Network security intrusion detection method and system based on multi-task learning

Abstract

The application relates to the technical field of network security, in particular to a network security intrusion detection method and system based on multi-task learning, network traffic data and intrusion detection data are acquired; based on the network traffic data, a data preprocessing operation is performed to obtain preprocessed network traffic data; the preprocessed network traffic data is converted into a format that can be recognized by a deep learning framework to obtain formatted network traffic data; based on the formatted network traffic data, the formatted network traffic data is segmented into a training set, a verification set and a test set; an intrusion detection model with two parallel branches is constructed and trained; based on the training result of the intrusion detection model, a final model is obtained; network traffic data to be judged is input into the final model, and a traffic type to which the network traffic data belongs is output, the method not only improves the calculation efficiency, but also realizes knowledge transfer between different tasks, so that the model performs better when processing new or variant attacks.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, more particularly, to a network security intrusion detection method and system based on multi-task learning. BACKGROUND

[0002] With the rapid development and wide application of network technology, network security problems are increasingly prominent. Network intrusion behaviors not only occur frequently, but also upgrade their means constantly, bringing great challenges to network security protection. Traditional network security intrusion detection methods mainly rely on rule matching and feature recognition, which perform well in detecting known attack types, but their limitations are increasingly highlighted in the face of increasingly complex and variable network attacks.

[0003] In recent years, machine learning technology has gradually attracted attention in the field of network security. Researchers have tried to apply various machine learning algorithms to intrusion detection, such as support vector machines, decision trees, random forests, etc. These methods have improved the accuracy and adaptability of intrusion detection to some extent. However, these methods are usually optimized for a single task, making it difficult to fully grasp the diversity and complexity of network attacks.

[0004] In addition, the rise of deep learning technology brings new possibilities for network intrusion detection. Some research attempts to use deep learning models such as convolutional neural networks and recurrent neural networks to extract deep features of network traffic. These methods perform well in handling large-scale, high-dimensional network data, but also have some problems. For example, the model structure is often too complex, resulting in long training time and large computational resource consumption; at the same time, these models are usually designed for a specific type of attack, making it difficult to cope with diversified network threats.

[0005] The closest method in the prior art is to apply a multi-layer perceptron to network intrusion detection. This method can automatically learn the features of network traffic and improve the accuracy of detection to some extent. However, this method still has the following problems: first, it is difficult to handle both traffic classification and attack type identification, which are related but different tasks; second, the model has limited generalization ability, making it difficult to cope with unknown attack types; third, there is a lack of effective data preprocessing and enhancement strategies, resulting in low efficiency of the model in utilizing raw data; finally, the model lacks a dynamic updating mechanism, making it difficult to adapt to changing network environments.

[0006] In view of the above problems, there is an urgent need for a network intrusion detection method that can handle multiple related tasks, has good generalization ability, can efficiently utilize data, and can be dynamically updated. SUMMARY

[0007] The network security intrusion detection method and system based on multi-task learning of the present application are proposed to solve the above technical problems. The method combines the multi-task learning framework and deep learning technology innovatively, achieving efficient, accurate and adaptive network intrusion detection.

[0008] The present application provides a network security intrusion detection method based on multi-task learning, comprising:

[0009] The acquisition step comprises:

[0010] Acquiring network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial-of-service traffic and unknown denial traffic;

[0011] The processing step comprises:

[0012] Based on the network traffic data, a data preprocessing operation is performed to obtain preprocessed network traffic data;

[0013] According to the preprocessed network traffic data, it is converted into a format that can be recognized by the deep learning framework, and the formatted network traffic data is obtained;

[0014] Based on the formatted network traffic data, it is divided into training set, validation set and test set;

[0015] According to the training set, validation set and test set, an intrusion detection model with two parallel branches is constructed and trained, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of attack data;

[0016] Based on the training results of the intrusion detection model, the average weighted loss function is used to fuse the high-risk traffic model, the denial-of-service traffic model, the unknown denial traffic model and the normal traffic model obtained by training, to obtain the final model;

[0017] The output step comprises:

[0018] The network traffic data to be judged is input into the final model, and the traffic type to which the network traffic data belongs is output.

[0019] As a preferred embodiment, the data preprocessing operation specifically comprises:

[0020] All characters in the network traffic data are converted to lowercase;

[0021] Delete all tab characters in the network traffic data, and replace characters with numbers and letters;

[0022] Delete all spaces in the network traffic data and process the tab characters.

[0023] As preferred, converting the preprocessed network traffic data into a format recognizable by the deep learning framework specifically includes:

[0024] Converting the preprocessed network traffic data into binary, using 16 hexadecimal digits to represent each character of the preprocessed network traffic data;

[0025] Truncating the preprocessed network traffic data to a fixed length, and padding with character 0 if the length is insufficient.

[0026] As preferred, the proportions of the training set, validation set and test set are any one of (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3) or (5, 3, 2).

[0027] As preferred, constructing the intrusion detection model specifically includes:

[0028] Setting the deep learning framework to a 10-layer Convolution-BN-Dropout-Relu-Pooling structure;

[0029] Setting the activation function to Leaky Relu;

[0030] Setting the loss function to a multi-class cross-entropy loss function;

[0031] Setting the weight function to an Adam optimizer;

[0032] Setting the initial weight parameter to (0, 0.01);

[0033] Setting the initial learning rate to 0.01 and gradually decaying to 1 / 5 of the original every 20 rounds;

[0034] Setting each batch to perform 100 iterations, with a total of 100 iterations;

[0035] Setting the pooling layer to 3*3 with a step of 3.

[0036] As preferred, using an average weighted loss function to fuse the high-risk traffic model, denial-of-service traffic model, denial-of-unknown traffic model and normal traffic model obtained by training specifically includes:

[0037] Setting the high-risk traffic loss weight to 0.9, the denial-of-service traffic loss weight to 0.7, the denial-of-unknown traffic loss weight to 0.3, and the normal traffic loss weight to 0.1;

[0038] Obtaining the final loss by aggregating through the average weighted loss function, and updating the model parameters, wherein the average weighted loss function is:

[0039]

[0040] wherein L is the average weighted loss, N is the number of network traffic data, w i is the different traffic loss weight, c i is the classification result of each batch of network traffic data, y i is the label of each batch of network traffic data.

[0041] As preferred, it further comprises:

[0042] periodically collecting new network traffic data;

[0043] adding the new network traffic data to the training set;

[0044] retraining the intrusion detection model based on the updated training set to obtain an updated final model.

[0045] As preferred, the intrusion detection model further comprises a self-attention mechanism for combining the output results of branch A and branch B to further improve the accuracy of the intrusion detection model.

[0046] As preferred, it further comprises a step of data expansion on network samples:

[0047] transforming normal traffic so that normal traffic data forms multiple attack traffic data of the same type;

[0048] adding the transformed normal traffic data as attack traffic data to the network samples.

[0049] A network security intrusion detection system based on multi-task learning comprises:

[0050] a sample collection module for obtaining network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial-of-service traffic, and denial-of-unknown traffic;

[0051] a data preprocessing module for preprocessing the network traffic data;

[0052] a format conversion module for converting the preprocessed network traffic data into a format that can be recognized by a deep learning framework;

[0053] a data segmentation module for segmenting the formatted network traffic data into a training set, a validation set, and a test set;

[0054] a model construction module for constructing an intrusion detection model with two parallel branches, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of attack data;

[0055] a training module configured to train the intrusion detection model based on the training set, the validation set, and the test set;

[0056] a fusion module configured to fuse the high-risk traffic model, the denial-of-service traffic model, the unknown traffic rejection model, and the normal traffic model using an average weighted loss function to obtain a final model;

[0057] a prediction module configured to input network traffic data to be judged into the final model and output a traffic type to which the network traffic data belongs;

[0058] an update module configured to periodically collect new network traffic data, add the new network traffic data to the training set, and retrain the intrusion detection model.

[0059] The beneficial effects of the present application mainly include the following aspects:

[0060] Firstly, the present application uses a multi-task learning framework to simultaneously process two related tasks of traffic classification and attack type identification. This design enables the model to learn more rich and general feature representations, significantly improving the detection accuracy and generalization ability. By sharing the underlying feature extraction network, this method not only improves the computational efficiency, but also realizes the knowledge transfer between different tasks, making the model perform better when dealing with new or variant attacks.

[0061] Secondly, the present application proposes a complete data preprocessing and format conversion method. These methods not only improve the data quality, but also make the data more suitable for deep learning model processing. In particular, by converting the data into fixed-length binary representation, this method effectively preserves the information of the original data while improving the processing efficiency of the model. This preprocessing strategy is coordinated with the structure of the deep learning model, forming an efficient data processing pipeline.

[0062] Furthermore, the present application introduces an innovative average weighted loss function. By assigning different weights to different types of traffic, this function enables the model to pay more attention to high-risk attack types while not ignoring other types of traffic. This design not only improves the overall performance of the model, but also enhances its sensitivity to important attacks, which is of great significance to actual network security protection.

[0063] In addition, the present application also includes data expansion and dynamic updating mechanisms. The data expansion technique generates a variety of simulated attack data by transforming normal traffic, effectively increasing the diversity of training samples and improving the model's ability to identify various attack variants. The dynamic updating mechanism enables the model to continuously learn new network attack patterns, maintaining the timeliness of detection ability. The combination of these two mechanisms enables the present method to have strong adaptability in the face of evolving network threats.

[0064] Finally, the system architecture proposed by the present application organically combines the above-mentioned innovations to form a complete and efficient network intrusion detection solution. The cooperative work between the various functional modules not only improves the overall performance of the system, but also enhances its scalability and maintainability.

[0065] In summary, the network security intrusion detection method and system based on multi-task learning of the present application effectively solve the problems existing in the prior art through multiple innovative designs. It not only can accurately identify various types of network attacks, but also has good generalization ability and adaptability, providing a new technical path for improving network security protection capability. BRIEF DESCRIPTION OF DRAWINGS

[0066] Figure 1 The method flowchart of the present application.

[0067] Figure 2 The logic block diagram of the data preprocessing module of the present application.

[0068] Figure 3 The logic block diagram of the format conversion module of the present application.

[0069] Figure 4 The logic block diagram of the model construction module and the training module of the present application.

[0070] Figure 5 The logic block diagram of the fusion module of the present application.

[0071] Figure 6 The logic block diagram of the prediction module of the present application.

[0072] Figure 7 The logic block diagram of the update module of the present application. DETAILED DESCRIPTION

[0073] Please refer to Figures 1-6 The present application relates to a network security intrusion detection method and system based on multi-task learning. The method innovatively combines a multi-task learning framework and deep learning technology to achieve efficient and accurate network intrusion detection. The technical solutions of the present application will be described in detail below.

[0074] Firstly, the network security intrusion detection method based on multi-task learning of the present application includes an acquisition step, a processing step and an output step. In the acquisition step, the system acquires network traffic data and intrusion detection data. It is worth noting that the acquired intrusion detection data includes normal traffic, high-risk traffic, denial-of-service traffic and denial-of-unknown traffic, etc. This lays a foundation for subsequent multi-task learning.

[0075] In the processing step, the method first performs preprocessing operations on the acquired network traffic data. This step is crucial because the original network traffic data often contains a lot of noise and redundant information, which may affect the learning effect of the model. Through preprocessing, we can get cleaner and more standardized data, which is conducive to the subsequent deep learning process.

[0076] Next, the method converts the preprocessed network traffic data into a format that the deep learning framework can recognize. The importance of this step is self-evident, as different deep learning frameworks may require different data formats. By converting the data into the appropriate format, we can ensure that the deep learning model can correctly read and process the data.

[0077] After the data preparation is completed, the method divides the formatted network traffic data into training set, validation set and test set. This data set division is a standard practice in machine learning, which allows us to not only train the model, but also evaluate the model performance during the training process, and finally test the generalization ability of the model on unseen data.

[0078] One of the core innovations of the invention is to build and train an intrusion detection model with two parallel branches. Here, branch A is used to determine whether the traffic belongs to attack data, while branch B is used to classify the attack type of attack data. This multi-task learning design allows the model to learn two related but different tasks simultaneously, thereby improving the overall performance and generalization ability of the model.

[0079] An important innovation of the invention is its unique dual-branch multi-task learning architecture. Specifically, branch A and branch B are not just simple parallel structures, but through innovative feature sharing and interaction mechanisms to improve overall performance.

[0080] When branch A determines whether the traffic belongs to attack data, it uses an improved deep residual network structure. This structure effectively alleviates the gradient vanishing problem of deep networks by adding skip connections, allowing the model to learn deeper features. Specifically, each residual block contains two 3x3 convolution layers, followed by batch normalization and ReLU activation functions. The residual connection uses a 1x1 convolution for dimension reduction to match the output dimension of the main path.

[0081] When branch B classifies the type of attack data, it introduces a combination of attention mechanism and gated recurrent unit (GRU). The attention mechanism helps the model focus on the most relevant features, while the GRU can capture the temporal dependencies in the traffic data. In the specific implementation, we use a multi-head self-attention mechanism with 8 heads and a hidden layer dimension of 64. The GRU has a hidden state dimension of 128 and uses a bidirectional structure to capture bidirectional context information.

[0082] The information interaction between the two branches is realized through a feature fusion layer. The layer uses a dynamic weight distribution mechanism to adaptively adjust the contribution weights of the two branches according to the difficulty of the current task. The weight update adopts a soft attention mechanism, and the calculation formula is:

[0083] w_i=softmax(v^T tanh(W[h_A;h_B]+b))

[0084] Where h_A and h_B are the feature representations of branches A and B, respectively, and W and v are learnable parameters.

[0085] After the model training is completed, the method fuses the high-risk traffic model, the denial-of-service traffic model, the unknown traffic model and the normal traffic model obtained by training using an average weighted loss function to obtain a comprehensive final model. This fusion strategy fully considers the importance of different types of traffic, so that the final model can have good performance in various network attack situations.

[0086] In the output step, the method inputs the network traffic data to be judged into the final model to obtain the traffic type to which the network traffic data belongs. This step realizes the final goal of the application, that is, accurately identifying and classifying network traffic.

[0087] Further, the application specifies the data preprocessing operation in detail. Specifically, the preprocessing operation includes three main steps: first, converting all characters in the network traffic data to lowercase; second, deleting all tab characters and replacing characters with numbers and letters; and third, deleting all spaces and processing tab characters. The design of these steps aims to unify the data format, remove irrelevant information, and thus improve the efficiency and accuracy of subsequent processing.

[0088] When converting the preprocessed network traffic data into a format recognizable by the deep learning framework, the application adopts two key steps. First, the data is converted into binary form, specifically, using hexadecimal numbers to represent each character. This representation method not only effectively compresses the data, but also preserves all the information of the original data. Second, the converted data is truncated to a fixed length, and if it is insufficient, it is padded with character 0. This step ensures the consistency of the input data, which is beneficial to the processing of the deep learning model.

[0089] The technical solutions of the present application have shown significant advantages in practical application. For example, through the multi-task learning framework, the method can simultaneously process the two tasks of traffic classification and attack type identification, improving the comprehensive performance of the model. The carefully designed data preprocessing and format conversion steps greatly improve the data quality and provide a good foundation for model training. In addition, the use of the average weighted loss function to fuse different types of traffic models enables the final model to better balance the detection effect of various network attacks.

[0090] In summary, the network security intrusion detection method based on multi-task learning proposed by the present application realizes efficient and accurate network intrusion detection by innovatively combining multi-task learning, deep learning and data preprocessing technology. This method not only can effectively identify various types of network attacks, but also has good scalability and adaptability, providing a new technical path for improving network security protection capabilities. In a preferred embodiment of the present application, the proportions of the training set, validation set and test set can be flexibly selected to adapt to different data situations and training needs. Specifically, the present method provides a plurality of selectable data set division proportions, including (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3) or (5, 3, 2). These different division proportions each have their own advantages and can be selected according to actual circumstances.

[0091] For example, when the (7, 1, 2) proportion is selected, i.e. 70% of the data is used for training, 10% for validation and 20% for testing. This division method provides sufficient training data for the model while retaining a considerable proportion of data for final testing, which is suitable for situations with a large amount of data. The (5, 3, 2) division proportion increases the proportion of the validation set, which may be more advantageous when more detailed adjustment of model hyperparameters is required.

[0092] Another important aspect of the present application is the construction of the intrusion detection model. In one embodiment, the deep learning framework is set to a 10-layer Convolution-BN-Dropout-Relu-Pooling structure. This complex network structure can effectively extract deep features from network traffic data, thereby improving detection accuracy. Specifically, the function of each layer is as follows:

[0093] The deep learning framework of the present application contains 10 layers, and the specific structure is as follows:

[0094] 1. Input layer: receives raw traffic data;

[0095] 2. First convolutional layer: uses 64 3x3 convolutional kernels with a step size of 1;

[0096] 3. Batch normalization layer: standardizes feature maps to speed up training;

[0097] 4. ReLU activation layer: introduce nonlinearity;

[0098] 5. Second convolutional layer: use 128 3x3 convolutional kernels with a stride of 2;

[0099] 6. Batch normalization layer;

[0100] 7. ReLU activation layer;

[0101] 8. Dropout layer: randomly drop 50% of neurons to prevent overfitting;

[0102] 9. Fully connected layer: 1024 neurons;

[0103] 10. Softmax output layer: output corresponding classification results according to tasks;

[0104] The specific parameter settings of each layer are as follows:

[0105] • The padding of the convolutional layer is set to'same' to maintain the feature map size;

[0106] • The momentum parameter of the batch normalization layer is set to 0.99 and the epsilon is set to 1e -5 ;

[0107] • The dropout rate of the Dropout layer is dynamically adjusted during training, with an initial value of 0.5;

[0108] • The fully connected layer uses the He initialization method to initialize the weights;

[0109] In the preferred embodiment of the present application, the activation function is set to Leaky Relu. Compared with the traditional Relu function, Leaky Relu still has a small gradient when the input is negative, which helps to alleviate the "dead Relu" problem and enables the model to learn better.

[0110] The choice of loss function is crucial for model training. The method uses a multi-class cross-entropy loss function, because network intrusion detection is essentially a multi-classification problem. Cross-entropy loss function performs well in multi-classification problems, and can effectively measure the difference between predicted results and true labels.

[0111] Preferably, the present application uses Adam optimizer as the weight function. Adam optimizer combines the advantages of momentum method and RMSprop, and can adaptively adjust the learning rate, which is beneficial to the model to quickly converge to the optimal solution. The initial weight parameter is set to (0, 0.01), which helps the model to maintain stability in the early stage of training.

[0112] The method also adopts a dynamic learning rate strategy. The initial learning rate is set to 0.01, and is attenuated to 1 / 5 of the original every 20 rounds. This strategy allows the model to learn quickly in the early stages of training, while making more detailed parameter adjustments in the later stages, which helps to find better solutions.

[0113] During training, each batch is set to perform 100 iterations for a total of 100 rounds. This setting ensures sufficient training while also considering the rational use of computing resources. The pooling layer is set to 3*3 with a step of 3, which helps to effectively reduce the data dimension while preserving important features.

[0114] Another innovation of the present application is the use of an average weighted loss function to fuse different types of traffic models. Specifically, the method sets different loss weights for different types of traffic: the high-risk traffic loss weight is 0.9, the denial-of-service traffic loss weight is 0.7, the unknown-rejection traffic loss weight is 0.3, and the normal traffic loss weight is 0.1. This setting reflects the importance of different types of traffic in network security, allowing the model to pay more attention to high-risk traffic types.

[0115] The calculation formula of the average weighted loss function is as follows:

[0116]

[0117] where L is the average weighted loss, N is the number of network traffic data, w i is the loss weight for different traffic, c i is the classification result of each batch of network traffic data, y i is the label of each batch of network traffic data.

[0118] The design of this loss function allows the model to consider the importance of different types of traffic during training, thereby maintaining good detection performance in various network attack scenarios.

[0119] To make the model adaptable to changing network environments, the present application also introduces a dynamic updating mechanism. Specifically, the method periodically collects new network traffic data and adds it to the training set. Then, based on the updated training set, the intrusion detection model is retrained to obtain the updated final model. This dynamic updating mechanism allows the model to continuously learn new network attack patterns, maintaining its timeliness in detection ability.

[0120] Overall, the present application realizes an efficient, accurate and adaptive network security intrusion detection method through the careful design of network structure, training strategy and dynamic updating mechanism. This method not only can effectively identify various types of network attacks, but also can evolve with the changes of network environment, providing strong technical support for network security protection. In another preferred embodiment of the present application, the intrusion detection model also introduces a self-attention mechanism. The main role of this mechanism is to combine the output results of branch A and branch B, so as to further improve the accuracy of the intrusion detection model. The self-attention mechanism can capture the long-range dependencies in the data, which is particularly important in network traffic analysis, because some attack patterns may have complex correlations in time or space.

[0121] Specifically, the self-attention mechanism calculates the correlation between each element in the input sequence and all other elements to generate an attention weight matrix. This weight matrix is then used to weight the sum of the inputs to obtain a new representation. In the present application, this mechanism is applied to the output of branch A and branch B, so that the model can better understand the mutual relationship between different features, and thus make more accurate judgments.

[0122] The core innovation of the present application is to propose a new "bidirectional attention-enhanced multi-task learning framework" (BAE-MTL). This framework not only realizes the parallel learning of branch A and branch B, but more importantly, through the innovative bidirectional attention mechanism, realizes the deep interaction and complementarity between the two branches.

[0123] Specifically, the innovation points and technical means of the BAE-MTL framework are as follows:

[0124] 1. Bidirectional attention mechanism:

[0125] The features between branch A and branch B are interacted through the bidirectional attention mechanism. This mechanism allows each branch to focus on the most relevant features in the other branch, thereby improving overall performance.

[0126] Let F A and F B be the feature maps of branch A and B respectively, and the bidirectional attention is calculated as follows:

[0127]

[0128] Where W AB and W BA are learnable weight matrices, and α and β are balance parameters.

[0129] 2. Dynamic Feature Fusion:

[0130] Before the final classification layer, we introduce a dynamic feature fusion mechanism. This mechanism dynamically adjusts the contribution weights of the two branches based on the current input features.

[0131]

[0132] where W f and b f are learnable parameters.

[0133] 3. Multi-Scale Feature Extraction:

[0134] To capture different scales of attack patterns, we introduce a multi-scale feature extraction module in each branch. This module uses different sizes of convolution kernels to process the input in parallel and then concatenates the results.

[0135] F multi = concat([conv 1×1 (F),conv 3×3 (F),conv 5×5 (F),maxpool(F)]),

[0136] 4. Residual Attention Block:

[0137] In each branch, we use an improved residual attention block to extract more effective features. This structure combines residual connections and channel attention mechanisms.

[0138] X res = conv(X) + X,

[0139] X att = X res × σ(MLP(globalpool(X res ))),

[0140] 5. Hierarchical Adaptive Loss Function:

[0141] We propose a hierarchical adaptive loss function that dynamically adjusts the loss weights of different layers based on the difficulty of the task. For branch A (binary classification task) and branch B (multi-classification task), the loss functions are defined as follows:

[0142] Loss function for branch A (improved binary cross-entropy):

[0143] L A = -∑[ylog(p) + (1-y)log(1-p)] × (1+γ|p-y|),

[0144] where y is the true label, p is the predicted probability, and γ is a tunable parameter to enhance the penalty on hard-to-classify samples.

[0145] Loss function for branch B (improved multi-class cross-entropy):

[0146] L B = -∑[y i log(p i )]×(1+λ(1-max(p))),

[0147] where y i is the one-hot encoding of the true label, p i is the predicted probability distribution, and λ is a tunable parameter to enhance the penalty on low-confidence predictions.

[0148] Total loss function:

[0149] L total = αL A + βL B + θL reg ,

[0150] where α and β are the weights to balance the two tasks, L reg is the regularization term, and θ is the regularization coefficient.

[0151] These innovative technical means and algorithms collectively form the core of the invention, enabling our method to achieve excellent performance in both traffic attack judgment and attack type classification. Through the BAE-MTL framework, we not only achieve multi-task learning, but also enhance the model's expression and generalization capabilities through various mechanisms, enabling it to better cope with complex and variable network attack scenarios.

[0152] Preferably, the invention also includes a step of data augmentation on network samples. The core idea of this step is to generate multiple attack traffic data of the same type by transforming normal traffic. This data augmentation method not only increases the number of training samples, but more importantly, it improves the model's ability to identify various attack variants.

[0153] In actual operation, data augmentation can be achieved in various ways. For example, slight modifications can be made to normal traffic data, such as changing the values of certain fields, adjusting the order or time interval of data packets, etc. These transformations should be subtle enough to simulate real attack behavior, but not so drastic as to completely change the essential characteristics of the data. The "simulated attack data" generated in this way is then added to the network samples for model training.

[0154] One significant advantage of this data augmentation method is that it can help the model learn more diverse attack patterns, including those that may not be common in existing data sets. This is important for improving the model's generalization ability and robustness, allowing it to better handle unknown or emerging attack types.

[0155] Next, the present application also proposes a network security intrusion detection system based on multi-task learning corresponding to the above method. The system includes multiple functional modules, each with its specific responsibilities, working together to achieve efficient and accurate intrusion detection.

[0156] First, the sample collection module 1 is responsible for obtaining network traffic data and intrusion detection data. The design of this module takes into account the complexity of the actual network environment, and can handle multiple types of data such as normal traffic, high-risk traffic, denial-of-service traffic, and unknown denial-of-service traffic. The efficient operation of the sample collection module 1 lays a solid foundation for subsequent data processing and model training.

[0157] The data preprocessing module 2 receives the raw data from the sample collection module 1 and performs preprocessing operations on it. This module implements the various preprocessing steps described earlier, such as character conversion, deletion of irrelevant characters, etc. The output of the data preprocessing module 2 is cleaned and standardized data, which greatly improves the efficiency and accuracy of subsequent processing.

[0158] The format conversion module 3 is responsible for converting the preprocessed network traffic data into a format that can be recognized by deep learning frameworks. The design of this module fully considers the needs of different deep learning frameworks, ensuring the compatibility and universality of data formats.

[0159] The data segmentation module 4 divides the formatted network traffic data into training set, validation set and test set. The flexible design of this module allows the division ratio of data sets to be adjusted according to actual needs, to adapt to different training strategies and data characteristics.

[0160] The model construction module 5 is one of the core components of the system, responsible for constructing an intrusion detection model with two parallel branches. This module implements the complex network structure described earlier, including the configuration of multiple layers of convolution, batch normalization, dropout, etc. The innovative design of the model construction module 5 allows the system to simultaneously handle traffic classification and attack type identification, two related but different tasks.

[0161] The model construction module 5 of the present application includes the configuration of multiple layers of convolution, batch normalization, dropout, etc.

[0162] Specifically:

[0163] Multi-layer convolution: In addition to the two main convolutional layers mentioned earlier, the model also adds additional convolutional layers in branches A and B, respectively. Branch A adds a 1x1 convolutional layer for feature dimension reduction, and branch B adds a dilated convolutional layer to expand the receptive field, which helps capture long-range dependencies.

[0164] Batch normalization: A batch normalization layer follows each convolutional layer. Batch normalization is not only used in the backbone network but also in the residual blocks and attention mechanisms to ensure the stability of feature distribution.

[0165] Dropout: In addition to the Dropout layer in the backbone network, Dropout layers are also added after the output of the residual blocks in branch A and the GRU units in branch B, with dropout rates of 0.3 and 0.4, respectively.

[0166] In addition, the model also introduces the following innovative structures:

[0167] Feature Pyramid Network (FPN): used to extract multi-scale features, which is beneficial for detecting attack patterns of different scales. FPN contains a top-down path and lateral connections, and a 1x1 convolution is used for feature adjustment at each scale level.

[0168] Cross-layer connection: inspired by the idea of DenseNet, cross-layer feature reuse is achieved. Specifically, every two layers are concatenated with all previous layers' feature maps, and then reduced by 1x1 convolution.

[0169] Dynamic convolution: the weights of the convolution kernel are not fixed but dynamically generated according to the input. This improves the model's adaptive ability, especially when facing new attacks.

[0170] The training module 6 trains the intrusion detection model based on the training set, validation set and test set provided by the data segmentation module 4. This module implements various training strategies described earlier, such as learning rate adjustment, loss function calculation, etc. The efficient operation of the training module 6 ensures that the model can fully learn the features and patterns in the data.

[0171] The fusion module 7 uses an average weighted loss function to fuse the various traffic models trained, ultimately obtaining a comprehensive model. The design of this module embodies the idea of multi-task learning, by reasonably allocating the weights of different tasks, achieving overall optimization of the model performance.

[0172] The prediction module 8 is responsible for inputting the network traffic data to be judged into the final model and outputting the traffic type to which the network traffic data belongs. This module is the "front end" of the system, directly facing the user, providing real-time intrusion detection results.

[0173] Finally, the updating module 9 implements the dynamic updating function of the system. It periodically collects new network traffic data, adds it to the training set, and re-trains the intrusion detection model. The presence of the updating module 9 enables the system to continuously learn and adapt to the changing network environment, maintaining the timeliness of detection capabilities.

[0174] In summary, the network security intrusion detection system based on multi-task learning proposed by the present application achieves efficient, accurate and adaptive intrusion detection through the cooperative work of multiple functional modules. This system design not only can effectively identify various types of network attacks, but also can continuously evolve with the changes of network environment, providing a comprehensive and powerful solution for network security protection.

[0175] It should be noted that the above description is only a preferred embodiment of the present application, and is not intended to limit the present application. Any modification, substitution or improvement made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A network security intrusion detection method based on multi-task learning, characterized in that ,include: The acquisition steps include: Acquire network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial-of-service traffic, and denial-of-unknown traffic; The processing steps include: Based on the network traffic data, perform data preprocessing operations to obtain preprocessed network traffic data; Based on the preprocessed network traffic data, it is converted into a format that can be recognized by the deep learning framework to obtain formatted network traffic data; Based on the formatted network traffic data, it is divided into a training set, a validation set, and a test set; Based on the training set, validation set, and test set, a bidirectional attention-enhanced multi-task learning framework is constructed and trained, which includes two parallel branches: branch A is used to determine whether traffic belongs to attack data, and branch B is used to classify the attack type of the attack data. Branch A and branch B interact with each other through a bidirectional attention mechanism. The bidirectional attention calculation formula is as follows: , , , , wherein, and are feature maps of branches A and B, respectively, and are learnable weight matrices, and are balancing parameters; The bidirectional attention-enhanced multi-task learning framework also includes a dynamic feature fusion layer, used to dynamically adjust the contribution weights of the two branches based on the features of the current input. The formula for calculating the fusion weight is as follows: , , wherein, and are learnable parameters, is a sigmoid activation function; Based on the training results of the intrusion detection model, the high-risk traffic model, denial-of-service traffic model, unknown denial-of-service traffic model, and normal traffic model obtained by the training are fused using an average weighted loss function to obtain the final model; Output steps, including: Input the network traffic data to be judged into the final model, and output the traffic type to which the network traffic data belongs.

2. The method of claim 1, wherein The data preprocessing operation specifically includes: Convert all characters in the network traffic data to lowercase; Delete all tabs from the network traffic data; Replace characters with numbers and letters; Remove all spaces from the network traffic data.

3. The method of claim 1, wherein Converting the preprocessed network traffic data into a format recognizable by the deep learning framework specifically includes: The preprocessed network traffic data is converted into binary, so that each character of the preprocessed network traffic data is represented by a hexadecimal number; The preprocessed network traffic data is truncated to a fixed length, and if the length is insufficient, it is padded with the character 0.

4. The method of claim 1, wherein The ratio of the training set, validation set, and test set is any one of (7, 1, 2), (7, 1, 1), (6, 2, 2), (5, 2, 3), or (5, 3, 2).

5. The method of claim 1, wherein The construction of the intrusion detection model specifically includes: The deep learning framework is configured with a 10-layer Convolution-BN-Dropout-ReLU-Pooling structure. Set the activation function to Leaky ReLU; Set the loss function to the multi-class cross-entropy loss function; Set the weighting function to the Adam optimizer; Set the initial weight parameters to (0, 0.01); The initial learning rate was set to 0.01 and gradually decreased, decreasing to 1 / 5 of the original rate every 20 rounds. Each batch is set to run 100 iterations, for a total of 100 iterations; All pooling layers are set to 3×3 with a step size of 3.

6. The method of claim 1, wherein The average weighted loss function is used to fuse the high-risk traffic model, the denial-of-service traffic model, the denial-of-unknown traffic model and the normal traffic model, and the specific process includes: The loss weight of the high-risk traffic is set to 0.9, the loss weight of the denial-of-service traffic is set to 0.7, the loss weight of the denial-of-unknown traffic is set to 0.3, and the loss weight of the normal traffic is set to 0.

1. The final loss is aggregated by the average weighted loss function, and the model parameters are updated.

7. The method of claim 1, wherein The method further includes: Periodically collecting new network traffic data; Adding the new network traffic data to the training set; Based on the updated training set, retraining the intrusion detection model to obtain an updated final model.

8. The method of claim 1, wherein The intrusion detection model further includes a self-attention mechanism for combining the output results of branch A and branch B to further improve the accuracy of the intrusion detection model.

9. The method of claim 1, wherein The method further includes a step of data expansion on network samples: Transforming the normal traffic to form multiple same-type attack traffic data from the normal traffic data; Adding the transformed normal traffic data as attack traffic data to the network samples.

10. A network security intrusion detection system based on multi-task learning for implementing the method of any one of claims 1-9, characterized in that The method includes: A sample collection module for obtaining network traffic data and intrusion detection data, wherein the intrusion detection data includes normal traffic, high-risk traffic, denial-of-service traffic and denial-of-unknown traffic; A data preprocessing module for preprocessing the network traffic data; A format conversion module for converting the preprocessed network traffic data into a format that can be recognized by a deep learning framework; A data segmentation module for segmenting the formatted network traffic data into a training set, a validation set and a test set; A model construction module for constructing a bidirectional attention enhanced multi-task learning framework, which includes two parallel branches, wherein branch A is used to determine whether the traffic belongs to attack data, and branch B is used to classify the attack type of the attack data; the branches A and B interact through a bidirectional attention mechanism and include a dynamic feature fusion layer; A training module for training the intrusion detection model based on the training set, the validation set and the test set; A fusion module for fusing the high-risk traffic model, the denial-of-service traffic model, the denial-of-unknown traffic model and the normal traffic model obtained by training to obtain a final model by using an average weighted loss function; A prediction module for inputting network traffic data to be judged into the final model to output the traffic type to which the network traffic data belongs; An update module for periodically collecting new network traffic data, adding it to the training set, and retraining the intrusion detection model.

Images