A two-stage shunt detection method for intrusion detection system using deep learning

Abstract

The application aims at the problem of fuzzy classification of boundary data when machine learning technology is applied in the field of intrusion detection, and proposes a two-stage shunt detection method for an intrusion detection system using deep learning, which can effectively solve the problem of fuzzy classification of boundary data. Including the following steps: step one, the network traffic is divided into abnormal traffic, normal traffic and suspicious traffic by the primary shunt detection platform based on the Swin Transformer classifier, and the suspicious traffic is transported to the secondary detection platform; step two, the suspicious traffic data is divided into several blocks by adopting MLP-Mixer as the secondary shunt detection platform, then each block is subjected to feature extraction and combination through a multilayer perceptron, and finally the suspicious traffic is finally distinguished to obtain the results of normal traffic and abnormal traffic.

Description

Technical Field

[0001] This invention belongs to the field of intrusion detection technology, specifically relating to a two-stage traffic splitting detection method for intrusion detection systems utilizing deep learning. Background Technology

[0002] Network traffic security is of paramount importance. In today's digital age, vast amounts of personal, business, and government information are transmitted and stored via the internet. This information includes personal privacy, financial data, trade secrets, and national security information. Therefore, protecting network traffic security is crucial for safeguarding personal privacy, preventing economic losses, protecting corporate interests, and maintaining national security.

[0003] Unprotected network traffic is vulnerable to various threats, such as hacking, phishing, ransomware, spyware, and data breaches. These threats can lead to serious consequences, including the theft of personal information, leakage of trade secrets, financial losses, and social instability. Therefore, ensuring the security of network traffic is a crucial measure to protect personal privacy, business interests, and national security. Measures such as encrypted communication, access control, firewalls, intrusion detection systems, security updates, network traffic analysis, and security training can effectively reduce the risk of network traffic attacks and leaks, maintaining the security and stability of the network ecosystem.

[0004] Intrusion detection systems (IDS) are a crucial strategy for detecting network traffic security, and deep learning-based IDS is an emerging research direction in the field of cybersecurity in recent years. Traditional IDS systems typically rely on manually defined rules or features to identify malicious behavior, but this method struggles to capture complex and unknown attack patterns. Deep learning technology, on the other hand, learns from massive amounts of data and automatically extracts features, enabling it to more effectively identify potential intrusion behaviors. Deep learning-based IDS systems typically employ convolutional neural networks (CNNs), recurrent neural networks (RNNs), long short-term memory networks (LSTMs), or variations of deep neural networks to process network traffic or host log data.

[0005] In the section on boundary data segmentation, patent CN201610427861.7 discloses a method and device for boundary data segmentation. It obtains the high-density correlation intervals of boundary data from the undisputed data of associated cluster groups in the clustering results, extracts concentrated data within these high-density correlation intervals from the undisputed data of the associated cluster groups, analyzes the similarity between the boundary data and the concentrated data within these high-density correlation intervals, and finally segments the boundary data based on the similarity. This method enables accurate classification of boundary data, ensuring precise and lossless data classification. Patent CN201911075244.5 discloses a method and system for boundary data analysis using clustering. It presets key variables and thresholds in various log data generated by boundary data exchange activities, then uses a clustering algorithm to classify the data, obtaining clustering analysis results. It then performs clustering analysis on data generated by new boundary data exchange activities, compares the results with the established forms to identify outliers, and identifies and statistically analyzes them. An alarm is triggered when the threshold is exceeded.

[0006] In the intrusion detection system section, patent CN202111044147.7 discloses an intrusion detection system that can classify events using a pre-built event analyzer trained on historical event records. This pre-built event analyzer can automatically identify events as normal or intrusion events based on event characteristics, improving the real-time performance and accuracy of the intrusion detection system. Patent CN202211485456.2 discloses a network security intrusion detection system and method, addressing the problem that existing network security intrusion detection systems can only intercept specific or continuous intrusion behaviors, resulting in a high false alarm rate. Furthermore, these systems cannot restrict intrusion terminals, allowing them to easily re-intrude and cause serious losses.

[0007] Traditional intrusion detection systems typically rely on manually defined rules or features to identify malicious behavior, but this approach struggles to capture complex and unknown attack patterns. Deep learning technology, by learning from vast amounts of data and automatically extracting features, can more effectively identify potential intrusions. These neural network models can automatically learn and extract features from data, thus reducing reliance on manual feature engineering to some extent. However, deep learning-based intrusion detection schemes generally suffer from a drawback: they cannot adequately classify boundary data. Boundary data typically refers to data points that are ambiguous or unclear between normal and anomalous. These data points may pose a potential threat, but due to their high similarity to normal behavior, traditional deep learning models often struggle to effectively classify them as either anomalous or normal. In such cases, deep learning models tend to categorize boundary data as normal, leading to false negatives—that is, failing to identify potential threats in a timely manner. Summary of the Invention

[0008] This invention addresses the problem of ambiguous boundary data classification that arises when machine learning technology is applied in the field of intrusion detection. It proposes a two-stage triage detection method for intrusion detection systems using deep learning, which can effectively solve the problem of ambiguous boundary data classification.

[0009] The present invention is achieved through the following technical solution.

[0010] A two-stage traffic splitting detection method for intrusion detection systems utilizing deep learning includes the following steps:

[0011] Step 1: The network traffic is divided into abnormal traffic, normal traffic and suspicious traffic by the primary traffic splitting and detection platform based on the Swin Transformer classifier, and the suspicious traffic is sent to the secondary detection platform.

[0012] Step 2: Using MLP-Mixer as a secondary traffic detection platform, the suspicious traffic data is divided into several blocks. Then, a multilayer perceptron is used to extract and combine features from each block. Finally, the suspicious traffic is distinguished to obtain the results of normal traffic and abnormal traffic.

[0013] The beneficial effects of this invention are:

[0014] 1. This invention uses a primary traffic distribution and detection platform to classify network traffic into abnormal, normal, and suspicious traffic, where suspicious traffic refers to data that the primary detection cannot accurately classify. Then, the suspicious traffic undergoes a secondary detection platform for final judgment.

[0015] 2. This invention employs the Swin Transformer, introducing a phased attention mechanism. The input data is divided into several blocks, and self-attention is applied at different levels to capture information at different scales and resolutions. This phased attention mechanism helps to effectively model long-distance dependencies while reducing the number of parameters and computational complexity. Furthermore, the Swin Transformer also employs a strategy of swapping attention windows, that is, exchanging the positions of attention windows at different levels to enhance the model's flexibility and generalization ability.

[0016] 3. This invention employs Swing Transformer and MLP-Mixer to handle advanced feature extraction and deep analysis tasks respectively, enabling the intrusion detection system to effectively cope with complex traffic patterns;

[0017] 4. This invention is based on intrusion detection technology using Swing Transformer and MLP-Mixer deep learning, which enables automatic learning and extraction of data features, and can more effectively identify potential intrusion behaviors. Attached Figure Description

[0018] Figure 1 This is a block diagram of a two-stage traffic splitting detection method for an intrusion detection system utilizing deep learning, according to the present invention. Detailed Implementation

[0019] Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the drawings are merely exemplary and are intended to illustrate the principles and spirit of the present invention, and are not intended to limit the scope of the present invention.

[0020] like Figure 1 As shown, the present invention provides a two-stage traffic splitting detection method for an intrusion detection system utilizing deep learning, which specifically includes the following steps:

[0021] Step 1: Network traffic is divided into abnormal traffic, normal traffic, and suspicious traffic by the primary traffic splitting and detection platform based on the Swin Transformer classifier, and the suspicious traffic is then sent to the secondary detection platform; the specific steps are as follows:

[0022] The suspicious traffic mentioned in this invention refers to data streams that the primary traffic distribution detection platform cannot accurately determine whether they are abnormal traffic.

[0023] 1.1 The Linear layer (input layer) is the initial layer of the model, used to reshape the dimension of the input features (traffic data) from 87 to 32. The Swin Transformer divides the input network traffic data into several blocks, each with its own attention mechanism, expressed by the following formula:

[0024] X traffic =Linear(X) traffic )

[0025] Attention(X traffic )=BlockAttention(StageNorm(X traffic ))+X traffic

[0026] Among them, X traffic Representing network traffic characteristics, StageNorm represents the normalization operation performed on each stage, and BlockAttention represents the attention mechanism within each block; Attention(X) represents the network traffic characteristics. trafficThis indicates that the features at each stage are weighted by the attention mechanism and then added to the original features to obtain the final attention features;

[0027] This step demonstrates that this phased attention mechanism helps the model effectively capture information from features at different scales.

[0028] 1.2 The Swing Transformer employs a cross-stage interaction method, enabling information sharing between different stages, as expressed by the following formula:

[0029] X traffic (l+1) =X traffic (l) +Block(StagePooling(X traffic (l) ))

[0030] Among them, X traffic (l) This represents the traffic characteristics of the l-th stage. StagePooling indicates pooling the characteristics of the current stage, and Block indicates processing the pooled characteristics. traffic (l+1) This means that the features of the current stage are pooled and processed, and then added to the features of the previous stage to obtain the feature representation of the next stage;

[0031] 1.3 The Swin Transformer employs a local attention mechanism to reduce computational complexity and memory consumption. Local attention allows the model to focus only on information within a local region, rather than information across the entire system. Therefore, it is expressed by the following formula:

[0032] Attention(X traffic ) = LocalAttention(X traffic )+X traffic

[0033] Among them, X traffic Representing input flow features, LocalAttention is a local attention mechanism; Attention(X) traffic This indicates that the local attention mechanism processes the input features and then adds them to the original features to obtain the final attention features;

[0034] 1.4 The Swing Transformer introduces cross-channel interaction to enhance the representation capability of features, expressed by the following formula:

[0035] X traffic (l+1) =X traffic(l) +LayerNorm(MlpBlock(X traffic (l) ))

[0036] Among them, X traffic (l) This represents the traffic characteristics of the l-th stage. MlpBlock is a module containing a Multilayer Perceptron (MLP). LayerNorm represents layer normalization of the MLP module output. X traffic (l+1) This means that the features of the current stage are processed and normalized by the MLP module, and then added to the features of the previous stage to obtain the feature representation of the next stage.

[0037] The 1.5 Linear layer (output layer) transforms the output dimension of the Transformer into the final output dimension, that is, the dimension is changed from 32 to 1. The transformed output will be used for the final binary classification prediction. The Sigmoid function in the Sigmoid layer is used to perform the activation operation in the binary classification task, mapping the output value to the range [0,1].

[0038] (x suspect ,(x abnormal ,x normal )1)=Sigmoid(MLP(x))

[0039] Where x represents the data of the layer, x suspevt For the suspicious traffic output, (x abnormal ,x normal )1 is the output to determine abnormal and normal traffic;

[0040] In specific implementation: set x normal A value greater than 0.9 indicates normal traffic. abnormal A value less than 0.1 indicates abnormal traffic; the output value range for suspicious traffic is 0.1. <x suspect <0.9.

[0041] Step 2: Using MLP-Mixer as a secondary traffic detection platform, the suspicious traffic data is divided into several blocks. Then, a multilayer perceptron is used to extract and combine features from each block. Finally, the suspicious traffic is distinguished to obtain the results of normal and abnormal traffic. The specific steps are as follows:

[0042] 2.1 Feature representation of suspicious traffic data using PatchEmbed; the specific formula is as follows:

[0043] T = PatchEmbed(X) suspect )

[0044] Among them, Xsuspect T represents the input suspicious traffic data, and T represents the feature representation obtained through PatchEmbed. PatchEmbed is the process of dividing the input traffic into uniform data blocks (or patches) and converting each patch into a low-dimensional vector.

[0045] 2.2 The feature vector of each patch is processed by a multilayer perceptron to capture local information and perform feature fusion. The specific formula is as follows:

[0046] T′=TokenMix(T)

[0047] T″ = ChannelMix(T′)

[0048] Here, Token Mix represents the feature vector of each patch being processed by a multilayer perceptron (MLP), and ChannelMix represents the feature vector after Token Mix being processed by global average pooling and projection across channels; it can be seen that this step helps to capture global information and mix features between different channels.

[0049] 2.3 The features are finally projected and represented using a fully connected layer, as shown in the following formula:

[0050] Y = FC(T″)

[0051] Here, FC indicates that the features are finally projected and represented through a fully connected layer, which has multiple hidden layers to map the mixed features to the final output space.

[0052] 2.4 Using the MLP-Mixer secondary detection platform to detect x suspect Classified as (x abnormal ,x normal 2. This completes x. traffic →{(x abnormal ,x normal )1,(x abnormal ,x normal )2}, classifying network traffic into normal traffic as abnormal traffic;

[0053] (x abnormal ,x normal )2=MLP-Mixer(x suspect ).

[0054] In summary, the above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0055] It will be apparent to those skilled in the art that the embodiments of the present invention are not limited to the details of the exemplary embodiments described above, and that the embodiments of the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the embodiments of the present invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the embodiments of the present invention is defined by the appended claims rather than the foregoing description. Therefore, all variations falling within the meaning and scope of equivalents of the claims are intended to be encompassed within the embodiments of the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims. Furthermore, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units, modules, or devices recited in the system, apparatus, or terminal claims may also be implemented by the same unit, module, or device through software or hardware. The terms "first," "second," etc., are used to indicate names and do not indicate any particular order.

[0056] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the embodiments of the present invention and are not intended to limit them. Although the embodiments of the present invention have been described in detail with reference to the above preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions to the technical solutions of the embodiments of the present invention should not depart from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A two-stage traffic splitting detection method for an intrusion detection system utilizing deep learning, characterized by comprising the following steps: Step 1: The network traffic is divided into abnormal traffic, normal traffic and suspicious traffic by the primary traffic splitting and detection platform based on the Swin Transformer classifier, and the suspicious traffic is sent to the secondary detection platform. Step 2: Using MLP-Mixer as a secondary traffic detection platform, the suspicious traffic data is divided into several blocks. Then, a multilayer perceptron is used to extract and combine features from each block. Finally, the suspicious traffic is distinguished to obtain the results of normal traffic and abnormal traffic. The suspicious traffic refers to data streams that the primary traffic distribution and detection platform cannot accurately determine as abnormal traffic. The specific judgment steps are as follows: 1.1 The Linear layer, as the input layer, is the initial layer of the model, used to reshape the dimension of the input features from 87 to 32. The Swin Transformer divides the input network traffic data into several blocks, each with its own attention mechanism, expressed by the following formula: in, Indicates network traffic characteristics, This refers to the standardized operations performed at each stage. This represents the attention mechanism within each block; This means that the features at each stage are weighted by the attention mechanism and then added to the original features to obtain the final attention features; 1.2 The Swin Transformer employs a cross-stage interaction method, enabling information sharing between different stages, as expressed by the following formula: in, Indicates the first Traffic characteristics at each stage This indicates that a pooling operation is performed on the features of the current stage. This indicates that the pooled features are processed. This means that the features of the current stage are pooled and processed, and then added to the features of the previous stage to obtain the feature representation of the next stage; 1.3 The Swin Transformer employs a local attention mechanism to reduce computational complexity and memory consumption. Local attention allows the model to focus only on information within a local region, rather than information across the entire system. Therefore, it is expressed by the following formula: in, Indicates input flow characteristics, It is a local attention mechanism; This indicates that the local attention mechanism processes the input features and then adds them to the original features to obtain the final attention features; 1.4 The Swin Transformer introduces cross-channel interaction to enhance the representation capability of features, expressed by the following formula: in, Indicates the first Traffic characteristics at each stage It is a module that includes a multilayer perceptron (MLP). This indicates that layer normalization is performed on the output of the MLP module. This means that the features of the current stage are processed and normalized by the MLP module, and then added to the features of the previous stage to obtain the feature representation of the next stage. 1.5 The Linear layer serves as the output layer, transforming the output dimension of the Transformer into the final output dimension, i.e., converting the dimension from 32 to 1. The transformed output will be used for the final binary classification prediction. The Sigmoid function in the Sigmoid layer is used to perform the activation operation in the binary classification task, mapping the output value to the range [0, 1]. in, For layer data, For suspicious traffic output, To output the identified abnormal and normal traffic; step two is as follows: 2.1 Through Feature representation is performed on suspicious traffic data; the specific formula is as follows: in, This indicates suspicious traffic data being entered. Indicates passage The obtained feature representation, It is the process of dividing the input traffic into uniform data blocks called patches, and converting each patch into a low-dimensional vector; 2.2 The feature vector of each patch is processed by a multilayer perceptron to capture local information and perform feature fusion. The specific formula is as follows: Wherein, Token Mix represents the feature vector of each patch processed by a multilayer perceptron (MLP), and ChannelMix represents the feature vector after Token Mix is ​​processed by global average pooling and projection across channels. 2.3 The features are finally projected and represented using a fully connected layer, as shown in the following formula: in, This means that the features are finally projected and represented through a fully connected layer, which has multiple hidden layers to map the mixed features to the final output space; 2.4 Using the MLP-Mixer secondary detection platform to... Classified as Thus completed Classify network traffic into normal traffic as abnormal traffic; 。 2. The two-stage traffic splitting detection method for an intrusion detection system utilizing deep learning as described in claim 1, characterized in that, set up A flow rate greater than 0.9 is considered normal. Traffic values ​​less than 0.1 are considered abnormal; the output value range for suspicious traffic is [value missing]. .

3. The two-stage traffic splitting detection method for an intrusion detection system utilizing deep learning as described in claim 1, characterized in that, set up A flow rate greater than 0.9 is considered normal. Traffic values ​​less than 0.1 are considered abnormal; the output value range for suspicious traffic is [value missing]. .

Images