Network security intrusion detection method and system based on multi-task learning

Abstract

The invention relates to the technical field of network security, in particular to a network security intrusion detection method and system based on multi-task learning, and the method comprises the steps: obtaining network flow data and intrusion detection data; executing a data preprocessing operation based on the network traffic data to obtain preprocessed network traffic data; according to the preprocessed network traffic data, converting the preprocessed network traffic data into a format which can be identified by a deep learning framework to obtain formatted network traffic data; dividing the formatted network traffic data into a training set, a verification set and a test set based on the formatted network traffic data; constructing and training an intrusion detection model with two parallel branches; obtaining a final model based on a training result of the intrusion detection model; and inputting the network flow data to be judged into the final model, and outputting the flow type to which the network flow data belongs, the method not only improves the calculation efficiency, but also realizes knowledge migration among different tasks, so that the model has better performance when processing novel or variant attacks.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more specifically, to a network security intrusion detection method and system based on multi-task learning. Background Art

[0002] With the rapid development and widespread application of network technology, network security issues are becoming increasingly prominent. Network intrusions not only occur frequently, but also their means are constantly upgraded, which brings huge challenges to network security protection. Traditional network security intrusion detection methods mainly rely on rule matching and feature recognition. Although they perform well in detecting known attack types, their limitations are becoming increasingly prominent in the face of increasingly complex and changeable network attacks.

[0003] In recent years, the application of machine learning technology in the field of network security has gradually attracted attention. Researchers have tried to apply various machine learning algorithms to intrusion detection, such as support vector machines, decision trees, random forests, etc. These methods have improved the accuracy and adaptability of intrusion detection to a certain extent. However, these methods are usually only optimized for a single task, and it is difficult to fully grasp the diversity and complexity of network attacks.

[0004] In addition, the rise of deep learning technology has brought new possibilities for network intrusion detection. Some studies have tried to use deep learning models such as convolutional neural networks and recurrent neural networks to extract deep features of network traffic. These methods perform well in processing large-scale, high-dimensional network data, but there are also some problems. For example, the model structure is often too complex, resulting in long training time and high consumption of computing resources; at the same time, these models are usually designed for specific types of attacks and are difficult to cope with diverse network threats.

[0005] The closest method in the existing technology is to apply multi-layer perceptron to network intrusion detection. This method can automatically learn the characteristics of network traffic and improve the accuracy of detection to a certain extent. However, this method still has the following problems: first, it is difficult to handle two related but different tasks, traffic classification and attack type identification, at the same time; second, the generalization ability of the model is limited and it is difficult to deal with unknown attack types; third, the lack of effective data preprocessing and enhancement strategies leads to low efficiency of the model's use of raw data; finally, the model lacks a dynamic update mechanism and is difficult to adapt to the ever-changing network environment.

[0006] In view of the above problems, there is an urgent need for network intrusion detection methods that can handle multiple related tasks simultaneously, have good generalization capabilities, can efficiently utilize data and can be dynamically updated. Summary of the invention

[0007] The network security intrusion detection method and system based on multi-task learning of the present invention are proposed to solve the above technical problems. The method realizes efficient, accurate and adaptive network intrusion detection by innovatively combining the multi-task learning framework and deep learning technology.

[0008] The present invention provides a network security intrusion detection method based on multi-task learning, comprising:

[0009] The acquisition steps include:

[0010] Obtaining network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial of service traffic, and rejected unknown traffic;

[0011] Processing steps include:

[0012] Based on the network traffic data, a data preprocessing operation is performed to obtain preprocessed network traffic data;

[0013] According to the preprocessed network traffic data, convert it into a format recognizable by the deep learning framework to obtain formatted network traffic data;

[0014] Based on the formatted network traffic data, split it into a training set, a validation set, and a test set;

[0015] Based on the training set, the validation set and the test set, an intrusion detection model with two parallel branches is constructed and trained, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of the attack data;

[0016] Based on the training results of the intrusion detection model, the high-risk traffic model, the denial of service traffic model, the rejection of unknown traffic model and the normal traffic model obtained by training are fused using an average weighted loss function to obtain a final model;

[0017] Output steps include:

[0018] The network traffic data to be judged is input into the final model, and the traffic type to which the network traffic data belongs is output.

[0019] Preferably, the data preprocessing operation specifically includes:

[0020] Convert all characters in the network traffic data to lowercase;

[0021] Deleting all tab characters in the network traffic data and replacing characters with numbers and letters;

[0022] All spaces in the network traffic data are removed and tab characters are processed.

[0023] Preferably, converting the preprocessed network traffic data into a format recognizable by the deep learning framework specifically includes:

[0024] Converting the preprocessed network flow data into binary so that each character of the preprocessed network flow data is represented by a hexadecimal number;

[0025] The preprocessed network traffic data is cut into a fixed length, and if the length is insufficient, it is padded with characters 0.

[0026] Preferably, the ratio of the training set, the validation set and the test set is any one of (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3) or (5, 3, 2).

[0027] Preferably, constructing the intrusion detection model specifically includes:

[0028] Set the deep learning framework to a 10-layer Convolution-BN-Dropout-Relu-Pooling structure;

[0029] Set the activation function to Leaky Relu;

[0030] Set the loss function to the multi-classification cross entropy loss function;

[0031] Set the weight function to Adam optimizer;

[0032] Set the initial weight parameter to (0, 0.01);

[0033] The initial learning rate is set to 0.01 and gradually decays to 1 / 5 of the original value every 20 rounds;

[0034] Each batch is set to perform 100 iterations, for a total of 100 rounds;

[0035] The pooling layers are all set to 3*3 with a stride of 3.

[0036] As a preference, the high-risk traffic model, the denial of service traffic model, the rejection of unknown traffic model and the normal traffic model obtained by fusion training using the average weighted loss function specifically include:

[0037] Set the high-risk traffic loss weight to 0.9, the denial of service traffic loss weight to 0.7, the rejection of unknown traffic loss weight to 0.3, and the normal traffic loss weight to 0.1;

[0038] The final loss is obtained by aggregating the average weighted loss function and updating the model parameters. The average weighted loss function is:

[0039]

[0040] Among them, L is the average weighted loss, N is the number of network traffic data, and w i For different traffic loss weights, c i is the classification result of each batch of network traffic data, y i Label for each batch of network traffic data.

[0041] As a preference, it also includes:

[0042] Periodically collect new network traffic data;

[0043] Adding the new network traffic data to a training set;

[0044] Based on the updated training set, the intrusion detection model is retrained to obtain an updated final model.

[0045] Preferably, the intrusion detection model also includes a self-attention mechanism for combining the output results of branch A and branch B to further improve the accuracy of the intrusion detection model.

[0046] Preferably, the method further includes the step of performing data expansion on the network sample:

[0047] Transform normal traffic so that normal traffic data forms multiple attack traffic data of the same type;

[0048] The transformed normal traffic data is added to the network sample as attack traffic data.

[0049] Network security intrusion detection system based on multi-task learning, including:

[0050] A sample collection module, used to obtain network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial of service traffic, and rejected unknown traffic;

[0051] A data preprocessing module, used for performing preprocessing operations on the network traffic data;

[0052] The format conversion module is used to convert the pre-processed network traffic data into a format that can be recognized by the deep learning framework;

[0053] A data segmentation module is used to segment the formatted network traffic data into a training set, a validation set, and a test set;

[0054] A model building module is used to build an intrusion detection model with two parallel branches, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of the attack data;

[0055] A training module, used for training the intrusion detection model based on the training set, the validation set and the test set;

[0056] A fusion module is used to fuse the high-risk traffic model, the denial of service traffic model, the unknown traffic rejection model and the normal traffic model obtained through training using an average weighted loss function to obtain a final model;

[0057] A prediction module, used for inputting the network traffic data to be judged into the final model and outputting the traffic type to which the network traffic data belongs;

[0058] The update module is used to periodically collect new network traffic data, add it to the training set, and retrain the intrusion detection model.

[0059] The beneficial effects of the present invention are mainly reflected in the following aspects:

[0060] First, the present invention adopts a multi-task learning framework to simultaneously handle two related tasks, traffic classification and attack type identification. This design enables the model to learn richer and more general feature representations, significantly improving the accuracy and generalization of detection. By sharing the underlying feature extraction network, this method not only improves computational efficiency, but also achieves knowledge transfer between different tasks, making the model perform better when dealing with new or variant attacks.

[0061] Secondly, the present invention proposes a complete set of data preprocessing and format conversion methods. These methods not only improve the data quality, but also make the data more suitable for deep learning model processing. In particular, by converting the data into a fixed-length binary representation, the present method effectively retains the information of the original data while improving the processing efficiency of the model. This preprocessing strategy is coordinated with the structure of the deep learning model to form an efficient data processing pipeline.

[0062] Furthermore, the present invention introduces an innovative average weighted loss function. By assigning different weights to different types of traffic, the function enables the model to pay more attention to high-risk attack types while not ignoring other types of traffic. This design not only improves the overall performance of the model, but also enhances its sensitivity to important attacks, which is of great significance to actual network security protection.

[0063] In addition, the present invention also includes data expansion and dynamic update mechanisms. The data expansion technology generates a variety of simulated attack data by transforming normal traffic, effectively increasing the diversity of training samples and improving the model's ability to identify various attack variants. The dynamic update mechanism enables the model to continuously learn emerging network attack patterns and maintain the timeliness of detection capabilities. The combination of these two mechanisms makes the method highly adaptable in the face of evolving network threats.

[0064] Finally, the system architecture proposed by the present invention organically combines the above innovations to form a complete and efficient network intrusion detection solution. The collaborative work between the various functional modules not only improves the overall performance of the system, but also enhances its scalability and maintainability.

[0065] In summary, the network security intrusion detection method and system based on multi-task learning of the present invention effectively solves the problems existing in the prior art through multiple innovative designs. It can not only accurately identify various types of network attacks, but also has good generalization ability and adaptability, providing a new technical path for improving network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] Figure 1 The present invention is a flow chart of the method.

[0067] Figure 2 It is a logic block diagram of the data preprocessing module of the present invention.

[0068] Figure 3 It is a logic block diagram of the format conversion module of the present invention.

[0069] Figure 4 The logical block diagram of the model building module and training module of the present invention.

[0070] Figure 5 It is a logic block diagram of the fusion module of the present invention.

[0071] Figure 6 It is a logic block diagram of the prediction module of the present invention.

[0072] Figure 7 It is a logic block diagram of the update module of the present invention. DETAILED DESCRIPTION

[0073] Please refer to Figure 1-6 The present invention relates to a network security intrusion detection method and system based on multi-task learning. The method realizes efficient and accurate network intrusion detection by innovatively combining a multi-task learning framework and deep learning technology. The technical solution of the present invention will be described in detail below.

[0074] First, the network security intrusion detection method based on multi-task learning of the present invention includes an acquisition step, a processing step and an output step. In the acquisition step, the system acquires network traffic data and intrusion detection data. It is worth noting that the acquired intrusion detection data includes multiple types such as normal traffic, high-risk traffic, denial of service traffic and rejection of unknown traffic, which lays the foundation for subsequent multi-task learning.

[0075] In the processing step, this method first preprocesses the acquired network traffic data. This step is crucial because the original network traffic data often contains a lot of noise and redundant information, and direct use may affect the learning effect of the model. Through preprocessing, we can get cleaner and more standardized data, which is conducive to the subsequent deep learning process.

[0076] Next, this method converts the preprocessed network traffic data into a format that the deep learning framework can recognize. The importance of this step is self-evident, because different deep learning frameworks may require different data formats. By converting the data into the appropriate format, we can ensure that the deep learning model can read and process the data correctly.

[0077] After data preparation is complete, this method splits the formatted network traffic data into training, validation, and test sets. This dataset partitioning is a standard practice in machine learning, which allows us to not only train the model, but also evaluate the model performance during the training process and finally test the model's generalization ability on unseen data.

[0078] A core innovation of the present invention is to construct and train an intrusion detection model with two parallel branches. Here, branch A is used to determine whether the traffic belongs to attack data, while branch B is used to classify the attack type of the attack data. This multi-task learning design allows the model to learn two related but different tasks at the same time, thereby improving the overall performance and generalization ability of the model.

[0079] An important innovation of the present invention lies in its unique dual-branch multi-task learning architecture. Specifically, branch A and branch B are not just simple parallel structures, but improve the overall performance through innovative feature sharing and interaction mechanisms.

[0080] Branch A uses an improved deep residual network structure to determine whether traffic belongs to attack data. This structure effectively alleviates the gradient vanishing problem of deep networks by adding jump connections, allowing the model to learn deeper features. Specifically, each residual block contains two 3x3 convolutional layers, followed by batch normalization and ReLU activation function. The residual connection uses 1x1 convolution for dimensionality reduction to match the output dimension of the main path.

[0081] Branch B introduces a combination of attention mechanism and gated recurrent unit (GRU) when classifying the type of attack data. The attention mechanism helps the model focus on the most relevant features, while GRU can capture the temporal dependencies in traffic data. In the specific implementation, we use a multi-head self-attention mechanism with 8 heads and 64 hidden layer dimensions. The hidden state dimension of GRU is set to 128, and a bidirectional structure is used to capture bidirectional context information.

[0082] The two branches interact with each other through the feature fusion layer. This layer uses a dynamic weight allocation mechanism to adaptively adjust the contribution weights of the two branches according to the difficulty of the current task. The weight update uses a soft attention mechanism, and the calculation formula is:

[0083] w_i=softmax(v^T tanh(W[h_A; h_B]+b))

[0084] Where h_A and h_B are the feature representations of branches A and B respectively, and W and v are learnable parameters.

[0085] After the model training is completed, this method uses the average weighted loss function to fuse the high-risk traffic model, denial of service traffic model, unknown traffic rejection model and normal traffic model obtained through training, and finally obtains a comprehensive final model. This fusion strategy fully considers the importance of different types of traffic, so that the final model can perform well in various network attack situations.

[0086] In the output step, the method inputs the network traffic data to be judged into the final model, thereby obtaining the traffic type to which the network traffic data belongs. This step achieves the ultimate goal of the present invention, namely, accurately identifying and classifying network traffic.

[0087] Furthermore, the present invention provides detailed provisions for data preprocessing operations. Specifically, the preprocessing operation includes three main steps: first, convert all characters in the network traffic data to lowercase; second, delete all tabs and replace the characters with numbers and letters; finally, delete all spaces and process tabs. These steps are designed to unify the data format and remove irrelevant information, thereby improving the efficiency and accuracy of subsequent processing.

[0088] When converting the preprocessed network traffic data into a format recognizable by the deep learning framework, the present invention adopts two key steps. First, the data is converted into binary form, specifically, each character is represented by a hexadecimal number. This representation method can not only effectively compress the data, but also retain all the information of the original data. Secondly, the converted data is truncated to a fixed length, and if it is insufficient, it is padded with the character 0. This step ensures the consistency of the input data, which is conducive to the processing of the deep learning model.

[0089] These technical solutions of the present invention have shown significant advantages in practical applications. For example, through the multi-task learning framework, the method can simultaneously handle two tasks, traffic classification and attack type identification, and improve the overall performance of the model. The carefully designed data preprocessing and format conversion steps greatly improve the data quality and provide a good foundation for model training. In addition, the average weighted loss function is used to fuse different types of traffic models, so that the final model can better balance the detection effects of various network attacks.

[0090] In general, the network security intrusion detection method based on multi-task learning proposed in the present invention realizes efficient and accurate network intrusion detection by innovatively combining multi-task learning, deep learning and data preprocessing technology. This method can not only effectively identify various types of network attacks, but also has good scalability and adaptability, and provides a new technical path for improving network security protection capabilities. In a preferred embodiment of the present invention, the ratio of the training set, the verification set and the test set can be flexibly selected to adapt to different data situations and training requirements. Specifically, the method provides a variety of optional data set division ratios, including (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3) or (5, 3, 2). These different division ratios each have their advantages and can be selected according to actual conditions.

[0091] For example, when the ratio (7, 1, 2) is selected, 70% of the data is used for training, 10% for validation, and 20% for testing. This division method provides sufficient training data for the model while retaining a considerable proportion of the data for the final test, which is suitable for situations with large amounts of data. The division ratio of (5, 3, 2) increases the proportion of the validation set, which may be more beneficial when more detailed adjustments are needed to the model hyperparameters.

[0092] Another important aspect of the present invention is the construction of an intrusion detection model. In one embodiment, the deep learning framework is set to a 10-layer Convolution-BN-Dropout-Relu-Pooling structure. This complex network structure can effectively extract deep features in network traffic data, thereby improving the accuracy of detection. Specifically, the functions of each layer are as follows:

[0093] The deep learning framework of the present invention includes 10 layers, and the specific structure is as follows:

[0094] 1. Input layer: receives raw traffic data;

[0095] 2. The first convolutional layer: uses 64 3x3 convolution kernels with a step size of 1;

[0096] 3. Batch normalization layer: standardizes feature maps and accelerates training;

[0097] 4. ReLU activation layer: introduces nonlinearity;

[0098] 5. Second convolutional layer: use 128 3x3 convolution kernels with a stride of 2;

[0099] 6. Batch normalization layer;

[0100] 7. ReLU activation layer;

[0101] 8. Dropout layer: randomly discard 50% of neurons to prevent overfitting;

[0102] 9. Fully connected layer: 1024 neurons;

[0103] 10.Softmax output layer: outputs the corresponding classification results according to the task;

[0104] The specific parameter settings of each layer are as follows:

[0105] The padding of the convolutional layer is set to 'same' to keep the feature map size;

[0106] The batch normalization layer’s momentum parameter is set to 0.99 and epsilon is set to 1e -5 ;

[0107] The dropout rate of the Dropout layer is dynamically adjusted during training, with an initial value of 0.5;

[0108] The fully connected layer uses the He initialization method to initialize weights;

[0109] In a preferred embodiment of the present invention, the activation function is set to Leaky Relu. Compared with the traditional Relu function, Leaky Relu still has a small gradient when the input is negative, which helps to alleviate the "death Relu" problem and enables the model to learn better.

[0110] The choice of loss function is crucial for model training. This method uses a multi-classification cross entropy loss function because network intrusion detection is essentially a multi-classification problem. The cross entropy loss function performs well in multi-classification problems and can effectively measure the difference between the predicted results and the true labels.

[0111] Preferably, the present invention uses Adam optimizer as the weight function. Adam optimizer combines the advantages of momentum method and RMSprop, and can adaptively adjust the learning rate, which is conducive to the model to converge to the optimal solution quickly. The initial weight parameter is set to (0, 0.01), which helps the model to remain stable in the early stage of training.

[0112] This method also uses a dynamic learning rate strategy. The initial learning rate is set to 0.01, and decays to 1 / 5 of the original every 20 rounds. This strategy allows the model to learn quickly in the early stages of training, and more detailed parameter adjustments in the later stages help find a better solution.

[0113] During the training process, each batch is set to perform 100 iterations, with a total of 100 iterations. This setting ensures sufficient training while also taking into account the rational use of computing resources. The pooling layers are all set to 3*3 with a step size of 3, which helps to effectively reduce the data dimension while retaining important features.

[0114] Another innovation of the present invention is to use an average weighted loss function to fuse different types of traffic models. Specifically, this method sets different loss weights for different types of traffic: the loss weight of high-risk traffic is 0.9, the loss weight of denial of service traffic is 0.7, the loss weight of unknown traffic rejection is 0.3, and the loss weight of normal traffic is 0.1. This setting reflects the importance of different types of traffic in network security, allowing the model to pay more attention to high-risk traffic types.

[0115] The calculation formula of the average weighted loss function is as follows:

[0116]

[0117] Among them, L is the average weighted loss, N is the number of network traffic data, and w i For different traffic loss weights, c i is the classification result of each batch of network traffic data, y i Label for each batch of network traffic data.

[0118] The design of this loss function enables the model to simultaneously consider the importance of different types of traffic during training, thereby maintaining good detection performance under various network attack scenarios.

[0119] In order to make the model adapt to the ever-changing network environment, the present invention also introduces a dynamic update mechanism. Specifically, the method periodically collects new network traffic data and adds it to the training set. Then, based on the updated training set, the intrusion detection model is retrained to obtain the updated final model. This dynamic update mechanism enables the model to continuously learn new network attack patterns and maintain the timeliness of its detection capabilities.

[0120] In general, the present invention realizes an efficient, accurate and adaptive network security intrusion detection method through a carefully designed network structure, training strategy and dynamic update mechanism. This method can not only effectively identify various types of network attacks, but also can continuously evolve with the changes in the network environment, providing strong technical support for network security protection. In another preferred embodiment of the present invention, the intrusion detection model also introduces a self-attention mechanism. The main function of this mechanism is to combine the output results of branch A and branch B, thereby further improving the accuracy of the intrusion detection model. The self-attention mechanism can capture long-range dependencies in the data, which is particularly important in network traffic analysis because some attack patterns may have complex correlations in time or space.

[0121] Specifically, the self-attention mechanism generates an attention weight matrix by calculating the correlation between each element in the input sequence and all other elements. This weight matrix is ​​then used to perform a weighted summation of the input to obtain a new representation. In the present invention, this mechanism is applied to the outputs of branches A and B, allowing the model to better understand the relationship between different features and make more accurate judgments.

[0122] The core innovation of this invention is to propose a new "Bidirectional Attention-Enhanced Multi-Task Learning Framework" (BAE-MTL). This framework not only realizes the parallel learning of branch A and branch B, but more importantly, it realizes the deep interaction and complementarity between the two branches through the innovative bidirectional attention mechanism.

[0123] Specifically, the innovations and technical means of the BAE-MTL framework are as follows:

[0124] 1. Bidirectional Attention Mechanism:

[0125] There is a bidirectional attention mechanism between branches A and B for feature interaction. This mechanism allows each branch to focus on the most relevant features in the other branch, thereby improving the overall performance.

[0126] Let F A and F B They are the feature maps of branches A and B respectively, and the bidirectional attention is calculated as follows:

[0127]

[0128] Among them, W AB and W BA is a learnable weight matrix, and α and β are balancing parameters.

[0129] 2. Dynamic feature fusion:

[0130] Before the final classification layer, we introduce a dynamic feature fusion mechanism, which dynamically adjusts the contribution weights of the two branches according to the current input features.

[0131]

[0132] Among them, W f and b f are learnable parameters.

[0133] 3. Multi-scale feature extraction:

[0134] To capture attack patterns of different scales, we introduce a multi-scale feature extraction module in each branch. This module processes the input in parallel using convolution kernels of different sizes and then concatenates the results.

[0135] F multi =concat([conv 1×1 (F),conv 3×3 (F),conv 5×5 (F),maxpool(F)]),

[0136] 4. Residual Attention Block:

[0137] In each branch, we use an improved residual attention block to extract more effective features. This structure combines residual connections and channel attention mechanisms.

[0138] X res =conv(X)+X,

[0139] X att =X res ×σ(MLP(globalpool(X res ))),

[0140] 5. Hierarchical adaptive loss function:

[0141] We propose a hierarchical adaptive loss function that dynamically adjusts the loss weights of different layers according to the difficulty of the task. For branch A (binary classification task) and branch B (multi-classification task), the loss functions are defined as follows:

[0142] The loss function of branch A (improved binary cross entropy):

[0143] L A =-∑[ylog(p)+(1-y)log(1-p)]×(1+γ|py|),

[0144] Among them, y is the true label, p is the predicted probability, and γ is an adjustable parameter used to enhance the penalty for difficult-to-classify samples.

[0145] Loss function of branch B (improved multi-class cross entropy):

[0146] L B =-∑[y i log(p i )]×(1+λ(1-max(p))),

[0147] Among them, y i is the one-hot encoding of the true label, p i is the predicted probability distribution and λ is an adjustable parameter used to increase the penalty for low confidence predictions.

[0148] Total loss function:

[0149] L total =αL A +βL B +θL reg ,

[0150] Among them, α and β are the weights to balance the two tasks, L reg is the regularization term and θ is the regularization coefficient.

[0151] These innovative technical means and algorithms together constitute the core of this invention, enabling our method to achieve excellent performance in both judging traffic attacks and classifying attack types. Through the BAE-MTL framework, we not only achieve multi-task learning, but also enhance the model's expressiveness and generalization capabilities through various mechanisms, enabling it to better cope with complex and changing network attack scenarios.

[0152] Preferably, the present invention also includes a step of data expansion for network samples. The core idea of ​​this step is to generate multiple attack traffic data of the same type by transforming normal traffic. This data expansion method not only increases the number of training samples, but more importantly, it improves the model's ability to identify various attack variants.

[0153] In practice, data expansion can be achieved in a variety of ways. For example, normal traffic data can be slightly modified, such as changing the value of certain fields, adjusting the order or time interval of data packets, etc. These changes should be subtle enough to simulate real attack behaviors, but not to completely change the essential characteristics of the data. The "simulated attack data" generated in this way is then added to the network sample for model training.

[0154] A significant advantage of this data expansion method is that it can help the model learn more diverse attack patterns, including variants that may not be common in existing datasets. This is of great significance for improving the generalization ability and robustness of the model, enabling the model to better cope with unknown or emerging attack types.

[0155] Next, the present invention also proposes a network security intrusion detection system based on multi-task learning corresponding to the above method. The system includes multiple functional modules, each module has its specific responsibilities, and they work together to achieve efficient and accurate intrusion detection.

[0156] First, the sample collection module 1 is responsible for acquiring network traffic data and intrusion detection data. The design of this module takes into account the complexity of the actual network environment and can simultaneously process multiple types of data such as normal traffic, high-risk traffic, denial of service traffic, and rejection of unknown traffic. The efficient operation of the sample collection module 1 lays a solid foundation for subsequent data processing and model training.

[0157] The data preprocessing module 2 receives the raw data from the sample collection module 1 and performs preprocessing operations on it. This module implements the various preprocessing steps described above, such as character conversion, deletion of irrelevant characters, etc. The output of the data preprocessing module 2 is cleaned and standardized data, which greatly improves the efficiency and accuracy of subsequent processing.

[0158] The format conversion module 3 is responsible for converting the preprocessed network traffic data into a format that can be recognized by the deep learning framework. The design of this module fully considers the needs of different deep learning frameworks and ensures the compatibility and universality of the data format.

[0159] The data segmentation module 4 segments the formatted network traffic data into a training set, a validation set, and a test set. The flexible design of this module allows the data set division ratio to be adjusted according to actual needs to adapt to different training strategies and data characteristics.

[0160] Model building module 5 is one of the core components of the system and is responsible for building an intrusion detection model with two parallel branches. This module implements the complex network structure described above, including the configuration of multiple layers of convolution, batch normalization, dropout, etc. The innovative design of model building module 5 enables the system to simultaneously handle two related but different tasks: traffic classification and attack type identification.

[0161] The model building module 5 of the present invention includes configurations of multiple layers of convolution, batch normalization, dropout and the like.

[0162] Specifically:

[0163] Multi-layer convolution: In addition to the two main convolutional layers mentioned above, the model also adds additional convolutional layers in branches A and B. Branch A adds a 1x1 convolutional layer for feature dimensionality reduction, and branch B adds a hole convolutional layer to expand the receptive field, which is conducive to capturing long-distance dependencies.

[0164] Batch Normalization: Each convolutional layer is followed by a batch normalization layer. Batch normalization is not only used in the backbone network, but also in the residual block and attention mechanism to ensure the stability of feature distribution.

[0165] Dropout: In addition to the Dropout layer in the backbone network, a Dropout layer is also added after the residual block of branch A and the GRU unit output of branch B, with dropout rates of 0.3 and 0.4, respectively.

[0166] In addition, the model also introduces the following innovative structures:

[0167] Feature Pyramid Network (FPN): It is used to extract multi-scale features, which is beneficial for detecting attack patterns of different scales. FPN contains top-down paths and lateral connections, and uses 1x1 convolution for feature adjustment at each scale level.

[0168] Cross-layer connection: Drawing on the idea of ​​DenseNet, cross-layer feature reuse is achieved. Specifically, every two layers, the feature map is concatenated with the feature maps of all previous layers, and then the dimension is reduced through 1x1 convolution.

[0169] Dynamic convolution: The weights of the convolution kernel are not fixed, but dynamically generated according to the input. This improves the adaptability of the model, especially in the face of new attacks.

[0170] The training module 6 trains the intrusion detection model based on the training set, validation set and test set provided by the data segmentation module 4. This module implements the various training strategies described above, such as learning rate adjustment, loss function calculation, etc. The efficient operation of the training module 6 ensures that the model can fully learn the features and patterns in the data.

[0171] Fusion module 7 uses an average weighted loss function to fuse various traffic models obtained through training, and finally obtains a comprehensive model. The design of this module embodies the idea of ​​multi-task learning, and achieves overall optimization of model performance by reasonably allocating weights of different tasks.

[0172] The prediction module 8 is responsible for inputting the network traffic data to be judged into the final model and outputting the traffic type to which the network traffic data belongs. This module is the "front end" of the system, directly facing the user, and providing real-time intrusion detection results.

[0173] Finally, the update module 9 implements the dynamic update function of the system. It periodically collects new network traffic data, adds it to the training set, and retrains the intrusion detection model. The existence of the update module 9 enables the system to continuously learn and adapt to the ever-changing network environment and maintain the timeliness of the detection capability.

[0174] In general, the network security intrusion detection system based on multi-task learning proposed in this invention realizes efficient, accurate and adaptive intrusion detection through the collaborative work of multiple functional modules. This system design can not only effectively identify various types of network attacks, but also continuously evolve with the changes in the network environment, providing a comprehensive and powerful solution for network security protection.

[0175] It should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modification, replacement, and improvement made within the principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security intrusion detection method based on multi-task learning, characterized in that: include: The acquisition steps include: Obtaining network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial of service traffic, and rejected unknown traffic; Processing steps include: Based on the network traffic data, a data preprocessing operation is performed to obtain preprocessed network traffic data; According to the preprocessed network traffic data, convert it into a format recognizable by the deep learning framework to obtain formatted network traffic data; Based on the formatted network traffic data, split it into a training set, a validation set, and a test set; Based on the training set, the validation set and the test set, an intrusion detection model with two parallel branches is constructed and trained, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of the attack data; Based on the training results of the intrusion detection model, the high-risk traffic model, the denial of service traffic model, the rejection of unknown traffic model and the normal traffic model obtained by training are fused using an average weighted loss function to obtain a final model; Output steps include: The network traffic data to be judged is input into the final model, and the traffic type to which the network traffic data belongs is output.

2. The method according to claim 1, characterized in that The data preprocessing operation specifically includes: Convert all characters in the network traffic data to lowercase; Deleting all tab characters in the network traffic data and replacing characters with numbers and letters; All spaces in the network traffic data are removed and tab characters are processed.

3. The method according to claim 1, characterized in that: Converting the preprocessed network traffic data into a format recognizable by the deep learning framework specifically includes: Converting the preprocessed network flow data into binary so that each character of the preprocessed network flow data is represented by a hexadecimal number; The preprocessed network traffic data is cut into a fixed length, and if the length is insufficient, it is padded with characters 0.

4. The method according to claim 1, characterized in that The ratio of the training set, the validation set and the test set is any one of (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3) or (5, 3, 2).

5. The method according to claim 1, characterized in that Constructing the intrusion detection model specifically includes: Set the deep learning framework to a 10-layer Convolution-BN-Dropout-Relu-Pooling structure; Set the activation function to Leaky Relu; Set the loss function to the multi-classification cross entropy loss function; Set the weight function to Adam optimizer; Set the initial weight parameter to (0, 0.01); The initial learning rate is set to 0.01 and gradually decays to 1 / 5 of the original value every 20 rounds; Each batch is set to perform 100 iterations, for a total of 100 rounds; The pooling layers are all set to 3*3 with a stride of 3.

6. The method according to claim 1, characterized in that The high-risk traffic model, denial of service traffic model, unknown traffic rejection model and normal traffic model obtained by fusion training using the average weighted loss function specifically include: Set the high-risk traffic loss weight to 0.9, the denial of service traffic loss weight to 0.7, the rejection of unknown traffic loss weight to 0.3, and the normal traffic loss weight to 0.1; The final loss is obtained by aggregating the average weighted loss function and updating the model parameters. The average weighted loss function is: Among them, L is the average weighted loss, N is the number of network traffic data, and w i For different traffic loss weights, c i is the classification result of each batch of network traffic data, y i Label for each batch of network traffic data.

7. The method according to claim 1, characterized in that Also includes: Periodically collect new network traffic data; Adding the new network traffic data to a training set; Based on the updated training set, the intrusion detection model is retrained to obtain an updated final model.

8. The method according to claim 1, characterized in that: The intrusion detection model also includes a self-attention mechanism, which is used to combine the output results of branch A and branch B to further improve the accuracy of the intrusion detection model.

9. The method according to claim 1, characterized in that: It also includes the steps of data expansion for network samples: Transform normal traffic so that normal traffic data forms multiple attack traffic data of the same type; The transformed normal traffic data is added to the network sample as attack traffic data.

10. A network security intrusion detection system based on multi-task learning, characterized in that: include: A sample collection module, used to obtain network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial of service traffic, and rejected unknown traffic; A data preprocessing module, used for performing preprocessing operations on the network traffic data; The format conversion module is used to convert the pre-processed network traffic data into a format that can be recognized by the deep learning framework; A data segmentation module is used to segment the formatted network traffic data into a training set, a validation set, and a test set; A model building module is used to build an intrusion detection model with two parallel branches, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of the attack data; A training module, used for training the intrusion detection model based on the training set, the validation set and the test set; A fusion module is used to fuse the high-risk traffic model, the denial of service traffic model, the unknown traffic rejection model and the normal traffic model obtained through training using an average weighted loss function to obtain a final model; A prediction module, used for inputting the network traffic data to be judged into the final model and outputting the traffic type to which the network traffic data belongs; The update module is used to periodically collect new network traffic data, add it to the training set, and retrain the intrusion detection model.

Images