Network intrusion detection method, system, electronic device and medium

Abstract

The present invention provides a network intrusion detection method, system, electronic device, and medium, belonging to the field of network intrusion detection technology. The method includes the following steps: first, obtaining a network intrusion detection dataset and preprocessing it to obtain a preprocessed dataset; second, reprocessing the preprocessed data using a Borderline SMOTE-OSS hybrid sampling method to obtain a dataset to be detected; then, constructing a 1D-TCN-ResNet-BiGRU-Multi-Head Attention model; and finally, inputting the dataset to be detected into the constructed model and outputting the detection results. The present invention can comprehensively extract local features, long-term temporal dependencies, and short-term temporal dependencies of network data, and enhance the relationship modeling between features through a multi-head self-attention mechanism, thereby more accurately identifying network intrusion behaviors.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to a network intrusion detection method, system, electronic equipment and medium. Background Art

[0002] With the exponential growth of computer network devices worldwide, network threats are constantly increasing, and ensuring the security of network environments has become an urgent issue. Existing network intrusion detection models do not fully learn temporal features, resulting in low accuracy. In addition, intrusion detection datasets contain malicious traffic with low attack frequency. If not intercepted in a timely manner, it will cause immeasurable damage to network devices and data. Therefore, improving network intrusion detection models and handling unbalanced datasets have become research hotspots in network intrusion detection. Summary of the Invention

[0003] The purpose of the present invention is to provide a network intrusion detection method, system, electronic device and medium, which can comprehensively extract local features, long-term time dependencies and short-term time dependencies of network data, and enhance the relationship modeling between features through a multi-head self-attention mechanism, so as to more accurately identify network intrusion behavior.

[0004] To achieve the above object, the present invention provides a network intrusion detection method, comprising the following steps:

[0005] S1. Obtain a network intrusion detection dataset and preprocess it to obtain a preprocessed dataset;

[0006] S2. Use the Borderline SMOTE-OSS hybrid sampling method to process the preprocessed data again to obtain the data set to be tested;

[0007] S3. Build a 1D-TCN-ResNet-BiGRU-Multi-Head Attention model;

[0008] S4. Input the dataset to be tested into the constructed 1D-TCN-ResNet-BiGRU-Multi-HeadAttention model and output the test results.

[0009] The 1D-TCN-ResNet-BiGRU-Multi-Head Attention model includes a parallel TCN-ResNet module and a BiGRU module, as well as a feature fusion module.

[0010] The TCN-ResNet module is used to receive the data set to be tested, extract the local features and long-term temporal dependencies of the time series data at different time scales, and generate the first feature vector;

[0011] The BiGRU module is used to receive the data set to be tested, extract the short-term temporal dependency of the time series data, that is, the dynamic changes between adjacent elements in the sequence, and generate the second feature vector;

[0012] The feature fusion module is used to receive the first feature vector and the second feature vector, enhance the relationship modeling between features through the multi-head self-attention mechanism, merge the outputs of the two modules through splicing to form a comprehensive feature vector, and output the detection result through the fully connected layer.

[0013] Preferably, the TCN-ResNet module includes a TCN layer, a ReLU activation function, a batch normalization layer, a maximum pooling layer, 4 residual units, a global average pooling layer, and a flattening layer connected in sequence; the 4 residual units are composed of two residual blocks, each residual block includes two one-dimensional convolution kernels of size 3, and the last residual block is connected to a ReLU activation function.

[0014] Preferably, the BiGRU module includes a forward GRU and a backward GRU, which are used to obtain the output of the last time step of each sequence as a feature representation.

[0015] Preferably, the feature fusion module also includes two multi-head self-attention mechanisms, which are respectively connected behind the TCN-ResNet module and the BiGRU module.

[0016] Preferably, the Borderline SMOTE-OSS hybrid sampling method comprises the following steps:

[0017] The Borderline SMOTE algorithm is used to identify boundary samples in minority class samples. Artificial samples are generated based on the identified boundary samples to increase the number of minority class samples. Then, the OSS algorithm is used to filter the artificial samples to reduce the number of minority class samples in the majority class samples (i.e., remove noise points in the majority class samples and minority class samples that are too close to the majority class samples), while reducing the number of samples in the majority class. The specific operation is as follows:

[0018] (1) Identify the boundary samples in the minority class that are close to the majority class samples and mark them as Borderline-SMOTE samples;

[0019] (2) For each Borderline-SMOTE sample, calculate the distance between it and the K nearest neighbor samples, and the default value of K is 3;

[0020] (3) For each Borderline-SMOTE sample, select one of the nearest neighbor samples and randomly generate a new sample;

[0021] (4) Add the new samples generated by the above steps to the minority class samples to increase the number of minority class samples;

[0022] (5) Initialize a set C, which should include all minority class samples and some randomly selected majority class samples;

[0023] (6) Use the set C to train a 1-NN classifier (i.e., the number of nearest neighbors in KNN is 1), and use this classifier to classify the samples in the original training sample set S, and merge the misclassified majority class samples into the set C;

[0024] (7) The Tomek links method is used to remove noise and boundary samples from the majority class samples in set C. Samples that are not misclassified by the 1-NN classifier are regarded as redundant samples, and finally a sample set with a more balanced class distribution is obtained;

[0025] (8) Repeat steps (6) to (7) until the ideal ratio of each class is reached, that is, the number of samples of the majority class and the minority class reaches a preset balance.

[0026] Preferably, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model is trained using the AdamW optimizer.

[0027] The present invention also provides a network intrusion detection system, comprising:

[0028] The data preprocessing module is used to obtain the network intrusion detection data set, perform preprocessing, and output the preprocessed data set;

[0029] The sampling processing module is used to reprocess the preprocessed data using the Borderline SMOTE-OSS hybrid sampling method and output the data set to be tested;

[0030] Model building module, used to build 1D-TCN-ResNet-BiGRU-Multi-Head Attention model;

[0031] The detection execution module is used to input the data set to be tested into the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model built by the model construction module and output the detection results;

[0032] Among them, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model includes:

[0033] The TCN-ResNet module is used to receive the data set to be tested, extract the local features and long-term temporal dependencies of the data, and generate the first feature vector;

[0034] The BiGRU module is used to receive the data set to be tested, extract the short-term time dependency of the data, and generate the second feature vector;

[0035] The feature fusion module is used to receive the first feature vector and the second feature vector, enhance the relationship modeling between features through the multi-head self-attention mechanism, merge the outputs of the two modules through splicing to form a comprehensive feature vector, and output the detection result through the fully connected layer.

[0036] The present invention also provides a computer device, comprising: a memory and a processor; the memory stores a computer program, and the processor implements the steps of the above-mentioned network intrusion detection method when executing the computer program.

[0037] The present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned network intrusion detection method are implemented.

[0038] Therefore, the present invention adopts the above-mentioned network intrusion detection method, system, electronic device and medium, and the beneficial technical effects are as follows:

[0039] (1) Improve detection accuracy:

[0040] By linking 1D-TCN-ResNet and BiGRU in parallel, different features of the data can be learned simultaneously. 1D-TCN-ResNet focuses on extracting local features and long-term temporal dependencies in time series data, that is, capturing features at different time scales; while BiGRU focuses on extracting short-term temporal dependencies in time series data, that is, the dynamic changes between adjacent elements in the sequence. The 1D-TCN-ResNet-BiGRU-Multi-HeadAttention network intrusion detection hybrid model proposed in the present invention enables them to integrate these complementary features in a parallel manner, thereby improving the expressive power of the model. For network traffic data, the 1D-TCN-ResNet module is mainly used to extract the spatial features of this data, that is, the features at different time points. The "spatial features" here refer to the features at different time points in the time series, rather than the spatial features in the traditional two-dimensional image.

[0041] (2) Enhance model generalization ability:

[0042] The advantages of Borderline SMOTE-OSS hybrid sampling are as follows:

[0043] 1) Reducing the risk of overfitting: OSS reduces the risk of overfitting by removing majority class samples on the boundary, while Borderline SMOTE avoids generating too many samples in the safe area by oversampling only minority class samples on the boundary, thereby further reducing overfitting.

[0044] 2) Improving the model's generalization ability: OSS reduces noise and redundancy by removing majority class samples that are very close to minority class samples, while Borderline SMOTE enhances the model's ability to identify minority classes by generating minority class samples on the border. This combined approach improves the model's prediction accuracy for minority classes while reducing overfitting for the majority class.

[0045] 3) Avoiding class overlap: Using SMOTE alone may generate samples in the majority class region, leading to class overlap. Borderline SMOTE, however, focuses on boundary samples, reducing this overlap. Combining it with OSS can further reduce class overlap, as OSS sharpens class boundaries by removing noise and boundary samples from the majority class.

[0046] 4) Improve the classifier's ability to identify minority samples: Using OSS alone may lose valuable information, while using Borderline SMOTE alone may generate samples in the majority class area, affecting boundary recognition. Combining these two methods can improve the classifier's ability to identify minority samples while preserving key information.

[0047] 5) Adapting to different degrees of imbalance: Different datasets may require different processing strategies. Combining OSS and Borderline SMOTE can provide more flexibility to adapt to different degrees of class imbalance.

[0048] 6) Improved robustness: OSS reduces the number of majority class samples to avoid over-reliance on the majority class, while Borderline SMOTE increases the model's sensitivity to the minority class by increasing the number of minority class samples on the border. Their combined use improves the model's robustness to samples from different categories.

[0049] (3) Optimizing model training efficiency:

[0050] The 1D-TCN-ResNet-BiGRU-Multi-HeadAttention model in this paper is trained using the AdamW optimizer. Compared with traditional optimizers, AdamW takes weight decay into account when updating parameters, which helps to accelerate model convergence and improve training efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 This is the structure diagram of the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model;

[0052] Figure 2 Flowchart of the 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model that integrates Borderline SMOTE-OSS hybrid sampling;

[0053] Figure 3 This is the multi-classification confusion matrix of 1D-TCN-ResNet-BiGRU-Multi-Head Attention on the CIC-IDS-2017 test set;

[0054] Figure 4 This is the multi-class confusion matrix of 1D-TCN-ResNet-BiGRU-Multi-Head Attention on the CIC-IDS-2017 test set after balancing using the Borderline SMOTE-OSS hybrid sampling algorithm;

[0055] Figure 5 Comparison of the accuracy of the TRBMA model and the TRBMA (BS-OSS) model on the multi-classification test set;

[0056] Figure 6 Comparison of recall rates between the TRBMA model and the TRBMA (BS-OSS) model on the multi-classification test set;

[0057] Figure 7 Comparison of F1 values ​​between the TRBMA model and the TRBMA (BS-OSS) model on the multi-classification test set. DETAILED DESCRIPTION

[0058] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0059] Unless otherwise defined, technical or scientific terms used in the present invention shall have the same meaning as commonly understood by one of ordinary skill in the art to which the present invention belongs.

[0060] Example 1

[0061] like Figure 1As shown in Figure 1, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model primarily consists of three components: a TCN-ResNet module, a BiGRU module, and a feature fusion module. In the TCN-ResNet module, data with a structure of (None, 78, 1) is first input to the TCN, the initial layer of the module. 78 represents the number of feature parameters and the number of channels is 1. TCNs are particularly well-suited for processing time series data, using dilated convolutions to increase the receptive field and capture long-term dependencies. Placing the TCN before the ResNet ensures that the network learns these important temporal features early on. The TCN layer also includes a dilated convolution layer followed by a Relu activation function, batch normalization, and a max pooling layer to reduce model complexity. The rest of the model consists of four residual units, each consisting of two residual blocks. Each residual block includes two one-dimensional convolutional kernels of size 3, and the final residual block is followed by a Relu activation function. The feature matrices of the two branches of the residual block are summed and then output through a Relu activation function. The feature map is then converted into a one-dimensional (None, 512) feature vector through global average pooling and flattening, and fed into the Multi-Head Attention (MHA) feature fusion module. In the Bi GRU module, the input data is first transposed to match the GRU input shape requirements. The forward and backward GRUs are then used to obtain the output of the last time step of each sequence as the feature representation. The outputs of the TCN-ResNet and BiGRU modules are then fed into the feature fusion module. The MHA mechanism focuses on different parts of the input in different representation subspaces, capturing richer feature representations. The outputs of the two modules are then concatenated and merged to form a comprehensive feature vector. This combines the long-term features captured by the TCN with the local features captured by the residual network, improving the model's overall understanding of the time series data. Finally, a fully connected layer outputs the final (None, 11) prediction result.

[0062] like Figure 2 The figure shows the flow chart of the intrusion detection model integrating Borderline SMOTE-OSS hybrid sampling.

[0063] The intrusion detection model integrating Borderline SMOTE-OSS hybrid sampling consists of three modules: data preprocessing module, model training module and intrusion detection model evaluation module.

[0064] First, data preprocessing is performed. Traffic types and corresponding features are statistically analyzed through data cleaning. Symbolic features in the dataset are then converted to numerical features. Finally, continuous data is normalized to the range [0, 1] and conforming to a normal distribution using Z-Score standardization and Min-Max normalization, resulting in a pre-processed dataset. This pre-processed dataset is then resampled using a hybrid Borderline SMOTE-OSS sampling method. Borderline SMOTE is used to identify boundary samples within the minority class and artificial samples are generated near these samples to increase the number of minority class samples. The OSS algorithm is then used to filter samples, removing noise points from the majority class and minority class samples that are too close to the majority class. This results in a balanced experimental dataset.

[0065] During model training on a dataset that has undergone Borderline SMOTE-OSS hybrid sampling, the training set is first processed in parallel using a TCN-ResNet module and a BiGRU module. The TCN-ResNet module extracts features from time series data using dilated convolutions and a residual network, and further processes the feature maps using max pooling and batch normalization. Simultaneously, the BiGRU module captures temporal dependencies through forward and backward GRU layers. The outputs of these two modules are then individually fed through a multi-head self-attention mechanism to enhance the model's understanding of features and weight assignment. The feature representations of these two modules are then merged, and a fully connected layer outputs the final classification result. In this process, the model utilizes the multi-head self-attention mechanism to enhance feature mining, enabling it to better understand and process time series data. Ultimately, a 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model incorporating Borderline SMOTE-OSS hybrid sampling is obtained. The model's effectiveness and performance are evaluated using a test set.

[0066] The present invention will be further described below through specific examples.

[0067] Example 1

[0068] To verify the performance of the proposed model, we compared the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model with four other models: CNN, ResNet, CNN-BiGRU, and CNN-BiGRU-Attention. During each model training process, we maintained consistent parameters: 100 training rounds, a learning rate of 0.001, a weight of 0.01, a batch size of 32, and the AdamW optimizer.

[0069] Table 1 Comparison results of evaluation indicators of each model

[0070] Accuracy Exact value Recall F1 value CNN 87.52％ 82.11％ 87.52％ 84.25％ ResNet 95.32％ 94.83％ 95.32％ 95.03％ BiGRU 96.64％ 96.87％ 96.64％ 96.45％ CNN-BiGRU 97.61％ 97.63％ 97.61％ 97.59％ CNN-BiGRU-Attention 98.26％ 98.79％ 98.26％ 98.48％ The model proposed in this invention 98.66％ 98.70％ 98.66％ 98.67％

[0071] Table 1 shows that the proposed 1D-TCN-ResNet-BiGRU-Multi-Head Attention model outperforms the comparative ensemble models in both network traffic feature extraction and classification. For multi-classification problems, the proposed ensemble model achieves an overall classification accuracy and precision of 98.66% and 98.70%, respectively, significantly exceeding the detection accuracy of the comparative models. Furthermore, the proposed ensemble model achieves the highest scores across all evaluation metrics. Compared to the simple CNN model, the proposed model achieves significant improvements of approximately 10% to 15% in accuracy, precision, recall, and F1-score. The overall precision for each attack traffic category also improves compared to the single ResNet and BiGRU models, increasing by 3.87% and 1.83%, respectively. Similarly, the overall recall improves by 3.34% and 2.02%, demonstrating that the classifier can better identify most types when adequately trained. The overall F1-score also improves by 3.64% and 2.22%, respectively. Finally, in the comparison between the CNN-BiGRU-Attention model and the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model proposed in this paper, it is not difficult to see that for network traffic intrusion detection on this dataset, the model proposed in this paper has more comprehensive feature extraction and higher accuracy.

[0072] Figure 3 After formally training the 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model proposed in this invention, the test set is predicted and classified to obtain the multi-classification confusion matrix, which can be used to more intuitively experience the detection performance of the model proposed in this invention. The horizontal axis represents the predicted category of the data, and the vertical axis represents the actual category of the data. Figure 3As can be seen, the classification accuracy for BENIGN reaches 97%, effectively distinguishing between normal and attack traffic. The proposed model achieves over 90% accuracy for other types of traffic, with recognition accuracy rates reaching 96% and 95% for DoS GoldenEye and SSH-Patator, respectively, demonstrating the proposed model's high accuracy for these two types of abnormal traffic. In contrast, the recognition accuracy for DoS Slowhttptest, Web Attacks, and Bots is lower, at 91%. This may be due to the small number of samples of these three types of abnormal traffic in the training set, resulting in insufficient learning.

[0073] The experimental results above show that for different types of network attack traffic, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model has stronger and more comprehensive feature extraction capabilities, better classification effects, higher detection accuracy, and better generalization performance than the single ResNet network model, BiGRU network model, and CNN-BIGRU-Attention integrated model. The comparative experiments confirm the effectiveness, rationality, and stability of the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model.

[0074] Example 2

[0075] Based on the CIC-IDS-2017 dataset, the Borderline SMOTE-OSS hybrid sampling method is compared with the currently commonly used SMOTE-Tomek Link and SMOTE-ENN hybrid sampling methods on binary and multi-classification datasets. The classification accuracy of different hybrid sampling algorithms is compared through the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model to determine the hybrid sampling method of the present invention.

[0076] In the present invention, the model in the accompanying drawings of the experimental results uses TRBMA to represent the network intrusion detection model that integrates 1D-TCN-ResNet-BiGRU-Multi-Head Attention, and uses TRBMA(BS-OSS) to represent the 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model that integrates Borderline SMOTE-OSS hybrid sampling.

[0077] Table 2 Classification accuracy of different hybrid sampling algorithms on the CIC-IDS-2017 dataset

[0078]

[0079] As can be seen from Table 2, both in binary and multi-classification experiments, although the model performance is improved by using the two hybrid sampling algorithms, SMOTE-ENN and SMOTE-Tomek Link, the TRBMA model training using the CIC-IDS-2017 dataset processed by the BS-OSS algorithm has the highest model accuracy. Therefore, it is reasonable and effective to select the BS-OSS-based hybrid sampling algorithm as the best solution to the sample class imbalance problem in this invention.

[0080] Figure 4 The following figure shows the confusion matrix of the TRBMA (BS-OSS) model after multi-classification on the CIC-IDS-2017 test set. Figure 3 , it can be seen that the TRBMA (BS-OSS) model has a lower misclassification rate than the TRBMA model, and the TRBMA (BS-OSS) model has improved the recognition accuracy of each traffic category. Not only did it increase the recognition accuracy of three types of traffic (DoS Slowhttptest, Web Attacks, and Bot) from 91% to 99%, it also significantly improved the recognition accuracy of traffic categories with very few samples in the original dataset. Therefore, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model optimized for the CIC-IDS-2017 dataset using Borderline SMOTE-OSS hybrid sampling successfully achieved improved recognition accuracy for both majority and minority abnormal traffic categories.

[0081] Figure 5 、 Figure 6 、 Figure 7 The bar graphs visually compare the Precision, Recall, and F1-Score performance of the TRBMA model and the TRBMA (BS-OSS) model on the multi-classification test set. These three graphs show that TRBMA (BS-OSS) significantly improves Precision, Recall, and F1-Score for all abnormal traffic categories.

[0082] Figure 5The figure shows the comparison of the precision of the TRBMA model and the TRBMA (BS-OSS) model for all types of traffic on a multi-classification dataset. It can be seen that the TRBMA (BS-OSS) model obtained by training the model using the dataset balanced by BS-OSS has a certain improvement in the precision value of each type of traffic, indicating that the TRBMA (BS-OSS) model has a higher classification and recognition capability for malicious intrusion traffic with a small number of samples.

[0083] Figure 6 A comparison of the Recall values ​​of the TRBMA model and the TRBMA (BS-OSS) model for network traffic on a multi-classification dataset is given. It can be seen that the TRBMA (BS-OSS) model has significantly improved the Recall values ​​of various types of abnormal traffic, proving that the dataset after balancing by BS-OSS is more comprehensively trained and fully utilized during the model training process.

[0084] Figure 7 The F1-Score comparison results of the TRBMA model and the TRBMA (BS-OSS) model for various types of traffic on a multi-classification dataset are shown. It can be seen that the TRBMA (BS-OSS) model also significantly improves the F1-Score of various types of abnormal traffic, indicating that the TRBMA (BS-OSS) model has good generalization ability and robust performance.

[0085] Example 3

[0086] The effectiveness of the proposed Borderline SMOTE-OSS hybrid sampling method for processing imbalanced datasets was verified. The multi-classification performance of the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model and the 1D-TCN-ResNet-BiGRU-Multi-Head Attention intrusion detection model fused with Borderline SMOTE-OSS hybrid sampling were compared on the CIC-IDS-2017 and NSL-KDD datasets.

[0087] CIC-IDS-2017 dataset:

[0088] Table 3 Comparison of model performance of the CIC-IDS-2017 dataset and the CIC-IDS-2017 dataset after BorderlineSMOTE-OSS hybrid sampling for training

[0089]

[0090] NSL-KDD dataset:

[0091] Table 4 Comparison of model performance for training using the NSL-KDD dataset and the NSL-KDD dataset after BorderlineSMOTE-OSS hybrid sampling

[0092]

[0093] Example 2

[0094] A network intrusion detection system, comprising:

[0095] The data preprocessing module is used to obtain the network intrusion detection data set, perform preprocessing, and output the preprocessed data set;

[0096] The sampling processing module is used to reprocess the preprocessed data using the Borderline SMOTE-OSS hybrid sampling method and output the data set to be tested;

[0097] Model building module, used to build 1D-TCN-ResNet-BiGRU-Multi-Head Attention model;

[0098] The detection execution module is used to input the data set to be tested into the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model built by the model construction module and output the detection results;

[0099] Among them, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model includes:

[0100] The TCN-ResNet module is used to receive the data set to be tested, extract the local features and long-term temporal dependencies of the time series data, and generate the first feature vector;

[0101] The BiGRU module is used to receive the data set to be tested, extract the short-term time dependency of the time series data, and generate the second feature vector;

[0102] The feature fusion module is used to receive the first feature vector and the second feature vector, enhance the relationship modeling between features through the multi-head self-attention mechanism, merge the outputs of the two modules through splicing to form a comprehensive feature vector, and output the detection result through the fully connected layer.

[0103] If the above functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0104] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0105] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0106] It is worth noting that the contents not elaborated in detail in the present invention are all prior art and are well known to those skilled in the art.

[0107] Therefore, the present invention adopts the above-mentioned network intrusion detection method, system, electronic device and medium, which can comprehensively extract the local features, long-term time dependencies and short-term time dependencies of network data, and enhance the relationship modeling between features through a multi-head self-attention mechanism, so as to more accurately identify network intrusion behavior.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that they can still modify or replace the technical solutions of the present invention with equivalents, and these modifications or equivalent replacements cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A network intrusion detection method, characterized in that: The following steps are involved: S1. Obtain a network intrusion detection dataset and preprocess it to obtain a preprocessed dataset; S2. Use the Borderline SMOTE-OSS hybrid sampling method to process the preprocessed data again to obtain the data set to be tested; The Borderline SMOTE-OSS hybrid sampling method includes the following steps: The Borderline SMOTE algorithm is used to identify boundary samples in minority class samples. Artificial samples are generated based on the identified boundary samples to increase the number of minority class samples. Then, the OSS algorithm is used to filter the artificial samples to reduce the number of minority class samples in majority class samples. S3. Build a 1D-TCN-ResNet-BiGRU-Multi-Head Attention model; S4. Input the dataset to be tested into the constructed 1D-TCN-ResNet-BiGRU-Multi-Head Attention model and output the test results. The 1D-TCN-ResNet-BiGRU-Multi-Head Attention model includes a parallel TCN-ResNet module and a BiGRU module, as well as a feature fusion module. The TCN-ResNet module is used to receive the data set to be tested, extract the local features and long-term temporal dependencies of the time series data at different time scales, and generate the first feature vector; The BiGRU module is used to receive the data set to be tested, extract the short-term temporal dependency of the time series data, that is, the dynamic changes between adjacent elements in the sequence, and generate the second feature vector; The feature fusion module receives the first and second feature vectors, enhances the relationship modeling between features through a multi-head self-attention mechanism, combines the outputs of the two modules to form a comprehensive feature vector, and outputs the detection result through a fully connected layer; The TCN-ResNet module includes a TCN layer, a ReLU activation function, a batch normalization layer, a maximum pooling layer, four residual units, a global average pooling layer, and a flattening layer connected in sequence; the four residual units are composed of two residual blocks, each residual block includes two one-dimensional convolution kernels of size 3, and the last residual block is connected to a ReLU activation function.

2. A network intrusion detection method according to claim 1, characterized in that: The BiGRU module includes: forward GRU and backward GRU, which are used to obtain the output of the last time step of each sequence as feature representation.

3. A network intrusion detection method according to claim 1, characterized in that: The feature fusion module also includes two multi-head self-attention mechanisms, which are connected behind the TCN-ResNet module and the BiGRU module respectively.

4. A network intrusion detection method according to claim 1, characterized in that: The 1D-TCN-ResNet-BiGRU-Multi-Head Attention model is trained using the AdamW optimizer.

5. A network intrusion detection system, characterized in that: Used to execute the network intrusion detection method according to any one of claims 1 to 4, comprising: The data preprocessing module is used to obtain the network intrusion detection data set, perform preprocessing, and output the preprocessed data set; The sampling processing module is used to reprocess the preprocessed data using the Borderline SMOTE-OSS hybrid sampling method and output the data set to be tested; Model building module, used to build 1D-TCN-ResNet-BiGRU-Multi-Head Attention model; The detection execution module is used to input the data set to be tested into the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model built by the model construction module and output the detection results; Among them, the 1D-TCN-ResNet-BiGRU-Multi-Head Attention model includes: The TCN-ResNet module is used to receive the data set to be tested, extract the local features and long-term temporal dependencies of the time series data, and generate the first feature vector; The BiGRU module is used to receive the data set to be tested, extract the short-term time dependency of the time series data, and generate the second feature vector; The feature fusion module is used to receive the first feature vector and the second feature vector, enhance the relationship modeling between features through the multi-head self-attention mechanism, merge the outputs of the two modules through splicing to form a comprehensive feature vector, and output the detection result through the fully connected layer.

6. A computer device comprising: memory and processor; The memory stores a computer program, wherein the processor implements the steps of the network intrusion detection method according to any one of claims 1 to 4 when executing the computer program.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network intrusion detection method according to any one of claims 1 to 4 are implemented.

Images