Network intrusion detection method and device, communication equipment and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a network intrusion detection method and device, communication equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: extracting network flow data, and preprocessing each feature in the network flow data; performing normalization processing on the preprocessed network flow data to obtain a normalization result, and converting features in the normalization result into binary vectors to obtain one-hot vectors corresponding to the network flow data; performing category balance processing and data principal component analysis on the one-hot vector to obtain a preset number of principal component data; constructing a network intrusion detection model according to the preset number of principal component data; and performing network intrusion detection through the network intrusion detection model. By adopting the method, the detection accuracy of network intrusion is improved, and the false alarm rate is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network intrusion detection method, apparatus, communication equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the development of computer hardware technology, network security threats are becoming increasingly severe. Distributed Denial of Service (DDoS) attacks, as a common means of network attack, simultaneously launch attacks on victims by controlling multiple hosts (called puppet machines), generating huge attack traffic, and its destructive power far exceeds that of traditional DoS attacks.

[0003] Traditional DoS / DDoS attack detection methods mainly rely on analyzing the information of the protected object to determine whether there is an attack in the network. However, these methods often have problems such as low detection accuracy and high false alarm rate when facing complex and changing network environments and increasingly cunning attack methods.

[0004] Therefore, there is an urgent need for a network intrusion detection method, apparatus, communication equipment, computer-readable storage medium and computer program product that can improve the accuracy of network intrusion detection and reduce the false alarm rate. Summary of the invention

[0005] Based on this, it is necessary to provide a network intrusion detection method, apparatus, communication equipment, computer-readable storage medium and computer program product that can improve the detection accuracy of network intrusion and reduce the false alarm rate in response to the above technical problems.

[0006] In a first aspect, the present application provides a network intrusion detection method, comprising:

[0007] Extracting network traffic data, and preprocessing each feature in the network traffic data;

[0008] Normalizing the preprocessed network traffic data to obtain a normalized result, converting features in the normalized result into a binary vector to obtain a one-hot vector corresponding to the network traffic data;

[0009] Performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0010] Construct a network intrusion detection model based on a preset number of principal component data;

[0011] Network intrusion detection is performed through network intrusion detection model.

[0012] In one embodiment, the preprocessing of each feature in the network traffic data includes:

[0013] Obtaining missing data values ​​and negative data values ​​of each feature in the network traffic data;

[0014] Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value;

[0015] The quasi-constant features in the network traffic data are removed, wherein the quasi-constant features are features whose variance is lower than a preset threshold.

[0016] In one embodiment, the preprocessed network traffic data is normalized to obtain a normalized result, and features in the normalized result are converted into a binary vector to obtain a one-hot vector corresponding to the network traffic data, including:

[0017] Analyze the preprocessed network traffic data to obtain the corresponding values ​​of each feature;

[0018] Normalizing the values ​​corresponding to each feature to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1];

[0019] Using a one-hot encoding method, each feature in the normalized result is converted into a binary vector;

[0020] Get the number of feature categories corresponding to each feature;

[0021] According to the number of feature categories corresponding to each feature, determine the length of the binary vector of each feature;

[0022] According to the binary vector of each feature and the corresponding length, a one-hot vector corresponding to the network traffic data is constructed.

[0023] In one embodiment, performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data includes:

[0024] According to the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0025] According to the feature category distribution ratio, the one-hot vector is subjected to category balancing processing by using an undersampling method;

[0026] Perform an orthogonal transformation on the one-hot vector after category balancing to obtain linear combination data, and sort them according to the variance;

[0027] constructing a cumulative variance graph based on the linear combination data;

[0028] According to the cumulative variance diagram, a preset number of principal component data are determined using a principal component analysis method.

[0029] In one embodiment, the network intrusion detection model includes an input layer, a convolution layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0030] In one embodiment, the network intrusion detection is performed by using a network intrusion detection model, including:

[0031] Performing short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and performing data enhancement processing on the two-dimensional spectrum graph;

[0032] The two-dimensional spectrum graph after data enhancement processing is input into the network intrusion detection model to perform network intrusion detection analysis, and the network intrusion detection result is output.

[0033] In a second aspect, the present application also provides a network intrusion detection device, including:

[0034] A data acquisition module, used to extract network traffic data;

[0035] A data processing module, used for preprocessing each feature in the network traffic data;

[0036] The data processing module is further used to normalize the preprocessed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a unique hot vector corresponding to the network traffic data;

[0037] The data processing module is further used to perform category balancing processing and data principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0038] A model building module is used to build a network intrusion detection model based on a preset number of principal component data;

[0039] The intrusion detection module is used to perform network intrusion detection through a network intrusion detection model.

[0040] In a third aspect, the present application further provides a communication device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0041] Extracting network traffic data, and preprocessing each feature in the network traffic data;

[0042] Normalizing the preprocessed network traffic data to obtain a normalized result, converting features in the normalized result into a binary vector to obtain a one-hot vector corresponding to the network traffic data;

[0043] Performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0044] Construct a network intrusion detection model based on a preset number of principal component data;

[0045] Network intrusion detection is performed through network intrusion detection model.

[0046] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0047] Extracting network traffic data, and preprocessing each feature in the network traffic data;

[0048] Normalizing the preprocessed network traffic data to obtain a normalized result, converting features in the normalized result into a binary vector to obtain a one-hot vector corresponding to the network traffic data;

[0049] Performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0050] Construct a network intrusion detection model based on a preset number of principal component data;

[0051] Network intrusion detection is performed through network intrusion detection model.

[0052] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0053] Extracting network traffic data, and preprocessing each feature in the network traffic data;

[0054] Normalizing the preprocessed network traffic data to obtain a normalized result, converting features in the normalized result into a binary vector to obtain a one-hot vector corresponding to the network traffic data;

[0055] Performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0056] Construct a network intrusion detection model based on a preset number of principal component data;

[0057] Network intrusion detection is performed through network intrusion detection model.

[0058] The network intrusion detection method, device, communication device, computer-readable storage medium and computer program product extract network traffic data and perform preprocessing to ensure the quality of data and the accuracy of model input, thereby improving the detection accuracy. The principal component analysis (PCA) is used for dimensionality reduction, which retains the most important information in the data, reduces the complexity of the model, and improves the computational efficiency, which helps to improve the detection accuracy of the model. Through unique hot encoding and data normalization, the categorical variables are converted into a digital format that the model can understand and scaled to a range suitable for the algorithm, which helps the model to better learn and identify patterns in the data. The imbalance problem of categorical data is handled through diversity analysis, and undersampling technology is used to balance the data, improve the classification performance of the model, and reduce false alarms caused by category imbalance. The output of classification probability is realized by dense layers using an improved neural network. This network structure helps to improve the model's ability to recognize complex data patterns, thereby reducing the false alarm rate. The Bayesian fully connected layer introduces probability weight distribution, which enhances the model's expressiveness and uncertainty modeling, and helps to improve the robustness of the model in the presence of noise or changes and reduce false alarms. Applying data enhancement techniques on training data, such as random cropping, rotation, flipping, etc., increases the generalization ability of the model, allowing it to maintain high detection accuracy when facing new and unseen data. In summary, this technical solution improves the accuracy of network intrusion detection and reduces the false alarm rate, while improving the robustness and automation level of the model to adapt to the increasingly severe network security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0060] Figure 1 An application environment diagram of a network intrusion detection method in an embodiment;

[0061] Figure 2 A schematic diagram of a flow chart of a network intrusion detection method in an embodiment;

[0062] Figure 3 is a flowchart of a network intrusion detection method in another embodiment;

[0063] Figure 4 is a flowchart of a network intrusion detection method in another embodiment;

[0064] Figure 5is a structural block diagram of a network intrusion detection device in one embodiment;

[0065] Figure 6 FIG. 4 is a diagram showing the internal structure of a communication device in one embodiment. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0067] The network intrusion detection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the server 102 communicates with the server 104 via a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104, or placed on the cloud or other network servers.

[0068] Server 104 extracts network traffic data from server 102, and preprocesses each feature in the network traffic data; normalizes the preprocessed network traffic data to obtain a normalized result, converts the features in the normalized result into a binary vector, and obtains a one-hot vector corresponding to the network traffic data; performs category balancing and data principal component analysis on the one-hot vector to obtain a preset number of principal component data; constructs a network intrusion detection model based on the preset number of principal component data; and performs network intrusion detection on server 102 through the network intrusion detection model.

[0069] Among them, server 102 / server 104 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0070] In an exemplary embodiment, Figure 2 As shown, a network intrusion detection method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps S202 to S210. Among them:

[0071] Step S202: extract network traffic data and pre-process each feature in the network traffic data.

[0072] Specifically, first you need to capture real-time or historical network traffic data from the network. This data usually includes various aspects of network communication, such as timestamp, source and destination IP addresses, source and destination port numbers, protocol type, packet size, etc. Collecting this data involves network monitoring tools, routers, switches, or specialized network traffic analysis systems.

[0073] Next, preprocess the network traffic data, starting with data cleaning, which includes removing invalid or erroneous data records, such as records with incorrect formats or obviously erroneous data. In the data, there may be missing values ​​(NaN). These missing values ​​need to be properly handled, such as filling them with the maximum value, mean, median of a specific feature, or through interpolation methods. Identify and handle outliers, which may be caused by measurement errors or malicious activities. Methods for handling outliers include replacement, deletion, or adjustment using statistical methods.

[0074] Step S204, normalizing the preprocessed network traffic data to obtain a normalized result, converting the features in the normalized result into a binary vector, and obtaining a one-hot vector corresponding to the network traffic data.

[0075] Specifically, the purpose of normalization is to scale all numerical features to a uniform range, usually [0, 1] or [-1, 1]. Doing so can speed up the convergence of learning algorithms, because many algorithms are sensitive to the scale of features, especially gradient-based optimization methods. Commonly used normalization methods include Min-Max Scaling and Standard Scaling (also known as Z-score normalization).

[0076] One-Hot Encoding is a method for converting categorical variables into a form that machine learning algorithms can better handle. It does this by creating a new binary column for each category, where one column has a value of 1 if an instance belongs to that category and 0 otherwise.

[0077] For categorical features in the preprocessed data (such as protocol type, service name, etc.), each unique category value will be converted into a binary vector. For example, if there is a feature "protocol type" whose possible values ​​are "TCP", "UDP" and "ICMP", then this feature of each data point will be represented as a vector of length 3, such as [1, 0, 0] for "TCP", [0, 1, 0] for "UDP", and [0, 0, 1] for "ICMP".

[0078] One-hot encoding prevents the model from misinterpreting the relationship between categorical features due to misinterpretation of numerical magnitudes. For example, the model may mistakenly believe that "10" is more important than "2" if these are unencoded category labels.

[0079] Step S206, performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data.

[0080] Specifically, class balancing of one-hot vectors and principal component analysis (PCA) of data are two important steps in data preprocessing, which help improve the performance and generalization ability of machine learning models.

[0081] Among them, the class balancing process aims to solve the problem of class imbalance in the data set, that is, the number of samples in some classes is much larger than that in other classes. This imbalance may cause the model to be biased towards the majority class, thereby reducing the ability to recognize the minority class. Among them, it includes oversampling technology and undersampling technology, or a combination of the two to balance the categories. Through class balancing, the model's ability to recognize the minority class can be improved, bias can be reduced, and the fairness and accuracy of the model can be improved.

[0082] Among them, principal component analysis (PCA) of data is a dimensionality reduction technique used to reduce the number of variables in a data set while retaining the most important information. It creates new uncorrelated features (principal components) by linearly combining the original features, which can explain the maximum variance in the data.

[0083] The covariance matrix of the data is calculated to determine the linear relationship between the features. The eigenvalues ​​and corresponding eigenvectors of the covariance matrix are calculated. The eigenvalues ​​represent the variance contribution of each principal component, while the eigenvectors define the direction of the new feature space. The first k principal components are selected according to the size of the eigenvalues, which can explain most of the variance in the data (for example, the cumulative explained variance reaches 95%). The original data is projected onto the selected principal components to obtain new dimensionality-reduced data. Principal component analysis of data can reduce the dimension of the data, reduce the complexity of the model, and improve computational efficiency. Redundant information can be removed, multicollinearity between features can be reduced, and the generalization ability of the model can be improved.

[0084] Step S208: constructing a network intrusion detection model according to a preset number of principal component data.

[0085] Specifically, according to the nature of the problem and the characteristics of the data, choose the appropriate machine learning model. For network intrusion detection, commonly used models include support vector machines, neural networks, etc.

[0086] Use the selected principal components as features, combined with the target variable (e.g., whether an intrusion has occurred), to form a training data set. Use the training data set to train the selected model. During the training process, the model learns how to identify patterns of intrusion behavior from the features. Use techniques such as cross-validation to evaluate the performance of the model to ensure that the model has good generalization ability. Evaluate the model's accuracy, precision, recall, F1 score and other indicators to ensure that the model can effectively detect intrusion behaviors while controlling the false alarm rate. Once the model has been fully trained and verified and shows good performance, it can be deployed in an actual network environment for real-time or periodic network traffic monitoring and intrusion detection.

[0087] Step S210: Perform network intrusion detection through a network intrusion detection model.

[0088] Specifically, the real-time network traffic data after preprocessing and dimension reduction is input into the trained network intrusion detection model. The model analyzes the input data and identifies normal and abnormal behaviors based on the learned patterns. The model outputs the classification results for each data point, indicating whether there is an intrusion. The output results of the model are analyzed to determine whether there is a real security threat. For data points that the model determines to be abnormal, further analysis is performed to confirm whether it is a real intrusion. Once the intrusion is confirmed, take appropriate response measures, such as isolating the affected system, blocking malicious traffic, notifying relevant personnel, etc. Feedback is provided to the model based on the detection results and actual security incidents in order to continuously optimize and update the model. The model is retrained regularly with new data to adapt to new attack patterns and changes in the network environment.

[0089] In the above network intrusion detection method, by preprocessing network traffic data, noise and irrelevant features can be removed, and information useful to the detection model can be retained, thereby improving the accuracy of detection; normalization processing makes all features on the same scale, which helps the model to learn and generalize better; converting features into unique hot vectors can avoid the model from misunderstanding the numerical size of categorical features and ensure that the model correctly understands the features; category balance processing ensures that the model will not be biased due to category imbalance in the data set, and improves the recognition ability of minority classes; principal component analysis (PCA) can reduce the dimension of data, remove redundant features, and retain key information that can explain most of the variance; the data after dimensionality reduction reduces the computational burden during model training and prediction, and improves the operation efficiency of the model; through precise feature engineering and model training, false positives and false negatives can be reduced, and the practicality of the model can be improved; the model can be continuously updated and adjusted according to new data to adapt to changes in network attack patterns; the model can be deployed in the network for real-time monitoring and rapid response to potential security threats; through effective network intrusion detection, data transmitted in the network can be protected from unauthorized access, protecting user privacy and data security.

[0090] In an exemplary embodiment, preprocessing each feature in the network traffic data includes:

[0091] Obtain missing data values ​​and negative data values ​​for each feature in network traffic data;

[0092] Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value;

[0093] Remove quasi-constant features from network traffic data. Quasi-constant features are features whose variance is lower than a preset threshold.

[0094] Specifically, in network traffic data, some features may have missing values ​​due to various reasons (such as incomplete data collection, transmission errors, etc.). These missing values ​​are usually represented as NaN (Not a Number). In some network traffic features, negative values ​​may be caused by measurement errors, data recording errors, or other abnormal situations.

[0095] Among them, the missing data value of each feature is replaced with the corresponding maximum value of the data. Replacing the missing value is to maintain the integrity of the data and avoid data processing problems caused by missing values. Replacing the missing value of each feature with the maximum value of the feature is a common processing method. This method assumes that the missing value is unlikely to exceed the observed maximum value, thereby avoiding the introduction of extreme outliers.

[0096] Replace the negative data value of each feature with the corresponding absolute value of the data. Some machine learning algorithms and models assume that the data is non-negative, so negative values ​​need to be converted to positive values. By taking the absolute value, negative values ​​can be converted to positive values ​​while retaining the relative size relationship of the data.

[0097] Remove quasi-constant features from network traffic data. Quasi-constant features are features that vary little or almost unchanged in the dataset, and whose variance is below a preset threshold. Quasi-constant features usually contribute little to the predictive power of the model because they have little variation between different samples and may increase the computational burden of the model.

[0098] Method: By calculating the variance of each feature and comparing it with a preset threshold, quasi-constant features with variance below the threshold can be identified and removed.

[0099] In this embodiment, through these preprocessing steps, the quality of data can be improved, laying a solid foundation for subsequent data analysis and model training. Preprocessing can not only improve the accuracy and efficiency of the model, but also help reduce false positives and false negatives, thereby improving the effectiveness of the entire network intrusion detection system.

[0100] In an exemplary embodiment, Figure 3 As shown, the preprocessed network traffic data is normalized to obtain a normalized result, and the features in the normalized result are converted into a binary vector to obtain a unique hot vector corresponding to the network traffic data, including:

[0101] Step S302, analyzing the pre-processed network traffic data to obtain the value corresponding to each feature;

[0102] Step S304, normalizing the values ​​corresponding to each feature to obtain a normalized result; wherein each feature in the normalized result is within the range of [0, 1];

[0103] Step S306, using a one-hot encoding method, converting each feature in the normalized result into a binary vector;

[0104] Step S308, obtaining the number of feature categories corresponding to each feature;

[0105] Step S310, determining the length of the binary vector of each feature according to the number of feature categories corresponding to each feature;

[0106] Step S312, constructing a corresponding one-hot vector of the network traffic data according to the binary vector of each feature and the corresponding length.

[0107] Specifically, in the preprocessing stage, the features in the network traffic data (such as timestamp, source and destination IP, source and destination port, etc.) have been cleaned and processed to ensure the consistency and integrity of the data. This step involves extracting the values ​​of each feature from the preprocessed data in preparation for the next step of normalization.

[0108] Normalization is to scale the value of a feature to a specific range, usually the [0, 1] interval, to eliminate the impact of the dimensions between different features and make the features comparable. You can use the minimum-maximum scaling formula for normalization to ensure that the data is converted to the [0, 1] range.

[0109] The one-hot encoding method is used to convert each feature in the normalized result into a binary vector. One-hot encoding is a technique for processing categorical variables, which converts each category of the categorical feature into a binary vector.

[0110] For example, if a feature has 3 categories {A, B, C}, then each category will be converted into a binary vector of length 3, such as A=[1, 0, 0], B=[0, 1, 0], C=[0, 0, 1].

[0111] The purpose of obtaining the number of feature categories corresponding to each feature is to determine the length of the one-hot encoding vector for each feature. If a feature has N different categories, then the length of its one-hot encoding vector is N. After determining the number of categories for each feature, you can know how many bits each feature needs to represent all its possible categories, which is the length of the one-hot encoding vector. Finally, convert the normalized value of each feature into the corresponding one-hot encoding vector, and combine these vectors to form a one-hot vector representation of the complete network traffic data. This one-hot vector can be used as input to a machine learning model because it provides an unbiased way to represent categorical features.

[0112] In this embodiment, through this process, the network traffic data is converted into a format suitable for processing by a machine learning model, so that the model can effectively learn and identify patterns in the network traffic, thereby improving the accuracy and efficiency of network intrusion detection.

[0113] In an exemplary embodiment, Figure 4 As shown, the one-hot vector is subjected to category balancing and principal component analysis to obtain a preset number of principal component data, including:

[0114] Step S402, obtaining the feature category distribution ratio corresponding to each feature according to the one-hot vector;

[0115] Step S404, performing category balancing processing on the one-hot vector using an undersampling method according to the feature category distribution ratio;

[0116] Step S406, performing orthogonal transformation on the one-hot vector after the category balancing process to obtain linear combination data, and sorting them according to the variance;

[0117] Step S408, constructing a cumulative variance graph based on the linear combination data;

[0118] Step S410: Determine a preset number of principal component data using a principal component analysis method according to the cumulative variance diagram.

[0119] Specifically, as can be seen above, the one-hot encoded data allows each category to be represented as a binary vector, which makes it easier to count the number of samples in each category, thereby obtaining the category distribution ratio corresponding to each feature. If the number of samples in some categories is much larger than that in other categories, this may cause the model to favor the majority class. To solve this problem, undersampling can be used, that is, reducing the number of samples in the majority class to balance the category distribution. Use undersampling techniques to balance data, improve model classification performance, and calculate diversity indices to evaluate the balance of category distribution.

[0120] Perform an orthogonal transformation on the unique hot vectors after category balancing to obtain linear combination data, and sort them according to the variance. Among them, principal component analysis (PCA) is an orthogonal transformation technique that converts the original data into a set of new unrelated features, called principal components. These principal components are linear combinations of the original features, and each principal component corresponds to a variance value, which indicates the amount of information retained by the component. The larger the variance, the more important the principal component.

[0121] The cumulative variance plot shows how the cumulative explained variance percentage changes as the number of principal components increases. Through this plot, you can intuitively see the increase in data variance explained for each additional principal component, which helps determine how many principal components are needed to approximate the original data. According to the cumulative variance plot, the principal component analysis method is used to determine the preset number of principal component data. Among them, according to the cumulative variance plot and the preset variance explanation threshold (retaining at least N% of the total variance, for example, 95%), the number of principal components that need to be retained can be determined to ensure that the data after dimensionality reduction retains enough information.

[0122] In this embodiment, through this process, the class imbalance problem can be effectively handled, and the dimension of the data can be reduced by PCA dimensionality reduction technology, while retaining the most important information. This not only improves the generalization ability of the model, but also reduces the computational burden during model training and prediction, and improves the operating efficiency of the model. Finally, a preset number of principal component data is obtained, which can be used to build a network intrusion detection model to improve the accuracy and efficiency of detection.

[0123] In an exemplary embodiment, the network intrusion detection model includes an input layer, a convolutional layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0124] Specifically, the input layer is the entrance of the model, receiving input data, such as preprocessed and dimensionally reduced network traffic data.

[0125] Convolutional layer: It is used to extract local features in the input data, for example, a 2D convolutional layer is used to process spectrogram data. A convolutional 2D layer can be used with 128 neurons, a kernel size of 3×3, and a stride of 1 to extract key features.

[0126] Residual module: It is used to solve the gradient vanishing and gradient exploding problems in deep networks. It allows gradients to flow directly through the network by adding skip connections. The residual module includes a batch normalization layer, an activation function, and a skip connection. Each convolutional layer is followed by a batch normalization layer.

[0127] The first batch normalization layer (Batch Normalization): is used to normalize the output of the layer to reduce internal covariate shift, speed up the training process, and improve the stability of the model.

[0128] Pooling Layer: Used to reduce the spatial dimension of data, extract important features, and reduce the amount of calculation. You can use maxPooling2dLayer to reduce the spatial dimension.

[0129] Second batch normalization layer: further normalizes the data to ensure the consistency of data distribution, which helps model training.

[0130] The first Bayesian fully connected layer and the second Bayesian fully connected layer: introduce probability weight distribution to enhance the model's expressiveness and uncertainty modeling. The two Bayesian fully connected layers have 1568 and 784 output neurons, respectively.

[0131] ReLU activation function layer: Use the ReLU (Rectified Linear Unit) activation function to add nonlinearity to help the model learn complex patterns.

[0132] SoftMax activation function layer: Usually used as the output layer for multi-classification problems, it converts the output into a probability distribution, indicating the probability of each category.

[0133] Gating module: A module that controls the information flow and can adjust the fusion method of different features. The gating signal G of the gating module controls the fusion of two sets of features. G is a value between 0 and 1, indicating the proportion of one feature in the fused feature.

[0134] Classification layer: The last layer of the model, used to output the final classification results, such as normal traffic or attack traffic.

[0135] In this embodiment, the network intrusion detection model is designed to extract the characteristics of network traffic data, learn the patterns of normal and abnormal behaviors, and accurately classify them. This structure helps to improve the model's ability to detect network intrusions, reduce false positives and false negatives, and enhance network security protection.

[0136] In an exemplary embodiment, network intrusion detection is performed using a network intrusion detection model, including:

[0137] Perform short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and perform data enhancement processing on the two-dimensional spectrum graph;

[0138] The two-dimensional spectrum graph after data enhancement is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0139] Specifically, the network traffic data to be detected is subjected to a short-time Fourier transform to obtain a two-dimensional spectrum diagram. Among them, the short-time Fourier transform (STFT) is a method of decomposing a signal into time domain and frequency domain representations, which can analyze the frequency components of the signal at different time points. After applying STFT to the network traffic data, a two-dimensional spectrum diagram can be obtained, in which the horizontal axis represents time, the vertical axis represents frequency, and the color or brightness represents the energy intensity at a specific time and frequency.

[0140] Data augmentation of 2D spectrograms is a technique that simulates natural variations in training datasets by creating data variants, with the goal of improving the generalization of the model. Data augmentation of 2D spectrograms includes random cropping, rotation, flipping, scaling, and other operations that help the model learn intrusion patterns in different situations.

[0141] The two-dimensional spectrogram after data enhancement is input into the network intrusion detection model for network intrusion detection analysis. The two-dimensional spectrogram after data enhancement is provided as input data to the network intrusion detection model. The model extracts key features from the spectrogram through its structure (such as convolutional layer, residual module, etc.) and analyzes these features to identify potential intrusion patterns.

[0142] The network intrusion detection model classifies the input network traffic data based on the learned features and patterns to determine whether it is an intrusion behavior. The model outputs the detection result, which may be a probability score (indicating the possibility of intrusion) or a clear classification label (such as "normal" or "attack").

[0143] In this embodiment, through this process, the network intrusion detection model can analyze real-time or historical network traffic data, identify potential security threats in a timely manner, and provide decision support for network security protection. This deep learning-based method can effectively process complex network traffic data and improve the accuracy and efficiency of detection.

[0144] The most detailed embodiment of this application includes:

[0145] Step 1: Extract network traffic data. Network traffic data includes timestamp, source and destination IP, source and destination port, protocol, packet size, attack occurrence, and preprocess the network traffic data to extract and refine relevant features that are critical to model performance. For data preprocessing, infinite values ​​in the data are replaced with NaN to ensure correct data processing. NaN values ​​are replaced by the maximum value of each feature. Negative values ​​are converted to their absolute values ​​to ensure non-negativity. Remove constant features from network traffic data and eliminate quasi-constant features with the smallest change between instances; among them, features with variances below a preset threshold are considered quasi-constants; the deletion method is specifically to calculate the correlation matrix between all feature pairs in the network traffic data using the Corr method, check the upper triangle of the correlation matrix, exclude the diagonal to prevent repeated calculations, and use the correlation threshold T to determine the high correlation columns. This method is used to remove quasi-constant features, aiming to reduce redundancy and multicollinearity.

[0146] Step 2: Data scaling Normalization is to scale the data to a range suitable for different algorithms. Perform minimum-maximum scaling on the data to convert the data to the [0, 1] range, and use the following formula to get the normalized result:

[0147] ;

[0148] The categorical variables in the normalized results are then converted into a numerical format understandable by the model using the one-hot encoding technique that encodes the labels. This is done by creating a binary vector where each different category is assigned a unique bit value. Each feature is represented as a binary vector consisting of 0s and 1s. A 1 at a particular index in the vector indicates that the feature belongs to a particular category.

[0149] Step 3: Sampling of multi-class data sets will affect the classification effect due to class imbalance. Use undersampling technology to balance the data and improve the classification performance of the model. First, calculate the diversity index to obtain the class distribution of the original data set. Use the formula to calculate the diversity index as follows:

[0150] ; Among them, r i Represents the proportion of instances in each class.

[0151] ; where m is the total number of instances.

[0152] The diversity index is calculated as follows:

[0153] .

[0154] In order to improve computational efficiency and reduce the risk of overfitting, preprocessing was performed based on principal component analysis, which was used to transform the original data set into a set of uncorrelated principal components. Comprehensive analysis using cumulative variance plots was used to retain at least N% of the total variance, and a specific number of principal components was selected based on the cumulative explained variance plots.

[0155] Step 4: It starts with the input layer which adapts the input network traffic data to the required dimensions, aligned with the dimensional size of the input network traffic data. The input layer is the entry point for the 2D spectrogram of the input network traffic data. The input layer is connected to a 2D convolutional layer with 128 neurons, a kernel size of 3×3, and a stride of 1. This convolutional layer effectively extracts key features from the 2D spectrogram. To ensure stability and accelerate convergence, it is followed by the first batch normalization layer to regulate the internal activations. This is followed by the max pooling layer, which reduces the spatial dimensionality while retaining essential information. This is followed by the ReLU layer, which promotes non-linearity in feature extraction. The output of the initial convolutional layer is further processed. A fully connected layer consisting of 400 neurons provides a robust feature representation, which is subsequently passed to the first Bayesian fully connected layer equipped with 1568 output neurons. The first Bayesian fully connected layer introduces a probability weight distribution in the network, adding an extra layer of expressiveness and uncertainty modeling. After the first Bayesian fully connected layer, the ReLU layer further enhances the non-linearity, and the second batch normalization layer promotes stable training. The leakyReLU layer introduces a controllable degree of nonlinearity to capture complex patterns. The model's second Bayesian fully connected layer, with 784 output neurons, further diversifies capabilities. Among them, the ReLU layer, two batch normalization layers, and the final Bayesian fully connected layer with 26 output neurons refine and extract feature representations, culminating in a ReLU activation function layer. Finally, a SoftMax activation function layer is obtained, which provides probability scores for each category, and a classification layer for final classification. In the preprocessing stage, the input data is short-time Fourier transformed to obtain a two-dimensional spectrogram, and data augmentation techniques such as random cropping, rotation, flipping, etc. are applied on the training data to increase the generalization ability of the model. These two-dimensional spectrograms are input into the convolution segment of the network.

[0156] The layers are as follows:

[0157] Input layer: The model starts with the input layer, which is trimmed to fit the response size and integrated with the size of the input network traffic data.

[0158] Convolutional layer: The input network traffic data is processed by an initial convolutional layer with 32 filters, padding of 1, and kernel size of 6. This layer can effectively extract basic features from the input network traffic data.

[0159] Residual Module: Batch Normalization Layer: Each convolutional layer is followed by a batch normalization layer. Activation Function: Each batch normalization layer is followed by an activation function layer. Skip Connection: Send the input network traffic data directly to the output of the convolutional layer. In some cases, the dimensions of the input network traffic data and the output of the residual module may not match. The dimensions are matched by zero padding the features of the input network traffic data.

[0160] Max pooling layer: effectively reduces the spatial dimension.

[0161] Mish activation function layer: introduces nonlinearity into feature extraction.

[0162] Bayesian fully connected layer: The output is sent to two Bayesian fully connected layers in sequence. The output capacities of the two Bayesian fully connected layers are 1568 and 784 respectively. The two Bayesian fully connected layers introduce the probability weight distribution into the network, which enhances the expression ability and uncertainty modeling. The model parameters Sigma1 and Sigma2 are tuned to 2 and 1 respectively.

[0163] The output of the first Bayesian fully connected layer passes through the Mish activation function layer to capture complex patterns. The batch normalization layer ensures stable training. The second Bayesian fully connected layer further refines and enriches the feature representation. The Mish activation layer introduces controlled nonlinearity.

[0164] Parallel branch: The input data goes through an alternative branch that mirrors the norm of the convolutional layers, batch normalization layers, max pooling layers, and Mish activation layers of the initial branch. Like the initial branch, this branch also performs batch normalization.

[0165] Gating module: For two sets of features F1 and F, the gating signal G controls the fusion of F1 and F2. The fused feature Fout is expressed as: Fout=G*F1+(1-G)F2, where G is a value between 0 and 1, indicating the proportion of F1 in the fused feature, and 1-G indicates the proportion of F2. The gating signal G can be obtained through a sigmoid function: G=σ(W g [F1; F2] + b g ), W g is the weight matrix, b g is the bias term.

[0166] Connection and output: The outputs from the two branches are connected to create a fusion of functions. The fusion output is passed through a Softmax activation function layer, and the loss function with L2 regularization can be expressed as: L2(θ)=L(θ)+λ / 2∑ i θ i 2, where L(θ) is the original loss function and λ is the regularization coefficient, which controls the influence of the regularization term. Finally, the attack classification result is obtained in the output of the model.

[0167] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0168] Based on the same inventive concept, the embodiment of the present application also provides a network intrusion detection device for implementing the network intrusion detection method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network intrusion detection device embodiments provided below can refer to the limitations on the network intrusion detection method above, and will not be repeated here.

[0169] In an exemplary embodiment, Figure 5 As shown, a network intrusion detection device is provided, comprising: a data acquisition module 502, for extracting network flow data;

[0170] The data processing module 504 is used to pre-process the characteristics in the network traffic data;

[0171] The data processing module 504 is further used to normalize the pre-processed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a one-hot vector corresponding to the network traffic data;

[0172] The data processing module 504 is also used to perform category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0173] A model building module 506 is used to build a network intrusion detection model according to a preset number of principal component data;

[0174] The intrusion detection module 508 is used to perform network intrusion detection through a network intrusion detection model.

[0175] In an exemplary embodiment, the data processing module 504 is also used to obtain the data missing values ​​and data negative values ​​of each feature in the network traffic data; replace the data missing value of each feature with the corresponding data maximum value, and replace the data negative value of each feature with the corresponding data absolute value; remove the quasi-constant features in the network traffic data, and the quasi-constant features are features whose variance is lower than a preset threshold.

[0176] In an exemplary embodiment, the data processing module 504 is also used to analyze the preprocessed network traffic data to obtain the numerical value corresponding to each feature; normalize the numerical value corresponding to each feature to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1]; use the one-hot encoding method to convert each feature in the normalized result into a binary vector; obtain the number of feature categories corresponding to each feature; determine the length of the binary vector of each feature according to the number of feature categories corresponding to each feature; and construct the one-hot vector corresponding to the network traffic data according to the binary vector of each feature and the corresponding length.

[0177] In an exemplary embodiment, the data processing module 504 is also used to obtain the feature category distribution ratio corresponding to each feature based on the one-hot vector; based on the feature category distribution ratio, use the undersampling method to perform category balancing processing on the one-hot vector; perform an orthogonal transformation on the one-hot vector after category balancing processing to obtain linear combination data, and sort them according to the variance size; construct a cumulative variance graph based on the linear combination data; and determine a preset number of principal component data using the principal component analysis method based on the cumulative variance graph.

[0178] In an exemplary embodiment, the network intrusion detection model includes an input layer, a convolutional layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0179] In an exemplary embodiment, the data processing module 504 is further used to perform short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and perform data enhancement processing on the two-dimensional spectrum graph;

[0180] The intrusion detection module 508 is used to input the two-dimensional spectrum graph after data enhancement processing into the network intrusion detection model to perform network intrusion detection analysis and output the network intrusion detection result.

[0181] Each module in the above network intrusion detection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the communication device in the form of hardware, or can be stored in the memory in the communication device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0182] In an exemplary embodiment, a communication device is provided. The communication device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6 As shown. The communication device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. The processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the communication device is used to provide computing and control capabilities. The memory of the communication device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the communication device is used to store network traffic data. The input / output interface of the communication device is used to exchange information between the processor and an external device. The communication interface of the communication device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method is implemented.

[0183] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a partial structure related to the scheme of the present application, and does not constitute a limitation on the communication device to which the scheme of the present application is applied. The specific communication device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0184] In an exemplary embodiment, a communication device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0185] Extract network traffic data and pre-process the features in the network traffic data;

[0186] Normalize the preprocessed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a unique hot vector corresponding to the network traffic data;

[0187] Perform category balancing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0188] Construct a network intrusion detection model based on a preset number of principal component data;

[0189] Network intrusion detection is performed through network intrusion detection model.

[0190] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0191] Obtain missing data values ​​and negative data values ​​for each feature in network traffic data;

[0192] Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value;

[0193] Remove quasi-constant features from network traffic data. Quasi-constant features are features whose variance is lower than a preset threshold.

[0194] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0195] Analyze the preprocessed network traffic data to obtain the corresponding values ​​of each feature;

[0196] The numerical values ​​corresponding to each feature are normalized to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1];

[0197] Using the one-hot encoding method, each feature in the normalized result is converted into a binary vector;

[0198] Get the number of feature categories corresponding to each feature;

[0199] According to the number of feature categories corresponding to each feature, determine the length of the binary vector of each feature;

[0200] According to the binary vector of each feature and its corresponding length, the corresponding one-hot vector of the network traffic data is constructed.

[0201] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0202] According to the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0203] According to the distribution ratio of feature categories, the one-hot vector is balanced by using undersampling method;

[0204] Perform an orthogonal transformation on the one-hot vector after category balancing to obtain linear combination data, and sort them according to the variance;

[0205] Construct a cumulative variance plot based on the linear combination data;

[0206] According to the cumulative variance diagram, a preset number of principal component data are determined using the principal component analysis method.

[0207] In one embodiment, the network intrusion detection model includes an input layer, a convolution layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0208] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0209] Perform short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and perform data enhancement processing on the two-dimensional spectrum graph;

[0210] The two-dimensional spectrum graph after data enhancement is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0211] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0212] Extract network traffic data and pre-process the features in the network traffic data;

[0213] Normalize the preprocessed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a unique hot vector corresponding to the network traffic data;

[0214] Perform category balancing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0215] Construct a network intrusion detection model based on a preset number of principal component data;

[0216] Network intrusion detection is performed through network intrusion detection model.

[0217] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0218] Obtain missing data values ​​and negative data values ​​for each feature in network traffic data;

[0219] Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value;

[0220] Remove quasi-constant features from network traffic data. Quasi-constant features are features whose variance is lower than a preset threshold.

[0221] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0222] Analyze the preprocessed network traffic data to obtain the corresponding values ​​of each feature;

[0223] The numerical values ​​corresponding to each feature are normalized to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1];

[0224] Using the one-hot encoding method, each feature in the normalized result is converted into a binary vector;

[0225] Get the number of feature categories corresponding to each feature;

[0226] According to the number of feature categories corresponding to each feature, determine the length of the binary vector of each feature;

[0227] According to the binary vector of each feature and its corresponding length, the corresponding one-hot vector of the network traffic data is constructed.

[0228] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0229] According to the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0230] According to the distribution ratio of feature categories, the one-hot vector is balanced by using undersampling method;

[0231] Perform an orthogonal transformation on the one-hot vector after category balancing to obtain linear combination data, and sort them according to the variance;

[0232] Construct a cumulative variance plot based on the linear combination data;

[0233] According to the cumulative variance diagram, a preset number of principal component data are determined using the principal component analysis method.

[0234] In one embodiment, the network intrusion detection model includes an input layer, a convolution layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0235] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0236] Perform short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and perform data enhancement processing on the two-dimensional spectrum graph;

[0237] The two-dimensional spectrum graph after data enhancement is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0238] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0239] Extract network traffic data and pre-process the features in the network traffic data;

[0240] Normalize the preprocessed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a unique hot vector corresponding to the network traffic data;

[0241] Perform category balancing and principal component analysis on the one-hot vector to obtain a preset number of principal component data;

[0242] Construct a network intrusion detection model based on a preset number of principal component data;

[0243] Network intrusion detection is performed through network intrusion detection model.

[0244] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0245] Obtain missing data values ​​and negative data values ​​for each feature in network traffic data;

[0246] Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value;

[0247] Remove quasi-constant features from network traffic data. Quasi-constant features are features whose variance is lower than a preset threshold.

[0248] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0249] Analyze the preprocessed network traffic data to obtain the corresponding values ​​of each feature;

[0250] The numerical values ​​corresponding to each feature are normalized to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1];

[0251] Using the one-hot encoding method, each feature in the normalized result is converted into a binary vector;

[0252] Get the number of feature categories corresponding to each feature;

[0253] According to the number of feature categories corresponding to each feature, determine the length of the binary vector of each feature;

[0254] According to the binary vector of each feature and its corresponding length, the corresponding one-hot vector of the network traffic data is constructed.

[0255] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0256] According to the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0257] According to the distribution ratio of feature categories, the one-hot vector is balanced by using undersampling method;

[0258] Perform an orthogonal transformation on the one-hot vector after category balancing to obtain linear combination data, and sort them according to the variance;

[0259] Construct a cumulative variance plot based on the linear combination data;

[0260] According to the cumulative variance diagram, a preset number of principal component data are determined using the principal component analysis method.

[0261] In one embodiment, the network intrusion detection model includes an input layer, a convolution layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

[0262] In one embodiment, when the computer program is executed by a processor, the following steps are also implemented:

[0263] Perform short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and perform data enhancement processing on the two-dimensional spectrum graph;

[0264] The two-dimensional spectrum graph after data enhancement is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0265] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0266] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0267] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0268] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network intrusion detection method, characterized in that: The method comprises: Extracting network traffic data, and preprocessing each feature in the network traffic data; Normalizing the preprocessed network traffic data to obtain a normalized result, converting features in the normalized result into a binary vector to obtain a one-hot vector corresponding to the network traffic data; Performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data; Construct a network intrusion detection model based on a preset number of principal component data; Network intrusion detection is performed through network intrusion detection model.

2. The method according to claim 1, characterized in that The preprocessing of each feature in the network traffic data includes: Obtaining missing data values ​​and negative data values ​​of each feature in the network traffic data; Replace the missing data value of each feature with the corresponding maximum data value, and replace the negative data value of each feature with the corresponding absolute data value; The quasi-constant features in the network traffic data are removed, wherein the quasi-constant features are features whose variance is lower than a preset threshold.

3. The method according to claim 1, characterized in that The normalizing process is performed on the preprocessed network traffic data to obtain a normalized result, and the features in the normalized result are converted into a binary vector to obtain a one-hot vector corresponding to the network traffic data, including: Analyze the preprocessed network traffic data to obtain the corresponding values ​​of each feature; Normalizing the values ​​corresponding to each feature to obtain a normalized result; wherein each feature in the normalized result is in the range of [0, 1]; Using a one-hot encoding method, each feature in the normalized result is converted into a binary vector; Get the number of feature categories corresponding to each feature; According to the number of feature categories corresponding to each feature, determine the length of the binary vector of each feature; According to the binary vector of each feature and the corresponding length, a one-hot vector corresponding to the network traffic data is constructed.

4. The method according to claim 1, characterized in that: The performing category balancing processing and principal component analysis on the one-hot vector to obtain a preset number of principal component data includes: According to the one-hot vector, obtain the feature category distribution ratio corresponding to each feature; According to the feature category distribution ratio, the one-hot vector is subjected to category balancing processing by using an undersampling method; Perform orthogonal transformation on the one-hot vector after category balancing to obtain linear combination data, and sort them according to the variance; constructing a cumulative variance graph based on the linear combination data; According to the cumulative variance diagram, a preset number of principal component data are determined using a principal component analysis method.

5. The method according to claim 1, characterized in that The network intrusion detection model includes an input layer, a convolution layer, a residual module, a first batch normalization layer, a maximum pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module and a classification layer connected in sequence.

6. The method according to claim 1, characterized in that The network intrusion detection is performed by using a network intrusion detection model, including: Performing short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrum graph, and performing data enhancement processing on the two-dimensional spectrum graph; The two-dimensional spectrum graph after data enhancement processing is input into the network intrusion detection model to perform network intrusion detection analysis, and the network intrusion detection result is output.

7. A network intrusion detection device, characterized in that: The device comprises: A data acquisition module, used to extract network traffic data; A data processing module, used for preprocessing each feature in the network traffic data; The data processing module is further used to normalize the preprocessed network traffic data to obtain a normalized result, convert the features in the normalized result into a binary vector, and obtain a unique hot vector corresponding to the network traffic data; The data processing module is further used to perform category balancing processing and data principal component analysis on the one-hot vector to obtain a preset number of principal component data; A model building module is used to build a network intrusion detection model based on a preset number of principal component data; The intrusion detection module is used to perform network intrusion detection through a network intrusion detection model.

8. A communication device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images