A threat behavior detection method based on fuzzy enhancement polynomial neural network

Abstract

The application discloses a threat behavior detection method based on a fuzzy enhancement polynomial neural network, which comprises the combination of fuzzy C-means clustering and a polynomial neural network, the design of a self-adaptive optimization mechanism, the introduction of an entropy activation function, the realization of dynamic edge weighting and a fuzzy enhancement feature extraction process, and an adaptive optimization algorithm for threat behavior detection is designed.The application constructs an efficient threat behavior detection model by designing an adaptive fuzzy enhancement polynomial neural network, realizes the accurate identification of complex threat modes in network traffic, and effectively improves the detection precision and efficiency.In addition, the visualization of the thinking process of the neural network is realized through the generation of fuzzy rules, and the transparency and interpretability of the system are improved.Compared with the traditional method, the application has more advantages in detection accuracy and adaptability, not only improves the identification ability of complex attack modes, but also adapts to different network environments, and is suitable for threat detection scenes in complex network traffic.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a threat behavior detection method using fuzzy augmented multinomial neural networks. Background Technology

[0002] Network security and threat detection are two real-world factors that are generally overlooked in existing network traffic analysis research, with few studies delving into the diverse threat behaviors within complex network traffic. However, improvements in the accuracy and efficiency of threat behavior detection rely heavily on classic machine learning algorithms and deep learning models, such as classic clustering algorithms and neural network techniques, which have received widespread attention. Furthermore, fuzzy clustering techniques have been successfully applied to pattern recognition and anomaly detection, laying the foundation for threat detection in network traffic. More importantly, the thought process of neural networks is often a "black box," difficult to interpret. However, by generating fuzzy rules, the thought process of neural networks can be visualized, increasing the system's transparency and interpretability. In conclusion, designing a new method to address threat behavior detection in complex network environments is urgently needed. Employing fuzzy augmented multinomial neural network technology to construct a threat detection model and generating a visualized neural network thought process through fuzzy rules is a practical solution. Summary of the Invention

[0003] This invention provides a threat behavior detection method based on fuzzy augmented multinomial neural networks. Its purpose is to overcome the shortcomings of existing threat behavior detection methods in dealing with complex attack patterns and improving detection transparency by introducing fuzzy augmented multinomial neural networks.

[0004] The technical solution adopted in this invention is as follows:

[0005] A threat behavior detection method based on fuzzy enhanced multinomial neural network includes the following steps:

[0006] Step 1: Data preprocessing and feature extraction. Preprocess the training and test data, including reading the data, converting the data format, extracting features and encoding labels, to ensure data consistency and provide correct input for subsequent model training.

[0007] Step 2: Fuzzy Clustering and Similarity Calculation. The Fuzzy C-means Clustering (FCM) algorithm is used to perform fuzzy clustering of the data, effectively dividing it into multiple fuzzy categories. In this process, the cosine similarity method is typically used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, a dynamic weighting method is used to adjust the connection strength between nodes to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections.

[0008] Step 3: Adaptive Optimization and Model Configuration. The SSOA (Self-Signaled Optimization Algorithm) dynamically adjusts key parameters in fuzzy clustering (such as the number of clusters *c* and the fuzzy index *m*), thereby optimizing the structural parameters of the neural network (such as the number of layers and the number of neurons per layer). This optimization algorithm automatically selects the most suitable parameters based on the characteristics of network traffic, thus improving the model's adaptability and accuracy. The optimization process dynamically adjusts parameters by monitoring the fitness during training, enabling the model to automatically adjust according to different data features and ensuring maximum training effectiveness.

[0009] Step 4: Feature Expansion and Neural Network Training. Based on features obtained from fuzzy clustering and multinomial feature expansion techniques, a feature set with higher expressive power is constructed and used as input to the neural network for training. By using an adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the model's learning ability and enabling it to better handle complex threat patterns.

[0010] Step 5: Model Evaluation and Validation. After training, a comprehensive performance evaluation of the model is performed, calculating various evaluation metrics, including accuracy, confusion matrix, and classification report. These metrics validate the model's performance in threat behavior detection, and the results are compared with existing methods to demonstrate the advantages of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved and validated through practical applications to ensure its effective identification and response to complex network threat behaviors in real-world environments.

[0011] Step 1: Data Preprocessing and Feature Extraction. Preprocessing of both training and test data includes reading the data, converting data formats, feature extraction, and label encoding to ensure data consistency and provide correct input for subsequent model training. Specific steps are as follows:

[0012] Step 1.1: Load an existing dataset or generate a new dataset. First, check if the saved training and test sets (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) already exist. If they exist, load the existing dataset directly; if they do not exist, generate a new dataset by parsing the PCAP file.

[0013] Step 1.2: Obtain and parse the PCAP files. Use the glob function to obtain all PCAP files in the specified directory (. / data0), and parse each file sequentially. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data (such as source IP, destination IP, protocol, source port, destination port, number of packets, etc.).

[0014] Step 1.3, Data Cleaning and Label Generation: The `generate_labels` function generates labels for each data packet based on its characteristics (e.g., protocol, source port, destination port, number of packets, number of bytes, etc.). Based on traffic characteristics, it determines whether the traffic is an attack type (e.g., UDP Flood, ARP spoofing, etc.) and generates the corresponding attack label (e.g., "UDP Flood Attack") along with the normal traffic label ("Normal").

[0015]

[0016] Here, dpkts is the number of packets at the destination, and proto is the protocol type. If the condition is true, the label is 1 (attack type); otherwise, it is 0 (normal traffic). A similar conditional judgment method can be used for other attack types (such as DNS Flood, ARP spoofing, etc.).

[0017] Step 1.4, Data Merging and Column Processing: Append the parsed results of each file to a single DataFrame, removing unnecessary columns (such as SrcAddr and DstAddr) to avoid processing too many category values. Additionally, remove rows containing null values ​​and encode the protocol column (Proto) to handle all non-numeric protocol types, ensuring data consistency.

[0018] Step 1.5: Label Encoding of Categorical Variables. This step involves label encoding the categorical variables in the dataset, converting non-numerical features (such as protocol type, source address, etc.) into numeric types for subsequent model use. This is done using LabelEncoder:

[0019] Encoded Value=LabelEncoder(X);

[0020] Step 1.6, Data Scaling and Resampling: Standardize the numerical features in the dataset using MinMaxScaler to normalize all feature values ​​to between 0 and 1. Then, resample using ADASYN to ensure a balanced class distribution and prevent data imbalance from affecting model performance.

[0021]

[0022] Step 1.7: Split the data into training and test sets using the `train_test_split` function. This ensures the model can be trained and validated. Finally, save the datasets (training and test sets) to local files (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) for later loading and use.

[0023] Step 1.8, Feature Extraction and Standardization: Features are standardized using MinMaxScaler to ensure that each feature value is at the same scale. This avoids bias during model training due to different feature magnitudes, guaranteeing that each feature contributes equally to the model.

[0024] Step 1.9, Label Encoding and Data Splitting: LabelEncoder is used to encode all non-numerical features, and the dataset is split into training and test sets using `train_test_split`. This ensures the model can adapt to different traffic types and can effectively learn and evaluate during training and testing.

[0025] Step 2: Fuzzy Clustering and Similarity Calculation. The Fuzzy C-means Clustering (FCM) algorithm is used to perform fuzzy clustering of the data, effectively dividing it into multiple fuzzy categories. In this process, the cosine similarity method is typically used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, a dynamic weighting method is used to adjust the connection strength between nodes to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections. The specific steps are as follows:

[0026] Step 2.1, Calculate the similarity matrix: First, calculate the similarity between data points. One commonly used similarity measure is cosine similarity, whose formula is:

[0027]

[0028] Here, A and B are the feature vectors of two data points, ||A|| and ||B|| are their Euclidean norms (modulo terms), and A·B is the dot product of these two vectors. By calculating the cosine similarity between all data points, we can obtain a similarity matrix, where each element represents the similarity between two data points.

[0029] Step 2.2, Dynamically Weighted Similarity Matrix: After calculating the similarity matrix, the similarities are then dynamically weighted. The purpose of weighting is to strengthen the connections between data points with high similarity and to reduce the influence between points with low similarity through a decay factor. The weighting formula is:

[0030] Weight ij =Similarity ij ×DecayFactor

[0031] Among them, Weight ij It is the weighted similarity between data point i and data point j. ij The original similarity value is calculated using cosine similarity. DecayFactor is a decay factor, typically ranging from 0 to 1 (e.g., 0.9). This weighting process makes high-similarity connections more prominent, while weakening low-similarity connections, thereby improving the quality of clustering.

[0032] Step 2.3, Fuzzy C-means Clustering (FCM): The data is clustered using the Fuzzy C-means Clustering (FCM) algorithm. The goal of FCM is to optimize the membership matrix U and cluster centers V by minimizing an objective function. The mathematical expression of the objective function is:

[0033]

[0034] in:

[0035] u ij It is data point x i For cluster center v j The membership degree represents the membership degree of data point x. i The degree of clustering j has a value between 0 and 1.

[0036] m is the fuzziness index (usually greater than 1), which controls the degree of fuzziness in clustering. A larger m value makes the membership matrix U smoother, while a smaller m value makes the clustering more accurate.

[0037] ||x i -v j || is data point x i For cluster center v j The Euclidean distance between the data points represents the similarity between the data points and the cluster centers.

[0038] C is the number of clusters, and N is the number of data points.

[0039] The membership matrix U and cluster centers V are iteratively updated until the objective function converges. In each iteration, the FCM algorithm updates the membership matrix to ensure a more reasonable distribution of membership values ​​among the clusters.

[0040] Step 2.4: Output Fuzzy Clustering Results: After clustering is complete, output the final membership matrix U and cluster centers V. Each element u in the membership matrix U... ij Represents data point x i The membership degree of cluster j. The final cluster center V is the "average" feature of the data points in each cluster, representing the central location of each cluster.

[0041] Step 3: Adaptive Optimization and Model Configuration. The SSOA (Self-Signaled Optimization Algorithm) is used to dynamically adjust key parameters in fuzzy clustering (such as the number of clusters *c* and the fuzzy index *m*), thereby optimizing the structural parameters of the neural network (such as the number of layers and the number of neurons per layer). This optimization algorithm automatically selects the most suitable parameters based on the characteristics of network traffic, thus improving the model's adaptability and accuracy. The optimization process dynamically adjusts parameters by monitoring the fitness during training, enabling the model to automatically adjust according to different data features and ensuring maximum training effectiveness. The specific steps are as follows:

[0042] Step 3.1, Preliminary Model Parameter Setting: The first step is to set the preliminary model parameters. This includes clustering parameters in the Fuzzy C-means Clustering (FCM) algorithm (such as the number of clusters c and the fuzziness index m), and neural network structure parameters (such as the number of layers and the number of neurons per layer). For initial setting, some common empirical values ​​can be used, or these parameters can be selected through simple heuristics. For example, the fuzziness index m is usually set between 1.5 and 2.5. The number of clusters c can be initially set based on the characteristics of the data, usually by selecting a reasonable value through cross-validation.

[0043] Step 3.2: Dynamically adjust using an adaptive optimization algorithm (SSOA): Dynamically adjust the key parameters of the model using an adaptive optimization algorithm (e.g., Adaptive Particle Swarm Optimization, SSOA). This includes: the number of clusters *c*, the fuzziness exponent *m*, the structural parameters of the neural network (e.g., the number of network layers, the number of neurons per layer), and the threshold (for binary classification tasks, such as the decision threshold for threat detection). The goal of the adaptive optimization algorithm is to minimize the model's loss function and find the optimal configuration by automatically adjusting different hyperparameters. SSOA typically searches for the optimal solution by simulating the behavior of particle swarms in nature. The particle update rule can be expressed by the following formula:

[0044]

[0045] This represents the velocity of particle i in the kth generation. Let x represent the position of particle i in the kth generation. id p represents the position of the particle in the i-th task. best,i is the optimal position of particle i itself, gbest is the global optimal position, c1 and c2 are acceleration constants, r1 and r2 are random values ​​in the range [0,1], and w is the inertial weight, used to balance the particle's exploration and utilization capabilities.

[0046] Through iterative optimization, SSOA can adjust model parameters to minimize the loss function, thereby obtaining the optimal model configuration.

[0047] Step 3.3, Fitness Function and Parameter Tuning: In the adaptive optimization process, a fitness function needs to be defined. This function evaluates the model's performance and determines the quality of the parameters. The fitness function is typically related to metrics such as the model's prediction accuracy, loss value, and F1 score. In this invention, the fitness function can be expressed as:

[0048]

[0049] Where Loss is the loss function, such as cross-entropy loss, y pred It is the model's predicted value, y true These are the real labels. Optimization algorithms improve fitness by minimizing loss through adjusting model parameters. Fitness monitoring allows us to dynamically adjust parameters in particle swarm optimization. For example, if the optimization process fails to converge in the early stages, exploration can be enhanced by increasing inertia weights or adjusting the acceleration constant. In later stages, reducing inertia weights helps accelerate the algorithm's convergence.

[0050] Step 3.4, Parameter Optimization Results Output: Through adaptive optimization, the optimal model parameters are finally obtained. At this point, the optimized cluster number c, fuzzy index m, and the number of neural network layers n are... layers Number of neurons per layer n neurons The decision threshold (e.g., 0.5) can be adapted to the needs of specific datasets and tasks. These optimization results provide the best parameter configuration for subsequent model training and prediction.

[0051] Step 4: Feature Expansion and Neural Network Training. Based on the features obtained from fuzzy clustering and multinomial feature expansion techniques, a feature set with higher expressive power is constructed and used as input to the neural network for training. By using an adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the model's learning ability and enabling it to better handle complex threat patterns. The specific steps are as follows:

[0052] Step 4.1, Feature Expansion and Combination: In this stage, the features obtained from fuzzy clustering are combined with multinomial features to expand the feature space. Specifically, we perform multinomial expansion on the original features to increase their nonlinear representation capability. These multinomial features can be generated using the following formula:

[0053] X poly =[X 1 ,X 2 ,...,X n ]

[0054] Where X is the original feature, X i Let be the i-th power of the original feature set, and n be the highest power of the required polynomial. In this way, we transform the original feature set into a more complex feature space to improve the model's ability to learn complex patterns. Then, we concatenate the fuzzy clustering results with these expanded features to form a new feature set:

[0055] X extended =[X fuzzy ,X poly ];

[0056] Step 4.2: Generate Clustering Rules: Generate corresponding rules from the fuzzy clustering results. Each rule is represented as a condition-result structure, specifically:

[0057] If x i ∈[a,b] for all i,then class y

[0058] Where, x i The feature is represented by [a,b], which represents the range of values ​​for the feature, and y is the target category (such as "potential attack" or "normal behavior").

[0059] Specifically, for each cluster, conditions are generated by calculating the feature ranges (maximum and minimum values) of the data points. Data points within the same cluster will have similar feature ranges, and rules are created using these feature ranges to indicate which combinations of feature values ​​correspond to attack or normal behavior.

[0060] Step 4.3, Neural Network Structure Construction: In this stage, we construct the neural network model based on the optimized parameter configuration. The model structure includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function (such as EntropyAwareActivation), which selects either ReLU or Sigmoid activation based on the entropy value of the input data. The structure of the neural network can be represented as follows:

[0061] Layerk =f(Layer) k-1 ·W k +b k )

[0062] Among them, Layer k W represents the output of the k-th layer. k ,b k Let f represent the weights and biases of the k-th layer, respectively, and f be the activation function.

[0063] During training, the Adam optimizer is used for backpropagation and weight updates to minimize the loss function, typically using cross-entropy loss (for binary classification tasks).

[0064]

[0065] Among them, y i It's a real label. These are the predicted values, and N is the number of samples.

[0066] Step 4.4, Neural Network Training and Optimization: In this stage, the neural network is trained using the training data. During training, the Adam optimizer is used with an appropriate learning rate, combined with an adaptive entropy activation function, for multiple iterations. Each training iteration optimizes the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. Furthermore, a learning rate scheduler (e.g., StepLR) is used to gradually decrease the learning rate to further optimize the model's convergence speed and stability.

[0067] Step 5: Model Evaluation and Validation. After training, a comprehensive performance evaluation of the model is performed, calculating various evaluation metrics, including accuracy, confusion matrix, and classification report. These metrics validate the model's performance in threat behavior detection, and the results are compared with existing methods to demonstrate the advantages of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved, and its practical application is validated to ensure its effective identification and response to complex network threat behaviors in real-world environments. Specific steps include:

[0068] Step 5.1: Evaluate the generated rules: In model evaluation, we not only assess the model's accuracy but also examine the effectiveness of the generated clustering rules. Each rule corresponds to a behavioral pattern, such as "potential attack" or "normal behavior." The formula for generating rules is: If x iFor each cluster (e.g., 26 clusters), a rule is generated, and its accuracy and reliability are verified using a test set. The reasonableness of the generated rule can be determined by the following conditions. If the generated rule does not meet expectations, the system will correct it, attempting to slightly adjust the rule range to obtain more diverse and accurate rules.

[0069] Step 5.2, Model Evaluation Metric Calculation: After training, the model is evaluated using a test set. Evaluation metrics typically include accuracy, confusion matrix, precision, recall, and F1 score. The accuracy formula is:

[0070]

[0071] In this system, TP (True Positive) represents a true positive, TN (True Negative) represents a true negative, FP (False Positive) represents a false positive, and FN (False Negative) represents a false negative. Additionally, the F1 score can be used to comprehensively consider precision and recall.

[0072]

[0073] The formulas for calculating precision and recall are as follows:

[0074]

[0075] Step 5.2: To evaluate the advantages of the method of this invention, we compare the performance of this model with other existing threat detection methods. This comparison demonstrates the advantages of the method of this invention in terms of accuracy, efficiency, etc. For example, we can compare the detection accuracy of this model with existing methods for different attack types, or compare the model's performance when processing different traffic data.

[0076] Advantages and benefits of the present invention

[0077] This invention proposes a threat behavior detection method based on fuzzy augmented multinomial neural networks (AFEPNNs). Addressing the characteristics of network traffic detection, it combines AFEPNN technology with a fuzzy multinomial neural network optimization algorithm. This method comprehensively considers data traffic characteristics, clustering results, and adaptive model optimization to improve the accuracy and robustness of threat detection and effectively identify various attack behavior types. This invention can adaptively adjust model parameters based on data characteristics and enhance system interpretability by generating easily interpretable clustering rules. This method is applicable to security monitoring, intrusion detection, and traffic analysis in complex network environments, improving detection efficiency and providing effective technical support for enhancing network security protection capabilities and reducing potential threats. Attached Figure Description

[0078] Figure 1 This is a flowchart of a threat behavior detection method based on a fuzzy enhanced multinomial neural network according to the present invention;

[0079] Figure 2 It is a topology graph generated from features and rules in threat behavior detection. Detailed Implementation

[0080] The present invention will now be described in detail with reference to the accompanying drawings and examples.

[0081] A threat behavior detection method based on a fuzzy enhanced multinomial neural network (technical innovations are shown in Table 1) is proposed. Based on SSOA parameter optimization (structural information is shown in Table 2), fuzzy clustering feature enhancement, and entropy-aware neural network techniques, a fuzzy enhanced multinomial neural network method is constructed to solve the problem of high-precision threat behavior detection (performance comparison is shown in Table 3). The specific implementation plan includes the following contents and steps:

[0082] Table 1. Key Innovations of the Algorithm

[0083]

[0084] Table 2. SSOA Optimization Parameter Range and Performance

[0085] Optimize parameters Parameter range Optimal value Parameter meaning Number of clusters c [8.99,11.32] 10.00 Number of categories in fuzzy clustering Ambiguity m [2.75,3.57] 2.75 Controlling the fuzziness of clustering Decision threshold [0.47,0.55] 0.50 Boundary threshold for classification decision Network layers [4,6] 4 Depth of neural networks Number of neurons per layer [39,94] 80 Width of the neural network Training accuracy —— 97.58％ Model performance on the test set

[0086] Table 2 Algorithm Performance Comparison

[0087] Algorithm Model accuracy Accuracy Recall rate F1 score AFEPNN (this method) 0.9743 0.9739 0.9726 0.9732 FPNN 0.9121 0.9276 0.8990 0.9076 FPNN_PSO 0.9093 0.9259 0.8957 0.9045 FCM_Random Forest 0.9385 0.9451 0.9385 0.8383 Random Forest 0.8468 0.8586 0.8468 0.8456

[0088] Step 1: Data Preprocessing and Feature Extraction. Preprocessing of both training and test data includes reading the data, converting data formats, feature extraction, and label encoding to ensure data consistency and provide correct input for subsequent model training. Specific steps are as follows:

[0089] Step 1.1: Load an existing dataset or generate a new dataset. First, check if the saved training and test sets (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) already exist. If they exist, load the existing dataset directly; if they do not exist, generate a new dataset by parsing the PCAP file.

[0090] Step 1.2: Obtain and parse the PCAP files. Use the glob function to obtain all PCAP files in the specified directory (. / data0), and parse each file sequentially. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data (such as source IP, destination IP, protocol, source port, destination port, number of packets, etc.).

[0091] Step 1.3, Data Cleaning and Label Generation: The `generate_labels` function generates labels for each data packet based on its characteristics (e.g., protocol, source port, destination port, number of packets, number of bytes, etc.). Based on traffic characteristics, it determines whether the traffic is an attack type (e.g., UDP Flood, ARP spoofing, etc.) and generates the corresponding attack label (e.g., "UDP Flood Attack") along with the normal traffic label ("Normal").

[0092]

[0093] Here, dpkts is the number of packets at the destination, and proto is the protocol type. If the condition is true, the label is 1 (attack type); otherwise, it is 0 (normal traffic). A similar conditional approach can be used for other attack types (such as DNS Flood, ARP spoofing, etc.).

[0094] Step 1.4, Data Merging and Column Processing: Append the parsed results of each file to a single DataFrame, removing unnecessary columns (such as SrcAddr and DstAddr) to avoid processing too many category values. Additionally, remove rows containing null values ​​and encode the protocol column (Proto) to handle all non-numeric protocol types, ensuring data consistency.

[0095] Step 1.5: Label Encoding of Categorical Variables. This step involves label encoding the categorical variables in the dataset, converting non-numerical features (such as protocol type, source address, etc.) into numeric types for subsequent model use. This is done using LabelEncoder:

[0096] Encoded Value=LabelEncoder(X)

[0097] Step 1.6, Data Scaling and Resampling: Standardize the numerical features in the dataset using MinMaxScaler to normalize all feature values ​​to between 0 and 1. Then, resample using ADASYN to ensure a balanced class distribution and prevent data imbalance from affecting model performance.

[0098]

[0099] Step 1.7: Split the data into training and test sets using the `train_test_split` function. This ensures the model can be trained and validated. Finally, save the datasets (training and test sets) to local files (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) for later loading and use.

[0100] Step 1.8, Feature Extraction and Standardization: Features are standardized using MinMaxScaler to ensure that each feature value is at the same scale. This avoids bias during model training due to different feature magnitudes, guaranteeing that each feature contributes equally to the model.

[0101] Step 1.9, Label Encoding and Data Splitting: LabelEncoder is used to encode all non-numerical features, and the dataset is split into training and test sets using `train_test_split`. This ensures the model can adapt to different traffic types and can effectively learn and evaluate during training and testing.

[0102] Step 2: Fuzzy Clustering and Similarity Calculation. The Fuzzy C-means Clustering (FCM) algorithm is used to perform fuzzy clustering of the data, effectively dividing it into multiple fuzzy categories. In this process, the cosine similarity method is typically used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, a dynamic weighting method is used to adjust the connection strength between nodes to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections. The specific steps are as follows:

[0103] Step 2.1, Calculate the similarity matrix: First, calculate the similarity between data points. One commonly used similarity measure is cosine similarity, whose formula is:

[0104]

[0105] Here, A and B are the feature vectors of two data points, ||A|| and |B|| are their Euclidean norms (modulo terms), and A·B is the dot product of these two vectors. By calculating the cosine similarity between all data points, we can obtain a similarity matrix, where each element represents the similarity between two data points.

[0106] Step 2.2, Dynamically Weighted Similarity Matrix: After calculating the similarity matrix, the similarities are then dynamically weighted. The purpose of weighting is to strengthen the connections between data points with high similarity and to reduce the influence between points with low similarity through a decay factor. The weighting formula is:

[0107] Weight ij =Similarity ij ×DecayFactor

[0108] Among them, Weight ij It is the weighted similarity between data point i and data point j. ij The original similarity value is calculated using cosine similarity. DecayFactor is a decay factor, typically ranging from 0 to 1 (e.g., 0.9). This weighting process makes high-similarity connections more prominent, while weakening low-similarity connections, thereby improving the quality of clustering.

[0109] Step 2.3, Fuzzy C-means Clustering (FCM): The data is clustered using the Fuzzy C-means Clustering (FCM) algorithm. The goal of FCM is to optimize the membership matrix U and cluster centers V by minimizing an objective function. The mathematical expression of the objective function is:

[0110]

[0111] in:

[0112] u ij It is data point x i For cluster center v j The membership degree represents the membership degree of data point x. i The degree of clustering j has a value between 0 and 1.

[0113] m is the fuzziness index (usually greater than 1), which controls the degree of fuzziness in clustering. A larger m value makes the membership matrix U smoother, while a smaller m value makes the clustering more accurate.

[0114] ||x i -v j || is data point x i For cluster center v jThe Euclidean distance between the data points represents the similarity between the data points and the cluster centers.

[0115] C is the number of clusters, and N is the number of data points.

[0116] The membership matrix U and cluster centers V are iteratively updated until the objective function converges. In each iteration, the FCM algorithm updates the membership matrix to distribute the membership of data points more reasonably among the clusters.

[0117] Step 2.4: Output Fuzzy Clustering Results: After clustering is complete, output the final membership matrix U and cluster centers V. Each element u in the membership matrix U... ij Represents data point x i The membership degree of cluster j. The final cluster center V is the "average" feature of the data points in each cluster, representing the central location of each cluster.

[0118] Step 3: Adaptive Optimization and Model Configuration. The SSOA (Self-Signaled Optimization Algorithm) is used to dynamically adjust key parameters in fuzzy clustering (such as the number of clusters *c* and the fuzzy index *m*), thereby optimizing the structural parameters of the neural network (such as the number of layers and the number of neurons per layer). This optimization algorithm automatically selects the most suitable parameters based on the characteristics of network traffic, thus improving the model's adaptability and accuracy. The optimization process dynamically adjusts parameters by monitoring the fitness during training, enabling the model to automatically adjust according to different data features and ensuring maximum training effectiveness. The specific steps are as follows:

[0119] Step 3.1, Preliminary Model Parameter Setting: The first step is to set the preliminary model parameters. This includes clustering parameters in the Fuzzy C-means Clustering (FCM) algorithm (such as the number of clusters c and the fuzziness index m), and neural network structure parameters (such as the number of layers and the number of neurons per layer). For initial setting, some common empirical values ​​can be used, or these parameters can be selected through simple heuristics. For example, the fuzziness index m is usually set between 1.5 and 2.5. The number of clusters c can be initially set based on the characteristics of the data, usually by selecting a reasonable value through cross-validation.

[0120] Step 3.2: Dynamically adjust using an adaptive optimization algorithm (SSOA): Dynamically adjust the key parameters of the model using an adaptive optimization algorithm (e.g., Adaptive Particle Swarm Optimization, SSOA). This includes: the number of clusters *c*, the fuzziness exponent *m*, the structural parameters of the neural network (e.g., the number of network layers, the number of neurons per layer), and the threshold (for binary classification tasks, such as the decision threshold for threat detection). The goal of the adaptive optimization algorithm is to minimize the model's loss function and find the optimal configuration by automatically adjusting different hyperparameters. SSOA typically searches for the optimal solution by simulating the behavior of particle swarms in nature. The particle update rule can be expressed by the following formula:

[0121]

[0122] This represents the velocity of particle i in the kth generation. Let x represent the position of particle i in the kth generation. id p represents the position of the particle in the i-th task. best,i `i` represents the optimal position of particle `i` itself, `gbest` represents the globally optimal position, `c1` and `c2` are acceleration constants, `r1` and `r2` are random values ​​ranging from [0,1], and `w` is the inertial weight used to balance the particle's exploration and utilization capabilities.

[0123] Through iterative optimization, SSOA can adjust model parameters to minimize the loss function, thereby obtaining the optimal model configuration.

[0124] Step 3.3, Fitness Function and Parameter Tuning: In the adaptive optimization process, a fitness function needs to be defined. This function evaluates the model's performance and determines the quality of the parameters. The fitness function is typically related to metrics such as the model's prediction accuracy, loss value, and F1 score. In this invention, the fitness function can be expressed as:

[0125]

[0126] Where Loss is the loss function, such as cross-entropy loss, y pred It is the model's predicted value, y true These are the real labels. Optimization algorithms improve fitness by minimizing loss through adjusting model parameters. Fitness monitoring allows us to dynamically adjust parameters in particle swarm optimization. For example, if the optimization process fails to converge in the early stages, exploration can be enhanced by increasing inertia weights or adjusting the acceleration constant. In later stages, reducing inertia weights helps accelerate the algorithm's convergence.

[0127] Step 3.4, Parameter Optimization Results Output: Through adaptive optimization, the optimal model parameters are finally obtained. At this point, the optimized cluster number c, fuzzy index m, and the number of neural network layers n are... layers Number of neurons per layer n neurons The optimization results, including the decision threshold (e.g., 0.5), can adapt to the needs of specific datasets and tasks. These optimizations provide the optimal parameter configurations for subsequent model training and prediction.

[0128] Step 4: Feature Expansion and Neural Network Training. Based on the features obtained from fuzzy clustering and multinomial feature expansion techniques, a feature set with higher expressive power is constructed and used as input to the neural network for training. By using an adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the model's learning ability and enabling it to better handle complex threat patterns. The specific steps are as follows:

[0129] Step 4.1, Feature Expansion and Combination: In this stage, the features obtained from fuzzy clustering are combined with multinomial features to expand the feature space. Specifically, we perform multinomial expansion on the original features to increase their nonlinear representation capability. These multinomial features can be generated using the following formula:

[0130] X poly =[X 1 ,X 2 ,...,X n ]

[0131] Where X is the original feature, X i Let be the i-th power of the original feature set, and n be the highest power of the required polynomial. In this way, we transform the original feature set into a more complex feature space to improve the model's ability to learn complex patterns. Then, we concatenate the fuzzy clustering results with these expanded features to form a new feature set:

[0132] X extended =[X fuzzy ,X poly ]

[0133] Step 4.2: Generate Clustering Rules: Generate corresponding rules from the fuzzy clustering results. Each rule is represented as a condition-result structure, specifically:

[0134] If x i ∈[a,b]for all i,then class y

[0135] Where, x iThe feature is represented by [a,b], which represents the range of values ​​for the feature, and y is the target category (such as "potential attack" or "normal behavior").

[0136] Specifically, for each cluster, conditions are generated by calculating the feature ranges (maximum and minimum values) of the data points. Data points within the same cluster will have similar feature ranges, and rules are created using these feature ranges to indicate which combinations of feature values ​​correspond to attack or normal behavior.

[0137] Step 4.3, Neural Network Structure Construction: In this stage, we construct the neural network model based on the optimized parameter configuration. The model structure includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function (such as EntropyAwareActivation), which selects either ReLU or Sigmoid activation based on the entropy value of the input data. The structure of the neural network can be represented as follows:

[0138] Layer k =f(Layer) k-1 ·W k +b k )

[0139] Among them, Layer k W represents the output of the k-th layer. k ,b k Let f represent the weights and biases of the k-th layer, respectively, and f be the activation function.

[0140] During training, the Adam optimizer is used for backpropagation and weight updates to minimize the loss function, typically using cross-entropy loss (for binary classification tasks).

[0141]

[0142] Among them, y i It's a real label. is the predicted value, and N is the number of samples.

[0143] Step 4.4, Neural Network Training and Optimization: In this stage, the neural network is trained using the training data. During training, the Adam optimizer is used with an appropriate learning rate, combined with an adaptive entropy activation function, for multiple iterations. Each training iteration optimizes the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. Furthermore, a learning rate scheduler (e.g., StepLR) is used to gradually decrease the learning rate to further optimize the model's convergence speed and stability.

[0144] Step 5: Model Evaluation and Validation. After training, a comprehensive performance evaluation of the model is performed, calculating various evaluation metrics, including accuracy, confusion matrix, and classification report. These metrics validate the model's performance in threat behavior detection, and the results are compared with existing methods to demonstrate the advantages of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved, and its practical application is validated to ensure its effective identification and response to complex network threat behaviors in real-world environments. Specific steps include:

[0145] Step 5.1: Evaluate the generated rules: In model evaluation, we not only assess the model's accuracy but also examine the effectiveness of the generated clustering rules. Each rule corresponds to a behavioral pattern, such as "potential attack" or "normal behavior." The formula for generating rules is: If x i For each cluster (e.g., 26 clusters), a rule is generated, and its accuracy and reliability are verified using a test set. The reasonableness of the generated rule can be determined by the following conditions. If the generated rule does not meet expectations, the system will correct it, attempting to slightly adjust the rule range to obtain more diverse and accurate rules.

[0146] Step 5.2, Model Evaluation Metric Calculation: After training, the model is evaluated using a test set. Evaluation metrics typically include accuracy, confusion matrix, precision, recall, and F1 score. The accuracy formula is:

[0147]

[0148] In this system, TP (True Positive) represents a true positive, TN (True Negative) represents a true negative, FP (False Positive) represents a false positive, and FN (False Negative) represents a false negative. Additionally, the F1 score can be used to comprehensively consider precision and recall.

[0149]

[0150] The formulas for calculating precision and recall are as follows:

[0151]

[0152] Step 5.2: To evaluate the advantages of the method of this invention, we compare the performance of this model with other existing threat detection methods. This comparison demonstrates the advantages of the method of this invention in terms of accuracy, efficiency, etc. For example, we can compare the detection accuracy of this model with existing methods for different attack types, or compare the model's performance when processing different traffic data.

Claims

1. A threat behavior detection method based on fuzzy augmented multinomial neural networks, comprising the following steps: Step 1: Data preprocessing and feature extraction. Preprocess the training and test data, including reading the data, converting the data format, extracting features and encoding labels, to ensure data consistency and provide correct input for subsequent model training. Step 2, Fuzzy Clustering and Similarity Calculation: The Fuzzy C-means Clustering (FCM) algorithm is used to perform fuzzy clustering on the data, thereby effectively dividing the data into multiple fuzzy categories. In this process, the cosine similarity method is used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, the connection strength between each node is adjusted through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections. Step 3, Adaptive Optimization and Model Configuration: The SSOA adaptive optimization algorithm is used to dynamically adjust the important parameters in fuzzy clustering, namely the number of clusters c and the fuzzy index m, thereby optimizing the structural parameters of the neural network. This optimization algorithm automatically selects the most suitable parameters based on the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, so that the model can automatically adjust according to different data features, ensuring the maximization of training effect. Step 4, Feature Expansion and Neural Network Training: Based on the features obtained by the fuzzy clustering algorithm and the multinomial feature expansion technique, a feature set with higher expressive power is constructed and passed as input to the neural network for training. By using the adaptive entropy activation function, the network can select a suitable activation function according to the complexity of the input data, thereby improving the model's learning ability and enabling it to better handle complex threat patterns. Step 4.1, Feature Expansion and Combination: In this stage, the features obtained from fuzzy clustering are combined with multinomial features to expand the feature space. Specifically, we perform multinomial expansion on the original features to increase their nonlinear representation capability. These multinomial features are generated using the following formula: , Where X is the original feature, Let be the i-th power of the original features, and n be the highest power of the required polynomial. In this way, we transform the original feature set into a more complex feature space to improve the model's ability to learn complex patterns. Then, we concatenate the fuzzy clustering results with these extended features to form a new feature set. , Step 4.2: Generate Clustering Rules: Generate corresponding rules based on the fuzzy clustering results. Each rule is represented as a condition-result structure, specifically: , in, Indicates features, Indicates the range of values ​​for the feature. The target categories are respectively determined as potential attacks or normal behavior; Specifically, for each cluster, conditions are generated by calculating the feature range of the data points. Data points in the same cluster will have similar feature ranges. Rules are created using these feature ranges to indicate which combinations of feature values ​​correspond to attack or normal behavior. Step 4.3, Neural Network Structure Construction: In this stage, we construct a neural network model based on the optimized parameter configuration. The model structure includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function, which selects either ReLU or Sigmoid activation based on the entropy value of the input data. The neural network structure is represented as follows: , in, Indicates the first The output of the layer, They represent the first Layer weights and biases It is an activation function. During training, the Adam optimizer is used for backpropagation and weight updates to minimize the loss function. For binary classification tasks, cross-entropy loss is used. , in, It's a real label. It is a predicted value. It is the number of samples; Step 4.4, Neural Network Training and Optimization: In this stage, the neural network is trained using training data. During training, the Adam optimizer is used with an appropriate learning rate set, combined with the adaptive entropy activation function, and multiple iterations are performed. Each training iteration optimizes the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. In addition, a learning rate scheduler is used to gradually reduce the learning rate to further optimize the convergence speed and stability of the model. Step 5: Model Evaluation and Validation. After training, a comprehensive performance evaluation of the model is conducted, and various evaluation metrics are calculated, including accuracy, confusion matrix, and classification report. These metrics are used to verify the model's performance in threat behavior detection, and the results are compared with existing methods. Finally, the trained model is saved, and the model is validated in practical applications.

2. The threat behavior detection method based on fuzzy enhanced multinomial neural network according to claim 1, characterized in that: Step 1, data preprocessing and feature extraction, involves preprocessing the training and testing data, including reading the data, converting the data format, extracting features, and encoding labels, to ensure data consistency and provide correct input for subsequent model training. The specific steps are as follows: Step 1.1: Load an existing dataset or generate a new dataset. First, check if the saved training and test sets already exist. If they do, load the existing dataset directly. If it does not exist, a new dataset is generated by parsing the PCAP file; Step 1.2: Obtain and parse PCAP files. Use the glob function to obtain all PCAP files in the specified directory, and parse each file in turn. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data. Step 1.3, Data Cleaning and Label Generation: Using the `generate_labels` function, labels are generated based on the characteristics of each data packet. Based on traffic characteristics, it is determined whether the traffic is an attack type, and the corresponding attack labels are generated together with normal traffic. , Here, dpkts is the number of packets at the destination, and proto is the protocol type. If the condition is met, the label is attack type 1; otherwise, it is normal traffic 0. A similar condition judgment method is used for other attack types. Step 1.4, Data Merging and Column Processing: Append the parsing results of each file to a total DataFrame, remove unnecessary columns to avoid processing too many category values, delete rows containing null values, encode protocol columns, process all non-numeric protocol types, and ensure data consistency. Step 1.5: Label Encoding of Categorical Variables. This step involves label encoding of categorical variables in the dataset, converting non-numerical features, protocol types, and source addresses into numeric types for subsequent model use. This is done using LabelEncoder. ； Step 1.6, Data Scaling and Resampling: Standardize the numerical features in the dataset using MinMaxScaler to normalize all feature values ​​to between 0 and 1. Then, resample using ADASYN to ensure a balanced class distribution and prevent data imbalance from affecting model performance. ； Step 1.7: Divide the data into training and testing sets. Divide the data into training and testing sets in a 7:3 ratio to ensure that the model can be trained and validated. Finally, save the dataset containing the training and testing sets to a local file for later loading and use. Step 1.8, Feature Extraction and Standardization: Use MinMaxScaler to standardize the features to ensure that each feature value of the data is at the same scale, avoid bias during model training due to different magnitudes of features, and ensure that each feature contributes equally to the model. Step 1.9, Label Encoding and Data Partitioning: Label all non-numerical features and divide the dataset into training and testing sets. This operation ensures that the model can adapt to different traffic types and can effectively learn and evaluate during the training and testing phases.

3. The threat behavior detection method based on fuzzy augmented multinomial neural network according to claim 1, characterized in that: Step 2 introduces fuzzy clustering and similarity calculation. The Fuzzy C-means Clustering (FCM) algorithm is used to perform fuzzy clustering of the data, effectively dividing it into multiple fuzzy categories. During this process, the cosine similarity method is used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, a dynamic weighting method is used to adjust the connection strength between nodes to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections. The specific steps are as follows: Step 2.1, Calculate the similarity matrix: First, calculate the similarity between data points. One commonly used similarity measure is cosine similarity, whose formula is: ， in, and These are the feature vectors of two data points. and These are their Euclidean norms, and It is the dot product of these two vectors. By calculating the cosine similarity between all data points, a similarity matrix is ​​obtained, where each element in the matrix represents the similarity between two data points. Step 2.2, Dynamically Weighted Similarity Matrix: After calculating the similarity matrix, the similarity is dynamically weighted. The purpose of weighting is to enhance the connection between data points with high similarity and to reduce the influence between points with low similarity through a decay factor. The weighting formula is as follows: ， in, It is the weighted similarity between data point i and data point j. The original similarity value is obtained by calculating cosine similarity. It is a decay factor with a value between 0 and 1. This weighting process makes high-similarity connections more prominent, while low-similarity connections are weakened, thereby improving the quality of clustering. Step 2.3, Fuzzy C-means Clustering (FCM): The FCM algorithm is used to cluster the data. The goal of FCM is to optimize the membership matrix by minimizing an objective function. and cluster center The mathematical expression for the objective function is: ， in: Data points Cluster centers Membership degree, representing the membership degree of a data point Clustering The degree of , with values ​​between 0 and 1; It is a fuzziness index, which controls the degree of fuzziness in clustering; a larger index indicates a higher fuzziness. The value makes the membership matrix Smoother, smaller The value makes clustering more accurate; Data points Cluster centers The Euclidean distance between the data points represents the similarity between the data points and the cluster centers. It is the number of clusters. It refers to the number of data points; By continuously iteratively updating the membership matrix and cluster center The FCM algorithm updates the membership matrix in each iteration until the objective function converges, so that the membership of data points is more reasonably distributed among the clusters. Step 2.4: Output fuzzy clustering results: After clustering is complete, output the final membership matrix. and cluster center Membership matrix Each element in Representing data points Clustering Membership degree, final cluster center It is the "average" feature of data points in each cluster, which represents the center position of each cluster.

4. The threat behavior detection method based on fuzzy enhanced multinomial neural network according to claim 1, characterized in that: Step 3 is adaptive optimization and model configuration. The SSOA adaptive optimization algorithm dynamically adjusts the number of clusters *c* and the fuzzy index *m* in fuzzy clustering, thereby optimizing the structural parameters of the neural network. This optimization algorithm automatically selects the most suitable parameters based on the characteristics of network traffic, thus improving the model's adaptability and accuracy. The optimization process dynamically adjusts parameters by monitoring the fitness during training, enabling the model to automatically adjust according to different data features and ensuring maximum training effectiveness. The specific steps are as follows: Step 3.1, Preliminary Model Parameter Setting: First, preliminary model parameters need to be set. This includes the clustering parameters in the fuzzy C-means clustering algorithm, such as the number of clusters. And fuzzy index And the neural network structure parameters, when initially setting them, use some common empirical values, or select these parameters through simple heuristics, fuzziness index. Set the number of clusters to between 1.5 and 2.

5. The initial settings are determined based on the characteristics of the data, and a reasonable value is selected through cross-validation. Step 3.2: Dynamically adjust the model using the adaptive optimization algorithm SSOA: The key parameters of the model, including the number of clusters, are dynamically adjusted using the adaptive optimization algorithm SSOA. Fuzzy Index The number of network layers in the neural network, the number of neurons in each layer, and the decision threshold for threat detection used in binary classification tasks; The goal of adaptive optimization algorithms is to minimize the model's loss function and find the optimal configuration by automatically adjusting different hyperparameters. SSOA searches for the optimal solution by simulating the behavior of particle swarms in nature, and the particle update rule is expressed by the following formula: ， ， Represents particles In the The speed of generation Represents particles In the The position of the generation, It is a particle Its own optimal position The optimal position globally. and It is the acceleration constant. and It is a random value, ranging from [0,1]. It is the inertial weight, used to balance the exploration and utilization capabilities of particles. Through iterative optimization, SSOA can adjust the model parameters to minimize the loss function, thereby obtaining the optimal model configuration. Step 3.3, Fitness Function and Parameter Tuning: In the adaptive optimization process, a fitness function needs to be defined to evaluate the model's performance. The fitness function is related to the model's prediction accuracy, loss value, and F1 score. The fitness function is expressed as: ， in, It is a loss function. These are the model's predicted values. The real labels are used to optimize the model by adjusting the model parameters to minimize the loss and thus improve the fitness. Fitness monitoring allows us to dynamically adjust the parameters in the particle swarm optimization algorithm. If the optimization process fails to converge in the early stage, the exploration ability can be enhanced by increasing the inertia weight or adjusting the acceleration constant. In the later stage, reducing the inertia weight helps to accelerate the convergence of the algorithm. Step 3.4, Parameter Optimization Result Output: Through adaptive optimization, the optimal model parameters are finally obtained. At this point, the optimized cluster number... Fuzzy Index The number of layers in a neural network Number of neurons per layer Both the decision threshold and the parameter settings can be adapted to the needs of specific datasets and tasks. These optimization results provide the best parameter configuration for subsequent model training and prediction.

5. The threat behavior detection method based on fuzzy augmented multinomial neural network according to claim 1, characterized in that: Step 5, Model Evaluation and Validation, involves a comprehensive performance evaluation of the model after training. Various evaluation metrics are calculated, including accuracy, confusion matrix, and classification report. These metrics validate the model's performance in threat behavior detection, and the results are compared with existing methods. Finally, the trained model is saved, and its practical application is validated. The specific steps are as follows: Step 5.1: Evaluate the generated rules: In model evaluation, not only is the accuracy of the model assessed, but the effectiveness of the generated clustering rules also needs to be checked. Each rule corresponds to a behavioral pattern. The formula for generating the rules is: For each cluster, a rule is generated, and the accuracy and reliability of the rule are verified through a test set. The reasonableness of the generated rule is judged by the following conditions. If the generated rule does not meet expectations, the system will make corrections and slightly adjust the rule range to obtain more diverse and accurate rules. Step 5.2, Model Evaluation Metric Calculation: After training, the model is evaluated using a test set. Evaluation metrics include accuracy, confusion matrix, precision, recall, and F1 score. The accuracy formula is: ， In this system, TP (True Positive) represents a true positive, TN (True Negative) represents a true negative, FP (False Positive) represents a false positive, and FN (False Negative) represents a false negative. Furthermore, the F1 score is used to comprehensively consider precision and recall. ， The formulas for calculating precision and recall are as follows: ； Step 5.2: Compare the performance of this model with other existing threat detection methods.

Images