A network intrusion detection method based on clustering oversampling and transformer

Abstract

The application discloses a network intrusion detection method based on clustering oversampling and a transformer, and relates to the technical field of network security and deep learning. The method comprises the following steps: performing data cleaning on network traffic data, balancing the data set through a clustering oversampling technology, and extracting characteristic values through a method combining information gain and fast correlation filtering; adopting a Max-Min normalization method to normalize the characteristic values, converting the characteristic values into images according to timestamps and characteristic sizes, and marking attack types; adopting a bilinear interpolation method to magnify the generated images, and dividing the images into a training set and a test set; and through transfer learning, fine-tuning a classification head, extracting deep features of the network traffic data, and realizing accurate classification of normal traffic and various attack traffics. The network intrusion detection method based on clustering oversampling and the transformer can not only effectively identify different types of network attacks, but also significantly improve the accuracy and reliability of intrusion detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security and deep learning, and particularly relates to a network intrusion detection method based on clustering oversampling and a Transformer. BACKGROUND

[0002] With the rapid development of the information age, the Internet has been deeply integrated into personal life, enterprise operation and national infrastructure. However, the frequency and complexity of cyber attacks continue to increase, not only threatening personal privacy and data security, but also posing a major risk to the social economy and national security. Network space security problems have become a key challenge that needs to be solved globally. To cope with the increasingly severe security challenges, the intrusion detection system (IDS) as an active defense tool can monitor network data transmission behavior in real time, identify abnormal activities and respond in a timely manner, and is an important means of protecting network security.

[0003] The concept of intrusion detection was first proposed by James Anderson in 1980. Currently, intrusion detection technology is mainly divided into two categories: misuse-based detection and anomaly-based detection. Misuse-based intrusion detection systems rely on signature knowledge bases to identify known attacks, and have high accuracy, but have limited detection capabilities for unknown threats. Anomaly-based systems compare normal behavior and abnormal behavior and have the potential to detect unknown attacks. However, traditional anomaly detection methods rely on shallow machine learning models (such as decision trees, random forests, XGBoost, etc.), which require human feature engineering and are not effective in dealing with high-dimensional and complex data.

[0004] With the increase in data size and complexity, deep learning methods have made significant progress in image recognition, natural language processing and other fields. In 2006, Hinton proposed the deep learning theory, which automatically extracts high-dimensional features through deep neural networks, solving the limitations of traditional machine learning in feature extraction. In recent years, deep learning has been gradually applied to the field of intrusion detection, including methods such as autoencoder, recurrent neural network (RNN), long short-term memory network (LSTM), gated recurrent unit (GRU) and convolutional neural network (CNN). These methods have improved detection accuracy, but still face many challenges:

[0005] Class imbalance problem: In network traffic data, attack traffic is often sparsely distributed as a minority class sample. Traditional models tend to focus on the majority class (normal traffic) during training, making it difficult to accurately identify low-frequency attack samples.

[0006] Limitations of feature extraction: traditional models are insufficient in capturing the timing features and global correlations of network traffic, and cannot fully represent complex network traffic patterns.

[0007] Inspired by the successful application of the Transformer architecture in natural language processing, the Vision Transformer (ViT) extends the Transformer structure to the image processing field, demonstrating excellent feature extraction capabilities. ViT models the global dependencies of input data through self-attention mechanisms, not only avoiding the sequential processing limitations of recurrent neural networks, but also significantly improving parallel computing efficiency. The multi-head attention mechanism enables ViT to simultaneously explore features in multiple subspaces, further enhancing the model's ability to express complex patterns. In addition, the widespread application of transfer learning techniques in deep learning has reduced the dependence on large-scale labeled data by migrating pre-trained model weights to new tasks, significantly improving model performance in small sample scenarios. SUMMARY

[0008] The purpose of the present application is to propose a network intrusion detection method based on clustering oversampling and Transformer, which can effectively identify different types of network attacks and significantly improve the accuracy and reliability of intrusion detection.

[0009] To achieve the above purpose, the present application proposes a network intrusion detection method based on clustering oversampling and Transformer, the specific steps are as follows:

[0010] S1, data cleaning is performed on network traffic data, and K-means SMOTE clustering oversampling technology is used to cluster, filter and oversample the data set;

[0011] S2, a method combining information gain and fast correlation filtering is used to eliminate irrelevant, unnecessary and noise features in network traffic data, and key effective information features are retained;

[0012] S3, a normalization method is used to normalize the numerical features in the network traffic data, then the network traffic data is converted into images according to the timestamp and feature size and labeled with attack types;

[0013] S4, the generated image is enlarged using the bilinear interpolation method, and is divided into training set and test set according to the proportion;

[0014] S5, use the VIT model pre-trained on ImageNet for transfer learning, extract the features of the image and train a classifier, and perform attack detection on network traffic to identify intrusion traffic.

[0015] Preferably, in S1, the data cleaning of the network traffic data comprises the following steps:

[0016] S111, deleting repeated data in the network traffic data;

[0017] S112, detecting the existence of infinite values in the data, including positive infinite values and negative infinite values, and replacing the infinite values with null values;

[0018] S113, filling the missing values with the median, the missing values including the missing values originally existing in the data and the infinite values replaced with null values.

[0019] Preferably, in S1, the K-means SMOTE clustering oversampling technique is used to cluster, filter and oversample the data set, and the specific steps are as follows:

[0020] S121, in the clustering stage, the data is divided into k clusters using the k-means algorithm, and the clustering criterion function formula of the k-means algorithm is as follows:

[0021]

[0022] Wherein, S is the sum of error squares of all data, k is the specified number of clustering clusters, C j is the jth cluster, p is the data in the cluster C j , m j is the average value of the data in the cluster C j , and i is an integer.

[0023] S122, in the filtering stage, the clusters to be oversampled are selected, and the clusters with a higher proportion of minority class samples are retained; then, the number of synthetic samples to be generated is allocated, and more samples are allocated to the clusters with sparse minority class samples.

[0024] S123, in the oversampling stage, the SMOTE method is used to achieve the target proportion of minority class and majority class instances.

[0025] Preferably, the K-means SMOTE algorithm has the following specific steps:

[0026] Step one, clustering the input data and screening out the clusters of minority class data and majority class data;

[0027] Step two, for each filtered cluster, the sampling weight is calculated according to the density of its minority class data;

[0028] Step three, using the SMOTE method to process each filtered cluster, and calculating the sampling weight according to the density of its minority class data.

[0029] Preferably, in S2, the method of combining information gain and fast correlation filtering is used to remove irrelevant, unnecessary and noise features in network traffic data, and the specific steps are as follows:

[0030] S21, calculate the importance score of each feature using information gain, sort the scores from high to low, and select the features whose cumulative importance reaches 90%; the information gain calculation formula is as follows:

[0031] IG(D|X) = H(D) - H(D|X);

[0032] Where H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition of knowing the random variable X, and IG(D|X) is the importance of feature X.

[0033] S22, use fast correlation filtering method to further reduce the redundancy between features; the fast correlation filtering method calculation formula is as follows:

[0034]

[0035] Where X and Z are different features, and SU(X, Z) is the correlation between features X and Z.

[0036] Preferably, in S3, the Max-Min normalization method is used to normalize the numerical features in network traffic data, and the network traffic data is converted into an image according to the timestamp and feature size and labeled with attack type, and the specific steps are as follows:

[0037] S31, encode the network traffic data into pixels in the image, first use Max-Min normalization to scale all features to the range of 0-1, then multiply by 255, and take the integer part as the pixel value corresponding to the corresponding feature, the output pixel value is:

[0038]

[0039] Where X represents the original feature value, X min represents the minimum value of the feature in the training set, X max represents the maximum value of the feature in the training set, X new represents the generated pixel value.

[0040] S32, convert the network traffic data into an image according to the timestamp and feature size and label the attack type.

[0041] Preferably, in S32, the following steps are included:

[0042] S321, after data normalization and feature selection, the data samples are converted into blocks / images based on the timestamps and feature sizes of the network traffic dataset, each transformed block / image has three channels of red, green and blue square color images and retains the time sequence correlation of the original network data;

[0043] S322, the transformed block / image is labeled based on the attack pattern in the data block; if all samples in the block / image are normal samples, they are labeled as "normal", and if the block / image contains attack samples, it is labeled as the most frequent attack type in the block.

[0044] Preferably, in S4, the generated image is enlarged using the bilinear interpolation method, and the specific steps are as follows:

[0045] S41, first interpolation from the x-axis direction: for a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, then use linear interpolation to calculate the values of f(x, y1) and f(x, y2), the formula is as follows:

[0046]

[0047] where Q 11 , Q 12 , Q 21 , Q 22 are the known four points;

[0048] S42, interpolation in the y-axis direction: using f(x, y1) and f(x, y2) obtained in the last step, linear interpolation is performed in the y-axis direction to obtain the final pixel value f(x, y), the formula is as follows:

[0049]

[0050] After the above data preprocessing process, the final transformed image set is generated, and then the image dataset is divided into training dataset and test dataset according to the ratio of 8:2.

[0051] Preferably, in S5, the ViT model pre-trained on the ImageNet dataset is used, the bottom layer weights are frozen based on transfer learning, the classification head is adjusted, and the network traffic attack detection is performed to identify the intrusion traffic, and the specific steps are as follows:

[0052] S51, based on the visual Transformer ViT model, deep features of the traffic image are extracted from the network traffic image data through the self-attention mechanism;

[0053] S52, in the migration learning process, in order to retain the feature extraction ability of the pre-trained model, the weight of the bottom feature extraction module of the ViT model is kept frozen, only the top classification head Classification Head is adjusted, and multi-classification of normal traffic and various attack traffic types is realized;

[0054] S53, the model is fine-tuned using the labeled network traffic image dataset, and the optimization target is to adjust the parameters of the classification head to improve the classification performance.

[0055] Preferably, in S53, during the model training process, the loss function adopts Cross-Entropy Loss, and the optimizer selects AdamW.

[0056] Therefore, the present application proposes a network intrusion detection method based on clustering oversampling and Transformer, which has the following beneficial effects:

[0057] (1) The network intrusion detection method based on clustering oversampling and Transformer balances the network traffic data through clustering oversampling technology, effectively solves the problem of sparse distribution of minority class samples, and improves the classification performance.

[0058] (2) The network intrusion detection method based on clustering oversampling and Transformer uses the ViT model pre-trained on ImageNet, adapts to the network intrusion detection task through the transfer learning technology, and adjusts the classification head to accurately distinguish normal traffic and various attack traffic types.

[0059] (3) The network intrusion detection method based on clustering oversampling and Transformer uses the self-attention mechanism of Transformer to extract the global and local features of network traffic images, enhances the expression ability of the model to complex traffic patterns, realizes efficient and accurate classification of network traffic, and significantly improves the performance and reliability of network intrusion detection.

[0060] The technical solutions of the present application will be further described in detail below with the help of the drawings and examples. BRIEF DESCRIPTION OF DRAWINGS

[0061] Figure 1 is the overall flowchart of the network intrusion detection method based on clustering oversampling and Transformer of the present application;

[0062] Figure 2 is the feature pattern image set of the network intrusion detection method based on clustering oversampling and Transformer of the present application. DETAILED DESCRIPTION

[0063] In order to make the technical solutions, advantages and purposes of the present application clearer, the technical solutions of the embodiments of the present application will be described clearly and completely below. The described embodiments are part of the embodiments of the present application, rather than all the embodiments. Based on the described embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without any inventive effort fall within the protection scope of the present application.

[0064] Unless otherwise defined, the technical terms or scientific terms used in the present application shall have the usual meanings understood by those skilled in the art to which the present application belongs.

[0065] As shown in Figure 1 The present application provides a network intrusion detection method based on clustering oversampling and Transformer, and the specific steps are as follows:

[0066] S1, data cleaning is performed on network traffic data, and K-means SMOTE clustering oversampling technology is used to cluster, filter and oversample the data set;

[0067] The data cleaning of the network traffic data CICIDS2017 data set removes invalid data in the data and fills in the missing values, including the following steps:

[0068] S111, 308381 rows of repeated data are detected in the data set, and these repeated rows will be deleted.

[0069] S112, according to the data description, there are infinite values (positive and negative infinity) in the data set, check and replace these infinite values with null values, and treat them as missing values for statistics and processing.

[0070] S113, the missing values (including the original missing values and those infinite values marked as missing values) are filled with median, because the median filling will not introduce new categories or destroy the data distribution. This strategy helps to maintain the consistency of the data, while avoiding introducing bias due to improper filling method.

[0071] The K-means SMOTE clustering oversampling technology is used to cluster, filter and oversample the data set to balance the data set, and the specific steps are as follows:

[0072] S121, in the clustering stage, the data is divided into k clusters using the k-means algorithm, and the clustering criterion function formula of the k-means algorithm is as follows:

[0073]

[0074] Where S is the sum of squared errors of all data, k is the specified number of clustering clusters, C is the clustering center, and x is the data point.j is the j-th cluster, p is the data in cluster C j j is the average value of data in cluster C j

[0075] S122, in the filtering stage, select the cluster to be oversampled, and retain the cluster with a high proportion of minority class samples; then, allocate the number of synthetic samples to be generated, and allocate more samples to the cluster with sparse minority class samples.

[0076] S123, in the oversampling stage, use the SMOTE method to achieve the target proportion of minority and majority instances.

[0077] The specific algorithm process of K-means SMOTE is shown in Algorithm 1:

[0078] Algorithm 1: k-means SMOTE algorithm;

[0079] Input: X_train: training data set, Threshold: imbalance ratio threshold, ex: the index of calculating density, the default value is the number of features of X_train, n: the number of samples to be generated, knn: the number of nearest neighbors used for oversampling;

[0080] Output: Y: the generated new data;

[0081] Step 1: cluster the input data and filter out the clusters of minority class data and majority class data.

[0082] Kmeans clustering of input data:

[0083] Clusters←kmeans(X_train);

[0084] FilterClusters=NULL;

[0085] FOR each t∈Clusters do

[0086]

[0087] IF Ratio<Threshold THEN

[0088] FilterClusters←{t}∪FilterClusters;

[0089] END IF

[0090] END FOR

[0091] ​​Second step: For each filtered cluster, calculate the sampling weight according to the density of its minority class data.

[0092] FOR each m∈FilterClusters do

[0093] DT=euclideanDistances(m);

[0094] meanMinorDistance(m)←mean(DT);

[0095]

[0096] END FOR

[0097] Sumofsparsity←∑ m∈FilterClusters sparsity(m)

[0098]

[0099] Third step: Use the SMOTE method to process each filtered cluster, and calculate the sampling weight according to the density of its minority class data.

[0100] Y=NULL;

[0101] FOR each m∈FilterClusters do

[0102] Samples←||n*Sampleweight(m)||;

[0103] Y←{SMOTE(m,samples,knn)}∪Y;

[0104] ENDFOR

[0105] RETURN Y。

[0106] S2, the method combining information gain and fast correlation filtering is adopted to eliminate irrelevant, unnecessary and noise features in network flow data, and key effective information features are reserved, so that the model training is more efficient, and the specific steps are as follows:

[0107] S21, After the above data preprocessing, a highly representative training subset is generated for subsequent model training. Information gain is used to measure the contribution of features to the target variable, that is, the amount of information or entropy change provided by the feature. By calculating the importance score of each feature, the features are sorted in descending order of score, and the features with cumulative importance reaching 90% are selected. In this embodiment, after screening the CICIDS2017 dataset by the information gain method, 49 important features are left, and the information gain calculation formula is as follows:

[0108] IG(D|X)=H(D)-H(D|X);

[0109] Where H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition that the random variable X is known, and IG(D|X) is the importance of the feature X.

[0110] S22, Information gain initially eliminates unimportant features, but there are still redundant features. The fast correlation-based filter method is used to further reduce the redundancy between features. The calculation formula of the fast correlation-based filter (FCBF) method is as follows:

[0111]

[0112] Where X and Z represent different features, SU(X, Z) takes a value in [0, 1], 1 represents that the features X and Z are completely positively correlated, and 0 represents that the features X and Z are completely independent. The correlation of the features is repeatedly calculated and the feature deletion is performed until there are no highly correlated features in the feature list. Finally, the CICIDS2017 dataset obtains 20 high-quality features, which significantly improves the efficiency and performance of the model, and reduces the interference of redundancy and noise on training.

[0113] S3, Max-Min normalization method is used to normalize the numerical features in network traffic data, and the network traffic data is converted into images according to the timestamp and feature size and labeled with attack types, and the specific steps are as follows:

[0114] S31, the network traffic data is encoded into pixels in the image, first Max-Min normalization is used to scale all features to the range of 0-1, then multiplied by 255, and the integer part is taken as the pixel value corresponding to the corresponding feature. The output pixel value is:

[0115]

[0116] Where X represents the original feature value, X min represents the minimum value of the feature in the training set, X max represents the maximum value of the feature in the training set, X new represents the generated pixel value.

[0117] S32, converting network traffic data into images according to timestamps and feature sizes and marking attack types, comprising the following steps:

[0118] S321, after data normalization and feature selection, the data samples are converted into blocks based on the timestamps and feature sizes of the network traffic data set. Because the CICIDS2017 data set has 20 important features, each block of 60 consecutive samples with 20 features (a total of 60*20=1200 feature values) is converted into an image with a shape of 20x20x3, and each transformed image is a square color image with three channels (red, green and blue). Since the image is generated based on the timestamps of the data samples, the time series correlation of the original network data can be preserved;

[0119] S322, marking the transformed images based on attack patterns in the data blocks; if all samples in the block / image are normal samples, the image is marked as "normal", and if the block / image contains attack samples, the image is marked as the most frequent attack type in the block.

[0120] For example, if a DoS attack occurs in the block with the highest proportion, the corresponding image will be marked as "DoS attack".

[0121] After the above data preprocessing process, representative samples of each attack type in the final transformed image set are generated as shown in Figure 2 According to the feature patterns shown in Figure 2 , the attack patterns of CICIDS 2017 can be obviously distinguished.

[0122] S4, using bilinear interpolation to enlarge the generated images, dividing them into training set and test set according to the proportion, the specific steps are as follows:

[0123] S41, first interpolate from the x-axis direction: for a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, then use linear interpolation to calculate the values of f(x, y1) and f(x, y2), the formula is as follows:

[0124]

[0125] Where Q 11 , Q 12 , Q 21 , Q 22 are the known four points;

[0126] S42, interpolate in the y-axis direction: using the f(x, y1) and f(x, y2) obtained in the last step, linearly interpolate in the y-axis direction to obtain the final pixel value f(x, y), the formula is as follows:

[0127]

[0128] After the above data preprocessing process, the final transformed image set is generated, and then the image data set is divided into training data set and test data set according to the ratio of 8:2.

[0129] S5, after the above steps, a three-channel network traffic image can be obtained, and a classifier is trained based on transfer learning and Transformer for defect prediction. Specifically, a ViT model pre-trained on an ImageNet data set is used, the bottom layer weights are frozen based on transfer learning, the classification head is adjusted, and the network traffic attack detection is performed to identify intrusion traffic. The specific steps are as follows:

[0130] S51, based on the Vision Transformer (ViT) model, the self-attention mechanism is used to learn general feature patterns from large-scale image data. The multi-layer self-attention mechanism of ViT can effectively capture global features and local details, thereby having good feature expression ability. These features can be transferred to other visual related tasks. In the embodiment, the generated network traffic image is input into the pre-trained ViT model for extracting deep features of the traffic image;

[0131] S52, in the process of transfer learning, in order to preserve the feature extraction ability of the pre-trained model, the weights of the bottom feature extraction module of the ViT model are kept frozen, and only the top classification head (Classification Head) is adjusted. The original ViT classification head is designed for the 1000-class classification task of ImageNet, and this method replaces it with a classification head suitable for network traffic anomaly detection to realize multi-classification of normal traffic and various attack traffic types.

[0132] S53, use the labeled network traffic image data set to fine-tune the model, and the optimization target is to adjust the parameters of the classification head to improve the classification performance. During the training process, the loss function uses cross-entropy loss (Cross-Entropy Loss), and the optimizer selects AdamW (Adaptive Moment Estimation with Weight Decay) to improve the training speed, accelerate the model convergence and reduce the risk of overfitting. After the training is completed, the model can be used to accurately identify abnormal behaviors and attack patterns in network traffic.

[0133] Therefore, the application provides a network intrusion detection method based on clustering oversampling and a transformer.

[0134] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not to limit them, and although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can still be modified or replaced by equivalents, and these modifications or replacements cannot make the modified technical solutions deviate from the spirit and scope of the technical solutions of the present application.

Claims

1. A network intrusion detection method based on clustering oversampling and Transformer, characterized in that: The specific steps are as follows: S1. Clean the network traffic data and use K-means SMOTE clustering oversampling technology to cluster, filter and oversample the data set; S2. Use a method combining information gain and fast correlation filtering to remove irrelevant, unnecessary, and noise features from network traffic data, retaining key effective information features; S3. Normalize the numerical features in the network traffic data using a normalization method, then convert the network traffic data into images based on timestamps and feature sizes and label the attack types. The Max-Min normalization method is used to normalize the numerical features in the network traffic data. The data is then converted into images based on the timestamp and feature size, and the attack type is marked. The specific steps are as follows: S31. Encode the network traffic data into pixels in the image. First, use Max-Min normalization to scale all features to the range of 0-1, then multiply by 255, and take the integer part as the pixel value corresponding to the corresponding feature. The output pixel value is: Where X represents the original eigenvalue, X min Represents the minimum value of the feature in the training set, X max Represents the maximum value of the feature in the training set, X new Represents the generated pixel value; S32. Converting network traffic data into images according to timestamps and feature sizes and marking attack types, including the following steps: S321. After data normalization and feature selection, convert the data samples into blocks / images based on the timestamp and feature size of the network traffic dataset, each transformed block / image having a square color image of three channels red, green, and blue and retaining the time series correlation of the original network data; S322, marking the transformed block / image based on the attack pattern in the data block; if all samples in the block / image are normal samples, it is marked as normal; if the block / image contains an attack sample, it is marked as the most frequent attack type in the block; S4. Use bilinear interpolation to enlarge the generated image and divide it into training set and test set according to the ratio; S5. Use the VIT model pre-trained on ImageNet for transfer learning, extract image features, and train a classifier to detect the aggressiveness of network traffic and identify intrusion traffic. The specific steps are as follows: S51, based on the visual Transformer ViT model, extracts deep features of traffic images from network traffic image data through the self-attention mechanism; S52. During the transfer learning process, to preserve the feature extraction capabilities of the pre-trained model, the weights of the underlying feature extraction module of the ViT model remain frozen, and only the top-level classification head is adjusted to achieve multi-classification of normal traffic and various attack traffic types. S53. Fine-tune the model using a labeled network traffic image dataset. The optimization goal is to adjust the parameters of the classification head to improve classification performance. During model training, the loss function uses cross-entropy loss, and the optimizer selects AdamW.

2. A network intrusion detection method based on clustering oversampling and Transformer according to claim 1, characterized in that: In S1, data cleaning of network traffic data includes the following steps: S111, deleting duplicate data in the network traffic data; S112. Detect infinite values ​​in the data, including positive infinite values ​​and negative infinite values, and replace the infinite values ​​with null values; S113. Use the median to fill in missing values, where the missing values ​​include missing values ​​originally existing in the data and infinite values ​​replaced by null values.

3. A network intrusion detection method based on clustering oversampling and Transformer according to claim 1, characterized in that: In S1, the K-means SMOTE clustering oversampling technique is used to cluster, filter, and oversample the dataset. The specific steps are as follows: S121. In the clustering stage, the k-means algorithm is used to divide the data into k clusters. The clustering criterion function formula of the k-means algorithm is as follows: Among them, S is the sum of squares of all data errors, k is the number of specified clusters, C j is the jth cluster, p is the cluster C j The data in m j It is cluster C j The average value of the data in, i is an integer; S122. In the filtering stage, clusters to be oversampled are selected, and clusters with a higher proportion of minority class samples are retained; then, the number of synthetic samples to be generated is allocated, and more samples are allocated to clusters with sparse minority class samples; S123. In the oversampling stage, the SMOTE method is used to achieve the target ratio of minority class and majority class instances.

4. A network intrusion detection method based on clustering oversampling and Transformer according to claim 3, characterized in that: K-means SMOTE algorithm, the specific steps are as follows: Step 1: Cluster the input data and filter out clusters of minority class data and majority class data; Step 2: For each filtered cluster, calculate the sampling weight according to the density of its minority class data; Step 3: Use the SMOTE method to process each filtered cluster and calculate the sampling weight based on the density of its minority class data.

5. The network intrusion detection method based on cluster oversampling and Transformer according to claim 1 is characterized in that: In S2, a method combining information gain and fast correlation filtering is used to remove irrelevant, unnecessary, and noise features from network traffic data. The specific steps are as follows: S21. Calculate the importance score of each feature using information gain, sort the features from high to low, and select features whose cumulative importance reaches 90%. The information gain calculation formula is as follows: IG(D|X)=H(D)-H(D|X); Where H(D) is the entropy of the target variable D, H(D|X) is the uncertainty of the target variable under the condition of known random variable X, and IG(D|X) is the importance of feature X; S22. Use a fast correlation filtering method to further reduce redundancy between features. The calculation formula of the fast correlation filtering method is as follows: Where X and Z are different features, and SU(X, Z) is the correlation between features X and Z.

6. A network intrusion detection method based on clustering oversampling and Transformer according to claim 1, characterized in that: In S4, the generated image is enlarged using the bilinear interpolation method. The specific steps are as follows: S41. First, interpolate from the x-axis direction: For a given point (x, y), find its two adjacent points (x1, y1) and (x2, y1) in the x-axis direction, and then use linear interpolation to calculate the values ​​of f(x, y1) and f(x, y2). The calculation formula is as follows: Among them, Q 11 , Q 12 , Q 21 , Q 22 There are four known points; S42. Interpolate in the y-axis direction: Use f(x, y1) and f(x, y2) obtained in the previous step to perform linear interpolation in the y-axis direction to obtain the final pixel value f(x, y). The formula is as follows: After the above data preprocessing process, the final transformed image set is generated, and then the image dataset is divided into a training dataset and a test dataset in a ratio of 8:2.

Images