Data feature extraction method and system based on combined kernel sparse auto-encoder

Abstract

The invention provides a data feature extraction method and system based on a combined kernel sparse auto-encoder, and relates to the technical field of network communication security detection. After a first data set and a second data set are obtained, a combined kernel function is constructed to obtain a third data set, then the third data set is utilized to train a sparse auto-encoder, parameters are updated to obtain a weight matrix and a sparse cost function, then a target function is constructed and solved, and the parameters are optimized based on an adaptive genetic algorithm. The objective function of the combined kernel sparse auto-encoder is optimized through an iteration method of the adaptive genetic algorithm, continuous crossing and variation are carried out, an optimal solution is solved, and a dimension reduction result is obtained. According to the method, the kernel technology and the sparse auto-encoder are combined, and the nonlinear structure and high-dimensional characteristics of the data are fully utilized, so that efficient extraction and dimension reduction processing of network security data features are realized, the effectiveness of feature extraction is improved, the robustness and accuracy of the model are enhanced, and the network security data analysis and processing capability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication security detection, and in particular to a data feature extraction method and system based on a combined kernel sparse autoencoder. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent and have become one of the important issues that need to be solved urgently. Feature extraction of network security data is a key step in the field of network security, and has an important impact on subsequent tasks such as anomaly detection and attack identification. However, traditional feature extraction methods often rely on manual experience and rules, and may not be able to capture all potential attack features, and are difficult to adapt to complex and changing network environments. The extracted features are often not accurate and comprehensive enough, and it is difficult to capture complex nonlinear relationships in the data.

[0003] In the prior art, based on the reality that labeled situation data is difficult to obtain, in order to avoid the BP neural network training from relying on labels, a situation assessment method based on a deep autoencoder network is proposed, and the situation data is trained in a semi-supervised learning manner to establish a situation assessment model. However, the assessment process requires the participation of professional and technical personnel, and there is a lack of analysis on the situation assessment effect, and the hardware requirements are relatively high. The deep autoencoder model classifies the network anomaly types. The proposed model has a high classification accuracy, but the data set used is not fully utilized and is not suitable for complex network environments. Summary of the invention

[0004] The main purpose of the present invention is to provide a data feature extraction method and system based on a combined kernel sparse autoencoder to solve at least one of the above technical problems.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: a data feature extraction method based on a combined kernel sparse autoencoder, The following steps are involved: Step 1: Acquire and parse the message data in the network communication process in real time, parse it according to a preset format, and save it to the first data set; Step 2: construct a second data set based on the preset statistical information of the data in the first data set and its corresponding features; Step 3: construct a combined kernel function to map the second data set to a high-dimensional data space, showing a linearly separable characteristic in the high-dimensional space, and save the mapped high-dimensional data as a third data set; Step 4: Use the third data set to train the sparse autoencoder model and retain the optimal sparse autoencoder model; Step 5: Construct the objective function to solve it, and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction. The objective function is as follows: ; in, is a weight function, β is a parameter in the sparse penalty cost function, Ωs is the sparse penalty term, is the loss function, and the formula is as follows: ; Among them, m is the number of training samples.

[0006] In the preferred embodiment, in step 5, optimizing the objective function parameters based on the adaptive genetic algorithm includes the following steps: S51: Initialize the population X and generate the initial population , including N individuals, calculate the corresponding fitness function value of each individual in the population Its fitness function uses the inverse of the root mean square error, and the chromosome encoding with the maximum fitness value corresponds to the optimal individual in the population ; S52: Select individuals with larger fitness values ​​from the population for crossover, and judge the crossover probability and mutation probability ; Early Evolution and The formula is: ; ; Late evolution and The formula is: ; ; in, and for and The initial value of, M is the number of individuals in the population whose individual fitness is greater than the average individual fitness of the population, and N is the total number of individuals in the population; S53: Calculate the fitness value of the offspring generated by the population and the maximum fitness value of all offspring in the population ; S54: Get the maximum fitness value among all offspring in the population ,make ,Will Update the chromosome encoding to the maximum fitness value; S55: repeat steps S52-S54 to perform fitness detection and evaluation; S56: Until The fitness value of the optimal individual is greater than the set limit, and the optimal solution is obtained; S57: Obtain the feature result of dimensionality reduction, and obtain the matrix after dimensionality reduction. The formula is: .

[0007] In the preferred embodiment, in step 5, the learning parameter selected based on the adaptive genetic algorithm optimization parameter is { },in , and is the parameter of the combined kernel function, and and are parameters in the sparse penalty cost function.

[0008] In the preferred scheme, in step 1, the message data of the network communication is parsed, specifically: according to the OSI seven-layer model of network communication, a layer-by-layer parsing method is adopted from bottom to top, and the parsed data includes source IP, source Mac, source port, destination IP, destination Mac, destination port, protocol and function code.

[0009] In the preferred scheme, in step 2, the preset statistical information of the data in the first data set and its corresponding characteristics, the preset statistical information includes statistics of the recent traffic from the current host IP, the recent traffic of the current host IP+MAC, the recent traffic from the current host to the target host, the traffic jitter from the current host to the target host and the recent traffic from the current host+port to the target host+port; the corresponding characteristics include data packet size, average value or variance.

[0010] In the preferred solution, in step 3, the combined kernel function is composed of a polynomial kernel function and a Gaussian radial basis kernel function, and the formulas are: The polynomial kernel function formula is: ; In the formula, and y are the feature vectors of the input samples, d is the degree of the polynomial, that is, the dimension of the feature space mapped to, T represents the matrix transpose operation, and k represents the kernel function; The Gaussian radial basis kernel function formula is: ; In the formula, and y are the feature vectors of the input samples, where σ is the parameter that controls the decay speed of the function, k represents the name of the kernel function, and exp represents the exponential power of e; The formula after combining the two is: ; In the formula, is a constant, a weight coefficient, whose value is between 0 and 1.

[0011] In the preferred solution, step 4: using a sparse autoencoder and performing model training includes: Divide the third data set into a training set and a test set, and perform data preprocessing; Initialize and set various parameters in the sparse encoder, including the number of nodes in the input layer and hidden layer, the training learning rate, sparse parameters, penalty weight parameters, weight matrix, batch training number and iterative training number in the forward algorithm; Inputting the training set after the data preprocessing into the sparse autoencoder model for iterative training, updating the parameters to obtain the weight matrix and the sparse cost function, until the number of iterative training times is reached, and saving the optimal sparse autoencoder model; The iterative training includes forward prediction of the sparse autoencoder model, calculating the loss function, and optimizing the sparse autoencoder model using back propagation and gradient descent methods.

[0012] The preferred solution also includes introducing a sparsity penalty term to make the activation of hidden layer neurons more sparse; The back propagation and gradient descent method is used to optimize the sparse autoencoder model, including: in the back propagation process, first calculating the reconstruction error, then calculating the gradient according to the reconstruction error, and updating the network parameters.

[0013] In the preferred solution, data preprocessing includes: First, redundant features are removed, then the data is normalized and missing values ​​are automatically filled.

[0014] A data feature extraction system based on a combined kernel sparse autoencoder, comprising: The original data set module is used to acquire and parse the message data of network communication in real time, parse it according to a preset format, and save it to the first data set; A nonlinear data set module, used to construct a second data set according to preset statistical information of data in the first data set and corresponding features thereof; A high-dimensional data set module, used to construct a combined kernel function, map the second data set to a high-dimensional data space, show a linearly separable property in the high-dimensional space, and save the high-dimensional data as a third data set; A model training module, used to perform model training on the sparse autoencoder using a third data set, and retain an optimal sparse autoencoder model; The objective function module is used to construct the objective function for solution and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction. The objective function is as follows: ; in, is the loss function, is a weight function, and , β is the parameter in the sparse penalty cost function, and Ωs is the sparse penalty term.

[0015] An electronic device comprises: a processor, a memory and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements a data feature extraction method based on a combined kernel sparse autoencoder.

[0016] A computer-readable storage medium comprises: a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, a data feature extraction method based on a combined kernel sparse autoencoder is implemented.

[0017] The present invention provides a data feature extraction method and device based on a combined kernel sparse autoencoder. After obtaining a first data set and a second data set, a combined kernel function is constructed to obtain a third data set, and then the sparse autoencoder is trained using the third data set, and the parameters are updated to obtain a weight matrix and a sparse cost function, and then the objective function is constructed and solved, and the parameters are optimized based on an adaptive genetic algorithm, and the objective function of the combined kernel sparse autoencoder is optimized by an iterative method of the adaptive genetic algorithm, and the optimal solution is obtained by continuous crossover and mutation, and the dimensionality reduction result is obtained. The present invention combines kernel technology and sparse autoencoders, and makes full use of the nonlinear structure and high-dimensional characteristics of data, thereby realizing efficient extraction and dimensionality reduction processing of network security data features, and improving the effectiveness of feature extraction. The sparse autoencoder is combined with the genetic algorithm to optimize the parameters, which can further improve the effect of feature selection and dimensionality reduction, reduce the feature dimension while retaining important information, enhance the robustness and accuracy of the model, more effectively handle the complex distribution and nonlinear relationship in the data, and improve the ability of network security data analysis and processing, and is suitable for the detection of common complex patterns and abnormal behaviors in network security data. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The present invention will be further described below in conjunction with the accompanying drawings and embodiments: Figure 1 is a flow chart of the method of the present invention; Figure 2 It is a schematic diagram of the overall feature extraction process of the method of the present invention; Figure 3 It is a schematic diagram of the sparse autoencoder structure of the present invention; Figure 4 It is a schematic diagram of the sample data collection network topology structure of the present invention. DETAILED DESCRIPTION

[0019] Example 1 like Figure 1-4As shown, a data feature extraction method based on a combined kernel sparse autoencoder comprises the following steps: S1: Acquire and parse message data in the network communication process in real time, parse it according to a preset format, and save it to the first data set D1.

[0020] S2: construct a second data set D2 according to preset statistical information of the data in the first data set and its corresponding features.

[0021] S3: Construct a combined kernel function to map the second data set to a high-dimensional data space, show a linearly separable property in the high-dimensional space, and save the high-dimensional data as a third data set D3.

[0022] S4: Use D3 to train the sparse autoencoder model and retain the optimal sparse autoencoder model.

[0023] S5: Construct an objective function to solve it, and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction, where the objective function is as follows: ; in, is the loss function, is a weight function, and , β is the parameter in the sparse penalty cost function, and Ωs is the sparse penalty term.

[0024] In this embodiment, after obtaining D1 and D2, a combined kernel function is constructed to obtain D3, and then D3 is used to train the sparse autoencoder, the parameters are updated to obtain the weight matrix and the sparse cost function, and then the objective function is constructed and solved, and the parameters are optimized based on the adaptive genetic algorithm. The objective function of the combined kernel sparse autoencoder is optimized by the iterative method of the adaptive genetic algorithm, and the crossover and mutation are continuously performed to find the optimal solution to obtain the dimensionality reduction result; this embodiment combines the kernel technology and the sparse autoencoder, and makes full use of the nonlinear structure and high-dimensional characteristics of the data, so as to realize the efficient extraction and dimensionality reduction of network security data features, and improve the effectiveness of feature extraction. The sparse autoencoder is combined with the genetic algorithm to optimize the parameters, which can further improve the effect of feature selection and dimensionality reduction, reduce the feature dimension while retaining important information, enhance the robustness and accuracy of the model, and more effectively handle the complex distribution and nonlinear relationship in the data, and improve the ability of network security data analysis and processing, which is suitable for the detection of common complex patterns and abnormal behaviors in network security data.

[0025] The three data sets used in this embodiment are specifically: D1 is the system real-time acquisition and analysis of the original message data of the network communication, and parses and saves it according to a preset format; D2 is a constructed nonlinear sample data set, and the characteristic information of the sample data is statistically analyzed based on the data of the first data set; D3 is a high-dimensional space data set obtained by using a combined kernel function to map the second data set to a high-dimensional space.

[0026] like Figure 3 As shown, it is a schematic diagram of the sample data collection network topology structure of this embodiment. The topology structure is derived from the network communication topology structure in a simulation environment. In the topology structure, the host and the attack host communicate with network devices such as cameras, servers, and printers through switch devices and send related network communication message data. A data collector is connected to the mirror port of the switch to collect the full amount of message data passing through the switch. At the same time, the data collector sends the collected data to the data analysis system, and the data analysis system implements parsing and statistical analysis of the message data.

[0027] In the preferred scheme, in step S1, the message data of the network communication is parsed, specifically: according to the OSI seven-layer model of network communication, a layer-by-layer parsing method is adopted from bottom to top, and the parsed data includes source IP, source Mac, source port, destination IP, destination Mac, destination port, protocol and function code.

[0028] In the above step S1, the network communication message data is obtained and parsed by monitoring the network communication system, obtaining the network communication message data in the system, and parsing the original message data. The message data is not limited to the above data types.

[0029] In step S2, the preset statistical information of the data in D1 and its corresponding features, the preset statistical information includes statistics of the recent traffic from the current host IP, the recent traffic of the current host IP+MAC, the recent traffic from the current host to the target host, the traffic jitter from the current host to the target host and the recent traffic from the current host+port to the target host+port; the corresponding features include packet size, average value or variance.

[0030] In this embodiment, as shown in Table 1, each type of characteristic data information of the sample data is counted, and the characteristic attributes mainly include counting the recent traffic from the host (IP) of the packet, counting the recent traffic from the host (IP+MAC) of the packet, counting the recent traffic from the host (IP) of the packet to the target host of the packet, counting the traffic jitter from the host (IP) of the data packet to the target host of the data packet, and counting the recent traffic from the host + port (IP) of the packet to the target host + port of the packet.

[0031] Table 1 Sample data statistics

[0032] Furthermore, as shown in Table 2 below, for the above features, it is necessary to count the size, average value or variance and other information of each feature data packet. For the above attribute values, the attribute values ​​in different time units can be counted, for example: attribute values ​​in time windows such as 100 milliseconds, 500 milliseconds, 1 second, 30 seconds, and 1 minute.

[0033] Table 2 Data traffic characteristic structure

[0034] In the preferred solution, in step S3, the combined kernel function is composed of a polynomial kernel function and a Gaussian radial basis kernel function, and the formulas are: The polynomial kernel function formula is: ; In the formula, x and y are the feature vectors of the input samples, d is the degree of the polynomial, that is, the dimension of the feature space mapped to it, T represents the matrix transpose operation, and k represents the kernel function.

[0035] The Gaussian radial basis kernel function formula is: ; In the formula, x and y are the feature vectors of the input samples, where σ is the parameter that controls the decay speed of the function, k represents the name of the kernel function, and exp represents the exponential power of e.

[0036] The formula after combining the two is: ; In the formula, is a constant, a weight coefficient, whose value is between 0 and 1.

[0037] It is mainly used to adjust the size of the polynomial kernel function and Gaussian radial basis kernel function.

[0038] In this embodiment, a combined kernel function is constructed to map data from a low-dimensional space to a high-dimensional space. A single kernel function has the problems of insufficient adaptability, weak generalization ability, and certain limitations. The combined kernel function is used to map the nonlinear data set of the original sample to a high-dimensional data space.

[0039] like Figure 3As shown, the sparse autoencoder structure model used in this embodiment mainly includes an input layer, a hidden layer and an output layer. The number of neurons in the input layer and the output layer is the same as the dimension of the input data, and the number of neurons in the hidden layer can be adjusted as needed. The activation function of the hidden layer and the output layer usually uses a sigmoid function to achieve sparse representation.

[0040] In order to optimize the data extraction capability, this embodiment performs model training on the sparse autoencoder model.

[0041] In the sparse autoencoder training process, the encoding process from the input layer to the hidden layer distinguishes the sparse part of the data, adds sparsity constraints to the hidden layers with multiple layers, and suppresses the output of the hidden layer neurons. In the decoding process from the hidden layer to the output layer, the sparse parts are combined to reconstruct the input data. By adjusting the parameters in the encoder and decoder, the error between the output data and the input data is minimized, thereby obtaining a better reconstruction result.

[0042] In the preferred solution, step S4: adopting a sparse autoencoder model and performing model training includes: Divide the third data set into a training set and a test set, and perform data preprocessing; Initialize and set various parameters in the sparse encoder, including the number of nodes in the input layer and hidden layer, the training learning rate, sparse parameters, penalty weight parameters, weight matrix, batch training number and iterative training number in the forward algorithm; The training set after data preprocessing is input into the sparse autoencoder model for iterative training, and the parameters are updated to obtain the weight matrix and sparse cost function until the number of iterative training times is reached, and the optimal sparse autoencoder model is saved; Among them, the iterative training includes the sparse autoencoder model performing forward prediction, then calculating the loss function, and using backpropagation and gradient descent methods to optimize the sparse autoencoder model.

[0043] In this embodiment, the sparse autoencoder is trained. First, the parameters of the sparse autoencoder need to be initialized, including 784 input neurons, 200 hidden layer neurons, 784 output layer neurons, 0.1 sparsity parameter, 2 penalty factor, 0.4 training learning rate, 20 training iterations, and softplus activation function. Then the training data is mapped to a high-dimensional space, input into the training sparse autoencoder, and the average activation is calculated. , the formula is: ; In the formula, is the activation value of neuron j in the hidden layer.

[0044] The preferred scheme also includes introducing a sparsity penalty term to make the activation of hidden layer neurons more sparse; using back propagation and gradient descent methods to optimize the sparse autoencoder model, including: in the back propagation process, first calculating the reconstruction error, then calculating the gradient based on the reconstruction error, and updating the network parameters.

[0045] Among them, the sparse penalty term is calculated as follows: ; Execute the back propagation algorithm and update the parameters to obtain the weight matrix and sparse cost function.

[0046] During the back-propagation process, the reconstruction error is first calculated, which is the difference between the input data and the reconstructed data. Then, the gradient is calculated based on the reconstruction error and the network parameters are updated.

[0047] By enforcing sparse activation of hidden layer neurons, the sparse autoencoder can better capture the important features of the input data.

[0048] In the preferred solution, data preprocessing includes: First, redundant features are removed, then the data is normalized and missing values ​​are automatically filled.

[0049] In this embodiment, after the above processing, the data quality is optimized, the training efficiency and accuracy of the model are improved, and the generalization ability of the model is enhanced.

[0050] In the preferred embodiment, in step S5, the learning parameter selected based on the adaptive genetic algorithm optimization parameter is { },in , and is the parameter of the combined kernel function, and and are parameters in the sparse penalty cost function.

[0051] In the preferred embodiment, in step 5, optimizing the objective function parameters based on the adaptive genetic algorithm includes the following steps: S51: Initialize the population X and generate the initial population , including N individuals, calculate the corresponding fitness function value of each individual in the population Its fitness function uses the inverse of the root mean square error, and the chromosome encoding with the maximum fitness value corresponds to the optimal individual in the population .

[0052] S52: Select individuals with larger fitness values ​​from the population for crossover, and judge the crossover probability and mutation probability :If the evolution process is in the early stage of evolution, the larger and smaller ; If the evolution process is in the late stage of evolution, the smaller one is determined according to the late stage formula and larger .

[0053] Early Evolution and The formula is: ; ; Late evolution and The formula is: ; ; in, and for and The initial value of , M is the number of individuals in the population whose individual fitness is greater than the average individual fitness of the population, N is the total number of individuals in the population, and k is the value of the weight function.

[0054] S53: Calculate the fitness value of the offspring generated by the population and the maximum fitness value of all offspring in the population .

[0055] S54: Get the maximum fitness value among all offspring in the population ,make, ,Will Update to the chromosome encoding with the maximum fitness value.

[0056] S55: Repeat steps S52-S54 to perform fitness detection and evaluation.

[0057] S56: Until The fitness value of the optimal individual is greater than the set limit, and the optimal solution is obtained.

[0058] S57: Obtain the feature result of dimensionality reduction, and obtain the matrix after dimensionality reduction. The formula is: .

[0059] In the formula, i represents the characteristic result value of the jth sample in the i-th category.

[0060] Through the above steps S1-S5, the final dimensionality reduction feature result, that is, the matrix after dimensionality reduction, is obtained.

[0061] In this implementation, by combining kernel technology and sparse autoencoders, the nonlinear structure and high-dimensional characteristics of the data are fully utilized to achieve efficient extraction and dimensionality reduction of network security data features.

[0062] As shown in Table 3 below, this is a practical application of this embodiment: the recognition rates of the kernel sparse autoencoder (MK_SAE) are compared with those of the single hidden layer autoencoder (Single_AE), the deep autoencoder including the denoising autoencoder (DeN_AE), the sparse autoencoder (SAE), the convolutional autoencoder (Conv_AE) and the kernel-based convolutional neural network (K_CNN).

[0063] Table 3 Recognition rate classification results based on different feature extraction algorithms

[0064] According to the above results, MK_SAE combines kernel function and penalty cost function to reconstruct features, and its feature extraction effect is better than Single_AE, SAE, DeN_AE, Convol_AE and K_CNN. The MK_SAE feature extraction algorithm has the best effect, higher computational efficiency, and significantly improves the recognition rate.

[0065] In view of the characteristics of current network communication data, such as massive data, multiple data attributes, and high data noise, traditional network attack detection methods can no longer meet the needs. In this embodiment, the relatively advanced and mature combined kernel sparse autoencoder method is selected to first use the kernel function to map the network security data to a high-dimensional space, and then the high-dimensional data is reduced in dimension and extracted through the sparse autoencoder algorithm, which effectively solves the problem of difficulty in detecting network attacks in a big data environment.

[0066] Example 2 In combination with Example 1, a data feature extraction system based on a combined kernel sparse autoencoder is provided, comprising: The original data set module is used to acquire and parse the message data in the network communication process in real time, parse it according to a preset format, and save it to the first data set.

[0067] The nonlinear data set module is used to construct a second data set according to preset statistical information of the data in the first data set and its corresponding features.

[0068] The high-dimensional data set module is used to construct a combined kernel function, map the second data set to a high-dimensional data space, show a linearly separable property in the high-dimensional space, and save the high-dimensional data as a third data set.

[0069] The model training module is used to perform model training on the sparse autoencoder using the third data set and retain the optimal sparse autoencoder model.

[0070] The objective function module is used to construct the objective function for solution and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction. The objective function is as follows: ; in, is the loss function, is a weight function, and , β is the parameter in the sparse penalty cost function, and Ωs is the sparse penalty term.

[0071] An electronic device comprises: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, a data feature extraction method based on a combined kernel sparse autoencoder as in Example 1 is implemented.

[0072] A computer-readable storage medium includes: a computer program stored on the computer-readable storage medium, and when the computer program is executed by a processor, a data feature extraction method based on a combined kernel sparse autoencoder as in Example 1 is implemented.

[0073] The above embodiments are only preferred technical solutions of the present invention and should not be regarded as limiting the present invention. The protection scope of the present invention shall be the technical solutions recorded in the claims, including equivalent replacement solutions of the technical features in the technical solutions recorded in the claims. That is, equivalent replacement improvements within this scope are also within the protection scope of the present invention.

Claims

1. A data feature extraction method based on a combined kernel sparse autoencoder, characterized in that: The following steps are involved: Step 1: Acquire and parse the message data in the network communication process in real time, parse it according to a preset format, and save it to the first data set; Step 2: construct a second data set based on the preset statistical information of the data in the first data set and its corresponding features; Step 3: construct a combined kernel function to map the second data set to a high-dimensional data space, showing a linearly separable characteristic in the high-dimensional space, and save the mapped high-dimensional data as the third data set; Step 4: Use the third data set to train the sparse autoencoder model and retain the optimal sparse autoencoder model; Step 5: Construct the objective function to solve it, and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction. The objective function is as follows: ； in, is a weight function, β is a parameter in the sparse penalty cost function, Ωs is the sparse penalty term, is the loss function, and the formula is as follows: ； Among them, m is the number of training samples.

2. The data feature extraction method based on combined kernel sparse autoencoder according to claim 1, characterized in that: In step 5, optimizing the objective function parameters based on the adaptive genetic algorithm includes the following steps: S51: Initialize the population X and generate the initial population , including N individuals, calculate the corresponding fitness function value of each individual in the population Its fitness function uses the inverse of the root mean square error, and the chromosome encoding with the maximum fitness value corresponds to the optimal individual in the population ; S52: Select individuals with larger fitness values ​​from the population for crossover, and judge the crossover probability and mutation probability ; Early Evolution and The formula is: ； ； Late evolution and The formula is: ； ； in, and for and The initial value of, M is the number of individuals in the population whose individual fitness is greater than the average individual fitness of the population, and N is the total number of individuals in the population; S53: Calculate the fitness value of the offspring generated by the population and the maximum fitness value of all offspring in the population ; S54: Get the maximum fitness value among all offspring in the population ,make ,Will Update the chromosome encoding to the maximum fitness value; S55: repeat steps S52-S54 to perform fitness detection and evaluation; S56: Until The fitness value of the optimal individual is greater than the set limit, and the optimal solution is obtained; S57: Obtain the feature result of dimensionality reduction, and obtain the matrix after dimensionality reduction. The formula is: 。 3. The data feature extraction method based on combined kernel sparse autoencoder according to claim 2 is characterized in that: In step 5, the learning parameters selected based on the adaptive genetic algorithm optimization parameter are { },in , and is the parameter of the combined kernel function, and and are parameters in the sparse penalty cost function.

4. The data feature extraction method based on combined kernel sparse autoencoder according to claim 1, characterized in that: In step 1, the message data of the network communication is parsed, specifically: according to the seven-layer OSI model of network communication, a layer-by-layer parsing method is adopted from bottom to top, and the parsed data includes source IP, source Mac, source port, destination IP, destination Mac, destination port, protocol and function code.

5. The data feature extraction method based on combined kernel sparse autoencoder according to claim 1, characterized in that: In step 2, preset statistical information of the data in the first data set and its corresponding features, the preset statistical information includes statistics of the latest traffic from the current host IP, the latest traffic of the current host IP+MAC, the latest traffic from the current host to the target host, the traffic jitter from the current host to the target host, and the latest traffic from the current host+port to the target host+port; Corresponding features include packet size, mean, or variance.

6. The data feature extraction method based on combined kernel sparse autoencoder according to claim 1, characterized in that: In step 3, the combined kernel function is composed of a polynomial kernel function and a Gaussian radial basis kernel function, and the formulas are: The polynomial kernel function formula is: ； In the formula, and y are the feature vectors of the input samples, d is the degree of the polynomial, that is, the dimension of the feature space mapped to, T represents the matrix transpose operation, and k represents the kernel function; The Gaussian radial basis kernel function formula is: ； In the formula, and y are the feature vectors of the input samples, where σ is the parameter that controls the decay speed of the function, k represents the name of the kernel function, and exp represents the exponential power of e; The formula after combining the two is: ； In the formula, is a constant, a weight coefficient, whose value is between 0 and 1.

7. The data feature extraction method based on combined kernel sparse autoencoder according to claim 1, characterized in that: Step 4: Use the sparse autoencoder and perform model training, including: Divide the third data set into a training set and a test set, and perform data preprocessing; Initialize and set various parameters in the sparse encoder, including the number of nodes in the input layer and hidden layer, the training learning rate, sparse parameters, penalty weight parameters, weight matrix, batch training number and iterative training number in the forward algorithm; Inputting the training set after the data preprocessing into the sparse autoencoder model for iterative training, updating the parameters to obtain the weight matrix and the sparse cost function, until the number of iterative training times is reached, and saving the optimal sparse autoencoder model; The iterative training includes forward prediction of the sparse autoencoder model, calculating the loss function, and optimizing the sparse autoencoder model using back propagation and gradient descent methods.

8. The data feature extraction method based on combined kernel sparse autoencoder according to claim 7, characterized in that: It also includes the introduction of a sparsity penalty term to make the activation of hidden layer neurons more sparse; The back propagation and gradient descent method is used to optimize the sparse autoencoder model, including: in the back propagation process, first calculating the reconstruction error, then calculating the gradient according to the reconstruction error, and updating the network parameters.

9. The data feature extraction method based on combined kernel sparse autoencoder according to claim 7, characterized in that: Data preprocessing includes: First, redundant features are removed, then the data is normalized and missing values ​​are automatically filled.

10. A data feature extraction system based on a combined kernel sparse autoencoder, characterized in that: include: The original data set module is used to obtain and parse the message data of network communication in real time, parse it according to a preset format, and save it to the first data set; A non-linear data set module, used to construct a second data set according to preset statistical information of data in the first data set and corresponding features thereof; A high-dimensional data set module, used to construct a combined kernel function, map the second data set to a high-dimensional data space, show a linearly separable property in the high-dimensional space, and save the high-dimensional data as a third data set; A model training module, used to perform model training on the sparse autoencoder using a third data set, and retain an optimal sparse autoencoder model; The objective function module is used to construct the objective function for solution and optimize the parameters based on the adaptive genetic algorithm to obtain the feature results of dimensionality reduction. The objective function is as follows: ； in, is the loss function, is a weight function, and , β is the parameter in the sparse penalty cost function, and Ωs is the sparse penalty term.

11. An electronic device, characterized in that: include: A processor, a memory, and a computer program stored in the memory and executable on the processor, wherein when the computer program is executed by the processor, a method for extracting data features based on a combined kernel sparse autoencoder as described in any one of claims 1 to 9 is implemented.

12. A computer-readable storage medium, characterized in that: include: The computer-readable storage medium stores a computer program, and when the computer program is executed by the processor, it implements a data feature extraction method based on a combined kernel sparse autoencoder as described in any one of claims 1 to 9.

Images