Wireless communication network intrusion detection method and device facing confrontation sample defense

Abstract

The invention provides a wireless communication network intrusion detection method and device facing confrontation sample defense, and belongs to the technical field of communication network security, and the method comprises the steps: carrying out the feature extraction of to-be-detected traffic data, and obtaining the spatial-temporal features of the to-be-detected traffic data; inputting the spatial-temporal characteristics into a discriminator of a pre-trained generative adversarial network, and obtaining a first detection result of the to-be-detected traffic data; performing deep packet detection on the to-be-detected traffic data, and performing abnormal behavior analysis on the to-be-detected traffic data based on the spatial-temporal characteristics to obtain a second detection result; and inputting the decision information into a pre-trained decision tree model, and determining a final detection result of the to-be-detected traffic data. According to the method, the abnormal modes in the network traffic can be accurately detected and classified, and encryption communication can be deeply analyzed, so that the safety protection capability of a wireless communication network is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of communication network technology, and in particular to a wireless communication network intrusion detection method and device oriented to adversarial sample defense. Background Art

[0002] In the modern wireless communication network environment, with the rapid development of technology and the popularization of global network applications, the threats to network security are increasing, and the forms are becoming more and more diverse and complex. Traditional network attacks such as viruses, Trojans and phishing attacks are already well known, and more complex network attack methods, such as advanced persistent threats (APT), control and steal network resources through long-term latency and chronic penetration, which poses a severe challenge to network security. The development of dark web technology, especially the use of anonymous networks such as Tor, enables malicious users to communicate and exchange data in a nearly untraceable manner. The increase in this type of encrypted traffic has greatly increased the difficulty of traditional network monitoring and intrusion detection technologies.

[0003] In this context, the widespread application of machine learning technology has played a significant role in improving the automation and intelligence level of network security. However, the introduction of this technology has also brought new challenges. In particular, the emergence of generative adversarial network (GAN) technology has enabled attackers to create increasingly sophisticated adversarial samples. These adversarial samples can deceive security detection systems based on machine learning models by introducing subtle and clever perturbations into normal network traffic (actual network traffic), making it difficult for them to correctly identify real threats, and may even completely bypass security protection measures.

[0004] The rapid growth of Internet of Things (IoT) devices and the prevalence of smart devices in daily life have significantly increased the security attack surface at the edge of wireless communication networks. These devices often lack adequate security protection measures, making them an easy target for attackers. Network security systems need to be able to not only identify traditional threats, but also effectively monitor and defend against potential risks from these emerging devices. Summary of the invention

[0005] The present invention provides a wireless communication network intrusion detection method and device for adversarial sample defense, so as to solve at least one defect existing in the prior art.

[0006] In a first aspect, the present invention provides a wireless communication network intrusion detection method for adversarial sample defense, comprising: extracting features of flow data to be tested to obtain spatiotemporal features of the flow data to be tested; inputting the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be tested; performing deep packet detection on the flow data to be tested, and performing abnormal behavior analysis on the flow data to be tested based on the spatiotemporal features to obtain a second detection result; inputting decision information into a pre-trained decision tree model to determine the final detection result of the flow data to be tested; the decision information includes key parameters of the flow data to be tested, the first detection result and the second detection result.

[0007] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, after determining the final detection result of the flow data to be tested, it also includes: in the case where it is determined that the flow data to be tested is malicious data according to the final detection result, triggering a response decision for the final detection result.

[0008] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, feature extraction is performed on the flow data to be measured to obtain the spatiotemporal characteristics of the flow data to be measured, including: extracting key parameters of the flow data to be measured; inputting the key parameters into a multi-layer perceptron to extract high-dimensional vector features of the flow data to be measured; inputting the high-dimensional vector features into a convolutional neural network to obtain the spatiotemporal characteristics of the flow data to be measured.

[0009] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, the generative adversarial network includes a discriminator and a generator; the generator is used to generate feature data of adversarial samples using random noise signals; the adversarial samples are malicious data that imitate actual traffic data; the discriminator is used to identify actual traffic data and adversarial samples based on the feature data of the adversarial samples and the actual traffic data.

[0010] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, deep packet inspection is performed on the flow data to be tested, including: analyzing the header information and load content of the flow data to be tested to determine whether it carries malicious information.

[0011] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, abnormal behavior analysis is performed on the flow data to be measured based on the spatiotemporal characteristics, including: based on the spatiotemporal characteristics of the flow data to be measured and a plurality of types of pre-set standard spatiotemporal characteristics, a comparative analysis of the abnormal behavior of the flow data to be measured is performed; wherein the plurality of types of standard spatiotemporal characteristics include the spatiotemporal characteristics of actual flow standard data and the spatiotemporal characteristics of various malicious flow standard data; and when it is determined that the spatiotemporal characteristics of the flow data to be measured match the spatiotemporal characteristics of any malicious flow standard data, a corresponding response decision is triggered.

[0012] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, decision information is input into a pre-trained decision tree model to determine the final detection result of the flow data to be tested, including: pre-setting multiple decision nodes of the decision tree model according to key parameters of the flow data to be tested, a first detection result and a second detection result; setting classification rules for each decision node; starting from the root node, based on the set classification rules, gradually refining the classification results until reaching a leaf node; the leaf node outputs the final classification result to determine whether the flow data to be tested is malicious flow data.

[0013] According to a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, before feature extraction is performed on the flow data to be tested, it also includes: deploying flow monitoring equipment at each key access point of the wireless communication network; using the flow monitoring equipment to capture the passing data packets, and performing data cleaning on the captured data packets; performing data standardization processing on the cleaned data to obtain the flow data to be tested.

[0014] In a second aspect, the present invention further provides a wireless communication network intrusion detection device for adversarial sample defense, comprising: The first processing module is used to extract features of the flow data to be measured and obtain the spatiotemporal features of the flow data to be measured; A second processing module is used to input the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; A third processing module is used to perform deep packet detection on the flow data to be measured, and to perform abnormal behavior analysis on the flow data to be measured based on the spatiotemporal characteristics to obtain a second detection result; The fourth processing module is used to input the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured; the decision information includes key parameters of the flow data to be measured, the first detection result and the second detection result.

[0015] In a third aspect, the present invention provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of a wireless communication network intrusion detection method for adversarial sample defense as described in any one of the above-mentioned methods are implemented.

[0016] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described wireless communication network intrusion detection methods for adversarial sample defense.

[0017] The wireless communication network intrusion detection method and device for adversarial sample defense provided by the present invention have the following beneficial effects compared with the prior art: (1) By integrating a multi-layer perceptron (MLP) and a convolutional neural network (CNN), the present invention can effectively identify and classify complex network traffic and behavior patterns, thereby improving the detection accuracy of malicious activities.

[0018] (2) The present invention makes specific optimizations to the Generative Adversarial Network (GAN) and adds an adaptive adversarial sample generation mechanism. This mechanism introduces a real-time updateable attack strategy model into the generator, enabling the generator to generate corresponding adversarial samples based on the latest network attack methods. This enables the model to be updated in real time and effectively counter the latest and more complex network attack strategies.

[0019] (3) The present invention combines deep packet inspection (DPI) and rule-based behavioral analysis, which can not only accurately identify traditional security threats, but also conduct in-depth analysis of encrypted communications and enhance the monitoring capability of covert communications.

[0020] (4) The present invention can adapt to changes in the network environment and adjust defense strategies in a timely manner to ensure continuous network security by implementing automated response measures and combining them with a continuous feedback mechanism. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a flow chart of a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention; Figure 2 It is a schematic diagram of a process of performing anomaly detection using a generative adversarial network provided by the present invention; Figure 3 It is a flowchart of the decision-making, response and feedback mechanism provided by the present invention; Figure 4 It is a structural schematic diagram of a wireless communication network intrusion detection device for adversarial sample defense provided by the present invention; Figure 5 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] It should be noted that, in the description of the embodiments of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0025] The terms "first", "second", etc. in this application are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application can be implemented in an order other than those illustrated or described here, and the objects distinguished by "first", "second", etc. are generally of one type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" represents at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0026] Combine the following Figure 1-Figure 5 The present invention describes a wireless communication network intrusion detection method and device for adversarial sample defense provided by an embodiment of the present invention.

[0027] Figure 1 is a flow chart of a wireless communication network intrusion detection method for adversarial sample defense provided by the present invention, such as Figure 1 As shown, including but not limited to the following steps: Step 101: extract features from the flow data to be measured to obtain the spatiotemporal features of the flow data to be measured.

[0028] Optionally, before feature processing, a data preprocessing process is also included, including but not limited to data cleaning and data standardization processes.

[0029] Step 102: Input the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured.

[0030] The generative adversarial network includes a discriminator and a generator; the generator is used to generate feature data of adversarial samples using random noise signals; the adversarial samples are malicious data that imitate actual traffic data; the discriminator is used to identify actual traffic data and adversarial samples based on the feature data of the adversarial samples and the actual traffic data.

[0031] Among them, the first detection result is to determine whether the traffic data to be tested is actual traffic data (which can be understood as normal traffic data) or an adversarial sample (malicious traffic data that imitates actual traffic data).

[0032] Step 103: Perform deep packet inspection on the traffic data to be measured, and perform abnormal behavior analysis on the traffic data to be measured based on the spatiotemporal characteristics to obtain a second detection result.

[0033] A deeper analysis of suspected abnormal traffic is conducted, not limited to surface feature matching, but goes deep into the content of the data packet to check whether there are any behavioral patterns that violate the norm. This process helps to discover complex attacks that cannot be identified by simple feature changes.

[0034] The second detection result includes whether the traffic data to be tested is malicious data and which specific type of malicious data it is.

[0035] Step 104: input the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured.

[0036] The decision information includes but is not limited to key parameters of the flow data to be tested, the first detection result and the second detection result, and may also include the spatiotemporal characteristics of the flow data to be tested, and the key parameters include but are not limited to data packet size, communication frequency and timestamp.

[0037] A decision tree is a supervised learning algorithm that classifies data through a series of rules or conditional tests. It is well suited for situations where multiple factors need to be considered in making a decision.

[0038] Optionally, after determining the final detection result of the flow data to be tested, it also includes: in a case where it is determined according to the final detection result that the flow data to be tested is malicious data, triggering a response decision for the final detection result.

[0039] The technical solution of the present invention is described below in conjunction with a specific embodiment: Step 1: Data collection and preprocessing The present invention automatically captures all inbound and outbound traffic data from the wireless communication network. This process is achieved through traffic monitoring equipment deployed at key access points of the network to ensure comprehensive monitoring of the data flow of the network. In the data acquisition stage, the present invention uses high-precision synchronization technology to record the timestamp and source / destination address of each data packet to ensure the integrity and traceability of the data. In the data preprocessing link, the present invention automatically performs data cleaning to remove network noise and non-target data streams, including all redundant information not related to security analysis. Subsequently, the present invention standardizes the data, unifies the data format into JSON, and adopts the UTF-8 encoding format to meet the subsequent deep learning processing requirements.

[0040] The specific operations are as follows: Step 1.1 Device deployment and data capture Traffic monitoring devices are deployed at key access points of the wireless communication network, including gateways, routers, and core switches. These devices are configured to capture all packets passing through, including IP layer data and transport layer details. The devices use the Network Time Protocol (NTP) to ensure that the timestamp of each data packet is accurate to milliseconds.

[0041] Step 1.2 Data cleaning Once the data is captured, the present invention immediately performs a preliminary analysis to identify and remove irrelevant data. This includes the use of predefined IP address whitelists and blacklists, as well as content-based filtering, such as advertising-related data and data streams generated by obvious legitimate applications. At the same time, the present invention detects and removes error packets and duplicate packets in data transmission, ensuring that the data subsequently processed has high quality and relevance.

[0042] Step 1.3 Data Standardization After completing data cleaning, the present invention converts all data into a unified JSON format to form the flow data to be tested. This operation involves mapping the data fields of various network protocols (such as TCP / UDP port number, protocol type, packet length, etc.) to the key-value pairs of JSON. All text data is uniformly encoded in UTF-8. Data standardization ensures that data from different sources and formats can be uniformly managed and queried in subsequent processing.

[0043] Step 2: Feature extraction Extracting features from the flow data to be measured to obtain the spatiotemporal features of the flow data to be measured includes: extracting key parameters of the flow data to be measured; inputting the key parameters into a multi-layer perceptron to extract high-dimensional vector features of the flow data to be measured; and inputting the high-dimensional vector features into a convolutional neural network to obtain the spatiotemporal features of the flow data to be measured. The following is a detailed description.

[0044] Based on step one, the feature extraction stage is entered. The feature extraction in the present invention can be performed jointly by a multi-layer perceptron (MLP) and a convolutional neural network (CNN). First, key parameters are directly obtained from the preprocessed data, including data packet size, communication frequency, and timestamp. These key parameters serve as initial data and provide a basis for pattern recognition and anomaly detection. Subsequently, the MLP further processes these directly obtained key parameters and extracts deeper feature representations through nonlinear mapping and feature combination. The convolutional neural network (CNN) continues to process the data, using its stacked convolutional layers and pooling layers to extract spatial and temporal features (i.e., spatiotemporal features) from the data. CNN is able to identify complex patterns in data packet sequences, including periodic behaviors, emergencies, and continuous trends. Through multi-level feature extraction and encoding, the present invention has enhanced its responsiveness to dynamic changes in network traffic. Its specific operations are as follows: Step 2.1 Feature extraction via Multi-layer Perceptron (MLP) After the data preprocessing is completed, the multi-layer perceptron (MLP) starts to work. The structure of the multi-layer perceptron can be set as needed to extract high-dimensional vector features.

[0045] Take the three-layer multilayer perceptron as an example. The multilayer perceptron consists of three fully connected layers, each equipped with a ReLU activation function to ensure effective processing of linear and nonlinear data relationships. The first layer directly receives and parses the key parameters of the traffic data to be measured, such as size, communication frequency, and timestamp. The second layer further nonlinearly maps and combines the features extracted by the first layer to explore potential complex relationships and patterns. The third layer integrates the outputs of the first two layers into a high-dimensional vector feature. This high-dimensional vector feature is not just the key parameter itself, but a high-dimensional feature representation obtained after MLP processing based on the key parameters, which provides a richer foundation for subsequent advanced pattern recognition.

[0046] Step 2.2 Feature extraction via convolutional neural network (CNN) Following the processing of the MLP, the convolutional neural network (CNN) takes over to further extract and identify complex spatial and temporal features (spatiotemporal features). The first convolution layer of the CNN is equipped with 16 filters, focusing on the extraction of local spatial patterns and processing the comprehensive feature vectors passed from the MLP; the first pooling layer that follows is used to reduce the data dimension and enhance the generalization ability of the pattern. The second convolution layer has 32 filters, which is used to deeply analyze the data and mine more complex temporal dynamics and spatial structures; the second pooling layer reduces the feature dimension again to prepare for the final abnormal behavior identification.

[0047] Step 3: Adversarial Sample Detection After receiving the spatiotemporal features extracted in step 2, the present invention inputs the spatiotemporal features into the discriminator of a specifically optimized generative adversarial network (GAN) to discriminate the traffic data to be detected. Both the generator and the discriminator of the GAN are carefully designed to improve the defense effect against complex network attacks.

[0048] Figure 2 is a flow chart of anomaly detection using a generative adversarial network provided by the present invention, such as Figure 2 As shown, the generator is used to generate feature data of adversarial samples using random noise signals; the adversarial samples are malicious data that imitate actual traffic data (normal traffic data); the discriminator is used to identify actual traffic data and adversarial samples based on feature data of adversarial samples and actual traffic data. By discriminating spatiotemporal features, the present invention can more accurately identify adversarial samples and enhance the detection capability of adversarial attacks.

[0049] Step 3.1 Generator configuration and operation optimization The generator uses advanced neural architecture search (NAS) technology to automatically design the neural network architecture to ensure optimal performance and efficiency. It receives a random noise signal as input and processes it through a dynamically adjusted multi-layer fully connected network. The number of network layers and the number of neurons in each layer are dynamically adjusted according to real-time data, and the LeakyReLU activation function is used to enhance nonlinear processing capabilities. Subsequently, an attention mechanism is introduced to enable the generator to more accurately simulate key network traffic features. The generator generates the features of adversarial samples rather than direct adversarial sample data. By simulating and perturbing these key features, the generator is able to create more confusing adversarial sample features that are highly similar to the features of actual traffic data in feature space.

[0050] Step 3.2 Discriminator configuration and operation optimization The discriminator combines traditional fully connected layers and modern convolutional layers to improve its sensitivity to details, especially when analyzing packet structures. Each convolutional layer is followed by batch normalization and ReLU activation functions to ensure standardization of input data and effective gradient flow. Before the output layer, the discriminator uses adaptive pooling technology to adjust the size of the feature map, optimize memory usage and computing speed. Finally, the sigmoid function is used to output the judgment result, and a hybrid model of support vector machine (SVM) and convolutional neural network (CNN) is combined to improve the ability to distinguish adversarial samples from real samples.

[0051] Step 4: Deep Packet Inspection (DPI) and Abnormal Behavior Analysis After completing the detection of adversarial samples in step three, the present invention then deploys deep packet inspection (DPI) technology to further strengthen security protection. DPI technology carefully analyzes the header and payload content of each data packet, reviews the data packet using pre-set security standards, and identifies data packets containing malicious payloads and abnormal signatures. And a rule-based abnormal behavior analysis method is adopted, which is directly built on the spatiotemporal features extracted in step two. These rules are formulated by security experts based on common network attack patterns and historical security data. The present invention monitors network behavior and compares it with these rules to identify abnormal behavior that deviates from regular network activities in real time. When the detected behavior matches the predefined abnormal pattern, the corresponding response decision (such as a security alarm) is triggered in time. The specific steps are as follows: Step 4.1 Deep Packet Inspection (DPI) After completing the detection of adversarial samples, the present invention deploys deep packet inspection (DPI) technology to further strengthen network security protection. The DPI module performs a detailed analysis of the header information and payload content of each data packet. The analysis includes checking the protocol type, port number, destination address, and payload data in the data packet to ensure that the data packet does not carry the signature of malware or viruses. DPI technology also reviews whether the data packet complies with the organization's internal network usage policy and external compliance requirements, thereby identifying and intercepting non-compliant communications.

[0052] Step 4.2 Rule-based abnormal behavior analysis Based on the spatiotemporal characteristics of the traffic data to be measured and multiple types of pre-set standard spatiotemporal characteristics, a comparison and analysis is performed on the abnormal behavior of the traffic data to be measured; wherein, the multiple types of standard spatiotemporal characteristics include the spatiotemporal characteristics of actual traffic standard data and the spatiotemporal characteristics of various malicious traffic standard data; when it is determined that the spatiotemporal characteristics of the traffic data to be measured match the spatiotemporal characteristics of any malicious traffic standard data, a corresponding response decision is triggered.

[0053] Specifically, based on deep packet inspection (DPI) analysis, the present invention further enhances security monitoring by using a rule-based abnormal behavior analysis method. Security experts define a set of behavioral rules based on known attack patterns and historical security data, detailing the characteristics of normal and abnormal network activities. The present invention monitors the spatiotemporal characteristics output by the neural network from step 2 in real time and compares the real-time data with these rules.

[0054] For example, when the present invention detects that the spatiotemporal feature vector of a certain IP address deviates significantly from the normal pattern in a short period of time, such as the change of the feature vector exceeds a preset threshold, which may indicate the presence of signs of a distributed denial of service (DDoS) attack, the present invention will immediately mark it as abnormal. In addition, if the spatiotemporal characteristics of a connection show abnormal communication patterns, such as the timing and size characteristics of the data packets match known data leaks or protocol abuse behaviors, the present invention will also identify it as abnormal behavior.

[0055] Any behavior that deviates from the normal spatiotemporal characteristic pattern, such as the abnormal traffic characteristics or unauthorized access attempts mentioned above, will be marked as abnormal. When the network behavior matches the preset abnormal characteristic pattern, the present invention automatically triggers an alarm and sends a notification to the network administrator so that timely countermeasures can be taken.

[0056] Step 5: Decision, Response and Feedback Figure 3 is a flow chart of the decision-making, response and feedback mechanism provided by the present invention, and the following reference is made to Figure 3 For further explanation, Figure 3 As shown, the decision, response and feedback mechanism of the present invention integrates the analysis results of steps two to four and uses a decision tree algorithm to classify network traffic to determine whether it is malicious.

[0057] Traffic identified as malicious will trigger an alarm and activate automatic response measures, including blocking the traffic, isolating the affected communication system, and notifying the network administrator. The present invention then enters the feedback phase, collecting operation results and user feedback to evaluate the response effect. This data will be used to optimize the detection algorithm and adjust the response strategy to adapt to new threats and ensure the continued security of the network. The specific steps are as follows: Step 5.1 Application of decision tree algorithm The present invention integrates the contents from step 2 to step 4 and uses a pre-trained supervised decision tree algorithm to classify the flow data to be measured.

[0058] In step 2, the present invention can directly utilize key parameters and / or spatiotemporal features such as the size of the data packet and the communication frequency. Step 3 uses a generative adversarial network (GAN) to identify whether there are adversarial samples that mimic normal traffic (actual traffic data). Step 4 applies rule-based abnormal behavior analysis to determine whether the traffic shows behavior consistent with known attack patterns.

[0059] The decision tree algorithm evaluates the properties of each data stream based on the analysis results of steps 2 to 4.

[0060] Optionally, the decision information is input into a pre-trained decision tree model to determine the final detection result of the flow data to be tested, including: pre-setting multiple decision nodes of the decision tree model according to the key parameters of the flow data to be tested, the first detection result and the second detection result; setting classification rules for each decision node; starting from the root node, based on the set classification rules, gradually refining the classification results until reaching a leaf node; the leaf node outputs the final classification result to determine whether the flow data to be tested is malicious flow data.

[0061] The following uses key parameters as an example to illustrate part of the classification process of the decision tree model: The first decision node of the decision tree can set a threshold checkpoint based on the average size of the data packets: if the average size of the data packets exceeds the preset threshold, the algorithm will direct the traffic to the left child node, indicating that there may be abnormal traffic; otherwise, it will be directed to the right child node, indicating that the traffic is normal. Then, in the left child node, the second decision node checks whether the number of data packets sent in a specific time period is abnormally high based on the communication frequency. If the communication frequency is higher than the normal range, the traffic will be further classified as high risk, which may indicate abnormal behavior such as distributed denial of service (DDoS) attacks; if it is not higher than the normal range, it may be a short-term network fluctuation and is classified as medium risk.

[0062] Referring to the above method, the decision tree algorithm can check specific attributes at each decision node according to the key parameters of the flow data to be measured, the first test result and the second test result, and finely classify the flow data to be measured, so as to finally determine the nature of the flow. This feature-based decision tree design improves the accuracy and efficiency of abnormal flow detection.

[0063] Step 5.2 Implementation of response measures Once traffic is classified as malicious, the present invention immediately triggers an alarm and automatically initiates response measures. This includes real-time blocking of traffic identified as malicious, isolating the affected portion of the present invention to prevent further damage, and automatically notifying the network administrator for further emergency response. The security policy preset by the present invention determines the specific content of the response action, and each measure is designed to quickly mitigate the potential damage caused by the threat.

[0064] Step 5.3 Feedback collection and algorithm optimization After the response event is processed, the present invention enters the feedback collection stage. In this stage, the present invention records and analyzes the processing effect and user feedback of each event, evaluates the effect of existing security measures and the accuracy of the detection algorithm. The collected data is used to adjust the parameters and structure of the decision tree algorithm to optimize the accuracy of classification. The present invention regularly updates the decision rules to adapt to emerging threat types and attack methods to ensure the continued effectiveness and advancement of the detection and response mechanism.

[0065] In summary, the present invention provides a composite deep learning framework that integrates multi-layer perceptron (MLP) and convolutional neural network (CNN). This framework uses optimized generative adversarial network (GAN) technology to improve the robustness of the model and effectively enhances the defense capability against malicious adversarial samples. By combining deep packet inspection (DPI) with abnormal behavior analysis, this technology can not only accurately detect and classify abnormal patterns in network traffic, but also conduct in-depth analysis of encrypted communications, thereby significantly improving the security protection capability of wireless communication networks. This is specifically reflected in the following aspects: (1) Comprehensive deep learning framework: By integrating multi-layer perceptron (MLP) and convolutional neural network (CNN), this technology can effectively identify and classify complex network traffic and behavior patterns, and improve the detection accuracy of malicious activities.

[0066] (2) Enhanced Generative Adversarial Network: This paper makes specific optimizations to the Generative Adversarial Network (GAN) and adds an adaptive adversarial sample generation mechanism. This mechanism introduces a real-time updateable attack strategy model into the generator, enabling the generator to generate corresponding adversarial samples based on the latest network attack methods. This enables the model to be updated in real time and effectively counter the latest and more complex network attack strategies. The enhanced GAN module also improves the model's defense capabilities against advanced persistent threats (APTs) and other complex attack strategies by sharing features between different network layers.

[0067] (3) Deep packet inspection and behavioral analysis: By combining deep packet inspection (DPI) and rule-based behavioral analysis, the present invention can not only accurately identify traditional security threats, but also conduct in-depth analysis of encrypted communications and enhance the monitoring capabilities of covert communications.

[0068] (4) Dynamic response and feedback adjustment: By implementing automated response measures and combining them with a continuous feedback mechanism, the system can adapt to changes in the network environment and adjust defense strategies in a timely manner to ensure continuous network security.

[0069] Figure 4is a schematic diagram of the structure of a wireless communication network intrusion detection device for adversarial sample defense provided by the present invention, such as Figure 4 As shown, the device comprises: The first processing module 410 is used to extract features of the flow data to be measured and obtain the spatiotemporal features of the flow data to be measured; The second processing module 420 is used to input the spatiotemporal features into the discriminator of the pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; The third processing module 430 is used to perform deep packet inspection on the traffic data to be measured, and perform abnormal behavior analysis on the traffic data to be measured based on the spatiotemporal characteristics to obtain a second detection result; The fourth processing module 440 is used to input the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured; the decision information includes key parameters of the flow data to be measured, the first detection result and the second detection result.

[0070] It should be noted that the wireless communication network intrusion detection device for adversarial sample defense provided in an embodiment of the present invention can execute the wireless communication network intrusion detection method for adversarial sample defense described in any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0071] Figure 5 is a schematic diagram of the structure of the electronic device provided by the present invention, such as Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530 and a communication bus 540, wherein the processor 510, the communication interface 520 and the memory 530 communicate with each other through the communication bus 540. The processor 510 may call the logic instructions in the memory 530 to execute the wireless communication network intrusion detection method for adversarial sample defense, the method comprising: extracting features from the flow data to be measured and obtaining the spatiotemporal features of the flow data to be measured; inputting the spatiotemporal features into the discriminator of the pre-trained generative adversarial network to obtain the first detection result of the flow data to be measured; performing deep packet detection on the flow data to be measured, and performing abnormal behavior analysis on the flow data to be measured based on the spatiotemporal features to obtain the second detection result; inputting the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured.

[0072] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the wireless communication network intrusion detection method for adversarial sample defense provided by the above-mentioned embodiments, and the method includes: extracting features of the flow data to be measured to obtain the spatiotemporal features of the flow data to be measured; inputting the spatiotemporal features into the discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; performing deep packet detection on the flow data to be measured, and performing abnormal behavior analysis on the flow data to be measured based on the spatiotemporal features to obtain a second detection result; inputting decision information into a pre-trained decision tree model to determine the final detection result of the flow data to be measured.

[0073] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the wireless communication network intrusion detection method for adversarial sample defense provided in the above-mentioned embodiments, the method comprising: extracting features of the flow data to be measured to obtain the spatiotemporal features of the flow data to be measured; inputting the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; performing deep packet detection on the flow data to be measured, and performing abnormal behavior analysis on the flow data to be measured based on the spatiotemporal features to obtain a second detection result; and inputting decision information into a pre-trained decision tree model to determine the final detection result of the flow data to be measured.

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A wireless communication network intrusion detection method for adversarial sample defense, characterized in that: include: Extract features from the flow data to be measured to obtain the spatiotemporal features of the flow data to be measured; Inputting the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; Performing deep packet inspection on the flow data to be measured, and performing abnormal behavior analysis on the flow data to be measured based on the spatiotemporal characteristics to obtain a second detection result; Inputting the decision information into a pre-trained decision tree model to determine the final detection result of the flow data to be measured; The decision information includes key parameters of the flow data to be measured, a first detection result and a second detection result.

2. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: After determining the final detection result of the flow data to be measured, the method further includes: When it is determined according to the final detection result that the flow data to be tested is malicious data, a response decision for the final detection result is triggered.

3. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: Extract features from the flow data to be measured and obtain the spatiotemporal features of the flow data to be measured, including: Extracting key parameters of the flow data to be measured; Inputting the key parameters into a multi-layer perceptron to extract high-dimensional vector features of the flow data to be measured; The high-dimensional vector features are input into a convolutional neural network to obtain the spatiotemporal features of the flow data to be measured.

4. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: The generative adversarial network includes a discriminator and a generator; The generator is used to generate characteristic data of adversarial samples using random noise signals; the adversarial samples are malicious data that imitate actual traffic data; The discriminator is used to identify actual traffic data and adversarial samples based on feature data of the adversarial samples and actual traffic data.

5. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: Perform deep packet inspection on the traffic data to be tested, including: By analyzing the header information and payload content of the traffic data to be tested, it is determined whether it carries malicious information.

6. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: Based on the spatiotemporal characteristics, abnormal behavior analysis is performed on the traffic data to be measured, including: Based on the spatiotemporal characteristics of the traffic data to be measured and the pre-set multiple types of standard spatiotemporal characteristics, the abnormal behavior of the traffic data to be measured is compared and analyzed; wherein the multiple types of standard spatiotemporal characteristics include the spatiotemporal characteristics of the actual traffic standard data and the spatiotemporal characteristics of various malicious traffic standard data; When it is determined that the spatiotemporal characteristics of the traffic data to be tested match the spatiotemporal characteristics of any malicious traffic standard data, a corresponding response decision is triggered.

7. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: Input the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured, including: Presetting a plurality of decision nodes of a decision tree model according to key parameters of the flow data to be measured, the first detection result, and the second detection result; Set the classification rules for each decision node; Starting from the root node, the classification results are gradually refined based on the set classification rules until the leaf node is reached; The leaf node outputs the final classification result to determine whether the traffic data to be tested is malicious traffic data.

8. The wireless communication network intrusion detection method for adversarial sample defense according to claim 1, characterized in that: Before extracting features from the measured traffic data, it also includes: Deploy traffic monitoring equipment at key access points of wireless communication networks; Use traffic monitoring equipment to capture the passing data packets and perform data cleaning on the captured data packets; The cleaned data is subjected to data standardization to obtain the flow data to be measured.

9. A wireless communication network intrusion detection device for adversarial sample defense, characterized in that: include: The first processing module is used to extract features of the flow data to be measured and obtain the spatiotemporal features of the flow data to be measured; A second processing module is used to input the spatiotemporal features into a discriminator of a pre-trained generative adversarial network to obtain a first detection result of the flow data to be measured; A third processing module is used to perform deep packet detection on the flow data to be measured, and to perform abnormal behavior analysis on the flow data to be measured based on the spatiotemporal characteristics to obtain a second detection result; The fourth processing module is used to input the decision information into the pre-trained decision tree model to determine the final detection result of the flow data to be measured; The decision information includes key parameters of the flow data to be measured, a first detection result and a second detection result.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the wireless communication network intrusion detection method for adversarial sample defense as described in any one of claims 1 to 8 are implemented.

Images