Intelligent abnormal traffic detection method and system based on SCN-BiLSTM

Abstract

The invention relates to the technical field of network security, in particular to an intelligent abnormal traffic detection method and system based on SCN-BiLSTM, and the method comprises the steps: firstly collecting network traffic intrusion detection sample data, and building a network traffic intrusion detection sample data set through data preprocessing; constructing an abnormal traffic detection model based on a stacked convolutional network SCN and a bidirectional long short-term memory network BiLSTM, and setting a target loss function used for balancing training sample categories; training an abnormal traffic detection model by using the network traffic intrusion detection sample data set based on the target loss function, and obtaining an abnormal traffic detection target model; and performing data preprocessing on the to-be-detected network traffic and inputting the to-be-detected network traffic to the abnormal traffic detection target model so as to perform abnormal classification identification on the to-be-detected network traffic by using the abnormal traffic detection target model. According to the method, the characteristics of the network traffic data can be comprehensively captured, the traffic detection accuracy is improved, the complexity of model calculation is reduced, and the detection accuracy of minority class samples is remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an abnormal traffic intelligent detection method and system based on SCN-BiLSTM. Background Art

[0002] In the digital age, network security has become a global focus. With the continuous evolution of network attack methods, it is particularly important to ensure the security of the network environment. Network attacks not only threaten personal privacy, but may also have a serious impact on corporate operations and national security. Although traditional security measures provide protection to a certain extent, they often seem powerless in the face of increasingly complex attack patterns. For attack behaviors that occur in the network, the network abnormal traffic detection method can usually be used to detect abnormal traffic and make timely responses, thereby maintaining the stable operation and security of the network. Therefore, abnormal traffic detection has become a research direction that many researchers are concerned about.

[0003] Abnormal traffic detection refers to the timely response and processing of abnormal traffic in the network by analyzing the overall network traffic and using technologies such as traffic classification or traffic statistics. Among the traditional abnormal traffic detection methods, abnormal traffic detection methods based on machine learning have been widely used by researchers. For example, some researchers have conducted specific research on abnormal network traffic detection using machine learning algorithms such as random forests, support vector machines, naive Bayes, K-nearest neighbors, and decision trees, and have achieved good results. However, the traffic features required by these methods require manual feature design and feature selection. In order to address the difficulties in designing traditional machine learning feature sets, researchers have applied deep learning to abnormal traffic detection, which can automatically extract network traffic features and identify abnormal behaviors. In addition, deep learning technology has better detection performance than machine learning models. For example, convolutional neural networks (CNN), deep neural networks (DNN), and recurrent neural networks (RNN) are used to address the limitations of shallow classifiers and improve the accuracy of intrusion detection. Despite the progress made in deep learning technology, there are still challenges in achieving classification accuracy and class imbalance in data sets. For example, while CNN is good at computing large amounts of data and has excellent feature extraction capabilities, the pooling process may cause key information of abnormal data to be lost. In addition, RNN and CNN may have difficulty capturing long-term dependencies, affecting their model generalization and performance. Moreover, most existing models lack consideration of model efficiency, ignoring the spatiotemporal complexity in traffic data and not fully evaluating efficiency. Especially for deep learning methods, the huge overhead of memory and running time in complex neural networks leads to high energy consumption, which is not feasible for edge devices with limited resources. Moreover, the unbalanced distribution in most existing datasets will lead to high false positives in deep learning-based methods, thereby reducing the accuracy of model traffic detection. Summary of the invention

[0004] To this end, the present invention provides an abnormal traffic intelligent detection method and system based on SCN-BiLSTM to solve the problems of insufficient temporal and spatial feature extraction, high false alarm rate, poor generalization ability, and limitation of data set class imbalance in existing abnormal traffic detection methods.

[0005] According to the design scheme provided by the present invention, on the one hand, a method for intelligent detection of abnormal traffic based on SCN-BiLSTM is provided, comprising:

[0006] Collect network traffic intrusion detection sample data, and form a network traffic intrusion detection sample data set through data preprocessing;

[0007] An abnormal traffic detection model is constructed based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and a target loss function for balancing the training sample categories is set, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to enhance the key features of the spatiotemporal dimensions of network traffic;

[0008] Based on the target loss function and using the network traffic intrusion detection sample data set, the abnormal traffic detection model is trained and the abnormal traffic detection target model is obtained;

[0009] The network traffic to be detected is preprocessed and input into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to classify and identify the abnormalities of the network traffic to be detected.

[0010] The present invention is based on the SCN-BiLSTM abnormal traffic intelligent detection method. Further, the data preprocessing includes: a data cleaning operation for performing invalid filtering and deletion on network traffic data, a unique hot encoding operation for converting non-numerical features of network traffic data, and a data normalization operation for scaling and standardizing the numerical values ​​of network traffic data using a minimum-maximum normalization method.

[0011] As an abnormal traffic intelligent detection method based on SCN-BiLSTM of the present invention, further, the SCN includes: a conventional convolution layer for capturing sequence local patterns and basic features in input network traffic data, a depth-by-depth convolution layer for extracting spatial feature information of each channel of the network traffic data based on the sequence local patterns and basic features and using convolution kernels respectively, a point-by-point convolution layer for mixing spatial feature information of each channel of the network traffic data, and a maximum pooling layer for reducing the dimension of channel spatial feature information according to the number of feature output channels.

[0012] As an abnormal traffic intelligent detection method based on SCN-BiLSTM of the present invention, further, the BiLSTM uses two LSTM units, forward and reverse, to process the forward and backward temporal dependencies in the network traffic data to capture the temporal characteristics of the network traffic in different time periods and directions.

[0013] As the abnormal traffic intelligent detection method based on SCN-BiLSTM of the present invention, further, the classification detection layer uses a softmax classifier to convert the classification output into a probability distribution.

[0014] As an abnormal traffic intelligent detection method based on SCN-BiLSTM of the present invention, further, the target loss function adopts a balanced loss function, so as to dynamically balance the positive and negative gradient ratios of each network traffic data sample category in the model training stage by utilizing a gradient reweighting mechanism in the balanced loss function, so that the model learns samples of different categories in the network traffic data.

[0015] As an abnormal traffic intelligent detection method based on SCN-BiLSTM of the present invention, further, the gradient reweighting mechanism includes: based on the ratio of accumulated positive gradient to negative gradient and using a specified mapping function to calculate the positive gradient weight and the negative gradient weight in the current model training iteration process, and using the positive gradient weight and the negative gradient weight to update the positive gradient and the negative gradient of each category output relative to the loss in the current batch, so as to update the accumulated positive gradient and negative gradient ratio in the next round of model training based on the updated positive gradient and negative gradient.

[0016] On the other hand, the present invention also provides an abnormal traffic intelligent detection system based on SCN-BiLSTM, comprising: a sample processing module, a model building module, a model training module and a traffic detection module, wherein:

[0017] The sample processing module is used to collect network traffic intrusion detection sample data and form a network traffic intrusion detection sample data set through data preprocessing;

[0018] A model building module, used to build an abnormal traffic detection model based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and set a target loss function for balancing the training sample categories, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to strengthen the key features of the spatiotemporal dimensions of network traffic;

[0019] A model training module is used to train an abnormal traffic detection model based on a target loss function and using a network traffic intrusion detection sample data set, and obtain an abnormal traffic detection target model;

[0020] The traffic detection module is used to pre-process the network traffic to be detected and input it into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to classify and identify the abnormalities of the network traffic to be detected.

[0021] Beneficial effects of the present invention:

[0022] 1. The present invention uses CNN and Depthwise Separable Convolutional (DSC) to construct SCN and extract the spatial features of abnormal traffic in the network, effectively reducing the number of parameters and computational workload, reducing the complexity of the model, using BiLSTM to capture time series features, and integrating the attention mechanism to enhance attention to important spatiotemporal features and improve classification accuracy; for the common class imbalance phenomenon in the data set, the balanced loss is used to learn more about the minority class, and the accuracy of the model traffic detection classification is improved. The feature extraction model of SCN-BiLSTM fused with the attention mechanism is combined with the classification detection model for class imbalance to solve the problems of insufficient spatiotemporal feature extraction and class imbalance, and enhance the detection performance of the model for unbalanced data sets.

[0023] 2. The effectiveness of this scheme was tested on the standard intrusion detection dataset NSL-KDD. The results show that this scheme has a good classification effect. Its multi-classification accuracy, recall rate and F1 score are significantly improved compared with other existing methods, and it can effectively improve the detection rate of minority classes. It has good application prospects in the field of network traffic anomaly monitoring. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 This is a schematic diagram of the abnormal traffic intelligent detection process based on SCN-BiLSTM in the embodiment;

[0025] Figure 2 This is a schematic diagram of the abnormal traffic intelligent detection algorithm architecture based on SCN-BiLSTM in the embodiment;

[0026] Figure 3 This is a schematic diagram of the stacked convolutional network (SCN) structure in the embodiment;

[0027] Figure 4 This is a schematic diagram of the LSTM structure in the embodiment;

[0028] Figure 5 This is a schematic diagram of the BiLSTM structure of the bidirectional long short-term memory network in the embodiment;

[0029] Figure 6 This is a schematic diagram of the comparative experimental network model structure in the embodiment;

[0030] Figure 7 The figure is a comparison of the accuracy of different loss functions for five data types in the embodiment;

[0031] Figure 8 It is a schematic diagram of the accuracy of the comparison scheme on five data types in the embodiment;

[0032] Fig. 9The ACC, Recall, and F1-score results of the comparative solution in the embodiment on NSL-KDD are shown;

[0033] Fig.10 It is a schematic diagram of the FPR result of the comparative scheme in the embodiment on NSL-KDD. DETAILED DESCRIPTION

[0034] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0035] In actual traffic detection scenarios, we need to not only pay attention to the problem of unbalanced data categories, but also improve the detection accuracy by capturing the spatial and temporal features in the traffic data. Therefore, how to design a lighter-weight deep learning model that can take into account the detection performance of samples of various categories and more efficiently capture spatial and temporal features to improve detection accuracy has become an important issue that needs to be solved in this field. To this end, the embodiments of the present invention, such as Figure 1 As shown, a method for intelligent detection of abnormal traffic based on SCN-BiLSTM is provided, including:

[0036] S101. Collect network traffic intrusion detection sample data, and form a network traffic intrusion detection sample data set through data preprocessing.

[0037] like Figure 2 In the algorithm architecture shown, the data preprocessing includes: a data cleaning operation for performing invalid filtering and deletion on the network traffic data, a unique hot encoding operation for converting the non-numerical features of the network traffic data, and a data normalization operation for scaling and normalizing the values ​​of the network traffic data using the minimum-maximum normalization method. This ensures that the input data meets the requirements of the model training.

[0038] S102. Construct an abnormal traffic detection model based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and set a target loss function for balancing the training sample categories, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to enhance the key features of the spatiotemporal dimensions of network traffic.

[0039] At present, most abnormal traffic detection methods are limited to a single network perspective and fail to fully explore the time and space dimension information contained in the traffic data. In this case, the SCN-BiLSTM lightweight feature extraction network structure with integrated attention mechanism is used to make full use of the time and space dimension information of the traffic data, which can achieve more comprehensive and accurate abnormal traffic detection.

[0040] In the field of deep learning, CNN has become a key technology for efficient feature extraction in tasks such as object recognition, text classification, and anomaly detection. Conventional CNNs are mainly composed of three layers: convolutional layer, pooling layer, and fully connected layer. The convolutional layer performs convolution operations by moving convolution kernels on the input data to effectively extract local features. It is the most important layer in the CNN structure. The role of the pooling layer is to reduce the spatial size of the feature map, reduce the number of parameters and the amount of calculation. After the convolution and pooling layers complete the feature extraction, the fully connected layer is responsible for comprehensive processing of these features to facilitate the final classification or regression analysis. However, although the convolutional layer performs well in local feature extraction, its ability to capture the correlation of global features is relatively weak, which may lead to the loss of some important semantic information when processing complex data, thus affecting the final result.

[0041] DSC decomposes the conventional convolution layer into depthwise convolution (DW) to extract spatial features within a single channel, and pointwise convolution (PW) to extract cross-channel feature combinations. This two-step operation of first independently convolving each input channel through depthwise convolution to greatly reduce the computational cost and focus on extracting features within each channel, and then using pointwise convolution to operate in the channel dimension to achieve feature fusion between channels to further refine and compress features and ensure the lightweight model, not only maintains performance comparable to conventional convolution, but also significantly reduces the amount of computation and model parameters. Although DSC has advantages in computational efficiency and model size, it is not as effective as conventional convolution layers in capturing certain complex feature patterns in the input data, which may lead to a decrease in the expressiveness of the model.

[0042] In this embodiment, Figure 3 As shown, SCN can be designed to include: a conventional convolution layer for capturing sequence local patterns and basic features in the input network traffic data, a depth-wise convolution layer for extracting spatial feature information of each channel of the network traffic data based on the sequence local patterns and basic features and using convolution kernels respectively, a point-by-point convolution layer for mixing the spatial feature information of each channel of the network traffic data, and a maximum pooling layer for reducing the dimension of channel spatial feature information according to the number of feature output channels.

[0043] As the first layer of the network, the conventional convolution layer accurately captures the local patterns and basic features of the sequence from the original input by setting hyperparameters such as the number of filters and the size of the convolution kernel, providing a rich feature basis for the processing of subsequent layers. The common pooling layer is not added afterwards in order to retain more details and spatial information; the depth-wise convolution layer is responsible for applying the convolution kernel to each channel separately, reducing the number of parameters while also retaining the information of each channel; the point-by-point convolution layer combines the output of the depth-wise convolution, mixes the information of different channels, and increases the nonlinear ability of the model; the maximum pooling layer is used to reduce the spatial dimension, which can reduce the input size of the subsequent layers, helping the model learn more representative features, and also helps to alleviate the overfitting problem.

[0044] The computational complexity and parameter calculation of depthwise separable convolution are shown in equations (1)-(5). Assume that the dimension of the input feature is F×F×M, the size of the convolution kernel is K×K, and the dimension of the output feature is F×F×N, where M and N are the number of input and output channels.

[0045] A1=K*K*M*N*F*F (1)

[0046] A2=K*K*M*N (2)

[0047] B1=K*K*M*F*F+M*N*F*F (3)

[0048] B2=K*K*M+1*1*M*N (4)

[0049]

[0050] Among them, the amount of calculation of conventional convolution is A1, the amount of parameters of conventional convolution is A2, the amount of calculation of depthwise separable convolution is B1, the amount of parameters of depthwise separable convolution is B2, and the ratio of the amount of calculation and the amount of parameters of depthwise separable convolution to conventional convolution is C1. Therefore, the amount of calculation and the amount of parameters of depthwise separable convolution are both higher than those of conventional convolution. The amount of calculation and parameters is greatly reduced.

[0051] Conventional convolutional layers are good at extracting local features and can be used to capture more complex feature combinations; depth-wise convolutional layers and point-wise convolutional layers focus more on cross-channel information integration and can efficiently process these features; the maximum pooling layer reduces the input dimension of subsequent layers and retains the most important feature information. The stacked convolutional network composed of the above network layers can enhance the network's ability to learn features while maintaining a low number of parameters.

[0052] LSTM is widely used in various network traffic detection models due to its excellent long-term memory ability. LSTM network introduces gating mechanisms and unit states such as forget gate, input gate and output gate, so that it can control which past information is forgotten or retained, thereby maintaining the ability to remember long data. The LSTM model structure is as follows Figure 4 shown.

[0053] Among them, the forget gate f t Responsible for eliminating redundant or irrelevant information, it passes the current input x t and the hidden state h at the previous moment t-1 Generate, used to control the unit state C t-1 Which information in is retained. Its calculation formula is shown in formula (6).

[0054] f t =σ(W f ·[h t-1 ,x t ]+b f ) (6)

[0055] Input Gate i t Responsible for adding new information, which is also through the current input x t and the hidden state h at the previous moment t-1 Generate, used to selectively convert temporary information Add to cell status C t-1 The calculation formula is shown in formula (7)-(8).

[0056] i t =σ(W i ·[h t-1 ,x t ]+b i ) (7)

[0057]

[0058] The current cell state C t The information to be retained at the previous moment is f t ×C t-1 The information to be added at the current moment The calculation formula is shown in formula (9).

[0059]

[0060] Output gate o t Responsible for filtering the information C after being processed by the forget gate and input gate t , output the hidden state h at the current moment t, and pass it to the next LSTM unit. Its calculation formula is shown in equations (10)-(11).

[0061] o t =σ(W o ·[h t-1 ,x t ]+b o ) (10)

[0062] h t =o t ×tanh(C t ) (11)

[0063] In the above formula, σ is the sigmoid function, W f , W i , W o , W c Represents the weight matrices of the forget gate, input gate, output gate and unit state, respectively, b f 、b i 、b o 、b c Represent the bias terms of the forget gate, input gate, output gate and unit state respectively.

[0064] Although LSTM can capture long-term dependencies well, it can only process unidirectional dependencies in time series data and cannot fully capture contextual information in the data. Therefore, in this embodiment, a bidirectional long short-term memory network BiLSTM is introduced to simultaneously process the forward and backward time series dependencies in traffic data. This bidirectional processing mechanism enables BiLSTM to effectively capture time series features in different time periods and directions, thereby improving the detection ability of the model. Figure 5 shown.

[0065] BiLSTM integrates the design of two LSTM units, forward and reverse, to consider both past and future contextual information at each moment, thereby generating richer hidden states and enhancing its ability to understand time series data. It uses a forward LSTM unit to process data along the original time series from beginning to end, and a reverse LSTM unit to analyze the same sequence in reverse order. The two share the same input (x 1 ,x 2 ,...,x t ,...) but they operate independently and jointly generate hidden states at each moment. By combining the hidden states of these two directions, a comprehensive hidden state sequence (h 1 ,h 2 ,...,h t,...), and then passed to the next layer of the model.

[0066] As an important technology in deep learning, the attention mechanism improves the detection rate and classification accuracy in complex tasks by assigning higher weights to key features to better capture important information and extract features, while ignoring irrelevant information.

[0067] The attention mechanism calculates the dot product of the query Q and all the keys K, and applies the softmax function to convert these dot products into probability distributions to clarify the importance of each value, and finally obtains the output through weighted summation. Among them, the query Q and key-value pairs (KV) are obtained by comparing the input feature X with the corresponding weight matrix W. Q , W K and W V Multiply. W Q , W K and W V It is automatically learned during the model training process. The calculation formula is shown in equations (12)-(14).

[0068] Q=XW Q (12)

[0069] K=XW K (13)

[0070] V=XW V (14)

[0071] The calculation formula of the attention value is shown in formula (15).

[0072]

[0073] Among them, K T is the transpose of K, d k is the dimension of the key vector. And introduce the scaling factor The purpose of scaling is to avoid the result of the dot product operation being too large in a large dimensional space, which would cause the gradient of the softmax function to approach zero, thus affecting the numerical stability during training.

[0074] In the embodiment of this case, the attention mechanism is combined with SCN and BiLSTM respectively, so as to help SCN focus on the most important channels and spatial positions and enhance the BiLSTM network's ability to understand the sequence context.

[0075] Among them, the target loss function in the embodiment of this case adopts a balanced loss function, so as to use the gradient reweighting mechanism in the balanced loss function to dynamically balance the positive and negative gradient ratios of each network traffic data sample category during the model training phase, so that the model can learn samples of different categories in the network traffic data. The gradient reweighting mechanism includes: based on the ratio of the accumulated positive gradient to the negative gradient and using a specified mapping function to calculate the positive gradient weight and the negative gradient weight in the current model training iteration process, and using the positive gradient weight and the negative gradient weight to update the positive gradient and the negative gradient of each category output relative to the loss in the current batch, so as to update the accumulated positive gradient and negative gradient ratio in the next round of model training based on the updated positive gradient and negative gradient.

[0076] The balanced loss function EQL v2 is used to solve the class imbalance problem. The principle of EQL v2 is to use the gradient reweighting mechanism to balance the positive and negative sample gradients of each category, and to effectively alleviate the negative impact of imbalanced data on the model classification results by adjusting the importance of different categories, especially enhancing the weight of minority class samples.

[0077] The idea of ​​EQL v2 gradient reweighting is as follows: weight the positive and negative gradients of each classifier independently according to the cumulative gradient ratio of the positive and negative gradients of the classifier.

[0078] The output Z for each class j The expressions for the positive and negative gradients relative to the loss L are shown in equations (16)-(17).

[0079]

[0080] in, is the estimated probability of the i-th data sample in the j-th class, Z j is the output without sigmoid function activation. I is all data samples, y i is the one-hot encoding of the label of the i-th data sample.

[0081] In order to realize the idea of ​​gradient-guided balanced weighting, we first define g j (t) is the ratio of the cumulative positive gradient to the negative gradient of task j until iteration t. In this iteration, the weight of the positive gradient q j (t) and the weight r of the negative gradient j (t) The calculation formulas are shown in equations (18)-(19).

[0082]

[0083] Where f(·) is the mapping function:

[0084] Get the positive gradient weight q j (t) and negative gradient weights They are then applied to the positive and negative gradients of the current batch respectively, and the reweighted gradients are shown in equations (20)-(21).

[0085]

[0086] Finally, the ratio of the accumulated positive gradient to the negative gradient is updated for the next iteration t+1, as shown in formula (22).

[0087]

[0088] In this way, EQL v2 can dynamically balance the positive and negative gradient ratios during the training phase, allowing the model to learn samples of different categories more fairly and improve its recognition ability for minority classes.

[0089] S103. Based on the target loss function and using the network traffic intrusion detection sample data set, the abnormal traffic detection model is trained to obtain the abnormal traffic detection target model.

[0090] like Figure 2 As shown in the figure, in order to solve the problem that the temporal and spatial features of traffic data have not been fully mined, the SCN-BiLSTM with fusion attention mechanism can efficiently extract the complex and deep temporal and spatial features through deep learning of traffic feature data. First, for the traffic data suitable for model input obtained after data preprocessing, the SCN constructed by combining conventional convolutional layers with DSC effectively extracts the spatial features of the input data; then the spatial dimension of the features is reduced through the pooling layer, the number of network parameters and the amount of calculation are reduced, and the risk of overfitting is reduced; then the attention mechanism is used to focus on key features, which improves the expressiveness of the model without affecting the complexity of the model too much; the results of the Attention layer are input to the BiLSTM layer containing 64 neurons, which can capture the contextual information of the input sequence and mine the temporal dependency. This two-way processing strategy promotes the capture of complex patterns in the input sequence and enhances the classification performance of the model; the attention mechanism is introduced again after the BiLSTM layer to strengthen the focus on the most influential part of the sequence and improve the ability to understand the sequence context. In classification detection, in order to solve the class imbalance problem in the data set, the original output is converted into a probability distribution through the softmax of the output layer. The loss function EQL v2 is used to optimize the final output result of the model by calculating the loss value, performing back propagation, updating parameters, etc.

[0091] S104, preprocessing the network traffic to be detected and inputting the data into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to perform abnormal classification and identification on the network traffic to be detected.

[0092] Furthermore, based on the above method, an embodiment of the present invention also provides an abnormal traffic intelligent detection system based on SCN-BiLSTM, comprising: a sample processing module, a model building module, a model training module and a traffic detection module, wherein:

[0093] The sample processing module is used to collect network traffic intrusion detection sample data and form a network traffic intrusion detection sample data set through data preprocessing;

[0094] A model building module, used to build an abnormal traffic detection model based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and set a target loss function for balancing the training sample categories, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to strengthen the key features of the spatiotemporal dimensions of network traffic;

[0095] A model training module is used to train an abnormal traffic detection model based on a target loss function and using a network traffic intrusion detection sample data set, and obtain an abnormal traffic detection target model;

[0096] The traffic detection module is used to pre-process the network traffic to be detected and input it into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to classify and identify the abnormalities of the network traffic to be detected.

[0097] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0098] The results of network traffic anomaly detection are deeply affected by the selected dataset. In this experiment, the NSL-KDD dataset is selected. The NSL-KDD dataset optimizes data quality by effectively solving the redundant record problem in the KDD 99 dataset. The dataset covers four types of attacks, including DoS, R2L, U2R, and Probe. However, the NSL-KDD dataset also has an imbalance problem, for example, the minority class U2R only accounts for 0.04% of the dataset.

[0099] In order to achieve large-scale non-redundant data training and validation when processing the NSL-KDD dataset, and to evaluate the effectiveness of the proposed method, a stratified 10-fold cross-validation strategy was adopted, and the ratio of the training set to the test set was 9:1. The specific distribution and ratio are shown in Table 1.

[0100] Table 1. Sample distribution and proportion of NSL-KDD dataset

[0101]

[0102] In order to comprehensively evaluate the performance of this method on an unbalanced dataset, multiple evaluation indicators including accuracy, recall, false alarm rate, and F1 score are used. The calculation formulas of each evaluation indicator are shown in equations (23)-(27):

[0103] Accuracy refers to the proportion of samples that are correctly identified among all samples. The higher the accuracy, the better the performance of the model.

[0104]

[0105] Precision refers to the ratio of samples predicted to be positive to samples actually predicted to be positive.

[0106]

[0107] The false alarm rate refers to the proportion of samples that are actually negative examples that are mistakenly predicted as positive examples. A low false alarm rate indicates that the model performs better in predicting negative examples.

[0108]

[0109] Recall, also known as recall, refers to the proportion of samples that are correctly predicted as positive examples among all actual positive examples. A higher recall indicates that the model is better able to capture positive examples.

[0110]

[0111] The F1 score represents the harmonic mean of precision and recall. It effectively evaluates the balance between precision and recall in a classifier. The higher the F1 score, the more robust the model.

[0112]

[0113] TP represents the number of samples that are actually positive but predicted to be positive, FN represents the number of samples that are actually positive but predicted to be negative, FP represents the number of samples that are actually negative but predicted to be positive, and TN represents the number of samples that are actually negative but predicted to be negative.

[0114] The experimental results are explained based on three aspects: (1) the impact of different network structures on the experimental results; (2) the impact of the presence or absence of an attention mechanism on the experimental results; and (3) the comparison of the classification results of this solution with other common methods.

[0115] (1) Impact of different network structures on experimental results

[0116] First, if Figure 6 As shown, five different models (a), (b), (c), (d), and (e) are used for multi-classification experiments. The five different model structures are: (a) CNN and CNN in series; (b) CNN, CNN, and BiLSTM in series; (c) CNN, CNN, and BiLSTM integrated with attention mechanism; (d) DSC, DSC, and BiLSTM integrated with attention mechanism; (e) SCN and BiLSTM integrated with attention mechanism in this solution.

[0117] Table 2 Experimental results of the model (a) (b) (c) (d) (e) and the scheme of this case (%)

[0118]

[0119] Table 3 Comparison of model parameters and training time

[0120]

[0121] The specific experimental results are shown in Table 2. It can be seen from the experimental results that the accuracy of model (e) is 99.81%, the recall rate is 99.70%, and the F1 score is 99.81%, which are all better than models (a)(b)(c)(d). In addition, model (e) replaces the second layer of CNN with the DSC layer based on the CNN-CNN-BiLSTM model that integrates the attention mechanism of model (c). The comparison of the parameters and training time of the two models is shown in Table 3. It can be seen that the stacked convolutional network SCN that combines CNN and DSC proposed by model (e) can significantly reduce the number of parameters and improve training efficiency. Therefore, in this case, the SCN-BiLSTM model (e) that integrates the attention mechanism is used to extract spatiotemporal features.

[0122] In order to verify the contribution of EQL v2 loss function in solving the class imbalance problem on NSL-KDD dataset, three different loss functions are used: FL, Cross-Entropy (CE) loss function and EQL v2 loss function of this case to conduct experiments on the same model (e). The experimental results are shown in Table 4 and Figure 7 shown.

[0123] Table 4 Comparison of detection results of five data types using different loss functions (%)

[0124]

[0125] Combining Table 4 and Figure 7 It can be seen that the classification detection model using the EQL v2 loss function has an accuracy of 99.92%, 99.97%, 99.95%, 97.98% and 90.90% on the five types of Normal, DoS, Probe, R2L and U2R, respectively, which are higher than the models using other loss functions, especially in the detection of minority classes R2L and U2R, the improvement in accuracy is more obvious. It proves that the EQL v2 loss function is very helpful in improving the accuracy of minority class abnormal traffic detection, and can be used as a loss function for classification detection models for imbalanced categories.

[0126] The abnormal traffic intelligent detection based on SCN-BiLSTM in this case combines the SCN-BiLSTM feature extraction model with the fusion attention mechanism and the classification detection model for imbalanced categories. Its accuracy is 99.94%, the recall rate is 99.95%, the F1 score is 99.94%, and the false alarm rate is 0.07%. It has a maximum improvement of 2.11% in accuracy, 3.65% in recall, and 2.4% in F1 score. Although the false alarm rate has not reached the lowest level, it is only 0.02% higher than model (b). It proves that this case has a strong detection capability on the NSL-KDD dataset.

[0127] (2) The impact of the presence or absence of an attention mechanism on experimental results

[0128] In order to further explore the role and value of the attention mechanism, the experiment compared the experimental results of multi-classification with and without the introduction of the attention mechanism. The experimental results are shown in Table 5. As can be seen from Table 5, after the introduction of the attention mechanism, the accuracy, recall and F1 score increased by 1.6%, 3.41% and 2% respectively, and the false alarm rate also decreased by 0.01%, indicating that the attention mechanism has an important contribution to the detection results of the overall method.

[0129] Table 5 Impact of attention mechanism on experimental results (%)

[0130]

[0131] (3) Comparison of the classification results of this solution and other methods

[0132] The algorithm of this case solution is comprehensively evaluated and compared with other algorithms on the NSL-KDD dataset. Eight common technologies are compared: KNN, RF, SVM, ICVAE-DNN, CD-2, I-SiamIDS, 1DCNN-BiLSTM, CANE. Table 6 Figures 8 to 10 The comparison results of the multi-classification performance of this scheme and other methods on the NSL-KDD dataset are shown.

[0133] Table 6 Comparison of detection results of five data types by different methods (%)

[0134]

[0135] The proposed solution has achieved the best results in the four indicators of accuracy, recall, F1 score, and false alarm rate on the NSL-KDD dataset. Compared with other methods, it has improved the accuracy by 0.13% to 27.66%, the recall by 0.24% to 43.22%, the F1 score by 0.15% to 33.40%, and the false alarm rate by 0.02% to 12.893%. The results show that the proposed solution not only improves the accuracy, but also maintains a low false alarm rate, further proving the effectiveness of the proposed solution in abnormal traffic detection.

[0136] The above experimental results show that this solution effectively extracts the spatial and temporal characteristics of traffic data, comprehensively captures the characteristics of network traffic data, improves the accuracy of traffic detection, reduces the complexity of model calculation, and increases the rate of model training; it can significantly improve the detection accuracy of minority class samples, improve the class imbalance problem in the data set, and can more accurately detect network intrusion behavior and improve the performance of abnormal traffic detection. It has good application prospects in the field of network traffic monitoring.

[0137] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0138] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0139] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0140] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0141] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. An abnormal traffic intelligent detection method based on SCN-BiLSTM, characterized in that: Include: Collect network traffic intrusion detection sample data, and form a network traffic intrusion detection sample data set through data preprocessing; An abnormal traffic detection model is constructed based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and a target loss function for balancing the training sample categories is set, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to enhance the key features of the spatiotemporal dimensions of network traffic; Based on the target loss function and using the network traffic intrusion detection sample data set, the abnormal traffic detection model is trained and the abnormal traffic detection target model is obtained; The network traffic to be detected is preprocessed and input into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to classify and identify the abnormalities of the network traffic to be detected.

2. According to claim 1, the abnormal traffic intelligent detection method based on SCN-BiLSTM is characterized in that: The data preprocessing includes: a data cleaning operation for performing invalid filtering and deletion on network traffic data, a unique hot encoding operation for performing conversion processing on non-numerical features of network traffic data, and a data normalization operation for performing scaling and normalization processing on the numerical values ​​of network traffic data using a minimum-maximum normalization method.

3. According to claim 1, the abnormal traffic intelligent detection method based on SCN-BiLSTM is characterized in that: The SCN includes: a conventional convolution layer for capturing sequence local patterns and basic features in input network traffic data, a depth-by-depth convolution layer for extracting spatial feature information of each channel of the network traffic data based on the sequence local patterns and basic features and using convolution kernels respectively, a point-by-point convolution layer for mixing spatial feature information of each channel of the network traffic data, and a maximum pooling layer for reducing the dimension of channel spatial feature information according to the number of feature output channels.

4. The abnormal traffic intelligent detection method based on SCN-BiLSTM according to claim 1 is characterized in that: The BiLSTM utilizes two LSTM units, forward and reverse, to process the forward and backward temporal dependencies in the network traffic data, so as to capture the temporal characteristics of the network traffic in different time periods and directions.

5. The abnormal traffic intelligent detection method based on SCN-BiLSTM according to claim 1 is characterized in that: The classification detection layer uses a softmax classifier to convert the classification output into a probability distribution.

6. The abnormal traffic intelligent detection method based on SCN-BiLSTM according to claim 1 is characterized in that: The target loss function adopts a balanced loss function, and utilizes a gradient reweighting mechanism in the balanced loss function to dynamically balance the positive and negative gradient ratios of each network traffic data sample category during the model training phase, so that the model learns samples of different categories in the network traffic data.

7. The abnormal traffic intelligent detection method based on SCN-BiLSTM according to claim 6 is characterized in that: The gradient reweighting mechanism includes: calculating the positive gradient weight and the negative gradient weight in the current model training iteration based on the ratio of the accumulated positive gradient to the negative gradient and using a specified mapping function, and using the positive gradient weight and the negative gradient weight to update the positive gradient and the negative gradient of each category output relative to the loss in the current batch, so as to update the accumulated positive gradient and negative gradient ratio in the next round of model training based on the updated positive gradient and negative gradient.

8. An abnormal traffic intelligent detection system based on SCN-BiLSTM, characterized in that: It includes: sample processing module, model building module, model training module and traffic detection module, among which, The sample processing module is used to collect network traffic intrusion detection sample data and form a network traffic intrusion detection sample data set through data preprocessing; A model building module, used to build an abnormal traffic detection model based on a stacked convolutional network (SCN) and a bidirectional long short-term memory (BiLSTM) network, and set a target loss function for balancing the training sample categories, wherein the abnormal traffic detection model includes: an SCN for extracting spatial dimension features of input network traffic data, a BiLSTM for extracting temporal dimension features of network traffic data, and a classification detection layer for classifying and identifying the extracted network traffic features, and the SCN and BiLSTM respectively use an attention mechanism to strengthen the key features of the spatiotemporal dimensions of network traffic; A model training module is used to train an abnormal traffic detection model based on a target loss function and using a network traffic intrusion detection sample data set, and obtain an abnormal traffic detection target model; The traffic detection module is used to pre-process the network traffic to be detected and input it into the abnormal traffic detection target model, so as to use the abnormal traffic detection target model to classify and identify the abnormalities of the network traffic to be detected.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images