Network intrusion detection method, device, computer equipment and storage medium

Abstract

This application relates to a network intrusion detection method, apparatus, computer device, computer-readable storage medium, and computer program product. The method comprises: collecting network traffic sample data, serializing the network traffic sample data to obtain traffic sequence data; using the traffic sequence data to train a comparative Tranceformer neural network model to obtain a network intrusion detection model; obtaining subsequent network traffic data within a preset range of a cloud environment; calculating a loss value for the subsequent network traffic data, and determining a network intrusion result based on the loss value using the network intrusion detection model. This method enables efficient detection of network traffic data.

Description

Technical Field

[0001] The present application relates to the field of cloud computing network technology, and in particular to a network intrusion detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] The rapid development of cloud computing technology has led to its widespread application in fields such as artificial intelligence, big data, and the Internet of Things. However, this has also led to increasing complexity in cloud network environments, posing even more severe security challenges. As a virtual resource pool, cloud computing environments, with their distributed nature, multi-tenant architecture, and dynamic resource adjustments, complicate and challenge network intrusion detection. With the widespread use of cloud computing services, hackers have begun targeting cloud environments, exploiting vulnerability exploits, denial of service attacks, and cross-site scripting attacks to illegally intrude and damage cloud systems. These attacks can not only lead to data leaks and financial losses, but can also severely impact the entire cloud computing environment.

[0003] Traditional network intrusion detection technologies, such as rule-based detection and statistical anomaly detection, struggle to cope with the complexity and dynamic nature of cloud environments. They often struggle to adapt to the high volume and rapid changes in data traffic in cloud environments, and are unable to effectively address new and unknown attack vectors. Existing methods for detecting intrusions from abnormal traffic suffer from two major issues: First, in real-world scenarios, the number of abnormal samples is often far less than that of normal samples, resulting in a significant imbalance in the training data. This imbalance makes the model prone to favoring normal samples during training, thereby reducing its ability to detect abnormal samples. Improving detection sensitivity often increases the false alarm rate, while reducing the false alarm rate can reduce detection sensitivity. Second, traditional algorithms may not be as effective as deep learning when processing large-scale data, high-noise data, or in applications requiring automatic feature learning.

[0004] Therefore, there is an urgent need for a network intrusion detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can efficiently detect network traffic data. Summary of the Invention

[0005] Based on this, it is necessary to provide a network intrusion detection method, device, computer equipment, computer-readable storage medium and computer program product that can efficiently detect network traffic data in response to the above technical problems.

[0006] In a first aspect, the present application provides a network intrusion detection method, comprising:

[0007] Collecting network traffic sample data, and performing serialization processing on the network traffic sample data to obtain traffic sequence data;

[0008] Using the traffic sequence data, a comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0009] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0010] Calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0011] In one embodiment, the serializing the network traffic sample data includes:

[0012] The collected network traffic sample data is segmented based on the network session topic type to obtain at least one PCAP storage file, and a link layer frame is read from each PCAP storage file;

[0013] Remove the header fields from the link layer frame, retaining the IP data packet encapsulated in the link layer frame;

[0014] Merge IP packets with the same traffic characteristics.

[0015] In one embodiment, the use of the traffic sequence data to train a comparative Tranceformer neural network model includes:

[0016] Performing positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively;

[0017] Extract semantic features from positive sample data, negative sample data, and original sample data;

[0018] The comparative Tranceformer neural network model is trained using the semantic features in the positive sample data, the negative sample data and the original sample data.

[0019] In one embodiment, the training of the comparative Tranceformer neural network model using semantic features in the positive sample data, negative sample data, and original sample data includes:

[0020] Based on the semantic features in the positive sample data, the negative sample data, and the original sample data, the similarity between different two items in the positive sample data, the negative sample data, and the original sample data is calculated using a calculation formula of a loss function;

[0021] When the similarity between the positive sample data and the original sample data reaches a maximum value, and the similarity between the negative sample data and the original sample data reaches a minimum value, the loss value of the characterization loss function reaches a minimum, and the training of the comparative Tranceformer neural network model is completed.

[0022] In one embodiment, the calculation formula of the loss value of the loss function includes:

[0023] ;

[0024] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0025] In one embodiment, after obtaining subsequent network traffic data within a preset range of the cloud environment, the method further includes:

[0026] Determine whether the subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules;

[0027] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion result is determined based on the loss value using the network intrusion detection model.

[0028] In one embodiment, after determining the network intrusion result, the method further includes:

[0029] In a case where the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to the preset blacklist traffic list.

[0030] In a second aspect, the present application further provides a network intrusion detection device, comprising:

[0031] The data acquisition module is used to collect network traffic sample data and perform serialization processing on the network traffic sample data to obtain traffic sequence data;

[0032] A model training module is used to train a comparative Tranceformer neural network model using the traffic sequence data to obtain a network intrusion detection model;

[0033] A data acquisition module is used to obtain subsequent network traffic data within a preset range of the cloud environment;

[0034] The intrusion detection module is used to calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0035] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0036] Collecting network traffic sample data, and performing serialization processing on the network traffic sample data to obtain traffic sequence data;

[0037] Using the traffic sequence data, a comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0038] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0039] Calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0040] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0041] Collecting network traffic sample data, and performing serialization processing on the network traffic sample data to obtain traffic sequence data;

[0042] Using the traffic sequence data, a comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0043] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0044] Calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0045] In a fifth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the following steps:

[0046] Collecting network traffic sample data, and performing serialization processing on the network traffic sample data to obtain traffic sequence data;

[0047] Using the traffic sequence data, a comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0048] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0049] Calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0050] The aforementioned network intrusion detection method, apparatus, computer device, computer-readable storage medium, and computer program product serialize collected network traffic sample data, converting it into unified traffic sequence data. This enhances the data's temporal characteristics and processability while reducing data complexity. Using this sequence data to train a comparative Transformer neural network model leverages the Transformer's multi-head self-attention mechanism, automatically learning complex features and long-range dependencies, thereby achieving high-precision intrusion detection and effectively addressing data imbalance. In practical applications, this method continuously acquires subsequent network traffic data within a preset range in the cloud environment, enabling real-time monitoring and dynamic detection of network traffic, adapting to the complexity and dynamic nature of the cloud environment. By calculating the loss value of subsequent network traffic data and combining it with the trained model to determine the network intrusion outcome, the method quantifies the degree of anomaly and improves detection reliability. Furthermore, the detection threshold can be dynamically adjusted based on actual needs, balancing detection sensitivity and false alarm rate, providing powerful decision-making support for network security management. Overall, this method demonstrates significant technical benefits in terms of detection accuracy, efficiency, adaptability, real-time performance, and reliability, effectively addressing network security challenges in cloud computing environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments of the present application or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 A diagram of an application environment of a network intrusion detection method according to an embodiment;

[0053] Figure 2 1 is a flow chart of a network intrusion detection method according to an embodiment;

[0054] Figure 3 is a flowchart of a network intrusion detection method according to another embodiment;

[0055] Figure 4 is a structural block diagram of a network intrusion detection device in one embodiment;

[0056] Figure 5 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0058] The network intrusion detection method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown, the terminal 102 communicates with the server 104 via a network. The data storage system can store data that the server 104 needs to process. The data storage system can be integrated on the server 104 or placed on the cloud or other network servers.

[0059] The server 104 controls the terminal 102 to collect network traffic sample data, serializes the network traffic sample data, and obtains traffic sequence data; the server 104 uses the traffic sequence data to train a comparative Tranceformer neural network model to obtain a network intrusion detection model; the server 104 controls the terminal 102 to obtain subsequent network traffic data within a preset range of the cloud environment; the server 104 calculates the loss value of the subsequent network traffic data, and determines the network intrusion result based on the loss value using the network intrusion detection model.

[0060] Terminal 102 may include, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices may include smart speakers, smart TVs, smart air conditioners, smart car devices, and projectors. Portable wearable devices may include smart watches, smart bracelets, and head-mounted devices. Head-mounted devices may include virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, and the like. Server 104 may be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing services.

[0061] In an exemplary embodiment, Figure 2 As shown, a network intrusion detection method is provided, which is applied to Figure 1 The server 104 in the example is used as an example to illustrate the method, which includes the following steps S202 to S208.

[0062] Step S202: collect network traffic sample data, and perform serialization processing on the network traffic sample data to obtain traffic sequence data.

[0063] Specifically, network traffic sample data is typically captured from network devices (such as switches and routers) or network monitoring tools. This data contains various network communication information, such as the source and destination addresses of packets, protocol types, packet sizes, and timestamps. The collected sample data should cover both normal traffic and abnormal traffic (such as attack traffic). Normal traffic is used by the model to learn the characteristics of normal network behavior, while abnormal traffic is used to train the model to identify potential intrusions. The collected data is typically in the form of raw network packets, such as those saved in PCAP (Packet Capture) file format. These files contain detailed records of network communications.

[0064] Serialization converts network traffic sample data into an ordered sequence format, enabling the model to better capture the temporal characteristics and dynamic changes of the data. This is crucial for detecting time-series-based attacks, such as DDoS attacks and scanning attacks. After the aforementioned processing, the network traffic sample data is converted into ordered sequence data. Each sequence data represents a network session or a set of related network interactions. Traffic sequence sample data is typically organized as a time series, and the data at each time point may contain multiple features, such as packet size and protocol type. This sequence data can be directly used to train deep learning models, such as the Transformer model.

[0065] Step S204: using the traffic sequence data to train a comparative Tranceformer neural network model to obtain a network intrusion detection model.

[0066] Specifically, traffic series data is network traffic data that has undergone preprocessing (such as session segmentation, link layer stripping, data aggregation, and enhancement). It retains the temporal order and dynamic characteristics of network traffic. This data format is suitable for training time series-based deep learning models because it can reflect the dynamic changes and behavioral patterns of network traffic.

[0067] The Transformer is a deep learning model based on the self-attention mechanism, originally developed for natural language processing tasks such as machine translation. Its multi-head self-attention mechanism enables it to capture long-range dependencies in sequence data and processes all elements in the sequence in parallel, thereby improving training efficiency. In this paper, the Transformer model is used to extract features from network traffic sequence data.

[0068] The Comparative Transformer proposed in this embodiment introduces a contrastive learning mechanism based on the traditional Transformer. Contrastive learning is an unsupervised learning method that learns feature representations by comparing similarities and differences between samples. During training, the model not only learns the characteristics of normal and abnormal traffic but also enhances its ability to distinguish different traffic patterns through contrastive learning. The model learns the deep characteristics of network traffic and can distinguish between normal and abnormal traffic. The resulting network intrusion detection model can be used to monitor network traffic flowing into the cloud environment in real time and determine whether there is intrusion.

[0069] Step S206: Obtain subsequent network traffic data within a preset range of the cloud environment.

[0070] Specifically, a "predefined scope" refers to a predefined network area or key node within a cloud environment that requires monitoring. For example, this could be a specific server, virtual machine, network interface, or network service. Setting a preset scope allows the detection system to focus on monitoring critical resources, improving detection efficiency and targeting.

[0071] Subsequent network traffic data refers to the network traffic data captured in real time after model training is completed. This data is the actual input for model detection and is used to determine whether the current network traffic is normal.

[0072] Step S208: Calculate the loss value of subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0073] Specifically, during the training phase, the model optimizes a loss function (such as SimCSE-Loss) through contrastive learning, maximizing the similarity between positive samples and the original samples and minimizing the similarity between negative samples and the original samples. For subsequent network traffic data captured in real time, the model calculates the loss value compared to normal traffic patterns. The loss value reflects the degree of difference between the current traffic data and normal traffic patterns.

[0074] If the calculated loss value exceeds a preset threshold, it indicates that the current traffic data differs significantly from normal traffic patterns and may be abnormal traffic, causing the model to identify it as an intrusion. Using a trained network intrusion detection model (such as the Comparative Transformer), subsequent network traffic data is classified and judged. The model outputs a probability or confidence level for determining whether the traffic is normal or abnormal, ultimately determining an intrusion outcome based on these outputs.

[0075] By calculating the loss value, the degree of traffic anomaly is quantified into a specific numerical value, making the judgment process more objective and accurate. The model has already learned the characteristic differences between normal and abnormal traffic during the training phase. By using the loss value to determine the difference, it can effectively distinguish between normal and abnormal traffic, reducing the false alarm rate. The loss value threshold can be dynamically adjusted based on actual network environment changes, achieving a balance between detection sensitivity and false alarm rate. This step enables rapid detection and judgment of real-time network traffic, timely detection and response to potential intrusions, and enhanced cloud environment security.

[0076] In the aforementioned network intrusion detection method, collected network traffic sample data is serialized and converted into unified traffic sequence data, enhancing the data's temporal characteristics and processability while reducing data complexity. Using this sequence data to train a comparative Transformer neural network model leverages the Transformer's multi-head self-attention mechanism, automatically learning complex features and long-range dependencies. This achieves high-precision intrusion detection and effectively addresses data imbalance. In practical applications, this method continuously acquires subsequent network traffic data within a preset range in the cloud environment, enabling real-time monitoring and dynamic detection of network traffic, adapting to the complexity and dynamic nature of the cloud environment. By calculating the loss value of subsequent network traffic data and combining it with the trained model to determine the network intrusion outcome, the method quantifies the degree of anomaly and improves detection reliability. Furthermore, the detection threshold can be dynamically adjusted based on actual needs, balancing detection sensitivity and false alarm rate, providing powerful decision support for network security management. Overall, this method demonstrates significant technical benefits in terms of detection accuracy, efficiency, adaptability, real-time performance, and reliability, effectively addressing network security challenges in cloud computing environments.

[0077] In an exemplary embodiment, Figure 3 As shown, the network traffic sample data is serialized, including:

[0078] Step S302: Segment the collected network traffic sample data using the network session topic type as a segmentation basis to obtain at least one PCAP storage file, and read the link layer frame from each PCAP storage file;

[0079] Step S304, removing the header field from the link layer frame, retaining the IP data packet encapsulated in the link layer frame;

[0080] Step S306: merging IP data packets with similar traffic characteristics.

[0081] Specifically, a network session refers to a communication connection established between two network nodes, typically defined by a specific protocol (such as TCP or UDP) and port number. Network session topic types can be used to distinguish different sessions based on features such as protocol type, port number, and IP address. Based on the network session topic type, the large amount of collected network traffic data is segmented into multiple small PCAP storage files. Each PCAP storage file contains traffic data for a specific session. PCAP (Packet Capture) format storage files are a common network traffic data storage format used to store detailed information about network data packets.

[0082] The link layer, the second layer in the network protocol stack, is responsible for transmitting data frames between adjacent nodes. Link layer frames consist of a frame header and a frame data portion. The frame header contains information such as the MAC address and protocol type, while the frame data portion encapsulates upper-layer protocol data (such as IP packets). The link layer frame contents are parsed from each PCAP file for further processing.

[0083] The header field of a link layer frame contains some link layer-related control information, such as the MAC address and protocol type. This information may not be necessary for subsequent traffic analysis, so the header field can be removed, retaining only the frame data portion. The frame data portion typically encapsulates an IP packet, a data unit at the network layer that contains important information such as the source IP address, destination IP address, and protocol type. The IP packet is retained for subsequent analysis of network traffic characteristics.

[0084] IP packet characteristics can include protocol type, packet size, source IP address, destination IP address, and so on. IP packets with similar characteristics may belong to the same traffic class, for example, HTTP requests from the same client to the same server. Combining IP packets with similar or identical traffic characteristics into a single class or group can reduce data redundancy and improve data processing efficiency. This combined data can be used to generate higher-level traffic characteristics, such as session duration and packet transmission rate.

[0085] In this embodiment, by removing link layer header fields and merging IP packets with identical traffic characteristics, data redundancy and complexity are reduced, improving data processing efficiency. The merged data better reflects the characteristics of network traffic, providing higher-quality input for subsequent model training. By retaining key information in IP packets, the model can more accurately identify the characteristic differences between normal and abnormal traffic, thereby improving the accuracy of intrusion detection.

[0086] In an exemplary embodiment, using traffic sequence data, a comparative Tranceformer neural network model is trained, including:

[0087] Perform positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively;

[0088] Extract semantic features from positive sample data, negative sample data and original sample data.

[0089] The comparative Tranceformer neural network model is trained using the semantic features of positive sample data, negative sample data and original sample data.

[0090] Specifically, positive data samples are samples of normal network traffic. These samples represent the network's behavior during normal operation. Negative data samples are samples of abnormal network traffic, such as traffic that has been attacked or exhibits malicious behavior. These samples represent the network's behavior when it is compromised. Original data samples are raw, unmodified traffic sequence data, used for comparative learning with positive and negative samples.

[0091] Positive sampling involves randomly extracting samples from normal traffic to generate positive data. Negative sampling involves randomly extracting samples from abnormal traffic to generate negative data. Negative samples can also be generated from normal traffic using data augmentation techniques (such as adding noise or random transformations). Raw sampling involves directly selecting unprocessed samples from traffic sequence data as raw data.

[0092] Extract semantic features from positive and negative data, as well as the original data. In deep learning, semantic features refer to high-level representations of data that reflect its inherent meaning and patterns. For network traffic data, semantic features may include packet size, transmission frequency, protocol type, and source / destination IP addresses.

[0093] The Transformer model uses its encoder to extract features from input traffic sequence data. Specifically, the Transformer model's self-attention mechanism captures long-range dependencies in sequence data and converts the input data into abstract semantic feature vectors. The Transformer model is able to capture the complex patterns and long-range dependencies in network traffic data, thereby extracting more meaningful semantic features. Through the self-attention mechanism, the model automatically learns important features in the data without the need for manual feature engineering.

[0094] By comparing the similarities and differences between positive and negative samples, as well as the original samples, the model can learn more effective feature representations. During training, the model uses a specific loss function (such as SimCSE-Loss) to optimize parameters. The loss function aims to maximize the similarity between positive and original samples and minimize the similarity between negative and original samples. Positive, negative, and original sample data are input into the Transformer model. The model extracts semantic features from these samples through the encoder.

[0095] In this embodiment, a comparative learning mechanism is used to enhance the model's ability to detect abnormal traffic. Through positive and negative sample sampling, semantic feature extraction, and loss function optimization, the model automatically learns the deep characteristics of network traffic and effectively distinguishes normal from abnormal traffic. This approach not only improves detection accuracy and efficiency, but also enhances the model's generalization and adaptability, providing powerful technical support for network intrusion detection in cloud environments.

[0096] In an exemplary embodiment, a comparative Tranceformer neural network model is trained using semantic features in positive sample data, negative sample data, and original sample data, including:

[0097] According to the semantic features of the positive sample data, negative sample data and original sample data, the similarity between different two items in the positive sample data, negative sample data and original sample data is calculated using the calculation formula of the loss function;

[0098] When the similarity between the positive sample data and the original sample data reaches the maximum value, and the similarity between the negative sample data and the original sample data reaches the minimum value, the loss value of the representation loss function reaches the minimum, and the training of the comparative Tranceformer neural network model is completed.

[0099] Specifically, a loss function formula (such as SimCSE-Loss) is used to calculate the similarity between different samples. Similarity is typically measured using cosine similarity, which calculates the cosine of the angle between two vectors. The value ranges from -1 to 1, with larger values indicating greater similarity. The loss function is the objective function used to optimize parameters during model training. In the comparative Transformer model, the loss function is designed to maximize the similarity between positive samples and the original samples and minimize the similarity between negative samples and the original samples.

[0100] During training, model parameters are continuously adjusted to increase the similarity between positive samples and the original samples and decrease the similarity between negative samples and the original samples. When the similarity between positive samples and the original samples reaches its maximum value and the similarity between negative samples and the original samples reaches its minimum value, the loss function reaches its minimum value. This indicates that the model has learned feature representations that effectively distinguish normal and abnormal traffic. When the loss value reaches its minimum value and the model performance on the validation set meets the requirements, the model training is considered complete.

[0101] In this embodiment, through comparative learning, the model can more accurately distinguish between normal and abnormal traffic, thereby improving the accuracy of intrusion detection. During training, the model learns the characteristic differences between normal and abnormal traffic, effectively reducing the false positive rate. By learning the similarities and differences between samples, the model can better adapt to new attack patterns and unknown network environments.

[0102] In an exemplary embodiment, the calculation formula of the loss value of the loss function includes:

[0103] ;

[0104] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0105] In this embodiment, the comparative Transformer model is optimized using the SimCSE-Loss loss function to improve the accuracy and efficiency of network intrusion detection. Through a comparative learning mechanism, the model's ability to distinguish between normal and abnormal traffic features is enhanced, thereby reducing false alarm rates and increasing detection sensitivity. SimCSE-Loss is particularly suitable for processing unbalanced datasets and can optimize model performance by maximizing the similarity of positive samples and minimizing the similarity of negative samples. It can adapt to the dynamic changes in network traffic in cloud environments, enabling rapid identification and response to new attack behaviors, enhancing the model's generalization capabilities and real-time detection effectiveness. By automatically learning traffic features, the need for manual feature engineering is reduced, the detection process is simplified, and a more effective protection measure is provided for cloud security.

[0106] In an exemplary embodiment, after obtaining subsequent network traffic data within a preset range of the cloud environment, the method further includes:

[0107] Determine whether subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules;

[0108] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion detection model is used to determine the network intrusion result based on the loss value.

[0109] Specifically, the preset blacklist traffic list refers to a list of traffic that is marked by the cloud resource service provider or user based on known malicious behaviors or attack patterns. This traffic is considered abnormal and is usually intercepted or blocked directly. The preset whitelist traffic list refers to a list of traffic that is added by the cloud resource service provider or user based on preset rules (such as known normal business traffic patterns). This traffic is considered trustworthy and is usually released directly. The system will first check whether the captured network traffic data matches an entry in the blacklist or whitelist. If it matches the blacklist, it will be directly intercepted and an alarm will be issued; if it matches the whitelist, it will be directly released without further detection.

[0110] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated. According to the loss value, the network intrusion detection model is used to determine that the network intrusion result does not belong to the blacklist or whitelist. Traffic refers to those that are neither on the blacklist nor on the whitelist. The system needs to further analyze to determine whether it is abnormal traffic.

[0111] Using a trained network intrusion detection model (such as a comparative Transformer model), the loss value between current traffic data and normal traffic patterns is calculated. This value reflects the degree of difference between the current traffic data and the normal traffic pattern. Based on a preset threshold, if the calculated loss value exceeds the threshold, it indicates that the current traffic data differs significantly from the normal traffic pattern, potentially indicating abnormal traffic, and the model will identify it as an intrusion. The model outputs a probability or confidence level for determining whether the traffic is normal or abnormal to determine the intrusion outcome.

[0112] In this embodiment, through the rapid screening of blacklists and whitelists, repeated detection of known normal or malicious traffic is reduced, saving computing resources and time. The system can concentrate resources to perform detailed analysis on unknown or suspicious traffic, improving the pertinence and efficiency of detection. Blacklisted traffic is usually known malicious behavior, and direct interception can reduce false alarms. Whitelisted traffic is usually known normal business traffic, and direct release can avoid normal traffic being misjudged as abnormal traffic. Blacklists and whitelists can be dynamically updated according to actual needs. For example, when a new attack pattern is discovered, it can be added to the blacklist in a timely manner; when the normal business traffic pattern changes, the whitelist can be updated. Cloud resource service providers or users can define blacklist and whitelist rules according to their own needs and experience, enhancing the flexibility and customizability of the system.

[0113] In an exemplary embodiment, after determining the network intrusion result, the method further includes:

[0114] When the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to the preset blacklist traffic list.

[0115] Specifically, after the network intrusion detection model analyzes subsequent network traffic data, it will output a judgment result indicating whether the current traffic is normal traffic or abnormal traffic. If the model determines that the subsequent network traffic data is abnormal traffic, it means that the traffic may contain malicious behavior or attack characteristics, such as unauthorized access, data leakage, denial of service attacks (DDoS), etc. The preset blacklist traffic list is a list of known malicious traffic characteristics used to quickly identify and intercept potential attack behaviors. Traffic on the blacklist is usually directly blocked or isolated to prevent further damage to the system. When new abnormal traffic is detected, adding these traffic characteristics to the blacklist can expand the coverage of the blacklist and enhance the system's ability to identify emerging attack patterns.

[0116] In this embodiment, by adding detected anomalous traffic to a blacklist, the system can more quickly identify and block similar attack behaviors, thereby enhancing defenses against unknown and new attacks. Traffic patterns that have already been identified as anomalous can be directly blocked by the blacklist upon subsequent occurrence, eliminating the need for detailed detection and analysis, thus conserving system resources. Dynamically updating the blacklist ensures that the system can respond promptly to emerging threats and mitigate the impact of attacks on the system.

[0117] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0118] Based on the same inventive concept, the embodiments of the present application also provide a network intrusion detection device for implementing the aforementioned network intrusion detection method. The implementation solution provided by the device is similar to the implementation solution described in the aforementioned method. Therefore, the specific limitations in one or more network intrusion detection device embodiments provided below can be found in the above-mentioned limitations on the network intrusion detection method and will not be repeated here.

[0119] In an exemplary embodiment, Figure 4 As shown, a network intrusion detection device is provided, comprising:

[0120] The data collection module 402 is used to collect network traffic sample data and perform serialization processing on the network traffic sample data to obtain traffic sequence data;

[0121] The model training module 404 is used to train a comparative Tranceformer neural network model using traffic sequence data to obtain a network intrusion detection model;

[0122] The data acquisition module 406 is used to acquire subsequent network traffic data within a preset range of the cloud environment;

[0123] The intrusion detection module 408 is used to calculate the loss value of subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0124] In an exemplary embodiment, the model training module 404 is also used to segment the collected network traffic sample data using the network session topic type as a segmentation basis, obtain at least one PCAP storage file, read the link layer frame from each PCAP storage file; remove the header field from the link layer frame, retain the IP data packet encapsulated in the link layer frame; and merge the IP data packets with the same traffic characteristics.

[0125] In an exemplary embodiment, the data acquisition module 402 is further configured to perform positive and negative sampling on the traffic sequence data to obtain positive sample data, negative sample data, and original sample data; extract semantic features from the positive sample data, negative sample data, and original sample data; and train a comparative Tranceformer neural network model using the semantic features from the positive sample data, negative sample data, and original sample data.

[0126] In an exemplary embodiment, the model training module 404 is further used to calculate the similarity between two different items in the positive sample data, negative sample data and original sample data based on the semantic features in the positive sample data, negative sample data and original sample data, using the calculation formula of the loss function; when the similarity between the positive sample data and the original sample data reaches a maximum value and the similarity between the negative sample data and the original sample data reaches a minimum value, the loss value representing the loss function reaches a minimum, and the training of the comparative Tranceformer neural network model is completed.

[0127] In an exemplary embodiment, the calculation formula of the loss value of the loss function includes:

[0128] ;

[0129] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0130] In an exemplary embodiment, the intrusion detection module 408 is used to determine whether subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein, the preset blacklist traffic list is marked by the cloud resource service provider or the user, and the preset whitelist traffic list is added by the cloud resource service provider or the user according to preset rules; when the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and according to the loss value, the network intrusion detection model is used to determine the network intrusion result.

[0131] In an exemplary embodiment, the intrusion detection module 408 is configured to add subsequent network traffic data to a preset blacklist traffic list when the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data.

[0132] Each module in the aforementioned network intrusion detection device may be implemented in whole or in part through software, hardware, or a combination thereof. Each module may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0133] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 5As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O) and a communication interface. The processor, memory and input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used to store network traffic sample data and subsequent network traffic data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method is implemented.

[0134] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0135] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0136] Collect network traffic sample data, perform serialization processing on the network traffic sample data, and obtain traffic sequence data;

[0137] Using traffic sequence data, the comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0138] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0139] Calculate the loss value of subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0140] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0141] The collected network traffic sample data is segmented based on the network session topic type to obtain at least one PCAP storage file, and a link layer frame is read from each PCAP storage file;

[0142] Remove the header fields from the link layer frame, retaining the IP data packet encapsulated in the link layer frame;

[0143] Merge IP packets with the same traffic characteristics.

[0144] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0145] Perform positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively;

[0146] Extract semantic features from positive sample data, negative sample data and original sample data.

[0147] The comparative Tranceformer neural network model is trained using the semantic features of positive sample data, negative sample data and original sample data.

[0148] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0149] According to the semantic features of the positive sample data, negative sample data and original sample data, the similarity between different two items in the positive sample data, negative sample data and original sample data is calculated using the calculation formula of the loss function;

[0150] When the similarity between the positive sample data and the original sample data reaches the maximum value, and the similarity between the negative sample data and the original sample data reaches the minimum value, the loss value of the representation loss function reaches the minimum, and the training of the comparative Tranceformer neural network model is completed.

[0151] In an exemplary embodiment, the calculation formula of the loss value of the loss function includes:

[0152] ;

[0153] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0154] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0155] Determine whether subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules;

[0156] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion detection model is used to determine the network intrusion result based on the loss value.

[0157] In one embodiment, when the processor executes the computer program, the processor further implements the following steps:

[0158] When the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to a preset blacklist traffic list.

[0159] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0160] Collect network traffic sample data, perform serialization processing on the network traffic sample data, and obtain traffic sequence data;

[0161] Using traffic sequence data, the comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0162] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0163] Calculate the loss value of subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0164] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0165] The collected network traffic sample data is segmented based on the network session topic type to obtain at least one PCAP storage file, and a link layer frame is read from each PCAP storage file;

[0166] Remove the header fields from the link layer frame, retaining the IP data packet encapsulated in the link layer frame;

[0167] Merge IP packets with the same traffic characteristics.

[0168] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0169] Perform positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively;

[0170] Extract semantic features from positive sample data, negative sample data and original sample data.

[0171] The comparative Tranceformer neural network model is trained using the semantic features of positive sample data, negative sample data and original sample data.

[0172] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0173] According to the semantic features of the positive sample data, negative sample data and original sample data, the similarity between different two items in the positive sample data, negative sample data and original sample data is calculated using the calculation formula of the loss function;

[0174] When the similarity between the positive sample data and the original sample data reaches the maximum value, and the similarity between the negative sample data and the original sample data reaches the minimum value, the loss value of the representation loss function reaches the minimum, and the training of the comparative Tranceformer neural network model is completed.

[0175] In an exemplary embodiment, the calculation formula of the loss value of the loss function includes:

[0176] ;

[0177] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0178] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0179] Determine whether subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules;

[0180] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion detection model is used to determine the network intrusion result based on the loss value.

[0181] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0182] When the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to a preset blacklist traffic list.

[0183] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0184] Collect network traffic sample data, perform serialization processing on the network traffic sample data, and obtain traffic sequence data;

[0185] Using traffic sequence data, the comparative Tranceformer neural network model is trained to obtain a network intrusion detection model;

[0186] Obtain subsequent network traffic data within a preset range of the cloud environment;

[0187] Calculate the loss value of subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

[0188] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0189] The collected network traffic sample data is segmented based on the network session topic type to obtain at least one PCAP storage file, and a link layer frame is read from each PCAP storage file;

[0190] Remove the header fields from the link layer frame, retaining the IP data packet encapsulated in the link layer frame;

[0191] Merge IP packets with the same traffic characteristics.

[0192] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0193] Perform positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively;

[0194] Extract semantic features from positive sample data, negative sample data and original sample data.

[0195] The comparative Tranceformer neural network model is trained using the semantic features of positive sample data, negative sample data and original sample data.

[0196] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0197] According to the semantic features of the positive sample data, negative sample data and original sample data, the similarity between different two items in the positive sample data, negative sample data and original sample data is calculated using the calculation formula of the loss function;

[0198] When the similarity between the positive sample data and the original sample data reaches the maximum value, and the similarity between the negative sample data and the original sample data reaches the minimum value, the loss value of the representation loss function reaches the minimum, and the training of the comparative Tranceformer neural network model is completed.

[0199] In an exemplary embodiment, the calculation formula of the loss value of the loss function includes:

[0200] ;

[0201] Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , represents the dot product of vector A and vector B, represents the norm of vector A, Represents the norm of vector B.

[0202] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0203] Determine whether subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules;

[0204] When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion detection model is used to determine the network intrusion result based on the loss value.

[0205] In one embodiment, when the computer program is executed by a processor, the following steps are further implemented:

[0206] When the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to a preset blacklist traffic list.

[0207] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0208] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. In particular, any reference to memory, database, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The databases involved in the various embodiments provided herein may include at least one of a relational database and a non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the various embodiments provided herein may be, but are not limited to, general-purpose processors, central processing units (CPUs), graphics processing units (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), quantum computing-based data processing logic devices, artificial intelligence (AI) processors, and the like.

[0209] The technical features of the above embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0210] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present application shall be determined by the appended claims.

Claims

1. A network intrusion detection method, characterized in that: The method comprises: Collecting network traffic sample data, serializing the network traffic sample data, segmenting the collected network traffic sample data based on the network session topic type to obtain at least one PCAP storage file, and reading link layer frames from each PCAP storage file; removing header fields from the link layer frames, retaining IP data packets encapsulated in the link layer frames; and merging IP data packets with the same traffic characteristics to obtain traffic sequence data; Using the traffic sequence data, a comparative Tranceformer neural network model is trained to obtain a network intrusion detection model; Obtain subsequent network traffic data within a preset range of the cloud environment; Calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

2. The method according to claim 1, characterized in that The method of using the traffic sequence data to train a comparative Tranceformer neural network model includes: Performing positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively; Extract semantic features from positive sample data, negative sample data, and original sample data; The comparative Tranceformer neural network model is trained using the semantic features in the positive sample data, the negative sample data and the original sample data.

3. The method according to claim 2, characterized in that The method of training the comparative Tranceformer neural network model by utilizing the semantic features in the positive sample data, the negative sample data, and the original sample data includes: Based on the semantic features in the positive sample data, the negative sample data, and the original sample data, the similarity between different two items in the positive sample data, the negative sample data, and the original sample data is calculated using a calculation formula of a loss function; When the similarity between the positive sample data and the original sample data reaches a maximum value, and the similarity between the negative sample data and the original sample data reaches a minimum value, the loss value of the characterization loss function reaches a minimum, and the training of the comparative Tranceformer neural network model is completed.

4. The method according to claim 3, characterized in that The calculation formula of the loss value of the loss function includes: ； Among them, SimCSE-Loss represents the loss value; Represents the original sample data The corresponding true label value result; Represents positive sample data The corresponding predicted value results; Represents negative sample data The corresponding predicted value result; τ represents the similarity adjustment factor; Represents the cosine similarity function for calculating any two sample data. The specific formula is: , Represents a vector A With vector B The dot product of Represents a vector A The norm of Represents a vector B The norm of .

5. The method according to claim 1, wherein After obtaining subsequent network traffic data within a preset range of the cloud environment, the method further includes: Determine whether the subsequent network traffic data belongs to a preset blacklist traffic list or a preset whitelist traffic list; wherein the preset blacklist traffic list is marked by the cloud resource service provider or user, and the preset whitelist traffic list is added by the cloud resource service provider or user according to preset rules; When the subsequent network traffic data does not belong to the preset blacklist traffic list or the preset whitelist traffic list, the loss value of the subsequent network traffic data is calculated, and the network intrusion result is determined based on the loss value using the network intrusion detection model.

6. The method according to claim 5, characterized in that After determining the network intrusion result, the method further includes: In a case where the network intrusion result indicates that the subsequent network traffic data is abnormal traffic data, the subsequent network traffic data is added to the preset blacklist traffic list.

7. A network intrusion detection device, characterized in that: The device comprises: The data collection module is used to collect network traffic sample data, serialize the network traffic sample data, segment the collected network traffic sample data based on the network session topic type to obtain at least one PCAP storage file, read the link layer frame from each PCAP storage file; remove the header field from the link layer frame, retain the IP data packet encapsulated in the link layer frame; and merge the IP data packets with the same traffic characteristics to obtain traffic sequence data. A model training module is used to train a comparative Tranceformer neural network model using the traffic sequence data to obtain a network intrusion detection model; A data acquisition module is used to obtain subsequent network traffic data within a preset range of the cloud environment; The intrusion detection module is used to calculate the loss value of the subsequent network traffic data, and determine the network intrusion result based on the loss value using the network intrusion detection model.

8. The device according to claim 7, characterized in that The model training module is also used to perform positive and negative sample sampling on the traffic sequence data to obtain positive sample data, negative sample data and original sample data respectively; extract semantic features from the positive sample data, negative sample data and original sample data; and use the semantic features from the positive sample data, negative sample data and original sample data to train the comparative Tranceformer neural network model.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images