Network intrusion detection method based on clustering oversampling and Transform

Abstract

The invention discloses a network intrusion detection method based on clustering oversampling and Transform, and relates to the technical field of network security and deep learning. The method comprises the following steps: carrying out data cleaning on network flow data, balancing a data set through a clustering oversampling technology, and extracting characteristic values through a method of combining information gain and rapid correlation filtering; normalizing the feature values by adopting a Max-Min normalization method, converting the feature values into images according to timestamps and feature sizes, and marking attack types; amplifying the generated image by adopting a bilinear interpolation method, and dividing the image into a training set and a test set; and fine tuning is carried out on the classification head through transfer learning, deep features of network traffic data are extracted, and accurate classification of normal traffic and various attack traffic is realized. According to the network intrusion detection method based on clustering oversampling and Transform, different types of network attacks can be effectively identified, and the accuracy rate and reliability of intrusion detection are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of network security and deep learning technology, and in particular to a network intrusion detection method based on clustering oversampling and Transformer. Background Art

[0002] With the rapid development of the information age, the Internet has been deeply integrated into personal life, business operations and national infrastructure. However, the frequency and complexity of cyber attacks continue to increase, which not only threatens personal privacy and data security, but also poses a major risk to social economy and national security. Cyberspace security issues have become a key problem that needs to be solved urgently around the world. In order to cope with the increasingly severe security challenges, the Intrusion Detection System (IDS), as an active defense tool, can monitor network data transmission behavior in real time, identify abnormal activities and respond in a timely manner, and is an important means to protect network security.

[0003] The concept of intrusion detection was first proposed by James Anderson in 1980. At present, intrusion detection technology is mainly divided into two categories: misuse detection-based and anomaly detection-based. Misuse-based intrusion detection systems rely on signature knowledge bases to identify known attacks, with high accuracy, but limited ability to detect unknown threats; while anomaly detection-based systems have the potential to detect unknown attacks by comparing normal and abnormal behaviors. However, traditional anomaly detection methods mostly rely on shallow machine learning models (such as decision trees, random forests, XGBoost, etc.), which rely on artificial feature engineering and are insufficient when dealing with high-dimensional and complex data.

[0004] As data size and complexity increase, deep learning methods have made significant progress in image recognition, natural language processing and other fields. The deep learning theory proposed by Hinton in 2006 automatically extracts high-dimensional features through deep neural networks, solving the limitations of traditional machine learning in feature extraction. In recent years, deep learning has been gradually applied to the field of intrusion detection, including autoencoders, recurrent neural networks (RNNs), long short-term memory networks (LSTMs), gated recurrent units (GRUs) and convolutional neural networks (CNNs). These methods have improved detection accuracy, but still face many challenges:

[0005] Class imbalance problem: In network traffic data, attack traffic is often sparsely distributed as a minority class sample. Traditional models tend to favor the majority class (normal traffic) during training, making it difficult to accurately identify low-frequency attack samples.

[0006] Limitations of feature extraction: Traditional models do not adequately capture the temporal characteristics and global correlation of network traffic and are unable to fully characterize complex network traffic patterns.

[0007] Inspired by the successful application of the Transformer architecture in the field of natural language processing, Vision Transformer (ViT) extends the Transformer structure to the field of image processing and demonstrates excellent feature extraction capabilities. ViT models the global dependency of input data through the self-attention mechanism, which not only avoids the sequential processing limitations of recurrent neural networks, but also significantly improves the efficiency of parallel computing. The multi-head attention mechanism enables ViT to mine features in multiple subspaces at the same time, further enhancing the model's ability to express complex patterns. In addition, the widespread application of transfer learning technology in the field of deep learning, by migrating the weights of pre-trained models to new tasks, not only reduces the dependence on large-scale annotated data, but also significantly improves the performance of the model in small sample scenarios. Summary of the invention

[0008] The purpose of this invention is to propose a network intrusion detection method based on cluster oversampling and Transformer, which is used to solve the problem that the traditional anomaly detection method model relies on artificial feature engineering and performs insufficiently when dealing with high-dimensional and complex data. It can effectively identify different types of network attacks and significantly improve the accuracy and reliability of intrusion detection.

[0009] To achieve the above purpose, the present invention proposes a network intrusion detection method based on clustering oversampling and Transformer, and the specific steps are as follows:

[0010] S1. Clean the network traffic data and use K-means SMOTE clustering oversampling technology to cluster, filter and oversample the data set;

[0011] S2, using a method combining information gain and fast correlation filtering to remove irrelevant, unnecessary and noise features in network traffic data, retaining key effective information features;

[0012] S3, using a normalization method to normalize the numerical features in the network traffic data, and then converting the network traffic data into images according to timestamps and feature sizes and marking the attack types;

[0013] S4, using bilinear interpolation method to enlarge the generated image, and divide it into training set and test set according to the proportion;

[0014] S5. Use the VIT model pre-trained on ImageNet for transfer learning, extract image features and train a classifier to perform aggressive detection of network traffic and identify intrusion traffic.

[0015] Preferably, in S1, cleaning the network traffic data includes the following steps:

[0016] S111, deleting duplicate data in the network traffic data;

[0017] S112, detecting infinite values ​​existing in the data, including positive infinite values ​​and negative infinite values, and replacing the infinite values ​​with null values;

[0018] S113. Use the median to fill in missing values, where the missing values ​​include missing values ​​originally existing in the data and infinite values ​​replaced by null values.

[0019] Preferably, in S1, the K-means SMOTE clustering oversampling technology is used to cluster, filter and oversample the data set, and the specific steps are as follows:

[0020] S121. In the clustering stage, the k-means algorithm is used to divide the data into k clusters. The clustering criterion function formula of the k-means algorithm is as follows:

[0021]

[0022] Among them, S is the error sum of all data, k is the number of specified clusters, C j is the jth cluster, p is the cluster C j The data in m j It is cluster C j The average value of the data in , where i is an integer.

[0023] S122. In the filtering stage, select clusters to be oversampled and retain clusters with a higher proportion of minority class samples; then, allocate the number of synthetic samples to be generated and allocate more samples to clusters with sparse minority class samples.

[0024] S123. In the oversampling stage, the SMOTE method is used to achieve the target ratio of minority class and majority class instances.

[0025] Preferably, the K-means SMOTE algorithm has the following specific steps:

[0026] Step 1: Cluster the input data and filter out the clusters of minority class data and majority class data;

[0027] Step 2: For each filtered cluster, calculate the sampling weight according to the density of its minority class data;

[0028] Step 3: Use the SMOTE method to process each filtered cluster and calculate the sampling weight based on the density of its minority class data.

[0029] Preferably, in S2, a method combining information gain and fast correlation filtering is used to remove irrelevant, unnecessary and noise features in the network traffic data. The specific steps are as follows:

[0030] S21. Calculate the importance score of each feature using information gain, sort them from high to low, and select features whose cumulative importance reaches 90%. The information gain calculation formula is as follows:

[0031] IG(D|X)=H(D)-H(D|X);

[0032] Among them, H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition of known random variable X, and IG(D|X) is the importance of feature X;

[0033] S22. Use a fast correlation filtering method to further reduce redundancy between features. The calculation formula of the fast correlation filtering method is as follows:

[0034]

[0035] Among them, X and Z are different features, and SU(X, Z) is the correlation between features X and Z.

[0036] Preferably, in S3, the Max-Min normalization method is used to normalize the numerical features in the network traffic data, and the images are converted into images according to the timestamp and feature size and the attack types are marked. The specific steps are as follows:

[0037] S31. Encode the network traffic data into pixels in the image. First, use Max-Min normalization to scale all features to the range of 0-1, then multiply by 255, and take the integer part as the pixel value corresponding to the corresponding feature. The output pixel value is:

[0038]

[0039] Where X represents the original eigenvalue, X min represents the minimum value of the feature in the training set, X max represents the maximum value of the feature in the training set, X new Represents the generated pixel value;

[0040] S32. Convert network traffic data into images according to timestamps and feature sizes and mark attack types.

[0041] Preferably, S32 includes the following steps:

[0042] S321, after data normalization and feature selection, converting data samples into blocks / images based on the timestamp and feature size of the network traffic data set, each transformed block / image having a square color image of three channels of red, green and blue and retaining the time series correlation of the original network data;

[0043] S322, marking the transformed block / image based on the attack pattern in the data block; if all samples in the block / image are normal samples, they are marked as "normal", and if the block / image contains an attack sample, it is marked as the most frequent attack type in the block.

[0044] Preferably, in S4, the generated image is enlarged by using the bilinear interpolation method, and the specific steps are as follows:

[0045] S41. First, interpolate from the x-axis direction: for a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, and then use linear interpolation to calculate the values ​​of f(x, y1) and f(x, y2). The calculation formula is as follows:

[0046]

[0047] Among them, Q 11 , Q 12 , Q 21 , Q 22 are four known points;

[0048] S42, interpolation in the y-axis direction: use f(x, y1) and f(x, y2) obtained in the previous step to perform linear interpolation in the y-axis direction to obtain the final pixel value f(x, y), the formula is as follows:

[0049]

[0050] After the above data preprocessing process, the final transformed image set is generated, and then the image data set is divided into a training data set and a test data set in a ratio of 8:2.

[0051] Preferably, in S5, a ViT model pre-trained on the ImageNet dataset is used, the underlying weights are frozen based on transfer learning, the classification head is adjusted, the aggressiveness detection of network traffic is performed, and the intrusion traffic is identified. The specific steps are as follows:

[0052] S51, based on the visual Transformer ViT model, the deep features of traffic images are extracted from network traffic image data through the self-attention mechanism;

[0053] S52. During the transfer learning process, in order to retain the feature extraction capability of the pre-trained model, the weights of the underlying feature extraction module of the ViT model remain frozen, and only the top-level classification head is adjusted to achieve multi-classification of normal traffic and various attack traffic types;

[0054] S53. Fine-tune the model using annotated network traffic image datasets. The optimization goal is to adjust the parameters of the classification head to improve classification performance.

[0055] Preferably, in S53, during the model training process, the loss function uses cross-entropy loss, and the optimizer selects AdamW.

[0056] Therefore, the present invention proposes a network intrusion detection method based on clustering oversampling and Transformer, which has the following beneficial effects:

[0057] (1) The present invention discloses a network intrusion detection method based on clustering oversampling and Transformer, which performs balanced processing on network traffic data through clustering oversampling technology, effectively solving the problem of sparse distribution of minority class samples, thereby improving classification performance.

[0058] (2) The present invention discloses a network intrusion detection method based on clustering oversampling and Transformer, which utilizes the ViT model pre-trained on ImageNet, adapts it to the network intrusion detection task through transfer learning technology, and adjusts the classification head to accurately distinguish normal traffic from various attack traffic types.

[0059] (3) The network intrusion detection method based on clustering oversampling and Transformer of the present invention utilizes the self-attention mechanism of Transformer to extract the global and local features of the network traffic image, enhances the model's ability to express complex traffic patterns, realizes efficient and accurate classification of network traffic, and significantly improves the performance and reliability of network intrusion detection.

[0060] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is an overall flow chart of a network intrusion detection method based on clustering oversampling and Transformer of the present invention;

[0062] Figure 2 The invention discloses a characteristic pattern image set of a network intrusion detection method based on clustering oversampling and Transformer. DETAILED DESCRIPTION

[0063] In order to make the technical solutions, advantages and purposes of the present invention clearer, the technical solutions of the embodiments of the present invention are clearly and completely described below. The described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the described embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the protection scope of this application.

[0064] Unless otherwise defined, technical or scientific terms used in the present invention shall have the common meanings understood by one having ordinary skills in the field to which the present invention belongs.

[0065] like Figure 1 As shown, the present invention provides a network intrusion detection method based on clustering oversampling and Transformer, and the specific steps are as follows:

[0066] S1. Clean the network traffic data and use K-means SMOTE clustering oversampling technology to cluster, filter and oversample the data set;

[0067] Data cleaning of the CICIDS2017 network traffic data set, removing invalid data and filling missing values ​​in the data includes the following steps:

[0068] S111. 308381 rows of duplicate data are detected in the data set. These duplicate rows will be deleted.

[0069] S112. According to the data description, there are infinite values ​​(positive infinity and negative infinity) in the data set. Check and replace these infinite values ​​with null values, and treat them as missing values ​​for statistics and processing.

[0070] S113. Use the median to fill missing values ​​(including original missing values ​​and those infinite values ​​marked as missing values), because median filling does not introduce new categories or destroy the data distribution. This strategy helps maintain the consistency of the data while avoiding the introduction of bias due to improper filling methods.

[0071] Use K-means SMOTE clustering oversampling technology to cluster, filter and oversample the data set to balance the data set. The specific steps are as follows:

[0072] S121. In the clustering stage, the k-means algorithm is used to divide the data into k clusters. The clustering criterion function formula of the k-means algorithm is as follows:

[0073]

[0074] Among them, S is the error sum of all data, k is the number of specified clusters, Cj is the jth cluster, p is the cluster C j The data in m j It is cluster C j The average value of the data in .

[0075] S122. In the filtering stage, select clusters to be oversampled and retain clusters with a higher proportion of minority class samples; then, allocate the number of synthetic samples to be generated and allocate more samples to clusters with sparse minority class samples.

[0076] S123. In the oversampling stage, the SMOTE method is used to achieve the target ratio of minority class and majority class instances.

[0077] The specific algorithm process of K-means SMOTE is shown in Algorithm 1:

[0078] Algorithm 1: k-means SMOTE algorithm;

[0079] Input: X_train: training data set, Threshold: imbalance ratio threshold, ex: exponent for calculating density, the default value is the number of features of X_train, n: the number of samples to be generated, knn: the number of nearest neighbors used for oversampling;

[0080] Output: Y: generated new data;

[0081] Step 1: Cluster the input data and filter out the clusters of minority class data and majority class data.

[0082] Perform kmeans clustering on the input data:

[0083] Clusters←kmeans(X_train);

[0084] FilterClusters = NULL;

[0085] FOR each t∈Clusters do

[0086]

[0087] IF Ratio <Threshold THEN

[0088] FilterClusters←{t}∪FilterClusters;

[0089] END IF

[0090] END FOR

[0091] Step 2: For each filtered cluster, the sampling weight is calculated according to the density of its minority class data.

[0092] FOR each m∈FilterClusters do

[0093] DT = euclideanDistances(m);

[0094] meanMinorDistance(m)←mean(DT);

[0095]

[0096] END FOR

[0097] Sum of sparsity ← ∑ m∈FilterClusters sparsity(m)

[0098]

[0099] Step 3: Use the SMOTE method to process each filtered cluster and calculate the sampling weight based on the density of its minority class data.

[0100] Y = NULL;

[0101] FOR each m∈FilterClusters do

[0102] Samples←||n*Sampleweight(m)||;

[0103] Y←{SMOTE(m,samples,knn)}∪Y;

[0104] ENDFOR

[0105] RETURN Y.

[0106] S2. Use the method of combining information gain and fast correlation filtering to remove irrelevant, unnecessary and noise features in network traffic data, retain key effective information features, so as to make model training more efficient. The specific steps are as follows:

[0107] S21. After the above data preprocessing, a highly representative training subset is generated for subsequent model training. Information gain is used to measure the contribution of a feature to the target variable, that is, the amount of information or entropy change provided by the feature. By calculating the importance score of each feature, sorting them from high to low, and selecting features with a cumulative importance of 90%. In this embodiment, after screening the CICIDS2017 data set by the information gain method, 49 important features remain, and the information gain calculation formula is as follows:

[0108] IG(D|X)=H(D)-H(D|X);

[0109] Among them, H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition of known random variable X, and IG(D|X) is the importance of feature X;

[0110] S22, information gain preliminarily eliminates unimportant features, but there are still redundant features. The fast correlation filtering method is used to further reduce the redundancy between features. The calculation formula of the fast correlation filtering (FCBF) method is as follows:

[0111]

[0112] Where X and Z represent different features, SU(X, Z) takes values ​​in [0, 1], 1 means that features X and Z are completely positively correlated, and 0 means that features X and Z are completely independent. Repeatedly calculate the correlation of features and perform feature deletion until there are no highly correlated features in the feature list. In the end, the CICIDS2017 dataset obtained 20 high-quality features, which significantly improved the model efficiency and performance, while reducing the interference of redundancy and noise on training.

[0113] S3. Use the Max-Min normalization method to normalize the numerical features in the network traffic data, convert them into images according to the timestamp and feature size, and mark the attack type. The specific steps are as follows:

[0114] S31. Encode the network traffic data into pixels in the image. First, use Max-Min normalization to scale all features to the range of 0-1, then multiply by 255, and take the integer part as the pixel value corresponding to the corresponding feature. The output pixel value is:

[0115]

[0116] Where X represents the original eigenvalue, X min represents the minimum value of the feature in the training set, X max represents the maximum value of the feature in the training set, X new Represents the generated pixel value;

[0117] S32, converting the network traffic data into an image according to the timestamp and feature size and marking the attack type, including the following steps:

[0118] S321. After data normalization and feature selection, the data samples are converted into blocks based on the timestamp and feature size of the network traffic dataset. Because the CICIDS2017 dataset has 20 important features, each block of 60 consecutive samples with 20 features (a total of 60*20=1200 feature values) is converted into an image with a shape of 20×20×3, and each transformed image is a square color image with three channels (red, green, and blue). Since the images are generated based on the timestamps of the data samples, the time series correlation of the original network data can be preserved;

[0119] S322, marking the transformed image based on the attack pattern in the data block; if all samples in the block / image are normal samples, the image is marked as "normal", if the block / image contains attack samples, the image is marked as the most frequent attack type in the block.

[0120] For example, if a DoS attack occurs in a block with the highest ratio, the corresponding image will be labeled as “DoS attack”.

[0121] After the above data preprocessing process, the representative samples of each attack type in the final transformed image set are generated as follows: Figure 2 As shown, according to Figure 2 The characteristic patterns shown can clearly distinguish the attack patterns of CICIDS 2017.

[0122] S4. Use bilinear interpolation to enlarge the generated image and divide it into training set and test set according to the proportion. The specific steps are as follows:

[0123] S41. First, interpolate from the x-axis direction: for a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, and then use linear interpolation to calculate the values ​​of f(x, y1) and f(x, y2). The calculation formula is as follows:

[0124]

[0125] Among them, Q 11 , Q 12 , Q 21 , Q 22 are four known points;

[0126] S42, interpolation in the y-axis direction: use f(x, y1) and f(x, y2) obtained in the previous step to perform linear interpolation in the y-axis direction to obtain the final pixel value f(x, y), the formula is as follows:

[0127]

[0128] After the above data preprocessing process, the final transformed image set is generated, and then the image data set is divided into a training data set and a test data set in a ratio of 8:2.

[0129] S5. After the above steps, we can obtain the images of the three-channel network traffic. Based on transfer learning and Transformer, we train a classifier for defect prediction. Specifically, we use the ViT model pre-trained on the ImageNet dataset, freeze the underlying weights based on transfer learning, adjust the classification head, perform aggressive detection of network traffic, and identify intrusion traffic. The specific steps are as follows:

[0130] S51. Based on the Vision Transformer (ViT) model, common feature patterns are learned from large-scale image data through the self-attention mechanism. ViT's multi-layer self-attention mechanism can effectively capture global features and local details, thereby having good feature expression capabilities. These features can be transferred to other vision-related tasks. In an embodiment, the generated network traffic image is input into the pre-trained ViT model to extract deep features of the traffic image;

[0131] S52. In the process of transfer learning, in order to retain the feature extraction capability of the pre-trained model, the weights of the underlying feature extraction module of the ViT model remain frozen, and only the top-level classification head is adjusted. The original ViT classification head is designed for the 1000-class classification task of ImageNet. This method replaces it with a classification head suitable for network traffic anomaly detection to achieve multi-classification of normal traffic and various attack traffic types.

[0132] S53. Fine-tune the model using annotated network traffic image datasets. The optimization goal is to adjust the parameters of the classification head to improve classification performance. During the training process, the loss function uses cross-entropy loss (Cross-Entropy Loss), and the optimizer selects AdamW (Adaptive Moment Estimation with Weight Decay) to increase the training speed, accelerate model convergence, and reduce the risk of overfitting. After training, the model can be used to accurately identify abnormal behaviors and attack patterns in network traffic.

[0133] Therefore, the present invention proposes a network intrusion detection method based on clustering oversampling and Transformer, which balances the network traffic data through clustering oversampling technology, and uses the self-attention mechanism of Transformer to extract the global and local features of the network traffic image, thereby achieving efficient and accurate classification of network traffic and significantly improving the performance and reliability of network intrusion detection.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solution of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solution to deviate from the spirit and scope of the technical solution of the present invention.

Claims

1. A network intrusion detection method based on clustering oversampling and Transformer, characterized in that: The specific steps are as follows: S1. Clean the network traffic data and use K-means SMOTE clustering oversampling technology to cluster, filter and oversample the data set; S2, using a method combining information gain and fast correlation filtering to remove irrelevant, unnecessary and noise features in network traffic data, retaining key effective information features; S3, using a normalization method to normalize the numerical features in the network traffic data, and then converting the network traffic data into images according to timestamps and feature sizes and marking the attack types; S4, using bilinear interpolation method to enlarge the generated image, and divide it into training set and test set according to the proportion; S5. Use the VIT model pre-trained on ImageNet for transfer learning, extract image features and train a classifier to perform aggressive detection of network traffic and identify intrusion traffic.

2. According to claim 1, a network intrusion detection method based on clustering oversampling and Transformer is characterized in that: In S1, data cleaning of network traffic data includes the following steps: S111, deleting duplicate data in the network traffic data; S112, detecting infinite values ​​existing in the data, including positive infinite values ​​and negative infinite values, and replacing the infinite values ​​with null values; S113. Use the median to fill in missing values, where the missing values ​​include missing values ​​originally existing in the data and infinite values ​​replaced by null values.

3. According to claim 1, a network intrusion detection method based on clustering oversampling and Transformer is characterized in that: In S1, K-means SMOTE clustering oversampling technology is used to cluster, filter and oversample the data set. The specific steps are as follows: S121. In the clustering stage, the k-means algorithm is used to divide the data into k clusters. The clustering criterion function formula of the k-means algorithm is as follows: Among them, S is the error sum of all data, k is the number of specified clusters, C j is the jth cluster, p is the cluster C j The data in m j It is cluster C j The average value of the data in, i is an integer; S122, in the filtering stage, selecting clusters to be oversampled, retaining clusters with a higher proportion of minority class samples; then, allocating the number of synthetic samples to be generated, allocating more samples to clusters with sparse minority class samples; S123. In the oversampling stage, the SMOTE method is used to achieve the target ratio of minority class and majority class instances.

4. According to claim 3, a network intrusion detection method based on clustering oversampling and Transformer is characterized in that: K-means SMOTE algorithm, the specific steps are as follows: Step 1: Cluster the input data and filter out the clusters of minority class data and majority class data; Step 2: For each filtered cluster, calculate the sampling weight according to the density of its minority class data; Step 3: Use the SMOTE method to process each filtered cluster and calculate the sampling weight based on the density of its minority class data.

5. According to claim 1, a network intrusion detection method based on clustering oversampling and Transformer is characterized in that: In S2, the information gain and fast correlation filtering method are used to remove irrelevant, unnecessary and noise features in the network traffic data. The specific steps are as follows: S21. Calculate the importance score of each feature using information gain, sort them from high to low, and select features whose cumulative importance reaches 90%. The information gain calculation formula is as follows: IG(D|X)=H(D)-H(D|X); Among them, H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition of known random variable X, and IG(D|X) is the importance of feature X; S22, using a fast correlation filtering method to further reduce redundancy between features; the calculation formula of the fast correlation filtering method is as follows: Among them, X and Z are different features, and SU(X, Z) is the correlation between features X and Z.

6. According to claim 1, a network intrusion detection method based on clustering oversampling and Transformer is characterized in that: In S3, the Max-Min normalization method is used to normalize the numerical features in the network traffic data, and then converted into images according to the timestamp and feature size and marked with the attack type. The specific steps are as follows: S31. Encode the network traffic data into pixels in the image. First, use Max-Min normalization to scale all features to the range of 0-1, then multiply by 255, and take the integer part as the pixel value corresponding to the corresponding feature. The output pixel value is: Where X represents the original eigenvalue, X min represents the minimum value of the feature in the training set, X max represents the maximum value of the feature in the training set, X new Represents the generated pixel value; S32. Convert the network traffic data into images according to timestamps and feature sizes and mark the attack types.

7. A network intrusion detection method based on clustering oversampling and Transformer according to claim 6, characterized in that: S32 includes the following steps: S321, after data normalization and feature selection, converting data samples into blocks / images based on the timestamp and feature size of the network traffic data set, each transformed block / image having a square color image of three channels of red, green and blue and retaining the time series correlation of the original network data; S322, marking the transformed block / image based on the attack pattern in the data block; if all samples in the block / image are normal samples, they are marked as "normal", and if the block / image contains attack samples, it is marked as the most frequent attack type in the block.

8. The network intrusion detection method based on clustering oversampling and Transformer according to claim 1 is characterized in that: In S4, the generated image is enlarged using the bilinear interpolation method, and the specific steps are as follows: S41. First, interpolate from the x-axis direction: for a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, and then use linear interpolation to calculate the values ​​of f(x, y1) and f(x, y2). The calculation formula is as follows: Among them, Q 11 , Q 12 , Q 21 , Q 22 are four known points; S42, interpolation in the y-axis direction: use f(x, y1) and f(x, y2) obtained in the previous step to perform linear interpolation in the y-axis direction to obtain the final pixel value f(x, y), the formula is as follows: After the above data preprocessing process, the final transformed image set is generated, and then the image data set is divided into a training data set and a test data set in a ratio of 8:

2.

9. The network intrusion detection method based on clustering oversampling and Transformer according to claim 1 is characterized in that: In S5, the ViT model pre-trained on the ImageNet dataset is used to freeze the underlying weights based on transfer learning, adjust the classification head, perform aggressive detection of network traffic, and identify intrusion traffic. The specific steps are as follows: S51, based on the visual Transformer ViT model, the deep features of traffic images are extracted from network traffic image data through the self-attention mechanism; S52. During the transfer learning process, in order to retain the feature extraction capability of the pre-trained model, the weights of the underlying feature extraction module of the ViT model remain frozen, and only the top-level classification head is adjusted to achieve multi-classification of normal traffic and various attack traffic types. S53. Fine-tune the model using annotated network traffic image datasets. The optimization goal is to adjust the parameters of the classification head to improve classification performance.

10. A network intrusion detection method based on clustering oversampling and Transformer according to claim 9, characterized in that: In S53, during the model training process, the loss function uses cross-entropy loss and the optimizer selects AdamW.

Images