A network intrusion detection method based on graph embedding weighted width network
Through a method based on graph embedding weighted width network, the imbalance problem of network intrusion detection in the industrial Internet is solved, high-precision imbalanced data noise classification is achieved, and the accuracy and robustness of detection are improved.
Patent Information
- Application Number
- CN202411725708.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-28
- Publication Date
- 2025-09-19
- Estimated Expiration
- 2044-11-28
AI Technical Summary
In the Industrial Internet, due to the low frequency of network intrusions and data imbalance, traditional network intrusion detection models have problems of low accuracy and poor generalization ability. Deep learning models are prone to overfitting when training data is limited, making it difficult to effectively detect and respond to network intrusions.
A method based on graph embedding weighted width network is adopted. By constructing the intrinsic graph and penalty graph matrix, using the Laplacian matrix to preserve geometric properties and class-specific penalty strategy, class penalty weights are designed, and the width neural network is optimized to improve detection accuracy and robustness.
It improves the accuracy and robustness of network intrusion detection, can effectively handle unbalanced data and noise, enhances the ability to identify minority samples, and improves the adaptability and generalization ability of network intrusion detection.
Smart Images
Figure CN119652575B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network intrusion detection and imbalanced learning, and in particular to a network intrusion detection method based on graph embedding weighted width network. Background Art
[0002] The Industrial Internet deeply integrates industrial systems with internet technologies, enabling interoperability between devices and efficient data transmission and sharing. Extracting valuable information from massive amounts of industrial data is crucial for equipment health management and forms the foundation for safe, reliable, and efficient equipment operation. Network intrusion detection, as a core component of equipment health management, plays a key role in ensuring the continuity and stability of production processes. Network intrusion detection enables enterprises to quickly detect and resolve security threats that arise during production, which is crucial for protecting equipment from intrusions and enhancing market competitiveness. However, in real-world industrial production scenarios, due to the continuous improvement of equipment reliability, most machines operate normally most of the time, and the frequency of network intrusions is relatively low. This requires models that can accurately diagnose network intrusions, prevent hacker attacks on Industrial Internet devices, and improve device stability. Therefore, network intrusion detection systems must possess high accuracy and real-time performance to ensure timely response and resolution when equipment anomalies or attacks occur. Consequently, sensor readings collected from network devices primarily consist of normal data, with intrusion data representing a relatively small proportion. Under such an imbalanced class distribution, traditional network intrusion diagnosis models often suffer from a series of flaws, such as low fault identification accuracy and poor generalization. These issues ultimately severely hinder the efficiency and reliability of traditional network intrusion diagnosis methods in the industrial internet environment. The presence of noise in the data exacerbates the model's decision bias for imbalanced data, further deteriorating classification performance. Deep learning models, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and autoencoders, have been widely used in the field of fault diagnosis. However, these deep learning-based network intrusion detection methods, due to their complex network structures and large number of parameters, often require extensive data for model training. When training data is limited, these models are prone to overfitting and exhibit poor generalization performance on unseen data. Furthermore, their training process is time-consuming. Therefore, there is an urgent need for a targeted learning model that can address the current imbalanced network intrusion detection problem.
[0003] Based on the various problems in the context of the above-mentioned industrial Internet, this patent designs a network intrusion detection method based on graph embedded weighted width network. It utilizes the simple linear structure of the width neural network and an efficient training method that does not require backpropagation but only requires pseudo-inverse to obtain the optimal solution. At the same time, it embeds the intrinsic graph and penalty graph structure as well as the class-specific penalty strategy into the optimized objective function, thereby improving the accuracy and efficiency of network intrusion detection, and providing more powerful technical support for the problem of efficient network intrusion detection in the industrial Internet environment. Summary of the Invention
[0004] The purpose of the present invention is to address the serious class imbalance and noise information interference problems in current industrial production network intrusion detection scenarios. A network intrusion detection method based on graph embedding weighted width network is provided. The graph embedding strategy is used to capture the topological structure, and the Laplace matrix is used to preserve geometric properties. A class-specific penalty strategy is used to solve the imbalance problem, thereby achieving high-precision imbalanced data noise classification.
[0005] To achieve the above objectives, the present invention provides a technical solution: a network intrusion detection method based on graph embedding weighted width network, comprising the following steps:
[0006] Step 1: Collect network intrusion detection data and preprocess it to obtain clean data and labels. The labels are divided into normal data and intrusion data.
[0007] Step 2: Use the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, and use the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct the intrinsic graph Laplace matrix and penalty graph Laplace matrix. Finally, use the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; use the preprocessed network intrusion detection data to calculate the density information and category information of the data, and design the class penalty weight based on the density information and category information;
[0008] Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network, and obtain the graph embedding weighted wide network with the best performance as the classification model for network intrusion detection data.
[0009] Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.
[0010] Furthermore, the network intrusion detection data is preprocessed, including filling missing values with the average value of the adjacent data before and after, deleting data with many missing features, dividing the data labels into normal data and intrusion data, and performing one-hot encoding on the labels.
[0011] Furthermore, the preprocessed network intrusion detection data is used to calculate the sample similarity to obtain the intrinsic graph matrix weight g in and penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows:
[0012]
[0013] Where c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j. Its calculation expression is as follows:
[0014]
[0015] Where exp represents the exponential function, z i and z j They represent the feature vectors of data i and data j respectively, and σ is the scaling parameter;
[0016] Penalty graph matrix weight g p The calculation expression is as follows:
[0017]
[0018] Where N represents the total number of network intrusion detection data;
[0019] Using the calculated intrinsic graph matrix weight g in and penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U=D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g pThe sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G, specifically projecting the intrinsic graph Laplace matrix L into the feature space to obtain the intrinsic graph matrix G in =X T LX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and penalty graph matrix G p Get the graph embedding matrix G;
[0020] The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows:
[0021] The calculation process of the density information is as follows: given the mth network intrusion detection data x m , first of all, with x m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S - The q nearest neighbors in Then calculate x respectively m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows:
[0022]
[0023] Where s i represents the i-th nearest neighbor in S, t j Stands for S - The jth nearest neighbor in ;
[0024] The mixing weight matrix is calculated by the following mixing formula
[0025]
[0026] Where ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value;
[0027] The category information calculation process is: the density penalty weight E of the data is calculated by the following formula: i :
[0028]
[0029] Where N i Represents the i-th network intrusion detection data x i The total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula:
[0030]
[0031] Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - :
[0032] d + =χF + +(1-χ)E +
[0033] d - =χF - +(1-χ)E -
[0034] Where χ is a parameter that weighs the global distribution and local density information, and F + and F - denote the computational penalty costs of normal data and intrusion data, E + and E - - represents the density penalty weights of normal data and intrusion data respectively.
[0035] Furthermore, the width neural network includes a two-layer neural structure. The first layer is the network intrusion detection data X embedded in the activation function through random weights and biases to generate feature nodes Z. The second layer is the feature nodes embedded in the nonlinear activation function through random weights and biases to generate enhanced nodes H. Finally, the feature nodes Z and enhanced nodes H are spliced to form hidden nodes A of normal data and intrusion data. + and A - , and then A + and A - Splicing to form hidden layer A;
[0036] The optimization objective function of the graph embedding weighted width network is:
[0037]
[0038] sA + W=Y + -δ + and A _ W=Y _ -δ _
[0039] Where, represents the L2 normal form, Indicates the minimization of W, λ is the regularization parameter of the width neural network, θ is the regularization parameter of the graph structure, δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established;
[0040] The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows:
[0041]
[0042] In the formula, - 1 represents the pseudo-inverse of the matrix, and I represents the identity matrix.
[0043] Furthermore, in step 4, the input graph of the network intrusion detection data to be tested is embedded in the weighted width network. After the activation function is embedded simultaneously with random weights and biases, the feature nodes of the data to be tested are obtained. The feature nodes of the data to be tested are then embedded simultaneously with the nonlinear activation function through random weights and biases to generate enhanced nodes of the data to be tested. Then, the feature nodes and enhanced nodes of the data to be tested are spliced together by column to obtain the hidden layer A. Finally, the final classification result is calculated by the following formula:
[0044]
[0045] Where, is the predicted label, that is, the final classification result.
[0046] Compared with the prior art, the present invention has the following advantages and beneficial effects:
[0047] The present invention comprehensively considers the intra-class and inter-class density and global distribution information of network intrusion detection data through a class-specific penalty weight strategy, comprehensively reflects data characteristics to solve the imbalance problem, distinguishes sample differences by calculating mixed density and weights, reduces the impact of difficult-to-distinguish samples, improves accuracy, and can also adaptively adjust weights to adapt to unbalanced data containing noise and outliers, enhance network adaptability and generalization capabilities, and optimize classification decisions to enhance the ability to identify minority class samples, namely intrusion categories. In terms of processing noisy data, existing methods do not effectively utilize graph structure information. The present invention uses graph embedding technology to preserve geometric and topological relationships and enhance the ability to process noisy data. Graph embedding not only enhances the robustness of the network in the face of noisy data, but also converts graph data into vector form to enhance the wide network's ability to express complex data. More importantly, the geometric and topological relationships of the data can be preserved during the optimization process, allowing the network to more accurately capture the similarities and differences between unbalanced samples, thereby effectively improving the detection performance of network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS
[0048] Figure 1 Schematic diagram of a flow chart of an embodiment of the present invention.
[0049] Figure 2 This is an overall architecture diagram of the technology used in the present invention. DETAILED DESCRIPTION
[0050] The present invention will be described in further detail below with reference to the embodiments and drawings, but the embodiments of the present invention are not limited thereto.
[0051] like Figure 1 and Figure 2 As shown, this embodiment discloses a network intrusion detection method based on graph embedding weighted width network, the details of which are as follows:
[0052] Step 1: Collect network intrusion detection data and preprocess it, including filling missing values with the average of the adjacent data before and after, deleting data with many missing features, dividing the data labels into normal data and intrusion data, and performing one-hot encoding on the labels to obtain clean data and labels. The labels are divided into normal data and intrusion data;
[0053] Step 2: Use the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, and use the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct the intrinsic graph Laplace matrix and penalty graph Laplace matrix. Finally, use the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; use the preprocessed network intrusion detection data to calculate the density information and category information of the data, and design the class penalty weight based on the density information and category information;
[0054] Use the preprocessed network intrusion detection data to calculate the sample similarity to obtain the intrinsic graph matrix weight g in and penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows:
[0055]
[0056] Where c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j. Its calculation expression is as follows:
[0057]
[0058] Where exp represents the exponential function, z i and z j They represent the feature vectors of data i and data j respectively, and σ is the scaling parameter;
[0059] Penalty graph matrix weight g p The calculation expression is as follows:
[0060]
[0061] Where N represents the total number of network intrusion detection data;
[0062] Using the calculated intrinsic graph matrix weight g in and penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U=D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g p The sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G, specifically projecting the intrinsic graph Laplace matrix L into the feature space to obtain the intrinsic graph matrix G in =X TLX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and penalty graph matrix G p Get the graph embedding matrix G;
[0063] The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows:
[0064] The calculation process of the density information is as follows: given the mth network intrusion detection data x m , first of all, with x m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S - The q nearest neighbors in Then calculate x respectively m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows:
[0065]
[0066] Where s i represents the i-th nearest neighbor in S, t j Stands for S _ The jth nearest neighbor in ;
[0067] The mixing weight matrix is calculated by the following mixing formula
[0068]
[0069] Where ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value;
[0070] The category information calculation process is: the density penalty weight E of the data is calculated by the following formula: i :
[0071]
[0072] Where N i Represents the i-th network intrusion detection data x iThe total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula:
[0073]
[0074] Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - :
[0075] d + =χF + +(1-χ)E +
[0076] d - =χF - +(1-χ)E -
[0077] Where χ is a parameter that weighs the global distribution and local density information, and F + and F _ denote the computational penalty costs of normal data and intrusion data, E + and E - - represents the density penalty weights of normal data and intrusion data respectively.
[0078] Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network, and obtain the graph embedding weighted wide network with the best performance as the classification model for network intrusion detection data.
[0079] The wide neural network includes a two-layer neural structure. The first layer is the network intrusion detection data X that is embedded in the activation function through random weights and biases to generate feature nodes Z (Z in the figure). n Represents the nth feature node), the second layer is the feature node that is embedded with a nonlinear activation function through random weights and biases to generate an enhanced node H (H in the figure n Represents the nth enhancement node), and finally concatenates the feature node Z and the enhancement node H to form the hidden node A of normal data and intrusion data. + and A - , and then A + and A -Splicing to form hidden layer A;
[0080] The optimization objective function of the graph embedding weighted width network is:
[0081]
[0082] sA + W=Y + -δ + and A - W=Y - -δ -
[0083] Where, represents the L2 normal form, Indicates the minimization of W, λ is the regularization parameter of the width neural network, θ is the regularization parameter of the graph structure, δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established;
[0084] The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows:
[0085]
[0086] Where, -1 represents the pseudo-inverse of the matrix, and I represents the identity matrix.
[0087] Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.
[0088] The network intrusion detection data input graph to be tested is embedded in the weighted width network. After embedding the activation function through random weights and biases, the feature nodes of the test data are obtained. The feature nodes of the test data are then embedded in the nonlinear activation function through random weights and biases to generate the enhanced nodes of the test data. Then, the feature nodes and enhanced nodes of the test data are concatenated column by column to obtain the hidden layer A. Finally, the final classification result is calculated by the following formula:
[0089]
[0090] Where, is the predicted label, that is, the final classification result.
[0091] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.
Claims
1. A network intrusion detection method based on graph embedding weighted width network, characterized in that: The following steps are involved: Step 1: Collect network intrusion detection data and preprocess it to obtain clean data and labels. The labels are divided into normal data and intrusion data. Step 2: Use the preprocessed network intrusion detection data to calculate sample similarity to obtain intrinsic graph matrix weights and penalty graph matrix weights, and use the calculated intrinsic graph matrix weights and penalty graph matrix weights to construct the intrinsic graph Laplace matrix and penalty graph Laplace matrix. Finally, use the obtained intrinsic graph Laplace matrix, penalty graph Laplace matrix and preprocessed network intrusion detection data to construct a graph embedding matrix; use the preprocessed network intrusion detection data to calculate the density information and category information of the data, and design the class penalty weight based on the density information and category information; Step 3: Add the graph embedding matrix and class penalty weights obtained in step 2 to a wide neural network to form an improved wide neural network, called graph embedding weighted wide network. Use the preprocessed network intrusion detection data to train the graph embedding weighted wide network, and obtain a graph embedding weighted wide network with optimal performance as the classification model for network intrusion detection data. Step 4: Use the graph embedding weighted width network with the best performance to classify the network intrusion detection data to be tested, and obtain the classification results of normal data and intrusion data.
2. The network intrusion detection method based on graph embedding weighted width network according to claim 1 is characterized by: Preprocessing of network intrusion detection data includes filling missing values with the average value of adjacent data, deleting data with many missing features, dividing data labels into normal data and intrusion data, and performing one-hot encoding on the labels.
3. The network intrusion detection method based on graph embedding weighted width network according to claim 2, characterized in that: Use the preprocessed network intrusion detection data to calculate the sample similarity to obtain the intrinsic graph matrix weight g in and penalty graph matrix weight g p , where the intrinsic graph matrix weight g in The calculation expression is as follows: Where c i and c j Respectively represent the categories to which data i and data j belong, Indicates category c i The number of samples in ,η ij It represents the similarity between data i and data j. Its calculation expression is as follows: Where exp represents the exponential function, z i and z j They represent the feature vectors of data i and data j respectively, and σ is the scaling parameter; Penalty graph matrix weight g p The calculation expression is as follows: Where N represents the total number of network intrusion detection data; Using the calculated intrinsic graph matrix weight g in and penalty graph matrix weight g p Construct the Laplace matrix L of the inner graph and the Laplace matrix U of the penalty graph, expressed as L = Dg in and U=D p -g p , where D is the intrinsic graph diagonal matrix, each value of its diagonal is g in The sum of the current value and the weights of all other edges, D p is the diagonal matrix of the penalty graph, each value of its diagonal is g p The sum of the current value and the weights of all other edges; use the obtained intrinsic graph Laplace matrix L, penalty graph Laplace matrix U and preprocessed network intrusion detection data to construct a graph embedding matrix G, specifically projecting the intrinsic graph Laplace matrix L into the feature space to obtain the intrinsic graph matrix G in =X T LX, where X is the network intrusion detection data, T represents the transpose of the matrix, and the penalty graph Laplacian matrix U is projected into the feature space to obtain the penalty graph matrix G p =X T UX, finally, merge the intrinsic graph matrix G in and penalty graph matrix G p Get the graph embedding matrix G; The density information and category information of the data are calculated using the preprocessed network intrusion detection data, as follows: The calculation process of the density information is as follows: given the mth network intrusion detection data x m , first of all, with x m The data of the same category constitutes a set S, which is the same as x m Different categories of data constitute a set S - , calculate x using the K nearest neighbor algorithm m The p nearest neighbors in S and S _ The q nearest neighbors in Then calculate x separately m In S and S - The intra-class density ρ in p and the inter-class density ρ q , the calculation formula is as follows: Where s i represents the i-th nearest neighbor in S, t j Stands for S _ The jth nearest neighbor in ; The mixing weight matrix is calculated by the following mixing formula Where ω is a parameter that weighs the density weight, and the gradient search strategy is used to find the optimal value; The category information calculation process is: the density penalty weight E of the data is calculated by the following formula: i : Where N i Represents the i-th network intrusion detection data x i The total number of data in the class; then, the sum of the penalty weights M of normal data and intrusion data is calculated based on the penalty weight, and the class penalty cost F is calculated based on the category information i , expressed by the following formula: Where η maj and η min Represent the number of samples in normal data and intrusion data respectively, V is the total number of labeled categories, and ave() represents the average value of the samples; finally, the class penalty weight d of normal data is obtained by the following formula + and the class penalty weight d of the intrusion data - : the + =χF + +(1-χ)E + the - =χF - +(1-χ)E - Where χ is a parameter that weighs the global distribution and local density information, and F + and F _ denote the computational penalty costs of normal data and intrusion data, E + and E _ - represents the density penalty weights of normal data and intrusion data respectively.
4. A network intrusion detection method based on graph embedding weighted width network according to claim 3, characterized in that: The width neural network includes a two-layer neural structure. The first layer is the network intrusion detection data X embedded in the activation function through random weights and biases to generate feature nodes Z. The second layer is the feature nodes embedded in the nonlinear activation function through random weights and biases to generate enhanced nodes H. Finally, the feature nodes Z and enhanced nodes H are spliced to form hidden nodes A of normal data and intrusion data. + and A _ , and then A + and A _ Splicing to form hidden layer A; The optimization objective function of the graph embedding weighted width network is: s.t.A + W = Y + -δ + and A - W = Y - -δ - Where, represents the L2 normal form, It means minimizing W, λ is the regularization parameter of the width neural network, is the regularization parameter of the graph structure, δ + and δ - is the error of positive and negative classification, Y + and Y - are positive and negative sample labels, W is the optimal output weight to be solved, and st indicates that the assumption condition is established; The optimization objective function is differentiated and pseudo-inversely calculated to obtain the optimal output weight, which is expressed as follows: Where, - 1 represents the pseudo-inverse of the matrix, and I represents the identity matrix.
5. A network intrusion detection method based on graph embedding weighted width network according to claim 4, characterized in that: In step 4, the network intrusion detection data input graph to be tested is embedded in the weighted width network. After embedding the activation function through random weights and biases, the feature nodes of the data to be tested are obtained. The feature nodes of the data to be tested are then embedded in the nonlinear activation function through random weights and biases to generate the enhanced nodes of the data to be tested. Then, the feature nodes and enhanced nodes of the data to be tested are spliced together by column to obtain the hidden layer A. Finally, the final classification result is calculated by the following formula: Where, is the predicted label, that is, the final classification result.