Network Intrusion Detection Method Based on Improved Binary Simulated Annealing Algorithm

Abstract

The application discloses a network intrusion detection method based on an improved binary simulated annealing algorithm, and comprises the following steps: S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set; S2, converting the simulated annealing algorithm into a binary form through a Sigmoid transfer function, setting an initial temperature according to a Metropolis criterion, adding a multi-neighborhood solution generation mechanism, forming an improved binary simulated annealing algorithm, and screening out key features in the data set; and S3, inputting the screened features into an improved network intrusion detection model, using a TPE optimization algorithm to optimize parameters of the improved network intrusion detection classification model, and performing final intrusion detection and classification. The application solves the problems of uneven sample distribution and difficulty difference of data samples, thereby realizing efficient and accurate network attack detection.

Description

Technical Field

[0001] This invention relates to a network intrusion detection method based on an improved binary simulated annealing algorithm. Background Technology

[0002] With the rapid development of the internet, it has become deeply integrated into people's daily lives, becoming an indispensable part. However, while providing convenience, the internet has also brought increasingly severe cybersecurity threats. How to improve the proactive defense capabilities and overall security of networks has become a current research focus, especially in the rapid identification and detection of various cyberattacks. Intrusion detection technology is an important protective tool for cybersecurity, effectively safeguarding user privacy and data security by providing early warnings through timely detection of ongoing or potential malicious attacks. However, with the continuous growth of network traffic, the complexity and scale of network data are increasing exponentially, making it difficult for traditional intrusion detection methods to cope with ever-changing malicious attacks and emerging cyber threats.

[0003] Therefore, developing efficient and robust Network Intrusion Detection Systems (NIDS) to protect sensitive information in the internet environment from cyberattacks is particularly urgent. NIDS monitors network traffic and issues alerts when any malicious or suspicious activity is detected. Currently, there are two main types of NIDS: anomaly-based detection and signature-based detection. Anomaly-based NIDS can detect new or unknown attacks by identifying activities that deviate from normal behavior patterns, thus offering high flexibility. However, these methods typically have a high false positive rate because anomalies in certain non-attack behaviors can also trigger alerts. In contrast, signature-based NIDS accurately identifies malicious behavior by matching known attack patterns, effectively reducing the false positive rate, and is therefore more common in practical applications. However, existing signature-based NIDS still face many challenges due to limitations such as model overfitting and bias caused by irrelevant or redundant features, and imbalanced class distribution in network traffic.

[0004] On the one hand, traditional IDS datasets, such as UNSW-NB15 and NSL-KDD, suffer from a severe imbalance in network traffic class distribution. This highly imbalanced dataset causes NIDS models to perform well in detecting majority class attacks but poorly in detecting minority class attacks, because insufficient minority class samples make it difficult for the model to effectively learn its features. Existing research often addresses class imbalance through data-level methods, such as statistical methods, generative adversarial networks (GANs), and federated learning. However, these methods are typically time-consuming; for example, training the generative model or generating synthetic data requires significant time. On the other hand, signature-based IDS relies on datasets with diverse features, some of which may be irrelevant or redundant. High-dimensional data not only increases dataset size and computational cost but also easily leads to overfitting during machine learning model training, resulting in a high false positive rate in real-world network environments. To address these issues, numerous researchers have proposed feature selection methods suitable for network intrusion detection, mainly categorized as embedded methods, filter methods, and wrapper methods. Embedded methods perform feature selection tasks simultaneously during model training, for example, by incorporating penalty terms into the model's objective function, achieving a tight integration between feature selection and model performance optimization. However, traditional embedded methods have limited ability to handle nonlinear feature combinations and struggle to fully capture complex data patterns. Filter methods can quickly select features by evaluating the statistical properties of individual features, but fail to consider the interactions between features. In contrast, wrapper methods can obtain the optimal feature set by directly evaluating feature subsets using the learning algorithm's performance, but they have higher computational costs, and the classifier's performance has a significant impact on the feature selection results.

[0005] To address the aforementioned issues, a network intrusion detection method based on an improved binary simulated annealing algorithm is proposed. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of existing methods by providing a network intrusion detection method based on an improved binary simulated annealing algorithm. This method solves the problems of uneven distribution of dataset samples and differences in the difficulty of data samples, thereby achieving efficient and accurate network attack detection.

[0007] The technical solution to achieve the above objectives is:

[0008] Network intrusion detection methods based on improved binary simulated annealing algorithms include:

[0009] Step S1: Obtain the intrusion detection dataset and preprocess the intrusion detection dataset;

[0010] Step S2: The simulated annealing algorithm is converted into binary form through the Sigmoid transfer function. According to the Metropolis criterion, the initial temperature is set and a multi-neighborhood solution generation mechanism is added to form an improved binary simulated annealing algorithm to filter out key features in the dataset.

[0011] Step S3: The selected feature combinations are input into the improved network intrusion detection model, and the parameters of the improved network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0012] Preferably, in step S1, the intrusion detection dataset includes two benchmark datasets: NSL-KDD and UNSW-NB15, both of which contain data related to attack categories and normal traffic.

[0013] Preferably, in step S1, the preprocessing method includes:

[0014] Null value handling: Clean and filter data by deleting missing values ​​and irrelevant parameters;

[0015] Label encoding: Before applying normalization techniques, label encoding is performed on all categorical features except the last relevant feature. Label encoding converts categorical features into numerical values.

[0016] Min-Max Normalization: After label encoding, min-max normalization is applied to the output to scale the numerical range of each feature to the [0, 1] interval. The transformation formula is as follows:

[0017] ;

[0018] In the formula, and These are the minimum and maximum values ​​of the eigenvectors, respectively. and These are the original value and the normalized value of the feature sample, respectively.

[0019] Data deduplication: Remove duplicate data from the NSLKDD and UNSW-NB15 datasets.

[0020] Preferably, in step S2, the simulated annealing algorithm simulates the gradual decrease in temperature during physical annealing, progressively exploring the solution space and tending towards the global optimum. During the search process, the algorithm accepts solutions with increased energy with a certain probability to prevent getting trapped in local optima. As the temperature decreases, the acceptance probability gradually decreases. The steps of the simulated annealing algorithm are as follows:

[0021] Initialization: Set initial parameters, including initial temperature. Number of outer loops Number of inner loops and termination temperature and cooling coefficient ;

[0022] Perturbation and Acceptance Criteria for Solutions: Randomly Select Initial Solutions A new solution is obtained by perturbing it. Calculate the energy values ​​or objective function values ​​of both solutions, and use the Metropolis criterion to determine whether to accept the new solution and the acceptance probability. for: ;

[0023] In the formula, For temperature;

[0024] Cooling method: A proportional cooling strategy is adopted, which controls the rate of temperature reduction gradually. This allows the algorithm to explore a larger solution space in the early stages, and then gradually focus on searching for the optimal solution in the later stages. The formula is as follows:

[0025] ;

[0026] In the formula, This is the cooling coefficient, with a value ranging from 0 to 1. For the first Temperature during the second external circulation cycle For the first Temperature during the second external circulation;

[0027] Termination condition: When the temperature drops to the preset termination temperature. Or reach the maximum number of outer loops If the condition is met, the algorithm stops and outputs the current solution; otherwise, it continues to execute the perturbation operation and the acceptance criterion.

[0028] Preferably, in step S2, the Sigmoid transfer function is used to convert the simulated annealing algorithm into binary form. The corresponding transfer function expression is as follows:

[0029] ;

[0030] In the formula, In the iteration Sub-time dimension The Middle The value of the position, , Represents the position in the solution space;

[0031] To map it to a discrete space, the corresponding update formula is:

[0032] ;

[0033] Therefore, the improved process for simulating annealing is as follows:

[0034] According to the Metropolis guidelines, the initial temperature is set as follows:

[0035] ;

[0036] In the formula, It is a constant used to adjust the magnitude of the initial temperature. and These are randomly selected from the solution space at the start of the algorithm's execution. The maximum and minimum values ​​of the objective function corresponding to each feasible solution. , and The calculation formula is as follows:

[0037] ;

[0038] ;

[0039] ;

[0040] In the formula, The elements are randomly selected in the solution space at the start of the algorithm's execution. The average of the objective function values ​​corresponding to each feasible solution;

[0041] Improved Metropolis criterion for combinatorial optimization problems of different scales. The value of T may differ by orders of magnitude from the current value of T, thus leading to If the value is too large or too small, it will affect the algorithm's running time and optimization ability. That is, let:

[0042] ;

[0043] in,

[0044] ;

[0045] Multi-neighborhood solution generation mechanism, assuming the current solution is ,in The process of generating neighborhood solutions to indicate whether a feature is selected is as follows:

[0046] ;

[0047] In the formula, This represents the element XOR operation. It is a randomly generated feature-flipped bit vector, discretized by the Sigmoid function, with the number of flipped features... It is randomly selected, and the range of values ​​is [missing information]. , It is the number of features in the dataset;

[0048] This leads to the development of an improved binary simulated annealing algorithm, which filters out key features from the dataset.

[0049] Preferably, in step S3, the LightGBM classifier is improved by using Focal loss as the loss function, thereby forming an improved network intrusion detection model;

[0050] LightGBM, as a boosting algorithm, generates a strong learning model by combining multiple weak learners. During training, the algorithm adjusts the weights based on the classification error rate of the samples, giving more attention to misclassified samples in the next training round. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is represented by the following formula:

[0051] ;

[0052] In the formula, It is the target value corresponding to the training sample. It is the number of basic learners. It is the first The weight coefficients of a cardinality learner These are training samples. These are the parameters for learner classification. It is the first The output of each basic learner;

[0053] After determining the model's loss function and the training data, the training process of the Boosting algorithm is transformed into an optimization problem of minimizing the loss function, with the objective function as follows:

[0054] ;

[0055] In the formula, It is the number of samples. It is a sample index. It is the actual value of the data. It corresponds to the first The target value for each sample It is the first The loss function value for each sample;

[0056] In GBDT, this is a boosting tree model obtained based on the gradient descent algorithm. After each new sub-model is added, the selected loss function continuously decreases towards the gradient of the variable with the second highest information content, as shown below:

[0057] ;

[0058] In the formula, and They are the first Subsequent The loss function value of the next iteration. and It corresponds to the first Individual and The target value for each sample It is the true target value of the sample;

[0059] The Focal Loss function is an improvement on the standard multi-class cross-entropy loss function. By adding a dynamic scaling factor to the standard cross-entropy loss function, it allows the model to focus on hard-to-classify samples during training. The formula for the standard multi-class cross-entropy loss function is as follows:

[0060] ;

[0061] In the formula, The first one representing the model output Predicted probability of class For actual labels;

[0062] The Focal Loss function is based on the standard multi-class cross-entropy loss function and introduces a dynamic scaling factor. In the Focal Loss calculation, As an adjustable parameter, the Focal loss function formula is as follows:

[0063] ;

[0064] In the formula, These are modulation coefficients used to handle the problem of classifying samples into easy and difficult categories. When a sample is misclassified, The modulation coefficient tends to 0, therefore it tends to 1, which has no effect on the loss function. (The remaining text appears to be incomplete and possibly contains errors.) The loss function is the same as the standard cross-entropy function; however, when the samples are correctly classified, the modulation coefficient tends to 0, the loss function of easily classified samples is weighted less, tends to 0, and contributes very little to the total loss function.

[0065] To address the imbalance of samples across different classes in the dataset, a cross-entropy loss coefficient, which is inversely proportional to the probability of the target occurrence, is used for correction. Therefore, a balanced cross-entropy function is introduced to improve the Focal Loss function. The formula for the balanced cross-entropy function is as follows:

[0066] ;

[0067] The improved Focal Loss function formula is as follows:

[0068] ;

[0069] in, The inverse proportional weight is defined as:

[0070] ;

[0071] In the formula, It is the total number of samples. It is the number of categories. It is the first The number of class samples;

[0072] By combining the Focal Loss function with the multi-class balanced cross-entropy function, the improved Focal Loss function is used as the loss function of the LightGBM model.

[0073] Preferably, in step S3, the TPE optimization algorithm fine-tunes the parameters of the improved network intrusion detection model, namely:

[0074] The optimization process can be represented by the following formula, where the configuration space It contains all the hyperparameters to be optimized. By continuously adjusting the model's hyperparameters, a set of optimal values ​​can be obtained. :

[0075] ;

[0076] In the formula, It is the objective function. yes In order to make the objective function A set of hyperparameters that achieves the minimum value;

[0077] The TPE optimization algorithm optimizes the... and Modeling instead of... Single modeling;

[0078] in, This represents the distribution of solutions. Represents the parameters when the solution is known. Distribution of;

[0079] In addition, optimization standards were introduced. To guide the search configuration space , The calculation is as follows:

[0080] ;

[0081] In the formula, For the predefined threshold, Represents the observed value loss function ratio Small density estimates, Represents the observed value loss function ratio High density composition;

[0082] To avoid getting stuck in local optima during the optimization process, it is necessary to ensure that all promising configuration regions can be traversed. Interpreted as relative to the threshold The extent to which the solution corresponding to the new hyperparameters can be improved, i.e. The definition is as follows:

[0083] ;

[0084] Through transformation and construct functions and :

[0085] ;

[0086] In the formula, in maximizing In the process of searching for better hyperparameters, It should be iterated gradually until it makes A smaller value, that is, one that approximates the maximum probability. and minimum probability ;

[0087] Repeat the above steps until the maximum number of iterations is reached to complete the parameter optimization of the improved network intrusion detection model.

[0088] The beneficial effects of this invention are:

[0089] This invention improves the simulated annealing algorithm by adapting the initial temperature to the Metropolis criterion, adding a multi-neighborhood search strategy, and combining a Sigmoid-type propagation function. It also introduces Focal Loss into the baseline classifier of the simulated annealing algorithm, making it more efficient for the feature selection task of NIDS.

[0090] This invention introduces a cost-sensitive learning-based Focal Loss to improve the loss function of the LightGBM classifier. At the algorithmic level, this balances the model's attention to all categories, strengthens its learning ability for difficult-to-classify samples, and thus improves the predictive performance of the classifier.

[0091] This invention utilizes the LightGBM classifier to achieve efficient classification of network attack patterns, and further optimizes the hyperparameters of all classifiers through TPE, significantly improving performance;

[0092] In summary, this invention solves the problems of uneven distribution of dataset samples and differences in the difficulty of data samples, thereby achieving efficient and accurate network attack detection. Attached Figure Description

[0093] Figure 1 This is a flowchart of the network intrusion detection method based on the improved binary simulated annealing algorithm of the present invention;

[0094] Figure 2 This is a schematic diagram illustrating the optimal fitness and corresponding number of features in each Epoch of the population in an embodiment of the present invention;

[0095] Figure 3 This is a schematic diagram illustrating the global optimal fitness and the corresponding number of features in each Epoch of the population in an embodiment of the present invention;

[0096] Figure 4 This is a schematic diagram of the ROC curve of the original method in this embodiment of the invention on the NSLKDD dataset;

[0097] Figure 5 This is a schematic diagram of the ROC curve of the method proposed in this embodiment of the invention on the NSLKDD dataset;

[0098] Figure 6 This is a schematic diagram of the confusion matrix of the original method on the NSLKDD dataset in an embodiment of the present invention;

[0099] Figure 7 This is a schematic diagram of the confusion matrix of the proposed method in this embodiment of the invention on the NSLKDD dataset;

[0100] Figure 8 This is a schematic diagram of the ROC curve of the original method in this embodiment of the invention on the UNSW-NB15 dataset;

[0101] Figure 9 This is a schematic diagram of the ROC curve of the method proposed in this embodiment of the invention on the UNSW-NB15 dataset;

[0102] Figure 10 This is a schematic diagram of the confusion matrix of the original method on the UNSW-NB15 dataset in this embodiment of the invention;

[0103] Figure 11 This is a schematic diagram of the confusion matrix of the method proposed in this embodiment of the invention on the UNSW-NB15 dataset. Detailed Implementation

[0104] The technical solution of the present invention will now be clearly and completely described in conjunction with the accompanying drawings. In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0105] The invention will now be further described with reference to the accompanying drawings.

[0106] like Figure 1 As shown, a network intrusion detection method based on an improved binary simulated annealing algorithm includes:

[0107] Step S1: Obtain the intrusion detection dataset and preprocess it.

[0108] In this embodiment, the intrusion detection dataset includes two benchmark datasets: NSL-KDD and UNSW-NB15, both of which contain data related to attack categories and normal traffic.

[0109] The NSL-KDD dataset is an improvement on the KDDCup'99 dataset, containing 43 features. 42 features describe network traffic, and 1 feature identifies attack categories. The attack categories comprise 23 distinct subcategories, 22 of which are attack types, with the remaining categories representing normal traffic. These 22 attack subcategories can be categorized into four main attack types. The dataset was pre-split into a training set (KDDTrain+) and a test set (KDDTest+). To avoid discrepancies in data distribution between the training and test sets due to pre-split, this study merged the training and test sets and randomly divided them into new training and test sets in a 7:3 ratio.

[0110] The UNSW-NB15 dataset: UNSW-NB15 is a dataset extracted from 100GB of normal and modern attack traffic by researchers at the Australian Cyber ​​Security Centre (ACCS) using the IXIA tool. The complete UNSW-NB15 dataset contains 2.5 million records, covering one general category and nine attack categories: analytics, backdoors, DoS, exploitation, fuzzing, general, reconnaissance, shellcode, and worms. To reduce training difficulty, the dataset creators also provided a 10% dataset containing 43 features: 42 describing network traffic and 2 identifying attack categories. 'attack_cat' is the multi-class label, and 'label' is the binary class label, containing 257,673 records. Since this study investigates a multi-class problem, 'label' was removed, and the dataset was randomly divided into a new training and test set in a 7:3 ratio.

[0111] In this embodiment, the preprocessing method includes:

[0112] Null value handling: Clean and filter data by deleting missing values ​​and irrelevant parameters;

[0113] Label encoding: Before applying normalization techniques, label encoding is performed on all categorical features except the last relevant feature. Label encoding converts categorical features into numerical values.

[0114] Min-Max Normalization: After label encoding, min-max normalization is applied to the output to scale the numerical range of each feature to the [0, 1] interval. The transformation formula is as follows:

[0115] ;

[0116] In the formula, and These are the minimum and maximum values ​​of the eigenvectors, respectively. and These are the original value and the normalized value of the feature sample, respectively.

[0117] Data deduplication: Remove duplicate data from the NSLKDD and UNSW-NB15 datasets.

[0118] Step S2: The simulated annealing algorithm is converted into binary form using the Sigmoid transfer function. Based on the Metropolis criterion, the initial temperature is set, and a multi-neighborhood solution generation mechanism is added to form an improved binary simulated annealing algorithm to filter out key features in the dataset.

[0119] In this embodiment, the simulated annealing algorithm simulates the gradual decrease in temperature during physical annealing, progressively exploring the solution space and approaching the global optimum. During the search process, the algorithm accepts solutions with increased energy with a certain probability to prevent getting trapped in local optima. As the temperature decreases, the probability of acceptance gradually decreases. The steps of the simulated annealing algorithm are as follows:

[0120] Initialization: Set initial parameters, including initial temperature. Number of outer loops Number of inner loops and termination temperature and cooling coefficient These parameters determine the search range and convergence speed;

[0121] Perturbation and Acceptance Criteria for Solutions: Randomly Select Initial Solutions A new solution is obtained by perturbing it. Calculate the energy values ​​or objective function values ​​of both solutions, and use the Metropolis criterion to determine whether to accept the new solution and the acceptance probability. for:

[0122] ;

[0123] In the formula, For temperature;

[0124] Cooling method: A proportional cooling strategy is adopted, which controls the rate of temperature reduction gradually. This allows the algorithm to explore a larger solution space in the early stages, and then gradually focus on searching for the optimal solution in the later stages. The formula is as follows:

[0125] ;

[0126] In the formula, This is the cooling coefficient, with a value ranging from 0 to 1. For the first Temperature during the second external circulation cycle For the first Temperature during the second external circulation;

[0127] Termination condition: When the temperature drops to the preset termination temperature. Or reach the maximum number of outer loops If the condition is met, the algorithm stops and outputs the current solution; otherwise, it continues to execute the perturbation operation and the acceptance criterion.

[0128] Simulated annealing is a flexible and effective global optimization algorithm, particularly suitable for solving large-scale discrete optimization problems. By simulating the physical phenomena during heat treatment and utilizing a mechanism that probabilistically accepts poor solutions, it avoids the limitation of traditional optimization methods that easily get trapped in local optima. However, the algorithm's performance is significantly affected by the cooling rate and the choice of initial parameters. Therefore, this study adjusted and optimized the simulated annealing algorithm.

[0129] In this embodiment, the Sigmoid transfer function is used to convert the simulated annealing algorithm into binary form. The corresponding transfer function expression is as follows:

[0130] ;

[0131] In the formula, In the iteration Sub-time dimension The Middle The value of the position, , Represents the position in the solution space;

[0132] To map it to a discrete space, the corresponding update formula is:

[0133] ;

[0134] Therefore, the improved process for simulating annealing is as follows:

[0135] According to the Metropolis guidelines, the initial temperature is set as follows:

[0136] ;

[0137] In the formula, This is a constant used to adjust the initial temperature. It is 0.9. and These are randomly selected from the solution space at the start of the algorithm's execution. The maximum and minimum values ​​of the objective function corresponding to each feasible solution. , and The calculation formula is as follows:

[0138] ;

[0139] ;

[0140] ;

[0141] In the formula, The elements are randomly selected in the solution space at the start of the algorithm's execution. The average of the objective function values ​​corresponding to each feasible solution;

[0142] Improved Metropolis criterion for combinatorial optimization problems of different scales. The value of T may differ by orders of magnitude from the current value of T, thus leading to If the value is too large or too small, it will affect the algorithm's running time and optimization ability. That is, let:

[0143] ;

[0144] in,

[0145] ;

[0146] Multi-neighborhood solution generation mechanism, assuming the current solution is ,in The process of generating neighborhood solutions to indicate whether a feature is selected is as follows:

[0147] ;

[0148] In the formula, This represents the element XOR operation. It is a randomly generated feature-flipped bit vector, discretized by the Sigmoid function, with the number of flipped features... It is randomly selected, and the range of values ​​is [missing information]. , It is the number of features in the dataset;

[0149] This leads to the development of an improved binary simulated annealing algorithm, which filters out key features from the dataset.

[0150] Step S3: The selected feature combinations are input into the improved network intrusion detection model, and the parameters of the improved network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0151] In this embodiment, the best features selected using the IBSA method are used to construct a new feature set, which is then used for final prediction by LightGBM. The introduction of the Focal loss function aims to improve the LightGBM classifier's ability to handle imbalanced samples and difficult-to-classify samples at the algorithmic level, thereby improving the model's classification performance. Furthermore, the Tree-structured Parzen Estimator (TPE) method is used to optimize the classifier's structure and hyperparameters to achieve the best predictive performance.

[0152] In this embodiment, the LightGBM classifier is improved by using Focal loss as the loss function, thereby forming an improved network intrusion detection model;

[0153] LightGBM, as a boosting algorithm, generates a strong learning model by combining multiple weak learners. During training, the algorithm adjusts the weights based on the classification error rate of the samples, giving more attention to misclassified samples in the next training round. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is represented by the following formula:

[0154] ;

[0155] In the formula, It is the target value corresponding to the training sample. It is the number of basic learners. It is the first The weight coefficients of a cardinality learner These are training samples. These are the parameters for learner classification. It is the first The output of each basic learner;

[0156] After determining the model's loss function and the training data, the training process of the Boosting algorithm is transformed into an optimization problem of minimizing the loss function, with the objective function as follows:

[0157] ;

[0158] In the formula, It is the number of samples. It is a sample index. It is the actual value of the data. It corresponds to the first The target value for each sample It is the first The loss function value for each sample;

[0159] In GBDT, this is a boosting tree model obtained based on the gradient descent algorithm. After each new sub-model is added, the selected loss function continuously decreases towards the gradient of the variable with the second highest information content, as shown below:

[0160] ;

[0161] In the formula, and They are the first Subsequent The loss function value of the next iteration. and It corresponds to the first Individual and The target value for each sample It is the true target value of the sample;

[0162] As a type of GBDT, LightGBM effectively addresses the challenges GBDT faces when processing massive amounts of data. This model has two main functions:

[0163] (a) Leaf-by-leaf tree growth method: It adopts a leaf-by-leaf growth strategy. Compared with level-by-level growth, this method can capture the structure of the data more quickly and effectively avoid overfitting by controlling the minimum amount of data in the leaf nodes and the depth of the tree.

[0164] (ii) Histogram-based decision tree algorithm: LightGBM selects features using a histogram algorithm. When searching for the optimal split point, it only needs to traverse the discrete values ​​of the histogram. This method significantly reduces computational and storage costs, making LightGBM more efficient when processing large-scale datasets.

[0165] The loss function is crucial for model optimization, directly impacting training efficiency and final model performance. This study addresses the data imbalance problem at the algorithmic level by introducing a cost-sensitive learning algorithm. Cost-sensitive learning is an effective method for solving the sample imbalance problem. It primarily improves the model's loss function by altering the misclassification cost, combining this cost with the loss function to make the model favor positive class samples with higher misclassification costs. For multi-class classification problems, the commonly used loss function is the multi-class cross-entropy loss function. The Focal Loss function improves upon the standard multi-class cross-entropy loss function by adding a dynamic scaling factor, allowing the model to focus on hard-to-classify samples during training, thereby enhancing the model's predictive ability for each class.

[0166] The Focal Loss function is an improvement on the standard multi-class cross-entropy loss function. By adding a dynamic scaling factor to the standard cross-entropy loss function, it allows the model to focus on hard-to-classify samples during training. The formula for the standard multi-class cross-entropy loss function is as follows:

[0167] ;

[0168] In the formula, The first one representing the model output Predicted probability of class For actual labels;

[0169] The Focal Loss function is based on the standard multi-class cross-entropy loss function and introduces a dynamic scaling factor. In Focal Loss calculations, training is performed on difficult-to-classify samples to reduce the impact of easily classified samples on the model's training performance. As an adjustable parameter, the Focal loss function formula is as follows:

[0170] ;

[0171] In the formula, These are modulation coefficients used to handle the problem of classifying samples into easy and difficult categories. When a sample is misclassified, The modulation coefficient tends to 0, therefore it tends to 1, which has no effect on the loss function. (The remaining text appears to be incomplete and possibly contains errors.) The loss function is the same as the standard cross-entropy function; however, when samples are correctly classified, the modulation coefficients tend to 0, and the loss function for easily classified samples has a reduced weight, tending to 0, thus contributing very little to the total loss function. As the parameters... As the modulation coefficient increases, the importance of misclassified samples is enhanced.

[0172] To address the imbalance of samples across different classes in the dataset, a cross-entropy loss coefficient, which is inversely proportional to the probability of the target occurrence, is used for correction. Therefore, a balanced cross-entropy function is introduced to improve the Focal Loss function. The formula for the balanced cross-entropy function is as follows:

[0173] ;

[0174] The improved Focal Loss function formula is as follows:

[0175] ;

[0176] in, The inverse proportional weight is defined as:

[0177] ;

[0178] In the formula, It is the total number of samples. It is the number of categories. It is the first The number of class samples;

[0179] By combining the Focal Loss function with the multi-class balanced cross-entropy function, the improved Focal Loss function is used as the loss function of the LightGBM model.

[0180] In this embodiment, the TPE optimization algorithm fine-tunes the parameters of the improved network intrusion detection model, namely:

[0181] The optimization process can be represented by the following formula, where the configuration space It contains all the hyperparameters to be optimized. By continuously adjusting the model's hyperparameters, a set of optimal values ​​can be obtained. :

[0182] ;

[0183] In the formula, It is the objective function. yes In order to make the objective function A set of hyperparameters that achieves the minimum value;

[0184] The TPE optimization algorithm optimizes the... and Modeling instead of... Single modeling;

[0185] in, This represents the distribution of solutions. Represents the parameters when the solution is known. Distribution of;

[0186] In addition, optimization standards were introduced. To guide the search configuration space , The calculation is as follows:

[0187] ;

[0188] In the formula, For the predefined threshold, Represents the observed value loss function ratio Small density estimates, Represents the observed value loss function ratio High density composition;

[0189] To avoid getting stuck in local optima during the optimization process, it is necessary to ensure that all promising configuration regions can be traversed. Interpreted as relative to the threshold The extent to which the solution corresponding to the new hyperparameters can be improved, i.e. The definition is as follows:

[0190] ;

[0191] Through transformation and construct functions and :

[0192] ;

[0193] In the formula, in maximizing In the process of searching for better hyperparameters, It should be iterated gradually until it makes A smaller value, that is, one that approximates the maximum probability. and minimum probability ;

[0194] Repeat the above steps until the maximum number of iterations is reached to complete the parameter optimization of the improved network intrusion detection model.

[0195] In this embodiment, let the outer loop number of the simulated annealing algorithm (hereinafter referred to as IBSA) be... The number of inner loops is 300. The cooling coefficient is 1. The value is 0.95, and no termination temperature is set.

[0196] To visually demonstrate the process and effect of feature selection in the proposed IBSA algorithm, this invention records the best fitness and the corresponding number of features in each Epoch of the population, as well as the global best fitness and the corresponding number of features, and plots them as a line graph to visualize the IBSA population iteration process.

[0197] like Figure 2 , 3 As shown, the improved binary simulated annealing algorithm, due to the high temperature in the early stages, continuously escapes local optima and finds a path to approach a better solution. In the later stages, as the temperature cools down, the algorithm continues to approach a better feature combination. Finally, after multiple iterations, the local optimal fitness curve basically coincides with the global optimal fitness curve, indicating that the model has successfully converged to a better solution in the later stages of iteration, demonstrating high search efficiency. Ultimately, the number of features in the NSLKDD dataset was reduced from 42 to 25, and the number of features in the UNSW-NB15 dataset was compressed from 44 to 25. The feature selection algorithm based on IBSA uses only one particle swarm, resulting in a search speed far exceeding that of swarm intelligence optimization algorithms. While maintaining a faster search speed, it not only effectively reduces redundant features but also lowers the complexity of the network intrusion detection model.

[0198] To gain a more comprehensive understanding of the performance improvements across different categories in the NSLKDD dataset, this invention compares the performance of the original method with that of the proposed method. The main performance metrics of the two methods are compared in Table 1:

[0199]

[0200] As shown in Table 1, on the NSLKDD dataset, the proposed method demonstrates superior generalization ability compared to the original method. Specifically, accuracy, weighted precision, recall, and F1 score all improve by approximately 2%. Notably, the precision for the Dos category, which has the smallest dataset, decreases from 100% to 97.10%. This may be due to the original method's insufficient emphasis on the Dos category, making it difficult to correctly identify Dos samples, resulting in very high precision but low recall. The introduction of the cost-sensitive learning Focal loss function allows the classification model to prioritize categories with fewer samples and greater difficulty in classification, resulting in a more balanced emphasis across all categories and reducing the probability of misclassifying other categories as Dos. However, overall, the F1 score for the Dos category is significantly improved, reaching 91.78%, indicating that the proposed method significantly improves the classifier's detection performance. To further analyze the generalization ability of the proposed method, this invention also plotted the ROC curves and confusion matrices of the original method and the proposed method on the NSLKDD dataset, as shown below. Figure 4-7 As shown.

[0201] Figure 4 and Figure 5 The ROC curves of the original method and the proposed method on the NSLKDD dataset are presented, and the AUC values ​​for each category are calculated. The ROC curves reflect the classifier's performance at different decision thresholds; the closer the AUC value is to 1, the better the overall performance of the classifier. As can be observed from the figures, under the original method, the curves for minority classes such as Fuzzers and Dos fluctuate significantly and are not smooth, indicating unstable predictive performance, and their area occupied is significantly smaller compared to the majority classes. In contrast, the proposed method significantly improves the predictive performance of all classes, especially for the minority classes Fuzzers and Dos, where the curves become smoother and their area occupied increases significantly. This result shows that the proposed method exhibits stronger discriminative ability when handling minority class samples. Furthermore, this method not only improves the detection performance of minority classes but also enhances the detection effect of the majority classes, with AUC values ​​for all categories reaching above 0.999, further demonstrating the superior overall stability of the proposed method.

[0202] To further verify the classifier's ability to distinguish between different categories Figure 6 and Figure 7 The confusion matrices of the original method and the proposed method on the NSLKDD dataset are shown respectively.

[0203] This invention performs color normalization on the confusion matrix to ensure relatively consistent color intensity across different categories, thus fairly presenting the importance of each category in visualization. On the NSLKDD dataset, compared to the original method, although the proposed method still exhibits false positives, it can generally accurately identify Normal and various attack types. Conversely, while the original method achieves better prediction results for most categories, its performance is significantly inferior on a few categories, such as Fuzzers and DoS attacks. Therefore, the method proposed in this invention demonstrates significant superiority on the NSLKDD dataset.

[0204] To gain a more comprehensive understanding of the performance improvements across different categories in the UNSW-NB15 dataset, this invention compares the performance of the original method with that of the proposed method. The main performance metrics of the two methods are compared in Table 2:

[0205]

[0206] As shown in Table 2, on the UNSW-NB15 dataset, the proposed method significantly improves overall generalization ability compared to the original method. Specifically, accuracy is improved by nearly 2%, and the weighted F1 score and average F1 score are improved by 2.15% and 6.29%, respectively. The proposed method outperforms the original method in all categories, particularly in the minority categories of Analysis, Backdoor, Shellcode, and Worms, with improvements of 17.03%, 15.73%, 7.21%, and 6.79%, respectively. Notably, the original method's F1 scores for Analysis and Backdoor are below 25%, indicating its near ineffectiveness in detecting these categories. In contrast, the proposed method achieves F1 scores of 40.46% and 34.61% for these categories, respectively. The poor performance of the original method is likely due to the fact that these categories are minority categories and difficult to detect; the original method undervalued them, misidentifying them as similar attack types and thus losing predictive ability for these categories. The proposed method introduces cost-sensitive learning via Focal loss, enabling the classifier to prioritize minority and hard-to-detect classes. Simultaneously, the IBSA feature selection method effectively removes redundant features, improving prediction accuracy. To further analyze the generalization ability of this method, ROC curves and confusion matrices of the original and proposed methods on the UNSW-NB15 dataset are plotted, as shown below. Figure 8-11 As shown.

[0207] Figure 8 and Figure 9ROC curves of the original method and the proposed method on the UNSW-NB15 dataset are presented, and AUC values ​​for each category are calculated. It can be seen that under the original method, the AUC values ​​for Analysis and Backdor in a few categories are below 0.93, and the curves are highly volatile and not smooth, indicating instability in its predictive performance. In contrast, the proposed method significantly improves predictive performance, making its curve smoother, and significantly increasing the AUC values ​​to 0.966 and 0.968, respectively. Furthermore, this method not only improves the detection performance of a few categories but also optimizes the detection effect for all categories, with AUC values ​​for all categories surpassing the performance of the original method. Particularly noteworthy is that the AUC value for the Normal category in the proposed method is very close to 1, indicating that the model can effectively distinguish between normal traffic and intrusion attack traffic, further demonstrating the overall superiority and stability of the proposed method.

[0208] To further verify the classifier's ability to identify different categories Figure 10 and Figure 11 The confusion matrix of the original method and the proposed method on the UNSW-NB15 dataset is also presented.

[0209] Figure 10 and Figure 11 The classification results for various attack types based on the confusion matrix are presented. For the UNSW-NB15 dataset, the original method exhibits severe false positives, including misclassifying Analysis, Backdor, and Shellcode (belonging to minority categories) as normal traffic and other attacks. Many common categories are also misclassified as Exploits, Fuzzers, and normal traffic. These false positives stem not only from the similarity of traffic features but are also exacerbated by class imbalance and feature redundancy issues in the input detection model, further aggravating the false positives among these categories.

[0210] Although the proposed method still exhibits false positives after improving classifier prediction performance, it significantly mitigates these issues. For example, Analysis, Backdor, and Shellcode, which belong to minority categories, are no longer falsely detected as normal traffic, greatly reducing the likelihood of these attack types going undetected. Therefore, the proposed method demonstrates significant superiority on the UNSW-NB15 dataset, substantially improving the detection capability for multiple attack types.

[0211] Tables 3 and 4 present the overall ablation experiments on the NSLKDD and UNSW-NB15 datasets, respectively, using the LightGBM classifier as the network intrusion detection model. The experiments were divided into four groups: no improvements were made, only cost-sensitive learning Focal loss was introduced, only IBSA was used for feature selection, and a combination of both methods was used. The ablation results show that introducing cost-sensitive learning Focal loss significantly improved all performance metrics, especially Precision and F1 score. This is mainly attributed to the resolution of the class imbalance problem, allowing the network intrusion detection model to pay more attention to difficult-to-classify samples and fewer classes. While applying IBSA feature selection alone improved the model's generalization performance, the F1 score remained significantly lower than Accuracy, indicating that the model was still severely affected by class imbalance. The ablation results demonstrate that the proposed network intrusion detection method achieves optimal performance, proving its significant effectiveness.

[0212]

[0213] The performance of the machine learning models under both the original and proposed methods was evaluated. Tables 5 and 6 show the performance of various mainstream classification models evaluated using different classification metrics on the NSL-KDD and UNSW-NB15 datasets, respectively. The results show that on the NSL-KDD dataset, the proposed method improves the performance of almost all classifiers compared to the original method. Furthermore, in both the original and proposed methods, the LightGBM model significantly outperforms all other mainstream models except for XGBoost, although its prediction performance is slightly lower than XGBoost, its training speed is faster. On the UNSW-NB15 dataset, the proposed method improves the performance of all classifiers compared to the original method, and the LightGBM model outperforms other mainstream models under both methods. In conclusion, the comparative experimental results demonstrate the superior generalization ability of the LightGBM classifier in the field of network intrusion detection.

[0214]

[0215]

[0216] The Focal loss employed in this invention is a cost-sensitive learning method that addresses the data imbalance problem at the algorithmic level and increases the classifier's emphasis on difficult samples. For further analysis, this invention compares Focal loss with various imbalance handling methods. Tables 7 and 8 show the performance of Focal loss versus different imbalance handling methods when using the LightGBM classifier on the NSL-KDD and UNSW-NB15 datasets, respectively. First, the traditional statistical synthetic data imbalance handling methods, SMOTE and ADASYN, perform well on the NSL-KDD and UNSW-NB15 datasets, consistently improving model performance. However, due to their lack of emphasis on difficult samples, their performance is inferior to classifiers incorporating Focal loss. Regarding generative models, Conditional Generative Adversarial Networks (CGANs) perform the worst, indicating low-quality generated data that significantly negatively impacts the prediction model. This may be due to flaws in the CGAN's loss function and insufficient sample size for minority classes to support network training, leading to mode collapse and the inability to generate high-quality samples. The introduction of Focal loss not only makes the classifier outperform other imbalanced data handling methods in terms of performance, but also saves a significant amount of time spent generating data. In summary, the experimental results fully verify that the cost-sensitive learning introduced in this study can solve the imbalanced data problem at the algorithmic level.

[0217]

[0218]

[0219]

[0220] Table 9 presents the performance analysis of different classifiers after applying the aforementioned feature reduction techniques, and compares their performance with the proposed method on the NSL-KDD and UNSW-NB15 datasets. Compared with other feature reduction techniques, the improved binary simulated annealing (IBSA) algorithm demonstrates superior performance. The XGBoost feature importance selection method performs relatively poorly, possibly because it excels at mining the importance of individual features but is insufficient in recognizing the importance of feature combinations. Other heuristic algorithms, even after 300 iterations, still failed to find a more ideal feature set than the feature combinations found by IBSA. It is worth mentioning that the IBSA-based feature selection algorithm uses only one particle swarm, resulting in a search speed far exceeding other swarm intelligence optimization algorithms, especially genetic algorithms. IBSA effectively reduces redundant features while maintaining a faster search speed, further reducing the complexity of network intrusion detection models.

[0221] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network intrusion detection method based on an improved binary simulated annealing algorithm, characterized in that, The application relates to an improved network intrusion detection method. Step S1: obtaining an intrusion detection data set and preprocessing the intrusion detection data set; Step S2: converting the simulated annealing algorithm into a binary form through a Sigmoid transfer function, setting an initial temperature according to a Metropolis criterion, adding a multi-neighborhood solution generation mechanism, screening out key features in the data set, and forming an improved binary simulated annealing algorithm; Step S3: inputting the screened features into an improved network intrusion detection model, optimizing parameters of the improved network intrusion detection classification model by using a TPE optimization algorithm, and performing final intrusion detection and classification. In step S2, the simulated annealing algorithm simulates the process of gradually reducing the temperature in the physical annealing process, gradually explores the solution space and tends to the global optimal solution, and in the search process, the algorithm accepts solutions with increased energy at a certain probability to prevent falling into a local optimal solution, and as the temperature decreases, the acceptance probability gradually decreases, and the algorithm steps of the simulated annealing are as follows: Initialization: Set initial parameters, including initial temperature T0, outer loop number L1, inner loop number L2 and termination temperature T min , and temperature reduction coefficient α; Solution perturbation and acceptance criteria: randomly select initial solution X old , perturb it to get a new solution X new , calculate the energy value or objective function value of both, and decide whether to accept the new solution or not by the Metropolis criterion. The acceptance probability P is: where T is the temperature, E(X new ) is the new solution X new corresponding to the objective function value E(X old ) is the initial solution X old corresponding to the objective function value E(X The temperature reduction mode adopts an equal ratio temperature reduction strategy, the strategy controls the rate of gradually reducing the temperature, so that the algorithm can explore a larger solution space in the early stage, and gradually concentrate on searching for an optimal solution in the later stage, and the formula is as follows: T k+1 = a · T k ; wherein a is a temperature reduction coefficient, having a value ranging between 0 and 1, T k+1 T k+1 is the temperature at the (k+1)th outer loop, k T k is the temperature at the kth outer loop; Termination condition: when the temperature is reduced to a preset termination temperature T min or reaches the maximum number of external cycles L1, the algorithm stops and outputs the current solution, otherwise, the perturbation operation and acceptance criterion are continued to be executed. The simulated annealing algorithm is converted into a binary form by using a Sigmoid transfer function, and the corresponding transfer function expression is as follows: where y k i,j (t) is the value of the (i,j) position in dimension k at iteration t, i,j representing the position in the solution space; In order to map it to a discrete space, the corresponding update formula is as follows: Then, the improvement process of the simulated annealing process is as follows: According to the Metropolis criterion, the initial temperature is set as follows: where P is a constant used to adjust the size of the initial temperature, E(X max ) and E(X min ) are the maximum and minimum values of the objective function values of the N feasible solutions randomly selected in the solution space at the beginning of the algorithm, respectively, and E(X max ), E(X min ) and E(X average ) are calculated as follows: E(X max ) = max{f(X max ) | i = 1, 2, …, N} E(X min ) = min{f(X min ) | i = 1, 2, …, N} E(X average ) = 1 / N Σf(X average ) | i = 1, 2, …, N} where E(X average ) is the average of the objective function values of the N feasible solutions randomly selected in the solution space at the beginning of the algorithm, S i is the objective function value of the i-th feasible solution randomly generated in the solution space at the initialization of the algorithm. The Metropolis criterion is improved. For different scale combination optimization problems, the value of E(X new )-E(X old ) may differ by orders of magnitude from the current T value, resulting in P values that are too large or too small, which affects the running time and optimization ability of the algorithm, i.e., let: Wherein, Multi-neighborhood solution generation mechanism, assuming the current solution is x t =(x1,x2,…,x n ), where x i ∈{0,1} indicates whether a feature is selected. The process of generating neighborhood solutions is as follows: x neighbor = x t ⊕ d; In the formula, represents the element exclusive or operation, d is a randomly generated feature flip bit vector, is discretized by the Sigmoid function, the number of features k to be flipped is randomly selected, and the value range is k [1, C / 5], and C is the number of features of the data set. Then, the improved binary simulated annealing algorithm is formed, and key features in the data set are screened out.

2. The network intrusion detection method based on the improved binary simulated annealing algorithm according to claim 1, characterized in that, In step S1, the intrusion detection data set includes two benchmark data sets: NSL-KDD and UNSW-NB15, and the two data sets both contain relevant data of attack categories and normal traffic.

3. The network intrusion detection method based on the improved binary simulated annealing algorithm according to claim 1, characterized in that, In step S1, the preprocessing mode includes: Null value processing: deleting missing values and irrelevant parameters, cleaning and filtering data; Label encoding: before applying the normalization technology, all classification features except the last relevant feature are subjected to label encoding, and the label encoding converts the classification features into numerical values; Minimum-maximum normalization: after label encoding, the obtained output is subjected to minimum-maximum normalization technology, so that the numerical value range of each feature is scaled to the [0, 1] interval, and the conversion formula is as follows: where X min and X max are the minimum and maximum values of the feature vector, respectively, and X new are the original and normalized values of the feature sample, respectively. Data deduplication: removing duplicate data of the NSLKDD and UNSW-NB15 data sets.

4. The network intrusion detection method based on the improved binary simulated annealing algorithm according to claim 1, characterized in that, In step S3, the LightGBM classifier is improved through a loss function of the Focal loss, and then the improved network intrusion detection model is formed. LightGBM, as a Boosting algorithm, combines multiple weak learners to generate a strong learning model. During the training process, the algorithm adjusts the weights according to the classification error rate of the samples, so that the samples with classification errors are given more attention in the next round of training. The outputs of all weak learners are combined into a strong model through weighted summation. The core concept is represented by the following formula: In the formula, f(x) is the target value corresponding to the training sample, Q is the number of base learners, a q is the weight coefficient of the qth base learner, x is the training sample, θ q is the parameter of the learner classification, T(x, θ q ) is the output of the qth base learner; After determining the loss function and training data of the model, the training process of the Boosting algorithm is converted into an optimization problem of minimizing the loss function. The objective function is as follows: where H is the number of samples, h is the sample index, y h is the actual value of the data, f(x h ) is the target value corresponding to the hth sample, L(y h , f(x h )) is the loss function value of the hth sample; In GBDT, it is a boosting tree model obtained based on the gradient descent algorithm. After adding a new sub-model each time, the selected loss function continuously decreases towards the gradient of the second highest information content variable, as shown below: L(F j (x),Y) < L(F j-1 (x),Y); wherein L(F j (x),Y) and L(F j-1 (x),Y) are the loss function values of the jth and j-1th iterations, respectively, F j (x) and F j-1 (x) are the target values corresponding to the jth and j-1th samples, and Y is the true target value of the sample. The Focal Loss function is improved based on the standard multi-class cross-entropy loss function. By adding a dynamic scaling factor to the standard cross-entropy loss function, the model focuses on difficult-to-classify samples during the training process. The formula of the standard multi-class cross-entropy loss function is as follows: where p i represents the predicted probability of the i-th class output by the model, y i is the actual label; The Focal Loss function is based on the standard multi-class cross-entropy loss function, and introduces a dynamic scaling factor (1-p t ) γ to the Focal Loss calculation, where γ>0 is a tunable parameter. The Focal loss loss function formula is as follows: where (1-p t ) γ is the modulation coefficient to deal with the problem of difficult and easy classification samples. When a certain sample is misclassified, p t tends to 0, so the modulation coefficient tends to 1, which has no effect on the loss function. The FL loss function in the misclassified sample is the same as the standard cross-entropy function. When the sample is correctly classified, the modulation coefficient tends to 0, the loss function of the easy classification sample is weighted, and it tends to 0, which has little contribution to the total loss function. To address the imbalance of samples in each category in the dataset, a cross-entropy loss coefficient inversely proportional to the probability of occurrence of the target is used for correction. Therefore, the balanced cross-entropy function is introduced to improve the Focal Loss function. The formula of the balanced cross-entropy function is as follows: The improved Focal Loss loss function formula is as follows: where a i is an inverse proportion weight defined as: where M is the total number of samples, C is the number of classes, M i is the number of samples in the i-th class. The improved Focal Loss function is combined with the multi-class balanced cross-entropy function, and the improved Focal Loss function is used as the loss function of the LightGBM model.

5. The network intrusion detection method based on the improved binary simulated annealing algorithm according to claim 4, characterized in that, In step S3, the TPE optimization algorithm optimizes the parameters of the improved network intrusion detection model, i.e.: The optimization process can be represented by the following equation, where the configuration space X contains all the hyperparameters to be optimized, and by continuously adjusting the hyperparameters of the model, a set of optimal values x can be obtained * : x * = argmin f(x); where f(x) is the objective function, x * is the set of hyperparameters in X that minimizes the objective function f(x); The TPE optimization algorithm models p(x|y) and p(y) instead of a single modeling of p(y|x); where p(y) represents the distribution of solutions, and p(x|y) represents the distribution of parameters x given the solution; In addition, the optimization standard EI is introduced to guide the search of the configuration space X. The calculation of p(x|y) is as follows: where y' is a defined threshold, l(x) represents the density estimation value of the loss function of the observation value x(i) less than y', and g(x) represents the density composition of the loss function of the observation value x(i) greater than y'; To avoid falling into a local optimal solution during optimization, it is necessary to ensure that all promising configuration regions can be traversed. EI is understood as the improvement amplitude of the solution corresponding to the new hyperparameters relative to the threshold y', i.e. the definition of EI is as follows: By transforming p(y\x), and constructing the functions γ = p(y' - y) and p(x) = ∫ R p(x\y)p(y)dy: In the formula, in the process of maximizing EI to find better hyperparameters, EI should be iterated step by step to make smaller values, that is, to approximate l(x) with the maximum probability and g(x) with the minimum probability. Repeat the above steps until the maximum number of iterations is reached, and complete the optimization of the parameters of the improved network intrusion detection model.

Images