Evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction

Abstract

The application discloses an evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction, and belongs to the cross field of network security and machine learning. The application generates simplified and complementary tasks through an improved dual-view dimension reduction method based on filtering and grouping methods, promotes the rapid identification of promising areas in a high-dimensional search space, and maintains feature subsets with the same performance and provides convergence guidance through a multi-task optimization mechanism based on dual archives, so that the balance between convergence and diversity among tasks is achieved, equivalent feature subsets with high intrusion detection accuracy and fewer feature numbers are searched, the accuracy and training efficiency are improved, and the model is provided with diverse and more interpretable decision support. The application can quickly search for Pareto optimal feature subsets with the same performance but different features in a high-dimensional feature space, provide more flexible and diverse choices for decision makers, and improve the accuracy of intrusion detection and reduce the model training time.

Description

TECHNICAL FIELD

[0001] The application belongs to the cross field of network security and machine learning, and particularly relates to an evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction. BACKGROUND

[0002] Under the background of deepening digital transformation and rapid development of network, network security has become a key field to protect enterprise development and personal privacy. With the rapid evolution of computer technology and communication technology, network attacks show the characteristics of multiple types, rapid variation and strong concealment. The growing network traffic and diverse access methods make network security problems more complex. Network intrusion detection identifies and prevents unauthorized access, attacks or malicious activities by analyzing abnormal behaviors and potential security threats in network traffic, which is a common network security defense technology. However, traditional network intrusion detection methods are prone to fall into the problem of "dimension disaster" when facing the growing data dimension, which leads to the decline of detection accuracy and the sharp increase of computational complexity. The root cause of the problem is that the feature model of data is not suitable. Feature selection, as one of the hottest data preprocessing techniques, can reduce the dimension of data by deleting redundant and irrelevant features from the original data set to construct a feature subset with stronger discrimination ability. Feature selection technology not only can reduce the computational consumption, but also can avoid model overfitting, improve classification performance, and at the same time preserve the original semantics of features, which provides important support for building more interpretable models.

[0003] Traditional feature selection methods, such as variance selection, forward search and recursive feature elimination, are difficult to find the optimal feature subset and provide diverse selection because of ignoring the interaction between features. Evolutionary computation methods, such as particle swarm optimization and genetic algorithm, have been widely used in feature selection due to their strong global search ability and independence on prior knowledge. However, the increase of dataset dimension leads to exponential growth of search space, and traditional evolutionary-based feature selection methods face the problem of insufficient search ability and long convergence time. Song et al. proposed a variable-size cooperative coevolutionary particle swarm optimization algorithm for high-dimensional feature selection, which divides the large-scale search space into multiple low-dimensional subspaces by grouping feature importance, and dynamically allocates resources according to convergence and diversity during the evolution process (Song X F, Zhang Y, Guo Y N, et al. Variable-size cooperative coevolutionary particle swarm optimization for feature selection on high-dimensional data[J]. IEEE Transactions on Evolutionary Computation, 2020, 24(5): 882-895.). This method does not consider the interaction between features in different groups, resulting in the obtained feature subset not achieving optimal performance and only searching for a single optimal feature subset. In reality, the difficulty and cost of obtaining each feature are different, so it is necessary to search for multiple feature subsets with the same classification performance to provide more diverse choices for decision-makers. Jiao et al. proposed a multi-form framework to enhance the search ability of multi-objective tasks using variable direction single-objective tasks (Jiao R, Xue B, Zhang M. Benefiting from single-objective feature selection to multiobjective feature selection: a multiform approach[J]. IEEE Transactions on Cybernetics, 2022, 53(12): 7773-7786.). This method takes a long time to search on high-dimensional datasets, and the classification performance of the obtained feature subset needs to be improved.To explore the search space more comprehensively, Xu et al. utilized the idea of forward and backward search, one sub-population was initialized with fewer features, while the other population was initialized to select more features, and the two sub-populations exchanged information during the evolution process to speed up the search, and finally merged into one population (Xu H, Xue B, Zhang M. A Bi-Search Evolutionary Algorithm for High-Dimensional Bi-Objective Feature Selection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2024. 8(5):3489-3502.). However, there is an overlap between the sub-populations during the evolution process, which may lead to waste of evaluation resources. These studies have made some progress, but still face two challenges: 1) how to efficiently and comprehensively search in high-dimensional search space; 2) how to obtain multiple equivalent feature subsets to provide decision makers with diverse options.

[0004] To solve the above problems, the present application provides an evolutionary multi-task intrusion detection feature selection method based on double-view dimension reduction, which constructs multi-task through double-view dimension reduction method to speed up the exploration in high-dimensional search space, and further improves the convergence and diversity by combining the multi-task optimization mechanism based on double archives, so as to search for multiple equivalent feature subsets with high intrusion detection accuracy and fewer features, improve the accuracy and training efficiency, and provide diverse and more interpretable decision support for the model. SUMMARY

[0005] The present application aims to provide an evolutionary multi-task intrusion detection feature selection method based on double-view dimension reduction to solve the above challenges, which generates simplified and complementary tasks through an improved double-view dimension reduction method based on filtering and grouping method, promotes the rapid identification of promising areas in high-dimensional search space, and maintains feature subsets with the same performance and provides convergence guidance through a multi-task optimization mechanism based on double archives, balances the convergence and diversity between tasks, and enhances the ability to search for multiple equivalent feature subsets. This method can quickly search for feature subsets with the same performance but different selected features in high-dimensional search space, improve the accuracy of intrusion detection and reduce the computational cost, while providing diverse and more interpretable decision support.

[0006] Technical scheme of the present application:

[0007] An evolutionary multi-task intrusion detection feature selection method based on double-view dimension reduction, the steps are as follows:

[0008] Step 1: data preprocessing and division: obtain network intrusion traffic dataset, and perform data preprocessing; then divide it into training set and test set in proportion;

[0009] Further, the data preprocessing includes missing value filling, character type to numerical type, data alignment and data standardization.

[0010] Further, the data standardization adopts Z-score standardization method, and the calculation formula is as follows:

[0011]

[0012] Wherein, X ij is the jth feature of the ith network connection record of the dataset, 1≤i≤n, 1≤j≤D, n is the total number of network connection records, D is the number of features, AVG j is the mean of the jth feature, STD j is the standard deviation of the jth feature, X ij ′ is the standardized data.

[0013] Step 2: perform double-view dimension reduction method on the original data features on the training set to construct multi-task, so as to obtain two simplified initial tasks T f and T g , and initialize population and evaluate and initialize archive;

[0014] Define the concept of individual (decision variable), which corresponds to the encoding value vector of data feature. The individual adopts binary feature encoding. The decision variable bit is 1, which means that the feature is selected, and the decision variable bit is 0, which means that the feature is not selected;

[0015] Step 2.1: obtain task T f based on filtering method,

[0016] First, use the ReliefF algorithm to calculate the weight value of each feature, randomly sample a network connection record R r , H l is the nearest L network connection records selected from the network connection records of the same class as R r , M l (c) is the nearest L network connection records selected from the samples of different class c from R r , and the calculation formula of the weight value W j of the jth feature is as follows:

[0017]

[0018] Wherein, the algorithm randomly samples M times, 1≤m≤M, ∑ represents the summation symbol, and class(Rr ) represents network connection record R r The categories, p(c) and p(class(R) r )) represent category c and network connection record R, respectively. r The proportion of each category, diff(j,S1,S2) represents the difference between the values ​​of the j-th feature in network connection records S1 and S2, calculated by the following formula:

[0019] diff(j,S1,S2)=|S1(j)-S2(j)| / (max(j)-min(j)) (3)

[0020] Where |S1(j)-S2(j)| represents the absolute value of the difference between the j-th feature values ​​of the two network connection records S1 and S2, max(j) refers to the maximum value of the j-th feature value, and min(j) refers to the minimum value.

[0021] Then, the features are sorted in descending order of their weight values. An inflection point selection method is used (a weight curve is created; the line connecting the maximum and minimum weight values ​​is the extreme value line, and the point farthest from the extreme value line is the inflection point). The weight value of the inflection point is used as a threshold for filtering features; features below this threshold are deleted, thus obtaining a selection containing D. f Task T with 1 feature f ;

[0022] Step 2.2: Obtain task T based on grouping method g ,

[0023] The maximum information coefficient (MIC) method was used to calculate the correlation coefficient (MIC) between all features and category labels. c The calculation steps are as follows:

[0024] First, the original two-dimensional space G is divided into multiple a×b grids, denoted as G| g The mutual information (MI) value for each grid cell is calculated using the following formula:

[0025] MI(X,Y)=H(X)+H(Y)-H(X,Y) (4)

[0026] Where X represents the feature, Y represents the category label, H(X,Y)=H(X|Y)+H(Y)=H(Y|X)+H(X), H(X) and H(X) are the entropies of X and Y respectively, and H(X|Y) and H(Y|X) represent the conditional entropy;

[0027] Then determine G| g The maximum MI value in G is denoted as maxMI(G| g The maximum MI value is normalized using the following formula:

[0028]

[0029] where M(G) a,b is a feature matrix storing the maximum normalized MI value in a a x b grid, and log min{a,b} represents taking the logarithm of the minimum of a and b;

[0030] Finally, the maximum value of M(G) a,b is selected as the value of MIC, which is given by:

[0031]

[0032] where B(n t ) = n t 0.6 is the upper bound of the grid size, and n t is the number of network connection records in the training set.

[0033] Then, based on the correlation MIC c , the features are divided into m groups by the K-Means clustering method, so that each group of features shows similar correlation with the class. The feature f b with the highest correlation, i.e., the most important feature, in each group is selected as the reference feature, and the correlation MIC b between f f and other features in the same group is calculated. If the correlation between features f and f b exceeds the correlation between feature f and the label, i.e., MIC f > MIC c , it means that feature f is redundant to the reference feature f b , and feature f will be reassigned to a different group. This process will obtain a task T g containing D g groups of features, each group of features is either selected or not selected simultaneously.

[0034] Step 2.3: Population initialization and evaluation and archive initialization:

[0035] First, initialize the population P f of task t f and the population P g of task T g , each population has N individuals, the specific implementation process is as follows:

[0036] For task T f , use the initialization method based on opposite learning (OBL), i.e., randomly initialize N / 2 individuals and their opposite individuals, obtain a population P f of size N, their selected features are completely opposite. For individuals X = {x1, x2, …, xD}, its opposite individual is completely determined by X:

[0037]

[0038] where a j and b j are the maximum and minimum values of the jth feature, respectively, and x j represents the jth feature value of the individual;

[0039] For task T g , randomly initialize N individuals to obtain the population P g ;

[0040] Next, calculate the following two optimization objective function values to evaluate the individuals in the population, and set the current iteration number t = 1. The first objective function is the feature selection ratio, which is calculated as follows:

[0041]

[0042] where the individual is represented as X = {x1, x2, …, x D}, x j represents the selection of the jth feature, x j = 1 indicates that the current individual selects the feature, and x j = 0 indicates that it is not selected;

[0043] The second objective is the classification error rate. First, use the features selected by the individual X to extract the data on the training set for training a random forest classification model, and obtain the classification error rate of the feature subset X according to the classification results of the model, which is calculated as follows:

[0044]

[0045] where TP, TN, FP, and FN represent the number of true positive samples, true negative samples, false positive samples, and false negative samples identified by the classification model, respectively;

[0046] Next, initialize the convergence archive A c and the diversity archive A d , which are implemented as follows:

[0047] First, obtain the joint population Pop = P f ∪ P g , then get the individual with the lowest classification error rate in Pop, and perform fast non-dominated sorting on Pop to obtain non-dominated individuals, which are added to the convergence archive A c . The diversity archive A d is initially an empty set.

[0048] Step 3: Perform double archive based evolutionary multitask optimization to obtain a set of Pareto optimal feature subsets PS;

[0049] Step 3.1: Offspring generation: for each task, the population P initialized in step 2 f and P g respectively form the mating pool, and offspring O c and O d are generated by crossover and mutation evolutionary operations respectively; f and O g ;

[0050] Step 3.2: Detect and remove individuals with duplicate decision vectors (i.e. select the same features) in offspring O f and O g , then for task T f and task T g , respectively, sort the features in descending order using the weight value W i and the correlation MIC c calculated in step 2, and randomly select h features from the top 50% features to generate new individuals, where h is a random number in [4, 3N], N is the number of population individuals, remove individuals with duplicate decision vectors from offspring O f and O g , and add the generated new individuals to obtain O f ′ and O g ′;

[0051] Step 3.3: Offspring evaluation: using the same evaluation method as in step 2, calculate the two objective values of offspring O f ′ and O g ′ according to formulas (8) and (9);

[0052] Step 3.4: Perform target value duplicate solution processing and environment selection for task T f and task T g respectively, and obtain the next generation populations P f ′, P g ′ and target value duplicate individuals P dup1 , P dup2 , the specific implementation process is as follows:

[0053] For task T f , process the target value duplicate solution: obtain the joint population Pop = P f ∪O f and find the set of duplicate solution individuals with the same target value P dup1 0 , calculate P dup1 0the Manhattan distance between individuals, remove the two individuals with the largest distance from the set P dup1 0 , and obtain P dup1 , remove the duplicate solution set P from the union population Pop dup , obtain Pop' = Pop\P dup1 , where \ denotes the difference set of sets; then use the population P obtained in step 2.3 f , the objective value and the offspring O obtained in step 3.3 f , perform environmental selection of the genetic algorithm NSGA-II on the objective value of P f , and obtain the next generation population P g ; similarly, perform the objective duplicate solution processing and environmental selection method on the task T g , and obtain the next generation population P dup2 and the objective value duplicate individual P

[0054] Step 3.5: update the convergence archive A c and the diversity archive A d : first obtain the union population Pop' = P f ' U P g ', then obtain the individual with the lowest classification error rate in Pop', and perform fast non-dominated sorting on Pop' to obtain non-dominated individuals, and record the individual with the lowest classification error rate and the non-dominated individuals as P elite , and add them to the convergence archive, that is, A c ' = A c U P elite , where U denotes the union set operation, and then perform fast non-dominated sorting on A c ' to obtain non-dominated individuals and the individual with the lowest classification error rate, and the non-dominated individuals and the individual with the lowest classification error rate are taken as the updated convergence archive A c ";

[0055] Step 3.6: obtain the dominated solution P dom in the convergence archive update process = A c ' \ A c ", where \ denotes the difference set of sets, and add the dominated solution P dom and the duplicate solutions P dup1 , P dup obtained in step 3.4 to the diversity archive to obtain the updated diversity archive A d ' = A d U P dup1 U P dup2 U P dom ; determine whether the number of individuals in the diversity archive exceeds the maximum number of individuals N Athe environmental selection process of NSGA-II is executed to select N A individuals.

[0056] Step 3.7: set the current iteration number t = t + 1, and judge whether t % a is 0, wherein a is the group refinement algebra of task T g , % represents the remainder of t divided by a, if yes, the group refinement of task T g is executed, otherwise, the next loop is entered.

[0057] The group refinement of task T g is implemented as follows: each group of features is randomly and uniformly divided into two groups of the same size, obtaining 2D g feature groups; the two groups obtained after the division of the selected feature group before refinement are also selected, and vice versa, and the individuals in the population P g , the convergence archive A c and the diversity archive A d are updated to the new feature group representation.

[0058] The above process is executed in a loop until the current iteration number t exceeds the preset maximum iteration number maxT, and the fast non-dominated sorting is performed on all archives and populations to obtain the Pareto optimal feature subset PS and output.

[0059] Step 4: select the final feature subset from the Pareto optimal feature subset PS obtained in step 3 according to the decision preference, extract the corresponding training set data and train the intrusion detection model.

[0060] Step 5: use the model obtained by training in step 4 to perform intrusion detection on the test set divided in step 1 and output the result.

[0061] Compared with the prior art, the present application has the following advantages:

[0062] The proposed evolutionary multi-task optimization algorithm can quickly search for feature subsets and exhibit strong global search capability. By balancing population diversity and convergence, the algorithm can obtain multiple solutions with excellent classification performance and fewer feature selections, providing decision makers with diverse choices. This diversity not only allows decision makers to select the most suitable feature subset according to specific needs, but also enables flexible adjustment in different application scenarios, improving the adaptability of the model. By removing irrelevant and redundant features, applying the selected optimal feature subset to model training can effectively shorten the training time of the model and reduce the consumption of computing resources, enabling the intrusion detection system to respond more quickly to potential threats. By focusing on features with the most information, the model can better capture important patterns in the data, thereby improving the accuracy of intrusion detection and providing more reliable protection for network security. BRIEF DESCRIPTION OF DRAWINGS

[0063] Figure 1 is the overall flowchart of the present application;

[0064] Figure 2 is a schematic diagram of an evolutionary multi-task feature selection method based on double-view dimension reduction provided by the present application;

[0065] Figure 3 is a multi-task evolutionary optimization flowchart based on double archives provided by the present application. DETAILED DESCRIPTION

[0066] The present application will be further described below in combination with the drawings and specific embodiments, and the present application includes but is not limited to the following embodiments.

[0067] Figure 1 The overall flowchart of the present application is shown, which is specifically divided into five steps of data preprocessing and division, performing double-view dimension reduction method to construct multi-task, performing evolutionary multi-task optimization based on double archives, selecting feature subset according to decision preference and training classification model, and verifying model performance on test set:

[0068] 1. Data preprocessing and division

[0069] The network intrusion flow dataset NSL-KDD is obtained, and data preprocessing is performed thereon, including missing value filling, character type conversion to numerical type, data alignment and data standardization; the specific implementation process of data standardization is as follows:

[0070] Further, the Z-score standardization method is used for data standardization, and the calculation formula is as follows:

[0071]

[0072] wherein, X ij is the jth feature of the ith network connection record of the dataset, 1≤i≤n, 1≤j≤D, n is the total number of network connection records, D is the number of features, AVG j is the mean of the jth feature, STD j is the standard deviation of the jth feature, X ij ′ is the standardized data.

[0073] Then, 70% of the preprocessed dataset is divided into a training set, and 30% is divided into a test set; next, feature selection is performed, Figure 2 A schematic diagram of an evolutionary multi-task feature selection method based on double-view dimension reduction provided by the present application is shown. The concept of individual (decision variable) is defined, and the encoding value vector X={x1, x2, …, x D}, where D represents the feature dimension of the dataset. Individuals are encoded using binary features; a decision variable bit of 1 indicates that the feature is selected, and 0 indicates that the feature is not selected. In this embodiment, the population size N is set to 42, and the maximum number of individuals in the archive is N. A Set to 42, the maximum number of iterations maxT is set to 50, the grouping refinement algebra α is set to 10, and the initial number of feature groups m is set to 5*log2D;

[0074] 2. Perform a dual-view dimensionality reduction method to construct multiple tasks: Perform a dual-view dimensionality reduction method on the original data features to construct multiple tasks, thereby obtaining two simplified initial tasks T. f and T g And perform population initialization and evaluation, as well as file initialization;

[0075] Step 2.1: Obtain task T based on filtering method f First, the ReliefF algorithm is used to calculate the weight value of each feature, and then a network connection record R is randomly sampled. r H l From R r The most recent L network connection records selected from the same category, M l (c) is from R r The L nearest network connection records selected from samples of different class c, and the weight value W of the j-th feature. j The calculation formula is as follows:

[0076]

[0077] The algorithm performs M random samplings, where 1 ≤ m ≤ M, ∑ represents the summation symbol, and class(R) r ) represents network connection record R r The categories, p(c) and p(class(R) r )) represent category c and network connection record R, respectively. r The proportion of each category, diff(j,S1,S2) represents the difference between the values ​​of the j-th feature in network connection records S1 and S2, calculated by the following formula:

[0078] diff(j,S1,S2)=|S1(j)-S2(j)| / (max(j)-min(j)) (3)

[0079] Where |S1(j)-S2(j)| represents the absolute value of the difference between the j-th feature values ​​of the two network connection records S1 and S2, max(j) refers to the maximum value of the j-th feature value, and min(j) refers to the minimum value.

[0080] Then the features are arranged in descending order according to their weight values, the inflection point selection method (create a weight curve, the line connecting the maximum and minimum weight values is the extreme value line, and the point farthest from the extreme value line is the inflection point) is used, and the weight value of the inflection point is used as the threshold for screening features, and features below the threshold are deleted, thereby obtaining a task T f containing D f features.

[0081] Step 2.2: Obtain task T g based on the grouping method, calculate the correlation MIC between all features and the category label using the maximum information coefficient (MIC) method c , the calculation steps are as follows:

[0082] First, divide the original two-dimensional space G into a plurality of a x b grids, denoted as G g , calculate the mutual information (MI) value of each grid, the formula is as follows:

[0083] MI(X,Y) = H(X) + H(Y) - H(X,Y) (4)

[0084] Where X represents a feature, Y represents a category label, H(X,Y) = H(X|Y) + H(Y) = H(Y|X) + H(X), H(X) and H(X) are the entropies of X and Y, respectively, and H(X|Y) and H(Y|X) represent conditional entropy.

[0085] Then determine the maximum MI value in G g , denoted as maxMI(G g ), and normalize the maximum MI value using the following formula:

[0086]

[0087] Where M(G) a,b is a feature matrix that stores the maximum normalized MI value in the a x b grid, and long min{a,b} represents taking the logarithm of the minimum value of a and b.

[0088] Finally, select the maximum value of M(G) a,b as the value of MIC, the formula is as follows:

[0089]

[0090] Where B(n t ) = n t 0.6 is the upper limit of the grid size, and n t is the number of network connection records in the training set.

[0091] Then, based on the correlation MIC cThe features are divided into m groups by K-Means clustering method, so that each group of features shows similar correlation with the category; select the most important feature f in each group b As a reference feature, calculate f b The correlation MIC between the feature f and other features in the same group f If the correlation between the feature f and f b is higher than the correlation between the feature f and the label, that is, MIC f > MIC c , it means that the feature f may be redundant for the reference feature f b , then the feature f will be reassigned to a different group; this process will obtain the task T g containing D g groups of features, each group of features is either selected or not selected at the same time.

[0092] Step 2.3: Population initialization and evaluation and archive initialization:

[0093] First, initialize the population P f of the task T f and the population P g of the task T g , each population has N individuals, the specific implementation process is as follows:

[0094] For the task T f , use the initialization method based on opposite learning (OBL), that is, randomly initialize N / 2 individuals and their opposite individuals to obtain a population P f of size N, their selected features are completely opposite. For the individual X = {x1, x2, …, x D} in the D-dimensional search space, its opposite individual is completely determined by X:

[0095]

[0096] Where a j and b j are the maximum and minimum values of the jth feature, respectively, and x j represents the jth feature value of the individual; for the task T g , randomly initialize N individuals to obtain the population P g ;

[0097] Next, calculate the following two optimization objective function values to evaluate the individuals in the population, and set the current iteration number t = 1. The first objective function is the feature selection ratio, which is calculated as follows:

[0098]

[0099] where X = {x1, x2,..., x D} represents an individual, x j represents the selection of the jth feature, x j = 1 means that the current individual selects the feature, and x j = 0 means that the feature is not selected;

[0100] The second objective is the classification error rate. First, the data on the training set is extracted using the features selected by the individual X, which is used to train the random forest classification model. According to the classification results of the model, the classification error rate of the feature subset X is obtained, and the calculation formula is as follows:

[0101]

[0102] where TP, TN, FP, and FN represent the number of true positive samples, true negative samples, false positive samples, and false negative samples identified by the classification model, respectively;

[0103] Next, the convergence archive A c and the diversity archive A d are initialized, and the implementation process is as follows:

[0104] First, the joint population Pop = P f ∪ P g is obtained, and then the individual with the lowest classification error rate in Pop is obtained, and the fast non-dominated sorting of Pop is performed to obtain non-dominated individuals, which are added to the convergence archive A c . The diversity archive A d is initially empty.

[0105] Step 3: Perform dual archive-based evolutionary multi-task optimization to obtain a set of Pareto optimal feature subsets PS;

[0106] Step 3.1: Offspring generation: the population P f and P g initialized in step 2 are each paired with the two archives A c and A d to form a mating pool, and evolutionary operations such as crossover and mutation are used to generate offspring O f and O g ;

[0107] Step 3.2: Detect and delete individuals with repeated decision vectors (i.e., selecting the same features) in the offspring O f and O g , and then for task T f and task T g , use the weight values W i and the correlation MIC cSort the features in descending order, randomly select h features from the top 50% features to generate new individuals, where h is a random number in [4, 3N], N is the number of population individuals, from offspring O f and O g Delete individuals with duplicate decision vectors, and add new individuals generated to obtain O f and O g ';

[0108] Step 3.3: offspring evaluation: using the same evaluation method as in step 2, calculate the two objective values of offspring O f and O g ' according to formulas (8) and (9);

[0109] Step 3.4: perform target duplicate solution processing and environment selection of task T f and task T g respectively, to obtain the next generation population P f ', P g ' and target value duplicate individuals P dup1 , P dup2 , the specific implementation process is as follows:

[0110] For task T f , process the target value duplicate solution: obtain the joint population Pop = P f ∪ O f and find the set of duplicate solution individuals P dup1 0 , calculate the Manhattan distance between individuals in P dup 0 , remove the two individuals with the largest distance from the set P dup1 0 to obtain P dup1 , remove the duplicate solution set P dup from the joint population Pop to obtain Pop ′ = Pop\P dup1 , where \ means taking the difference set of the set; the target value of the population P f obtained in step 2.3 and the target value of the offspring O f ' obtained in step 3.3 perform environment selection of the classic genetic algorithm NSGA-II to obtain the next generation population P f '; similarly, perform the target duplicate solution processing and environment selection method of this step for task T g to obtain the next generation population P g ' and target value duplicate individuals P dup ;

[0111] Step 3.5: update the convergence archive A c and the diversity archive A dFirstly, the union population Pop' = P f ∪ P g is obtained, and then the individual with the lowest classification error rate in Pop' is obtained, and fast non-dominated sorting is performed on Pop' to obtain non-dominated individuals, and the individual with the lowest classification error rate and the non-dominated individuals are recorded as P elite , and are added to the convergence archive, that is, A c ' = A c ∪ P elite , where ∪ indicates a set union operation, and fast non-dominated sorting is performed on A c ' to obtain non-dominated individuals and the individual with the lowest classification error rate, and the non-dominated individuals and the individual with the lowest classification error rate are taken as the updated convergence archive A c ";

[0112] Step 3.6: Obtain the dominated solution P dom = A c ' \ A c ", where \ indicates a set difference operation, and the dominated solution P dom and the repeated solution P dup obtained in step 3.4 are added to the diversity archive to obtain the updated diversity archive A dup ' = A d ∪ P d ∪ P dup1 ∪ P dup2 ∪ P dom ; it is judged whether the number of individuals in the diversity archive exceeds the limit of the maximum number of individuals N A , and if so, the environmental selection process of NSGA-II is performed to select N A individuals.

[0113] Step 3.7: Set the current iteration number t = t + 1, and judge whether t % a is 0, where a is the grouping refinement generation number of task T g , and % indicates that t is taken modulo a, and if so, the grouping refinement of task T g is performed, otherwise the next loop is entered.

[0114] The grouping refinement of task T g is implemented as follows: each group of features is randomly and uniformly divided into two groups of the same size to obtain 2D g feature groups; the two groups obtained after the division of the selected feature group before refinement are also selected, and vice versa, and in this way, the individuals in the population P g , the convergence archive A c and the diversity archive A d are updated to new feature group representations.

[0115] The above process is cycled until the current iteration number t exceeds the preset maximum iteration number maxT, the fast non-dominated sorting is performed on all archives and populations, the Pareto optimal feature subset PS is obtained and output.

[0116] 4. Selecting a feature subset according to decision preferences and training a classification model

[0117] In this embodiment, the feature subset with the lowest training classification error rate is selected from the PS obtained in step 3, the corresponding data in the training set is extracted as input to train the random forest classifier classification model according to the selected features of the feature subset, according to the parameter tuning experiment, the number of trees in the random forest is set to 100, the maximum depth of the tree is set to 15, and the feature evaluation standard is set to be based on the gini index;

[0118] 5. Verifying the model performance on the test set

[0119] The model obtained by training in step 4 is used for intrusion detection on the test set divided in step 1, and the result is output. The evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction proposed in the present application optimizes the feature subset with low classification error rate and fewer features, realizes efficient intrusion detection model training, and improves the detection accuracy.

[0120] In summary, the present application discloses an evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction. The present application utilizes the advantages of the evolutionary multi-task paradigm, constructs a dual-view dimension reduction task to reduce the search space, further improves the search efficiency based on dual-archives knowledge transfer, designs a diversity maintenance mechanism and a convergence guided grouping refinement mechanism, and realizes the balance between diversity and convergence. Efficient search obtains a diverse feature subset, providing flexible selection for decision makers, removing redundant and irrelevant features while maintaining excellent classification performance, effectively shortening the model training time and improving the intrusion detection accuracy.

[0121] The above content only illustrates the technical idea of the present application, and cannot limit the protection scope of the present application. Any modification made according to the technical idea of the present application on the basis of the technical solution falls within the protection scope of the claims of the present application.

Claims

1. An evolutionary multi-task intrusion detection feature selection method based on dual-view dimension reduction, characterized in that, The steps are as follows: Step 1: data preprocessing and division: obtaining network intrusion flow data set, carrying out data preprocessing; then dividing it into training set and test set according to proportion; Step 2: Perform the dual-view dimension reduction method on the original data features on the training set to build multi-tasks to obtain two simplified initial tasks and and population initialization and evaluation and archive initialization; The step 2 is specifically: The concept of individual is defined, the coding value vector corresponding to the data characteristics is adopted, the individual adopts binary feature coding, the decision variable bit is 1, which indicates that the feature is selected, and 0 indicates that the feature is not selected; Step 2.1: Obtaining tasks based on filtering , First, the weight value of each feature is calculated using the ReliefF algorithm, and a network connection record is randomly sampled ; Then the features are arranged in descending order of their weight values, and the inflection point selection method is used, with the weight value of the inflection point as the threshold for screening features, and features below the threshold are deleted, thereby obtaining a task containing features Step 2.2: Obtaining tasks based on grouping method , Calculate the correlation between all features and the class label using the maximal information coefficient MIC method Then, based on the correlation Group the features into groups using the K-Means clustering method, so that each group of features shows similar correlation with the class label; select the feature with the highest correlation, i.e. the most important feature, in each group as the reference feature, calculate the correlation between and other features in the same group If the correlation between feature and is higher than the correlation between feature and the label, i.e. , it means that feature may be redundant to the reference feature , then feature will be reassigned to a different group; this process will obtain a task containing groups of features, each group of features is either selected or not selected simultaneously Step 2.3: population initialization and evaluation and archive initialization; Step 3: Perform dual archive based evolutionary multi-task optimization to obtain a set of Pareto-optimal feature subsets ; Step 4: Selecting a final subset of features from the pareto-optimal subset of features obtained in step 3 based on decision preferences from which a final subset of features is selected, the corresponding training set data is extracted and an intrusion detection model is trained; Step 5: using the model obtained by step 4 training to carry out intrusion detection on the test set divided in step 1 and output the result.

2. The method of claim 1, wherein the method is based on dual-view dimension reduction evolutionary multi-task intrusion detection feature selection. The data preprocessing includes missing value filling, character type conversion to numerical type, data alignment and data standardization.

3. The method of claim 2, wherein the method is based on dual-view dimension reduction evolutionary multi-task intrusion detection feature selection. The data standardization adopts Z-score standardization method, and the calculation formula is as follows: ； wherein, is the number of data sets, is the number of network connection records in the data set, is the number of features of the network connection record, , is the total number of network connection records, is the number of features, is the mean of the th feature, is the standard deviation of the th feature, is the standardized data.

4. The evolutionary multi-task intrusion detection feature selection method based on double-view dimension reduction according to claim 3, characterized in that, In step 2.1, From and The most recent one selected from the network connection records of the same category One network connection record, From and Different categories The nearest one selected from the samples The first network connection record. The weight values ​​of each feature The calculation formula is as follows: ； wherein the algorithm randomly samples subclasses, , denotes a summation symbol, denotes a network connection record of a class, and denotes the proportion of the class and the class of the network connection record , denotes the difference between the value of the th feature in the network connection record and is calculated by the following equation: ； in, represent and Two network connection records The absolute value of the difference between the eigenvalues. Refers to the first The maximum value of each eigenvalue. The minimum value; In step 2.2, The calculation steps are as follows: Firstly, the original two-dimensional space is divided into multiple grids, represented as , and the mutual information MI value of each grid is calculated, with the formula as follows: ； wherein, represents a feature, represents a class label, , and are and the entropy of and represent conditional entropies; The maximum MI value in the matrix is then determined, denoted as , and normalized using the following equation: ​ ； wherein, is a feature matrix storing the normalized MI values in the grid, denotes taking the logarithm of the minimum value in and . Finally, the maximum value of the selected is chosen as the value of the MIC, which is given by the formula ； wherein, is an upper limit on the grid size, is the number of network connection records in the training set; Step 2.3: the steps are as follows: First, initialize the tasks of the population and the tasks of the population , each population has individuals, the specific implementation process is as follows: For the task An initialization method based on opposite learning OBL is adopted, i.e. random initialization An individual and its opposite individual, a population of size is obtained Their selected features are completely opposite; for Individuals in a d-dimensional search space Its opposite individual Is completely determined by ​ ； wherein, and are the maximum and minimum values of the th feature, respectively, denotes the individual th feature value; For task , randomly initialize individuals to obtain a population ; Next, the following two optimization objective function values are calculated to evaluate individuals in the population, and the current iteration number is set ; the first objective function is the feature selection ratio, which is calculated as follows: ； wherein the individual is represented as , represents the selection of the bit feature, represents that the current individual has selected the bit feature, represents that it has not been selected;​ The second objective is the classification error rate, which is first computed for each individual The data on the selected feature extraction training set is used to train a random forest classification model, from which the classification results of this model are obtained for a feature subset The classification error rate of the feature subset, which is calculated as follows: ； wherein, , , and respectively represent the number of true positive samples, true negative samples, false positive samples and false negative samples identified by the classification model. Next, the convergence profile is initialized and the diversity profile is implemented as follows: First, the joint population is obtained Then, the individual with the lowest classification error rate in the population is obtained and the fast non-dominated sorting is performed to obtain the non-dominated individuals, which are added to the convergence archive The diversity archive is initially an empty set.

5. The method of claim 4, wherein the method is based on evolutionary multi-task feature selection with dual-view dimension reduction. Step 3 is specifically as follows: Step 3.1: Performing Progeny Generation: Populations of each task initialized in Step 2 and Each with two archives and Forming a mating pool, respectively generating progeny through evolutionary operations of crossover and mutation and ; Step 3.2: Detect and delete descendant species and Individuals with repeated decision vectors in the middle, then for the task and tasks Use the weight values ​​calculated in step 2 respectively. and relevance Sort the features in descending order, and randomly select from the top 50% of the features. A new individual is generated based on several features, among which... Is Random numbers between, It is the population size, from offspring and After removing individuals with duplicate decision vectors and adding the newly generated individuals, the result is obtained. and ; Step 3.3: Perform progeny evaluation: Using the same evaluation as in Step 2, calculate two target values for the progeny and ​​ Step 3.4: Perform tasks respectively and target value of the task Repeat the processing of the target and the environment selection to obtain the next generation population , and target value of the task , The specific implementation process is as follows: For task For example, handle target value duplicate solutions: obtain joint population And find a set of individuals with the same target value , calculate The Manhattan distance between individuals in Remove the two individuals with the largest distance from the set , get Remove the duplicate solution set from the joint population Obtain Where Indicates the difference set of the set; Then the population obtained in step 2.3 is used The target value and the offspring obtained in step 3.3 The genetic algorithm NSGA-II is executed on the target value and the environment selection of the population obtained in step 3.3 to obtain the next generation population The same is done for the task The target repeated solution processing and environment selection method of this step is executed to obtain the next generation population And the target value repeats the individual ; Step 3.5: Update the convergence archive and diversity archive : First, obtain the joint population , then obtain the individual with the lowest classification error rate in , and perform fast non-dominated sorting on to obtain non-dominated individuals, and record the individual with the lowest classification error rate and the non-dominated individuals as , and add them to the convergence archive, i.e. , where denotes the set union operation, and then perform fast non-dominated sorting on to obtain non-dominated individuals and the individual with the lowest classification error rate, and the non-dominated individuals and the individual with the lowest classification error rate are taken as the updated convergence archive ; Step 3.6: Obtain the dominated solution in the convergence archive update process where is the difference set of the collection of dominated solutions and the repeated solutions obtained in step 3.4 , is added to the diversity archive, and the updated diversity archive is obtained ; it is determined whether the number of individuals in the diversity archive exceeds the maximum number of individuals in the archive , if it exceeds, the environmental selection process of NSGA-II is executed to select individuals; Step 3.7: Set the current iteration number ,judge Is it 0, where It is a task Grouping refinement algebra, express right Take the remainder; if so, execute the task. The grouping is refined; otherwise, proceed to the next loop. Task The packet refinement process is implemented as follows: each feature group is randomly and uniformly divided into two groups of equal size, resulting in feature groups; the two groups resulting from the division of the selected feature group before refinement are also selected, and vice versa, and the population , convergence profile and diversity profile is updated to the new feature group representation; The above process is looped until the current iteration number exceeds the preset maximum iteration number , and the fast non-dominated sorting is performed for all archives and populations to obtain a Pareto optimal feature subset and output.

Images