Construction method of network intrusion detection model based on self-encoding prototype network

Abstract

The invention discloses a method for constructing a network intrusion detection model based on a self-encoding prototype network, which comprises the following steps of: constructing a self-encoding prototype network model by using a decoder part in a self-encoder, and reconstructing original characteristics of input traffic in a high-dimensional space to obtain category prototype representation with higher discrimination; training the self-encoding prototype network model by using the open source network flow data to obtain an open source network intrusion detection model; and performing iterative optimization on the open source network intrusion detection model by using the target network flow data to obtain a target network intrusion detection model. According to the method, the internal network environment is effectively defended under the condition that the traffic data is scarce, so that the risk of carrying out an attack test on the internal network is avoided, and the migration capability of the network intrusion detection model in different network environments is effectively improved; and meanwhile, in a high-dimensional space, the model can better realize a clustering effect, so that the classification performance and generalization of the intrusion detection model based on the prototype network are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method for constructing a network intrusion detection model based on a self-encoding prototype network. Background Art

[0002] With the rapid development of the Internet and artificial intelligence, network intrusions and malicious behaviors have become increasingly rampant. Network Intrusion Detection System (NIDS) has become an essential means of protection against the growing number of network attacks, providing vital protection for users' network communication security. However, the problem of internal network environments in various fields being attacked remains severe. Attackers develop targeted attack plans targeting the business logic and network environment within specific fields, which may cause significant damage to the information systems of enterprises and government agencies.

[0003] In view of the problem of intelligent network intrusion detection in different network environments, current research mainly focuses on the following methods. First, the detection effect of artificial intelligence models is improved through sampling methods, but downsampling technology will inevitably lead to information loss, and oversampling to generate artificial samples may cause problems such as overfitting and data noise. Secondly, the transfer learning method can use common Internet attack traffic as prior knowledge to train the model, and then migrate it to the corresponding field network environment to fine-tune the model to achieve attack detection, but this method also relies on a large amount of external attack traffic data. The meta-learning method is based on the idea of ​​transfer learning, focusing on achieving the migration effect of the model through a small number of samples as prior knowledge, but this method relies on a higher physical configuration of the detector.

[0004] Conventional intrusion detection systems cannot effectively protect specific intranet environments. The fundamental reason is that the traffic within the network is different from regular Internet traffic. It is difficult to deal with unknown attacks through expert rule protection, and the cost is huge. At the same time, the imbalance of internal network data is very serious. Network intrusions and malicious behaviors usually only account for a small part of all network traffic or even have no relevant samples, making it difficult to directly train deep learning defense models.

[0005] The advantage of the small sample learning method based on the prototype network is that it only requires a small number of labeled samples for effective training, so it has obvious advantages in small sample tasks. However, when applied to network intrusion detection models, directly using the prototype network will face problems such as weak generalization ability.

[0006] Therefore, a method for constructing a network intrusion detection model based on self-encoding prototype network is proposed to solve the above problems. Summary of the invention

[0007] In view of the above problems, the purpose of the present invention is to provide a method for constructing a network intrusion detection model based on an autoencoder prototype network. By using the decoder in the autoencoder and combining it with the prototype network, the internal network environment can be effectively defended when traffic data is scarce, thereby improving the classification performance and generalization of the traditional intrusion detection model. The technical solution is as follows:

[0008] The method for constructing a network intrusion detection model based on an autoencoder prototype network includes the following steps:

[0009] Step S1, collecting open source network traffic data and preprocessing the open source network traffic data;

[0010] Step S2, constructing an autoencoder prototype network model, including: the prototype network forms an embedding function through a model based on a decoder in the autoencoder; the embedding function maps the input traffic feature to an embedding space to obtain a high-dimensional embedding representation of the input traffic feature;

[0011] Step S3: Use the preprocessed open source network traffic data to train the autoencoder prototype network model to obtain an open source network intrusion detection model;

[0012] Step S4: collecting target network traffic data and preprocessing the target network traffic data;

[0013] Step S5: Use the preprocessed target network traffic data to iteratively optimize the open source network intrusion detection model to obtain a target network intrusion detection model for malicious traffic classification of the target network.

[0014] Furthermore, in step S1, the preprocessing of the open source network traffic data specifically includes the following steps:

[0015] S11, split the data according to the attack category and divide it into a training set;

[0016] S12, extracting and screening features from training set samples;

[0017] S13, dividing the support set and the query set according to the training set samples;

[0018] S14, replace the infinite values ​​and empty data in the training set sample data with 0;

[0019] S15, normalizing and standardizing the training set sample data;

[0020] S16. Divide the training tasks according to the processed support set and query set samples.

[0021] Furthermore, the step S3 specifically includes the following steps:

[0022] S31, initialize the autoencoder prototype network model;

[0023] S32. Input the preprocessed open source network traffic data into the autoencoder prototype network model. The support set samples and query set samples are expanded into high-dimensional embedding representations through the decoder in the autoencoder. The high-dimensional embedding mean of the same category samples in the support set is calculated and used as the prototype representation of this category. The calculation formula is as follows:

[0024] c k =(1 / |n k |)∑f(x)

[0025] In the formula, c k is the prototype representation of the k-th traffic type, x is the support set sample, f(x) is the high-dimensional embedding representation of the support set sample, n k is the total number of samples of the kth type of traffic in the support set;

[0026] S33. Calculate the Euclidean distance between the high-dimensional embedding representation of the query set sample and the prototype representation of each category to obtain the probability that the sample belongs to each category. The calculation formula is as follows:

[0027]

[0028] In the formula, p φ (y=k|q) is the classification probability that the query set sample q is of category k, q is the query set sample, f(q) is the high-dimensional embedding representation of the query set sample, c k is the prototype representation of the k-th traffic, k′ is the index of the existing prototype representation in the open source network, c k ′ is the k′th prototype representation among the existing prototype representations in the open source network, and the function exp is an exponential function with the natural constant e as the base;

[0029] S34. Minimize the cross entropy of the classification probability by the stochastic gradient descent method and obtain the loss function L(φ):

[0030] L(φ)=-logp φ (y=k|q)

[0031] S35, optimizing the model through an optimizer;

[0032] S36. The autoencoder prototype network model is cyclically trained according to the training batches of the training task to obtain an open source network intrusion detection model.

[0033] Furthermore, the step S4 specifically includes the following steps:

[0034] S41, customize the number of iterations Update_Steps according to the total number of target network traffic data and the minimum number of samples that support a valid update of the model;

[0035] S42, collecting target network traffic data;

[0036] S43, splitting the data according to attack categories;

[0037] S44, extracting and screening features for all samples;

[0038] S45, dividing the support set and the query set according to the number of iterations Update_Steps;

[0039] S46, uniformly replace infinite values ​​and empty data in the sample data with 0;

[0040] S47, normalizing and standardizing the sample data;

[0041] S48. Divide the training tasks according to the processed support set and query set samples.

[0042] Furthermore, the step S41 specifically includes the following steps:

[0043] S411, determining the total number of target network traffic data, the total number of categories of target network traffic data, the minimum number of support set samples for each category, and the minimum number of query set samples for each category;

[0044] S412. Calculate the minimum number of samples that support a valid update of the model. The calculation formula is as follows:

[0045] T = N' × (s + q')

[0046] Where T is the minimum number of samples that support an effective update of the model, N′ is the total number of categories of the target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category.

[0047] S413. Calculate the maximum number of iterations based on the total number of target network traffic data and the minimum number of samples that support one effective update of the model. The calculation formula is as follows:

[0048]

[0049] Where Update_Steps max is the maximum number of iterations, M is the total number of target network traffic data, T is the minimum number of samples that support an effective update of the model, Indicates that no more than The largest integer of ;

[0050] S414, Update_Steps according to the maximum number of iterations max , customize the number of iterations Update_Steps.

[0051] Furthermore, in step S45, the total number of samples in the divided support set and query set are respectively:

[0052] M s =Update_Steps×N′×s

[0053] M q′ =Update_Steps×N′×q′

[0054] Where M s is the total number of support set samples, M q′ is the total number of query set samples, Update_Steps is the number of iterations, N′ is the total number of categories of the target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category.

[0055] Furthermore, the step S5 comprises:

[0056] S51, inputting the preprocessed target network traffic data into an open source network intrusion detection model;

[0057] S52, obtaining high-dimensional embedding representations of support set samples and query set samples, and using the same formula in step S32 to calculate the high-dimensional embedding mean of samples of the same category in the support set as the prototype representation of the corresponding category;

[0058] S53, obtaining the same loss function in the same manner as steps S33 and S34, iteratively optimizing the open source network intrusion detection model, and obtaining the target network intrusion detection model;

[0059] S54. After the model is updated, the Euclidean distance between the sample to be tested and the prototype representation of each category is calculated. The formula is as follows:

[0060] D jk″ =∑||T j , c k″ || 2

[0061] Where, T j is the sample to be tested, c k″ is the prototype representation of the k″ type of traffic, D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between

[0062] S55. Obtain the predicted category of the sample to be tested, that is, the category index of the minimum Euclidean distance:

[0063]

[0064] In the formula, is the predicted category of the sample to be tested, k″ is the index of all existing category prototype representations in the open source network and the target network, and D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between Indicates D jk″ The value of k″ that obtains the minimum value;

[0065] S56. According to the predicted category and the real category of the sample to be tested, the detection accuracy of the target network intrusion detection model in the target network environment is calculated. The calculation formula is as follows:

[0066]

[0067] In the formula, acc is the detection accuracy, is the predicted category of the sample to be tested, y j is the true category of the sample to be tested, j is the number of the sample to be tested, and N is the total number of samples to be tested.

[0068] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0069] 1. The present invention constructs an autoencoder prototype network model based on a joint architecture of an autoencoder and a prototype network; uses traffic data in an open source network to train the autoencoder prototype network model to obtain an open source network intrusion detection model; and then uses traffic data in a target network to iteratively optimize the open source network intrusion detection model to obtain a target network intrusion detection model. This achieves effective defense of the internal network environment when traffic data is scarce, avoids the risk of attack testing in the intranet, improves the overall security of enterprises and related units, effectively improves the migration capability of network intrusion detection models in different network environments, and promotes the development of network security protection systems.

[0070] 2. The present invention uses the autoencoder decoder to expand the original features of the traffic layer by layer, reconstruct the original features of the traffic in high-dimensional space, and obtain a new feature embedding representation. Combined with the prototype network, it can obtain prototype representations of different categories that are farther away from each other and more discriminative. Therefore, in high-dimensional space, the model can better achieve clustering effects, thereby improving the classification performance and generalization of the intrusion detection model based on the prototype network. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 This is a framework diagram of the method for building a target network intrusion detection model.

[0072] Figure 2 Construct a flowchart for the autoencoder prototype network model.

[0073] Figure 3 This is a flow chart of network traffic data processing.

[0074] Figure 4 Flowchart for training the autoencoder prototype network model.

[0075] Figure 5 This is the migration flow chart of the intrusion detection model in the target network environment. DETAILED DESCRIPTION

[0076] The technical solution of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the present invention, so as to have a further understanding of the concept of the present invention, the technical problems solved, the technical features constituting the technical solution and the technical effects brought about.

[0077] In order to improve the migration capability of network intrusion detection models and further enhance the generalization of intrusion detection systems, the present invention uses a technical solution for migration training and testing of self-encoding prototype network models to demonstrate how to use multiple open source data sets to simulate different network environments and train self-encoding prototype network models, thereby achieving model adaptation and attack detection in new network environments.

[0078] Embodiment 1:

[0079] like Figure 1 to Figure 5 As shown, the method for constructing a network intrusion detection model based on a self-encoding prototype network includes the following steps:

[0080] S1. Collect open source network traffic data and pre-process the open source network traffic data;

[0081] Collect open source network traffic data;

[0082] Specifically, in this embodiment, multiple open source network data sets are collected to simulate the migration of the model in different network environments during training, including two open source network data sets: UNSWNB15 and CICIDS2017.

[0083] Preprocess the collected open source network traffic data;

[0084] Specifically, in this embodiment, the collected data is integrated through methods in the SkLearn and Pandas libraries, and the data is standardized and normalized, and then the data is packaged to ensure that the model can obtain correct input.

[0085] like Figure 3 As shown in the figure, the preprocessing of open source network traffic data specifically includes the following steps:

[0086] S11, split the data according to the attack category and divide it into a training set;

[0087] The dataset was split by category, and attack categories with less than 2,000 samples were removed. 5,000 samples were randomly selected from each category, and all samples were selected if the number was less than 5,000.

[0088] The traffic types reserved for model training and testing are as follows: normal traffic, DDoS attacks, fuzz testing, protocol analysis, backdoor exploits, vulnerability exploits, common password attacks, flood attacks implemented by GoldenEye, flood attacks implemented by Hulk, flood attacks implemented by SlowHttpTest, flood attacks implemented by Slowloris, FTP brute force attacks, SSH brute force attacks, and port scanning.

[0089] S12, extracting and screening features from training set samples;

[0090] A total of 7 features, including traffic ID, source IP address, source port number, destination IP address, destination port number, protocol type and timestamp, are eliminated, and only features related to traffic and data packets are retained.

[0091] S13, dividing the support set and the query set according to the training set samples;

[0092] 1000 data from each category of CICIDS2017 and UNSWNB15 datasets are extracted as support sets in training, and 200 data as query sets for model training.

[0093] S14. Replace the infinite values ​​and empty data in the training set sample data with 0.

[0094] S15, normalizing and standardizing the training set sample data;

[0095] The data were normalized using MinMaxScaler and standardized using StandardScaler.

[0096] S16, dividing the training tasks according to the processed support set and query set samples;

[0097] Each training batch contains m classification tasks. The task content is to select K data from each category of n types of samples for model training, and then use Q data for testing; therefore, n×K data are selected as the support set for training, and n×Q data are selected as the query set for query, as a training task;

[0098] The support set and query set data in the same task come from the same training data set. In different training rounds, the model will perform traffic classification tasks in different network environments, thereby simulating the model migration process during training.

[0099] S2. Constructing an autoencoder prototype network model; the autoencoder prototype network model includes a decoder in the autoencoder and a prototype network connected thereto; wherein the decoder is used to obtain a high-dimensional embedding representation of the input traffic data;

[0100] Specifically, in this embodiment, Figure 2 As shown, the prototype network is embedded with a learnable parameter Ω Calculate the Y-dimensional embedding representation of the input traffic feature; the embedding function F(·) is specifically implemented by a model based on the decoder in the autoencoder. The model consists of three linear layers, which expands the dimension input_size of the input traffic feature to 128 dimensions, then expands the 128-dimensional data to 256 dimensions, and finally expands to a high-dimensional space of 512 dimensions to obtain a high-dimensional embedding representation of the input traffic feature, and then performs prototype fitting and classification; the linear layers are connected by ReLU activation functions;

[0101] From the perspective of the prototype network, the ideal model should make the feature vectors of the same category as close as possible, and the feature vectors of different categories as far apart as possible. Since the high-dimensional space is more sparse, the present invention innovatively uses the decoder part of the autoencoder to expand the original features of the input traffic layer by layer, reconstruct the original features of the input traffic in the high-dimensional space, and obtain a new feature embedding representation, which can obtain prototype representations of different categories that are farther away from each other and more discriminative. Therefore, in the high-dimensional space, the model can better achieve the clustering effect, thereby improving the classification performance and generalization of the intrusion detection model based on the prototype network.

[0102] S3, using the preprocessed open source network traffic data to train the autoencoder prototype network model to obtain an open source network intrusion detection model;

[0103] like Figure 4 As shown, step S3 specifically includes the following steps:

[0104] S31, initialize the autoencoder prototype network model;

[0105] Initialize the autoencoder prototype network model in PrototypicalNetwork, where the autoencoder prototype network model includes an autoencoder and a prototype network for high-dimensional embedding acquisition.

[0106] S32. Input the preprocessed open source network traffic data into the autoencoder prototype network model. The support set samples and query set samples are expanded into 512-dimensional high-dimensional embedding representations through the decoder in the autoencoder. The high-dimensional embedding mean of the same category samples in the support set is calculated and used as the prototype representation of this category. The calculation formula is as follows:

[0107] c k =(1 / |n k |)∑f(x)

[0108] In the formula, c k is the prototype representation of the k-th traffic type, x is the support set sample, f(x) is the high-dimensional embedding representation of the support set sample, n k is the total number of samples of the k-th traffic type in the support set.

[0109] S33. Calculate the Euclidean distance between the high-dimensional embedding representation of the query set sample and the prototype representation of each category to obtain the probability that the sample belongs to each category. The calculation formula is as follows:

[0110]

[0111] In the formula, p φ (y=k|q) is the classification probability that the query set sample q is of category k, q is the query set sample, f(q) is the high-dimensional embedding representation of the query set sample, c k is the prototype representation of the kth type of traffic, k′ is the index of the existing prototype representation of the category in the open source network, and c k ′ is the k′th prototype representation among the existing prototype representations in the open source network, and the function exp is an exponential function with the natural constant e as the base;

[0112] The loss function is calculated based on the probability that a random sample q in the query set is correctly classified into the corresponding category. The embedded representation f(q) obtained by the prototype generation network is then calculated from the Euclidean distance between the sample q and the known prototype to obtain the probability p that the sample q is of category k. φ (y=k|q).

[0113] S34. Use prototypical_loss to configure the traffic prototype to generate the model loss function. Use the stochastic gradient descent method to minimize the cross entropy of the classification probability and obtain the loss function L(φ):

[0114] L(φ)=-logp φ (y=k|q)

[0115] S35. Use Adam to configure the self-flow prototype to generate a model optimizer, and optimize the model through the optimizer.

[0116] S36, cyclically training the autoencoder prototype network model according to the training batch of the training task to obtain an open source network intrusion detection model;

[0117] The self-encoding prototype network model is built using the PyTorch library. The model with the best performance on the query set will be saved for subsequent attack detection in the target network environment.

[0118] S4, collecting target network traffic data and preprocessing the target network traffic data, specifically including the following steps:

[0119] S41, according to the total number of target network traffic data and the minimum number of samples that support a valid update of the model, customize the number of iterations Update_Steps, including the following steps:

[0120] S411, determining the total number of target network traffic data, the total number of categories of target network traffic data, the minimum number of support set samples for each category, and the minimum number of query set samples for each category;

[0121] The minimum number of support set samples for each category is determined by the specific amount of data in the target network environment, and usually 1, 2, 5 or 10 flows can be used; the minimum number of query set samples for each category is generally the same as the minimum number of support set samples for each category, or it can be more, but usually 15 flows are sufficient to support the effective update of the prototype.

[0122] S412. Calculate the minimum number of samples that support a valid update of the model. The calculation formula is as follows:

[0123] T = N' × (s + q')

[0124] Where T is the minimum number of samples that support an effective update of the model, N′ is the total number of categories of the target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category.

[0125] S413. Calculate the maximum number of iterations based on the total number of target network traffic data and the minimum number of samples that support one effective update of the model. The calculation formula is as follows:

[0126]

[0127] Where Update_Steps max is the maximum number of iterations, M is the total number of target network traffic data, T is the minimum number of samples that support an effective update of the model, Indicates that no more than The maximum integer.

[0128] S414, Update_Steps according to the maximum number of iterations max , customize the number of iterations Update_Steps;

[0129] The present invention customizes the adaptation progress of the model in the target network environment according to the smaller amount of data in the target network environment by setting the iteration number Update_Steps variable; a small number of iterations, that is, a small amount of data, can enable the model to effectively detect malicious traffic; the customized number of iterations allows the effect of malicious traffic detection to be achieved through a small number of iterations when samples are insufficient, thereby improving the flexibility of the method and the adaptability of migration.

[0130] S42, collecting target network traffic data;

[0131] Specifically, in this embodiment, the data in the CICIDS2018 dataset is taken as an example to test the model migration effect in the target network environment, and part of the traffic is intercepted for model fine-tuning and testing;

[0132] S43. Split the data according to attack categories.

[0133] S44, extracting and screening features from samples of the training set;

[0134] The features of the PCAP data packets in the target network environment are extracted by running the CICFlowMeter tool through the script; a total of 7 features including flow ID, source IP address, source port number, destination IP address, destination port number, protocol type and timestamp are eliminated, and only features related to flow and data packets are retained.

[0135] S45, divide the support set and the query set according to the number of iterations Update_Steps, and the remaining traffic can be used as a test set; wherein the total number of samples of the divided support set and query set are respectively:

[0136] M s =Update_Steps×N′×s

[0137] M q′ =Update_Steps×N′×q′

[0138] Where M s is the total number of support set samples, Mq′ is the total number of query set samples, Update_Steps is the number of iterations, N′ is the total number of categories of target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category;

[0139] In each iteration round, the model constructs N′ types of prototypes based on N′×s traffic lines, and then uses N′×q′ data to update the model parameters.

[0140] S46. Replace the infinite values ​​and empty data in the sample data with 0.

[0141] S47. Normalize and standardize the sample data.

[0142] S48. Divide the training tasks according to the processed support set and query set samples.

[0143] S5, such as Figure 5 As shown, the open source network intrusion detection model is iteratively optimized using the preprocessed target network traffic data, and the migration of the intrusion detection model from the open source data set to the target data set is realized, and the target network intrusion detection model is obtained, which is used for malicious traffic classification of the target network;

[0144] Step S5 includes:

[0145] S51, inputting the preprocessed target network traffic data into an open source network intrusion detection model.

[0146] S52, obtaining high-dimensional embedding representations of support set samples and query set samples, and using the same formula in step S32, calculating the high-dimensional embedding mean of samples of the same category in the support set as the prototype representation of the corresponding category.

[0147] S53, obtaining the same loss function in the same manner as steps S33 and S34, iteratively optimizing the open source network intrusion detection model, and obtaining the target network intrusion detection model.

[0148] S54. After the model is updated, the Euclidean distance between the sample to be tested and the prototype representation of each category is calculated. The formula is as follows:

[0149] D jk″ =∑||T j , c k″ || 2

[0150] Where, T j is the sample to be tested, c k″ is the prototype representation of the k″ type of traffic, D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between .

[0151] S55. Obtain the predicted category of the sample to be tested, that is, the category index of the minimum Euclidean distance:

[0152]

[0153] In the formula, is the predicted category of the sample to be tested, k″ is the index of all existing category prototype representations in the open source network and the target network, and D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between Indicates D jk″ The value of k″ that obtains the minimum value.

[0154] S56. According to the predicted category and the real category of the sample to be tested, the detection accuracy of the target network intrusion detection model in the target network environment is calculated. The calculation formula is as follows:

[0155]

[0156] In the formula, acc is the detection accuracy, is the predicted category of the sample to be tested, y j is the true category of the sample to be tested, j is the number of the sample to be tested, and N is the total number of samples to be tested.

[0157] The experimental results show that in the CICIDS2018 dataset, before the prototype iteration, after taking 5 samples from each class for prototype generation, the accuracy of model detection is only 48.78%, indicating that the model trained in other network environments is difficult to be directly applied to the new network environment. After one iteration, the accuracy reaches 65.75%, which has been significantly improved; when 50 samples from each class are taken for prototype calculation, the original accuracy before iteration is 50.76%, while the accuracy after one iteration reaches 75.25%, and the accuracy after 5 iterations reaches 85.99%. It can be seen that this method can effectively defend the internal network environment when traffic data is scarce, avoid the risk of attack testing in the intranet, improve the overall security of enterprises and related units, effectively improve the migration ability of network intrusion detection models in different network environments, and promote the development of network security protection systems.

[0158] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for constructing a network intrusion detection model based on a self-encoding prototype network, characterized in that: The following steps are involved: Step S1, collecting open source network traffic data and preprocessing the open source network traffic data; Step S2, constructing an autoencoder prototype network model, including: the prototype network forms an embedding function through a model based on a decoder in the autoencoder; the embedding function maps the input traffic feature to an embedding space to obtain a high-dimensional embedding representation of the input traffic feature; Step S3: Use the preprocessed open source network traffic data to train the autoencoder prototype network model to obtain an open source network intrusion detection model; Step S4: collecting target network traffic data and preprocessing the target network traffic data; Step S5: Use the preprocessed target network traffic data to iteratively optimize the open source network intrusion detection model to obtain a target network intrusion detection model for malicious traffic classification of the target network.

2. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 1, characterized in that: In step S1, the preprocessing of open source network traffic data specifically includes the following steps: S11, split the data according to the attack category and divide it into a training set; S12, extracting and screening features from training set samples; S13, dividing the support set and the query set according to the training set samples; S14, replace the infinite values ​​and empty data in the training set sample data with 0; S15, normalizing and standardizing the training set sample data; S16. Divide the training tasks according to the processed support set and query set samples.

3. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 1, characterized in that: The step S3 specifically comprises the following steps: S31, initialize the autoencoder prototype network model; S32. Input the preprocessed open source network traffic data into the autoencoder prototype network model. The support set samples and query set samples are expanded into high-dimensional embedding representations through the decoder in the autoencoder. The high-dimensional embedding mean of the same category samples in the support set is calculated and used as the prototype representation of this category. The calculation formula is as follows: c k =(1 / |n k |)∑f(x) In the formula, c k is the prototype representation of the k-th traffic type, x is the support set sample, f(x) is the high-dimensional embedding representation of the support set sample, n k is the total number of samples of the kth type of traffic in the support set; S33. Calculate the Euclidean distance between the high-dimensional embedding representation of the query set sample and the prototype representation of each category to obtain the probability that the sample belongs to each category. The calculation formula is as follows: In the formula, p φ (y=k|q) is the classification probability that the query set sample q is of category k, q is the query set sample, f(q) is the high-dimensional embedding representation of the query set sample, c k is the prototype representation of the kth type of traffic, k′ is the index of the existing prototype representation of the category in the open source network, and c k′ is the k′th prototype representation among the existing prototype representations in the open source network, and the function exp is an exponential function with the natural constant e as the base; S34. Minimize the cross entropy of the classification probability by the stochastic gradient descent method to obtain the loss function L(φ): L(φ)=-logp φ (y=k|q) S35, optimizing the model through an optimizer; S36. The autoencoder prototype network model is cyclically trained according to the training batches of the training task to obtain an open source network intrusion detection model.

4. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 1, characterized in that: The step S4 specifically comprises the following steps: S41, customize the number of iterations Update_Steps according to the total number of target network traffic data and the minimum number of samples that support a valid update of the model; S42, collecting target network traffic data; S43, splitting the data according to attack categories; S44, extracting and screening features for all samples; S45, dividing the support set and the query set according to the number of iterations Update_Steps; S46, uniformly replace infinite values ​​and empty data in the sample data with 0; S47, normalizing and standardizing the sample data; S48. Divide the training tasks according to the processed support set and query set samples.

5. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 4, characterized in that: The step S41 specifically includes the following steps: S411, determining the total number of target network traffic data, the total number of categories of target network traffic data, the minimum number of support set samples for each category, and the minimum number of query set samples for each category; S412. Calculate the minimum number of samples that support a valid update of the model. The calculation formula is as follows: T = N' × (s + q') Where T is the minimum number of samples that support an effective update of the model, N′ is the total number of categories of the target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category. S413. Calculate the maximum number of iterations based on the total number of target network traffic data and the minimum number of samples that support one effective update of the model. The calculation formula is as follows: Where Update_Steps max is the maximum number of iterations, M is the total number of target network traffic data, T is the minimum number of samples that support an effective update of the model, Indicates that no more than The largest integer of ; S414, Update_Steps according to the maximum number of iterations max , customize the number of iterations Update_Steps.

6. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 5, characterized in that: In step S45, the total number of samples in the divided support set and query set are respectively: M s =Update_Steps×N′×s M q′ =Update_Steps×N′×q′ Where M s is the total number of support set samples, M q′ is the total number of query set samples, Update_Steps is the number of iterations, N′ is the total number of categories of the target network traffic data, s is the minimum number of support set samples for each category, and q′ is the minimum number of query set samples for each category.

7. The method for constructing a network intrusion detection model based on a self-encoding prototype network as claimed in claim 1, characterized in that: The step S5 comprises: S51, inputting the preprocessed target network traffic data into an open source network intrusion detection model; S52, obtaining high-dimensional embedding representations of support set samples and query set samples, and using the same formula in step S32 to calculate the high-dimensional embedding mean of samples of the same category in the support set as the prototype representation of the corresponding category; S53, obtaining the same loss function in the same manner as steps S33 and S34, iteratively optimizing the open source network intrusion detection model, and obtaining the target network intrusion detection model; S54. After the model is updated, the Euclidean distance between the sample to be tested and the prototype representation of each category is calculated. The formula is as follows: D ik″ =∑||T j ,c k″ || 2 Where, T j is the sample to be tested, c k″ is the prototype representation of the k″ type of traffic, D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between S55. Obtain the predicted category of the sample to be tested, that is, the category index of the minimum Euclidean distance: In the formula, is the predicted category of the sample to be tested, k″ is the index of all existing category prototype representations in the open source network and the target network, and D jk″ is the sample to be tested T j Prototype characterization of the k″th traffic type c k″ The Euclidean distance between Indicates D jk″ The value of k″ that obtains the minimum value; S56. According to the predicted category and the real category of the sample to be tested, the detection accuracy of the target network intrusion detection model in the target network environment is calculated. The calculation formula is as follows: In the formula, acc is the detection accuracy, is the predicted category of the sample to be tested, y j is the true category of the sample to be tested, j is the number of the sample to be tested, and N is the total number of samples to be tested.

Images