Network intrusion detection system based on CSAGCRNet model

Abstract

The invention discloses a network intrusion detection system based on a CSAGCRNet model, and belongs to the field of network security. The system is established on the basis of a VGG16 model, innovatively fuses the advantages of a feature fusion technology and a convolutional neural network in deep learning, and greatly improves the accuracy and detection efficiency of network attack classification. The system converts flow data into a grey-scale map, extracts texture features and combines the texture features with original data, and enhances attack features. A VGG16 pre-training model is used for extracting efficient feature information, and meanwhile, a grouping convolution residual block is used for optimizing a training process, so that the training efficiency and the model performance are improved. The system innovatively combines a channel and a space attention mechanism module, realizes deep fusion of multi-scale features, and comprehensively captures multi-dimensional attack features. The system adopts an advanced multi-classification architecture, can accurately identify various network intrusion behaviors, is especially suitable for real-time malicious activity detection, and provides powerful technical support and guarantee for network security.

Description

Technical Field

[0001] The present invention belongs to the field of network security, in particular to the field of Internet of Things and network intrusion detection, and specifically to a network intrusion detection system based on a CSAGCRNet model. Background Art

[0002] In recent years, with the rapid development of network technology, network attack methods have become increasingly complex and varied. Traditional intrusion detection systems (IDS) based on feature rule bases are unable to cope with new network threats. These traditional systems mainly rely on predefined rule bases for matching detection, and their detection effects are often greatly reduced for unknown or new types of attacks.

[0003] In recent years, deep learning technology, especially convolutional neural network (CNN), has achieved remarkable results in image classification, natural language processing and other fields. However, the application of deep learning technology to network intrusion detection still faces many challenges. Network traffic data is non-image data and cannot directly take advantage of CNN's image processing advantages. Therefore, how to convert non-image data into image data so as to better use CNN for feature extraction and classification has become an urgent problem to be solved. Summary of the invention

[0004] The purpose of the present invention is to provide a network intrusion detection system based on the CSAGCRNet model to solve the problems in the prior art. The CSAGCRNet model innovatively solves the problems in the prior art, converts non-image data into image data, and improves the robustness and accuracy of the intrusion detection system. The system uses feature fusion technology and combines the powerful feature extraction capability of convolutional neural networks (CNNs) to accurately identify network attack types in real time and improve the accuracy of intrusion detection in complex network environments.

[0005] In order to achieve the above-mentioned object of the invention, the present invention provides the following technical solutions.

[0006] The present invention provides a network intrusion detection system based on the CSAGCRNet model, comprising: an initialization module, a feature extraction module, a feature extraction capability enhancement module, an optimization model module, a classification module, a system optimization module, and a real-time detection module;

[0007] The initialization module: converts network traffic data into grayscale images, extracts texture features through grayscale co-occurrence matrix, and splices it with the original network traffic data, which can significantly enhance the expression ability of attack features. Converting traffic data into grayscale images and extracting texture features can enhance the model's ability to identify attack traffic. In this way, not only can detailed attack patterns be captured, but also richer semantic information can be provided for subsequent feature analysis and classification, thereby improving the overall intrusion detection performance;

[0008] The feature extraction module: uses the first four convolution blocks of the VGG16 model as a feature extractor for pre-training and unfreezing the Block4 convolution block, extracts local and global features of the two-dimensional image data, and generates a feature map with high information content through convolution layers, activation functions and pooling operations. On this basis, after introducing the fusion channel and spatial attention module and the grouped convolution residual block into Block3 and Block4, the model's perception of high-level features can be further improved, and the network's recognition of complex patterns and details can be enhanced. This design can make full use of the rich features extracted in advance and perform more sophisticated feature reorganization and selection, thereby improving the final classification performance, especially in complex network intrusion detection tasks, showing stronger adaptability and robustness;

[0009] The module for enhancing feature extraction capability: In this module, multiple branches process the input tensor in parallel to enhance the importance information between channels and reduce the risk of overfitting. At the same time, it focuses on the input data spatially, giving the model the ability to pay attention to local areas. Specifically, the input tensor is first subjected to an adaptive average pooling operation to generate a scalar value representing the overall feature for each channel. Then, these features are sent to branches with different compression ratios respectively, and each branch performs channel compression and recovery operations, that is, the number of channels is compressed through the fully connected layer, and then the original number of channels is restored. In this process, ReLU and Sigmoid activation functions are applied in each branch respectively to generate channel attention weights. These weight tensors capture the relative importance of channels from multiple angles, and then the weights generated by each branch are fused, and the shape is adjusted so that they are multiplied element by element with the input tensor and then combined with spatial attention. Finally, the Dropout operation is applied to further reduce the risk of overfitting while amplifying the channel and spatial features that are critical to the classification task;

[0010] The optimization model module: The grouped convolution residual block first performs a grouped convolution operation on the input tensor, by dividing the input channels into a specified number of groups and then performing convolutions separately, thereby reducing the amount of calculation and extracting feature information of different groups. After each grouped convolution layer, a normalization layer and a ReLU activation function are provided to accelerate training, stabilize feature distribution, and improve nonlinear expression capabilities. Subsequently, the module checks whether the number of channels of the shortcut connection and the convolutional feature tensor match to determine whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency. After the above processing, the feature tensor will be passed to the attention mechanism module to further enhance the feature extraction effect. Finally, the processed feature tensor is added to the shortcut connection through a residual connection, and the ReLU activation function and Dropout operation are applied to enhance the nonlinear expression capability of the model and prevent overfitting.

[0011] The classification module: By fusing the output results of the fusion channel and spatial attention module with the grouped convolution residual block, a richer feature representation is obtained. The fused features are processed by the fully connected layer and the predicted category is finally output. In this process, the attention module helps to dynamically adjust the importance of different channels and give the model attention to local areas, while the grouped convolution residual block extracts more diverse features through efficient convolution operations. Through these processing steps, the model can effectively classify input data and identify normal traffic and malicious attacks, thus playing a key role in network security;

[0012] The system optimization module: repeatedly trains and adjusts the input data set through the CSAGCRNet model, and uses the cross entropy loss function and Adam optimizer to optimize the model parameters to improve the accuracy, precision and robustness of network intrusion detection;

[0013] The real-time detection module: The system can continuously monitor and detect real-time traffic to ensure rapid response capabilities and efficient detection performance in a large-scale network environment.

[0014] Furthermore, in the initialization module, the network traffic data is converted into a grayscale image, and the texture features are extracted through the grayscale co-occurrence matrix, and then spliced ​​with the original network traffic data, which can significantly enhance the expression ability of attack features, provide richer semantic information for subsequent feature analysis and classification, and improve the overall intrusion detection performance.

[0015] Furthermore, in the feature extraction module, the first four convolution blocks of the VGG16 model are used as feature extractors. The model has been pre-trained on the ImageNet dataset. The fourth block is unfrozen and its rich high-level feature representation is used to extract important features and other detail information in the input image, so that the key features of different types of network traffic can be captured during the classification process. After the fusion channel and spatial attention module and the grouped convolution residual block are introduced into Block3 and Block4, the model's perception of high-level features can be further improved, and the network's recognition of complex patterns and details can be enhanced.

[0016] Furthermore, in the attention mechanism module, multiple branches process the input tensor in parallel to enhance the importance information between channels and effectively reduce the risk of overfitting. Specifically, the input tensor is first subjected to an adaptive average pooling operation to generate a scalar value representing the overall feature for each channel. Then, these features are sent to multiple branches with different compression ratios, and each branch performs channel compression and recovery through a fully connected layer, that is, the number of channels is compressed first and then the original number of channels is restored. In each branch, ReLU and Sigmoid activation functions are applied respectively to generate channel attention weights. In this way, each branch captures the relative importance of the channel from different angles. Subsequently, the weights generated by each branch are fused, and the shape is adjusted to be multiplied element-by-element with the input tensor, and then the spatial attention mechanism is fused to further amplify the channel features and spatial features that are critical to the classification task. Finally, the Dropout operation is applied to further reduce the risk of overfitting and ensure the generalization ability of the model.

[0017] Furthermore, the grouped convolution residual block first performs a grouped convolution operation on the input tensor, by dividing the input channels into a specified number of groups for convolution, thereby reducing the amount of computation and extracting unique features for each group. After each grouped convolution layer, a normalization layer and a ReLU activation function are applied to accelerate the training process, stabilize the feature distribution, and enhance the nonlinear expression ability of the network. Next, the module checks whether the number of channels of the shortcut connection is consistent with that of the feature tensor after convolution to determine whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency. After these processes, the feature tensor will be passed to the attention mechanism module to further enhance the feature extraction capability. Finally, the processed feature tensor is added to the shortcut connection through a residual connection, and the ReLU activation function and Dropout operation are applied to enhance the nonlinear expression ability of the model while effectively preventing overfitting.

[0018] Furthermore, by fusing the output of the attention module with the grouped convolutional residual block, the model can obtain richer and more diverse feature representations. The attention module dynamically adjusts the importance of different channels and introduces a spatial attention mechanism to enable the model to better focus on key local features, while the grouped convolutional residual block extracts fine-grained features from multiple angles through efficient convolution operations. The fused features are processed by a fully connected layer and the predicted category is finally output. In this process, the channel attention mechanism of the attention module helps to highlight features that are critical to the classification task, the spatial attention helps to highlight the relationship between local features, and the grouped convolutional residual block optimizes computational efficiency and feature expression capabilities. Through these processing steps, the model can accurately classify input data and identify normal traffic and malicious attacks, thus playing a vital role in network security.

[0019] The present invention uses feature fusion technology to extract the texture features of the grayscale image produced by the original network traffic through the grayscale co-occurrence matrix, and then splices it with the original network traffic. After splicing the extracted texture features with the original network traffic data, the model can combine two different types of features to perform a more comprehensive and multi-dimensional analysis. This fusion can not only retain the key information of the original data, but also further enhance the identification of attack traffic through texture features, thereby improving classification accuracy and robustness.

[0020] The present invention proposes a network intrusion detection system based on CSAGCRNet. The system first uses feature fusion technology to extract the texture features of the grayscale image produced by the original network traffic through the grayscale co-occurrence matrix, and then splices it with the original network traffic. Then, feature extraction is performed through the pre-trained VGG16 model, and the extracted features are processed and fused in combination with the Residual module, the fusion channel and the spatial attention module, and finally the classification results are output through the fully connected layer.

[0021] The present invention has the following advantages: (1) Enhanced attack features: The feature fusion technology is used to extract the texture information in the grayscale co-occurrence matrix and combine it with the original traffic, so as to strengthen the connection between the attack features and provide useful information for subsequent classification; (2) Deep learning model: The combination of the VGG16 model with the grouped convolution residual module and the fusion channel and spatial attention module utilizes a multi-scale feature extraction mechanism to enhance the classification performance of different types of network attacks and accelerate the convergence speed of the model; (3) Enhanced detection performance: Compared with traditional intrusion detection systems, the system has higher accuracy, robustness and real-time performance when processing multiple types of complex network traffic. The present invention not only utilizes the original data of network traffic, but also extracts the texture features of the grayscale image through the grayscale co-occurrence matrix, thereby realizing the comprehensive utilization of multi-source information. The fusion of multi-source information helps to more comprehensively and accurately describe the characteristics of network traffic and improve the accuracy of the detection system. The deep learning model structure (VGG16, residual module, fusion channel and spatial attention module) adopted by the present invention has good scalability and flexibility. The model can be adjusted and optimized according to actual needs to adapt to network traffic detection tasks of different scales and types. The present invention not only improves the accuracy and robustness of the detection system, but also accelerates the convergence speed of the model, and realizes the comprehensive utilization of multi-source information and the scalability, flexibility, and easy deployment and maintenance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is a schematic diagram of the process of feature fusion of the network intrusion detection system based on the CSAGCRNet model of the present invention;

[0023] Figure 2 It is a system architecture diagram of the CSAGCRNet model of the present invention. DETAILED DESCRIPTION

[0024] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the following embodiments will further illustrate the present invention in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention. On the contrary, the present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention as defined by the claims.

[0025] The embodiment of the present invention includes the following steps:

[0026] (1) Initialization: The system obtains non-image data from network traffic and uses the preprocessing module to comprehensively clean the original data, effectively eliminating noise data and redundant information, and standardizing the data to ensure that it has uniform specifications and scales. On this basis, image conversion technology is used to convert network traffic data into grayscale images, and the grayscale co-occurrence matrix is ​​used to extract texture features and splice them with the original network traffic data. During the conversion process, special attention is paid to preserving the similarity and domain structure between data to maximize the integrity and consistency of features before and after conversion. This method provides a solid and reliable foundation for subsequent analysis and processing based on image data, thereby significantly enhancing the expressiveness of attack features;

[0027] (2) Feature extraction: The first four convolutional blocks of the VGG16 model are used as pre-trained feature extractors, and the pre-trained weights are introduced. At the same time, the convolutional layer of Block4 is unfrozen, which can quickly and effectively extract the features of the image data after network traffic conversion. In addition, the transfer learning ability of the pre-trained model enables the system to quickly adapt to new attack patterns by fine-tuning the pre-trained model when facing new attacks. On this basis, the fusion channel and spatial attention module and the grouped convolution residual block are introduced into Block3 and Block4, which can further improve the model's perception of high-level features and enhance the network's recognition of complex patterns and details. This design can make full use of the rich features extracted in advance and perform more refined feature reorganization and selection, thereby improving the final classification performance, especially in complex network intrusion detection tasks, showing stronger adaptability and robustness. Through convolutional layers, activation functions and pooling operations, the model can capture local features and global information in the image layer by layer, generate highly informative feature maps, and provide richer semantic information and visual features for subsequent tasks. This feature extraction process provides a solid foundation for subsequent network intrusion detection tasks and ensures the efficiency and accuracy of the system in processing complex data;

[0028] (3) Enhanced feature extraction capability: In this module, multiple branches process the input tensor in parallel to enhance the importance information between channels and reduce the risk of overfitting. At the same time, the model focuses on the input data spatially, giving it the ability to pay attention to local areas. Specifically, the input tensor is first subjected to an adaptive average pooling operation to generate a scalar value representing the overall feature for each channel. Then, these features are sent to branches with different compression ratios respectively, and each branch performs channel compression and recovery operations, that is, the number of channels is compressed through a fully connected layer and then the original number of channels is restored. In this process, ReLU and Sigmoid activation functions are applied to each branch to generate channel attention weights. These weight tensors capture the relative importance of channels from multiple perspectives. The weights generated by each branch are then fused and reshaped so that they can be multiplied element-by-element with the input tensor and then combined with spatial attention. Finally, the Dropout operation is applied to further reduce the risk of overfitting while amplifying the channel and spatial features that are critical to the classification task;

[0029] (4) Optimizing the model: The grouped convolution residual block first performs a grouped convolution operation on the input tensor. It divides the input channels into a specified number of groups and then performs convolution separately, thereby reducing the amount of computation and extracting feature information of different groups. After each grouped convolution layer, a normalization layer and a ReLU activation function are provided to accelerate training, stabilize feature distribution, and improve nonlinear expression capabilities. Subsequently, the module checks whether the number of channels of the shortcut connection and the convolutional feature tensor match to determine whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency. After the above processing, the feature tensor will be passed to the attention mechanism module to further enhance the feature extraction effect. Finally, the processed feature tensor is added to the shortcut connection through a residual connection, and the ReLU activation function and Dropout operation are applied to enhance the nonlinear expression capability of the model and prevent overfitting.

[0030] (5) Classification: By fusing the output results of the fusion channel and spatial attention module with the grouped convolution residual block, a richer feature representation is obtained. The fused features are processed by the fully connected layer and the predicted category is finally output. In this process, the attention module helps to dynamically adjust the importance of different channels and give the model attention to local areas, while the grouped convolution residual block extracts more diverse features through efficient convolution operations. Through these processing steps, the model can effectively classify the input data and identify normal traffic and malicious attacks, thus playing a key role in network security;

[0031] (6) System optimization: The CSAGCRNet model is used to repeatedly train and adjust the input data set, and the cross entropy loss function and Adam optimizer are used to optimize the model parameters to improve the accuracy, precision, and robustness of network intrusion detection;

[0032] (7) Real-time detection: The system can continuously monitor and detect real-time traffic, ensuring rapid response capabilities and efficient detection performance in large-scale network environments.

[0033] Converting network traffic data into grayscale images, extracting texture features through grayscale co-occurrence matrices, and concatenating them with the original network traffic data can significantly enhance the expression of attack features. First, after network traffic data is converted into grayscale images, the spatial structure and local patterns in the traffic can be captured more effectively. This conversion not only retains the key features of the data, but also simplifies the representation of the data, making it easier for the model to process. By analyzing the relative relationship between pixels, the grayscale co-occurrence matrix can capture the statistical information and patterns in the traffic, especially the subtle differences between attack traffic and normal traffic. Attack features in grayscale images are usually manifested as unique textures or spatial distribution patterns, which are often visually distinguishable from normal traffic. By extracting these features, the model can more accurately identify and distinguish attack traffic and improve the sensitivity of detection. In short, converting traffic data into grayscale images and extracting texture features can enhance the model's ability to identify attack traffic. In this way, not only can detailed attack patterns be captured, but also richer semantic information can be provided for subsequent feature analysis and classification, thereby improving the overall intrusion detection performance.

[0034] The first four convolutional blocks of the VGG16 model are used as feature extractors. Before use, the VGG16 model is pre-trained on the ImageNet dataset, and the fourth convolution is unfrozen. Its rich high-level feature representation is used to extract important features and other detailed information from the input image, so that the key features of different types of network traffic can be captured during the classification process. In addition, the transfer learning ability of the pre-trained model enables the system to quickly adapt to new attacks by fine-tuning the pre-trained model. On this basis, the fusion channel and spatial attention module and the grouped convolution residual block are introduced into Block3 and Block4, which can further improve the model's perception of high-level features and enhance the network's recognition of complex patterns and details. This design can make full use of the rich features extracted in advance and perform more sophisticated feature reorganization and selection, thereby improving the final classification performance, especially in complex network intrusion detection tasks, showing stronger adaptability and robustness.

[0035] The attention mechanism module contains multiple branches. A scalar value representing the overall characteristics of the channel is obtained by performing adaptive average pooling on the input tensor, and then processed on multiple branches with different compression ratios. Each branch first undergoes compression and recovery operations of the fully connected layer, and then the channel attention weight tensor is calculated by combining the Relu function and the Sigmoid function. The weight tensor of each branch is then fused, and the shape is adjusted and then multiplied element-by-element with the input tensor, and finally the Dropout operation is applied. In this way, the importance information between channels can be captured from different angles, highlighting the channel features that are more critical to the classification task, while preventing overfitting. At the same time, the spatial attention mechanism focuses on the spatial position in the input data, giving the model the ability to pay attention to local areas. Through this design, the model's perception of local features and structures in images or other data is significantly enhanced, thereby improving its recognition of details and local patterns;

[0036] The grouped convolution residual block first performs a grouped convolution operation on the input tensor, and reduces the amount of calculation and mines the feature information under different groups by dividing the input channels into a specified number of groups for convolution. After each grouped convolution layer, a normalization layer and a Relu activation function are provided to accelerate training, stabilize data distribution, and increase nonlinear expression capabilities. Next, check whether the number of channels of the shortcut connection matches the number of channels of the feature tensor after the convolution operation to decide whether to adjust the number of channels of the shortcut connection. The feature tensor processed as above is passed to the attention mechanism module to enhance the feature extraction capability, and then a residual connection is performed with the shortcut connection, and finally the Relu function and Dropout operation are applied.

[0037] First, the fusion channel and spatial attention module are fused with the grouped convolution residual block, and the result of this operation is input into the fully connected layer. Then, the fully connected layer performs corresponding calculations on the input information received to obtain the predicted category. Finally, further classification processing operations are carried out based on these predicted categories to accurately identify whether the processed data belongs to normal traffic or malicious attacks.

[0038] Through feature fusion technology, the texture features of the grayscale image produced by the original network traffic are extracted through the grayscale co-occurrence matrix, and then spliced ​​with the original network traffic. After splicing the extracted texture features with the original network traffic data, the model can combine two different types of features for a more comprehensive and multi-dimensional analysis. This fusion can not only retain the key information of the original data, but also further enhance the identification of attack traffic through texture features, improving classification accuracy and robustness.

[0039] The network intrusion detection system has an adaptive adjustment mechanism, which can be dynamically adjusted according to the traffic characteristics under different network environments, including adjusting the convolution kernel size, pooling method and activation function parameters to adapt to different network architectures and data characteristics, so as to improve the intrusion detection effect in the Internet of Things environment or large-scale enterprise network environment.

[0040] The network intrusion detection system includes batch normalization and dropout layer mechanisms. Batch normalization is used to standardize activation values ​​in each layer output to reduce internal covariate shift; the dropout layer randomly shields some neurons to prevent overfitting and enhance the generalization ability of the model.

[0041] The network intrusion detection system generates corresponding warning information according to the classification results and feeds back to the security administrator in real time.

[0042] Example 1

[0043] like Figure 1 As shown in the figure, the schematic diagram of the feature fusion process describes the process of converting high-dimensional data into a two-dimensional image. The specific steps are as follows:

[0044] Step 1: Data preprocessing. In network intrusion detection, the original network traffic data usually contains multiple features (such as transmission time, packet size, protocol type, etc.). First, these high-dimensional features are represented as vectors:

[0045] (1)

[0046] in, Indicates the feature, Represents the dimension of the feature.

[0047] Step 2: Convert to grayscale image. In order to extract the texture features of network traffic, we first reduce the high-dimensional data to a two-dimensional plane and generate the corresponding two-dimensional image data. The quantity is mapped to a two-dimensional plane and the corresponding two-dimensional image matrix is ​​generated:

[0048] (2)

[0049] in, Represents the two-dimensional image matrix after dimensionality reduction by the eigenvector.

[0050] Step 3: Extract texture features. The gray-level co-occurrence matrix is ​​a mathematical tool for describing image texture features, which is commonly used in image processing and computer vision tasks. It captures the texture pattern in the image by calculating the spatial relationship between the gray-level pixel pairs in the image. The gray-level co-occurrence matrix is ​​also important for extracting traffic features after network traffic data is converted into images. Its formula is as follows:

[0051] (1) Energy: measures the uniformity of image texture.

[0052] (3)

[0053] (2) Contrast: measures the contrast intensity of image texture.

[0054] (4)

[0055] (3) Correlation: measures the linear relationship between grayscale values.

[0056] (5)

[0057] (4) Homogeneity: measures the smoothness of texture in an image.

[0058] (6)

[0059] (5) Entropy: measures the complexity of image texture.

[0060] (7)

[0061] Where i and j are gray levels, p(i,j) is the element in the gray level co-occurrence matrix that represents the co-occurrence frequency of gray level pair (i, j). and are the grayscale mean of the image (mean along rows and columns), and is the standard deviation of the grayscale values.

[0062] Step 4: Feature fusion. The extracted texture features are fused with the original network traffic features, providing a solid and reliable foundation for subsequent image data-based analysis and processing, thereby significantly enhancing the expression ability of attack features.

[0063] Step 5: VGG16 model preprocessing. The generated 2D image is then input to the pre-trained VGG16 model, which has been pre-trained on the ImageNet dataset and has strong feature extraction capabilities. In the VGG16 model, we use its first four convolutional pooling blocks but unfreeze the last convolutional block to extract high-level features. The convolution operation in this part can be expressed as:

[0064] (8)

[0065] in, represents the output feature map after convolution, represents the convolution kernel, Indicates bias.

[0066] Step 6: In the fusion channel and spatial attention mechanism module, multiple branches process the input tensor in parallel to enhance the importance information between channels and effectively reduce the risk of overfitting. The specific operation is as follows: First, perform an adaptive average pooling operation on the input tensor to generate a scalar value representing the overall feature for each channel:

[0067] (9)

[0068] (10)

[0069] in, , Represents the output after adaptive average pooling.

[0070] Next, these features are sent to multiple branches with different compression ratios. Each branch performs channel compression and recovery through a fully connected layer, that is, the number of channels is compressed first and then the original number of channels is restored. In each branch, ReLU and Sigmoid activation functions are applied to generate channel attention weights:

[0071] (11)

[0072] (12)

[0073] (13)

[0074] (14)

[0075] (15) (16)

[0076] (17)

[0077] (18)

[0078] in, , According to Linear layers that compress output channels or input channels, , According to Linear layer that compresses output channels or input channels.

[0079] Subsequently, the weights generated by each branch are fused and reshaped to be multiplied element-by-element with the input tensor, further amplifying the channel features that are critical to the classification task:

[0080] (19)

[0081] Then, the channel features are fused with the spatial features to extract attack features from both channel and spatial dimensions, thus strengthening the model’s focus on important features.

[0082] (20)

[0083] (twenty one)

[0084] in, Represents the result of multiplying the weights of each fused branch by the input tensor.

[0085] Finally, the Dropout operation is applied to further reduce the risk of overfitting and ensure the generalization ability of the model:

[0086] (twenty two)

[0087] Step 7: The specific operation of the group convolution residual block is as follows:

[0088] First, a grouped convolution operation is performed on the input tensor. After each grouped convolution layer, a normalization layer and a ReLU activation function are applied:

[0089] (twenty three)

[0090] (twenty four)

[0091] in, , Represents the output of a grouped convolution operation and the application of a normalization layer and a ReLU activation function.

[0092] Next, the module checks whether the number of channels of the shortcut connection is consistent with the number of channels of the convolutional feature tensor to decide whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency.

[0093] After these processes, the feature tensor will be passed into the multi-branch SE module to further enhance the feature extraction capability:

[0094] (25)

[0095] in, Represents the output of the multi-branch SE module.

[0096] Finally, the processed feature tensor is added to the shortcut connection through the residual connection, and the ReLU activation function and Dropout operation are applied:

[0097] (26)

[0098] (11) Step 8: The dataset finally enters the global average pooling layer. By averaging the entire feature map, global average pooling can fuse features at different positions and extract the global features of the image or data. It is then flattened and entered into the linear layer for normalization. It enters the dropout layer to discard some unimportant neurons and then enters the linear layer again to generate the output result.

[0099] Example 2

[0100] 1. System Architecture

[0101] The network intrusion detection system based on the CSAGCRNet model can be deployed in an actual network environment to monitor the network traffic in real time.

[0102] System architecture Figure 2 As shown, the following steps are included:

[0103] Step 1: Input layer. The system receives network traffic data in real time and converts it into a grayscale image through the preprocessing module. Then, it extracts its texture features through the gray-level co-occurrence matrix and finally splices it with the original network traffic data.

[0104] Step 2: CSAGCRNet model. The processed traffic is input into the first four convolution blocks of the pre-trained VGG16 network to extract the underlying features, and then the fusion channel is connected to the spatial attention module and the grouped convolution residual block after Block3 and Block4 respectively, which can further improve the model's perception of high-level features and enhance the network's recognition of complex patterns and details.

[0105] 2. Real-time detection process

[0106] When the system is deployed at the network entrance, all passing network traffic will be automatically captured and processed by the system.

[0107] The specific steps are as follows:

[0108] Step 1: Data collection and data generation. The network traffic data is obtained in real time through the network collector, and converted into a grayscale image. Then, its texture features are extracted through the grayscale co-occurrence matrix, and finally the traffic data is generated after being spliced ​​with the original network traffic data.

[0109] Step 2: Model inference. The generated image enters the CSAGCRNet model, which extracts features based on the pre-trained feature extraction layer and fusion channels with the spatial attention module and the grouped convolution residual block.

[0110] Step 3: Abnormal traffic detection: When the system detects that network traffic belongs to the category of malicious attack, the system will trigger an alarm and record relevant information for security personnel to analyze.

[0111] 3. System Optimization

[0112] In order to improve the detection efficiency of the system, the system is trained through the cross entropy loss function and the Adam optimizer. During the model optimization process, the weight of the model is adjusted through continuous iterations, so that the classification accuracy is gradually improved.

[0113] The network intrusion detection system of the present invention can be integrated into the existing network security protection system. The system can be deployed at the network entrance to monitor the traffic passing through in real time. Once suspicious traffic is detected, the system will issue an alarm and record detailed attack information for reference by the security administrator.

[0114] The present invention proposes an innovative network intrusion detection system, the core of which is built on the CSAGCRNet model. This system cleverly combines the cutting-edge technology of feature fusion and the excellent feature extraction ability of convolutional neural network (CNN) in the field of deep learning, thereby significantly enhancing the classification accuracy and detection efficiency of network attacks. Specifically, the system converts traffic data into grayscale images, extracts its texture features and splices them with the original traffic data to enhance the network traffic attack features, and then uses the VGG16 pre-training model to mine and extract efficient and representative feature information. At the same time, the key role of the grouped convolution residual block in optimizing the deep neural network training process is fully utilized to effectively improve the training efficiency and enhance the model performance, and innovatively combines the fusion channel and the spatial attention mechanism module to achieve deep fusion of multi-scale features, and capture attack features from multiple dimensions from channels and spaces. The system adopts an advanced multi-classification architecture, which can accurately identify various types of network intrusion behaviors in complex and changeable network environments. It is very suitable for real-time malicious activity detection scenarios and provides strong technical support and guarantee for network security protection.

[0115] Although the present disclosure has been shown and described with reference to specific exemplary embodiments of the present disclosure, it should be understood by those skilled in the art that various changes in form and details may be made to the present disclosure without departing from the spirit and scope of the present disclosure as defined by the appended claims and their equivalents. Therefore, the scope of the present disclosure should not be limited to the above-mentioned embodiments, but should be determined not only by the appended claims, but also by the equivalents of the appended claims.

Claims

1. A network intrusion detection system based on the CSAGCRNet model, characterized in that: include: An initialization module is used to convert network traffic data into a grayscale image, extract texture features of the grayscale image through a grayscale co-occurrence matrix, and concatenate the texture features with the original network traffic data to enhance the expression capability of attack features and provide richer semantic information for subsequent feature analysis and classification; The feature extraction module uses the first four convolution blocks of the VGG16 model as pre-trained feature extractors and unfreezes the Block4 convolution block to extract local and global features of the two-dimensional image data. It generates feature maps with high information content through convolution layers, activation functions, and pooling operations. After introducing the fusion channel and spatial attention module and the grouped convolution residual block into Block3 and Block4, the model's perception of high-level features is further improved. Strengthen the feature extraction capability module, including multiple branches processing the input tensor in parallel to enhance the importance information between channels and reduce the risk of overfitting. Specifically, the input tensor is adaptively averaged pooled to generate a scalar value representing the overall feature, and these features are sent to branches with different compression ratios for channel compression and recovery operations. The ReLU and Sigmoid activation functions are used to generate channel attention weights. The weights generated by each branch are fused and reshaped to be multiplied element-by-element with the input tensor. The spatial attention mechanism is combined, and finally the Dropout operation is applied to reduce the risk of overfitting. Optimize the model module, the group convolution residual block first performs a group convolution operation on the input tensor, divides the input channels into a specified number of groups and then performs convolution respectively to reduce the amount of calculation and extract feature information of different groups; a normalization layer and a ReLU activation function are provided after each group convolution layer to accelerate training, stabilize feature distribution, and improve nonlinear expression ability; check whether the number of channels of the shortcut connection and the convolution feature tensor match to determine whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency; the processed feature tensor is passed to the attention mechanism module to enhance the feature extraction effect, the processed feature tensor is added to the shortcut connection through the residual connection, and the ReLU activation function and the Dropout operation are applied to enhance the nonlinear expression ability of the model and prevent overfitting; The classification module fuses the output results of the fusion channel and spatial attention module with the grouped convolution residual block to obtain a rich feature representation, which is processed by the fully connected layer and finally outputs the predicted category; The system optimization module repeatedly trains and adjusts the input data set through the CSAGCRNet model, and uses the cross entropy loss function and Adam optimizer to optimize the model parameters to improve the accuracy, precision and robustness of network intrusion detection; Real-time detection module, which is used to continuously monitor and detect real-time traffic to ensure rapid response and efficient detection performance in large-scale network environments; The system also includes batch normalization and dropout layer mechanisms. Batch normalization standardizes the activation values ​​in each layer output to reduce internal covariate shift; the dropout layer randomly blocks some neurons to prevent overfitting and enhance the generalization ability of the model. The system has an adaptive adjustment mechanism, which can be dynamically adjusted according to the traffic characteristics in different network environments, including adjusting the convolution kernel size, pooling method and activation function parameters to adapt to different network architectures and data characteristics, so as to achieve the best intrusion detection effect in the Internet of Things environment or large-scale enterprise network environment.

2. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the initialization module, the network traffic data is converted into a grayscale image, and texture features are extracted through the grayscale co-occurrence matrix. The texture features are then spliced ​​with the original network traffic data to significantly enhance the expression ability of the attack features, provide richer semantic information for subsequent feature analysis and classification, and improve the overall intrusion detection performance.

3. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the feature extraction module, the first four convolution blocks of the VGG16 model are used as feature extractors. Before use, the VGG16 model is pre-trained on the ImageNet dataset, and the fourth convolution is unfrozen. The rich high-level feature representation is used to extract important features and other detail information in the input image, so that the key features of different types of network traffic can be captured during the classification process. In addition, the transfer learning ability of the pre-trained model enables the system to quickly adapt to new attacks by fine-tuning the pre-trained model. On this basis, after the fusion channel and spatial attention module and the grouped convolution residual block are introduced into Block3 and Block4, the model's perception of high-level features is further improved, and the network's recognition of complex patterns and details is enhanced. This design can make full use of the rich features extracted in advance and perform more sophisticated feature reorganization and selection, thereby improving the final classification performance, especially in complex network intrusion detection tasks, showing stronger adaptability and robustness.

4. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the enhanced feature extraction capability module, the fusion channel and space module includes multiple branches to process input tensors in parallel to enhance the importance information between channels and effectively reduce the risk of overfitting; A scalar value representing the overall feature is generated through an adaptive average pooling operation and sent to multiple branches with different compression ratios for channel compression and recovery. The ReLU and Sigmoid activation functions are used to generate channel attention weights. The weights generated by each branch are fused and the shape is adjusted and multiplied element-by-element with the input tensor. Combined with the spatial attention mechanism, the Dropout operation is finally applied to reduce the risk of overfitting.

5. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the optimization model module, the grouped convolution residual block first performs a grouped convolution operation on the input tensor, divides the input channels into a specified number of groups for convolution, so as to reduce the amount of calculation and extract the unique features of each group; applies a normalization layer and a ReLU activation function after each grouped convolution layer to accelerate the training process, stabilize the feature distribution, and enhance the nonlinear expression ability of the network; checks whether the number of channels of the shortcut connection is consistent with that of the feature tensor after convolution to determine whether the number of channels of the shortcut connection needs to be adjusted to maintain dimensional consistency; passes the processed feature tensor into the attention mechanism module, adds the processed feature tensor to the shortcut connection through the residual connection, and applies the ReLU activation function and the Dropout operation to enhance the nonlinear expression ability of the model and prevent overfitting.

6. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the optimization model module, the attention mechanism module includes multiple branches, and a scalar value representing the overall characteristics of the channel is obtained by performing adaptive average pooling processing on the input tensor, and the processing is performed on multiple branches with different compression ratios. Each branch first undergoes compression and recovery operations of the fully connected layer, and then the channel attention weight tensor is calculated by combining the Relu function and the Sigmoid function. The weight tensor of each branch is then fused, and the shape is adjusted and then multiplied element-by-element with the input tensor, and finally the Dropout operation is applied; the importance information between channels is captured from different angles, and the channel features that are more critical to the classification task are highlighted, while preventing overfitting. At the same time, the spatial attention mechanism focuses on the spatial position in the input data, giving the model the ability to pay attention to local areas; the model's perception of local features and structures in images or other data is significantly enhanced, thereby improving its recognition effect on details and local patterns.

7. According to claim 1, a network intrusion detection system based on the CSAGCRNet model is characterized in that: In the classification module, by fusing the output results of the attention module with the grouped convolutional residual block, the model can obtain richer and more diverse feature representations; the attention module dynamically adjusts the importance of different channels and introduces a spatial attention mechanism to enable the model to better focus on key local features; the grouped convolutional residual block extracts fine-grained features from multiple angles through efficient convolution operations; the fused features are processed through a fully connected layer and finally the predicted category is output.

8. A network intrusion detection method based on CSAGCRNet model, characterized in that Using a network intrusion detection system based on the CSAGCRNet model as described in any one of claims 1 to 7, the method comprises the following steps: 1) Data preprocessing and grayscale image conversion: Collect network traffic data, including transmission time, packet size, and protocol type, and represent it as a high-dimensional feature vector; reduce the dimension of the high-dimensional feature vector and map it to a two-dimensional plane to generate the corresponding two-dimensional image data, i.e., a grayscale image; this conversion retains the key features of the data and simplifies the data representation; 2) Extract texture features: Use the gray-level co-occurrence matrix to analyze the grayscale image and extract its texture features, including energy, contrast, correlation, homogeneity, and entropy; these features can capture the texture patterns in the image, especially the subtle differences between attack traffic and normal traffic; 3) Feature fusion: The extracted texture features are combined with the original network traffic features to form a fused feature vector. This step combines two different types of features, providing rich and comprehensive information for subsequent feature analysis and classification. 4) VGG16 model preprocessing and feature extraction: Input the fused feature vector (in the form of a two-dimensional image) into the pre-trained VGG16 model; the VGG16 model has been pre-trained on the ImageNet dataset and has strong feature extraction capabilities; use the first four convolutional blocks of the VGG16 model as feature extractors, but unfreeze the fourth convolutional block to utilize its rich high-level feature representation; generate feature maps with high information content through convolutional layers, activation functions, and pooling operations; 5) Introducing attention mechanism and grouped convolution residual block: After Block3 and Block4 of the VGG16 model, the fusion channel and spatial attention modules are connected to further enhance the model's ability to capture the importance of information between channels and spatial positions; the grouped convolution residual block is introduced after Block3 and Block4 to reduce the amount of calculation and extract feature information under different groups; after each grouped convolution layer, a normalization layer and ReLU activation function are provided to accelerate training, stabilize data distribution and increase nonlinear expression capabilities; through the combination of attention mechanism and grouped convolution residual block, the model's perception of high-level features is improved, and the network's recognition of complex patterns and details is enhanced; 6) Model optimization and training: Use the cross entropy loss function and Adam optimizer to train the model to optimize model parameters and improve the accuracy of network intrusion detection. During the training process, the classification accuracy is gradually improved by continuously iteratively adjusting the model weights. 7) Real-time detection and early warning: Deploy the trained model in the actual network environment to monitor the network traffic in real time. When the system detects that the network traffic belongs to the malicious attack category, it triggers an alarm and records relevant information for security personnel to analyze. The system has an adaptive adjustment mechanism that can dynamically adjust according to the traffic characteristics in different network environments to adapt to different network architectures and data characteristics. 8) Global average pooling and output results: The data set enters the global average pooling layer, and the global features of the image or data are extracted by averaging the entire feature map; the global features are flattened and then enter the linear layer for normalization, and then enter the discard layer to discard some unimportant neurons, and finally enter the linear layer again to generate output results; the system generates corresponding warning information based on the classification results and provides real-time feedback to the security administrator.

9. A network intrusion detection method based on the CSAGCRNet model as claimed in claim 8, characterized in that In step 3), the feature fusion extracts the texture features of the grayscale image produced by the original network traffic through the grayscale co-occurrence matrix, and then splices it with the original network traffic; after splicing the extracted texture features with the original network traffic data, the model combines two different types of features to perform a more comprehensive and multi-dimensional analysis; this fusion can not only retain the key information of the original data, but also further enhance the identification of attack traffic through texture features, thereby improving classification accuracy and robustness.

10. A network intrusion detection method based on the CSAGCRNet model as claimed in claim 8, characterized in that In step 5), the attention mechanism and the grouped convolution residual block are introduced, and the fusion channel and the spatial attention module are first fused with the grouped convolution residual block. The result of this operation will be input into the fully connected layer; then, the fully connected layer performs corresponding calculations on the input information received, and then obtains the predicted category; Finally, further classification processing operations are performed based on these predicted categories to accurately identify whether the processed data belongs to normal traffic or malicious attacks.

Images