Network intrusion detection method and apparatus, communication device, and storage medium

Abstract

The application relates to the technical field of network security, in particular to a network intrusion detection method and device, communication equipment, a computer readable storage medium and a computer program product. The method comprises the following steps: extracting network traffic data, and preprocessing each feature in the network traffic data; performing normalization processing on the preprocessed network traffic data to obtain a normalization result, converting the features in the normalization result into binary vectors to obtain a corresponding one-hot vector of the network traffic data; performing category balancing processing and data principal component analysis on the one-hot vector to obtain a preset number of principal component data; constructing a network intrusion detection model according to the preset number of principal component data; and performing network intrusion detection through the network intrusion detection model. The method can improve the detection accuracy of network intrusion and reduce the false positive rate.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network intrusion detection method, apparatus, communication equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] With the development of computer hardware technology, network security threats are becoming increasingly severe. Distributed Denial-of-Service (DDoS) attacks, as a common network attack method, involve controlling multiple hosts (called botnets) to launch attacks against a victim simultaneously, generating massive attack traffic, and their destructive power far exceeds that of traditional DoS attacks.

[0003] Traditional DoS / DDoS attack detection methods primarily rely on analyzing information about the protected object to determine whether an attack is occurring on the network. However, these methods often suffer from low detection accuracy and a high false positive rate when facing complex and ever-changing network environments and increasingly sophisticated attack methods.

[0004] Therefore, there is an urgent need for a network intrusion detection method, device, communication equipment, computer-readable storage medium, and computer program product that can improve the accuracy of network intrusion detection and reduce the false alarm rate. Summary of the Invention

[0005] Therefore, it is necessary to provide a network intrusion detection method, apparatus, communication equipment, computer-readable storage medium, and computer program product that can improve the accuracy of network intrusion detection and reduce the false alarm rate, in response to the above-mentioned technical problems.

[0006] Firstly, this application provides a network intrusion detection method, including:

[0007] Extract network traffic data and preprocess the features in the network traffic data;

[0008] The preprocessed network traffic data is normalized to obtain a normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0009] The unique hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0010] A network intrusion detection model is constructed based on a preset number of principal component data.

[0011] Network intrusion detection is performed using a network intrusion detection model.

[0012] In one embodiment, the preprocessing of the features in the network traffic data includes:

[0013] Obtain the missing and negative values ​​of each feature in the network traffic data;

[0014] Replace missing values ​​for each feature with the corresponding maximum values, and replace negative values ​​for each feature with the corresponding absolute values.

[0015] Remove quasi-constant features from the network traffic data. These quasi-constant features are those with variances below a preset threshold.

[0016] In one embodiment, the step of normalizing the preprocessed network traffic data to obtain a normalized result, and converting the features in the normalized result into a binary vector to obtain the corresponding one-hot vector of the network traffic data, includes:

[0017] Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature;

[0018] The values ​​corresponding to each feature are normalized to obtain the normalized result; wherein, in the normalized result, each feature is within the range of [0, 1];

[0019] Using one-hot encoding, each feature in the normalization result is converted into a binary vector;

[0020] Obtain the number of feature categories corresponding to each feature;

[0021] Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature;

[0022] Based on the binary vectors of each feature and their corresponding lengths, the corresponding one-hot vectors of the network traffic data are constructed.

[0023] In one embodiment, the process of performing class balancing and principal component analysis on the one-hot vector to obtain a preset number of principal component data includes:

[0024] Based on the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0025] Based on the feature category distribution ratio, the one-hot vector is subjected to category balancing using an undersampling method;

[0026] The one-hot vectors after class balancing are orthogonally transformed to obtain linear combination data, which are then sorted according to their variance.

[0027] Based on the linear combination data, construct a cumulative variance plot;

[0028] Based on the cumulative variance plot, a predetermined number of principal component data are determined using principal component analysis.

[0029] In one embodiment, the network intrusion detection model includes an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer, connected in sequence.

[0030] In one embodiment, the network intrusion detection using a network intrusion detection model includes:

[0031] A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and the two-dimensional spectrogram is then subjected to data augmentation processing.

[0032] The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0033] Secondly, this application also provides a network intrusion detection device, comprising:

[0034] The data acquisition module is used to extract network traffic data;

[0035] The data processing module is used to preprocess the various features in the network traffic data;

[0036] The data processing module is also used to normalize the preprocessed network traffic data to obtain a normalization result, and convert the features in the normalization result into a binary vector to obtain the corresponding one-hot vector of the network traffic data.

[0037] The data processing module is also used to perform class balancing and principal component analysis on the one-hot vectors to obtain a preset number of principal component data.

[0038] The model building module is used to build a network intrusion detection model based on a preset number of principal component data.

[0039] The intrusion detection module is used to perform network intrusion detection using a network intrusion detection model.

[0040] Thirdly, this application also provides a communication device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0041] Extract network traffic data and preprocess the features in the network traffic data;

[0042] The preprocessed network traffic data is normalized to obtain a normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0043] The unique hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0044] A network intrusion detection model is constructed based on a preset number of principal component data.

[0045] Network intrusion detection is performed using a network intrusion detection model.

[0046] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0047] Extract network traffic data and preprocess the features in the network traffic data;

[0048] The preprocessed network traffic data is normalized to obtain a normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0049] The unique hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0050] A network intrusion detection model is constructed based on a preset number of principal component data.

[0051] Network intrusion detection is performed using a network intrusion detection model.

[0052] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0053] Extract network traffic data and preprocess the features in the network traffic data;

[0054] The preprocessed network traffic data is normalized to obtain a normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0055] The unique hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0056] A network intrusion detection model is constructed based on a preset number of principal component data.

[0057] Network intrusion detection is performed using a network intrusion detection model.

[0058] The aforementioned network intrusion detection methods, devices, communication equipment, computer-readable storage media, and computer program products improve detection accuracy by extracting and preprocessing network traffic data, ensuring data quality and model input accuracy. Principal Component Analysis (PCA) is used for dimensionality reduction, preserving the most important information in the data, reducing model complexity, and improving computational efficiency, thus contributing to improved detection accuracy. One-hot encoding and data normalization convert categorical variables into a model-understandable numerical format and scale them to a suitable range for the algorithm, helping the model better learn and recognize patterns in the data. Diversity analysis addresses the imbalance problem in categorical data, and undersampling techniques are used to balance the data, improving model classification performance and reducing false positives caused by class imbalance. An improved neural network with dense layers outputs classification probabilities; this network structure helps improve the model's ability to recognize complex data patterns, thereby reducing the false positive rate. Bayesian fully connected layers introduce probability weight distribution, enhancing the model's expressive power and uncertainty modeling, helping to improve the model's robustness in the presence of noise or variation, and reducing false positives. Applying data augmentation techniques, such as random pruning, rotation, and flipping, to the training data increases the model's generalization ability, enabling it to maintain high detection accuracy even when faced with new and unseen data. In summary, this technical solution improves the accuracy of network intrusion detection and reduces the false positive rate, while also enhancing the model's robustness and automation level to adapt to increasingly severe cybersecurity threats. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a diagram illustrating the application environment of a network intrusion detection method in one embodiment.

[0061] Figure 2 This is a flowchart illustrating a network intrusion detection method in one embodiment;

[0062] Figure 3 This is a flowchart illustrating a network intrusion detection method in another embodiment;

[0063] Figure 4 This is a flowchart illustrating a network intrusion detection method in another embodiment;

[0064] Figure 5This is a structural block diagram of a network intrusion detection device in one embodiment;

[0065] Figure 6 This is an internal structural diagram of a communication device in one embodiment. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] The network intrusion detection method provided in this application embodiment can be applied to, for example, Figure 1 The application environment shown is illustrated. Server 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104, or it can be located in the cloud or on another network server.

[0068] Server 104 extracts network traffic data from server 102 and preprocesses the features in the network traffic data. It then normalizes the preprocessed network traffic data to obtain a normalized result, converts the features in the normalized result into binary vectors, and obtains the corresponding one-hot vectors of the network traffic data. Finally, it performs class balancing and principal component analysis on the one-hot vectors to obtain a preset number of principal component data. Based on the preset number of principal component data, it constructs a network intrusion detection model. Finally, it uses the network intrusion detection model to perform network intrusion detection on server 102.

[0069] Among them, server 102 / server 104 can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud computing services.

[0070] In one exemplary embodiment, such as Figure 2 As shown, a network intrusion detection method is provided, which is applied to... Figure 1 Taking server 104 as an example, the explanation includes the following steps S202 to S210. Wherein:

[0071] Step S202: Extract network traffic data and preprocess the features in the network traffic data.

[0072] Specifically, the first step is to capture real-time or historical network traffic data from the network. This data typically includes various aspects of network communication, such as timestamps, source and destination IP addresses, source and destination port numbers, protocol types, and packet sizes. Collecting this data involves network monitoring tools, routers, switches, or specialized network traffic analysis systems.

[0073] Next, the network traffic data is preprocessed, starting with data cleaning. This includes removing invalid or erroneous data records, such as those with incorrect formats or obvious errors. Missing values ​​(NaN) may exist in the data. These missing values ​​need to be handled properly, such as by filling them with the maximum, average, median, or interpolation methods based on specific characteristics. Outliers are identified and handled, which may be due to measurement errors or malicious activity. Outlier handling methods include replacement, deletion, or adjustment using statistical methods.

[0074] Step S204: Normalize the preprocessed network traffic data to obtain the normalization result, and convert the features in the normalization result into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0075] Specifically, the purpose of normalization is to scale all numerical features to a uniform range, typically [0, 1] or [-1, 1]. This can speed up the convergence of learning algorithms, as many algorithms are sensitive to the scale of features, especially gradient-based optimization methods. Commonly used normalization methods include min-max scaling and standard scaling (also known as Z-score normalization).

[0076] One-hot encoding is a method for transforming categorical variables into a form that machine learning algorithms can better handle. It achieves this by creating a new binary column for each category, where one column corresponds to one category, and the value of that column is 1 if an instance belongs to that category, and 0 otherwise.

[0077] For categorical features (such as protocol type, service name, etc.) in the preprocessed data, each unique category value is converted into a binary vector. For example, if there is a feature "protocol type" with possible values ​​"TCP", "UDP", and "ICMP", then this feature for each data point will be represented as a vector of length 3, such as [1, 0, 0] for "TCP", [0, 1, 0] for "UDP", and [0, 0, 1] for "ICMP".

[0078] One-hot encoding can prevent the model from misinterpreting the relationship between categorical features due to misunderstandings of numerical magnitude. For example, the model might mistakenly assume that "10" is more important than "2" if these are unencoded class labels.

[0079] Step S206: Perform class balancing and principal component analysis on the one-hot vectors to obtain a preset number of principal component data.

[0080] Specifically, class balancing of one-hot vectors and principal component analysis (PCA) are two important steps in data preprocessing, which help improve the performance and generalization ability of machine learning models.

[0081] Class balancing aims to address the problem of class imbalance in a dataset, where some classes have significantly more samples than others. This imbalance can cause the model to favor the majority class, thus reducing its ability to identify the minority class. Methods include oversampling and undersampling, or a combination of both, to balance the classes. By balancing the classes, the model's ability to identify the minority class can be improved, bias reduced, and the fairness and accuracy of the model enhanced.

[0082] Principal Component Analysis (PCA) is a dimensionality reduction technique used to reduce the number of variables in a dataset while retaining the most important information. It creates new, uncorrelated features (principal components) by linearly combining the original features; these principal components can explain the maximum variance in the data.

[0083] By calculating the covariance matrix of the data, the linear relationships between features are determined. The eigenvalues ​​and corresponding eigenvectors of the covariance matrix are calculated. The eigenvalues ​​represent the variance contribution of each principal component, while the eigenvectors define the direction of the new feature space. The top k principal components are selected based on the magnitude of the eigenvalues; these principal components can explain most of the variance in the data (e.g., cumulatively explaining 95% of the variance). The original data is projected onto the selected principal components to obtain new dimensionality-reduced data. Principal component analysis reduces the dimensionality of the data, decreases model complexity, and improves computational efficiency. It also removes redundant information, reduces multicollinearity among features, and improves the model's generalization ability.

[0084] Step S208: Construct a network intrusion detection model based on a preset number of principal component data.

[0085] Specifically, an appropriate machine learning model should be selected based on the nature of the problem and the characteristics of the data. For network intrusion detection, commonly used models include support vector machines and neural networks.

[0086] A training dataset is formed using selected principal components as features, combined with a target variable (e.g., whether an intrusion occurred). The selected model is then trained using this training dataset. During training, the model learns how to identify patterns of intrusion behavior from the features. Techniques such as cross-validation are used to evaluate the model's performance, ensuring good generalization ability. Metrics such as accuracy, precision, recall, and F1 score are evaluated to ensure the model effectively detects intrusion behavior while controlling the false positive rate. Once the model is sufficiently trained and validated, demonstrating good performance, it can be deployed in a real-world network environment for real-time or periodic network traffic monitoring and intrusion detection.

[0087] Step S210: Perform network intrusion detection using a network intrusion detection model.

[0088] Specifically, preprocessed and dimensionality-reduced real-time network traffic data is input into a trained network intrusion detection model. The model analyzes the input data and identifies normal and abnormal behaviors based on learned patterns. The model outputs a classification result for each data point, indicating whether intrusion behavior exists. The model's output is analyzed to determine if a real security threat exists. For data points identified as abnormal by the model, further analysis is conducted to confirm whether they represent actual intrusion behavior. Once intrusion behavior is confirmed, appropriate response measures are taken, such as isolating affected systems, blocking malicious traffic, and notifying relevant personnel. Feedback is provided to the model based on detection results and actual security incidents to continuously optimize and update the model. The model is periodically retrained with new data to adapt to new attack patterns and changes in the network environment.

[0089] In the aforementioned network intrusion detection methods, preprocessing network traffic data removes noise and irrelevant features while retaining useful information for the detection model, thereby improving detection accuracy. Normalization ensures all features are on the same scale, aiding model learning and generalization. Converting features to one-hot vectors avoids misunderstandings about the numerical magnitude of categorical features, ensuring the model correctly understands the features. Class balancing ensures the model is not biased by class imbalance in the dataset, improving the ability to identify minority classes. Principal component analysis (PCA) reduces data dimensionality, removes redundant features, and retains key information that explains most of the variance. Dimensionality reduction reduces the computational burden during model training and prediction, improving model efficiency. Precise feature engineering and model training reduce false positives and false negatives, enhancing model usability. The model can be continuously updated and adjusted based on new data to adapt to changes in network attack patterns. The model can be deployed in the network for real-time monitoring, quickly responding to potential security threats. Effective network intrusion detection protects data transmitted over the network from unauthorized access, safeguarding user privacy and data security.

[0090] In one exemplary embodiment, preprocessing of various features in network traffic data includes:

[0091] Obtain missing and negative values ​​for various features in network traffic data;

[0092] Replace missing values ​​for each feature with the corresponding maximum values, and replace negative values ​​for each feature with the corresponding absolute values.

[0093] Remove quasi-constant features from network traffic data. Quasi-constant features are those with variances below a preset threshold.

[0094] Specifically, in network traffic data, certain features may have missing values ​​due to various reasons (such as incomplete data collection, transmission errors, etc.). These missing values ​​are usually represented as NaN (Not a Number). In some network traffic features, negative values ​​may be due to measurement errors, data recording errors, or other anomalies.

[0095] In this approach, missing values ​​for each feature are replaced with their corresponding maximum values. Replacing missing values ​​with their maximum values ​​maintains data integrity and avoids data processing problems caused by missing values. This common method assumes that missing values ​​are unlikely to exceed the observed maximum values, thus avoiding the introduction of extreme outliers.

[0096] For each feature, negative values ​​are replaced with their corresponding absolute values. Some machine learning algorithms and models assume the data is non-negative, so negative values ​​need to be converted to positive values. By taking the absolute value, negative values ​​can be converted to positive values ​​while preserving the relative magnitude of the data.

[0097] Quasi-constant features are removed from network traffic data. Quasi-constant features are those that vary little or almost constantly in the dataset, with variance below a preset threshold. Quasi-constant features typically contribute little to the model's predictive ability because they show almost no variation across different samples and may even increase the model's computational burden.

[0098] Method: By calculating the variance of each feature and comparing it with a preset threshold, quasi-constant features with variances below the threshold can be identified and removed.

[0099] In this embodiment, these preprocessing steps improve data quality, laying a solid foundation for subsequent data analysis and model training. Preprocessing not only improves the accuracy and efficiency of the model but also helps reduce false positives and false negatives, thereby enhancing the overall performance of the network intrusion detection system.

[0100] In one exemplary embodiment, such as Figure 3 As shown, the preprocessed network traffic data is normalized to obtain a normalized result. The features in the normalized result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data, including:

[0101] Step S302: Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature;

[0102] Step S304: Normalize the values ​​corresponding to each feature to obtain the normalization result; wherein, in the normalization result, each feature is within the range of [0, 1].

[0103] Step S306: Using one-hot encoding, convert each feature in the normalization result into a binary vector;

[0104] Step S308: Obtain the number of feature categories corresponding to each feature;

[0105] Step S310: Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature;

[0106] Step S312: Based on the binary vectors of each feature and their corresponding lengths, construct the corresponding one-hot vectors for the network traffic data.

[0107] Specifically, in the preprocessing stage, features in network traffic data (such as timestamps, source and destination IPs, source and destination ports, etc.) have been cleaned and processed to ensure data consistency and integrity. This step involves extracting the values ​​of each feature from the preprocessed data to prepare for the next step of normalization processing.

[0108] Normalization scales the numerical values ​​of features to a specific range, typically [0, 1], to eliminate the influence of different units of measurement and make the features comparable. A min-max scaling formula can be used for normalization to ensure the data is converted to the [0, 1] range.

[0109] One-hot encoding is used to convert each feature in the normalization result into a binary vector. One-hot encoding is a technique for processing categorical variables, which converts each category of the categorical feature into a binary vector.

[0110] For example, if a feature has 3 categories {A, B, C}, then each category will be converted into a binary vector of length 3, such as A=[1, 0, 0], B=[0, 1, 0], C=[0, 0, 1].

[0111] Determining the number of feature categories for each feature is crucial for determining the length of its one-hot encoded vector. If a feature has N distinct categories, its one-hot encoded vector length is N. Once the number of categories for each feature is determined, we can ascertain how many bits are needed to represent all possible categories – this is the length of the one-hot encoded vector. Finally, the normalized values ​​of each feature are converted into their corresponding one-hot encoded vectors, and these vectors are combined to form a complete one-hot vector representation of the network traffic data. This one-hot vector can be used as input to a machine learning model because it provides an unbiased way to represent categorical features.

[0112] In this embodiment, through this process, network traffic data is converted into a format suitable for machine learning models to process, enabling the models to effectively learn and identify patterns in network traffic, thereby improving the accuracy and efficiency of network intrusion detection.

[0113] In one exemplary embodiment, such as Figure 4 As shown, class balancing and principal component analysis are performed on the one-hot vectors to obtain a predetermined number of principal component data, including:

[0114] Step S402: Based on the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0115] Step S404: Based on the feature category distribution ratio, perform category balancing on the one-hot vector using the undersampling method;

[0116] Step S406: Perform an orthogonal transformation on the one-hot vectors after class balancing to obtain linear combination data, and sort them according to the variance.

[0117] Step S408: Construct a cumulative variance plot based on the linear combination data;

[0118] Step S410: Based on the cumulative variance plot, use principal component analysis to determine a preset number of principal component data.

[0119] Specifically, as discussed above, one-hot encoding represents each category as a binary vector, which facilitates the counting of samples for each category, thus obtaining the category distribution ratio for each feature. If the number of samples for some categories is significantly greater than that for others, this may cause the model to favor the majority class. To address this issue, undersampling can be used, which reduces the number of samples for the majority class to balance the category distribution. Using undersampling to balance the data improves the model's classification performance, and a diversity index is calculated to evaluate the balance of the category distribution.

[0120] An orthogonal transformation is performed on the one-hot vectors after class balancing to obtain linear combination data, which are then sorted according to their variance. Principal Component Analysis (PCA) is an orthogonal transformation technique that converts the original data into a new set of uncorrelated features called principal components. These principal components are linear combinations of the original features, and each principal component corresponds to a variance value, representing the amount of information retained by that component. The larger the variance, the more important the principal component.

[0121] The cumulative variance plot shows how the percentage of variance explained by the cumulative variance changes as the number of principal components increases. This plot visually shows the increase in variance explained by each additional principal component, helping to determine how many principal components are needed to approximate the original data. Based on the cumulative variance plot, principal component analysis is used to determine the predetermined number of principal components. Specifically, based on the cumulative variance plot and a predetermined variance explanation threshold (retaining at least N% of the total variance, e.g., 95%), the number of principal components to be retained can be determined to ensure that the dimensionality-reduced data retains sufficient information.

[0122] In this embodiment, this process effectively addresses the class imbalance problem and reduces the dimensionality of the data using PCA dimensionality reduction while retaining the most important information. This not only improves the model's generalization ability but also reduces the computational burden during model training and prediction, thereby increasing the model's operational efficiency. Ultimately, a predetermined number of principal component data points are obtained, which can be used to build a network intrusion detection model to improve detection accuracy and efficiency.

[0123] In an exemplary embodiment, the network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

[0124] Specifically, the input layer is the entry point of the model, receiving input data such as preprocessed and dimensionality-reduced network traffic data.

[0125] Convolutional layers: Used to extract local features from input data, such as using 2D convolutional layers to process spectrogram data. A 2D convolutional layer containing 128 neurons, a kernel size of 3×3, and a stride of 1 can be used to extract key features.

[0126] Residual modules address the vanishing and exploding gradient problems in deep networks by adding skip connections to allow gradients to flow directly through the network. A residual module consists of a batch normalization layer, an activation function, and skip connections. Each convolutional layer is followed by a batch normalization layer.

[0127] The first batch normalization layer is used to normalize the output of the layers, thereby reducing internal covariate bias, accelerating the training process, and improving the stability of the model.

[0128] Max pooling layer: Used to reduce the spatial dimensionality of data, extract important features, and reduce computational cost. The maxPooling2dLayer can be used to reduce spatial dimensionality.

[0129] The second batch normalization layer further normalizes the data, ensuring the consistency of data distribution and aiding in model training.

[0130] The first and second Bayesian fully connected layers introduce probability weight distributions to enhance the model's expressive power and uncertainty modeling. These two Bayesian fully connected layers have 1568 and 784 output neurons, respectively.

[0131] ReLU activation function layer: The ReLU (Rectified Linear Unit) activation function is used to add non-linearity, which helps the model learn complex patterns.

[0132] SoftMax activation function layer: Typically used as the output layer for multi-class classification problems, it transforms the output into a probability distribution representing the probability of each class.

[0133] Gating module: This module controls the information flow and can adjust the fusion method of different features. The gating signal G of the gating module controls the fusion of two sets of features. G is a value between 0 and 1, representing the proportion of a feature in the fused features.

[0134] Classification layer: The last layer of the model, used to output the final classification result, such as normal traffic or attack traffic.

[0135] In this embodiment, the network intrusion detection model is designed with layers and modules to extract features from network traffic data, learn patterns of normal and abnormal behavior, and perform accurate classification. This structure helps improve the model's ability to detect network intrusions, reduce false positives and false negatives, and enhance network security protection.

[0136] In one exemplary embodiment, network intrusion detection is performed using a network intrusion detection model, including:

[0137] A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and then data augmentation processing is performed on the two-dimensional spectrogram.

[0138] The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0139] Specifically, a short-time Fourier transform (STFT) is performed on the network traffic data to be detected, resulting in a two-dimensional spectrogram. The short-time Fourier transform (STFT) is a method that decomposes a signal into time and frequency domain representations, allowing analysis of the signal's frequency components at different time points. Applying STFT to the network traffic data yields a two-dimensional spectrogram, where the horizontal axis represents time, the vertical axis represents frequency, and color or brightness represents the energy intensity at a specific time and frequency.

[0140] Data augmentation of two-dimensional spectrograms is a technique that simulates natural variations in the training dataset by creating data variants, with the aim of improving the model's generalization ability. Data augmentation of two-dimensional spectrograms includes operations such as random cropping, rotation, flipping, and scaling, which help the model learn intrusion patterns under different conditions.

[0141] The augmented two-dimensional spectrogram is input into the network intrusion detection model for analysis. The augmented two-dimensional spectrogram serves as input data for the network intrusion detection model. The model extracts key features from the spectrogram using its structure (such as convolutional layers and residual modules) and analyzes these features to identify potential intrusion patterns.

[0142] Network intrusion detection models classify input network traffic data based on learned features and patterns to determine whether it constitutes an intrusion. The model outputs a detection result, which may be a probability score (indicating the likelihood of an intrusion) or a specific classification label (such as "normal" or "attack").

[0143] In this embodiment, through this process, the network intrusion detection model can analyze real-time or historical network traffic data, promptly identify potential security threats, and provide decision support for network security protection. This deep learning-based method can effectively process complex network traffic data and improve the accuracy and efficiency of detection.

[0144] One of the most detailed embodiments of this application includes:

[0145] Step 1: Extract network traffic data. This data includes timestamps, source and destination IPs, source and destination ports, protocols, packet sizes, and attack occurrences. Preprocessing is performed to extract and refine relevant features crucial to model performance. During preprocessing, infinite values ​​are replaced with NaN to ensure proper data handling. NaN values ​​are replaced by the maximum value of their respective features. Negative values ​​are converted to their absolute values ​​to ensure non-negativity. Constant features are removed from the network traffic data, eliminating quasi-constant features that minimize variation between instances. Features with variance below a preset threshold are considered quasi-constant. Specifically, the removal method involves calculating the correlation matrix between all feature pairs in the network traffic data using the Corr method, checking the upper triangle of the correlation matrix (excluding the diagonal) to prevent duplicate calculations, and using a correlation threshold T to determine highly correlated columns. This method aims to reduce redundancy and multicollinearity by removing quasi-constant features.

[0146] Step 2: Data scaling and normalization scales the data to a range suitable for different algorithms. Min-max scaling is applied to transform the data to the [0, 1] range. The normalization result is obtained using the following formula:

[0147] ;

[0148] Then, one-hot encoding of the encoded labels is used to convert the categorical variables in the normalized results into a numerical format that the model can understand. This is achieved by creating a binary vector where each distinct category is assigned a unique bit value. Each feature is represented as a binary vector consisting of 0s and 1s. A 1 at a specific index in the vector indicates that the feature belongs to a specific category.

[0149] Step 3: Multi-class Data Sampling. Class imbalance can negatively impact classification performance. Undersampling is used to balance the data and improve model classification performance. First, calculate the diversity index to obtain the class distribution of the original dataset. The diversity index is calculated using the following formula:

[0150] ; where r i This indicates the proportion of instances in each class.

[0151] Where m is the total number of instances.

[0152] The diversity index is calculated as follows:

[0153] .

[0154] To improve computational efficiency and reduce the risk of overfitting, preprocessing is performed based on principal component analysis (PCA). PCA transforms the original dataset into a set of uncorrelated principal components. A comprehensive analysis using cumulative variance plots is then employed to retain at least N% of the total variance, and a specific number of principal components are selected based on the cumulative explained variance plot.

[0155] Step 4: Starting with the input layer, which adapts to the required dimensionality of the input network traffic data, aligning with the dimensionality of the input network traffic data. The input layer is the entry point for the two-dimensional spectrogram of the input network traffic data. The input layer is connected to a 2D convolutional layer containing 128 neurons with a kernel size of 3×3 and a stride of 1. This convolutional layer effectively extracts key features from the two-dimensional spectrogram. To ensure stability and accelerate convergence, a first batch normalization layer is followed, modulating the internal activation. Next is a max-pooling layer, which reduces the spatial dimensionality while preserving basic information. Following this is a ReLU layer, facilitating non-linearity in feature extraction. The output of the initial convolutional layer is further processed. A fully connected layer of 400 neurons provides a robust feature representation, which is then passed to a first Bayesian fully connected layer equipped with 1568 output neurons. The first Bayesian fully connected layer introduces a probability weight distribution into the network, adding an extra layer for expressiveness and uncertainty modeling. After the first Bayesian fully connected layer, a ReLU layer further enhances the non-linearity, and a second batch normalization layer facilitates stable training. The leakyReLU layer introduces a controllable degree of nonlinearity to capture complex patterns. The model's second Bayesian fully connected layer, with 784 output neurons, further diversifies the model. The ReLU layer, two batch normalization layers, and a final Bayesian fully connected layer with 26 output neurons refine and extract feature representations, ultimately forming a ReLU activation function layer. Finally, a SoftMax activation function layer provides probability scores for each class, along with a classification layer for final classification. In the preprocessing stage, a short-time Fourier transform is performed on the input data to obtain two-dimensional spectrograms. Data augmentation techniques, such as random pruning, rotation, and flipping, are applied to the training data to enhance the model's generalization ability. These two-dimensional spectrograms are then input into the network's convolutional segments.

[0156] The layers are as follows:

[0157] Input layer: The model starts with the input layer, which is cropped to fit the data of the response size, and integrated with the size of the input network traffic data.

[0158] Convolutional layer: The input network traffic data is processed by an initial convolutional layer with 32 filters, padding of 1, and a kernel size of 6. This layer can effectively extract basic features from the input network traffic data.

[0159] Residual Module: Batch Normalization Layer: Each convolutional layer is followed by a batch normalization layer. Activation Function: Each batch normalization layer is followed by an activation function layer. Skip Connection: The input network traffic data is sent directly to the output of the convolutional layer. In some cases, the dimensions of the input network traffic data and the output of the residual module may not match. Zero-padding is performed on the features of the input network traffic data to match their dimensions.

[0160] Max pooling layer: effectively reduces spatial dimensionality.

[0161] Mish activation function layer: Introduces non-linearity into feature extraction.

[0162] Bayesian Fully Connected Layers: The outputs are sequentially fed into two Bayesian fully connected layers, with output capacities of 1568 and 784, respectively. These two layers introduce probability weight distributions into the network, enhancing expressive power and uncertainty modeling. Model parameters Sigma1 and Sigma2 are tuned to 2 and 1, respectively.

[0163] The output of the first Bayesian fully connected layer is passed through a Mish activation function layer to capture complex patterns. A batch normalization layer ensures stable training. The second Bayesian fully connected layer further refines and enriches the feature representation. The Mish activation layer introduces controlled nonlinearity.

[0164] Parallel Branch: The input data undergoes an alternative branch, mirroring the initial branch's convolutional layers, batch normalization layers, max pooling layers, and Mish activation layers. Like the initial branch, this branch also undergoes batch normalization.

[0165] Gating Module: For two sets of features F1 and F2, the gating signal G controls the fusion of F1 and F2. The fused feature Fout is expressed as: Fout = G * F1 + (1 - G)F2, where G is a value between 0 and 1, representing the proportion of F1 in the fused feature, and 1 - G represents the proportion of F2. The gating signal G can be obtained through a sigmoid function: G = σ(W g [F1;F2]+b g ), W g It is the weight matrix, b g It is a bias term.

[0166] Connection and Output: The outputs from the two branches are concatenated to create a fused function. The fused output is processed through a Softmax activation function layer, and the loss function with L2 regularization can be expressed as: L2(θ) = L(θ) + λ / 2∑ i θ i 2Where L(θ) is the original loss function, and λ is the regularization coefficient, controlling the influence of the regularization term. The attack classification result is ultimately obtained in the model's output.

[0167] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0168] Based on the same inventive concept, this application also provides a network intrusion detection device for implementing the network intrusion detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more network intrusion detection device embodiments provided below can be found in the limitations of the network intrusion detection method described above, and will not be repeated here.

[0169] In one exemplary embodiment, such as Figure 5 As shown, a network intrusion detection device is provided, including: a data acquisition module 502, used to extract network traffic data;

[0170] Data processing module 504 is used to preprocess various features in network traffic data;

[0171] The data processing module 504 is also used to normalize the preprocessed network traffic data to obtain the normalization result, and convert the features in the normalization result into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0172] The data processing module 504 is also used to perform class balancing and principal component analysis on the one-hot vectors to obtain a preset number of principal component data.

[0173] The model building module 506 is used to build a network intrusion detection model based on a preset number of principal component data.

[0174] The intrusion detection module 508 is used to perform network intrusion detection using a network intrusion detection model.

[0175] In an exemplary embodiment, the data processing module 504 is further configured to obtain the missing data values ​​and negative data values ​​of each feature in the network traffic data; replace the missing data values ​​of each feature with the corresponding maximum data value, and replace the negative data values ​​of each feature with the corresponding absolute data value; and remove quasi-constant features from the network traffic data, wherein the quasi-constant features are features with variances lower than a preset threshold.

[0176] In an exemplary embodiment, the data processing module 504 is further configured to analyze the preprocessed network traffic data to obtain the numerical values ​​corresponding to each feature; normalize the numerical values ​​corresponding to each feature to obtain a normalized result; wherein, each feature in the normalized result is within the range of [0, 1]; convert each feature in the normalized result into a binary vector using a one-hot encoding method; obtain the number of feature categories corresponding to each feature; determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature; and construct the corresponding one-hot vector of the network traffic data based on the binary vector of each feature and its corresponding length.

[0177] In an exemplary embodiment, the data processing module 504 is further configured to: obtain the feature category distribution ratio corresponding to each feature based on the one-hot vector; perform category balancing processing on the one-hot vector using an undersampling method based on the feature category distribution ratio; perform orthogonal transformation on the one-hot vector after category balancing processing to obtain linear combination data, and sort it according to the variance; construct a cumulative variance plot based on the linear combination data; and determine a preset number of principal component data using principal component analysis based on the cumulative variance plot.

[0178] In an exemplary embodiment, the network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

[0179] In an exemplary embodiment, the data processing module 504 is further configured to perform a short-time Fourier transform on the network traffic data to be detected to obtain a two-dimensional spectrogram, and to perform data augmentation processing on the two-dimensional spectrogram.

[0180] The intrusion detection module 508 is used to input the data-enhanced two-dimensional spectrogram into the network intrusion detection model for network intrusion detection analysis and output the network intrusion detection results.

[0181] Each module in the aforementioned network intrusion detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of the communication device in hardware form or independent of it, or stored in the memory of the communication device in software form, so that the processor can call and execute the corresponding operations of each module.

[0182] In one exemplary embodiment, a communication device is provided, which may be a server, and its internal structure diagram may be as follows. Figure 6 As shown, the communication device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores network traffic data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a network intrusion detection method.

[0183] Those skilled in the art will understand that Figure 6 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the communication device to which the present application is applied. Specific communication devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0184] In one exemplary embodiment, a communication device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0185] Extract network traffic data and preprocess the features in the network traffic data;

[0186] The preprocessed network traffic data is normalized to obtain the normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0187] The one-hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0188] A network intrusion detection model is constructed based on a preset number of principal component data.

[0189] Network intrusion detection is performed using a network intrusion detection model.

[0190] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0191] Obtain missing and negative values ​​for various features in network traffic data;

[0192] Replace missing values ​​for each feature with the corresponding maximum values, and replace negative values ​​for each feature with the corresponding absolute values.

[0193] Remove quasi-constant features from network traffic data. Quasi-constant features are those with variances below a preset threshold.

[0194] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0195] Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature;

[0196] The values ​​corresponding to each feature are normalized to obtain the normalized result; in the normalized result, each feature is within the range of [0, 1].

[0197] The one-hot encoding method is used to convert each feature in the normalization result into a binary vector;

[0198] Obtain the number of feature categories corresponding to each feature;

[0199] Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature;

[0200] Based on the binary vectors of each feature and their corresponding lengths, the corresponding one-hot vectors of network traffic data are constructed.

[0201] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0202] Based on the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0203] Based on the distribution ratio of feature categories, the one-hot vectors are balanced using an undersampling method.

[0204] The one-hot vectors after class balancing are orthogonally transformed to obtain linear combination data, which are then sorted according to their variance.

[0205] Construct a cumulative variance plot based on the linear combination data;

[0206] Based on the cumulative variance plot, principal component analysis is used to determine the predetermined number of principal component data.

[0207] In one embodiment, the network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

[0208] In one embodiment, the processor, when executing a computer program, also performs the following steps:

[0209] A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and then data augmentation processing is performed on the two-dimensional spectrogram.

[0210] The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0211] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0212] Extract network traffic data and preprocess the features in the network traffic data;

[0213] The preprocessed network traffic data is normalized to obtain the normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0214] The one-hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0215] A network intrusion detection model is constructed based on a preset number of principal component data.

[0216] Network intrusion detection is performed using a network intrusion detection model.

[0217] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0218] Obtain missing and negative values ​​for various features in network traffic data;

[0219] Replace missing values ​​for each feature with the corresponding maximum values, and replace negative values ​​for each feature with the corresponding absolute values.

[0220] Remove quasi-constant features from network traffic data. Quasi-constant features are those with variances below a preset threshold.

[0221] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0222] Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature;

[0223] The values ​​corresponding to each feature are normalized to obtain the normalized result; in the normalized result, each feature is within the range of [0, 1].

[0224] The one-hot encoding method is used to convert each feature in the normalization result into a binary vector;

[0225] Obtain the number of feature categories corresponding to each feature;

[0226] Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature;

[0227] Based on the binary vectors of each feature and their corresponding lengths, the corresponding one-hot vectors of network traffic data are constructed.

[0228] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0229] Based on the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0230] Based on the distribution ratio of feature categories, the one-hot vectors are balanced using an undersampling method.

[0231] The one-hot vectors after class balancing are orthogonally transformed to obtain linear combination data, which are then sorted according to their variance.

[0232] Construct a cumulative variance plot based on the linear combination data;

[0233] Based on the cumulative variance plot, principal component analysis is used to determine the predetermined number of principal component data.

[0234] In one embodiment, the network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

[0235] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0236] A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and then data augmentation processing is performed on the two-dimensional spectrogram.

[0237] The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0238] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0239] Extract network traffic data and preprocess the features in the network traffic data;

[0240] The preprocessed network traffic data is normalized to obtain the normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data.

[0241] The one-hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data.

[0242] A network intrusion detection model is constructed based on a preset number of principal component data.

[0243] Network intrusion detection is performed using a network intrusion detection model.

[0244] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0245] Obtain missing and negative values ​​for various features in network traffic data;

[0246] Replace the missing values ​​of each feature with the corresponding maximum values, and replace the negative values ​​of each feature with the corresponding absolute values.

[0247] Remove quasi-constant features from network traffic data. Quasi-constant features are those with variances below a preset threshold.

[0248] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0249] Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature;

[0250] The values ​​corresponding to each feature are normalized to obtain the normalized result; in the normalized result, each feature is within the range of [0, 1].

[0251] The one-hot encoding method is used to convert each feature in the normalization result into a binary vector;

[0252] Obtain the number of feature categories corresponding to each feature;

[0253] Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature;

[0254] Based on the binary vectors of each feature and their corresponding lengths, the corresponding one-hot vectors of network traffic data are constructed.

[0255] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0256] Based on the one-hot vector, obtain the feature category distribution ratio corresponding to each feature;

[0257] Based on the distribution ratio of feature categories, the one-hot vectors are balanced using an undersampling method.

[0258] The one-hot vectors after class balancing are orthogonally transformed to obtain linear combination data, which are then sorted according to their variance.

[0259] Construct a cumulative variance plot based on the linear combination data;

[0260] Based on the cumulative variance plot, principal component analysis is used to determine the predetermined number of principal component data.

[0261] In one embodiment, the network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

[0262] In one embodiment, when the computer program is executed by a processor, it also performs the following steps:

[0263] A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and then data augmentation processing is performed on the two-dimensional spectrogram.

[0264] The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

[0265] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0266] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0267] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0268] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A network intrusion detection method, characterized in that, The method includes: Extract network traffic data and preprocess the features in the network traffic data; The preprocessed network traffic data is normalized to obtain a normalization result. The features in the normalization result are converted into binary vectors to obtain the corresponding one-hot vectors of the network traffic data. The one-hot vectors are subjected to class balancing and principal component analysis to obtain a preset number of principal component data. Specifically, based on the one-hot vectors, the feature class distribution ratios corresponding to each feature are obtained; based on the feature class distribution ratios, the one-hot vectors are subjected to class balancing using an undersampling method; the class-balanced one-hot vectors are subjected to orthogonal transformation to obtain linear combination data, which are then sorted according to variance; a cumulative variance plot is constructed based on the linear combination data; and based on the cumulative variance plot, a preset number of principal component data are determined using principal component analysis. A network intrusion detection model is constructed based on a preset number of principal component data. Network intrusion detection is performed using a network intrusion detection model.

2. The method according to claim 1, characterized in that, The preprocessing of each feature in the network traffic data includes: Obtain the missing and negative values ​​of each feature in the network traffic data; Replace missing values ​​for each feature with the corresponding maximum values, and replace negative values ​​for each feature with the corresponding absolute values. Remove quasi-constant features from the network traffic data. These quasi-constant features are those with variances below a preset threshold.

3. The method according to claim 1, characterized in that, The process of normalizing the preprocessed network traffic data to obtain a normalized result, and converting the features in the normalized result into a binary vector to obtain the corresponding one-hot vector of the network traffic data, includes: Analyze the preprocessed network traffic data to obtain the values ​​corresponding to each feature; The values ​​corresponding to each feature are normalized to obtain the normalized result; wherein, in the normalized result, each feature is within the range of [0, 1]; Using one-hot encoding, each feature in the normalization result is converted into a binary vector; Obtain the number of feature categories corresponding to each feature; Determine the length of the binary vector of each feature based on the number of feature categories corresponding to each feature; Based on the binary vectors of each feature and their corresponding lengths, the corresponding one-hot vectors of the network traffic data are constructed.

4. The method according to claim 1, characterized in that, The network intrusion detection model includes, in sequence, an input layer, a convolutional layer, a residual module, a first batch normalization layer, a max pooling layer, a second batch normalization layer, a first Bayesian fully connected layer, a second Bayesian fully connected layer, a ReLU activation function layer, a SoftMax activation function layer, a gating module, and a classification layer.

5. The method according to claim 1, characterized in that, The network intrusion detection using the network intrusion detection model includes: A short-time Fourier transform is performed on the network traffic data to be detected to obtain a two-dimensional spectrogram, and the two-dimensional spectrogram is then subjected to data augmentation processing. The augmented two-dimensional spectrogram is input into the network intrusion detection model for network intrusion detection analysis, and the network intrusion detection results are output.

6. A network intrusion detection device, characterized in that, The device includes: The data acquisition module is used to extract network traffic data; The data processing module is used to preprocess the various features in the network traffic data; The data processing module is also used to normalize the preprocessed network traffic data to obtain a normalization result, and convert the features in the normalization result into a binary vector to obtain the corresponding one-hot vector of the network traffic data. The data processing module is further configured to perform class balancing and principal component analysis on the one-hot vectors to obtain a preset number of principal component data. Specifically, based on the one-hot vectors, the feature class distribution ratios corresponding to each feature are obtained; based on the feature class distribution ratios, the one-hot vectors are subjected to class balancing using an undersampling method; the one-hot vectors after class balancing are subjected to orthogonal transformation to obtain linear combination data, which is then sorted according to variance; a cumulative variance plot is constructed based on the linear combination data; and based on the cumulative variance plot, a preset number of principal component data is determined using principal component analysis. The model building module is used to build a network intrusion detection model based on a preset number of principal component data. The intrusion detection module is used to perform network intrusion detection using a network intrusion detection model.

7. A communication device, comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images