Network intrusion detection method based on improved binary simulated annealing algorithm

Abstract

The invention discloses a network intrusion detection method based on an improved binary simulated annealing algorithm, and the method comprises the steps: S1, obtaining an intrusion detection data set, and carrying out the preprocessing of the intrusion detection data set; s2, converting the simulated annealing algorithm into a binary form through a Sigmoid transfer function, forming an improved binary simulated annealing algorithm according to a Metropolis criterion, setting an initial temperature and adding a multi-neighborhood solution generation mechanism, and screening out key features in a data set; and S3, inputting the screened feature combination into the improved network intrusion detection model, optimizing parameters of the improved network intrusion detection classification model by using a TPE optimization algorithm, and executing final intrusion detection and classification. According to the method, the problems of uneven data set sample distribution and data sample difficulty difference are solved, so that efficient and accurate network attack detection is realized.

Description

Technical Field

[0001] The invention relates to a network intrusion detection method based on an improved binary simulated annealing algorithm. Background Art

[0002] With the rapid development of the Internet, it has been deeply integrated into people's daily lives and has become an indispensable and important part. However, while providing convenience, the Internet has also brought increasingly severe network security threats. How to improve the active defense capabilities and overall security of the network has become the current research focus, especially in the rapid identification and detection of various network attacks. Intrusion detection technology is an important protection tool for network security, which can effectively protect user privacy and data security and provide early warnings by timely detecting ongoing or potential malicious attacks. However, with the continuous growth of network traffic, the complexity and scale of network data have increased exponentially, and traditional intrusion detection methods are difficult to cope with the ever-changing malicious attacks and emerging network threats.

[0003] Therefore, it is particularly urgent to develop an efficient and robust network intrusion detection system (NIDS) to protect sensitive information in the Internet environment from cyber attacks. NIDS monitors network traffic and issues an alarm when any malicious or suspicious activities are detected. Currently, there are two main types of NIDS: anomaly detection-based and signature-based. Anomaly-based NIDS can detect new or unknown attacks by identifying activities that deviate from normal behavior patterns, so it has high flexibility. However, this type of method usually has a high false alarm rate because some anomalies of non-attack behaviors may also trigger alarms. In contrast, signature-based NIDS accurately identifies malicious behaviors by matching known attack patterns, effectively reducing false alarm rates, and is therefore more common in practical applications. However, due to problems such as model overfitting and bias caused by irrelevant or redundant features, and imbalanced class distribution in network traffic, existing signature-based NIDS still face many challenges.

[0004] On the one hand, traditional IDS datasets, such as UNSW-NB15 and NSL-KDD, have a class distribution problem with severely unbalanced network traffic. Highly unbalanced datasets cause NIDS models to perform well in detecting majority classes, but perform poorly in detecting minority class attacks. The reason is that insufficient minority class samples make it difficult for the model to effectively learn its features. Existing studies mostly deal with the problem of class distribution imbalance through data-level methods, such as statistical methods, generative adversarial networks, and federated learning. However, these methods are usually time-consuming. For example, the training of generative models or the generation of synthetic data consumes a lot of time. On the other hand, signature-based IDS needs to rely on datasets with multiple features, some of which may be irrelevant or redundant. High-dimensional data not only increases the size of the dataset and the computational cost, but also easily leads to overfitting of machine learning models during training, resulting in a high false alarm rate in actual network environments. In response to these problems, a large number of scholars have proposed feature selection methods suitable for network intrusion detection, which are mainly divided into embedded methods, filter methods, and wrapper methods. Embedded methods perform feature selection tasks simultaneously during model training, for example, by incorporating penalty terms into the model objective function to achieve a tight combination between feature selection and model performance optimization. However, traditional embedded methods have limited processing capabilities for nonlinear feature combinations and are unable to fully capture complex data patterns. Filter methods can quickly screen features by evaluating the statistical properties of individual features, but fail to consider the interactions between features. In contrast, wrapper methods can obtain the optimal feature set by directly using the learning algorithm performance to evaluate feature subsets, but their computational overhead is high, and the performance of the classifier has a greater impact on the feature selection results.

[0005] To address the above problems, a network intrusion detection method based on an improved binary simulated annealing algorithm is provided. Summary of the invention

[0006] The purpose of the present invention is to overcome the existing defects and provide a network intrusion detection method based on an improved binary simulated annealing algorithm, which solves the problems of uneven distribution of data set samples and difficulty differences of data samples, thereby achieving efficient and accurate network attack detection.

[0007] The technical solution to achieve the above purpose is: The network intrusion detection method based on the improved binary simulated annealing algorithm includes: Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set; Step S2, converting the simulated annealing algorithm into a binary form through the Sigmoid transfer function, setting the initial temperature according to the Metropolis criterion, and adding a multi-neighborhood solution generation mechanism to form an improved binary simulated annealing algorithm to screen out the key features in the data set; In step S3, the selected feature combination is input into the improved network intrusion detection model, and the parameters of the improved network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0008] Preferably, in step S1, the intrusion detection data set includes two benchmark data sets: NSL-KDD and UNSW-NB15, and both data sets contain relevant data of attack categories and normal traffic.

[0009] Preferably, in step S1, the preprocessing method includes: Null value processing: clean and filter data by removing missing values ​​and irrelevant parameters; Label encoding: Label encoding is performed on all categorical features except the last relevant feature before applying normalization techniques. Label encoding converts categorical features into numerical values. Min-max normalization: After label encoding, the min-max normalization technique is applied to the obtained output to scale the numerical range of each feature to the [0, 1] interval. The conversion formula is: ; In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively; Data deduplication: Remove duplicate data from the NSLKDD and UNSW-NB15 datasets.

[0010] Preferably, in step S2, the simulated annealing algorithm simulates the process of gradually decreasing temperature during physical annealing, gradually explores the solution space and tends to the global optimal solution. During the search process, the algorithm accepts solutions with increased energy with a certain probability to prevent falling into the local optimal solution. As the temperature decreases, the acceptance probability gradually decreases. The algorithm steps of simulated annealing are as follows: Initialization: Set initial parameters, including initial temperature , External loop times , inner loop times and termination temperature , and the temperature drop coefficient ; Perturbation and Acceptance Criteria of Solutions: Random Selection of Initial Solutions , and perturb it to obtain a new solution , calculate the energy value or objective function value of the two, and decide whether to accept the new solution acceptance probability through the Metropolis criterion for: ; In the formula, is temperature; Cooling method: A geometric cooling strategy is used. This strategy controls the rate at which the temperature is gradually reduced, so that the algorithm can explore a larger solution space in the early stage and gradually focus on searching for the optimal solution in the later stage. The formula is as follows: ; In the formula, is the cooling coefficient, and its value range is between 0 and 1. For the The temperature during the second external circulation, For the The temperature during the second external circulation; Termination condition: When the temperature drops to the preset termination temperature Or the maximum number of external loops is reached When , the algorithm stops and outputs the current solution, otherwise, it continues to execute the perturbation operation and acceptance criteria.

[0011] Preferably, in step S2, a Sigmoid transfer function is used to convert the simulated annealing algorithm into a binary form, and the corresponding transfer function expression is: ; In the formula, For the iteration Secondary time dimension Middle The value of the position, , represents the position in the solution space; To map it to discrete space, the corresponding update formula is: ; Then, the improvement process of simulated annealing process is: According to the Metropolis criterion, the initial temperature is set to: ; In the formula, is a constant used to adjust the initial temperature. and are randomly selected in the solution space at the beginning of the algorithm. The maximum and minimum values ​​of the objective function corresponding to the feasible solutions, , and The calculation formula is as follows: ; ; ; In the formula, is a random number selected from the solution space at the beginning of the algorithm The average value of the objective function corresponding to the feasible solutions; Improved Metropolis criterion for combinatorial optimization problems of different scales, The value of may be orders of magnitude different from the current T value, resulting in The value is too large or too small, which affects the running time and optimization ability of the algorithm. That is, let: ; in, ; Multi-neighborhood solution generation mechanism, assuming that the current solution is ,in Indicates whether the feature is selected. The process of generating neighborhood solutions is as follows: ; In the formula, Represents the element-wise XOR operation, is a randomly generated feature flip bit vector, discretized by the Sigmoid function, and the number of flipped features is randomly selected and has a value range of , is the number of features in the dataset; Then the improved binary simulated annealing algorithm is completed to screen out the key features in the data set.

[0012] Preferably, in step S3, the LightGBM classifier is improved by the loss function of Focal loss, thereby forming an improved network intrusion detection model; As a Boosting algorithm, LightGBM generates a strong learning model by combining multiple weak learners. During the training process, the algorithm adjusts the weights according to the classification error rate of the samples, so that the misclassified samples get more attention in the next round of training. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is expressed as follows: ; In the formula, is the target value corresponding to the training sample, is the number of elementary learners, It is The weight coefficients of the cardinality learners, is a training sample, are the parameters of the learner classification, It is The output of the base learner; After determining the loss function and training data of the model, the training process of the Boosting algorithm is transformed into an optimization problem of minimizing the loss function. The objective function is as follows: ; In the formula, is the number of samples, is the sample index, is the actual value of the data, It corresponds to The target value of samples, It is The loss function value of samples; In GBDT, this is a boosted tree model obtained based on the gradient descent algorithm. After each addition of a new sub-model, the gradient of the selected loss function will continue to decrease towards the variable with the second highest information content, as shown below: ; In the formula, and They are Second and The loss function value of the iteration, and It corresponds to and The target value of samples, is the true target value of the sample; The Focal Loss function is an improvement based on the standard multi-category cross entropy loss function. By adding a dynamic scaling factor to the standard cross entropy loss function, the model focuses on difficult-to-classify samples during training. The formula of the standard multi-category cross entropy loss function is as follows: ; In the formula, Represents the output of the model The predicted probability of the class, is the actual label; The Focal Loss function is based on the standard multi-category cross entropy loss function and introduces a dynamic scaling factor To the Focal Loss calculation, It is an adjustable parameter. The Focal loss function formula is as follows: ; In the formula, is the modulation coefficient to deal with the problem of difficult and easy classification samples. When a sample is misclassified, tends to 0, so the modulation coefficient tends to 1, which has no effect on the loss function. The loss function is the same as the standard cross entropy function; however, when the samples are paired, the modulation coefficient tends to 0, and the loss function of the easy-to-classify samples is down-weighted, tends to 0, and contributes little to the total loss function; In view of the imbalance of samples of each category in the data set, the cross entropy loss coefficient inversely proportional to the probability of target occurrence is used for correction. Therefore, the balanced cross entropy function is introduced to improve the Focal Loss function. The formula of the balanced cross entropy function is as follows: ; The improved Focal Loss loss function formula is as follows: ; in, is the inverse proportional weight, defined as: ; In the formula, is the total number of samples, is the number of categories, It is The number of class samples; The Focal Loss loss function is combined with the multi-category balanced cross entropy function, and the improved Focal Loss function is used as the loss function of the LightGBM model.

[0013] Preferably, in step S3, the TPE optimization algorithm tunes the parameters of the improved network intrusion detection model, namely: The optimization process can be expressed as follows, where the configuration space Contains all hyperparameters to be optimized. By continuously adjusting the hyperparameters of the model, a set of optimal values ​​can be obtained. : ; In the formula, is the objective function, yes So that the objective function A set of hyperparameters that achieves the minimum value; The TPE optimization algorithm is based on and Modeling is performed instead of Single modeling of in, represents the distribution of solutions, Represents the parameters when the solution is known The distribution of In addition, the optimization criteria are introduced To guide the search configuration space , The calculation of is as follows: ; In the formula, is the defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition; In order to avoid falling into the local optimal solution during the optimization process, it is necessary to ensure that all promising configuration areas can be traversed. is understood as relative to the threshold , the solution corresponding to the new hyperparameter can be improved, that is, The definition is as follows: ; Through conversion , and construct the function and : ; In the formula, the maximum In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability ; Repeat the above steps until the maximum number of iterations is reached, completing the parameter optimization of the improved network intrusion detection model.

[0014] The beneficial effects of the present invention are: The present invention improves the simulated annealing algorithm, including making the initial temperature and the Metropolis criterion adaptive, adding a multi-neighborhood search strategy and combining a Sigmoid propagation function, and introducing Focal Loss into the benchmark classifier of the simulated annealing algorithm, so that it can be more efficiently applied to the feature selection task of NIDS; This paper introduces the Focal Loss of cost-sensitive learning to improve the loss function of the LightGBM classifier, which balances the model's attention to all categories at the algorithm level, strengthens the learning ability of difficult-to-classify samples, and thus improves the prediction performance of the classifier; This paper uses the LightGBM classifier to achieve efficient classification of network attack patterns, and further optimizes the hyperparameters of all classifiers through TPE to significantly improve performance; In summary, the present invention solves the problems of uneven distribution of data set samples and difficulty differences of data samples, thereby achieving efficient and accurate network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flow chart of the network intrusion detection method based on the improved binary simulated annealing algorithm of the present invention; Figure 2 is a schematic diagram of recording the best fitness and the corresponding number of features in each Epoch in a population in an embodiment of the present invention; Figure 3 is a schematic diagram of recording the global best fitness and the corresponding number of features in each Epoch in a population in an embodiment of the present invention; Figure 4 Schematic diagram of the ROC curve of the original method in the embodiment of the present invention on the NSLKDD data set; Figure 5 Schematic diagram of the ROC curve of the method proposed in the embodiment of the present invention on the NSLKDD data set; Figure 6 Schematic diagram of the confusion matrix of the original method in the embodiment of the present invention on the NSLKDD data set; Figure 7 Schematic diagram of the confusion matrix of the method proposed in the embodiment of the present invention on the NSLKDD dataset; Figure 8 Schematic diagram of the ROC curve of the original method in the embodiment of the present invention on the UNSW-NB15 data set; Fig. 9 is a schematic diagram of the ROC curve of the method proposed in the embodiment of the present invention on the UNSW-NB15 data set; Fig.10 is a schematic diagram of the confusion matrix of the original method in an embodiment of the present invention on the UNSW-NB15 data set; Fig.11 Schematic diagram of the confusion matrix of the method proposed in the embodiment of the present invention on the UNSW-NB15 dataset. DETAILED DESCRIPTION

[0016] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. In the description of the present invention, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0017] The present invention will be further described below in conjunction with the accompanying drawings.

[0018] like Figure 1 As shown, the network intrusion detection method based on the improved binary simulated annealing algorithm includes: Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set.

[0019] In the embodiment, the intrusion detection data set includes two benchmark data sets: NSL-KDD and UNSW-NB15, and both data sets contain relevant data of attack categories and normal traffic.

[0020] NSL-KDD dataset: This dataset is an improvement on the KDDCup'99 dataset. It contains 43 features, 42 of which describe network traffic and 1 feature is used to identify attack categories. The attack category contains 23 different subcategories, 22 of which are attack types and the remaining categories represent normal traffic. The 22 attack subcategories can be summarized into 4 major attack categories. The dataset has been pre-partitioned into a training set (KDDTrain+) and a test set (KDDTest+). In order to avoid the difference in data distribution between the training set and the test set caused by the pre-partition, this study merged the training set and the test set data and randomly divided them into new training and test sets in a ratio of 7:3.

[0021] UNSW-NB15 dataset: UNSW-NB15 is a dataset extracted from 100GB of normal and modern attack traffic by researchers at the Australian Centre for Cyber ​​Security (ACCS) using the IXIA tool. The complete UNSW-NB15 dataset contains 2.5 million data records, covering 1 general category and 9 attack categories, namely analysis, backdoor, DoS, vulnerability exploitation, fuzz testing, general, reconnaissance, shellcode and worms. In order to reduce the difficulty of training, the creator of the dataset also provides a 10% dataset, which contains 43 features in total, of which 42 features describe network traffic and 2 features are used to identify attack categories. 'attack_cat' is a multi-class label, and 'label' is a binary class label, containing 257,673 data. Since this study explores a multi-classification problem, 'label' is deleted and randomly divided into new training and test sets in a ratio of 7:3.

[0022] In the embodiment, the pre-processing method includes: Null value processing: clean and filter data by removing missing values ​​and irrelevant parameters; Label encoding: Label encoding is performed on all categorical features except the last relevant feature before applying normalization techniques. Label encoding converts categorical features into numerical values. Min-max normalization: After label encoding, the min-max normalization technique is applied to the obtained output to scale the numerical range of each feature to the [0, 1] interval. The conversion formula is: ; In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively; Data deduplication: Remove duplicate data from the NSLKDD and UNSW-NB15 datasets.

[0023] Step S2, converting the simulated annealing algorithm into binary form through the Sigmoid transfer function, setting the initial temperature according to the Metropolis criterion, and adding a multi-neighborhood solution generation mechanism to form an improved binary simulated annealing algorithm to screen out the key features in the data set.

[0024] In the embodiment, the simulated annealing algorithm simulates the process of gradually decreasing temperature during physical annealing, gradually explores the solution space and tends to the global optimal solution. During the search process, the algorithm accepts solutions with increased energy with a certain probability to prevent falling into the local optimal solution. As the temperature decreases, the acceptance probability gradually decreases. The algorithm steps of simulated annealing are as follows: Initialization: Set initial parameters, including initial temperature , External loop times , inner loop times and termination temperature , and the temperature drop coefficient ,These parameters determine the search range and convergence speed; Perturbation and Acceptance Criteria of Solutions: Random Selection of Initial Solutions , and perturb it to obtain a new solution , calculate the energy value or objective function value of the two, and decide whether to accept the new solution acceptance probability through the Metropolis criterion for: ; In the formula, is temperature; Cooling method: A geometric cooling strategy is used. This strategy controls the rate at which the temperature is gradually reduced, so that the algorithm can explore a larger solution space in the early stage and gradually focus on searching for the optimal solution in the later stage. The formula is as follows: ; In the formula, is the cooling coefficient, and its value range is between 0 and 1. For the The temperature during the second external circulation, For the The temperature during the second external circulation; Termination condition: When the temperature drops to the preset termination temperature Or the maximum number of external loops is reached When , the algorithm stops and outputs the current solution, otherwise, it continues to execute the perturbation operation and acceptance criteria.

[0025] The simulated annealing algorithm is a flexible and effective global optimization algorithm, which is particularly suitable for solving large-scale discrete optimization problems. It simulates the physical phenomena in the heat treatment process and uses the mechanism of probabilistic acceptance of poor solutions to avoid the limitations of traditional optimization methods that are prone to falling into local optimal solutions. However, the performance of the algorithm is greatly affected by the temperature cooling rate and the initial parameter selection, so the simulated annealing algorithm was adjusted and optimized in this study.

[0026] In the embodiment, the Sigmoid transfer function is used to convert the simulated annealing algorithm into a binary form, and the corresponding transfer function expression is: ; In the formula, For the iteration Secondary time dimension Middle The value of the position, , represents the position in the solution space; To map it to discrete space, the corresponding update formula is: ; Then, the improvement process of simulated annealing process is: According to the Metropolis criterion, the initial temperature is set to: ; In the formula, is a constant used to adjust the initial temperature. is 0.9, and are randomly selected in the solution space at the beginning of the algorithm. The maximum and minimum values ​​of the objective function corresponding to the feasible solutions, , and The calculation formula is as follows: ; ; ; In the formula, is a random number selected from the solution space at the beginning of the algorithm The average value of the objective function corresponding to the feasible solutions; Improved Metropolis criterion for combinatorial optimization problems of different scales, The value of may be orders of magnitude different from the current T value, resulting in The value is too large or too small, which affects the running time and optimization ability of the algorithm. That is, let: ; in, ; Multi-neighborhood solution generation mechanism, assuming that the current solution is ,in Indicates whether the feature is selected. The process of generating neighborhood solutions is as follows: ; In the formula, Represents the element-wise XOR operation, is a randomly generated feature flip bit vector, discretized by the Sigmoid function, and the number of flipped features is randomly selected and has a value range of , is the number of features in the dataset; Then the improved binary simulated annealing algorithm is completed to screen out the key features in the data set.

[0027] In step S3, the selected feature combination is input into the improved network intrusion detection model, and the parameters of the improved network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0028] In the embodiment, the best features selected by the IBSA method are constructed as a new feature set, and then LightGBM is used for final prediction. The introduction of the Focal loss function aims to improve the ability of the LightGBM classifier to handle sample imbalance problems and difficult-to-classify samples from an algorithmic level, thereby improving the classification performance of the model. In addition, the Tree-structured Parzen Estimator (TPE) method is used to optimize the structure and hyperparameters of the classifier to achieve the best prediction effect of the model.

[0029] In the embodiment, the LightGBM classifier is improved by the loss function of Focal loss, thereby forming an improved network intrusion detection model; As a Boosting algorithm, LightGBM generates a strong learning model by combining multiple weak learners. During the training process, the algorithm adjusts the weights according to the classification error rate of the samples, so that the misclassified samples get more attention in the next round of training. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is expressed as follows: ; In the formula, is the target value corresponding to the training sample, is the number of elementary learners, It is The weight coefficients of the cardinality learners, is a training sample, are the parameters of the learner classification, It is The output of the base learner; After determining the loss function and training data of the model, the training process of the Boosting algorithm is transformed into an optimization problem of minimizing the loss function. The objective function is as follows: ; In the formula, is the number of samples, is the sample index, is the actual value of the data, It corresponds to The target value of samples, It is The loss function value of samples; In GBDT, this is a boosted tree model obtained based on the gradient descent algorithm. After each addition of a new sub-model, the gradient of the selected loss function will continue to decrease towards the variable with the second highest information content, as shown below: ; In the formula, and They are Second and The loss function value of the iteration, and It corresponds to and The target value of samples, is the true target value of the sample; As a type of GBDT, LightGBM effectively solves the challenges that GBDT encounters when processing massive data. The model has two main functions: (i) Leaf-by-leaf tree growing method: It adopts a leaf-by-leaf growing strategy. Compared with level-by-level growing, this method can capture the structure of the data faster and effectively avoid overfitting by controlling the minimum amount of data in the leaf nodes and the depth of the tree.

[0030] (ii) Histogram-based decision tree algorithm: LightGBM selects features through the histogram algorithm. When looking for the optimal split point, it only needs to traverse according to the discrete values ​​of the histogram. This method significantly reduces the computational and storage costs, making LightGBM more efficient when processing large-scale data sets.

[0031] The loss function is the key to model optimization, which directly affects the efficiency of the training process and the final performance of the model. This study deals with the problem of data imbalance from the algorithm level and introduces a cost-sensitive learning algorithm. Cost-sensitive learning is an effective way to solve the problem of sample imbalance. It mainly changes the misclassification cost of the model, combines the misclassification cost with the loss function, and improves the loss function of the model so that the model tends to favor positive samples with larger misclassification costs. For multi-classification problems, the commonly used loss function is the multi-category cross entropy loss function. The Focal Loss function is based on the standard multi-category cross entropy loss function. By adding a dynamic scaling factor to the standard cross entropy loss function, the model focuses on difficult-to-classify samples during training, thereby improving the model's prediction ability for samples of each category.

[0032] The Focal Loss function is an improvement based on the standard multi-category cross entropy loss function. By adding a dynamic scaling factor to the standard cross entropy loss function, the model focuses on difficult-to-classify samples during training. The formula of the standard multi-category cross entropy loss function is as follows: ; In the formula, Represents the output of the model The predicted probability of the class, is the actual label; The Focal Loss function is based on the standard multi-category cross entropy loss function and introduces a dynamic scaling factor In the Focal Loss calculation, we can train samples that are difficult to classify to reduce the impact of easy-to-classify samples on the model training effect. It is an adjustable parameter. The Focal loss function formula is as follows: ; In the formula, is the modulation coefficient to deal with the problem of difficult and easy classification samples. When a sample is misclassified, tends to 0, so the modulation coefficient tends to 1, which has no effect on the loss function. The loss function is the same as the standard cross entropy function; when the samples are paired, the modulation coefficient tends to 0, the loss function of the easy-to-classify samples is reduced in weight, tends to 0, and contributes little to the total loss function. As increases, the modulation coefficient also increases, increasing the importance of the misclassified samples; In view of the imbalance of samples of each category in the data set, the cross entropy loss coefficient inversely proportional to the probability of target occurrence is used for correction. Therefore, the balanced cross entropy function is introduced to improve the Focal Loss function. The formula of the balanced cross entropy function is as follows: ; The improved Focal Loss loss function formula is as follows: ; in, is the inverse proportional weight, defined as: ; In the formula, is the total number of samples, is the number of categories, It is The number of class samples; The Focal Loss loss function is combined with the multi-category balanced cross entropy function, and the improved Focal Loss function is used as the loss function of the LightGBM model.

[0033] In the embodiment, the TPE optimization algorithm tunes the parameters of the improved network intrusion detection model, namely: The optimization process can be expressed as follows, where the configuration space Contains all hyperparameters to be optimized. By continuously adjusting the hyperparameters of the model, a set of optimal values ​​can be obtained. : ; In the formula, is the objective function, yes So that the objective function A set of hyperparameters that achieves the minimum value; The TPE optimization algorithm is based on and Modeling is performed instead of Single modeling of in, represents the distribution of solutions, Represents the parameters when the solution is known The distribution of In addition, the optimization criteria are introduced To guide the search configuration space , The calculation of is as follows: ; In the formula, is the defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition; In order to avoid falling into the local optimal solution during the optimization process, it is necessary to ensure that all promising configuration areas can be traversed. is understood as relative to the threshold , the solution corresponding to the new hyperparameter can be improved, that is, The definition is as follows: ; Through conversion , and construct the function and : ; In the formula, the maximum In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability ; Repeat the above steps until the maximum number of iterations is reached, completing the parameter optimization of the improved network intrusion detection model.

[0034] In this embodiment, the number of outer loops of the simulated annealing algorithm (hereinafter referred to as IBSA) is is 300, the number of inner loops 1, the cooling coefficient It is 0.95 and the end temperature is not set.

[0035] In order to intuitively demonstrate the process and effect of feature selection of the proposed IBSA algorithm, the present invention records the best fitness and the corresponding number of features in each Epoch in the population, as well as the global best fitness and the corresponding number of features, and draws them into a line graph to visualize the IBSA population iteration process.

[0036] like Figure 2 , 3 As shown in the figure, the improved binary simulated annealing algorithm continuously jumped out of the local optimal solution due to the high temperature in the early stage, and found a route to approach a better solution; in the later stage, the temperature continued to cool down, and the algorithm continued to approach a better feature combination. Finally, after multiple iterations, the local optimal fitness curve basically coincided with the global optimal fitness curve, indicating that the model has successfully converged to a better solution in the later stage of iteration, showing a high search efficiency. In the end, the number of features of the NSLKDD dataset was reduced from 42 to 25, and the number of features of the UNSW-NB15 dataset was compressed from 44 to 25. The feature selection algorithm based on IBSA has only one particle swarm, and the search speed is much higher than the swarm intelligence optimization algorithm. While maintaining a faster search speed, it not only effectively reduces redundant features, but also reduces the complexity of the network intrusion detection model.

[0037] In order to more comprehensively understand the performance improvement of each category in the NSLKDD dataset, the present invention compares the performance of the original method with the proposed method. The main performance indicators of the two methods are shown in Table 1: As shown in Table 1, on the NSLKDD dataset, the proposed method shows better generalization ability than the original method. Specifically, the accuracy, weighted precision, recall and F1 scores are all improved by about 2%. It is worth noting that as the category with the least amount of data, the precision of Dos has decreased from 100% to 97.10%. This phenomenon may be due to the fact that the original method does not pay enough attention to the Dos category, which makes it difficult to correctly identify the samples of the Dos category, resulting in very high precision and low recall. The introduction of the cost-sensitive learning Focal loss function makes the classification model pay attention to categories with a small number of samples and difficult to classify, making the classifier pay more attention to all categories, thereby increasing the probability that samples of other categories are misclassified as Dos. However, overall, the F1 score of the Dos category has increased significantly, reaching 91.78%, indicating that the method proposed in this study has significantly improved the detection performance of the classifier. In order to further analyze the generalization ability of the method proposed in the present invention, the present invention also draws the ROC curve and confusion matrix of the original method and the proposed method on the NSLKDD dataset, as shown in Figure 4-7 shown.

[0038] Figure 4 and Figure 5 The ROC curves of the original method and the proposed method on the NSLKDD dataset are shown respectively, and the AUC values ​​of each category are calculated. The ROC curve reflects the performance of the classifier at different decision thresholds. The closer the AUC value is to 1, the better the overall performance of the classifier. It can be observed from the figure that under the original method, the curves of minority categories such as Fuzzers and Dos fluctuate greatly and are not smooth, indicating that their prediction performance is unstable, and the area they occupy is also significantly smaller than that of the majority category. In contrast, the proposed method significantly improves the prediction performance of all categories, especially the curves of Fuzzers and Dos in the minority category become smoother, and the area they occupy is significantly larger. This result shows that the proposed method exhibits stronger discrimination ability when processing minority category samples. In addition, this method not only improves the detection performance of minority categories, but also improves the detection effect of majority categories. The AUC values ​​of each category have reached above 0.999, further proving the overall superior stability of the method.

[0039] In order to further verify the discrimination ability of the classifier in different categories, Figure 6 and Figure 7 The confusion matrices of the original method and the proposed method on the NSLKDD dataset are shown respectively.

[0040] The present invention performs color normalization on the confusion matrix to ensure that the color intensity of different categories is relatively consistent, so as to fairly present the importance of each category in the visualization. On the NSLKDD dataset, compared with the original method, although the proposed method still has false detection, it can basically accurately identify Normal and various attack types. On the contrary, although the original method has achieved good prediction results in most categories, it has a significant gap in the performance of a few categories represented by Fuzzers and Dos. Therefore, the method proposed in the present invention shows significant superiority on the NSLKDD dataset.

[0041] In order to more comprehensively understand the performance improvement of each category in the UNSW-NB15 dataset, the present invention compares the performance of the original method with the proposed method. The main performance indicators of the two methods are shown in Table 2: As shown in Table 2, on the UNSW-NB15 dataset, the overall generalization ability of the proposed method is significantly improved compared with the original method. Specifically, the accuracy is improved by nearly 2%, and the weighted F1 score and average F1 score are improved by 2.15% and 6.29% respectively. The F1 scores of all categories in the proposed method are better than those of the original method, especially Analysis, Backdoor, Shellcode and Worms, which belong to the minority categories, which are improved by 17.03%, 15.73%, 7.21% and 6.79% respectively. It is particularly noteworthy that the F1 scores of the original method in Analysis and Backdoor are both lower than 25%, which indicates that the original method can hardly detect these categories effectively. In the proposed method, the F1 scores of these categories are improved to 40.46% and 34.61% respectively. The poor performance of the original method is probably due to the fact that these categories belong to the minority categories and are difficult to detect. The original method does not pay enough attention to these categories and misidentifies them as similar attack types, thereby losing the prediction ability of this category. The proposed method introduces focal loss cost-sensitive learning to make the classifier pay more attention to minority categories and difficult-to-detect categories. At the same time, the IBSA feature selection method effectively removes redundant features and improves the accuracy of prediction. In order to further analyze the generalization ability of this research method, this paper also plots the ROC curve and confusion matrix of the original method and the proposed method on the UNSW-NB15 dataset, as shown in the figure. Figure 8-11 shown.

[0042] Figure 8 and Fig. 9The ROC curves of the original method and the proposed method on the UNSW-NB15 dataset are shown respectively, and the AUC values ​​of each category are calculated. It can be seen that under the original method, the AUC values ​​of Analysis and Backdor in the minority category are lower than 0.93, and the curves fluctuate greatly and are not smooth, indicating that their prediction performance is unstable. In contrast, the proposed method significantly improves the prediction performance, making its curve smoother, and the AUC values ​​are significantly improved to 0.966 and 0.968. In addition, this method not only improves the detection performance of the minority category, but also optimizes the detection effect of all categories. The AUC values ​​of each category exceed the performance of the original method. It is particularly noteworthy that the AUC value of the Normal category in the proposed method is very close to 1, which shows that the model can well distinguish normal traffic from intrusion attack traffic, further proving the overall superiority and stability of the method.

[0043] In order to further verify the recognition ability of the classifier on different categories, Fig.10 and Fig.11 The confusion matrix between the original method and the proposed method on the UNSW-NB15 dataset is also shown.

[0044] Fig.10 and Fig.11 The classification results of various attack types based on the confusion matrix are shown. For the UNSW-NB15 dataset, the original method shows serious false positives, including false positives of Analysis, Backdor, and Shellcode belonging to minority categories as normal traffic and other attacks, and false positives between many total categories as Exploits, Fuzzers, and normal traffic. These false positives are not only due to the similarity of traffic features, but also affected by the class imbalance and feature redundancy problems in the input detection model, which aggravates the false positives between these categories.

[0045] Although the proposed method still has false detection after improving the prediction performance of the classifier, it has alleviated these false detection problems to a great extent. For example, Analysis, Backdor and Shellcode belonging to the minority categories are no longer falsely detected as normal traffic, greatly reducing the possibility of these categories of attack traffic not being detected. Therefore, the proposed method shows significant superiority on the UNSW-NB15 dataset and significantly improves the detection capability of multiple types of attacks.

[0046] Tables 3 and 4 show the overall ablation experimental results of the NSLKDD dataset and the UNSW-NB15 dataset respectively, with the LightGBM classifier as the network intrusion detection model. The experiment is divided into four groups, corresponding to no improvement measures, only the introduction of cost-sensitive learning Focal loss, only the use of IBSA for feature screening, and the combination of the two methods. From the ablation experimental results, after the introduction of cost-sensitive learning Focal loss, the performance indicators of the model are significantly improved, especially the Precision and F1 scores. This phenomenon is mainly attributed to the solution of the imbalance problem, which enables the network intrusion detection model to pay more attention to difficult samples and a small number of categories. After applying IBSA feature selection alone, the generalization performance of the model is improved, but the F1 score is still significantly lower than the Accuracy. Obviously, this model is still seriously affected by the class imbalance problem. The ablation experimental results show that the performance of the network intrusion detection method proposed in the present invention has reached the best level, proving the significant effectiveness of the method of the present invention.

[0047] The performance of machine learning models under the original method and the proposed method was evaluated. Tables 5 and 6 show the performance of various mainstream classification models evaluated using different classification indicators on the NSL-KDD and UNSW-NB15 datasets, respectively. The results show that on the NSL-KDD dataset, the proposed method improves the performance of almost all classifiers compared to the original method. In addition, the performance of the LightGBM model is significantly better than all other mainstream models except the XGBoost model in both the original method and the proposed method. Although the prediction performance is slightly lower than that of XGBoost, it is ahead of it in training speed. On the UNSW-NB15 dataset, the proposed method improves the performance of all classifiers compared to the original method, and the performance of the LightGBM model under both methods is better than other mainstream models. In summary, the comparative experimental results demonstrate the superior generalization ability of the LightGBM classifier in the field of network intrusion detection.

[0048] The Focal loss adopted by the present invention is a cost-sensitive learning, which solves the problem of data imbalance from the algorithm level and improves the classifier's attention to difficult samples. For further analysis, the present invention compares Focal loss with a variety of imbalance processing methods. Tables 7 and 8 show the performance of Focal loss and different imbalance processing methods when the LightGBM classifier is used on the NSL-KDD and UNSW-NB15 datasets, respectively. The first is the traditional statistical synthetic data imbalance processing method: SMOTE and ADASYN. This method performs well on the NSL-KDD and UNSW-NB15 datasets and can steadily improve the model performance, but because it does not pay attention to difficult samples, the performance is not as good as the classifier introducing Focal loss. Regarding the generative model, the conditional generative adversarial network has the worst performance, which indicates that the quality of the data it generates is low, which has a significant negative impact on the prediction model. This may be due to defects in the loss function of CGAN and the fact that the number of minority class samples is insufficient to support the training of the network, resulting in mode collapse and the inability to generate high-quality samples. The introduction of Focal loss not only makes the classifier ahead of other data imbalance processing methods in terms of performance, but also saves a lot of time consumed in generating data. In short, the experimental results fully verify that the cost-sensitive learning introduced in this study can solve the data imbalance problem at the algorithm level.

[0049] Table 9 shows the performance analysis of different classifiers after adopting the above feature reduction techniques, and compares them with the performance of the proposed method on the NSL-KDD and UNSW-NB15 datasets. Compared with other feature reduction techniques, the improved binary simulated annealing algorithm (IBSA) shows excellent performance. The performance of the XGBoost feature importance selection method is relatively weak, which may be due to its prominence in mining the importance of a single feature, but its lack of ability in identifying the importance of feature combinations. The feature sets searched by other heuristic algorithms after 300 iterations still failed to search for a better feature combination than IBSA. It is worth mentioning that the feature selection algorithm based on IBSA has only one particle swarm, and the search speed is much higher than other swarm intelligence optimization algorithms, especially genetic algorithms. IBSA not only effectively reduces redundant features while maintaining a faster search speed, but also reduces the complexity of the network intrusion detection model.

[0050] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments may still be modified, or some or all of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network intrusion detection method based on an improved binary simulated annealing algorithm, characterized in that: include: Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set; Step S2, converting the simulated annealing algorithm into a binary form through the Sigmoid transfer function, setting the initial temperature according to the Metropolis criterion, and adding a multi-neighborhood solution generation mechanism to form an improved binary simulated annealing algorithm to screen out the key features in the data set; In step S3, the selected feature combination is input into the improved network intrusion detection model, and the parameters of the improved network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

2. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 1 is characterized in that: In step S1, the intrusion detection data set includes two benchmark data sets: NSL-KDD and UNSW-NB15, and both data sets contain relevant data of attack categories and normal traffic.

3. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 1 is characterized in that: In step S1, the preprocessing method includes: Null value processing: clean and filter data by removing missing values ​​and irrelevant parameters; Label encoding: Label encoding is performed on all categorical features except the last relevant feature before applying normalization techniques. Label encoding converts categorical features into numerical values. Min-max normalization: After label encoding, the min-max normalization technique is applied to the obtained output to scale the numerical range of each feature to the [0, 1] interval. The conversion formula is: ； In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively; Data deduplication: Remove duplicate data from the NSLKDD and UNSW-NB15 datasets.

4. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 1 is characterized in that: In step S2, the simulated annealing algorithm simulates the process of gradually decreasing temperature during physical annealing, gradually explores the solution space and tends to the global optimal solution. During the search process, the algorithm accepts solutions with increased energy with a certain probability to prevent falling into the local optimal solution. As the temperature decreases, the acceptance probability gradually decreases. The algorithm steps of simulated annealing are as follows: Initialization: Set initial parameters, including initial temperature , External loop times , inner loop times and termination temperature , and the temperature drop coefficient ; Perturbation and Acceptance Criteria of Solutions: Random Selection of Initial Solutions , and perturb it to obtain a new solution , calculate the energy value or objective function value of the two, and decide whether to accept the new solution acceptance probability through the Metropolis criterion for: ; In the formula, is temperature; Cooling method: A geometric cooling strategy is used. This strategy controls the rate at which the temperature is gradually reduced, so that the algorithm can explore a larger solution space in the early stage and gradually focus on searching for the optimal solution in the later stage. The formula is as follows: ； In the formula, is the cooling coefficient, ranging from 0 to 1. For the The temperature during the second external circulation, For the The temperature during the second external circulation; Termination condition: When the temperature drops to the preset termination temperature Or the maximum number of external loops is reached When , the algorithm stops and outputs the current solution, otherwise, it continues to execute the perturbation operation and acceptance criteria.

5. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 4 is characterized in that: In step S2, the Sigmoid transfer function is used to convert the simulated annealing algorithm into a binary form. The corresponding transfer function expression is: ； In the formula, For the iteration Secondary time dimension Middle The value of the position, , represents the position in the solution space; To map it to discrete space, the corresponding update formula is: ； Then, the improvement process of simulated annealing process is: According to the Metropolis criterion, the initial temperature is set to: ； In the formula, is a constant used to adjust the initial temperature. and are randomly selected in the solution space at the beginning of the algorithm. The maximum and minimum values ​​of the objective function corresponding to the feasible solutions, , and The calculation formula is as follows: ； ； ； In the formula, is a random number selected from the solution space at the beginning of the algorithm The average value of the objective function corresponding to the feasible solutions; Improved Metropolis criterion for combinatorial optimization problems of different scales, The value of may be orders of magnitude different from the current T value, resulting in The value is too large or too small, which affects the running time and optimization ability of the algorithm. That is, let: ； in, ； Multi-neighborhood solution generation mechanism, assuming that the current solution is ,in Indicates whether the feature is selected. The process of generating neighborhood solutions is as follows: ； In the formula, Represents the element-wise XOR operation, is a randomly generated feature flip bit vector, discretized by the Sigmoid function, and the number of flipped features is randomly selected and has a value range of , is the number of features in the dataset; Then the improved binary simulated annealing algorithm is completed to screen out the key features in the data set.

6. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 1 is characterized in that: In the step S3, the LightGBM classifier is improved by the loss function of Focal loss, thereby forming an improved network intrusion detection model; As a Boosting algorithm, LightGBM generates a strong learning model by combining multiple weak learners. During the training process, the algorithm adjusts the weights according to the classification error rate of the samples, so that the misclassified samples get more attention in the next round of training. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is expressed as follows: ； In the formula, is the target value corresponding to the training sample, is the number of elementary learners, It is The weight coefficients of the cardinality learners, is a training sample, are the parameters of the learner classification, It is The output of the base learner; After determining the loss function and training data of the model, the training process of the Boosting algorithm is transformed into an optimization problem of minimizing the loss function. The objective function is as follows: ； In the formula, is the number of samples, is the sample index, is the actual value of the data, It corresponds to The target value of samples, It is The loss function value of samples; In GBDT, this is a boosted tree model obtained based on the gradient descent algorithm. After each addition of a new sub-model, the gradient of the selected loss function will continue to decrease towards the variable with the second highest information content, as shown below: ； In the formula, and They are Second and The loss function value of the iteration, and It corresponds to and The target value of samples, is the true target value of the sample; The Focal Loss function is an improvement based on the standard multi-category cross entropy loss function. By adding a dynamic scaling factor to the standard cross entropy loss function, the model focuses on difficult-to-classify samples during training. The formula of the standard multi-category cross entropy loss function is as follows: ; In the formula, Represents the model output The predicted probability of the class, is the actual label; The Focal Loss function is based on the standard multi-category cross entropy loss function and introduces a dynamic scaling factor To the Focal Loss calculation, It is an adjustable parameter. The Focal loss function formula is as follows: ； In the formula, is the modulation coefficient to deal with the problem of difficult and easy classification samples. When a sample is misclassified, tends to 0, so the modulation coefficient tends to 1, which has no effect on the loss function. The loss function is the same as the standard cross entropy function; however, when the samples are paired, the modulation coefficient tends to 0, and the loss function of the easy-to-classify samples is down-weighted, tends to 0, and contributes little to the total loss function; In view of the imbalance of samples of each category in the data set, the cross entropy loss coefficient inversely proportional to the probability of target occurrence is used for correction. Therefore, the balanced cross entropy function is introduced to improve the Focal Loss function. The formula of the balanced cross entropy function is as follows: ； The improved Focal Loss loss function formula is as follows: ； in, is the inverse proportional weight, defined as: ； In the formula, is the total number of samples, is the number of categories, It is The number of class samples; The Focal Loss loss function is combined with the multi-category balanced cross entropy function, and the improved Focal Loss function is used as the loss function of the LightGBM model.

7. The network intrusion detection method based on improved binary simulated annealing algorithm according to claim 6 is characterized in that: In step S3, the TPE optimization algorithm tunes the parameters of the improved network intrusion detection model, namely: The optimization process can be expressed as follows, where the configuration space Contains all hyperparameters to be optimized. By continuously adjusting the hyperparameters of the model, a set of optimal values ​​can be obtained. : ； In the formula, is the objective function, yes So that the objective function A set of hyperparameters that achieves the minimum value; The TPE optimization algorithm is based on and Modeling is performed instead of Single modeling of in, represents the distribution of solutions, Represents the parameters when the solution is known The distribution of In addition, the optimization criteria are introduced To guide the search configuration space , The calculation of is as follows: ； In the formula, is the defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition; In order to avoid falling into the local optimal solution during the optimization process, it is necessary to ensure that all promising configuration areas can be traversed. is understood as relative to the threshold , the solution corresponding to the new hyperparameter can be improved, that is, The definition is as follows: ； Through conversion , and construct the function and : ； In the formula, the maximum In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability ; Repeat the above steps until the maximum number of iterations is reached, completing the parameter optimization of the improved network intrusion detection model.

Images