An Intrusion Detection Method and System Based on Data Balance and Feature Collaboration

Abstract

This application discloses an intrusion detection method and system based on data balance and feature collaboration, belonging to the field of network security technology, including: adding an SKnet layer after the deconvolution layer in the DCGAN generator for improvement; inputting a random noise vector into the improved DCGAN generator to obtain a balanced data set; improving the initial SRGAN generator; inputting the balanced data set into the improved SRGAN generator to extract deep features to obtain deep features; inputting the balanced data set into a preset LSTM network model to extract time series features to obtain time series features; obtaining a fused feature map based on the deep features and time series features; and obtaining an intrusion classification result based on the fused feature map. The present invention solves the problem of imbalanced network attack category data, constructs an intrusion detection model, and improves model performance.

Description

Technical Field

[0001] The present application belongs to the field of network security technology, and specifically relates to an intrusion detection method and system based on data balance and feature collaboration. Background Art

[0002] In today's world, the internet has become an indispensable infrastructure for modern society. Emerging technologies such as 5G, the Internet of Things, artificial intelligence, cloud computing, and blockchain continue to drive network development, leading to exponential growth in global data traffic. Cyberattacks are increasing in scale and frequency, with methods such as distributed denial of service attacks, ransomware, phishing emails, and zero-day vulnerability exploits becoming more sophisticated and covert. These attacks not only target individual users but also pose a threat to businesses and critical national infrastructure. Intrusion detection is a crucial component of current internet defenses against cyberattacks, and research into high-performance intrusion detection methods is gaining increasing attention.

[0003] However, the existing technology has the following problems when performing intrusion detection: First, there is data imbalance in the data sets publicly available on the Internet, and the attack type data is far less than the normal traffic data, which can easily lead to the detection model being unable to obtain sufficient useful information during training, thereby causing the performance of the detection model to deteriorate; Second, while solving the data imbalance problem, the existing technology often solves it by introducing deep convolutional generative adversarial networks (DCGANs). However, the existing DCGAN generator will encounter problems during the training process: the existing DCGAN generator is sensitive to hyperparameters and is prone to gradient vanishing and gradient exploding problems, which will affect the convergence of the DCGAN generator and the discriminator, causing the DCGAN generator to learn some fixed patterns during the learning and training process, resulting in certain similarities and limitations in the generated images. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide an intrusion detection method and system based on data balance and feature collaboration, which can solve the problem of data imbalance in network attack categories in the prior art and the problem of low performance of existing intrusion detection models.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, an embodiment of the present application provides an intrusion detection method based on data balancing and feature collaboration, the method comprising:

[0007] An improved DCGAN generator is obtained by adding an SKnet layer after the deconvolution layer in the initial DCGAN generator. The SKnet layer includes: a convolution layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a softmax layer.

[0008] Inputting the preset random noise vector into the improved DCGAN generator for dimensionality reduction to obtain a balanced data set;

[0009] An initial SRGAN generator is improved based on a preset fully connected layer, a deflattening layer, and a residual network layer to obtain an improved SRGAN generator, wherein the improved SRGAN generator consists of an input layer, a first fully connected layer, a second fully connected layer, a deflattening layer, a first convolutional layer, a residual network layer, and a second convolutional layer connected in sequence;

[0010] Inputting the balanced data set into the improved SRGAN generator to extract deep features and obtain deep features;

[0011] Inputting the balanced data set into a preset LSTM network model to extract time series features and obtain time series features;

[0012] Acquire a query vector, a value vector, and a key vector based on the depth feature and the time series feature;

[0013] Based on an attention mechanism, processing the query vector, the key vector, and the value vector to obtain a fused feature map;

[0014] The fused feature map is sequentially subjected to feature mapping, activation, and classification processing to obtain an intrusion classification result.

[0015] As an optional implementation of the first aspect of the present application, a process of inputting a preset random noise vector into the improved DCGAN generator for dimensionality reduction to obtain a balanced data set includes:

[0016] Performing linear transformation, normalization, and activation processing on the preset random noise in sequence to obtain a first feature map, where the dimension of the first feature map is higher than the dimension of the random noise;

[0017] Deconvolution and upsampling are performed on the first feature map in sequence to obtain a second feature map, where the number of channels of the second feature map is half that of the first feature map, and both the height and width are greater than those of the first feature map;

[0018] Inputting the second feature map into a plurality of branch convolution kernels of different sizes for convolution processing to obtain a third feature map and a fourth feature map, wherein the feature extraction dimension of the fourth feature map is higher than that of the third feature map;

[0019] Performing feature aggregation on the third feature map and the fourth feature map to generate an attention weight matrix;

[0020] Performing weighted fusion on the third feature map and the fourth feature map based on the attention weight matrix to obtain a fused feature map;

[0021] Performing deconvolution processing and feature enhancement processing on the fused feature map in sequence to obtain a fifth feature map, where the number of channels of the fifth feature map is half that of the fused feature map, and the height and width are both greater than those of the fused feature map;

[0022] A balanced dataset is obtained based on the fifth feature map.

[0023] As an optional implementation manner of the first aspect of the present application, a process of obtaining a balanced data set based on the fifth feature map includes:

[0024] Obtain and preprocess a preset initial data set to obtain a grayscale image data set;

[0025] Performing convolution processing and activation processing on the fifth feature map in sequence to obtain a second data set, where the second data set has the same format and size as the grayscale image data set;

[0026] Performing reverse normalization on the second data set to obtain a third data set, wherein the data value range of the third data set is consistent with the range of the initial data set;

[0027] The third data set is merged with the initial data set to obtain a balanced data set.

[0028] As an optional implementation of the first aspect of the present application, the process of improving the initial SRGAN generator based on the preset fully connected layer, deflattening layer, and residual network layer to obtain the improved SRGAN generator includes:

[0029] A fully connected layer and an unflattening layer are added after the input layer of the initial SRGAN generator, the up-conversion layer in the initial SRGAN generator is removed, and multiple residual network layers are added between the convolutional layers inside the generator to obtain an improved SRGAN generator.

[0030] As an optional implementation of the first aspect of the present application, the balanced dataset is input into the improved SRGAN generator for deep feature extraction. The process of obtaining deep features includes:

[0031] Input the balanced data set into the first fully connected layer for vector conversion to obtain a first vector;

[0032] Inputting the first vector into a second fully connected layer for linear transformation mapping to obtain a second vector, where the length of the second vector is greater than that of the first vector;

[0033] Inputting the second vector into a deflattening layer for deflattening to obtain a third vector, wherein the dimension of the third vector is higher than that of the second vector;

[0034] The third vector is sequentially input into the first convolutional layer, the residual network layer, and the second convolutional layer for feature extraction to obtain deep features.

[0035] As an optional implementation of the first aspect of the present application, the process of processing the query vector, the key vector, and the value vector based on the attention mechanism to obtain a fused feature map includes:

[0036] Calculate the similarity between the query vector and the key vector based on the cross attention mechanism and generate an attention weight matrix;

[0037] The value vector is weighted based on the attention weight matrix to obtain a fused feature map.

[0038] As an optional implementation of the first aspect of the present application, the mathematical expression of the fused feature map is:

[0039] ;

[0040] ;

[0041] in, represents the fused feature map, represents the local feature map, represents the global feature map, represents the first weight matrix, represents the second weight matrix, represents batch normalization, represents the fully connected layer mapping operation, represents the Relu activation function, represents the average pooling result, represents the fully connected weight matrix, Represents the output vector after transformation of the fully connected layer.

[0042] In a second aspect, an embodiment of the present application provides an intrusion detection system based on data balancing and feature collaboration, the system comprising:

[0043] The SKnet module is used to add an SKnet layer after the deconvolution layer in the initial DCGAN generator to obtain an improved DCGAN generator. The SKnet module consists of a convolutional layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a Softmax layer connected in sequence;

[0044] A dimensionality reduction processing module is used to input a preset random noise vector into the improved DCGAN generator for dimensionality reduction processing to obtain a balanced data set;

[0045] An SRGAN module, wherein the SRGAN module is used to improve the initial SRGAN generator according to a preset fully connected layer, an unflattened layer, and a residual network layer to obtain an improved SRGAN generator;

[0046] A deep feature extraction module, wherein the deep feature extraction module is used to input the balanced data set into the improved SRGAN generator to perform deep feature extraction and obtain deep features;

[0047] A time series feature extraction module is used to input the balanced data set into a preset LSTM network model to extract time series features and obtain time series features;

[0048] A mapping module, configured to perform mapping processing on the depth features to obtain a query vector, and to perform mapping processing on the time series features to obtain a value vector and a key vector;

[0049] an attention mechanism module, the attention mechanism module being configured to calculate the similarity between the query vector and the key vector, generate an attention weight matrix, and weight the value vector based on the attention weight matrix to obtain a fused feature map;

[0050] The classification module is used to perform feature mapping, activation and classification processing on the fused feature map in sequence to obtain an intrusion classification result.

[0051] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor, a memory, and a program or instruction stored in the memory and executable on the processor, wherein when the program or instruction is executed by the processor, the steps of the method described in the first aspect are implemented.

[0052] In a fourth aspect, an embodiment of the present application provides a readable storage medium, comprising a processor, a memory, and a program or instruction stored on the memory and executable on the processor, wherein the program or instruction, when executed by the processor, implements the steps of the method described in the first aspect.

[0053] Compared with the prior art, the present invention proposes an intrusion detection method based on data balance and feature collaboration. First, to address the problem of uneven sample number distribution in existing datasets, SKNet is introduced to improve the DCGAN model. SKNet is used to assist the discriminator in efficiently distinguishing between real samples and generated samples, thereby promoting accelerated model convergence, improving the quality of generator generation, and solving the problem of dataset imbalance during data-level intrusion detection training. At the same time, the present invention proposes a network intrusion detection model that integrates an improved SRGAN generator, LSTM, and a cross-attention mechanism. This intrusion detection model can use the improved SRGAN generator to extract local and global deep feature representations of samples, use the LSTM module's time series modeling capabilities to capture the global contextual information of samples, and dynamically adjust feature weights through the self-attention module to complete feature extraction of the dataset and then perform classification. By comparing with other models on the original dataset and the balanced dataset, the improved fusion model performs better overall. Specifically, the classification effect of the improved fusion model is better than that of the classification model with a single module, and the model performs better than the original dataset on the balanced dataset. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] Figure 1 This is a flow chart of an intrusion detection method based on data balance and feature collaboration provided in the first embodiment of the present application;

[0055] Figure 2 This is a schematic diagram of the training model provided by the first embodiment of the present application;

[0056] Figure 3 This is a diagram of the improved DCGAN structure provided by the first embodiment of this application;

[0057] Figure 4 This is a structural diagram of an intrusion detection model provided by the first embodiment of the present application;

[0058] Figure 5 This is a structural diagram of an intrusion detection system based on data balance and feature collaboration provided in the second embodiment of the present application. DETAILED DESCRIPTION

[0059] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0060] The terms "first," "second," and the like in the specification and claims of this application are used to distinguish similar objects and are not used to describe a particular order or precedence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments of this application can be implemented in an order other than those illustrated or described herein. In addition, the term "and / or" in the specification and claims refers to at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0061] The following describes in detail an intrusion detection method and system based on data balance and feature collaboration provided by an embodiment of the present application through specific embodiments and their application scenarios in conjunction with the accompanying drawings.

[0062] Example 1

[0063] See also Figure 1 , which is a flow chart of an intrusion detection method based on data balance and feature collaboration proposed in the first embodiment of the present application. The proposed method includes steps S1 to S8.

[0064] Step S1: Add an SKnet layer after the deconvolution layer in the initial DCGAN generator to obtain an improved DCGAN generator. The SKnet layer includes: a convolution layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a Softmax layer.

[0065] Among them, the convolution layer, batch normalization layer, activation function layer, global average pooling layer, fully connected layer, and Softmax layer are connected in sequence to form the SKnet layer of the present invention.

[0066] The advantage of introducing the SKnet layer in the present invention is that the present invention can use the SKnet layer to assist the discriminator in efficiently distinguishing between real samples and generated samples, thereby promoting the accelerated convergence of the improved DCGAN model and improving the quality of the data generated by the generator, thereby solving the problem of data set imbalance in the data-level intrusion detection training process. Figure 2 This is a schematic diagram of the training model of this application. Figure 3 This is the improved DCGAN structure diagram of this application.

[0067] Step S2: Input the preset random noise vector into the improved DCGAN generator for dimensionality reduction to obtain a balanced data set.

[0068] In step S2 of the present invention, the specific process of obtaining a balanced data set includes: inputting a preset random noise into a generator for initialization processing to obtain a first feature map, wherein the dimension of the first feature map is higher than the dimension of the random noise; performing deconvolution operations on the first feature map in sequence to achieve the purpose of upsampling, and obtaining a second feature map, wherein the number of channels of the second feature map is half of the first feature map, and the height and width are both higher than the first feature map; inputting the second feature map into a plurality of branch convolution kernels of different sizes for convolution processing to obtain a third feature map and a fourth feature map, wherein the fourth feature map and the third feature map are feature maps containing local details and global information respectively; performing feature aggregation on the third feature map and the fourth feature map to generate an attention weight matrix; performing weighted fusion on the third feature map and the fourth feature map based on the attention weight matrix to obtain a fused feature map; performing deconvolution processing and feature enhancement processing on the fused feature map in sequence to obtain a fifth feature map, wherein the number of channels of the fifth feature map is half of the fused feature map, and the height and width are both higher than the fused feature map; and obtaining a balanced data set based on the fifth feature map.

[0069] Specifically, the preset random noise is input into the generator for initialization processing, and the process of obtaining the first feature map includes the following steps: a 1×100 random noise vector that obeys a uniform distribution or a Gaussian distribution is input into the generator, and the fully connected layer first maps the noise to a 1×1152 vector through a linear transformation, and then after reshaping, a 128×3×3 feature map is output. The 128×3×3 feature map is the first feature map.

[0070] Specifically, the first feature map is sequentially deconvolved and upsampled to obtain the second feature map, including the following steps: the 128×3×3 first feature map is input into the deconvolution layer and gradually upsampled by micro-step convolution to obtain a 64×5×5 second feature map. Obviously, the number of channels of the second feature map is 64, and the height and width are both 5. The number of channels of the first feature map is 128, and the height and width are both 3. The number of channels of the second feature map is half of that of the first feature map, and the height and width are both higher than the first feature map, and each deconvolution layer is followed by a batch normalization layer and a LeakyReLU layer, and the LeakyReLU layer is followed by an SK convolution layer.

[0071] Specifically, the second feature map is input into a plurality of branches of convolution kernels of different sizes for convolution processing to obtain the third feature map and the fourth feature map, including: inputting the 64×5×5 second feature map into convolution kernels with branch sizes of 3×3 and 5×5 for parallel convolution processing respectively, and obtaining the third feature map and the fourth feature map accordingly, wherein the 3×3 convolution kernel is used to capture the local details of the second feature map, and the 5×5 convolution kernel is used to associate the global information of the second feature map. Therefore, the feature extraction dimension of the third feature map is higher than that of the fourth feature map (the feature map dimension obtained by the small convolution kernel is slightly higher), and the number of convolution kernel branches set in the present invention is 2.

[0072] Specifically, the process of performing feature aggregation on the third feature map and the fourth feature map to generate the attention weight matrix specifically includes: first, performing global average pooling operations on the third feature map and the fourth feature map respectively, compressing them into two 1×1×C channel descriptors; then, connecting these two 1×1×C channel descriptors, and generating a channel attention vector through a fully connected layer; finally, generating an attention weight matrix based on the channel attention vector. Among them, the calculation formula of the channel descriptor is as follows: and formula As shown:

[0073]

[0074]

[0075] in, Represents the feature map after feature fusion, and Represents feature maps of different sizes, Indicates the The result after average pooling of channels is: represents the average pooling operation, and Represent the width and height of the feature map respectively, , , Represents the feature map before feature fusion.

[0076] The calculation formula of the channel attention vector is as follows and formula As shown:

[0077]

[0078]

[0079] in, represents the output vector after the full connection layer transformation, represents the fully connected layer operation, represents the activation function, represents batch normalization, represents the fully connected weight matrix, represents the dimension after dimensionality reduction, represents the number of input feature channels, represents the scaling hyperparameter, Indicates the preset minimum latitude value. Represents the average pooling result.

[0080] Specifically, the process of weighted fusion of the third feature map and the fourth feature map based on the attention weight matrix to obtain the fused feature map includes the following steps: first, weight distribution is performed, that is, the attention weight matrix of each branch is generated based on the attention weight vector, and the calculation formula is formula and formula As shown:

[0081]

[0082]

[0083] in, and is the attention weight of feature maps of different scales, and represents the weight matrix, Represents the feature vector obtained after average pooling.

[0084] Specifically, the third feature map and the fourth feature map are weightedly fused based on the attention weight matrix. When the fused feature map is obtained, the mathematical expression of the fused feature map is as follows: and formula As shown:

[0085]

[0086]

[0087] in, represents the fused feature map, represents the local feature map, represents the global feature map, represents the first weight matrix, represents the second weight matrix, represents batch normalization, represents the fully connected layer mapping operation, represents the Relu activation function, represents the average pooling result, represents the fully connected weight matrix, Represents the output vector after transformation of the fully connected layer.

[0088] Specifically, the fused feature map is sequentially subjected to deconvolution processing and feature enhancement processing to obtain the fifth feature map, including: deconvolution processing of the 64×5×5 fused feature map again, and then feature enhancement processing is performed on the result obtained by deconvolution, and a fifth feature map of size 32×9×9 is output. The number of channels of the fifth feature map is 32, and the height and width are both 9. The number of channels of the fused feature map is 64, and the height and width are both 5. The number of channels of the fifth feature map is half of that of the fused feature map, and the height and width are both higher than those of the fused feature map.

[0089] Specifically, the process of obtaining a balanced data set based on the fifth feature map includes: obtaining and preprocessing a preset initial data set to obtain a grayscale image data set; performing convolution processing and activation processing on the fifth feature map in sequence to obtain a second data set, and the second data set has the same format size as the grayscale image data set, both of which are 9×9; performing reverse normalization processing on the second data set to obtain a third data set, and the value range of the pixel points in the third data set is equal to the value range of the data in the initial data set; merging the third data set with the initial data set to obtain a balanced data set.

[0090] In summary, the present invention first generates two sets of feature maps through multi-scale feature branches. These two sets of feature maps can capture local details and be associated with the global context, thereby improving the flexibility of feature expression. Then, feature aggregation and attention weight generation operations are performed on these two sets of feature maps, and attention weight calculation is performed to splice the channel descriptors of each branch to generate a channel attention vector. Finally, dynamic feature fusion is performed, that is, the weight matrix of each branch is obtained based on the generated channel attention vector, and the two sets of feature maps generated by the multi-scale feature branch are weightedly fused to output the fused feature map. The fused feature map can not only capture the feature information of different scales after deconvolution, but also enrich the details of the image generated by the generator.

[0091] Step S3: The initial SRGAN generator is improved based on the preset fully connected layer, deflattening layer, and residual network layer to obtain an improved SRGAN generator, wherein the improved SRGAN generator consists of an input layer, a first fully connected layer, a second fully connected layer, a deflattening layer, a first convolutional layer, a residual network layer, and a second convolutional layer connected in sequence.

[0092] In step S3 of the present invention, compared with the initial SRGAN generator, the improved SRGAN generator of the present invention adds a fully connected layer and a deflattening layer after the input layer of the initial SRGAN generator, removes the upper sampling layer in the initial SRGAN generator, and adds 5 residual blocks between the first convolutional layer and the second convolutional layer inside the generator.

[0093] The function of the first fully connected layer of the present invention is: when the data set is input to the input layer of the improved SRGAN generator to obtain the output of the input layer, the first fully connected layer can vector-convert the output of the input layer to obtain a converted vector; the function of the second fully connected layer of the present invention is: the converted vector can be mapped to obtain a vector of higher length; the deflattening layer of the present invention is used to realize the mapping of the input one-dimensional vector to a high-dimensional feature space to adapt to the input of the subsequent convolutional layer. At the same time, the upper layer in the initial SRGAN generator is removed, and 5 residual blocks are added between the convolutional layers inside the generator, so that the network can more easily learn deep feature representations, solving the problems of gradient disappearance and degradation that occur with the increase of network depth.

[0094] Step S4: Input the balanced data set into the improved SRGAN generator to extract deep features and obtain deep features.

[0095] In step S4 of the present invention, the specific step of obtaining the deep features includes: inputting the balanced data set into the fully connected layer after the input layer of the SRGAN generator, performing vector conversion to obtain a first vector of 1×79; inputting the first vector of 1×79 into the fully connected layer after the input layer of the SRGAN generator again, performing linear transformation mapping processing to obtain a second vector of 1×81, where the length of the second vector is 81, which is greater than the length of the first vector 79; inputting the second vector into the deflattening layer of the SRGAN generator for deflattening processing to obtain a third vector of 1×9×9, where the dimension of the third vector is three-dimensional, which is greater than the two-dimensional dimension of the second vector; inputting the third vector of 1×9×9 into the first convolutional layer of the SRGAN generator for feature extraction to obtain the deep features of the balanced data set.

[0096] Specifically, when performing feature extraction, the upsampling layer of the original SRGAN generator needs to be removed. At the same time, the present invention sets the number of residual blocks to 5, and adds 5 residual blocks between the convolutional layers inside the improved SRGAN generator to enable the network to learn deep feature representations more easily. The mathematical expression of the residual block is as follows: As shown:

[0097]

[0098] in, Represents a series of nonlinear transformation operations, represents the parameter weight of the residual block, is the input of the residual block, It is a deep feature.

[0099] Step S5: Input the balanced data set into a preset LSTM network model to extract time series features and obtain time series features.

[0100] In step S5 of the present invention, the LSTM network model enables the network to retain information over a long time span through its unique cell structure. The most important components are the forget gate, input gate, and output gate, and the processing object is called a "cell." The internal structure of the LSTM network model used in the present invention specifically includes the following three parts:

[0101] 1) Forget gate;

[0102] The balanced data set is converted into a 1×79 vector as the current "cell" input. The forget gate calculates the cell state of the previous time step and the current input, and outputs a value between 0 and 1 to control the degree of forgetting of information, that is, it determines which information in the current cell state needs to be discarded. The calculation formula is as follows: As shown:

[0103]

[0104] in, is the weight matrix of the forget gate, is the bias vector of the forget gate, Indicates the hidden state at the last moment. represents the Sigmoid activation function, is the output of the forget gate, Used to control the degree of forgetting for each element in the cell state.

[0105] 2) Input gate;

[0106] The input gate determines what new information needs to be added to the "cell" state. It combines the current input and the hidden state of the previous time step to generate an update value and combines it with the candidate memory. The calculation formula is as follows As shown:

[0107]

[0108] in, Is the switch state vector of the input gate, which is used to control the degree of addition of the current input information. represents the Sigmoid activation function, is the candidate cell state vector, is the weight matrix of the input gate, is the input gate bias vector, is the weight matrix used when generating candidate cell states, is the bias vector used when generating candidate cell states, is the current cell state, is the cell state at the previous moment.

[0109] 3) Output gate;

[0110] The output gate controls the hidden state output of the current time step in order to pass useful information to the next time step. The calculation formula is as follows: and formula As shown:

[0111]

[0112]

[0113] in, is the current hidden state, is the switching state vector of the output gate, is the weight matrix of the output gate, is the bias vector of the output gate, is the current cell state, is the Sigmoid activation function, Indicates the hidden state at the last moment. Used to control the degree of forgetting for each element in the cell state.

[0114] In summary, after the balanced data set is input into the forget gate, input gate, and output gate in sequence, the temporal features of the balanced data set can be obtained.

[0115] Step S6: Acquire a query vector, a value vector, and a key vector based on the depth feature and the temporal feature.

[0116] In step S6 of the present invention, the specific steps of obtaining the query vector, the value vector and the key vector include: mapping the deep features to obtain the query vector, and mapping the time series features to obtain the value vector and the key vector.

[0117] Step S7: Based on the attention mechanism, process the query vector, the key vector and the value vector to obtain a fused feature map.

[0118] In step S7 of the present invention, the specific steps of obtaining the fused feature map include: calculating the similarity between the query vector and the key vector based on the cross attention mechanism to generate an attention weight matrix; weighting the value vector based on the attention weight matrix to obtain the fused feature map. The calculation formula of the similarity between the query vector and the key vector is as follows: As shown:

[0119]

[0120] in, represents the query vector, represents the key vector, represents the matrix transpose, represents the scaling factor, Represents the query vector With key vector similarity.

[0121] Specifically, the mathematical expression of the attention weight matrix is as follows As shown:

[0122]

[0123] in, represents the attention weight matrix, express activation function, represents the query vector, represents the key vector, represents the matrix transpose, Represents the scaling factor.

[0124] The mathematical expression of the fusion feature map is as follows: and As shown:

[0125]

[0126]

[0127] in, represents the cross attention calculation, represents the query vector, represents the key vector, represents a value vector, express activation function, represents the matrix transpose, represents the scaling factor, represents the deep features of the balanced dataset, represents the time series characteristics of the balanced dataset, represents the output of the cross-attention mechanism, represents attention calculation, Represents the exclusive OR operation.

[0128] Step S8: performing feature mapping, activation and classification processing on the fused feature map in sequence to obtain an intrusion classification result.

[0129] Specifically, see Figure 4 , which represents the structural diagram of the intrusion detection model provided by the present invention. The present invention constructs an intrusion detection model based on SRGAN, LSTM and cross-attention mechanism. After the fusion feature map is sequentially feature mapped, Softmax normalization is adopted, and the output of the intrusion detection model that integrates SRGAN, LSTM and cross-attention mechanism is converted into a category probability distribution through the Sigmoid activation function. The cross-entropy loss function is optimized to make the predicted probability of the intrusion detection model match the true category distribution as much as possible to obtain the corresponding predicted value. The intrusion detection model of the present invention can perform the final category judgment on the predicted value based on the principle of probability maximization, and finally obtain the intrusion classification result.

[0130] To demonstrate the feasibility of the proposed intrusion detection method based on data balancing and feature collaboration, a simulation experiment was conducted. The experiment was conducted on a limited number of data types, including botnets, brute force attacks, cross-site scripting attacks, penetration attacks, SQL injection attacks, and Heartbleed attacks. By incorporating SKNet into the DCGAN generator, significant data enhancement effects were observed, as shown in Table 1.

[0131] Table 1 Data quantity distribution before and after balancing

[0132]

[0133] The comparison of FID (Frechet Inception Distance) between the initial DCGAN and the improved DCGAN is shown in Table 2. The Frechet distance can represent the similarity of images and is one of the evaluation indicators of image similarity.

[0134] Table 2 Comparison of FID values between the initial DCGAN and the improved DCGAN

[0135]

[0136] As can be seen from Table 2, the FID values of the first three types of data generated by the improved DCGAN have basically dropped to around 30, and the FID values of the last three types have also decreased compared to the original model. This shows that the data generated by the improved DCGAN is closer to the real data than the data generated by the original DCGAN.

[0137] In order to verify the improved DCGAN data enhancement effect, the MLP classification model was used to carry out control experiments on the initial dataset, DCGAN enhanced dataset and improved DCGAN enhanced dataset.

[0138] It should be noted that the present invention selects the public dataset CICIDS-2017 for data preprocessing. The preprocessing process includes data cleaning (deleting outliers and missing values), category merging, feature screening, character feature digitization, and data normalization. The initial dataset selected by the present invention has 79 features in CSV format. Because the 79th feature is a character feature, it needs to be first one-hot encoded and then mapped to pixels. That is, the normalized feature is multiplied by 255 and mapped to grayscale values, and two zero pixels are added at the end to obtain a 9×9 grayscale image. Then, 75% of it is selected as the training set and 25% as the test set. The performance comparison table of the initial DCGAN and the improved DCGAN is shown in Table 3.

[0139] Table 3 Performance comparison between initial DCGAN and improved DCGAN

[0140]

[0141] As shown in Table 3, the average precision, recall, and F1 score of the improved DCGAN enhanced dataset have all improved, which shows that the quality of the generated data can be improved after SKNet improves the initial DCGAN model.

[0142] In order to verify the effectiveness of the intrusion detection model proposed in the present invention, a control experiment was conducted between several existing models and the intrusion detection model proposed in the present invention. The results are shown in Table 4:

[0143] Table 4 Performance comparison of the intrusion detection model of the present invention

[0144]

[0145] As shown in Table 4, the intrusion detection model proposed in this paper outperforms other models on all datasets, especially on the improved DCGAN enhanced dataset, with a precision of 99.6%, a recall of 99.5%, and an F1 score of 99.5%. This shows that the intrusion detection model proposed in this paper has a strong ability to identify complex attack behaviors.

[0146] Compared with the existing technology, this paper first introduces the SKNet layer to improve the initial DCGAN model to address the problem of uneven distribution of sample numbers in existing data sets. The SKNet layer is used to assist the internal discriminator of the initial DCGAN model to efficiently distinguish between real samples and generated samples, thereby promoting the convergence speed of the intrusion detection model, improving the quality of the data generated by the generator, and solving the problem of data imbalance in the intrusion detection training process at the data level.

[0147] In summary, the present invention addresses the problems and shortcomings of existing network intrusion detection methods and proposes an intrusion detection model that integrates an improved SRGAN generator, LSTM, and a cross-attention mechanism. This intrusion detection model utilizes an improved SRGAN generator to extract deep local and global feature representations of samples, leverages the LSTM's time series modeling capabilities to capture the sample's global context, and dynamically adjusts feature weights through a self-attention module to complete feature extraction and classification of the dataset. Comparisons with other models on both initial and balanced datasets show that the proposed intrusion detection model performs better overall.

[0148] Example 2

[0149] See also Figure 5 , shown is an intrusion detection system based on data balance and feature collaboration proposed in the second embodiment of the present application, including:

[0150] The SKnet module is used to add an SKnet layer after the deconvolution layer in the initial DCGAN generator to obtain an improved DCGAN generator. The SKnet module includes: a convolution layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a softmax layer;

[0151] A dimensionality reduction processing module is used to input a preset random noise vector into the improved DCGAN generator for dimensionality reduction processing to obtain a balanced data set;

[0152] An SRGAN module is used to improve the initial SRGAN generator according to the fully connected layer, the deflattening layer, and the residual block to obtain an improved SRGAN generator;

[0153] A deep feature extraction module, wherein the deep feature extraction module is used to input the balanced data set into the improved SRGAN generator to perform deep feature extraction and obtain deep features;

[0154] A time series feature extraction module is used to input the balanced data set into a preset LSTM network model to extract time series features and obtain time series features;

[0155] A mapping module, configured to perform mapping processing on the depth features to obtain a query vector, and to perform mapping processing on the time series features to obtain a value vector and a key vector;

[0156] a cross-attention mechanism module, wherein the cross-attention mechanism module is used to calculate the similarity between the query vector and the key vector, generate an attention weight matrix, and weight the value vector based on the attention weight matrix to obtain a fused feature map;

[0157] The classification module is used to perform feature mapping, activation and classification processing on the fused feature map in sequence to obtain an intrusion classification result.

[0158] The beneficial effect of the intrusion detection system based on data balance and feature collaboration proposed by the present invention is that the present invention adds an SKnet module after the deconvolution layer inside the initial DCGAN generator, and performs three core operations of the SKnet module: multi-scale feature branch generation, feature aggregation and attention weight generation, and feature map fusion. Among them, the local feature map generated by the multi-scale feature branch can capture local details, and the generated global feature map can be associated with the global context, thereby improving the flexibility of feature expression; through feature aggregation and attention weight generation, and attention weight calculation, the channel descriptors of each branch are spliced to generate a channel attention vector, thereby obtaining temporal features and depth features; based on the temporal features and depth features, a feature map fusion operation is performed, and finally a fused feature map is output. The fused feature map generated by the SKnet module can capture feature information of different scales after deconvolution, enrich the details of the generated image, and also enhance the expressive power and robustness of the model.

[0159] Secondly, the proposed SRGAN module replaces the original convolutional layers of the SRGAN generator with fully connected layers, and then introduces a deflattening layer to transform the input one-dimensional vector into a high-dimensional feature space suitable for the input of subsequent convolutional layers. Feature extraction also requires removing the original upsampling layer of the generator and adding five residual blocks between the two convolutional layers, enabling the network to more easily learn deep feature representations and addressing the vanishing gradient and degradation issues that arise with increasing network depth.

[0160] Finally, the present invention integrates the SRGAN module, the preset LSTM network model and the cross-attention mechanism module to build the intrusion detection model of the present invention. After preprocessing, the original data set is subjected to feature extraction by the improved SRGAN and LSTM models respectively, and the extracted features are input into the cross-attention mechanism module respectively. The cross-attention mechanism module maps the features extracted by the SRGAN generator to a query vector, maps the features extracted by the LSTM to a value vector and a key vector, and calculates the similarity between the query vector and the key vector to obtain a similarity score matrix and an attention weight matrix, and finally uses the weight matrix to perform weighted summation on the value vector to obtain the final feature. The cross-attention mechanism builds an interactive bridge for the features extracted by the SRGAN generator and the LSTM, which allows the intrusion detection model of the present invention to dynamically adjust the attention to each feature according to the context, so that the intrusion detection model of the present invention can combine spatial features and temporal features when processing data.

[0161] In the embodiments of the present application, an intrusion detection system based on data balancing and feature collaboration can be a device, or a component, integrated circuit, or chip in a terminal. The device can be a mobile electronic device or a non-mobile electronic device. For example, the mobile electronic device can be a mobile phone, tablet computer, laptop computer, PDA, in-vehicle electronic device, wearable device, ultra-mobile personal computer (UMPC), netbook, or personal digital assistant (PDA), while the non-mobile electronic device can be a server, network attached storage (NAS), personal computer (PC), television, ATM, or self-service machine, etc., without specific limitations in the embodiments of the present application.

[0162] In an embodiment of the present application, an intrusion detection system based on data balancing and feature collaboration may be a device having an operating system. The operating system may be an Android operating system, an iOS operating system, or other possible operating systems, which are not specifically limited in the embodiment of the present application.

[0163] The intrusion detection system based on data balance and feature collaboration provided by the embodiment of the present application can achieve Figures 1 to 4 In the method embodiment, each process of implementing an intrusion detection system based on data balance and feature collaboration is not described here in detail to avoid repetition.

[0164] Optionally, an embodiment of the present application also provides an electronic device, including a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, each process of the above-mentioned intrusion detection method embodiment based on data balance and feature collaboration is implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0165] An embodiment of the present application also provides a readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the various processes of the above-mentioned intrusion detection method embodiment based on data balance and feature collaboration are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0166] The processor is the processor in the electronic device described in the above embodiment. The readable storage medium includes a computer-readable storage medium, such as a computer read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk.

[0167] It should be noted that, in this article, the terms "comprise", "include" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprises a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element. In addition, it should be noted that the scope of the methods and devices in the embodiments of the present application is not limited to performing functions in the order shown or discussed, and may also include performing functions in a substantially simultaneous manner or in the opposite order according to the functions involved. For example, the described method may be performed in an order different from that described, and various steps may also be added, omitted, or combined. In addition, the features described with reference to certain examples may be combined in other examples.

[0168] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform. Of course, they can also be implemented by hardware, but in many cases the former is a more preferred embodiment. Based on this understanding, the technical solution of this application, or the part that contributes to the existing technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of this application.

[0169] The embodiments of the present application are described above in conjunction with the accompanying drawings, but the present application is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of this application, ordinary technicians in this field can also make many forms without departing from the purpose of this application and the scope of protection of the claims, all of which are within the protection of this application.

Claims

1. An intrusion detection method based on data balance and feature collaboration, characterized in that: include: Add an SKnet layer after the deconvolution layer in the initial DCGAN generator to obtain an improved DCGAN generator. The SKnet layer includes: a convolution layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a softmax layer. Input a preset random noise vector into the improved DCGAN generator for dimensionality reduction processing to obtain a balanced data set, wherein the process of obtaining the balanced data set includes: linearly transforming, normalizing, and activating the preset random noise in sequence to obtain a first feature map, wherein the dimension of the first feature map is higher than the dimension of the random noise; deconvoluting and upsampling the first feature map in sequence to obtain a second feature map, wherein the number of channels of the second feature map is half of the first feature map, and the height and width are both higher than the first feature map; inputting the second feature map into a plurality of branch convolution kernels of different sizes for convolution processing, Obtain a third feature map and a fourth feature map, wherein the feature extraction dimension of the fourth feature map is higher than that of the third feature map; perform feature aggregation on the third feature map and the fourth feature map to generate an attention weight matrix; perform weighted fusion on the third feature map and the fourth feature map based on the attention weight matrix to obtain a fused feature map; perform deconvolution processing and feature enhancement processing on the fused feature map in sequence to obtain a fifth feature map, wherein the number of channels of the fifth feature map is half of that of the fused feature map, and the height and width are both higher than those of the fused feature map; obtain a balanced data set based on the fifth feature map; wherein the mathematical expression of the fused feature map is: ； ； in, represents the fused feature map, represents the local feature map, represents the global feature map, represents the first weight matrix, represents the second weight matrix, represents batch normalization, represents the fully connected layer mapping operation, represents the Relu activation function, represents the average pooling result, represents the fully connected weight matrix, Represents the output vector after the full connection layer transformation; An initial SRGAN generator is improved based on a preset fully connected layer, a deflattening layer, and a residual network layer to obtain an improved SRGAN generator, wherein the improved SRGAN generator is composed of an input layer, a first fully connected layer, a second fully connected layer, a deflattening layer, a first convolutional layer, a residual network layer, and a second convolutional layer connected in sequence. The process of obtaining the improved SRGAN generator includes: adding a fully connected layer and a deflattening layer after the input layer of the initial SRGAN generator, removing the upper layer in the initial SRGAN generator, and adding multiple residual network layers between the convolutional layers inside the generator to obtain the improved SRGAN generator; Inputting the balanced data set into the improved SRGAN generator for deep feature extraction to obtain deep features, wherein the process of obtaining deep features includes: inputting the balanced data set into the first fully connected layer for vector conversion processing to obtain a first vector; inputting the first vector into the second fully connected layer for linear transformation mapping processing to obtain a second vector, wherein the length of the second vector is greater than that of the first vector; inputting the second vector into the deflattening layer for deflattening processing to obtain a third vector, wherein the dimension of the third vector is greater than that of the second vector; inputting the third vector into the first convolutional layer, the residual network layer, and the second convolutional layer in sequence for feature extraction to obtain deep features; Inputting the balanced data set into a preset LSTM network model to extract time series features and obtain time series features; Acquire a query vector, a value vector, and a key vector based on the depth feature and the time series feature; Based on an attention mechanism, processing the query vector, the key vector, and the value vector to obtain a fused feature map; The fused feature map is sequentially subjected to feature mapping, activation, and classification processing to obtain an intrusion classification result.

2. The intrusion detection method based on data balance and feature collaboration according to claim 1, characterized in that: The process of obtaining a balanced data set based on the fifth feature map includes: Obtain and preprocess a preset initial data set to obtain a grayscale image data set; Performing convolution processing and activation processing on the fifth feature map in sequence to obtain a second data set, where the second data set has the same format and size as the grayscale image data set; Performing reverse normalization on the second data set to obtain a third data set, wherein the data value range of the third data set is consistent with the range of the initial data set; The third data set is merged with the initial data set to obtain a balanced data set.

3. The intrusion detection method based on data balance and feature collaboration according to claim 1, characterized in that: The process of processing the query vector, the key vector, and the value vector based on the attention mechanism to obtain a fused feature map includes: Calculate the similarity between the query vector and the key vector based on the cross attention mechanism and generate an attention weight matrix; The value vector is weighted based on the attention weight matrix to obtain a fused feature map.

4. An intrusion detection system based on data balance and feature collaboration, characterized in that: The system comprises: The SKnet module is used to add an SKnet layer after the deconvolution layer in the initial DCGAN generator to obtain an improved DCGAN generator. The SKnet module consists of a convolutional layer, a batch normalization layer, an activation function layer, a global average pooling layer, a fully connected layer, and a Softmax layer connected in sequence; A dimensionality reduction processing module is used to input a preset random noise vector into the improved DCGAN generator for dimensionality reduction processing to obtain a balanced data set, wherein the process of obtaining a balanced data set includes: linearly transforming, normalizing, and activating the preset random noise in sequence to obtain a first feature map, wherein the dimension of the first feature map is higher than the dimension of the random noise; deconvolving and upsampling the first feature map in sequence to obtain a second feature map, wherein the number of channels of the second feature map is half of the first feature map, and the height and width are both higher than the first feature map; inputting the second feature map into a plurality of branches with different sizes of convolution kernels The method further comprises the following steps: performing convolution processing on the first feature map and the fourth feature map to obtain a third feature map and a fourth feature map, wherein the feature extraction dimension of the fourth feature map is higher than that of the third feature map; performing feature aggregation on the third feature map and the fourth feature map to generate an attention weight matrix; performing weighted fusion on the third feature map and the fourth feature map based on the attention weight matrix to obtain a fused feature map; performing deconvolution processing and feature enhancement processing on the fused feature map in sequence to obtain a fifth feature map, wherein the number of channels of the fifth feature map is half of that of the fused feature map, and both the height and width are higher than those of the fused feature map; obtaining a balanced data set based on the fifth feature map; wherein the mathematical expression of the fused feature map is: ； ； in, represents the fused feature map, represents the local feature map, represents the global feature map, represents the first weight matrix, represents the second weight matrix, represents batch normalization, represents the mapping operation of the fully connected layer, represents the Relu activation function, represents the average pooling result, represents the fully connected weight matrix, Represents the output vector after the full connection layer transformation; An SRGAN module is configured to improve an initial SRGAN generator according to a preset fully connected layer, a deflattening layer, and a residual network layer to obtain an improved SRGAN generator. The improved SRGAN generator is composed of an input layer, a first fully connected layer, a second fully connected layer, a deflattening layer, a first convolutional layer, a residual network layer, and a second convolutional layer connected in sequence. The process of obtaining the improved SRGAN generator comprises: adding a fully connected layer and a deflattening layer after the input layer of the initial SRGAN generator, removing the upper layer in the initial SRGAN generator, and adding multiple residual network layers between the convolutional layers within the generator to obtain the improved SRGAN generator. A deep feature extraction module, the deep feature extraction module is used to input the balanced data set into the improved SRGAN generator for deep feature extraction to obtain deep features; wherein the process of obtaining deep features includes: inputting the balanced data set into the first fully connected layer for vector conversion processing to obtain a first vector; inputting the first vector into the second fully connected layer for linear transformation mapping processing to obtain a second vector, the length of the second vector being longer than the first vector; inputting the second vector into the deflattening layer for deflattening processing to obtain a third vector, the dimension of the third vector being longer than the second vector; inputting the third vector into the first convolutional layer, the residual network layer, and the second convolutional layer in sequence for feature extraction to obtain deep features; A time series feature extraction module is used to input the balanced data set into a preset LSTM network model to extract time series features and obtain time series features; A mapping module, configured to perform mapping processing on the depth features to obtain a query vector, and to perform mapping processing on the time series features to obtain a value vector and a key vector; an attention mechanism module, the attention mechanism module being configured to calculate the similarity between the query vector and the key vector, generate an attention weight matrix, and weight the value vector based on the attention weight matrix to obtain a fused feature map; The classification module is used to perform feature mapping, activation and classification processing on the fused feature map in sequence to obtain an intrusion classification result.

5. An electronic device, characterized in that: It includes a processor, a memory, and a program or instruction stored in the memory and executable on the processor. When the program or instruction is executed by the processor, the steps of an intrusion detection method based on data balance and feature collaboration as described in any one of claims 1 to 3 are implemented.

6. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, the steps of the intrusion detection method based on data balance and feature collaboration as described in any one of claims 1 to 3 are implemented.

Images