and enhancing the generalization ability. On the one hand, the automatic selection of important features is realized, that is, there is no need to use additional feature engineering technology, such as feature extraction technology such as principal component analysis and linear discriminant analysis or other feature selection methods to realize the extraction of important features; on the other hand, the task of compressing high-dimensional input into low-dimensional important features is completed.

[0034] The automatic encoder AE of the present invention adopts Bi-GRU to learn relevant semantic information in traffic data from two perspectives: the past and the future. On the one hand, it can avoid the problems of gradient vanishing and gradient explosion that are prone to occur in RNN. On the other hand, the number of parameters of GRU is much smaller than that of LSTM, which can reduce the training and reasoning time of the model and improve the real-time performance of network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on the provided drawings without creative work.

[0036] Figure 1 It is a schematic diagram of the overall framework of intelligent network attack detection provided by an embodiment of the present invention;

[0037] Figure 2 is a flow chart of an intelligent network attack detection technology provided by an embodiment of the present invention;

[0038] Figure 3 is a schematic diagram of an automatic encoder AE provided in an embodiment of the present invention;

[0039] Figure 4 is a network structure diagram of an automatic encoder AE provided by an embodiment of the present invention;

[0040] Figure 5 LSTM unit structure diagram provided by an embodiment of the present invention;

[0041] Figure 6 is a network structure diagram of a Bi-GRU provided in an embodiment of the present invention;

[0042] Figure 7 It is a GRU unit structure diagram provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] like Figure 3 As shown, the first aspect of the embodiment of the present invention provides an intelligent network attack detection method based on traffic analysis, and the specific execution steps are as follows:

[0045] Obtain network traffic data;

[0046] A pre-trained autoencoder AE is constructed. The autoencoder AE includes an encoder module, a latent space, and a decoder module. The encoder module adopts a two-layer long short-term memory network, and a Dropout layer is inserted between the two layers of long short-term memory networks to receive input traffic data and perform data compression and feature extraction to obtain key traffic features. The latent space adopts a bidirectional gated recurrent unit to classify key traffic features, and outputs the detection result indicating whether there is an abnormal traffic type in the traffic data through the decoder module.

[0047] During the specific execution of this embodiment, the high-dimensional raw data in the data set is passed to the input of the autoencoder, and then passes through a three-layer encoder for data compression and dimensionality reduction, thereby screening out the most important 15-dimensional features, and passing these lower-dimensional features to the Bi-GRU module for further learning of temporal features, and finally classifying them as normal or abnormal.

[0048] Since the number of normal traffic and abnormal traffic, and different types of abnormal traffic in common data sets are very different, as shown in Table 1, there are 15 different types of traffic data in the CICIDS2017 data set.

[0049] Table 1 Different types of traffic data

[0050] Traffic type label quantity BENIGN 2271320 DosHulk 230124 PortScan 158804 DDoS 128025 DosGoldenEye 10293 FTP-Patator 7935 SSH-Patator 5897 Dosslowloris 5796 DosSlowhttptest 5499 Bot 1956 WebAttack-BruteForce 1507 WebAttack-XSS 652 Infiltration 36 WebAttack-SqlInjection 21 Heartbleed 11

[0051] In order to solve this data imbalance problem, the present invention selects to use the network structure of the autoencoder. The architecture of the autoencoder is as follows Figure 4 shown.

[0052] The UNSW-NB15 dataset is used as the experimental dataset of the present invention. The autoencoder AE includes an input layer, an encoder module, a latent space, a decoder module and an output layer. The input layer receives the dataset data X and passes it to the encoder module. The data is processed by the encoder module, the latent space and the decoder module in turn, and finally the classification result X' is output through the output layer.

[0053] In one embodiment, the step of obtaining traffic data in the network includes:

[0054] The traffic data is preprocessed, including one or more of the following: removing noise, deleting invalid values, and mapping string-type data to one-hot codes. The high-dimensional raw data in the dataset is passed to the input of the autoencoder after being preprocessed by removing noise, deleting invalid values, and mapping string-type data to one-hot codes.

[0055] Table 2: Noise data in the original data

[0056] NaN Infinity 255319 42553.2 0 2000000 155797 10869.6 Infinity Infinity 0 2000000

[0057] There is a noise problem in the original high-dimensional traffic data. The noise in the original data is eliminated through data preprocessing steps. Taking the CICIDS2017 dataset as an example, each data in the dataset is a 79-dimensional vector, that is, it contains 78 features and 1 label. There are non-numeric data (including NaN values, INF, etc.) in the feature data, and some feature data are not normalized, as shown in Table 2. By screening out non-numeric data (NaN values, Infinity) and using the z-score formula to standardize non-normalized feature data such as 255319 and 2000000, it is used for subsequent feature selection and classification.

[0058] In one embodiment, the pre-training step of the autoencoder AE includes:

[0059] Obtain a training data set, the training data set includes traffic data and corresponding type labels, the type labels include normal traffic types and abnormal traffic types, and the quantity difference between traffic data of different abnormal traffic types is greater than a set value;

[0060] The training data set is input into the autoencoder AE for pre-training until the training end condition is met, that is, when the performance of the validation set is stable and the loss converges, the training end condition is considered to be met, and the pre-trained autoencoder AE is obtained.

[0061] In one embodiment, the encoder module includes a first LSTM layer, a Dropout layer and a second LSTM layer in sequence according to the data transmission direction; wherein the first LSTM layer performs a dimensionality reduction on the input high-dimensional traffic data sequence and extracts high-order features in the traffic data sequence; the Dropout layer randomly drops a specified number of neurons; the second LSTM layer receives the high-order features transmitted from the Dropout layer and performs a second dimensionality reduction to output key traffic features.

[0062] It should be noted that the encoder module of the traditional autoencoder uses a fully connected layer to compress data. In order to better extract the time series features in the data, the embodiment of the present invention adopts a two-layer long short-term memory network (Long Short-Term Memory, i.e., LSTM) as the network layer in the encoder of the autoencoder AE, and uses a Dropout layer between the two LSTM layers to prevent overfitting.

[0063] In this embodiment, the 196-dimensional flow data X after data preprocessing is passed to the encoder module of AE through the input layer, which consists of 1 layer of LSTM, 1 layer of Dropout and 1 layer of LSTM. The unit structure and related formulas of LSTM are as follows: Figure 5As shown in the figure, its basic unit is composed of multiple gates, including: Forget Gate, Input Gate, Candidate Cell State, Output Gate, Cell State, and Hidden State.

[0064] Forget Gate: Determines which information should be forgotten from the cell state. The output of the forget gate is a value in the range [0,1], representing the degree to which each storage unit is forgotten.

[0065] Expression: f t =σ(W f ·[h t-1 ,x t ]+b f );

[0066] Among them, σ represents the sigmoid activation function, W f and b f are the weight matrix and bias term respectively.

[0067] Input Gate: Controls the extent to which new information enters the cell state.

[0068] expression:

[0069] First, the input gate determines which values ​​need to update the cell state (i t ), then, the candidate cell state Provides new candidate values. These two steps combined determine the degree of update of the cell state. σ and tanh are sigmoid and hyperbolic tangent activation functions respectively, W i , W c , b i , b c are the corresponding weight matrices and bias terms.

[0070] Cell State: It is the core of LSTM and stores long-term memory. Through the forget gate and input gate, the old state information is appropriately deleted and the new candidate information is added.

[0071] expression:

[0072] Output Gate: Decides which parts should become outputs based on the current cell state.

[0073] expression:

[0074] The output gate first determines which parts of the cell state should be output, and then processes the selected parts through the tanh activation function to obtain the final output h t , W o and b o are the corresponding weight matrices and bias terms.

[0075] The LSTM unit dynamically controls the information flow through three gates (forget gate, input gate and output gate) and a cell state, thus effectively solving the problem of long-term dependency. The update of each gate and cell state involves the implicit state h of the previous moment. t-1 and the current input x t , and perform weighted summation through their respective weight matrices and bias terms, and then perform nonlinear transformation through the activation function.

[0076] In one embodiment, the potential space adopts a bi-gate recurrent unit (Bi-GRU) to detect network attacks. According to the data transmission direction, it includes: Bi-GRU layer, Dropout layer, GRU layer, normalization layer and full connection layer; wherein, the Bi-GRU layer includes forward GRU and backward GRU, the forward GRU is used to process the positive key traffic feature sequence from time t=1 to t=T, and capture the semantic information from the past to the present; the backward GRU is used to process the reverse key traffic feature sequence from time t=T to t=1, and capture the semantic information from the future to the present; the Dropout layer randomly drops a specified number of neurons; the GRU layer is used to further capture the temporal dependency between the key traffic feature sequences; the normalization layer is used to normalize the output of the GRU layer; the full connection layer is used to map the normalized feature vector to the final output space and output the abnormal traffic detection result.

[0077] The Bi-GRU structure is as follows Figure 6 As shown in the figure, Bi-GRU is divided into forward GRU and backward GRU. The forward GRU is responsible for processing the forward input sequence from time t=1 to t=T, capturing the semantic information from the past to the present, while the backward GRU is responsible for processing the reverse input sequence from time t=T to t=1, capturing the semantic information from the future to the present, that is, Bi-GRU learns the relevant semantic information in the traffic data from both the past and the future.

[0078] The input of Bi-GRU is the 15-dimensional feature representation compressed by the encoder in AE. It further learns the 15-dimensional important features after AE dimensionality reduction, and finally outputs two categories: normal traffic or abnormal traffic.

[0079] Bi-GRU module Figure 3The Bi-GRU Model in the model includes 1 Bi-GRU layer, 1 Dropout layer, 1 GRU layer, 1 BatchNorm layer and 1 Fully Connect layer. It learns the temporal semantic features of 15-dimensional input from the past and future directions. Its hidden layer unit dimension is 384 and its output dimension is 768. The 768-dimensional output data is used as the input of the Dropout layer. Dropout randomly drops some neurons with a probability of 0.5 to avoid the model from over-relying on certain features, and passes the 768-dimensional output to the GRU layer. The hidden layer unit of the GRU layer is 2, so the 2-dimensional data it outputs is used as the input of the BatchNorm layer. The BatchNorm layer is responsible for normalizing the data. The normalized data passes through the final Fully Connect layer and is finally classified as abnormal or normal.

[0080] The unit structure of the Bi-GRU layer is consistent with that of the GRU. It also has an update gate, a reset gate, and a candidate state. The unit structure and related formulas of the GRU are as follows: Figure 7 shown.

[0081] Reset Gate: Determines how much historical information needs to be reset. The output of the reset gate is a value in the range [0,1], representing the degree to which each storage unit is reset.

[0082] Expression: r t =σ(W r ·[h t-1 , x t ]+b r );

[0083] Where σ represents the sigmoid activation function, W r and b r are the weight matrix and bias term respectively.

[0084] Update Gate: determines how much new information should be added to the current state. The output of the update gate is also a value in the range [0,1], representing the degree to which each storage unit is updated.

[0085] Expression: z t =σ(W z ·[h t-1 , x t ]+b z );

[0086] Where W r and b r are the weight matrix and bias term respectively.

[0087] Candidate hidden state: Based on the output of the reset gate and the hidden state h at the previous moment t-1 , and the current input x t to compute a new candidate hidden state.

[0088] Calculation formula:

[0089] Where tanh is the hyperbolic tangent activation function.

[0090] Hidden state: Combine the output of the update gate and the candidate hidden state to update the hidden state at the current moment. This formula shows that if the output of the update gate is close to 1, more new information will be added to the hidden state; conversely, if the output of the update gate is close to 0, more of the previous hidden state will be retained.

[0091] Update formula:

[0092] On the one hand, using Bi-GRU can avoid the gradient vanishing and gradient exploding problems that are prone to occur in RNN. On the other hand, the number of parameters of GRU is much smaller than that of LSTM, which can reduce the training and reasoning time of the model and improve the real-time performance of network attack detection.

[0093] The second aspect of an embodiment of the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the steps of the intelligent network attack detection method based on traffic analysis of the first aspect of the embodiment are implemented.

[0094] The present invention uses AE to extract important features from traffic data, while completing data dimensionality reduction and avoiding the problems of low detection rate and high false alarm rate caused by using sampling technology to solve the problem of data imbalance;

[0095] The present invention uses the deep learning method LSTM as the middle layer of the stacked autoencoder to fully extract the timing information in the traffic, and adopts Bi-GRU to further learn the important traffic features extracted by AE. The network attack detection rate is improved to 96.01%, the recall rate is improved to 99.98%, and the F1 score is improved to 97.96%. The overall effect is significantly improved compared with the existing network attack detection methods. Table 3 is the detection effect tested on the U NSW-NB15 dataset.

[0096] Table 3: Comparison of experimental data

[0097]

[0098] The above is a detailed introduction to an intelligent network attack detection method and electronic device based on traffic analysis provided by the present invention. Specific examples are used in this article to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea; at the same time, for general technicians in this field, according to the idea of ​​the present invention, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0099] In this article, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

Claims

1. An intelligent network attack detection method based on traffic analysis, characterized in that: The steps include: Obtain network traffic data; Construct a pre-trained autoencoder AE, which includes an encoder module, a latent space, and a decoder module: The encoder module adopts a two-layer long short-term memory network and inserts a Dropout layer between the two layers of long short-term memory networks to receive input traffic data and perform data compression and feature extraction to obtain key traffic features; The latent space uses a bidirectional gated recurrent unit to classify key traffic features, and outputs a detection result indicating whether the traffic data has an abnormal traffic type through a decoder module.

2. The intelligent network attack detection method based on traffic analysis according to claim 1 is characterized in that: The pre-training steps of the autoencoder AE include: Acquire a training data set, the training data set including flow data and corresponding type labels, the type labels including normal flow types and abnormal flow types, and the quantity difference between flow data of different abnormal flow types is greater than a set value; The training data set is input into the autoencoder AE for pre-training until a training end condition is met to obtain a pre-trained autoencoder AE.

3. The intelligent network attack detection method based on traffic analysis according to claim 1 is characterized in that: The encoder module includes a first layer LSTM, a Dropout layer and a second layer LSTM in sequence according to the data transmission direction; wherein, The first layer LSTM performs dimensionality reduction on the input high-dimensional traffic data sequence and extracts high-order features in the traffic data sequence; The Dropout layer randomly drops a specified number of neurons; The second LSTM layer receives the high-order features transmitted from the Dropout layer and performs secondary dimensionality reduction to output the key traffic features.

4. The intelligent network attack detection method based on traffic analysis according to claim 1 is characterized in that: The latent space includes, in order according to the data transmission direction: a Bi-GRU layer, a Dropout layer, a GRU layer, a normalization layer, and a fully connected layer; wherein, The Bi-GRU layer includes a forward GRU and a backward GRU, wherein the forward GRU is used to process a positive key flow feature sequence from time t=1 to t=T, and capture semantic information from the past to the present; the backward GRU is used to process a reverse key flow feature sequence from time t=T to t=1, and capture semantic information from the future to the present; The Dropout layer randomly drops a specified number of neurons; The GRU layer is used to further capture the temporal dependencies between key traffic feature sequences; The normalization layer is used to normalize the output of the GRU layer; The fully connected layer is used to map the normalized feature vector to the final output space and output the abnormal traffic detection result.

5. The intelligent network attack detection method based on traffic analysis according to claim 1 is characterized in that: The step of obtaining traffic data in the network includes: Preprocessing operations are performed on the traffic data, including one or more of the following: removing noise, deleting invalid values, and mapping string type data to one-hot codes.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the intelligent network attack detection method based on traffic analysis as described in any one of claims 1 to 5 are implemented.

Images