Network intrusion detection method based on graph embedded weighted width network

Abstract

The invention discloses a network intrusion detection method based on a graph embedded weighted width network. The method comprises the following steps: collecting network intrusion detection data and preprocessing the data; calculating a sample by using the preprocessed network intrusion detection data to construct a graph embedding matrix; calculating a class penalty weight by using the preprocessed network intrusion data; adding the obtained graph embedding matrix and the class penalty weight into a width neural network to obtain an improved width neural network which is called a graph embedding weighted width network; and classifying network intrusion detection data to be detected by using the trained graph embedded weighted width network to obtain a classification result. According to the method, the advantages of an efficient training mode and high accuracy of the width network are utilized, meanwhile, a graph embedding technology is introduced to improve the classification capability of network intrusion data, and the attention of the width network to minority classes in the training process is enhanced by using an adaptive weighted penalty matrix; and the accuracy of network intrusion detection data classification can be improved.

Description

Technical Field

[0001] The invention relates to the technical field of network intrusion detection and unbalanced learning, and in particular to a network intrusion detection method based on a graph embedding weighted width network. Background Art

[0002] The Industrial Internet deeply integrates industrial systems with Internet technologies, achieving interconnection between devices and efficient transmission and sharing of data. In this process, extracting valuable information from massive industrial data is crucial for equipment health management, which is the basis for achieving safe, reliable and efficient operation of equipment. As the core link of equipment health management, network intrusion detection plays a key role in ensuring the continuity and stability of the production process. Through network intrusion detection, enterprises can quickly detect and resolve security threats that arise in the production process, which is of great importance for maintaining equipment from being invaded and enhancing the competitiveness of enterprises in the market. However, in actual industrial production scenarios, due to the continuous improvement of equipment reliability, most machines can operate normally most of the time, and the frequency of network intrusions is relatively low. It is precisely the need for models to accurately diagnose network intrusions, prevent hackers from attacking industrial Internet devices, and improve the stability of equipment. Therefore, the network intrusion detection system must have a high degree of accuracy and real-time performance to ensure timely response and processing when the equipment is abnormal or attacked. Therefore, the sensor readings collected from network devices are mainly normal data, and the proportion of intrusion data is relatively small. Under such unbalanced category distribution, traditional network intrusion diagnosis models often expose a series of defects such as low fault identification accuracy and poor generalization ability, which will eventually seriously hinder the efficiency and reliability of traditional network intrusion diagnosis methods in the industrial Internet environment. The presence of noise in the data will aggravate the decision bias of the model on unbalanced data, and the classification effect will be further deteriorated. At the same time, deep learning models, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs) and autoencoders, have been widely used in the field of fault diagnosis. However, these deep learning-based network intrusion detection methods often require a large amount of data for model training due to their own complex network structure and a large number of parameters. When the training data is limited, these models are prone to overfitting and show poor generalization performance on unseen data. At the same time, their training process is also time-consuming. Therefore, there is an urgent need for a targeted learning model that can cope with the imbalance problem of current network intrusion detection.

[0003] Based on the various problems in the context of the above-mentioned industrial Internet, this patent designs a network intrusion detection method based on graph embedded weighted wide network, which utilizes the simple linear structure of the wide neural network and an efficient training method that does not require back propagation but only requires pseudo-inverse to obtain the optimal solution. At the same time, the intrinsic graph and penalty graph structure as well as the class-specific penalty strategy are embedded into the optimized objective function, thereby improving the accuracy and efficiency of network intrusion detection, and providing more powerful technical support for the problem of efficient network intrusion detection in the industrial Internet environment. Summary of the invention

[0004] The purpose of the present invention is to address the serious problems of class imbalance and noise information interference in current industrial production network intrusion detection scenarios, and to provide a network intrusion detection method based on graph embedding weighted width network. The method captures the topological structure through a graph embedding strategy, uses the Laplace matrix and other geometric properties to preserve the imbalance problem, and uses a class-specific penalty strategy to solve the imbalance problem, thereby achieving high-precision noise classification of imbalanced data.

[0005] To achieve the above object, the technical solution provided by the present invention is: a network intrusion detection method based on graph embedding weighted width network, comprising the following steps:

[0006] Step 1: collect network intrusion detection data and preprocess the network intrusion detection data to obtain clean data and labels, which are divided into normal data and intrusion data;

[0007] Step 2, using the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, using the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct intrinsic graph Laplace matrix and penalty graph Laplace matrix, and finally using the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; using the preprocessed network intrusion detection data to calculate the density information and category information of the data, and designing the class penalty weight based on the density information and category information;

[0008] Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called a graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network to obtain a graph embedding weighted wide network with optimal performance as a classification model for network intrusion detection data.

[0009] Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.

[0010] Furthermore, the network intrusion detection data is preprocessed, including filling missing values ​​with the average value of the adjacent data before and after, deleting data with many missing features, dividing the data labels into normal data and intrusion data, and performing one-hot encoding on the labels.

[0011] Furthermore, the sample similarity is calculated using the preprocessed network intrusion detection data to obtain the intrinsic graph matrix weight g in and the penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows:

[0012]

[0013] In the formula, c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j, and its calculation expression is as follows:

[0014]

[0015] In the formula, exp represents the exponential function, z i and z j denote the feature vectors of data i and data j respectively, and σ is the scaling parameter;

[0016] Penalty graph matrix weight g p The calculation expression is as follows:

[0017]

[0018] In the formula, N represents the total number of network intrusion detection data;

[0019] Using the calculated intrinsic graph matrix weight g in and the penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U = D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g pThe sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G. Specifically, the intrinsic graph Laplace matrix L is projected into the feature space to obtain the intrinsic graph matrix G. in =X T LX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and the penalty graph matrix G p Get the graph embedding matrix G;

[0020] The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows:

[0021] The calculation process of the density information is as follows: given the mth network intrusion detection data x m , firstly, m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S - The q nearest neighbors in Then calculate x m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows:

[0022]

[0023] In the formula, s i represents the i-th nearest neighbor in S, t j Represents S - The jth nearest neighbor in ;

[0024] The mixing weight matrix is ​​calculated by the following mixing formula

[0025]

[0026] In the formula, ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value;

[0027] The category information calculation process is: the density penalty weight E of the data is calculated by the following formula i :

[0028]

[0029] Where N i Represents the i-th network intrusion detection data x i The total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula:

[0030]

[0031] Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - :

[0032] d + =χF + +(1-χ)E +

[0033] d - =χF - +(1-χ)E -

[0034] Where χ is a parameter that weighs the global distribution and local density information, and F + and F - denote the computational penalty costs of normal data and intrusion data, respectively, and E + and E - - represent the density penalty weights of normal data and intrusion data respectively.

[0035] Furthermore, the width neural network includes a two-layer neural structure, the first layer is the network intrusion detection data X is embedded in the activation function through random weights and biases to generate feature nodes Z, the second layer is the feature nodes are embedded in the nonlinear activation function through random weights and biases to generate enhanced nodes H, and finally the feature nodes Z and enhanced nodes H are spliced ​​to form hidden nodes A of normal data and intrusion data + and A - , and then A + and A - Splicing to form hidden layer A;

[0036] The optimization objective function of the graph embedding weighted width network is:

[0037]

[0038] sA + W=Y + -δ + and A _ W=Y _ -δ _

[0039] In the formula, represents the L2 normal form, represents the minimization of W, λ is the regularization parameter of the width neural network, θ is the regularization parameter of the graph structure, and δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established;

[0040] The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows:

[0041]

[0042] In the formula, - 1 represents the pseudo-inverse of the matrix and I represents the identity matrix.

[0043] Further, in step 4, the input graph of the network intrusion detection data to be tested is embedded in the weighted width network, and the feature nodes of the data to be tested are obtained after the activation function is embedded simultaneously by random weights and biases. The feature nodes of the data to be tested are then embedded simultaneously by the nonlinear activation function through random weights and biases to generate enhanced nodes of the data to be tested, and then the feature nodes and enhanced nodes of the data to be tested are spliced ​​by column to obtain the hidden layer A, and finally the final classification result is calculated by the following formula:

[0044]

[0045] In the formula, is the predicted label, that is, the final classification result.

[0046] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0047] The present invention comprehensively considers the intra-class and inter-class density and global distribution information of network intrusion detection data through a class-specific penalty weight strategy, comprehensively reflects data characteristics to solve the imbalance problem, distinguishes sample differences by calculating mixed density and weights, reduces the impact of difficult-to-distinguish samples, improves accuracy, and can also adaptively adjust weights to adapt to unbalanced data containing noise and outliers, enhance network adaptability and generalization capabilities, and optimize classification decisions to enhance the recognition ability of minority class samples, i.e., intrusion categories. In terms of processing noisy data, existing methods do not effectively utilize graph structure information. The present invention uses graph embedding technology to retain geometric and topological relationships and enhance the ability to process noisy data. Graph embedding can not only enhance the robustness of the network in the face of noisy data, but also convert graph data into vector form to enhance the wide network's ability to express complex data. More importantly, the geometric and topological relationships of the data can be retained during the optimization process, so that the network can more accurately capture the similarities and differences between unbalanced samples, thereby effectively improving the detection performance of network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 Schematic diagram of a flow chart of an embodiment of the present invention.

[0049] Figure 2 This is an overall architecture diagram of the technology used in the present invention. DETAILED DESCRIPTION

[0050] The present invention is further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0051] like Figure 1 and Figure 2 As shown, this embodiment discloses a network intrusion detection method based on graph embedding weighted width network, and its specific situation is as follows:

[0052] Step 1: Collect network intrusion detection data and preprocess the network intrusion detection data, including filling missing values ​​with the average value of the adjacent data before and after, deleting data with many missing features, dividing data labels into normal data and intrusion data, and performing one-hot encoding on the labels to obtain clean data and labels, which are divided into normal data and intrusion data;

[0053] Step 2, using the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, using the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct intrinsic graph Laplace matrix and penalty graph Laplace matrix, and finally using the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; using the preprocessed network intrusion detection data to calculate the density information and category information of the data, and designing the class penalty weight based on the density information and category information;

[0054] Use the preprocessed network intrusion detection data to calculate sample similarity to obtain the intrinsic graph matrix weight g in and the penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows:

[0055]

[0056] In the formula, c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j, and its calculation expression is as follows:

[0057]

[0058] In the formula, exp represents the exponential function, z i and z j denote the feature vectors of data i and data j respectively, and σ is the scaling parameter;

[0059] Penalty graph matrix weight g p The calculation expression is as follows:

[0060]

[0061] In the formula, N represents the total number of network intrusion detection data;

[0062] Using the calculated intrinsic graph matrix weight g in and the penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U = D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g p The sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G. Specifically, the intrinsic graph Laplace matrix L is projected into the feature space to obtain the intrinsic graph matrix G. in =X TLX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and the penalty graph matrix G p Get the graph embedding matrix G;

[0063] The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows:

[0064] The calculation process of the density information is as follows: given the mth network intrusion detection data x m , firstly, m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S - The q nearest neighbors in Then calculate x m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows:

[0065]

[0066] In the formula, s i represents the i-th nearest neighbor in S, t j Represents S _ The jth nearest neighbor in ;

[0067] The mixing weight matrix is ​​calculated by the following mixing formula

[0068]

[0069] In the formula, ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value;

[0070] The category information calculation process is: the density penalty weight E of the data is calculated by the following formula i :

[0071]

[0072] Where N i Represents the i-th network intrusion detection data x iThe total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula:

[0073]

[0074] Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - :

[0075] d + =χF + +(1-χ)E +

[0076] d - =χF - +(1-χ)E -

[0077] Where χ is a parameter that weighs the global distribution and local density information, and F + and F _ denote the computational penalty costs of normal data and intrusion data, respectively, and E + and E - - represent the density penalty weights of normal data and intrusion data respectively.

[0078] Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called a graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network to obtain a graph embedding weighted wide network with optimal performance as a classification model for network intrusion detection data.

[0079] The wide neural network includes a two-layer neural structure. The first layer is a network intrusion detection data X that is embedded in an activation function through random weights and biases to generate feature nodes Z (Z in the figure n represents the nth feature node), and the second layer is the feature node that is embedded with a nonlinear activation function through random weights and biases to generate an enhanced node H (H in the figure n represents the nth enhancement node), and finally the feature node Z and the enhancement node H are spliced ​​to form the hidden node A of normal data and intrusion data. + and A - , and then A + and A -Splicing to form hidden layer A;

[0080] The optimization objective function of the graph embedding weighted width network is:

[0081]

[0082] sA + W=Y + -δ + and A - W=Y - -δ -

[0083] In the formula, represents the L2 normal form, represents the minimization of W, λ is the regularization parameter of the width neural network, θ is the regularization parameter of the graph structure, and δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established;

[0084] The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows:

[0085]

[0086] In the formula, -1 represents the pseudo-inverse of the matrix and I represents the identity matrix.

[0087] Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.

[0088] The input graph of the network intrusion detection data to be tested is embedded in the weighted width network. The feature nodes of the data to be tested are obtained by embedding the activation function with random weights and biases at the same time. The feature nodes of the data to be tested are then embedded in the nonlinear activation function with random weights and biases at the same time to generate the enhanced nodes of the data to be tested. Then, the feature nodes and enhanced nodes of the data to be tested are concatenated by column to obtain the hidden layer A. Finally, the final classification result is calculated by the following formula:

[0089]

[0090] In the formula, is the predicted label, that is, the final classification result.

[0091] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A network intrusion detection method based on graph embedding weighted width network, characterized in that: The following steps are involved: Step 1: collect network intrusion detection data and preprocess the network intrusion detection data to obtain clean data and labels, which are divided into normal data and intrusion data; Step 2, using the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, using the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct intrinsic graph Laplace matrix and penalty graph Laplace matrix, and finally using the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; using the preprocessed network intrusion detection data to calculate the density information and category information of the data, and designing the class penalty weight based on the density information and category information; Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called a graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network to obtain a graph embedding weighted wide network with optimal performance as a classification model for network intrusion detection data. Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.

2. According to claim 1, a network intrusion detection method based on graph embedding weighted width network is characterized in that: Preprocess the network intrusion detection data, including filling missing values ​​with the average value of the adjacent data, deleting data with many missing features, dividing the data labels into normal data and intrusion data, and performing one-hot encoding on the labels.

3. The network intrusion detection method based on graph embedding weighted width network according to claim 2 is characterized by: Use the preprocessed network intrusion detection data to calculate sample similarity to obtain the intrinsic graph matrix weight g in and the penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows: In the formula, c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j, and its calculation expression is as follows: In the formula, exp represents the exponential function, z i and z j denote the feature vectors of data i and data j respectively, and σ is the scaling parameter; Penalty graph matrix weight g p The calculation expression is as follows: In the formula, N represents the total number of network intrusion detection data; Using the calculated intrinsic graph matrix weight g in and the penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U = D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g p The sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G. Specifically, the intrinsic graph Laplace matrix L is projected into the feature space to obtain the intrinsic graph matrix G. in =X T LX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and the penalty graph matrix G p Get the graph embedding matrix G; The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows: The calculation process of the density information is as follows: given the mth network intrusion detection data x m , firstly, m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S _ The q nearest neighbors in Then calculate x m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows: In the formula, s i represents the i-th nearest neighbor in S, t j Represents S _ The jth nearest neighbor in ; The mixing weight matrix is ​​calculated by the following mixing formula In the formula, ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value; The category information calculation process is: the density penalty weight E of the data is calculated by the following formula i : Where N i Represents the i-th network intrusion detection data x i The total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula: Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - : the + =χF + +(1-χ)E + the - =χF - +(1-χ)E - Where χ is a parameter that weighs the global distribution and local density information, and F + and F _ denote the computational penalty costs of normal data and intrusion data, respectively, and E + and E _ - represent the density penalty weights of normal data and intrusion data respectively.

4. A network intrusion detection method based on graph embedding weighted width network according to claim 3, characterized in that: The wide neural network includes a two-layer neural structure. The first layer is the network intrusion detection data X embedded in the activation function through random weights and biases to generate feature nodes Z. The second layer is the feature nodes embedded in the nonlinear activation function through random weights and biases to generate enhanced nodes H. Finally, the feature nodes Z and enhanced nodes H are spliced ​​to form hidden nodes A of normal data and intrusion data. + and A _ , and then A + and A _ Splicing to form hidden layer A; The optimization objective function of the graph embedding weighted width network is: s.t.A + W = Y + -δ + and A - W = Y - -δ - In the formula, represents the L2 normal form, represents the minimization of W, λ is the regularization parameter of the width neural network, is the regularization parameter of the graph structure, δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established; The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows: In the formula, - 1 represents the pseudo-inverse of the matrix and I represents the identity matrix.

5. A network intrusion detection method based on graph embedding weighted width network according to claim 4, characterized in that: In step 4, the input graph of the network intrusion detection data to be tested is embedded in the weighted width network, and the feature nodes of the data to be tested are obtained by embedding the activation function through random weights and biases at the same time. The feature nodes of the data to be tested are then embedded in the nonlinear activation function through random weights and biases to generate enhanced nodes of the data to be tested, and then the feature nodes and enhanced nodes of the data to be tested are concatenated by column to obtain the hidden layer A. Finally, the final classification result is calculated by the following formula: In the formula, is the predicted label, that is, the final classification result.

Images