Intrusion detection method based on improved convolutional neural network

Abstract

The invention relates to the technical field of intrusion detection, in particular to an intrusion detection method based on an improved convolutional neural network. Comprising the following steps: processing an NSL-KDD data set by adopting a self-adaptive synthetic sampling method to obtain an enhanced training data set; inputting the enhanced training data set into a pre-constructed improved convolutional neural network for training to obtain a trained intrusion detection model; the pre-constructed improved convolutional neural network comprises an input layer, a convolutional layer, two SPConv modules, a full connection layer, a Softmax layer and an output layer; the SPConv module comprises a channel segmentation block, two convolution blocks and a feature fusion block; and performing intrusion detection according to the trained intrusion detection model. According to the method, the problems of unbalanced data sample distribution and information redundancy can be effectively solved by adopting a data enhancement algorithm, the feature extraction efficiency of the model is improved by adding the SPConv module into the model, and the robustness and performance of intrusion detection are enhanced.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection, and in particular to an intrusion detection method based on an improved convolutional neural network. Background Art

[0002] As an important part of maintaining network security, intrusion detection technology plays a key role because it can actively identify various illegal network behaviors such as illegal operations, external attacks, unauthorized data access, and warn users in advance when potential threats appear so that they can take appropriate defense measures to ensure the safe operation of the network. Although network security measures such as access control, data encryption and user authentication contribute to the security of the network to a great extent, when these measures have flaws or cannot cope with emerging threats, abnormal attack detection technology becomes the most effective means to maintain network security.

[0003] With the rapid development of network technology and the continuous evolution of network attack methods, traditional attack identification methods based on data mining and pattern matching face many problems; these problems include insufficient timeliness, high false alarm rate, low recognition rate and weak generalization ability, which makes it difficult for them to cope with today's complex network security challenges. Therefore, researchers have turned to finding more efficient network attack detection methods. Among them, the convolutional neural network-based method has attracted much attention because it can effectively reduce memory usage, reduce the number of parameters, and alleviate the problem of model overfitting. This method has brought new possibilities to the field of network intrusion detection, improved the overall security of the network, and responded to the emerging network security threats.

[0004] Although the existing attack recognition algorithms using convolutional neural networks (CNNs) have greatly improved detection accuracy, there are still some problems. First, there is information redundancy between channels in the convolutional layer. This redundant information may affect the performance of the model, but since it is uncertain which channels are redundant, they cannot be directly discarded. Convolutional neural networks usually contain multiple convolutional layers in image processing, which can extract features at different levels. However, some features may partially overlap between different levels, resulting in information redundancy. Second, the model is too sensitive to large samples and ignores small samples. The uneven distribution of data samples has a great impact on model training. In practical applications, some categories may have much fewer samples than other categories, which may cause the model to tend to prefer large categories that are easier to obtain and ignore small categories. This bias will cause the model to perform poorly when dealing with attacks from rare categories. Summary of the invention

[0005] In order to solve the problems existing in the prior art, the present invention provides an intrusion detection method based on an improved convolutional neural network. The method comprises: using an adaptive synthetic sampling method to process the NSL-KDD data set to obtain an enhanced training data set; inputting the enhanced training data set into a pre-constructed improved convolutional neural network for training to obtain a trained intrusion detection model; the pre-constructed improved convolutional neural network comprises: an input layer, a convolutional layer, two SPConv modules, a fully connected layer, a Softmax layer and an output layer; the SPConv module comprises a channel segmentation block, two convolution blocks and a feature fusion block; and performing intrusion detection according to the trained intrusion detection model. The present invention adopts a data enhancement algorithm to effectively solve the problems of uneven distribution of data samples and information redundancy. Adding the SPConv module to the model improves the feature extraction efficiency of the model and enhances the robustness and performance of intrusion detection.

[0006] The present invention adopts the following technical solution, an intrusion detection method based on an improved convolutional neural network, comprising:

[0007] Adaptive synthetic sampling method is used to process the NSL-KDD dataset to obtain an enhanced training dataset;

[0008] Inputting the enhanced training data set into a pre-built improved convolutional neural network for training to obtain a trained intrusion detection model;

[0009] The pre-built improved convolutional neural network includes: an input layer, a convolution layer, two SPConv modules, a fully connected layer, a Softmax layer and an output layer; wherein the SPConv module includes a channel segmentation block, two convolution blocks and a feature fusion block;

[0010] Perform intrusion detection based on the trained intrusion detection model.

[0011] Furthermore, the adaptive synthetic sampling method is used to process the NSL-KDD dataset, specifically:

[0012] Analyze the NSL-KDD data set to obtain the category of each sample in the data set;

[0013] The minority category samples in the dataset are randomly transformed to generate new synthetic samples, and the synthetic samples are added to the NSL-KDD dataset.

[0014] Furthermore, the enhanced training data set is input into a pre-built improved convolutional neural network for training, including:

[0015] The training data set is input into the pre-constructed improved convolutional neural network through the input layer, and the convolution layer performs convolution operation and outputs the corresponding feature map;

[0016] The feature map is split into a representative part and a redundant part by the SPConv module, and different levels of convolution operations are used for feature extraction respectively;

[0017] The soft attention module is used in the fully connected layer to weightedly integrate the features extracted from different channels, and output the prediction results through the Softmax layer.

[0018] Furthermore, the SPConv module includes a channel segmentation block, two convolution blocks and a feature fusion block, specifically:

[0019] The channel segmentation block is used to split the feature map output by the convolution layer into a representative part and a redundant part respectively;

[0020] The two convolution blocks use different levels of convolution operations to perform convolution operations on the representative part and the redundant part respectively to extract corresponding features;

[0021] The feature fusion block is used to fuse the features output by the convolution block.

[0022] The beneficial effects of the present invention are as follows: the present invention can resist the overly sensitive reaction of the model to large samples by applying an adaptive synthetic sampling method, and can effectively handle the unbalanced distribution in the data set, thereby ensuring that small samples also receive sufficient attention, which further improves the learning and recognition ability of the intrusion detection system for small samples. The present application further introduces an improved convolutional neural network, and by adopting a segmented convolution module, the model can more reasonably extract multi-scale features, while reducing the redundancy of information between channels, helping the model to more accurately identify and distinguish intrusion behaviors, and enhancing the performance of intrusion detection; finally, the advantages of IADASYN and ISPC-CNN are integrated to perform intrusion detection tasks, which not only improves the overall performance, but also strengthens the overall security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0024] Figure 1 A schematic diagram of a flow chart of an intrusion detection method based on an improved convolutional neural network according to an embodiment of the present invention;

[0025] Figure 2 A schematic diagram of an improved convolutional neural network structure according to an embodiment of the present invention;

[0026] Figure 3 Schematic diagram of the structure of the SPConv module in an improved convolutional neural network according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] A flowchart of an intrusion detection method based on an improved convolutional neural network according to an embodiment of the present invention is shown in FIG. Figure 1 As shown, including:

[0029] Obtain the NSL-KDD dataset and process it using an adaptive synthetic sampling method to obtain an enhanced training dataset;

[0030] The enhanced training data set is input into the pre-built improved convolutional neural network for training to obtain a trained intrusion detection model;

[0031] The pre-built improved convolutional neural network includes: input layer, convolution layer, two SPConv modules, fully connected layer, Softmax layer and output layer; among them, the SPConv module includes channel segmentation block, two convolution blocks and feature fusion block;

[0032] Perform intrusion detection based on the trained intrusion detection model.

[0033] In another specific embodiment of the present invention:

[0034] The NSL-KDD dataset is obtained and processed using an adaptive synthetic sampling method to obtain an enhanced training dataset.

[0035] In deep learning, the distribution of data samples does have an important impact on the performance of the model, especially when faced with extremely unbalanced sample distribution; in the NSL-KDD dataset, the two sample categories of Normal and DoS occupy the vast majority of the data, accounting for 53.46% and 36.46% respectively, and the total proportion is as high as 90%, while the number of sample categories of R2L and U2R is very limited. This unbalanced distribution may cause the model to tend to process common sample categories during training and ignore rare categories, thereby affecting the performance of the model; in order to solve this problem, the present invention adopts an adaptive synthetic sampling method (ADASYN) algorithm to process small sample categories. The adaptive synthetic sampling method is a data enhancement algorithm that balances the unbalanced data distribution to a certain extent by increasing the number of samples in small sample categories.

[0036] Inputting the enhanced training data set into a pre-built improved convolutional neural network for training to obtain a trained intrusion detection model;

[0037] The traditional CNN-based attack recognition model ignores the redundancy in the channel and directly convolves all the feature maps of the next convolutional layer without any feature analysis. Obviously, the redundancy on these channels will reduce the detection performance and execution efficiency of the network. However, because it is difficult to determine whether similar pattern features contain different details, these similar features cannot be directly deleted. In order to more reasonably extract multi-scale features and reduce the redundancy of information between channels, the present invention proposes an improved convolutional neural network (ISPC-CNN) model based on the SPConv module; Figure 2 As shown in Figure 1, ISPC-CNN consists of seven layers: an input layer, a convolutional layer, two SPConv modules, a fully connected layer, a Softmax layer, and an output layer; Figure 3 As shown in the figure, the SPConv module consists of four parts: a channel segmentation block, two convolution blocks, and a feature fusion block; the basic process of ISPC-CNN training is as follows:

[0038] First, the enhanced training data set is input into the ISPC-CNN model through the input layer, and then multiple feature maps are output after convolution operation through the convolution layer, and then sent to the SPConv module. The feature maps are split into representative parts and redundant parts through the channel segmentation block in the SPConv module. This step helps to distinguish the main features from the redundant features and reduce information redundancy; further, different levels of convolution operations are used to perform convolution operations on the representative part and the redundant part respectively, so as to extract the corresponding features. Such differentiated processing helps to more effectively capture feature information at different levels; after the extracted features are sent to the fully connected layer, the soft attention module is used in the fully connected layer to perform weighted integration of the extracted features, so that the features under different channels are more reasonable, which helps to improve the perception and feature expression capabilities of the model; finally, the loss value is calculated after the output of the Softmax layer, and the network parameters are optimized through error back propagation to make the model converge, thereby completing the training of the model.

[0039] The design of the ISPC-CNN model in this invention aims to better handle information redundancy within the channel to improve the performance and efficiency of the attack recognition model. By comprehensively considering the multi-scale extraction, segmentation and integration of features, the model is expected to better adapt to different types of attacks and improve the robustness of the model. This innovative design is of great significance for the application of deep learning in the security field.

[0040] In an experimental embodiment of the present invention:

[0041] The NSL-KDD dataset plays an important role in intrusion detection research and is used to evaluate the performance of intrusion detection systems (IDS). This dataset consists of three main parts: KDDTrain, KDDTest-21, and KDDTest+. Each record contains a label to indicate the category of the record and 41 connection attributes that describe the specific operational behavior of the network connection, including digital and symbolic attributes.

[0042] The NSL-KDD dataset contains 5 types of samples, including 4 abnormal samples and 1 normal sample. These abnormal samples represent different attack behaviors. The training dataset only contains 22 attack behaviors, while the test dataset contains an additional 17 abnormal samples. This distribution design helps to test the generalization ability of the model. Since the present invention focuses on a 5-classification problem, this sample distribution is reasonable. In addition, KDDTest-21 and KDDTest+ contain different abnormal samples, so KDDTest-21 is usually used as a benchmark for KDDTest+ to further evaluate the generalization performance of the model.

[0043] The present invention adopts three indicators, namely ACC (Accuracy), FAR (False Alarm Rate) and DR (Detection Rate), to evaluate the performance of intrusion detection system (IDS). These indicators play a key role in the field of intrusion detection. They provide a comprehensive evaluation of system performance in order to better understand and measure the effectiveness of IDS. ACC is one of the key indicators for evaluating the overall performance of intrusion detection system. It represents the ratio between the samples correctly identified by IDS and the total number of samples. A higher accuracy rate means that IDS can identify normal and abnormal samples more accurately, reducing the possibility of misjudgment. Therefore, a high ACC indicates the reliability of the system in terms of overall performance; DR is an indicator used to evaluate the IDS's ability to identify attack samples. It indicates the proportion of attack samples identified by the IDS to all abnormal samples, that is, the number of attack samples detected by the system. A higher detection rate indicates that the IDS has more effectively discovered attack behaviors and improved the security of the network. Paying attention to the system's sensitivity to attacks makes DR very important for intrusion detection systems; FAR refers to the proportion of normal samples that the IDS mistakenly misclassifies as abnormal samples when distinguishing normal samples. A lower FAR indicates that the system is more reliable in judging normal behavior and reduces the possibility of false alarms. A low FAR is very important for practical applications because false alarms may cause unnecessary interference and costs. Therefore, the reliability of an intrusion detection system pursues higher ACC and DR and lower FAR.

[0044] By training the ISPC-CNN model after using IADASYN data enhancement on the KDDTrain dataset, the present invention achieves a significant improvement in the comprehensive performance of the intrusion detection model, which not only has a positive impact on the accuracy of intrusion detection, but also significantly improves the overall security of the network, which shows that the combination of data enhancement and a more advanced feature extraction model can significantly improve the performance of IDS; on the KDDTest+ and KDDTest-21 datasets, the detection rate (DR) of the IAS-CNN model is increased by 5.39% and 7.21%, respectively, as shown in Table 1, which means that the system more effectively identifies attack behaviors, thereby improving the security of the network. This increased detection rate helps the system better respond to evolving threats and discover potential security issues in advance; compared with the ISPC-CNN model used alone, the IAS-CNN model achieves a FAR reduction of 10.09% and 14.51% on the KDDTest+ and KDDTest-21 datasets, respectively, which shows that sample balancing through the IADASYN algorithm can significantly reduce the generation of false alarms, thereby reducing the false alarm rate of the system, which is very important for reducing unnecessary operating costs and improving user satisfaction.

[0045] Table 1 Performance diagram of IAS-CNN model

[0046]

[0047] Based on the above results, it can be concluded that the IADASYN algorithm adopted in the present invention realizes the discretization of categories by balancing the sample distribution, thereby greatly improving the classification performance of IDS. This conclusion provides a powerful reference for the design and optimization of intrusion detection systems, and emphasizes the synergy of data enhancement and feature extraction models to improve the performance and robustness of IDS.

[0048] At the same time, IAS-CNN not only significantly improves the overall performance, but also performs better than traditional CNN and CL-CNN. Compared with the classic RNN model, IAS-CNN achieves significant improvements of ACC by 2.79% and 7.87% on two different data sets. In addition, the present invention selects FAR and DR as core indicators to evaluate the comprehensive performance of various intrusion identification models. The specific data can be seen in Table 2.

[0049] Table 2 Schematic comparison of DR and FR of various models

[0050] Model RNN CNN CL-CNN IAS-CNN DR (%) 69.73 68.66 68.56 80.00 FAR(%) 26.89 27.90 25.10 12.32

[0051] Obviously, IAS-CNN shows more excellent performance in both DR and FAR. Compared with the traditional CNN model, the DR of IAS-CNN is improved by 11.34%, while the FAR is reduced by 15.58%. In general, compared with other deep learning models, the ISPC-CNN proposed in this invention not only has a significant improvement in comprehensive performance, but also shows stronger generalization ability.

[0052] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An intrusion detection method based on an improved convolutional neural network, characterized in that: include: Adaptive synthetic sampling method is used to process the NSL-KDD dataset to obtain an enhanced training dataset; Inputting the enhanced training data set into a pre-built improved convolutional neural network for training to obtain a trained intrusion detection model; The pre-built improved convolutional neural network includes: an input layer, a convolution layer, two SPConv modules, a fully connected layer, a Softmax layer and an output layer; wherein the SPConv module includes a channel segmentation block, two convolution blocks and a feature fusion block; Perform intrusion detection based on the trained intrusion detection model.

2. The intrusion detection method based on improved convolutional neural network according to claim 1, characterized in that: The adaptive synthetic sampling method is used to process the NSL-KDD dataset, specifically: Analyze the NSL-KDD data set to obtain the category of each sample in the data set; The minority category samples in the dataset are randomly transformed to generate new synthetic samples, and the synthetic samples are added to the NSL-KDD dataset.

3. The intrusion detection method based on improved convolutional neural network according to claim 1, characterized in that: Inputting the enhanced training data set into a pre-built improved convolutional neural network for training, including: The training data set is input into the pre-constructed improved convolutional neural network through the input layer, and the convolution layer performs convolution operation and outputs the corresponding feature map; The feature map is split into a representative part and a redundant part by the SPConv module, and different levels of convolution operations are used for feature extraction respectively; The soft attention module is used in the fully connected layer to weightedly integrate the features extracted from different channels, and output the prediction results through the Softmax layer.

4. The intrusion detection method based on improved convolutional neural network according to claim 2, characterized in that: The SPConv module includes a channel segmentation block, two convolution blocks and a feature fusion block, specifically: The channel segmentation block is used to split the feature map output by the convolution layer into a representative part and a redundant part respectively; The two convolution blocks use different levels of convolution operations to perform convolution operations on the representative part and the redundant part respectively to extract corresponding features; The feature fusion block is used to fuse the features output by the convolution block.

Images