Network intrusion detection method and device based on ensemble learning

Abstract

The invention belongs to the technical field of network security, and discloses a network intrusion detection method and device based on ensemble learning, and the method comprises the steps: obtaining real-time network flow data; performing data preprocessing on the real-time network flow data to obtain to-be-measured flow; predicting the traffic to be measured by using different pre-trained machine learning models to obtain prediction results of multiple machine learning models; according to the voting weight, integrating prediction results of the multiple machine learning models by using a weighted voting mechanism, and outputting a network intrusion detection result for obtaining real-time network flow data; wherein the voting weight is dynamically optimized through a particle swarm algorithm; according to the invention, the prediction results of multiple machine learning models are integrated and summarized by using a weighted voting mechanism according to the voting weight, the advantages of different machine learning models are fully utilized, the final intrusion detection result is ensured to reflect the comprehensive knowledge of multiple machine learning models, and the accuracy and efficiency of the overall detection are improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, relates to network intrusion detection technology, and particularly to a network intrusion detection method and device based on ensemble learning. Background Art

[0002] Intrusion Detection System (IDS) is a network security device used to detect suspicious activities or threatening behaviors in the network. It is a key technology for protecting network infrastructure and is widely used in energy, telecommunications, public utilities and other fields.

[0003] In recent years, some researchers have introduced machine learning models into intrusion detection systems to enable them to detect more advanced suspicious activities or threat behaviors. However, since network traffic data is usually an uneven data distribution, and each machine learning model has an advantage range for a specific traffic type, it is often ineffective for traffic types that are not within its expertise, resulting in a single model being unable to effectively cope with the diversity and complexity of current suspicious activities or threat behaviors.

[0004] With the continuous development of intrusion detection technology, it has gradually evolved from an intrusion detection system based on a single machine learning model to an intrusion detection system based on ensemble learning. Among them, the intrusion detection system based on ensemble learning combines multiple basic machine learning models to improve the overall detection capability. Specifically, each model receives network traffic as input and returns a prediction result for the activity type, and ultimately provides a more accurate response based on an integrated voting mechanism.

[0005] At present, in the existing intrusion detection systems based on ensemble learning, static weights are usually used to combine the prediction results of the models, that is, each model is assigned a fixed weight when implementing ensemble learning, but the assigned fixed weights make the model unable to adapt to the real-time evolution of changes in network traffic; at the same time, since the weights assigned to each model are fixed, the performance of the model will change with new attacks or changes in traffic behavior. For example, a model that was initially proven to be effective in detecting Distributed Denial of Service (DDoS) may gradually become ineffective with the introduction of new attack variants or the evolution of network traffic, which in turn greatly reduces the efficiency and accuracy of intrusion detection, leaving the network at risk of long-term threats. Summary of the invention

[0006] In view of the technical problems existing in the prior art, the present invention provides a network intrusion detection method and device based on ensemble learning to solve the technical problem that the existing intrusion detection system based on ensemble learning uses static weights to combine the prediction results of the model, resulting in greatly reduced efficiency and accuracy of intrusion detection, making the network face long-term threat risks.

[0007] In order to achieve the above object, the technical solution adopted by the present invention is: The present invention provides a network intrusion detection method based on ensemble learning, comprising: Get real-time network traffic data; Perform data preprocessing on real-time network traffic data to obtain the traffic to be tested; Different pre-trained machine learning models are used to predict the traffic to be tested, and the prediction results of multiple machine learning models are obtained. According to the voting weights, the prediction results of multiple machine learning models are integrated using a weighted voting mechanism to output the network intrusion detection results of real-time network traffic data. Among them, the voting weights are dynamically optimized using a particle swarm algorithm.

[0008] Furthermore, the real-time network traffic data is preprocessed to obtain the traffic to be tested, as follows: The real-time network traffic data is subjected to feature encoding, data normalization and resampling to obtain the preprocessing result of the real-time network traffic data as the traffic to be measured.

[0009] Furthermore, the training process of the pre-trained machine learning model is as follows: The NSL-KDD dataset is used to train and verify multiple predetermined machine learning models to obtain multiple pre-trained machine learning models; wherein, during the verification process, several pre-trained machine learning models are determined as the best models for each traffic category; the multiple predetermined machine learning models include a random forest model, a gradient boosting model, and a logistic regression model.

[0010] Furthermore, the process of training and verifying multiple predetermined machine learning models using the NSL-KDD dataset to obtain multiple pre-trained machine learning models is as follows: Perform data preprocessing on the NSL-KDD dataset to obtain a preprocessed dataset; The chi-square test method is used to extract key features from the preprocessed data set to obtain training data; Determine a plurality of machine learning models, and optimize hyperparameters of each machine learning model using a grid search method to obtain a plurality of predetermined machine learning models; Divide the training data into preset proportions to obtain a training set and a validation set; Each predetermined machine learning model is trained using the training set to obtain multiple trained machine learning models; each trained machine learning model is verified using the validation set, and a voting weight is assigned to each trained machine learning model according to preset model performance evaluation indicators to obtain multiple pre-trained machine learning models.

[0011] Furthermore, different pre-trained machine learning models are used to predict the traffic to be tested, and the prediction results of multiple machine learning models are obtained; according to the voting weights, the prediction results of multiple machine learning models are integrated using a weighted voting mechanism, and the network intrusion detection results of real-time network traffic data are output, as follows: Randomly select two pre-trained machine learning models to predict the traffic to be tested, and obtain the prediction results of the two machine learning models; Compare the predictions of two machine learning models; If the prediction results of the two machine learning models are the same, the prediction results of the two machine learning models are merged to output the network intrusion detection results of the real-time network traffic data; If the prediction results of the two machine learning models are different, a third pre-trained machine learning model is selected to predict the traffic to be measured, and a prediction result of the third machine learning model is obtained; wherein the third pre-trained machine learning model is one of the best models of the traffic category to which the traffic to be measured belongs; According to the voting weights, the prediction results of the two machine learning models and the prediction results of the third machine learning model are summarized using a weighted voting mechanism, and the network intrusion detection results of real-time network traffic data are output.

[0012] Furthermore, in the process of dynamic optimization of voting weights through the particle swarm algorithm, the voting weights of each pre-trained machine learning model are used as particles; wherein, in the process of dynamic optimization, at each iteration, the speed of the particle is calculated based on the combination of the individual position and the global position.

[0013] The present invention also provides a network intrusion detection system based on ensemble learning, comprising: Real-time traffic acquisition module, used to obtain real-time network traffic data; A real-time traffic preprocessing module is used to preprocess the real-time network traffic data to obtain the traffic to be tested; The prediction output module is used to use different pre-trained machine learning models to predict the traffic to be tested and obtain the prediction results of multiple machine learning models; according to the voting weights, the prediction results of multiple machine learning models are integrated using the weighted voting mechanism to output the network intrusion detection results of real-time network traffic data; among them, the voting weights are dynamically optimized through the particle swarm algorithm.

[0014] The present invention also provides a network intrusion detection device based on ensemble learning, comprising: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the network intrusion detection method based on ensemble learning is executed.

[0015] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the network intrusion detection method based on ensemble learning is implemented.

[0016] The present invention also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the network intrusion detection method based on ensemble learning is implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The network intrusion detection method based on ensemble learning provided by the present invention uses different pre-trained machine learning models to separately predict the traffic to be tested, and uses a weighted voting mechanism to integrate and summarize the prediction results of multiple machine learning models according to voting weights, so as to fully utilize the advantages of different machine learning models and ensure that the final network intrusion detection results can reflect the comprehensive knowledge of multiple machine learning models, thereby improving the accuracy and efficiency of network intrusion detection and ensuring the security of the network; wherein, the voting weights are dynamically optimized using a particle swarm algorithm, so that the voting weights of each machine learning model are dynamically optimized according to the past performance of each machine learning model under a specific traffic type, so as to effectively respond to the ever-changing traffic patterns and abnormal situations, meet the needs of more flexible detection of different types of attacks, and effectively reduce false alarms.

[0018] The network intrusion detection system based on ensemble learning, the network intrusion detection device based on ensemble learning, the computer-readable storage medium and the computer program product provided by the present invention have all the advantages of the above-mentioned network intrusion detection method based on ensemble learning. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flow chart of the network intrusion detection method based on ensemble learning provided in Example 1; Figure 2 It is the F1 score graph of the network intrusion detection method and various machine learning models in Example 1; Figure 3 A structural block diagram of a network intrusion detection system based on ensemble learning provided in Example 2; Figure 4 This is a structural block diagram of a network intrusion detection device based on ensemble learning provided in Example 3. DETAILED DESCRIPTION

[0020] In order to make the technical problems, technical solutions and beneficial effects solved by the present invention more clearly understood, the present invention is further described in detail in the following specific embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0021] Example 1 As attached Figure 1 As shown, this embodiment 1 provides a network intrusion detection method based on ensemble learning, comprising the following steps: Step 1: Use the NSL-KDD dataset to train and verify multiple predetermined machine learning models to obtain multiple pre-trained machine learning models.

[0022] The NSL-KDD dataset (Non-Intrusive Learning Packet Dataset using KDD Cup'99Data) is an improved version of the KDD'99 dataset (Knowledge Discovery and Data Mining Cup 1999 Data Set). The NSL-KDD dataset includes normal communication traffic and four different types of attack traffic; among them, the four different types of attack traffic include Distributed Denial of Service (DDoS) attacks, probing attacks, privilege escalation attacks, and access attacks.

[0023] It is worth noting that each traffic instance in the NSL-KDD dataset represents a network connection, which is a set of descriptive information containing 41 attributes; including continuous duration, number of data packets exchanged, and protocol used; each traffic instance is marked as normal or a specific type of attack; for traffic instances marked as attacks, a description of the attack type is also included.

[0024] Specifically, the steps of training and verifying multiple predetermined machine learning models using the NSL-KDD dataset to obtain multiple pre-trained machine learning models are as follows: Step 11: Perform data preprocessing on the NSL-KDD data set to obtain a preprocessed data set. The data preprocessing process is as follows: Step 111, encode the character-type discrete features in the NSL-KDD dataset into digital features, so as to convert the character-type discrete features in the NSL-KDD dataset into numerical values ​​that can be processed by the machine learning model, and obtain the encoded dataset; wherein, the character-type discrete features in the NSL-KDD dataset include character-type discrete features of three classification attributes: protocol type, service, and flag.

[0025] Step 112: perform data normalization on the encoded data set to obtain a normalized data set; specifically, a minimum-maximum function is used to scale the features in the encoded data set to the interval [0,1] to eliminate the dimensional differences between the features; wherein the minimum-maximum function is specifically:

[0026] in, is the normalized result of the feature; is the feature in the encoded data set; is the maximum value of the feature; is the minimum value of the feature.

[0027] It should be noted that data normalization is performed on the features in the encoded dataset to scale the features in the encoded dataset to a common numerical range, which can avoid the negative impact on the predictive performance of the machine learning model due to the proportional differences of the features; secondly, the minimum-maximum function is used to normalize the data to avoid a single feature dominating the learning process of the machine learning model.

[0028] Step 113: Use SMOTE (Synthetic Minority Over-sampling Technique) to resample the encoded data set to obtain a preprocessed data set. Since attack traffic is often underrepresented compared to normal traffic in the NSL-KDD data set, resampling the encoded data set using SMOTE can generate synthetic samples of minority groups to help machine learning models learn patterns and relationships from underrepresented categories.

[0029] Step 12: Use the Chi-square test (a statistical hypothesis testing method) method to extract key features of the preprocessed data set to obtain training data.

[0030] Since most of the features in the preprocessed data set are useless for identifying anomalies, if all the features in the preprocessed data set are directly used for model training, the risk of overfitting will increase; in this embodiment 1, the chi-square test method is adopted to extract key features of the preprocessed data set by determining the correlation between the classification features and the target variable, and the model is trained based on the extracted key features, which can effectively reduce the risk of overfitting; wherein the key features include flow duration, the total number of data packets and the total number of bytes transmitted.

[0031] Step 13: determine multiple machine learning models, and use a grid search method to optimize the hyperparameters of each machine learning model to obtain multiple predetermined machine learning models. The multiple predetermined machine learning models include a random forest model, a gradient boosting model, and a logistic regression model.

[0032] In this embodiment 1, the random forest model, gradient boosting model and logistic regression model with heterogeneity are used as weak models in ensemble learning, and the results of each weak model are combined by ensemble learning technology to cover a wider range of traffic types, thereby achieving a wider range of predictions for different traffic types; the specific analysis is as follows: The random forest model is a supervised learning algorithm based on decision tree aggregation. Its main advantage is that it can combine the prediction results of many decision trees to reduce the risk of overfitting. During the prediction process, each decision tree will vote for a category, and the category with the most votes is the final prediction result. Therefore, it can be applied to network traffic data with multiple features and has better generalization ability and robust prediction ability. Secondly, the random forest model has reliability and the ability to process heterogeneous data to reduce differences in predictions.

[0033] The gradient boosting model is a boosting model that combines multiple weak models such as decision trees in sequence to improve the overall accuracy by gradually reducing the residual error at each step. Unlike the random forest model that combines decision trees in parallel, the gradient boosting model builds decision trees in sequence and tries to correct errors in previous decision trees. Therefore, it can be used to capture complex relationships in network traffic data and improve prediction accuracy, especially for complex nonlinear problems in intrusion detection. Selecting the gradient boosting model can continuously improve system accuracy and reduce prediction errors, especially for situations where network traffic data changes greatly.

[0034] The logistic regression model is a binary classification model that is used to calculate the probability that an event belongs to a certain category. The logistic regression model maps input features to probabilities based on a logistic function, and then assigns categories based on a defined threshold. By selecting the logistic regression model, we can take advantage of its fast and efficient advantages in binary classification problems, and be able to compete with the complexity of the random forest model and the gradient boosting model.

[0035] Step 14: Divide the training data according to a preset ratio to obtain a training set and a validation set; preferably, the preset ratio is 80:20; use the training set to train each predetermined machine learning model to obtain multiple trained machine learning models; use the validation set to verify each trained machine learning model, and assign voting weights to each trained machine learning model according to preset model performance evaluation indicators to obtain multiple pre-trained machine learning models.

[0036] During the training process, each predetermined machine learning model is trained separately using the training set, so that each predetermined machine learning model learns the pattern and relationship between the input traffic instance and the target label, and obtains multiple trained machine learning models; wherein the target label is the marking information of the traffic instance.

[0037] During the validation process, each trained machine learning model is validated using the validation set to evaluate the prediction performance of the trained machine learning model on a data set that has not participated in the training, and then to detect whether the training of each trained machine learning model has overfitting or underfitting.

[0038] It should be noted that during the verification process, the process of assigning voting weights to each trained machine learning model according to the preset model performance evaluation indicators is as follows: According to the attribute characteristics of network traffic data, the data in the validation set are grouped to obtain several traffic groups; each traffic group represents a traffic category; each trained machine learning model is used to predict the data in several traffic groups respectively, and the prediction results of each trained machine learning model on each traffic group are obtained.

[0039] According to the prediction results of each trained machine learning model on each traffic group, the preset model performance evaluation indicators of each trained machine learning model on each traffic group are calculated; wherein the preset model performance evaluation indicators include accuracy, precision, recall rate or F1 score (balanced F score, an indicator for measuring model accuracy in statistics).

[0040] According to the preset model performance evaluation indicators of each trained machine learning model on each traffic grouping, a voting weight is assigned to each trained machine learning model on each traffic grouping to obtain multiple pre-trained machine learning models; wherein the voting weight is used to represent a weight parameter that is proportional to the accuracy of each pre-trained machine learning model in predicting the network traffic data of the corresponding traffic category.

[0041] Secondly, during the verification process, several pre-trained machine learning models are determined as the best models for each traffic category; the specific process is as follows: according to the preset model performance evaluation indicators of each trained machine learning model on each traffic group, the pre-trained machine learning model with the best preset model performance evaluation indicators on each traffic group is determined to obtain the best model for each traffic category; wherein, the process of determining the pre-trained machine learning model with the best preset model performance evaluation indicators on each traffic group is selected by threshold comparison or based on the ranking results of the preset model performance evaluation indicators of each trained machine learning model on each traffic group; preferably, when selecting based on the ranking results of the preset model performance evaluation indicators of each trained machine learning model on each traffic group, the Top3 strategy is adopted, that is, based on the ranking results of the preset model performance evaluation indicators of each trained machine learning model on each traffic group, the three pre-trained machine learning models with the best preset model performance evaluation indicators on each traffic group are selected as the best models for each traffic category.

[0042] It should be noted that after training and verifying multiple pre-determined machine learning models using the NSL-KDD dataset, each pre-trained machine learning model is assigned a voting weight on each traffic category, and each traffic category corresponds to the best model.

[0043] Step 2: Get real-time network traffic data.

[0044] Wireshark (a tool for capturing real-time network packets) is used to collect real-time network packets. The real-time network packets are saved in CSV (Comma-Separated Values) format. Compared with Pcap (Packet Capture, a standard format for capturing network packets), CSV format can organize detailed information of packets in a table. Then, Data Frame (a two-dimensional tabular data processing tool) in Pandas (an open source third-party Python library) is used to aggregate the real-time network packets to create flow-level features and obtain real-time network traffic data.

[0045] Step 3: Preprocess the real-time network traffic data to obtain the traffic to be tested.

[0046] The real-time network traffic data is subjected to feature encoding, data normalization and resampling to obtain the preprocessing result of the real-time network traffic data as the traffic to be measured. After obtaining the traffic to be measured, the traffic category to which the traffic to be measured belongs is determined according to the attribute characteristics of the network traffic data, that is, the corresponding relationship between the traffic to be measured and the plurality of traffic groups in step 14 is determined.

[0047] It should be noted that the specific operations of feature encoding, data normalization and resampling of real-time network traffic data are basically the same as the data preprocessing operation of the NSL-KDD dataset in the above step 11, and will not be repeated here.

[0048] Step 4: Use different pre-trained machine learning models to predict the traffic to be tested and obtain the prediction results of multiple machine learning models; according to the voting weights, use the weighted voting mechanism to integrate the prediction results of multiple machine learning models, and output the network intrusion detection results of real-time network traffic data; wherein, the voting weights are dynamically optimized by the particle swarm algorithm.

[0049] Specifically, the implementation steps are as follows: Step 41: Randomly select two pre-trained machine learning models to predict the traffic to be tested, and obtain the prediction results of the two machine learning models.

[0050] Step 42: Compare the prediction results of the two machine learning models.

[0051] Step 43: If the prediction results of the two machine learning models are the same, the prediction results of the two machine learning models are merged and the network intrusion detection results of the real-time network traffic data are output.

[0052] Step 44. If the prediction results of the two machine learning models are different, select a third pre-trained machine learning model to predict the traffic to be measured according to the traffic type to which the traffic to be measured belongs, and obtain the prediction result of the third machine learning model; wherein the third pre-trained machine learning model is one of the best models of the traffic category to which the traffic to be measured belongs.

[0053] Step 45: According to the voting weights, the prediction results of the two machine learning models and the prediction results of the third machine learning model are summarized using a weighted voting mechanism to output the network intrusion detection results of the real-time network traffic data.

[0054] It should be noted that the weighted voting mechanism can make full use of the expertise of the machine learning model for each type of network traffic data, thereby improving the overall accuracy; secondly, by assigning higher voting weights to the best model of each traffic category to reduce prediction errors to balance accuracy, it can dynamically adapt to traffic changes, minimize false positives and negatives, and improve flexibility while effectively solving the problem of using homogeneous weights between models.

[0055] In this embodiment 1, the triggering condition for dynamically optimizing the voting weights by using the particle swarm algorithm is that the network intrusion detection result of the real-time network traffic data is attack traffic.

[0056] Specifically, according to the manual review results of the real-time network traffic data, the particle swarm algorithm is used to update and optimize the voting weights of each pre-trained machine learning model; wherein, the generation process of the manual review results of the real-time network traffic data is specifically as follows: the network intrusion detection result of the real-time network traffic data is the attack traffic, and the real-time network traffic data is manually judged for abnormalities, thereby obtaining the manual review results of the real-time network traffic data.

[0057] It should be noted that when the particle swarm algorithm is used to update and optimize the voting weights of each pre-trained machine learning model, the voting weights of each pre-trained machine learning model are taken as particles; in each iteration, the speed of the particle is calculated based on the combination of the individual position and the global position; wherein each particle has a position and a speed, the position of each particle represents a possible voting weight configuration, and the speed of each particle represents the movement of the particle in the solution space.

[0058] It should also be noted that the initial position of each particle is the voting weight assigned by each pre-trained machine learning model at the current time step, and the initial velocity of each particle is zero.

[0059] The particle velocity update formula is as follows:

[0060] in, After optimization The speed of a particle; is the time step; is the inertia weight; To optimize the previous The speed of a particle; , is the learning factor; For the The best individual position of each particle; To optimize the previous The position of a particle; is the best global position of the entire particle swarm; , A random number in [0,1].

[0061] The particle position update formula is as follows:

[0062] in, After optimization The position of a particle.

[0063] In this embodiment 1, the voting weights are dynamically optimized by the particle swarm algorithm to adjust the voting weights according to new threats and traffic changes, thereby gradually improving the detection efficiency; secondly, the particle swarm algorithm can update the voting weights without completely retraining the model, which is extremely efficient and suitable for systems where traffic conditions may change rapidly; compared with other optimization algorithms, such as genetic algorithms or simulated annealing algorithms, the particle swarm algorithm is simple, efficient and adaptable; there is no need for complex operations such as selection, crossover or mutation; the particle swarm algorithm is also highly flexible and suitable for dynamic environments where conditions such as network traffic change rapidly; in addition, the particle swarm algorithm also has the characteristics of high computational time efficiency, which is very suitable for real-time updates that require rapid adjustment of voting weights to cope with new threats and traffic changes, thereby improving the overall effectiveness of intrusion detection.

[0064] Example description: Taking the network intrusion detection process of a certain network node as an example, the above network intrusion detection method based on ensemble learning is supplemented. The details are as follows: First, Wireshark (a tool for capturing real-time network data packets) is used to collect real-time network data packets of the sample network nodes, and the collected real-time network data packets are aggregated and preprocessed to obtain the traffic to be tested.

[0065] Afterwards, two pre-trained machine learning models are randomly selected to predict the traffic to be tested, and the prediction results of the two machine learning models are obtained. Specifically, assuming that the traffic type of the traffic to be tested is UDP (User Datagram Protocol), the two pre-trained machine learning models randomly selected at this time are the random forest model and the logistic regression model; when predicting the traffic to be tested, the random forest model classifies the traffic to be tested as normal traffic, while the logistic regression model classifies the traffic to be tested as a detection attack; therefore, the prediction results of the two pre-trained machine learning models are different.

[0066] In view of the different prediction results of the two pre-trained machine learning models, the best model of the traffic category to which the tested traffic belongs, that is, the second random forest model, is used as the third machine learning model; and the third machine learning model is used to predict the tested traffic; at this time, the second random forest model classifies the tested traffic as a detection attack.

[0067] Assume that the voting weight of the first random forest model is 0.5, the voting weight of the logistic regression model is 0.4, and the voting weight of the second random forest model is 0.8; according to the voting weights, when the prediction results of the two machine learning models and the prediction results of the third machine learning model are summarized using the weighted voting mechanism, the weighted voting result classified as detection attack is 0.4+0.8=1.2, and the weighted voting result classified as normal traffic is 0.5, then the network intrusion detection result of the real-time network traffic data output is detection attack; at the same time, the voting weights are dynamically optimized through the particle swarm algorithm for the next prediction.

[0068] Experimental verification results: The performance of the network intrusion detection method based on ensemble learning, the random forest model, the gradient boosting model and the logistic regression model described in Example 1 were experimentally verified using a pre-constructed data set; the experimental verification results are shown in the attached Figure 2 As shown; from the attached Figure 2 It can be seen that the F1 score of the network intrusion detection method based on ensemble learning described in this embodiment 1 is 86.1%, the F1 score of the random forest model is 77.2%, the F1 score of the gradient boosting model is 68.4%, and the F1 score of the logistic regression model is 84.6%; among them, the F1 score of the network intrusion detection method based on ensemble learning described in this embodiment 1 is the highest, and is higher than other single machine learning models; this shows that integrating the prediction results of multiple machine learning models through a weighted voting mechanism can significantly improve the overall performance; the reason is that: by integrating and utilizing the advantages of each single model, the traffic anomaly classification results have better accuracy and reliability, and can better summarize different types of traffic.

[0069] The network intrusion detection method based on ensemble learning described in this embodiment 1 integrates the results of separate predictions of the traffic to be tested by different pre-trained machine learning models by introducing a weighted voting mechanism, which can more flexibly detect different types of attacks and reduce misjudgments; the voting weights are dynamically optimized through the particle swarm algorithm to achieve real-time adjustment of the voting weights and improve the ability to detect new threats.

[0070] Example 2 As attached Figure 3As shown, this embodiment 2 provides a network intrusion detection system based on ensemble learning, including a real-time traffic acquisition module, a real-time traffic preprocessing module and a prediction output module.

[0071] The real-time traffic acquisition module is used to obtain real-time network traffic data.

[0072] The real-time traffic preprocessing module is used to preprocess the real-time network traffic data to obtain the traffic to be tested.

[0073] The prediction output module is used to use different pre-trained machine learning models to predict the traffic to be tested and obtain the prediction results of multiple machine learning models; according to the voting weights, the prediction results of multiple machine learning models are integrated using the weighted voting mechanism to output the network intrusion detection results of real-time network traffic data; among them, the voting weights are dynamically optimized through the particle swarm algorithm.

[0074] Preferably, the network intrusion detection system based on ensemble learning also includes a model training module.

[0075] The model training module is used to train and verify multiple predetermined machine learning models using the NSL-KDD dataset to obtain multiple pre-trained machine learning models.

[0076] Example 3 As attached Figure 4 As shown, this embodiment 3 provides a network intrusion detection device based on ensemble learning, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, such as a network intrusion detection method program based on ensemble learning; wherein the attached Figure 4 The communication interface in is used to access external devices to obtain data.

[0077] When the processor executes the computer program, the steps of the above-mentioned network intrusion detection method based on ensemble learning are implemented; or, when the processor executes the computer program, the functions of each module in the above-mentioned system are implemented.

[0078] Exemplarily, the computer program may be divided into one or more modules / units, which are stored in the memory and executed by the processor to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the network intrusion detection device based on ensemble learning.

[0079] The network intrusion detection device based on ensemble learning can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The network intrusion detection device based on ensemble learning can include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the attached Figure 3 The schematic diagram is merely an example of a network intrusion detection device based on ensemble learning and does not constitute a limitation of the network intrusion detection device based on ensemble learning. It may include more or fewer components than shown in the diagram, or a combination of certain components, or different components. For example, the network intrusion detection device based on ensemble learning may also include input and output devices, network access devices, buses, etc.

[0080] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the network intrusion detection device based on integrated learning, and uses various interfaces and lines to connect various parts of the entire network intrusion detection device based on integrated learning.

[0081] The memory can be used to store the computer program and / or module, and the processor implements various functions of the network intrusion detection device based on integrated learning by running or executing the computer program and / or module stored in the memory and calling the data stored in the memory.

[0082] The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0083] Example 4 This embodiment 4 also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps of the network intrusion detection method based on ensemble learning are implemented.

[0084] If the module / unit integrated in the network intrusion detection device based on integrated learning is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0085] Based on such understanding, the present embodiment 4 implements all or part of the processes in the above-mentioned network intrusion detection method based on ensemble learning, and can also be completed by instructing related hardware through a computer program, and the computer program can be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the above-mentioned network intrusion detection method based on ensemble learning can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc.

[0086] The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc.

[0087] It should be noted that the content contained in the computer-readable medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable media does not include electrical carrier signals and telecommunication signals.

[0088] Example 5 This embodiment 5 provides a computer product, which includes a computer program, and the computer program is stored in a computer-readable storage medium; the processor of the network intrusion detection device based on ensemble learning reads the computer program from the computer-readable storage medium, and the processor executes the computer program, so that the network intrusion detection device based on ensemble learning can execute the network intrusion detection method based on ensemble learning described in embodiment 1, which will not be repeated here.

[0089] It should be noted that a person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing related hardware through a computer program. The program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods.

[0090] The above embodiment is only one of the implementation methods that can realize the technical solution of the present invention. The scope of protection claimed by the present invention is not limited only to this embodiment, but also includes changes, replacements and other implementation methods that can be easily thought of by any technician familiar with the technical field within the technical scope disclosed by the present invention.

Claims

1. A network intrusion detection method based on ensemble learning, characterized in that: include: Get real-time network traffic data; Perform data preprocessing on real-time network traffic data to obtain the traffic to be tested; Use different pre-trained machine learning models to predict the traffic to be tested and obtain the prediction results of multiple machine learning models; According to the voting weights, the prediction results of multiple machine learning models are integrated using a weighted voting mechanism to output network intrusion detection results of real-time network traffic data; among them, the voting weights are dynamically optimized using a particle swarm algorithm.

2. A network intrusion detection method based on ensemble learning according to claim 1, characterized in that: Perform data preprocessing on real-time network traffic data to obtain the traffic to be tested, as follows: The real-time network traffic data is subjected to feature encoding, data normalization and resampling to obtain the preprocessing result of the real-time network traffic data as the traffic to be measured.

3. A network intrusion detection method based on ensemble learning according to claim 1, characterized in that: The training process of the pre-trained machine learning model is as follows: The NSL-KDD dataset is used to train and verify multiple predetermined machine learning models to obtain multiple pre-trained machine learning models; wherein, during the verification process, several pre-trained machine learning models are determined as the best models for each traffic category; the multiple predetermined machine learning models include a random forest model, a gradient boosting model, and a logistic regression model.

4. A network intrusion detection method based on ensemble learning according to claim 3, characterized in that: The process of training and validating multiple predetermined machine learning models using the NSL-KDD dataset to obtain multiple pre-trained machine learning models is as follows: Perform data preprocessing on the NSL-KDD dataset to obtain a preprocessed dataset; The chi-square test method is used to extract key features from the preprocessed data set to obtain training data; Determine a plurality of machine learning models, and optimize hyperparameters of each machine learning model using a grid search method to obtain a plurality of predetermined machine learning models; Divide the training data into preset proportions to obtain a training set and a validation set; Each predetermined machine learning model is trained using the training set to obtain multiple trained machine learning models; each trained machine learning model is verified using the validation set, and a voting weight is assigned to each trained machine learning model according to preset model performance evaluation indicators to obtain multiple pre-trained machine learning models.

5. A network intrusion detection method based on ensemble learning according to claim 3, characterized in that: Different pre-trained machine learning models are used to predict the traffic to be tested, and the prediction results of multiple machine learning models are obtained. According to the voting weights, the prediction results of multiple machine learning models are integrated using the weighted voting mechanism to output the network intrusion detection results of real-time network traffic data, as follows: Randomly select two pre-trained machine learning models to predict the traffic to be tested, and obtain the prediction results of the two machine learning models; Compare the predictions of two machine learning models; If the prediction results of the two machine learning models are the same, the prediction results of the two machine learning models are merged to output the network intrusion detection results of the real-time network traffic data; If the prediction results of the two machine learning models are different, a third pre-trained machine learning model is selected to predict the traffic to be measured, and a prediction result of the third machine learning model is obtained; wherein the third pre-trained machine learning model is one of the best models of the traffic category to which the traffic to be measured belongs; According to the voting weights, the prediction results of the two machine learning models and the prediction results of the third machine learning model are summarized using a weighted voting mechanism, and the network intrusion detection results of real-time network traffic data are output.

6. A network intrusion detection method based on ensemble learning according to claim 1, characterized in that: In the process of dynamic optimization of voting weights through particle swarm algorithm, the voting weights of each pre-trained machine learning model are used as particles; in the process of dynamic optimization, the speed of the particles is calculated according to the combination of individual position and global position at each iteration.

7. A network intrusion detection system based on ensemble learning, characterized in that: include: Real-time traffic acquisition module, used to obtain real-time network traffic data; A real-time traffic preprocessing module is used to preprocess the real-time network traffic data to obtain the traffic to be tested; A prediction output module is used to predict the traffic to be tested using different pre-trained machine learning models to obtain prediction results of multiple machine learning models; According to the voting weights, the prediction results of multiple machine learning models are integrated using a weighted voting mechanism to output network intrusion detection results of real-time network traffic data; among them, the voting weights are dynamically optimized using a particle swarm algorithm.

8. A network intrusion detection device based on ensemble learning, characterized in that: include: a processor suitable for executing a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the network intrusion detection method based on ensemble learning according to any one of claims 1 to 6 is executed.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the network intrusion detection method based on ensemble learning as described in any one of claims 1 to 6 is implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the network intrusion detection method based on ensemble learning as claimed in any one of claims 1 to 6 is implemented.

Images