5G mobile network intrusion detection method and system based on Transform model, and storage medium

Abstract

The invention relates to the technical field of network intrusion detection, in particular to a 5G mobile network intrusion detection method and system based on a Transform model and a storage medium. The method comprises the following steps: collecting a network intrusion detection data stream, generating an original alarm, and preprocessing the original alarm to form an alarm sequence; performing alarm embedding on the alarm sequence, and outputting the embedding representation of each alarm; based on a Transform encoder, inputting the embedded representation of each alarm, and outputting an attack activity feature vector; and classifying the input attack activity feature vectors, and outputting attack activity types. According to the method, the model pays more attention to alarms related to important alarms and neglects noise alarms or error alarms, so that the robustness and precision of the model are improved.

Description

Technical Field

[0001] The present invention relates to the field of network intrusion detection technology, and in particular to a 5G mobile network intrusion detection method, system and storage medium based on a Transformer model. Background Art

[0002] With the rapid development of the Internet, network security issues are becoming increasingly serious. How to protect the integrity of network information and reduce the losses caused by network attacks has become an urgent problem to be solved. Intrusion detection system is a network or host system that can identify unsafe time and issue an alarm. Typical 5G mobile network intrusion detection methods include Figure 1 As shown. A Network Intrusion Detection System (NIDS) is deployed in the user plane bypass of the edge network, bearer network, and core network. The device detects potential attack behaviors in network traffic based on predefined rules and sends them to the security event analysis center. The security event analysis center uses tools to deduplicate and filter alarms and aggregate them based on IP addresses. Since the alarms generated by NIDS generally have a high error rate, it is necessary to rely on manual verification of alarms. By associating the alarms generated by unified attack activities, a complete attack scenario is constructed, and based on this, the type of attack activity is determined based on rules and manual analysis.

[0003] This type of mobile network intrusion detection method relies heavily on manual analysis, requiring manual verification of alarms, alarm correlation analysis, and determination of attack activities. The workload is mainly reflected in two aspects: 1) The intrusion detection equipment deployed at the network boundary relies on predefined rules. This mechanism leads to a high alarm error rate. There are a large number of false positives and negatives in the generated alarm sequence, and a large amount of manpower costs are required to verify the alarms; 2) It relies on manual determination of the type of attack activity, which has high manpower costs and is highly dependent on manual experience. The analysis of attack activities lacks objectivity and accuracy. Considering the growing scale of attacks and the increasingly complex attack activities, the mobile network intrusion detection method that relies on manual labor faces huge manpower cost overhead.

[0004] Later, with the development of artificial intelligence, many researchers tried to use AI to complete intrusion detection. AI-enabled mobile network attack detection is an effective way to reduce the manual analysis load of attack activities. Mobile network detection methods based on artificial intelligence (AI) can be divided into two categories according to the input data type.

[0005] Determine the alarm type based on network traffic characteristics, such as Figure 2As shown in the figure, this type of method collects network traffic, extracts network features, and uses deep learning models such as Convolution Neural Network (CNN) and Recurrent Neural Network (RNN) to detect the type of alarm. The advantage of this method is that it reduces the overhead of manual maintenance of alarm rules, but it still relies on manual verification of alarms, correlation analysis, and determination of attack activities.

[0006] Determine the type of attack activity based on the alarm sequence, such as Figure 3 As shown in FIG, this type of method collects alarms generated by NIDS; generates alarm vectors by encoding or embedding the alarms in natural language processing (NLP) text; then, based on the timestamp, the alarms in a fixed time window are used as alarm sequences associated with the same attack activity, and are input into the time series model to determine the type of attack activity. There are also attack activity determination methods based on alarm sequences that use hidden Markov models (HMM) to solve the problem of attack activity determination. This method first generates templates of known attack activities and stores them in a template library; for the captured attack activities, the type of attack activity is determined by comparing the similarity between the activity and the known attack activity templates in the template library.

[0007] AI-enabled mobile network attack detection methods input alarm sequences and output classification results of attack activities. The accuracy of its detection depends largely on the quality of the alarms. It is generally believed in the AI ​​community that data quality is crucial to the accuracy of AI methods, so-called "garbage in, garbage out". However, the poor quality of alarm sequences is a common problem, which is mainly reflected in two aspects:

[0008] 1) The rigid attack sequence segmentation mechanism leads to noise pollution in the alarm sequence. Before inputting the alarm sequence into the AI ​​model, the alarm needs to be segmented first, that is, the alarm sequence is divided to determine which alarms belong to the same attack activity. The general method is to segment the alarm sequence based on the time window and the timestamp of the alarm. That is to say, the alarms in the same window are identified as the same attack activity, and the alarms of the same attack activity are input into the AI ​​model for training and prediction. However, a time window may be mixed with alarms of other attack activities. These irrelevant alarms are called "noise alarms". These noise alarms will affect the detection performance of the AI ​​model;

[0009] 2) Low-quality alarms. Ideally, each alarm should correspond to an attack behavior. However, in practice, due to factors such as rule aging and the evolution of network attack technologies, NIDS generates a large number of false positive (FP) and false negative (FN) alarms, resulting in a decrease in alarm quality. False positives introduce erroneous information and hinder the extraction of effective features, while FN alarms lead to the loss of key attack features. These low-quality alarms significantly increase the difficulty of extracting effective attack patterns for the classifier, thereby reducing detection performance. Summary of the invention

[0010] The present invention aims to solve the problem of poor detection performance of traditional attack detection schemes in low-quality alarm scenarios, and provides a 5G mobile network intrusion detection method, system and storage medium based on the Transformer model. The method adaptively discovers the correlation between alarms, and based on this, realizes the automatic characterization of attack activities and supports automatic classification. At the same time, in order to solve the problem of heavy workload of analysts in manually verifying the classification results of attack activities, an aggregation method based on sequence similarity is proposed, so as to achieve the purpose of reducing the workload of security operation center (SOC) staff.

[0011] To achieve the above object, the technical solution of the present invention is as follows:

[0012] In a first aspect, the present invention provides a 5G mobile network intrusion detection method based on a Transformer model, comprising:

[0013] S1, collect network intrusion detection data stream, generate original alarm, pre-process the original alarm, and form an alarm sequence;

[0014] S2, embed the alarm sequence into alarms and output the embedded representation of each alarm;

[0015] S3, based on the Transformer encoder, inputs the embedded representation of each alert and outputs the attack activity feature vector; specifically includes:

[0016] S301, the Transformer encoder extracts important warning vectors to form an important warning vector sequence;

[0017] S302, using the Transformer encoder to learn the association between important alarms and each alarm, and generate an attention score vector;

[0018] S303, based on the attention score vector, realizing attack activity vector representation;

[0019] S4. Classify the input attack activity feature vector and output the attack activity type.

[0020] Furthermore, in step S1, the original alarm is pre-processed, including: filtering the original alarm and deleting duplicate alarms; then performing importance assessment and classifying the threat levels of the alarms; and segmenting the classified alarms into sequences to form alarm sequences.

[0021] Furthermore, in step S302, the Transformer encoder is used to learn the association between the important alarm and each alarm to generate an attention score vector; specifically, the following steps are included:

[0022] Set the important alarm vector sequence to X 1 , the complete warning vector sequence is X 2 , where the important warning vector sequence X 1 It is a vector sequence composed of important warning vectors marked after the warning is classified by threat level; the complete warning vector sequence X 2 It is a vector sequence composed of all the alarms embedded in the set time period;

[0023] The Transformer encoder has a self-attention mechanism, which consists of three neural networks: the query neural network, the key neural network, and the value neural network.

[0024] The important alarm vector sequence X 1 Input the query neural network and get the query vector Q i ;

[0025] The complete warning vector sequence X 2 Input the key neural network and the value neural network to get the key vector K i Sum value vector V i ; Get the attention score matrix;

[0026] Normalize all attention scores in the attention score matrix to get the attention score vector.

[0027] Furthermore, all attention scores are normalized using the Softmax function.

[0028] Furthermore, the Transformer encoder has at least one self-attention mechanism, and all self-attention mechanisms learn the association between important alarms and each alarm in parallel and independently.

[0029] Furthermore, in step S303, the attack activity vector representation is realized based on the attention score vector, and the specific method is as follows:

[0030]

[0031] In the above formula, d k Indicates Q i ,K i ,K i The dimension of i ranges from 1 to h, where h represents the number of self-attention mechanisms in the Transformer encoder.

[0032] Furthermore, the original alarm is filtered, specifically including: deleting duplicate alarms from the original alarm using five-tuple information, wherein the five-tuple information is source IP, target IP, source port, target port, and transport layer protocol.

[0033] Furthermore, sequence segmentation is performed, specifically including: counting the expected ε and variance σ of each type of alarm posterior alarm, if the time difference Δt between the current alarm and the subsequent alarm of the same type>ε+3σ, then it is determined that the current alarm and the subsequent alarm of the same type belong to different alarm sequences.

[0034] Furthermore, the 5G mobile network intrusion detection method further includes:

[0035] S5, clustering the attack activity feature vector to obtain multiple clusters;

[0036] S6. Manually verify multiple clusters.

[0037] Furthermore, in step S5, the attack activity feature vector is clustered to obtain a plurality of clusters, specifically including: using a DBSCAN-based clustering method to aggregate the attack activity feature vector to obtain a plurality of clusters, each cluster representing a plurality of alarm sequences with similar features.

[0038] In a second aspect, the present invention provides a 5G mobile network intrusion detection system based on a Transformer model, which is used to implement the above-mentioned 5G mobile network intrusion detection method based on a Transformer model. The 5G mobile network intrusion detection system includes:

[0039] The alarm preprocessing module is used to collect network intrusion detection data streams, generate original alarms, and preprocess the original alarms to form alarm sequences;

[0040] An attack activity classification module, wherein the attack activity classification module includes an embedder, an encoder, and a classifier;

[0041] The embedder is used to embed alarms into the alarm sequence and output the embedded representation of each alarm;

[0042] The encoder is a Transformer encoder, the embedded representation of each alarm is input into the encoder, and the encoder outputs an attack activity feature vector;

[0043] The classifier is used to classify the input attack activity feature vector and output the attack activity type.

[0044] Furthermore, the 5G mobile network intrusion detection system also includes:

[0045] The attack activity aggregation module is used to cluster the attack activity feature vectors to obtain multiple clusters.

[0046] In a third aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the above-mentioned 5G mobile network intrusion detection method based on the Transformer model is implemented.

[0047] Compared with the prior art, the present invention has the following beneficial effects:

[0048] The 5G mobile network intrusion detection method based on the Transformer model provided by the present invention evaluates the importance of alarms and uses a multi-head attention mechanism to extract the correlation between important alarms and other alarms, so that the model pays more attention to alarms related to important alarms and ignores noise alarms or false alarms, thereby improving the robustness and accuracy of the model.

[0049] The present invention uses the encoder of the Transformer model to intelligently learn the feature representation of attack activities according to the alarm sequence, and based on the feature representation, performs intelligent classification and aggregation. Subsequent manual verification only requires verification of the cluster centers of multiple clusters or random sampling in the cluster, which greatly reduces the workload of SOC staff. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 Schematic diagram of a typical 5G mobile network intrusion detection method in the prior art.

[0051] Figure 2 The figure is a flow chart of determining the alarm type based on network traffic characteristics in the prior art.

[0052] Figure 3 The figure is a flow chart of determining the type of attack activity based on the alarm sequence in the prior art.

[0053] Figure 4 It is a schematic diagram of the method flow of the present invention.

[0054] Figure 5A schematic diagram of the process of embedding, encoding and classifying alarms in the attack activity classification module of the present invention. DETAILED DESCRIPTION

[0055] The technical solution of the present invention will be clearly described below in conjunction with the accompanying drawings. Obviously, the described embodiments are not all embodiments of the present invention, and all other embodiments obtained by ordinary technicians in the field without making creative work are within the protection scope of the present invention.

[0056] It should be noted that, unless otherwise specifically stated, the relative arrangements of components and steps, and numerical expressions set forth in these embodiments should not be construed as limiting the scope of the present invention.

[0057] The following description of the exemplary embodiments is merely illustrative and is not intended to limit the present invention and its application or use in any sense. Techniques, methods and devices known to ordinary technicians in the relevant field may not be discussed in detail here, but where applicable, these techniques, methods and devices should be considered as part of this specification.

[0058] Embodiment 1

[0059] This embodiment provides a 5G mobile network intrusion detection method based on the Transformer model. Figure 4 As shown, including:

[0060] S1. Collect network intrusion detection data streams, generate original alarms, and pre-process the original alarms to form alarm sequences; pre-processing includes three processes:

[0061] Alarm deduplication: Use five-tuple information to delete duplicate alarms from massive raw data sets, thereby reducing the size of data to be analyzed. The five-tuple information refers to source IP, destination IP, source port, destination port, and transport layer protocol.

[0062] Alarm importance assessment: Intrusion detection devices generate a large number of alarms, and different alarms contribute differently to the classification of attack activities. For example, there are often a large number of precursor alarms, such as detection and scanning, at the beginning of an attack. Since attackers often detect a large number of ports / vulnerabilities, the number of such precursor alarms is often large. However, since such alarms exist in the vast majority of attack activities and are not specific, their characteristics have limited contribution to improving classification performance. During the analysis of attack activities, attention should be paid to events that may have a substantial impact on the victim. Such events are more representative and contribute more to identifying attack types. Therefore, this embodiment divides attack activities into different stages according to the ATT&CK framework, attack targets and attack methods. Each stage of an attack causes different degrees of harm to the system, so the alarm threat level can be classified. The division principles are shown in Table 1.

[0063] Table 1 Alarm importance classification principles

[0064] Attack Phase Threat Level Attack Phase Threat Level reconnaissance generally Resource Development generally Initial visit generally implement important Persistence generally Privilege Escalation important Defense Evasion generally Credential Access important Detection generally Lateral movement generally collect important Command and Control important Data breach important Influence important

[0065] Alarm sequence segmentation: In the same time period, the victim device may suffer from multiple attack activities. The goal of alarm sequence segmentation is to divide the alarm set suffered by the victim into multiple alarm sequences. These alarm sequences will be input into the classifier to determine the type of attack activity. Traditional segmentation schemes are relatively coarse-grained because such schemes only segment the alarm set associated with the victim device based on the time window. For example, the alarm set is divided into 1 hour granularity, that is, the alarm within the first hour is 1 attack activity, and the alarm within the second hour is the second attack activity. However, there are two problems with this. On the one hand, it is impossible to handle the situation where multiple attack activities are contained in one time window. On the other hand, there may be a large number of noise alarms in the alarm sequence generated according to the time window, which affects the learning of the classifier.

[0066] In this embodiment, the expected ε and variance σ of each type of alarm posterior alarm are counted. If the time difference Δt>ε+3σ between the current alarm and the subsequent alarm of the same type, it is determined that the current alarm and the subsequent alarm of the same type belong to different alarm sequences.

[0067] For example, "555 port scan" is used in 10 attack activities. The present invention counts the time difference between "555 port scan" and the a posteriori alarm in these 10 attack activities, and obtains the expectation and variance. When the time difference between "555 port scan" and the subsequent alarm is greater than, it is considered that this is a new attack activity, that is, "555 port scan" and the subsequent alarm should belong to two different alarm sequences.

[0068] S2, embed the alarm sequence into alarms and output the embedded representation of each alarm;

[0069] The input of the embedder is the summary information of each alarm in the alarm sequence (usually the "msg" field of the alarm), and the output is the embedded representation of the summary information, wherein the embedded representation can represent the semantic features of the alarm.

[0070] The specific embedding method is as follows:

[0071] First, extract the summary information of the alarm. The summary information of each alarm is actually a piece of text, for example: "GlibcGhost Attack-Buffer Overflow Attempt (EHLO)". The Doc2Vec paragraph vector method is an unsupervised algorithm that can learn fixed-length feature representations from variable-length texts (for example, sentences, paragraphs, and documents). This embodiment uses Doc2Vec to encode the summary information of each alarm to capture the potential structure and semantic relationships in the sentence, thereby improving the accuracy of the alarm representation. The Distributed Bag of Words (DBOW) model is a Doc2Vec encoding algorithm that is more efficient than other Doc2Vec schemes. Therefore, in this embodiment, the DBOW model is used to pre-train a robust encoding model, and then the pre-trained model is used to complete the alarm embedding. The text embedding process is as follows:

[0072] X′=f Doc2Vec (D) (1)

[0073] In the above formula, D represents the alarm sequence, f Doc2Vec Represents the text vector generation function X′ learned by Doc2Vec.

[0074] In an alarm sequence, the alarm type at the previous moment will affect the alarm type at the next moment. The order of appearance in a sequence is also an important feature information for attack activity detection. In order to characterize the position information of the alarm in the sequence, this embodiment uses the Transformer position encoding matrix PE to extract the alarm position information. m Represents the feature dimension of the alert vector. For an attack activity, the position embedding is calculated as follows:

[0075]

[0076] Where i represents the position of the current alarm in the sequence, j is used to determine the parity of the current sequence, and for elements at odd positions, formula (3) is used for position embedding, and for elements at even positions, formula (2) is used for position embedding. In formulas (2) and (3), the position encodings of all alarms are in the interval [0,1], and formulas (2) and (3) can well reflect the distance between different alarm vectors. Finally, by adding the text encoding and the position encoding, the input embedding vector is obtained, denoted as X.

[0077] X=X′+PE (4)

[0078] S3, based on the Transformer encoder, inputs the embedded representation of each alert and outputs the attack activity feature vector;

[0079] The role of the encoder is to learn the vector encoding of attack activities from the alarm vector sequence. The input is the embedded representation of the alarm sequence, and the output is the feature vector of the attack activity. In the existing network scenario, the collected attack sequence may contain interference information. For example, in an alarm sequence, there may be a large number of false alarms and noise alarms. Therefore, the encoder needs to have the ability to learn the alarm association relationship, that is, to focus on alarms that are highly associated with attack activities and ignore interference information. Since the multi-head attention mechanism of Transformer can well extract the association relationship between different inputs, this embodiment uses the encoder of the Transformer model to extract the features of the alarm sequence.

[0080] Transformer is a deep learning model that uses an attention mechanism. This mechanism can assign different weights according to the importance of each part of the input data. Its core is the multi-head attention mechanism (Multi-HeadAttention). The multi-head attention mechanism is composed of multiple self-attention mechanisms. The self-attention mechanism (SelfAttention) can assign different attention scores to each element according to the different correlations between the elements in the input sequence, so that the model can pay more attention to and amplify the influence of important elements in the input sequence and reduce the influence of unimportant elements. The multi-head attention mechanism obtains the correlation between elements at a specific position and elements at different positions by running multiple independent self-attention mechanisms in parallel, thereby more comprehensively capturing the potential correlation in the sequence. Figure 5 The specific processing process is as follows:

[0081] S301, the Transformer encoder extracts important warning vectors to form an important warning vector sequence;

[0082] S302, using the Transformer encoder to learn the association between important alarms and each alarm, and generate an attention score vector;

[0083] Define h as the number of self-attention mechanisms in the Transformer encoder, and the sequence of important warning vectors is X 1 , the complete warning vector sequence is X 2 Here, the important alarm sequence refers to the vector sequence composed of important alarm vectors marked according to the ATT&CK framework, and the complete alarm vector sequence refers to the sequence composed of all alarms embedded in the time period. Each self-attention mechanism i consists of three neural networks, namely the query neural network, the key neural network and the value neural network, and their model parameters are expressed as and In this embodiment, the important alarm vector sequence X 1 Input the query neural network and get the query vector Q i ; The complete warning vector sequence X 2 Input the key neural network and the value neural network to get the key vector K i Sum value vector V i .

[0084]

[0085]

[0086] This embodiment is different from the implementation of the Transformer universal encoder. The input vectors of the query vector and the value vector of the key vector of the universal Transformer encoder are complete input sequences, and the multi-head self-attention mechanism of the Transformer is relied on to discover the association between the elements in the input sequence. The initial input of the query network of this embodiment is different from the initial input of the value network and the key network, that is, the initial input of the query network is an important alarm vector sequence, and the initial input of the value network and the key network is a complete alarm vector sequence. This processing is to simulate the process of analyzing manual attack activities, that is, during the attack activity analysis process, the SOC staff will first extract important alarms, and then search for common alarms associated with important alarms in the full alarm sequence, thereby forming an alarm sequence of the attack activity.

[0087] In this embodiment, the Transformer model is used to obtain the correlation between each alarm and the important alarm vector, that is, the attention score matrix in the Transformer model. The attention score matrix indicates the correlation between each alarm vector in the complete alarm vector sequence and the vector sequence of important alarms, and can also reflect the importance of the alarm to the entire attack.

[0088] Afterwards, the present invention uses the Softmax function to normalize all attention scores to obtain an attention score vector. The Softmax function can normalize the model output value to a range as the probability of the sample, which has good interpretability.

[0089] S303, based on the attention score vector, realizing attack activity vector representation;

[0090] The attention score matrix is ​​multiplied by the value vector and then divided by You can get the attention head's attack activity vector representation. Note that here we divide by This is because it can reduce the attention score to a suitable range, making the softmax function calculation more stable and easier to converge.

[0091]

[0092] In the above formula, d k Indicates Q i ,K i ,K i Dimension.

[0093] Finally, in order to comprehensively consider all attention mechanisms, that is, to integrate the associated information extracted by all attention mechanisms, the present invention concatenates the outputs of multiple self-attention mechanisms and then inputs them into a layer of neural network to form the final output. The model parameters of this layer of neural network are denoted as W O , specifically:

[0094] MultiHead(X)=Concat(head 1 ,…,head h )W O (9)

[0095] in,

[0096] head i =Attention(Q i ,K i ,V i ) (10)

[0097] After using the multi-head attention mechanism to extract vector correlation, the encoder structure also includes a feed-forward neural network (FFN) and an Add&Norm layer. The feed-forward neural network enables the model to learn complex features in the input data, thereby increasing the expressiveness of the model. The Add in the Add&Norm mechanism refers to the residual block. The core of the residual block is the residual connection. The residual connection allows the output of shallow neurons to bypass one or more layers and be directly spliced ​​into the output of subsequent layers. This can effectively alleviate the problems of gradient disappearance and gradient explosion during training, accelerate model convergence, and avoid overfitting. The Norm in the Add&Norm mechanism refers to the normalization module. Transformer uses the layer normalization method to improve training stability and accelerate convergence.

[0098] S4. Classify the input attack activity feature vector and output the attack activity type.

[0099] The function of the classifier is to classify attack activities. The input of the classifier is the feature vector representation of the attack activity, and the output is the classification result, that is, which type of attack the alarm sequence belongs to, such as Mirai.

[0100] S5, clustering the attack activity feature vector to obtain multiple clusters;

[0101] The attack activity type obtained in step S4 still needs to be manually verified to ensure the credibility of the classification result. Considering the huge scale of alarms, manual verification of all alarm sequences one by one is a huge labor cost. Since the alarms caused by different types of attacks present similar characteristics, this embodiment designs an attack activity aggregation module, the input of which is the feature representation of the alarm sequence, and the output is the aggregated cluster to reduce the load of manual verification and improve the verification efficiency. The module adopts a clustering method based on DBSCAN (Density-Based Spatial Clustering of Applications with Noise), which is a density-based clustering algorithm. This method finds clusters of arbitrary shapes and intelligently finds abnormal points, thereby effectively avoiding the influence of abnormal points on the clustering results. The attack activity aggregation module aggregates the attack activity feature vectors output by the encoder to obtain multiple clusters, each of which represents an alarm sequence with similar characteristics. When analysts perform manual verification of attack activities, they only need to verify the cluster center of each cluster or randomly sample in the cluster for verification, thereby greatly reducing the workload of manual verification.

[0102] S6. Manually verify multiple clusters.

[0103] Embodiment 2

[0104] This embodiment provides a 5G mobile network intrusion detection system based on a Transformer model, which is used to implement the 5G mobile network intrusion detection method based on a Transformer model provided in Embodiment 1. The 5G mobile network intrusion detection system includes:

[0105] The alarm preprocessing module is used to collect network intrusion detection data streams, generate original alarms, and preprocess the original alarms to form alarm sequences;

[0106] An attack activity classification module, wherein the attack activity classification module includes an embedder, an encoder, and a classifier;

[0107] The embedder is used to embed alarms into the alarm sequence and output the embedded representation of each alarm;

[0108] The role of the embedder is to map the alarm sequence to the vector space. The input of the embedder is the alarm sequence, and the output is the embedded representation of these alarm sequences, that is, the alarm vector sequence. This embodiment uses Doc2Vec to embed the text description of each alarm, and combines the position information of each alarm in the sequence to generate a vector representation of each alarm. The vector representation of each alarm in the alarm sequence is concatenated to form an embedded representation of the alarm sequence. The vector representation of the alarm sequence will be used to encode the alarm activity.

[0109] The encoder is a Transformer encoder, the embedded representation of each alarm is input into the encoder, and the encoder outputs an attack activity feature vector;

[0110] The classifier is used to classify the input attack activity feature vector and output the attack activity type.

[0111] The classifier consists of a fully connected neural network layer that can comprehensively extract the output of the encoding layer and use the Softmax activation function to achieve fine-grained classification of attack activity types.

[0112] The attack activity aggregation module is used to cluster the attack activity feature vectors to obtain multiple clusters. This module uses a clustering method based on DBSCAN (Density-Based Spatial Clustering of Applications with Noise), which is a density-based clustering algorithm. This method finds clusters of any shape and intelligently finds outliers, thereby effectively avoiding the influence of outliers on clustering results.

[0113] Embodiment 3

[0114] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the 5G mobile network intrusion detection method based on the Transformer model provided in Embodiment 1 is implemented.

[0115] The above specific implementation methods are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to examples, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A 5G mobile network intrusion detection method based on the Transformer model, characterized in that: include: S1, collect network intrusion detection data stream, generate original alarm, pre-process the original alarm, and form an alarm sequence; S2, embed the alarm sequence into alarms and output the embedded representation of each alarm; S3, based on the Transformer encoder, inputs the embedded representation of each alert and outputs the attack activity feature vector; specifically includes: S301, the Transformer encoder extracts important warning vectors to form an important warning vector sequence; S302, using the Transformer encoder to learn the association between important alarms and each alarm, and generate an attention score vector; S303, based on the attention score vector, realizing attack activity vector representation; S4. Classify the input attack activity feature vector and output the attack activity type.

2. The 5G mobile network intrusion detection method according to claim 1, characterized in that: In step S1, the original alarm is pre-processed, including: filtering the original alarm and deleting duplicate alarms; then performing importance assessment and classifying the threat levels of the alarms; and segmenting the classified alarms into sequences to form alarm sequences.

3. The 5G mobile network intrusion detection method according to claim 2, characterized in that: In step S302, the Transformer encoder is used to learn the association between important alarms and each alarm to generate an attention score vector; specifically, the following steps are included: Set the important alarm vector sequence as X1 and the complete alarm vector sequence as X2, where the important alarm vector sequence X1 is a vector sequence composed of important alarm vectors marked after the alarm is classified by threat level; the complete alarm vector sequence X2 is a vector sequence composed of all alarms embedded in the set time period; The Transformer encoder has a self-attention mechanism, which consists of three neural networks: the query neural network, the key neural network, and the value neural network. Input the important alarm vector sequence X1 into the query neural network to obtain the query vector Q i ; Input the complete alarm vector sequence X2 into the key neural network and the value neural network to obtain the key vector K i Sum value vector V i ; Get the attention score matrix; Normalize all attention scores in the attention score matrix to get the attention score vector.

4. The 5G mobile network intrusion detection method according to claim 3, characterized in that: All attention scores are normalized using the Softmax function.

5. The 5G mobile network intrusion detection method according to claim 4, characterized in that: The Transformer encoder has at least one self-attention mechanism, and all self-attention mechanisms learn the association between important alarms and each alarm in parallel and independently.

6. The 5G mobile network intrusion detection method according to claim 5, characterized in that: In step S303, the attack activity vector representation is realized based on the attention score vector. The specific method is as follows: In the above formula, d k Indicates Q i ,K i ,K i The dimension of i ranges from 1 to h, where h represents the number of self-attention mechanisms in the Transformer encoder.

7. The 5G mobile network intrusion detection method according to claim 2, characterized in that: The original alarm is filtered, specifically including: deleting duplicate alarms from the original alarm using five-tuple information, wherein the five-tuple information is source IP, target IP, source port, target port, and transport layer protocol.

8. The 5G mobile network intrusion detection method according to claim 2, characterized in that: Sequence segmentation is performed, specifically including: counting the expected ε and variance σ of each type of alarm posterior alarm, if the time difference Δt between the current alarm and the subsequent alarm of the same type is greater than ε+3σ, then the current alarm and the subsequent alarm of the same type belong to different alarm sequences.

9. The 5G mobile network intrusion detection method according to claim 1, characterized in that: The network intrusion detection method also includes: S5, clustering the attack activity feature vector to obtain multiple clusters; S6. Manually verify multiple clusters.

10. The 5G mobile network intrusion detection method according to claim 9, characterized in that: In step S5, the attack activity feature vector is clustered to obtain a plurality of clusters, specifically including: using a DBSCAN clustering method to aggregate the attack activity feature vector to obtain a plurality of clusters, each cluster representing a plurality of alarm sequences with similar features.

11. A 5G mobile network intrusion detection system based on a Transformer model, used to implement the 5G mobile network intrusion detection method based on a Transformer model according to any one of claims 1 to 10, characterized in that: The 5G mobile network intrusion detection system comprises: The alarm preprocessing module is used to collect network intrusion detection data streams, generate original alarms, and preprocess the original alarms to form alarm sequences; An attack activity classification module, wherein the attack activity classification module includes an embedder, an encoder, and a classifier; The embedder is used to embed alarms into the alarm sequence and output the embedded representation of each alarm; The encoder is a Transformer encoder, the embedded representation of each alarm is input into the encoder, and the encoder outputs an attack activity feature vector; The classifier is used to classify the input attack activity feature vector and output the attack activity type.

12. The 5G mobile network intrusion detection system according to claim 11, characterized in that: Also includes: The attack activity aggregation module is used to cluster the attack activity feature vectors to obtain multiple clusters.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the 5G mobile network intrusion detection method based on the Transformer model described in any one of claims 1 to 10 is implemented.

Images