Network intrusion detection method, system, terminal and storage medium

Abstract

The present invention provides a network intrusion detection method, system, terminal, and storage medium. The method comprises: determining a target sampling strategy based on the number of samples of preprocessed data; sampling the preprocessed data according to the target sampling strategy to obtain sampled samples; inputting the sampled samples into a network intrusion detection model for feature extraction, deep information extraction, and multi-head attention mechanism calculation to obtain a global feature vector; predicting the data type based on the global feature vector, and calculating the model loss based on a weighted balance loss function with dynamic adjustment of the number of categories; training the network intrusion detection model based on the model loss; and inputting the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain network intrusion detection results. In an embodiment of the present invention, stratified sampling is used to sample the preprocessed data, effectively preventing imbalance in sample data categories.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method, system, terminal and storage medium. Background Art

[0002] With the widespread use of the internet, network security issues are becoming more frequent, and the topic of network information and communication security is receiving increasing attention. Network intrusions are a serious threat to network security, not only causing personal information leakage and financial loss, but also posing a threat to the security and stability of an entire country. Therefore, to improve network security and protect sensitive information and network services from attacks, network intrusion detection is receiving increasing attention.

[0003] In the existing network intrusion detection process, network intrusion detection models are generally used for network intrusion detection. However, the sample data categories of the existing network intrusion detection models are unbalanced, which reduces the accuracy of the trained network intrusion detection models and leads to low network intrusion detection accuracy. Summary of the Invention

[0004] The purpose of the embodiments of the present invention is to provide a network intrusion detection method, system, terminal and storage medium to solve the problem of low accuracy of network intrusion detection in the prior art.

[0005] The embodiment of the present invention is implemented as follows: a network intrusion detection method, the method comprising:

[0006] Acquiring a network data set, and preprocessing the network data set to obtain preprocessed data;

[0007] Determining a target sampling strategy according to the sample quantity of the preprocessed data, and sampling the preprocessed data according to the target sampling strategy to obtain sampled samples;

[0008] Inputting the sampled samples into a network intrusion detection model for feature extraction to obtain long-term dependency features;

[0009] Performing deep information extraction on the long-term dependency features to obtain a hidden state sequence, and performing multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector;

[0010] Predicting the data type based on the global feature vector to obtain a sample prediction value, and calculating the model loss based on the sample prediction value and a weight balance loss function that is dynamically adjusted based on the number of categories;

[0011] Updating parameters of the network intrusion detection model according to the model loss until the network intrusion detection model converges;

[0012] The network data to be detected is input into the converged network intrusion detection model to perform intrusion detection and obtain a network intrusion detection result.

[0013] Preferably, sampling the preprocessed data according to the target sampling strategy to obtain a sample includes:

[0014] If the target sampling strategy is the first preset strategy, calculating the data similarity between different sample data in the preprocessed data;

[0015] Determine the neighboring samples corresponding to the sample data according to the data similarity, and determine the number of category differences of the sample data according to the neighboring samples;

[0016] Deleting samples from the sample data according to the number of category differences until a preset iteration condition is met to obtain the sampling sample;

[0017] If the target sampling strategy is the second preset strategy, determining majority class samples and minority class samples according to the sample categories of the neighboring samples, and determining boundary samples in the sample data according to the sample numbers of the majority class samples and the minority class samples;

[0018] The boundary samples and the corresponding minority class samples are synthesized to obtain synthesized samples, and the synthesized samples are undersampled to obtain the sampled samples.

[0019] Preferably, sampling the preprocessed data according to the target sampling strategy to obtain a sampled sample further includes:

[0020] If the target sampling strategy is the third preset strategy, extracting data features of the sample data, and normalizing the data features to obtain normalized features;

[0021] Extracting the sample data to obtain sample pairs, calculating synthetic features of the sample pairs based on the normalized features, and determining synthetic labels based on data labels of the sample data in the sample pairs;

[0022] The sampling sample is generated according to the synthetic feature and the synthetic label.

[0023] Preferably, the sampled samples are input into a network intrusion detection model for feature extraction to obtain long-term dependency features, including:

[0024] Performing dilated causal convolution on the sampled samples according to the network intrusion detection model to obtain convolution features, and performing nonlinear transformation on the convolution features to obtain transformation features;

[0025] Regularizing the transformed features to obtain generalized features, and performing residual connection processing on the generalized features to obtain residual features;

[0026] The residual features are processed by a channel attention mechanism to obtain the long-term dependency features.

[0027] Preferably, deep information extraction is performed on the long-term dependency features to obtain a hidden state sequence, including:

[0028] Inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model respectively to update the state, thereby obtaining a forward hidden layer state and a reverse hidden layer state;

[0029] Concatenating the forward hidden layer state and the reverse hidden layer state to obtain the hidden state sequence;

[0030] The formulas used for inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model for state update include:

[0031] =(1- z t )* h t-1 + z t *

[0032] =(1- r t )* h t-1 + r t *

[0033] is the forward hidden layer state at the current moment, is a candidate hidden state, z t is the output of the update gate, is the reverse hidden layer state at the current moment, r t is the output of the reset gate.

[0034] Preferably, a multi-head attention mechanism is performed on the hidden state sequence to obtain a global feature vector, including:

[0035] A linear transformation is performed on the hidden state sequence to obtain a query, a key, and a value, and a scaled dot product attention calculation is performed on the query, the key, and the value to obtain the global feature vector.

[0036] Preferably, the weight balance loss function that is dynamically adjusted based on the number of categories is:

[0037]

[0038] in, L is the model loss, w i is the dynamic class weight, N is the number of categories of the sample category, y i It is i The true label of the sampled sample is i The sample prediction value corresponding to each of the sampling samples;

[0039]

[0040] in, f i For the i The number of categories for each category, γ is a hyperparameter.

[0041] Another object of an embodiment of the present invention is to provide a network intrusion detection system, the system comprising:

[0042] A preprocessing module is used to obtain a network data set and preprocess the network data set to obtain preprocessed data;

[0043] a sampling module, configured to determine a target sampling strategy according to the number of samples of the preprocessed data, and sample the preprocessed data according to the target sampling strategy to obtain sampled samples;

[0044] A feature extraction module is used to input the sampled samples into a network intrusion detection model for feature extraction to obtain long-term dependency features;

[0045] An attention calculation module is used to perform deep information extraction on the long-term dependency features to obtain a hidden state sequence, and perform multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector;

[0046] A training module is configured to predict data types based on the global feature vector to obtain sample prediction values, and calculate model losses based on the sample prediction values ​​and a weighted balance loss function dynamically adjusted based on the number of categories; and update parameters of the network intrusion detection model based on the model loss until the network intrusion detection model converges;

[0047] The intrusion detection module is used to input the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain network intrusion detection results.

[0048] In the embodiment of the present invention, corresponding target sampling strategies are respectively set for preprocessed data with different sample quantities, and the preprocessed data is sampled by adopting a stratified sampling method, which effectively prevents the phenomenon of imbalance in sample data categories, improves the accuracy of the trained network intrusion detection model, and thus improves the accuracy of network intrusion detection. By performing multi-head attention mechanism calculation on the hidden state sequence, the features can be effectively dynamically weighted, thereby improving the generalization ability of the model in complex network environments and reducing the false alarm rate and missed alarm rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 is a flow chart of a network intrusion detection method provided by a first embodiment of the present invention;

[0050] Figure 2 1 is a schematic diagram of the framework of the improved TBA-Net model provided by the first embodiment of the present invention;

[0051] Figure 3 2 is a schematic diagram showing the comparison before and after improvement of the TCN residual module provided by the first embodiment of the present invention;

[0052] Figure 4 2 is a schematic diagram showing the comparison of sample sizes before and after stratified sampling of the training set provided by the first embodiment of the present invention;

[0053] Figure 5 Schematic diagram of indicators of various categories before and after data balancing provided by the first embodiment of the present invention;

[0054] Figure 6 1 is a schematic diagram of indicators of various categories before and after using DWB Loss provided by the first embodiment of the present invention;

[0055] Figure 7 is a schematic diagram of 30% of data randomly sampled from an initial data set provided by the first embodiment of the present invention;

[0056] Figure 8 Schematic diagram of various indicators of the improved TCN residual module provided by the first embodiment of the present invention;

[0057] Figure 9 is a schematic structural diagram of a network intrusion detection system provided by a second embodiment of the present invention;

[0058] Figure 10 It is a structural diagram of a terminal device provided by the third embodiment of the present invention. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0060] In order to illustrate the technical solution of the present invention, specific embodiments are provided below.

[0061] Example 1

[0062] See also Figures 1 to 3 , is a flow chart of a network intrusion detection method provided by a first embodiment of the present invention. The network intrusion detection method can be applied to any device or system. The network intrusion detection method includes the following steps:

[0063] Step S10, obtaining a network data set, and preprocessing the network data set to obtain preprocessed data;

[0064] The CICIDS-2017 initial dataset can be used as the network dataset. Preprocessing steps include cleaning, category merging, feature screening, character feature digitization, and data planning to generate a preprocessed dataset. To avoid excessive sample size and thus affecting training efficiency, the preprocessed dataset can be sampled using random sampling. The sampled preprocessed dataset can then be divided into training and test sets.

[0065] Step S20, determining a target sampling strategy according to the sample quantity of the preprocessed data, and sampling the preprocessed data according to the target sampling strategy to obtain sampled samples;

[0066] Among them, when the number of samples is greater than the first preset number, the preprocessed data is determined to be a large class sample, and the corresponding target sampling strategy is the first preset strategy; when the number of samples is between the second preset number and the first preset number, the preprocessed data is determined to be a smaller sample class, and the corresponding target sampling strategy is the second preset strategy; if the number of samples is less than the second preset number, the preprocessed data is determined to be a very small class sample, and the corresponding target sampling strategy is the third preset strategy. The first preset number and the second preset number can be set according to needs. In this step, the sample imbalance problem in the data set is solved by adopting a stratified sampling method.

[0067] Optionally, sampling the preprocessed data according to the target sampling strategy to obtain a sample includes:

[0068] If the target sampling strategy is the first preset strategy, calculating the data similarity between different sample data in the preprocessed data;

[0069] Among them, the data similarity between different sample data can be calculated by using the Euclidean distance formula;

[0070] Determine the neighboring samples corresponding to the sample data according to the data similarity, and determine the number of category differences of the sample data according to the neighboring samples;

[0071] Among them, the number of category differences is the number of neighboring samples of different categories from the sample data;

[0072] Deleting samples from the sample data according to the number of category differences until a preset iteration condition is met to obtain the sampling sample;

[0073] Among them, the Edited Nearest Neighbors (ENN) undersampling strategy is used to calculate the nearest neighbor samples and select noise samples for deletion according to the corresponding conditions. After multiple iterations, all samples are traversed until the proportion of deleted samples in two consecutive iterations is less than the threshold of 1% or the maximum number of iterations is 10, forming a balanced sampling sample;

[0074] If the target sampling strategy is the second preset strategy, determining majority class samples and minority class samples according to the sample categories of the neighboring samples, and determining boundary samples in the sample data according to the sample numbers of the majority class samples and the minority class samples;

[0075] Among them, if the target sampling strategy is the second preset strategy, then according to the sample category of the neighboring samples, the majority class samples and minority class samples in the neighboring samples corresponding to each sample data are determined respectively, and the boundary sampling strategy is used to determine the boundary samples in the sample data;

[0076] Synthesize the boundary sample and the corresponding minority class sample to obtain a synthesized sample, and undersample the synthesized sample to obtain the sampled sample;

[0077] After multiple iterations, all samples are traversed and all boundary samples are synthesized into new samples using the SMOTE strategy to obtain synthetic samples. The synthetic samples are then processed by ENN undersampling to form balanced samples.

[0078] If the target sampling strategy is the third preset strategy, extracting data features of the sample data, and normalizing the data features to obtain normalized features;

[0079] Extracting the sample data to obtain sample pairs, calculating synthetic features of the sample pairs based on the normalized features, and determining synthetic labels based on data labels of the sample data in the sample pairs;

[0080] Generate the sampling sample according to the synthetic feature and the synthetic label;

[0081] Among them, if the target sampling strategy is the third preset strategy, the Mixup oversampling strategy is used to fuse the features and labels of two different samples through linear interpolation to generate a sampling sample;

[0082] Assume that the set of sample data D min for:

[0083]

[0084] in, N is the number of categories, x i For the i Normalized features, y i is the true label;

[0085] The mathematical formalization of Mixup is defined as:

[0086]

[0087] in, x j For the j Normalized features, is a synthetic feature, For synthetic tags, λ ~ Beta(a, a) is the interpolation coefficient, a =0.3, passed Beta Distribution controls the strength of the blend.

[0088] Specifically, the Mixup strategy steps are as follows:

[0089] (1) Feature normalization and screening:

[0090] Perform Min-Max normalization on numerical features to eliminate dimensional differences:

[0091] Homogeneity constraints are imposed on discrete features (such as protocol type and port number), allowing only samples with the same protocol or port to participate in interpolation.

[0092] (2) Dynamic interpolation generation:

[0093] Randomly select sample pairs that meet the discrete feature consistency conditions from the sample data set, generate interpolation coefficients, calculate synthetic features, and use hard label constraints to determine the synthetic labels. Inherited to x i If the true label λ Greater than or equal to 0.5, then Inherited to x j The true label.

[0094] (3) Generate sample post-processing

[0095] Abnormal samples that exceed the original feature value range are eliminated, and continuous features are inverse normalized to restore the original data distribution characteristics.

[0096] In this embodiment, a suitable sampling strategy is dynamically selected based on the number of samples;

[0097] For example, BorderlineSMOTE oversampling, Mixup oversampling, and ENN undersampling. For classes with large samples (over 500,000), ENN is used directly for noise removal. For classes with fewer samples (over 500 but less than 500,000), BorderlineSMOTE oversampling is used to first identify boundary samples and synthesize new samples using SMOTE, and then ENN is used to remove noise. For classes with very few samples, Mixup is used to first fuse the features and labels of two different samples through linear interpolation to generate new sample data, and then ENN is used to remove noise.

[0098] Step S30, inputting the sample into a network intrusion detection model for feature extraction to obtain long-term dependency features;

[0099] Optionally, the sampled samples are input into a network intrusion detection model for feature extraction to obtain long-term dependency features, including:

[0100] Performing dilated causal convolution on the sampled samples according to the network intrusion detection model to obtain convolution features, and performing nonlinear transformation on the convolution features to obtain transformation features;

[0101] Among them, a TCN layer is set in the network intrusion detection model. The horizontal data samples are used as input data and the dilated causal convolution is performed through the TCN layer to obtain convolution features. This expands the receptive field of each convolution operation, enabling the model to capture dependencies spanning a longer period of time. The formula for dilated causal convolution is:

[0102]

[0103] in, x t Represents input data, y t is the convolution feature, w t is the convolution kernel, b is the bias term, d is the expansion factor, kis the convolution kernel size. The dilation factor allows the TCN layer to expand its receptive field without increasing computational complexity, enabling the model to capture dependencies over longer timeframes while maintaining computational efficiency. The residual module in the TCN layer adds its input directly to the output of the convolutional layer, helping to efficiently transfer information within the network and avoiding the vanishing gradient problem in deep networks.

[0104] Secondly, after the dilated causal convolution operation, the data is transformed nonlinearly using the Mish activation function. This function replaces the original Relu unit (ReLU) in the residual module of the TCN layer, resulting in an improved TCN residual module. This module maintains nonlinear expressiveness while avoiding the "neuron death" problem that ReLU may cause and improving gradient fluidity.

[0105] Regularizing the transformed features to obtain generalized features, and performing residual connection processing on the generalized features to obtain residual features;

[0106] In order to prevent overfitting of temporal features, the Dropout layer is used for regularization, and neurons are randomly discarded to improve the generalization ability of the model and prevent overfitting.

[0107] Performing channel attention mechanism processing on the residual features to obtain the long-term dependency features;

[0108] Among them, by introducing the channel attention mechanism SE module at the end of each improved TCN residual module, the attention weight of each channel can be adaptively adjusted to strengthen the model's attention to important features.

[0109] In this embodiment, by combining dilated causal convolution operations, activation functions, Dropout regularization, residual connections, and SE modules, the TCN layer can effectively extract long-term dependency features from network traffic and provide accurate feature representation in the process of capturing complex intrusion behaviors.

[0110] Step S40, performing deep information extraction on the long-term dependency feature to obtain a hidden state sequence, and performing multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector;

[0111] Among them, a BiGRU layer is set in the network intrusion detection model. The BiGRU layer consists of two independent GRU units, one for processing forward time sequence and the other for processing reverse time sequence, so that the previous and next information of the input data can be considered at each time step, thereby capturing richer long-term dependency features and establishing long-term dependency relationships of the sequence.

[0112] The long-term dependency features extracted by the TCN layer are fed into each GRU unit as input data. The GRU state is updated at each time step based on the input data and the previous state. The core calculation of each GRU unit involves two gating mechanisms—the update gate and the reset gate. The update gate and the reset gate together determine how the current input is combined with the previous information to generate the new hidden state.

[0113] Optionally, deep information extraction is performed on the long-term dependency features to obtain a hidden state sequence, including:

[0114] Inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model respectively to update the state, thereby obtaining a forward hidden layer state and a reverse hidden layer state;

[0115] Concatenating the forward hidden layer state and the reverse hidden layer state to obtain the hidden state sequence;

[0116] The hidden state sequence combines time series information from the past and future, enabling the BiGRU layer to establish long-term dependencies when processing time series data, accurately identifying potential attacks. Through deep information extraction at the BiGRU layer, the network intrusion detection model can further enrich the long-term dependency features extracted by the TCN layer. Through comprehensive time series modeling, it improves the precise understanding of network traffic and the ability to predict potential threats.

[0117] The formulas used for inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model for state update include:

[0118] =(1- z t )* h t-1 + z t *

[0119] =(1- r t )* h t-1 + r t *

[0120] is the forward hidden layer state at the current moment, is a candidate hidden state, z tis the output of the update gate, is the reverse hidden layer state at the current moment, r t is the output of the reset gate.

[0121] Furthermore, a multi-head attention mechanism is performed on the hidden state sequence to obtain a global feature vector, including:

[0122] Performing a linear transformation on the hidden state sequence to obtain a query, a key, and a value, and performing a scaled dot product attention calculation on the query, the key, and the value to obtain the global feature vector;

[0123] Among them, in the improved TBA-Net model, the input of the multi-head attention mechanism layer (Attention layer) is the hidden state sequence output by the BiGRU layer;

[0124] The hidden state sequence is mapped to the space of query (Q), key (K), and value (V) through a linear transformation:

[0125]

[0126] in, W q 、 W k 、 W v is a learnable parameter matrix corresponding to queries, keys, and values.

[0127] Calculate the attention score and calculate the weighted value through scaled dot-product attention:

[0128]

[0129]

[0130] in, A It represents the weighted global feature vector of the multi-head attention mechanism, and the attention weight matrix obtained by normalizing the dot product similarity between the query and the key. Softmax is used for normalization so that the attention distribution of all time steps is between 0 and 1. The feature representation of each time step is not only affected by itself, but also by the weighted influence of the information of other time steps.

[0131] By performing deep information extraction on long-term dependency features to obtain a latent state sequence, and performing multi-head attention mechanism calculation on the latent state sequence, the improved TBA-Net model can extract global feature vectors with high temporal dependency, thereby showing better results in long-term dependency modeling and complex attack pattern recognition.

[0132] The global feature vector is input into the fully connected layer of the improved TBA-Net model for further feature mapping. On the one hand, feature dimensionality reduction is achieved through linear transformation, and on the other hand, nonlinear activation is used to enhance the nonlinear expression ability of features. The improved TBA-Net model can adaptively adjust the weights of different features and improve the classification discrimination ability.

[0133] Step S50, performing data type prediction based on the global feature vector to obtain a sample prediction value, and calculating a model loss based on the sample prediction value and a weighted balance loss function dynamically adjusted based on the number of categories;

[0134] Among them, after receiving the output of the fully connected layer, softmax normalization is used to convert the output of the improved TBA-Net model into a category probability distribution, and the cross entropy loss function (CE loss) is optimized to make the predicted probability of the improved TBA-Net model match the true category distribution as much as possible. The predicted result will obtain the corresponding sample prediction value, and the improved TBA-Net model can make the final category judgment based on the principle of probability maximization.

[0135] During the training process of the network intrusion detection model, the sampled samples can also be dynamically weighted to improve the attention of the network intrusion detection model (improved TBA-Net model) to minority category data.

[0136] Specifically, the number of samples of each sample category in the sampled samples is obtained, the dynamic category weight is calculated according to the number of samples of each sample category, and the sampled samples are weighted according to the dynamic category weight;

[0137] Among them, setting i The number of categories is f i , DWB Loss dynamic category weight w i The calculation method is:

[0138]

[0139] γ It is a hyperparameter (usually 0.5) used to smooth the category weights to prevent them from being too large or too small.

[0140] Optionally, the weighted loss function that is dynamically adjusted based on the number of categories is:

[0141]

[0142] in, L is the model loss, wi is the dynamic class weight, N is the number of categories of the sample category, y i It is i The true label of the sampled sample is i The sample prediction value corresponding to each of the sampled samples is calculated. Gradient back propagation is performed in the improved TBA-Net model based on the model loss, so that small category samples have a greater weight in the loss calculation.

[0143] Step S60, updating parameters of the network intrusion detection model according to the model loss until the network intrusion detection model converges;

[0144] After the improved TBA-Net model converges, the test set is fed into the model for testing to verify its effectiveness and derive relevant evaluation metrics. For samples predicted to be attack traffic, in-depth analysis can be conducted in conjunction with the threat intelligence system to identify the attack source, type, and potential impact, and to implement appropriate security policies. Furthermore, to address false positives and false negatives in detection results, detection thresholds can be optimized in conjunction with security policies. Active learning is then used to continuously optimize the model, ensuring that it maintains high detection accuracy and stability even in the face of new attacks.

[0145] Step S70, inputting the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain a network intrusion detection result;

[0146] Among them, by inputting the network data to be detected into the converged network intrusion detection model for intrusion detection, it can automatically identify whether the network data to be detected is a network intrusion attack, the type of intrusion attack and other information.

[0147] See also Figure 4 , is the comparison of sample data of each category (including Benign, Bot, BruteForce, DoS / DDos, Infiltration, PortScan, Web Attack, etc.) before and after stratified sampling of the training set, Figure 4 It can be seen that the balance of the data set is greatly enhanced after stratified sampling.

[0148] The focus of data balancing is to enhance the accuracy of each category and other indicators. Therefore, it is necessary to compare each category one by one to see the effect before and after balancing. Figure 5 ,After data balancing, the accuracy of each category (Recall, F1 value, FNR, FAR) is higher than the accuracy before data balancing.

[0149] Figure 6 To compare the results before and after using DWB Loss, the accuracy indicators (Recall, F1 value, FNR, FAR) of each category after using DWB Loss are higher than the accuracy indicators before data balancing.

[0150] In this embodiment, the residual module in the TCN layer is improved by introducing the Mish activation function to replace the original ReLU. The purpose is to alleviate the gradient vanishing problem in deep networks so as to maintain information flow when training deeper networks. At the same time, the SE module is introduced to adaptively adjust the weight of each channel to strengthen the model's focus on key features, so as to better identify important attack features, thereby further improving the model's feature expression ability. To verify the effect of the improved TCN residual module, 30% of the sample data was randomly sampled from the initial dataset (see Figure 7 ) to conduct verification experiments, and the experimental results are as follows Figure 8 As shown in the figure, the various indicators (Accuracy, Precision, Recall, F1_score, FAR, FNR) of the improved TCN residual module are significantly better.

[0151] In this embodiment, the parallelized convolutional structure of the TCN layer alleviates the sequence computation bottleneck of traditional RNNs. The BiGRU layer, combined with a bidirectional temporal learning strategy, enables the model to more comprehensively model the contextual relevance of network traffic, improving detection accuracy. The multi-head attention mechanism dynamically weights features, improving the model's generalization capabilities in complex network environments and reducing false positives and false negatives. The TCN layer has strong long-term dependency feature extraction capabilities, the BiGRU layer can simultaneously consider the contextual relationship of input data at each time step to capture deeper information, and the multi-head attention mechanism can weight the features of different attack behaviors to enhance the model's feature expression capabilities. The combination of these three greatly improves the accuracy of the model's intrusion detection.

[0152] In this embodiment, by introducing the Mish activation function to replace the ReLU in the TCN residual connection block, it is possible to avoid the "neuron death" problem that may be caused by ReLU while maintaining nonlinear expression capabilities, and improve gradient fluidity. Secondly, the SE module is introduced after the residual module of each layer. Because the SE module can strengthen the model's focus on key features by adaptively adjusting the weight of each channel, especially when processing complex data such as the CICIDS-2017 dataset that contains multiple types of network attacks, it can better identify important attack features, thereby further improving the model's feature expression capabilities. The improved TBA-Net model enables it to extract global feature vectors with high temporal dependencies, thereby showing better results in long-term dependency modeling and complex attack pattern recognition.

[0153] In this embodiment, corresponding target sampling strategies are set for preprocessed data with different sample sizes, and the preprocessed data is sampled by adopting a stratified sampling method, which effectively prevents the phenomenon of imbalance in sample data categories, improves the accuracy of the trained network intrusion detection model, and thus improves the accuracy of network intrusion detection. By performing multi-head attention mechanism calculation on the hidden state sequence, the features can be effectively dynamically weighted, thereby improving the generalization ability of the model in complex network environments and reducing the false alarm rate and missed alarm rate.

[0154] Example 2

[0155] See also Figure 9 , is a schematic diagram of the structure of a network intrusion detection system 100 provided in a second embodiment of the present invention, including:

[0156] The preprocessing module 10 is used to obtain a network data set and preprocess the network data set to obtain preprocessed data.

[0157] The sampling module 11 is configured to determine a target sampling strategy according to the number of samples of the pre-processed data, and sample the pre-processed data according to the target sampling strategy to obtain sampled samples.

[0158] Optionally, the sampling module 11 is further configured to: if the target sampling strategy is the first preset strategy, calculate the data similarity between different sample data in the preprocessed data;

[0159] Determine the neighboring samples corresponding to the sample data according to the data similarity, and determine the number of category differences of the sample data according to the neighboring samples;

[0160] Deleting samples from the sample data according to the number of category differences until a preset iteration condition is met to obtain the sampling sample;

[0161] If the target sampling strategy is the second preset strategy, determining majority class samples and minority class samples according to the sample categories of the neighboring samples, and determining boundary samples in the sample data according to the sample numbers of the majority class samples and the minority class samples;

[0162] Synthesize the boundary sample and the corresponding minority class sample to obtain a synthesized sample, and undersample the synthesized sample to obtain the sampled sample;

[0163] If the target sampling strategy is the third preset strategy, extracting data features of the sample data, and normalizing the data features to obtain normalized features;

[0164] Extracting the sample data to obtain sample pairs, calculating synthetic features of the sample pairs based on the normalized features, and determining synthetic labels based on data labels of the sample data in the sample pairs;

[0165] The sampling sample is generated according to the synthetic feature and the synthetic label.

[0166] The feature extraction module 12 is used to input the sampled data into the network intrusion detection model to extract features and obtain long-term dependency features.

[0167] Optionally, the feature extraction module 12 is further configured to: obtain the number of samples of each sample category in the sampled samples, and calculate the dynamic category weight according to the number of samples of each sample category;

[0168] The sampling samples are weighted according to the dynamic category weights to obtain the horizontal data samples.

[0169] Furthermore, the feature extraction module 12 is further configured to: perform dilated causal convolution on the sampled samples according to the network intrusion detection model to obtain convolution features, and perform nonlinear transformation on the convolution features to obtain transformation features;

[0170] Regularizing the transformed features to obtain generalized features, and performing residual connection processing on the generalized features to obtain residual features;

[0171] The residual features are processed by a channel attention mechanism to obtain the long-term dependency features.

[0172] The attention calculation module 13 is used to perform deep information extraction on the long-term dependency features to obtain a hidden state sequence, and perform multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector.

[0173] Optionally, the attention calculation module 13 is further configured to: input the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model respectively to perform state update, thereby obtaining a forward hidden layer state and a reverse hidden layer state;

[0174] Concatenating the forward hidden layer state and the reverse hidden layer state to obtain the hidden state sequence;

[0175] The formulas used for inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model for state update include:

[0176] =(1- z t )* h t-1 +z t *

[0177] =(1- r t )* h t-1 + r t *

[0178] is the forward hidden layer state at the current moment, is a candidate hidden state, z t is the output of the update gate, is the reverse hidden layer state at the current moment, r t is the output of the reset gate.

[0179] Furthermore, the attention calculation module 13 is also used to: perform a linear transformation on the hidden state sequence to obtain a query, a key and a value, and perform a scaled dot product attention calculation on the query, the key and the value to obtain the global feature vector.

[0180] The training module 14 is used to predict the data type based on the global feature vector to obtain a sample prediction value, and calculate the model loss based on the sample prediction value and a weight balance loss function that is dynamically adjusted based on the number of categories; and update the parameters of the network intrusion detection model based on the model loss until the network intrusion detection model converges.

[0181] Optionally, the weighted loss function that is dynamically adjusted based on the number of categories is:

[0182]

[0183] in, L is the model loss, w i is the dynamic class weight, N is the number of categories of the sample category, y i It is i The true label of the sampled sample is i The sample prediction value corresponding to each of the sampling samples;

[0184]

[0185] in, f i For thei The number of categories for each category, γ is a hyperparameter.

[0186] The intrusion detection module 15 is used to input the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain a network intrusion detection result.

[0187] In this embodiment, corresponding target sampling strategies are set for preprocessed data with different sample sizes, and the preprocessed data is sampled by adopting a stratified sampling method, which effectively prevents the phenomenon of imbalance in sample data categories, improves the accuracy of the trained network intrusion detection model, and thus improves the accuracy of network intrusion detection. By performing multi-head attention mechanism calculation on the hidden state sequence, the features can be effectively dynamically weighted, thereby improving the generalization ability of the model in complex network environments and reducing the false alarm rate and missed alarm rate.

[0188] Example 3

[0189] Figure 10 This is a block diagram of a terminal device 2 provided in the third embodiment of the present application. Figure 10 As shown, the terminal device 2 of this embodiment includes: a processor 20, a memory 21, and a computer program 22 stored in the memory 21 and executable on the processor 20, such as a program for a network intrusion detection method. When the processor 20 executes the computer program 22, the steps of each embodiment of the network intrusion detection method described above are implemented.

[0190] Exemplarily, the computer program 22 may be divided into one or more modules, which are stored in the memory 21 and executed by the processor 20 to implement the present application. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution process of the computer program 22 in the terminal device 2. The terminal device may include, but is not limited to, a processor 20 and a memory 21.

[0191] The processor 20 may be a central processing unit (CPU), other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor.

[0192] The memory 21 can be an internal storage unit of the terminal device 2, such as a hard drive or memory of the terminal device 2. The memory 21 can also be an external storage device of the terminal device 2, such as a plug-in hard drive, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. equipped with the terminal device 2. Furthermore, the memory 21 can include both an internal storage unit of the terminal device 2 and an external storage device. The memory 21 is used to store the computer program and other programs and data required by the terminal device. The memory 21 can also be used to temporarily store data that has been output or is about to be output.

[0193] In addition, the functional modules in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0194] If the integrated module is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be either non-volatile or volatile. Based on this understanding, the present application can implement all or part of the process steps in the above-mentioned method embodiments by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of each of the above-mentioned method embodiments. The computer program includes computer program code, which can be in source code form, object code form, executable file, or some intermediate form. Computer-readable storage media can include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard drive, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal, and software distribution medium. It should be noted that the content contained in computer-readable storage media can be appropriately increased or decreased according to the requirements of legislation and patent practices in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practices, computer-readable storage media do not include electrical carrier signals and telecommunications signals.

[0195] The above-described embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present application, and should all be included in the scope of protection of the present application.

Claims

1. A network intrusion detection method, characterized in that: The method comprises: Acquiring a network data set, and preprocessing the network data set to obtain preprocessed data; Determining a target sampling strategy according to the sample quantity of the preprocessed data, and sampling the preprocessed data according to the target sampling strategy to obtain sampled samples; Inputting the sampled samples into a network intrusion detection model for feature extraction to obtain long-term dependency features; Performing deep information extraction on the long-term dependency features to obtain a hidden state sequence, and performing multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector; Predicting the data type based on the global feature vector to obtain a sample prediction value, and calculating the model loss based on the sample prediction value and a weight balance loss function that is dynamically adjusted based on the number of categories; Updating parameters of the network intrusion detection model according to the model loss until the network intrusion detection model converges; Inputting the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain network intrusion detection results; Sampling the preprocessed data according to the target sampling strategy to obtain a sampled sample includes: If the target sampling strategy is the first preset strategy, calculating the data similarity between different sample data in the preprocessed data; Determine the neighboring samples corresponding to the sample data according to the data similarity, and determine the number of category differences of the sample data according to the neighboring samples; Deleting samples from the sample data according to the number of category differences until a preset iteration condition is met to obtain the sampling sample; If the target sampling strategy is the second preset strategy, determining majority class samples and minority class samples according to the sample categories of the neighboring samples, and determining boundary samples in the sample data according to the sample numbers of the majority class samples and the minority class samples; The boundary samples and the corresponding minority class samples are synthesized to obtain synthesized samples, and the synthesized samples are undersampled to obtain the sampled samples.

2. The network intrusion detection method according to claim 1, wherein: Sampling the preprocessed data according to the target sampling strategy to obtain a sampled sample further includes: If the target sampling strategy is the third preset strategy, extracting data features of the sample data, and normalizing the data features to obtain normalized features; Extracting the sample data to obtain sample pairs, calculating synthetic features of the sample pairs based on the normalized features, and determining synthetic labels based on data labels of the sample data in the sample pairs; The sampling sample is generated according to the synthetic feature and the synthetic label.

3. The network intrusion detection method according to claim 1, wherein: The sample is input into the network intrusion detection model for feature extraction to obtain long-term dependency features, including: Performing dilated causal convolution on the sampled samples according to the network intrusion detection model to obtain convolution features, and performing nonlinear transformation on the convolution features to obtain transformation features; Regularizing the transformed features to obtain generalized features, and performing residual connection processing on the generalized features to obtain residual features; The residual features are processed by a channel attention mechanism to obtain the long-term dependency features.

4. The network intrusion detection method according to claim 1, wherein: Deep information extraction is performed on the long-term dependency features to obtain a hidden state sequence, including: Inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model respectively to update the state, thereby obtaining a forward hidden layer state and a reverse hidden layer state; Concatenating the forward hidden layer state and the reverse hidden layer state to obtain the hidden state sequence; The formulas used for inputting the long-term dependency features into the update gate and reset gate of the recurrent neural network unit in the network intrusion detection model for state update include: =（1- z t ）* h t-1 + z t * =（1- r t ）* h t-1 + r t * is the forward hidden layer state at the current moment, h t-1 for t The forward hidden layer state at time -1, is a candidate hidden state, z t is the output of the update gate, is the reverse hidden layer state at the current moment, r t is the output of the reset gate.

5. The network intrusion detection method according to claim 1, wherein: The multi-head attention mechanism is used to calculate the hidden state sequence to obtain a global feature vector, including: A linear transformation is performed on the hidden state sequence to obtain a query, a key, and a value, and a scaled dot product attention calculation is performed on the query, the key, and the value to obtain the global feature vector.

6. The network intrusion detection method according to claim 1, wherein: The weight balance loss function dynamically adjusted based on the number of categories is: in, L is the model loss, w i is the dynamic class weight, N is the number of categories of the sample category, y i It is i The true labels of the sampled samples, It is i The sample prediction value corresponding to each of the sampling samples; in, f i For the i The number of categories for each category, γ is a hyperparameter.

7. A network intrusion detection system, characterized in that: The system comprises: A preprocessing module is used to obtain a network data set and preprocess the network data set to obtain preprocessed data; a sampling module, configured to determine a target sampling strategy according to the number of samples of the preprocessed data, and sample the preprocessed data according to the target sampling strategy to obtain sampled samples; A feature extraction module is used to input the sampled samples into a network intrusion detection model for feature extraction to obtain long-term dependency features; An attention calculation module is used to perform deep information extraction on the long-term dependency features to obtain a hidden state sequence, and perform multi-head attention mechanism calculation on the hidden state sequence to obtain a global feature vector; A training module is configured to predict data types based on the global feature vector to obtain sample prediction values, and calculate model losses based on the sample prediction values ​​and a weighted balance loss function dynamically adjusted based on the number of categories; and update parameters of the network intrusion detection model based on the model loss until the network intrusion detection model converges; An intrusion detection module is used to input the network data to be detected into the converged network intrusion detection model to perform intrusion detection and obtain network intrusion detection results; The sampling module is further configured to: if the target sampling strategy is the first preset strategy, calculate the data similarity between different sample data in the preprocessed data; Determine the neighboring samples corresponding to the sample data according to the data similarity, and determine the number of category differences of the sample data according to the neighboring samples; Deleting samples from the sample data according to the number of category differences until a preset iteration condition is met to obtain the sampling sample; If the target sampling strategy is the second preset strategy, determining majority class samples and minority class samples according to the sample categories of the neighboring samples, and determining boundary samples in the sample data according to the sample numbers of the majority class samples and the minority class samples; The boundary samples and the corresponding minority class samples are synthesized to obtain synthesized samples, and the synthesized samples are undersampled to obtain the sampled samples.

8. A terminal device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images