Feature selection method, electronic device, readable storage medium, and program product

Abstract

The present application discloses a feature selection method, electronic device, readable storage medium, and program product, and relates to the field of data processing technology. The present application selects from associated features of newly added features, constrains the directional expansion of feature subsets based on the correlation between features, fully considers the effectiveness of feature subsets for data classification when selecting feature subsets, and terminates feature selection when the next target feature does not exist, so that the selected feature subset is the optimal set of candidate features that contributes to data classification, reduces the probability of redundant features not being removed or valid features being mistakenly deleted, and effectively improves the accuracy of data selection.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a feature selection method, electronic device, readable storage medium, and program product. Background Art

[0002] With the development of the internet and the surge in the number of users, especially in the era of big data and cloud computing, the amount of network data has exploded. To perform efficient and accurate data detection, it is necessary to select stable and effective feature subsets from the massive amount of data features. For example, in intrusion detection scenarios, it is necessary to select the features that contribute most to determining whether the network traffic has been attacked from a large amount of network traffic data, thereby ensuring the efficiency and accuracy of intrusion detection.

[0003] The Fast Correlation-based Feature Selection (FCBC) algorithm is a representative feature selection algorithm. It removes irrelevant features and uses a sequential forward search algorithm to remove redundant features. However, when removing redundant features, the FCBC algorithm only focuses on the correlation between features and removes redundant features based on pairwise feature comparisons, without considering the validity of the resulting feature subset.

[0004] Therefore, redundant features may remain in the feature subset selected by the above feature selection algorithm or valid features may be mistakenly deleted, and the accuracy of feature selection needs to be improved. Summary of the Invention

[0005] The present application provides a feature selection method, an electronic device, a readable storage medium, and a program product to at least solve the problem of low feature selection accuracy in related technologies.

[0006] This application provides a feature selection method, including:

[0007] Select new features from multiple candidate features and add them to the feature subset;

[0008] Determining at least one associated feature of the newly added feature from a plurality of candidate features;

[0009] If, based on the classification contribution of each associated feature, it is determined that at least one associated feature contains a target feature corresponding to the newly added feature, the target feature is added to the feature subset. The classification contribution of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset.

[0010] The target feature is used as a new feature of the feature subset, and the next target feature is searched among multiple candidate features until the next target feature does not exist among the multiple candidate features, thereby obtaining a feature subset corresponding to the multiple candidate features.

[0011] The present application also provides an electronic device, comprising: a memory for storing a computer program; and a processor for implementing the steps of any of the above-mentioned feature selection methods when executing the computer program.

[0012] The present application also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above-mentioned feature selection methods are implemented.

[0013] The present application also provides a computer program product, comprising a computer program, which implements the steps of any of the above-mentioned feature selection methods when executed by a processor.

[0014] This application selects from the associated features of the newly added features, constrains the directional expansion of the feature subset based on the correlation between features, fully considers the effectiveness of the feature subset for data classification when selecting the feature subset, and ends feature selection when the next target feature does not exist, so that the selected feature subset is the optimal set of candidate features that contributes to data classification, reduces the probability of redundant features not being removed or valid features being mistakenly deleted, and effectively improves the accuracy of data selection. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0016] Figure 1 A flow chart of a feature selection method provided in an embodiment of the present application;

[0017] Figure 2 A schematic diagram of a navigable small-world graph provided in an embodiment of the present application;

[0018] Figure 3 A schematic diagram of an intrusion detection process provided in an embodiment of the present application;

[0019] Figure 4 A schematic diagram of the structure of a feature selection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0021] It should be noted that, in the description of this application, the terms "comprises," "includes," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. The terms "first," "second," etc., in this application are used to distinguish similar objects, and are not used to describe a particular order or sequence.

[0022] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0023] The embodiment of the present application provides a feature selection method. Figure 1 This is a flow chart of a feature selection method provided in an embodiment of the present application. The following is a flow chart of a feature selection method based on the execution process of the feature selection method. Figure 1 The method flow shown is described in detail.

[0024] like Figure 1 As shown in Figure 2, the feature selection method includes the following steps:

[0025] S101. Select a new feature from multiple candidate features and add it to the feature subset.

[0026] Candidate features refer to features that are initially screened from the original sample data, which may contain redundant features that need to be removed.

[0027] Specifically, raw sample data consists of multiple pieces of data, each of which corresponds to multiple raw features and a corresponding category. For example, in a network intrusion detection scenario, raw sample data is divided into network traffic data during an attack (abnormal data) and network traffic data during a non-attack (normal data).

[0028] New features refer to the starting features that are selected into the feature subset for the first time, and the feature subset is a dynamically generated feature set used to store the valid features that are finally selected.

[0029] The step of selecting a new feature from among the multiple candidate features and adding it to the feature subset includes: adding a candidate feature having the highest correlation with the data classification result from among the multiple candidate features as the new feature to the feature subset.

[0030] The data classification result is the category to which the data corresponding to the candidate feature belongs. The degree of correlation between the candidate feature and the data classification result reflects the distinguishing power of the candidate feature in distinguishing different data categories.

[0031] The candidate feature with the highest correlation with the data classification result among multiple candidate features is added as the first new feature to the feature subset, which can make the initial feature subset have stronger classification discrimination ability when classifying data, laying the foundation for subsequent associated feature search.

[0032] S102: Determine at least one associated feature of the newly added feature from multiple candidate features.

[0033] Associated features refer to other candidate features among candidate features that have a predefined association relationship with the current newly added feature.

[0034] For example, a navigable small world (NSW) graph is constructed based on multiple features, and at least one associated feature of a newly added feature may be a feature corresponding to at least one vertex connected to the vertex corresponding to the newly added feature in the NSW graph.

[0035] S103. If it is determined based on the classification contribution degree of each associated feature that there is a target feature corresponding to the newly added feature in at least one associated feature, the target feature is added to the feature subset. The classification contribution degree of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset.

[0036] The classification contribution is the strength of the feature subset in distinguishing different data categories, assuming the current associated feature is added to the feature subset. It should be noted that when calculating the classification contribution of each associated feature, this is only the assumption that the associated feature is added to the feature subset, not the actual addition of the associated feature to the feature subset. In this case, the feature subset still only contains the newly added features.

[0037] The target feature is a feature selected from at least one associated feature that can improve the classification effect of the feature subset.

[0038] S104: Use the target feature as a new feature of the feature subset, and search for the next target feature among the multiple candidate features until the next target feature does not exist among the multiple candidate features, thereby obtaining a feature subset corresponding to the multiple candidate features.

[0039] After the target feature is added to the feature subset, it becomes a new feature in the feature subset. The next target feature is then searched for within the candidate features. Each time a target feature is found, it is added to the feature subset and used as a new feature. The search continues until no further target features are found. The process of searching for the next target feature is described in steps S102-S103.

[0040] Specifically, searching for the next target feature among the multiple candidate features includes searching for the next target feature in a difference set between the multiple candidate features and the current feature subset.

[0041] After any candidate feature is added to the feature subset, the candidate feature no longer participates in the subsequent target feature search process as a selected feature, and the selection range of the target feature is at least one candidate feature that is not added to the feature subset.

[0042] If the next target feature does not exist among multiple candidate features, it means that any feature subset that is not currently added to the feature subset cannot improve the data classification effect of the feature subset after being added to the feature subset. It can be determined that the current feature subset can achieve the best data classification effect and the feature screening process is completed.

[0043] The disclosed embodiment selects a new feature from a plurality of candidate features and adds it to a feature subset; determines at least one associated feature of the new feature from the plurality of candidate features; if, based on the classification contribution degree of each associated feature, it is determined that a target feature corresponding to the new feature exists in at least one associated feature, the target feature is added to the feature subset, and the classification contribution degree of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset; uses the target feature as a new feature of the feature subset, searches for the next target feature from the plurality of candidate features until the next target feature does not exist in the plurality of candidate features, and obtains a feature subset corresponding to the plurality of candidate features; selects from the associated features of the new feature, constrains the directional expansion of the feature subset by the correlation between features, fully considers the effectiveness of the feature subset for data classification when selecting the feature subset, and terminates feature selection when the next target feature does not exist, so that the selected feature subset is the optimal set of candidate features that contribute to data classification, reduces the probability of redundant features not being removed or valid features being mistakenly deleted, and effectively improves the accuracy of data selection.

[0044] In some embodiments, if it is determined based on the classification contribution degree of each associated feature that there is a target feature corresponding to the newly added feature in at least one associated feature, the target feature is added to the feature subset, including: if the correlation degree between the feature subset and the data classification result is improved after the associated feature with the largest classification contribution degree in at least one associated feature is added to the feature subset, then the associated feature with the largest classification contribution degree is determined to be the target feature corresponding to the newly added feature.

[0045] If, among at least one associated feature corresponding to the target feature, the associated feature with the greatest classification contribution is added to the feature subset, and the correlation between the feature subset and the data classification result does not increase, it is determined that the next target feature does not exist among the multiple candidate features.

[0046] Each newly added feature corresponds to at least one associated feature. The classification contribution of each associated feature is calculated separately. If the classification contribution of each associated feature indicates that adding the associated feature to the feature subset does not improve the correlation between the feature subset and the data classification results, then the addition of any associated feature will not bring positive improvements to the effectiveness of the feature subset and is therefore considered redundant.

[0047] For example, set the feature subset S f , candidate feature set S. The candidate feature F1 with the greatest correlation with the data classification result is added as a new feature to the feature subset, and in the subsequent feature selection range S r Remove F1 from the equation and it becomes:

[0048] S f =S f +{F1}

[0049] S r =S-{F1}

[0050] Traverse the associated features F of F1 j , calculate S respectively f +{F j Correlation between SC and data classification results f，j , and the correlation SC between the current feature subset and the data classification result f .

[0051] The calculation formula of SC is as follows:

[0052]

[0053] SU is the symmetric uncertainty, which is used to measure the degree of association between features and classes, and between features. The calculation formula is:

[0054]

[0055] N is the number of features, It is the average value of the correlation SU between all features involved in the calculation and the data classification results.

[0056] Variables X and Y refer to two variables corresponding to symmetric uncertainty, such as the associated feature and the feature classification result. IG(X|Y) refers to the mutual information between the two variables, and H(X) and H(Y) refer to the information entropy of the variables.

[0057] The value range of SU is 0-1. The larger the value, the stronger the correlation between the two variables, otherwise the correlation is weaker.

[0058] The value range of SC is 0-1. The larger the value, the stronger the correlation between the feature set (such as feature subset) and the data classification result, otherwise the correlation is weaker.

[0059] For the associated feature F of F1 j , if there is a feature F t Corresponding SC f，t Maximum, and SC f，t Greater than SC f , which means that in feature F t After adding the feature subset, the correlation between the feature subset and the data classification result is most significantly improved, so the feature F is determined. t is the target feature corresponding to the current new feature, then the feature F t Add feature subset S f and remove F in the subsequent feature selection range t , expressed as:

[0060] S f =S f +{F t}

[0061] S r =S-{F t}

[0062] Next, for the newly added feature F in the feature subset t Perform the operations of associated feature search and target feature search until the search is completed and the final feature subset S is obtained. f .

[0063] The disclosed embodiment ensures that the effectiveness of the feature subset for the data classification result continues to improve by selecting at least one associated feature and, after adding the feature subset, increasing the correlation between the feature subset and the data classification result; at the same time, selecting only the highest associated feature can minimize the feature dimension of the feature subset finally selected, and provide the most effective feature support for actual data classification with as few feature dimensions as possible.

[0064] In some embodiments, before selecting a new feature from multiple candidate features to add to the feature subset, the method also includes: calculating the correlation between each original feature and the data classification result among multiple original features; and determining at least one original feature whose correlation with the data classification result is greater than a preset correlation threshold as a candidate feature.

[0065] The original features include the original features corresponding to the general preset data set and the original features corresponding to the real-time collection data set.

[0066] Raw features are unprocessed features extracted from data. Raw features include those corresponding to common preset datasets. For example, in intrusion detection scenarios, commonly used common preset datasets include the KDDCup99 dataset, the CICIDS2017 dataset, and the UNSW-NB15 dataset.

[0067] Among them, the KDDCup99 dataset consists of 4.9 million network connections, each of which has 41 features and 1 label. The label is used to distinguish whether the network connection is normal data or abnormal data generated by network attacks.

[0068] The CICIDS2017 dataset focuses on simulating real-time network environments, including user behavior data and the latest attack behavior data. Each behavior record in the dataset contains 80 network traffic features and the attack event corresponding to each record.

[0069] The UNSW-NB15 dataset contains approximately 2.6 million traffic records, each of which corresponds to 49 features and two labels, which are used to distinguish whether each traffic record is a normal number or anomaly data, and the attack event corresponding to the anomaly data.

[0070] The original features also include original features corresponding to real-time collection data sets. The real-time collection data sets are network data in actual applications, including but not limited to network traffic data, host logs, database access logs, etc.

[0071] For newly captured real-time data sets, analysis and feature extraction operations are required to meet the requirements of feature selection. Specifically, the newly captured data is analyzed to determine whether it is normal data or abnormal data and to classify it; and feature extraction is performed on the captured data in combination with the features corresponding to the general preset data set.

[0072] Taking network traffic data as an example, the original features include protocol type, time, source IP, source port, destination IP, destination port, traffic duration, number of packets per second, number of bytes per second, average packet arrival time interval (maximum, minimum, standard deviation), total number of forward packets, etc.

[0073] For each original feature, the correlation degree SU between the original feature and the data classification result is calculated respectively. The specific calculation formula is shown in the above embodiment and will not be repeated here.

[0074] Furthermore, the original features are sorted in descending order according to the correlation degree, a preset correlation degree threshold is set, and only features with a correlation degree greater than the preset correlation degree threshold are retained to obtain at least one candidate feature.

[0075] This disclosed embodiment performs a preliminary screening of raw features based on their correlation with the data classification results, removing clearly irrelevant features to avoid inefficient computations during subsequent feature selection. Furthermore, by combining a pre-set general dataset with a real-time acquisition dataset as feature sources, and combining the characteristics of both known and actual data for feature selection, the resulting selected feature subset possesses high stability.

[0076] In some embodiments, the association relationship between multiple candidate features is determined based on the degree of association between a set of every two candidate features and the data classification result; accordingly, at least one associated feature of a newly added feature is determined among the multiple candidate features, including: determining at least one associated feature of a newly added feature based on the association relationship between the multiple candidate features.

[0077] Among them, according to the degree of correlation between the set composed of each two candidate features and the data classification result, the correlation relationship between multiple candidate features is determined, including: taking the candidate features as vertices, determining the edges between multiple vertices according to the degree of correlation between the set composed of each two candidate features and the data classification result; and constructing a navigable small-world graph corresponding to the multiple candidate features based on the vertices and the edges.

[0078] Navigable small-world graphs are an algorithmic framework for approximate nearest neighbor search. Figure 2 A schematic diagram of a navigable small world graph provided in an embodiment of the present application. Figure 2 As shown, each vertex in the navigable small-world graph corresponds to a candidate feature, and each edge is the correlation degree SC between the set of two candidate features with an associated relationship and the data classification result.

[0079] The invention discloses a method for determining edges between multiple vertices according to the degree of correlation between a set consisting of every two candidate features and a data classification result, comprising: inserting vertices corresponding to multiple candidate features in a navigable small-world graph in descending order of correlation with the data classification result; when inserting a current vertex, determining at least one feature evaluation set consisting of the candidate features corresponding to the current vertex and the candidate features corresponding to existing vertices in the navigable small-world graph, wherein the feature evaluation set includes the candidate features corresponding to the current vertex and the candidate features corresponding to an existing vertex; calculating the degree of correlation between at least one feature evaluation set and the data classification result, determining m feature evaluation sets with the highest correlation with the data classification result as target sets corresponding to the current vertex, wherein m is a preset positive integer; and connecting the current vertex with the existing vertices corresponding to the target set to obtain m edges corresponding to the current vertex.

[0080] The following describes in detail the process of constructing a navigable small-world graph.

[0081] Let S new is the set of candidate features contained in the current navigable small-world graph, S old is the candidate feature set that is not added to the navigable small-world graph. In the initial state, S new is an empty set, S old is the candidate feature set S, expressed as:

[0082] S new ={}

[0083] S old =S

[0084] in,

[0085] S={F1,F2,……F n}

[0086] There are n candidate features in total, and from F1 to F n Sort by the degree of relevance to the data classification results from high to low.

[0087] From S old Select F1 as the first vertex to be inserted into the navigable small-world graph, expressed as:

[0088] S new ={F1},S old =S old -F1

[0089] Since the current navigable small-world graph has only one vertex, it is impossible to establish an association relationship between vertices. F1 is directly selected from Sold as the current vertex to be inserted into the navigable small-world graph, which is expressed as:

[0090] S new={F1},S old =S old -F1

[0091] Calculate the set S 1,2 = the correlation degree SC between {F1, F2} and data classification results 1,2 , connect F1 and F2, put SC 1,2 as the weight of the edge between F1 and F2.

[0092] Set the maximum number of vertices connected to each vertex m, from S old Select F i As the current vertex inserted into the navigable small-world graph, for example, when i is 2, it is expressed as:

[0093] S new =S new +F2, S old =S old -F2

[0094] Traverse and calculate S new Each candidate feature is respectively i The correlation between the feature evaluation sets composed of the two candidate features is calculated, and the top m feature evaluation sets with the largest correlation are selected as the target set. The points corresponding to the two candidate features in the target set are connected, and the corresponding SC is used as the weight of the edge between the points corresponding to the two candidate features.

[0095] The correlation between the feature evaluation set and the data classification results represents the contribution of the current vertex and another candidate feature in the feature evaluation set to the effectiveness of the feature subset. The higher the correlation between the feature evaluation set and the data classification results, the more favorable the contribution of the two candidate features to the effectiveness of the feature subset when they are combined into the feature subset.

[0096] Repeat the above process until all elements in the candidate feature set S are traversed.

[0097] like Figure 2 As shown, taking the candidate features F1, F2, F3, F4, F5, and m as 2 as an example, the process of constructing a navigable small world according to the above steps is as follows:

[0098] Take F1 as the first vertex in the navigable small world.

[0099] Take F2 and calculate the correlation SC between the feature evaluation set {F1, F2} and the data classification result 1,2 , connecting the vertices corresponding to F1 and F2 and the weight of the edge is SC 1,2 .

[0100] Take F3 and calculate the correlation SC between the feature evaluation set {F1, F3}, the feature evaluation set {F2, F3} and the data classification result respectively 1,2 , SC 2,3 , connecting the vertices corresponding to F1 and F2 and its edge weight is SC 1,2 , connecting the vertices corresponding to F2 and F3 and its edge weight is SC 2,3 .

[0101] Take F4 and calculate the correlation degree SC between the feature evaluation set {F1, F4}, the feature evaluation set {F2, F4}, the feature evaluation set {F3, F4} and the data classification result respectively 1,4 , SC 2,4 , SC 3,4 , if SC 1,4 >SC 3,4 >SC 2,4 , then determine the feature evaluation set {F1, F4} and the feature evaluation set {F3, F4} as the target set, connect the vertices corresponding to F1 and F4 and the edge weight is SC 1,4 , connecting the vertices corresponding to F3 and F4 and its edge weight is SC 3,4 .

[0102] Take F5 and calculate the correlation degree SC between the feature evaluation set {F1, F5}, feature evaluation set {F2, F5}, feature evaluation set {F3, F5}, feature evaluation set {F4, F5} and the data classification result respectively 1,5 , SC 2,5 , SC 3,5 , SC 4,5 , if SC 2,5 >SC 4,5 >SC 3,5 >SC 1,5 , then determine the feature evaluation set {F3, F5} and the feature evaluation set {F4, F5} as the target set, connect the vertices corresponding to F3 and F5 and the edge weight is SC 3,5 , connecting the vertices corresponding to F4 and F5 and its edge weight is SC 4,5 .

[0103] So far, if Figure 2 The navigable small-world graph shown is constructed.

[0104] The disclosed embodiment constructs a navigable small-world graph as the basis for feature selection, wherein every two connected candidate features, when present together, provide more effective information for the data classification results, thereby ensuring the subsequent rapid selection of stable and effective feature subsets.

[0105] In some embodiments, the feature selection method further includes: performing model training based on the original sample data corresponding to multiple candidate features to obtain multiple candidate data classification models; and determining a target data classification model from the multiple candidate data classification models based on the data classification accuracy of the candidate data classification models.

[0106] Optionally, the original sample data is divided into multiple parts, one of which is used to verify the data classification accuracy of the candidate data classification model, and the remaining original sample data is used for model training.

[0107] Among them, each data in the original sample data corresponds to its own data classification label. Different types of classifiers are trained according to the sample data set, such as Naive Bayes (NB), Support Vector Machine (Support Vector Machine), Random Forest (RF) and other types of classifiers, to obtain multiple candidate data classification models.

[0108] Each type of classifier is trained multiple times using multiple sample datasets. After each training session, the data classification accuracy of each candidate data classification model is calculated. After the multiple training sessions are completed, the average of the data classification accuracy after each training session is calculated to obtain the final accuracy of the candidate data classification model.

[0109] Accordingly, according to the data classification accuracy of the candidate data classification model, the target data classification model is determined from multiple candidate data classification models, including: according to the final accuracy of each candidate data classification model, selecting the model with the highest final accuracy from multiple candidate data classification models as the target data classification model.

[0110] In this step, after training multiple candidate data classification models with the same original sample data, the optimal target data classification model is determined to find the classifier with the best decision-making ability and improve the accuracy of subsequent data classification. At the same time, the same candidate data classification model is trained multiple times with multiple copies of data, and the accuracy of the candidate data classification model is evaluated with the average value of the data classification accuracy after each training, so as to avoid the impact of occasional low accuracy on the true ability of the candidate data classification model and ensure the objectivity of the target data classification model selection.

[0111] On the basis of the above embodiment, the data to be detected is classified by using the target data classification model.

[0112] Specifically, the data to be detected is obtained, and the data to be detected includes multiple data features; the multiple data features of the data to be detected are screened according to the feature subset to obtain a detection feature set of the data to be detected, and the elements in the feature subset correspond one-to-one to the elements in the detection feature set; the detection feature set is input into the target data classification model to obtain the classification result of the data to be detected output by the target data classification model.

[0113] The data to be detected is the actual data that is acquired in real time and needs to be classified. For example, in a network intrusion detection scenario, the data to be detected can be network traffic data.

[0114] The data to be detected corresponds to multiple data features, including valid features corresponding to the feature subset and other redundant features. Feature extraction is performed on the data to be detected based on the feature subset to obtain a detection feature set. The detection feature set only includes at least one feature corresponding to the feature subset.

[0115] For example, in the network intrusion detection scenario, in the early feature selection process, the feature subset dimension is determined to be 5, and the features are source port, source IP, protocol type, traffic duration, and number of packets per second; for the network data to be detected, the five features of source port, source IP, protocol type, traffic duration, and number of packets per second are extracted as the detection feature set.

[0116] Furthermore, by inputting the detection feature set into the target data classification model, the classification result of the data to be detected output by the target data classification model can be obtained.

[0117] Figure 3 This is a schematic diagram of an intrusion detection process provided by an embodiment of the present application. Figure 3 As shown, the whole process of intrusion detection based on the feature selection method in the above embodiment includes the following steps:

[0118] S301. Dataset construction.

[0119] A general preset data set and a real-time collected data set are obtained, and data preprocessing is performed on the general preset data set and the real-time collected data set to obtain multiple original features and corresponding data categories.

[0120] S302: Constructing a navigable small-world graph (NSW).

[0121] Calculate the correlation between each of the multiple original features and the data classification result; determine at least one original feature whose correlation with the data classification result is greater than a preset correlation threshold as a candidate feature to preliminarily remove irrelevant features.

[0122] Taking candidate features as vertices, edges between multiple vertices are determined according to the degree of association between the set composed of each two candidate features and the data classification results; a navigable small-world graph corresponding to multiple candidate features is constructed based on the vertices and edges.

[0123] The specific implementation process of determining the edges between multiple vertices according to the degree of association between the set composed of each two candidate features and the data classification result is shown in the above embodiment and will not be repeated here.

[0124] S303: Feature selection.

[0125] The candidate feature with the highest correlation with the data classification result among the multiple candidate features is added as a new feature to the feature subset. Based on the association relationship between the candidate features in the navigable small-world graph, at least one associated feature of the new feature is determined, that is, at least one associated feature connected to the new feature in the navigable small-world graph.

[0126] If, based on the classification contribution of each associated feature, it is determined that at least one associated feature contains a target feature corresponding to the newly added feature, the target feature is added to the feature subset. The classification contribution of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset.

[0127] The target feature is used as a new feature of the feature subset, and the next target feature is searched among multiple candidate features until the next target feature does not exist among the multiple candidate features. The feature subset corresponding to the multiple candidate features is obtained, and the feature selection is completed.

[0128] S304: Constructing an intrusion detection model.

[0129] Model training is performed based on original sample data corresponding to multiple candidate features to obtain multiple candidate data classification models; and a target data classification model is determined from the multiple candidate data classification models based on the data classification accuracy of the candidate data classification models.

[0130] Specifically, the original sample data is divided into multiple parts, one of which is used to verify the data classification accuracy of the candidate data classification model, and the remaining original sample data is used for model training.

[0131] Each classifier type is trained multiple times using multiple sample datasets. After each training session, the classification accuracy of each candidate data classification model is calculated. After the training sessions are complete, the average classification accuracy is calculated to obtain the final accuracy of the candidate data classification model. Based on the final accuracy of each candidate data classification model, the model with the highest final accuracy is selected from the multiple candidate data classification models as the target data classification model.

[0132] S305: Intrusion detection.

[0133] The features of the data to be detected captured in real time are extracted according to the feature subset to obtain a detection feature set of the data to be detected, and the elements in the feature subset correspond one to one with the elements in the detection feature set.

[0134] The detection feature set is input into the target data classification model to obtain the classification result of the data to be detected output by the target data classification model to determine whether intrusion detection occurs currently.

[0135] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus the necessary general hardware platform, and of course it can also be implemented by hardware, but in many cases the former is a better implementation method.

[0136] An embodiment of the present application also provides a feature selection device. Figure 4 A structural diagram of a feature selection device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the feature selection device 40 includes a first selection module 41, a first determination module 42, a adding module 43, and a search module 44; wherein the first selection module 41 is used to select a new feature from multiple candidate features and add it to a feature subset; the first determination module 42 is used to determine at least one associated feature of the new feature from multiple candidate features; the adding module 43 is used to add the target feature to the feature subset if it is determined that there is a target feature corresponding to the new feature in at least one associated feature based on the classification contribution degree of each associated feature, and the classification contribution degree of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset; the search module 44 is used to use the target feature as a new feature of the feature subset, and search for the next target feature among multiple candidate features until the next target feature does not exist in the multiple candidate features, thereby obtaining a feature subset corresponding to the multiple candidate features.

[0137] Optionally, the first selection module 41 is configured to add a candidate feature having the greatest correlation with the data classification result among the multiple candidate features as a new feature to the feature subset.

[0138] Optionally, the adding module 43 is used to determine that the associated feature with the greatest classification contribution among at least one associated feature is the target feature corresponding to the newly added feature if the correlation between the feature subset and the data classification result increases after the associated feature with the greatest classification contribution among at least one associated feature is added to the feature subset.

[0139] Optionally, the search module 44 is also used to determine that the next target feature does not exist in the multiple candidate features if, among at least one associated feature corresponding to the target feature, the associated feature with the greatest classification contribution is added to the feature subset, and the correlation between the feature subset and the data classification result does not increase.

[0140] Optionally, the search module 44 is further configured to search for a next target feature in a difference set between multiple candidate features and the current feature subset.

[0141] Optionally, the feature selection device 40 also includes a second selection module, which includes a first calculation unit and a first determination unit; the first calculation unit is used to calculate the correlation degree between each original feature and the data classification result among multiple original features; the first determination unit is used to determine at least one original feature whose correlation degree with the data classification result is greater than a preset correlation degree threshold as a candidate feature.

[0142] Optionally, the original features include original features corresponding to a general preset data set and original features corresponding to a real-time acquisition data set.

[0143] Optionally, the feature selection device 40 also includes a second determination module, which is used to determine the association relationship between multiple candidate features based on the degree of association between the set consisting of each two candidate features and the data classification result; accordingly, the first determination module 42 is also used to determine at least one associated feature of the newly added feature based on the association relationship between the multiple candidate features.

[0144] Optionally, the second determination module includes a second determination unit and a construction unit; the second determination unit is used to determine the edges between multiple vertices based on the candidate features as vertices and the degree of correlation between the set consisting of each two candidate features and the data classification results; the construction unit is used to construct a navigable small-world graph corresponding to multiple candidate features based on the vertices and edges.

[0145] Optionally, the second determination unit is used to insert vertices corresponding to multiple candidate features in the navigable small-world graph in descending order of correlation with the data classification result; when inserting the current vertex, determine at least one feature evaluation set consisting of the candidate feature corresponding to the current vertex and the candidate features corresponding to existing vertices in the navigable small-world graph, the feature evaluation set including the candidate feature corresponding to the current vertex and the candidate feature corresponding to an existing vertex; calculate the correlation between at least one feature evaluation set and the data classification result respectively, and determine the m feature evaluation sets with the highest correlation with the data classification result as the target sets corresponding to the current vertex, where m is a preset positive integer; connect the current vertex with the existing vertices corresponding to the target set to obtain m edges corresponding to the current vertex.

[0146] Optionally, the feature selection device 40 also includes a model training module for performing model training based on the original sample data corresponding to multiple candidate features to obtain multiple candidate data classification models; and determining the target data classification model from the multiple candidate data classification models based on the data classification accuracy of the candidate data classification models.

[0147] Optionally, the feature selection device 40 also includes a detection module, which includes an acquisition unit, a screening unit, and a detection unit; the acquisition unit is used to acquire the data to be detected, and the data to be detected includes multiple data features; the screening unit is used to screen the multiple data features of the data to be detected according to the feature subset to obtain a detection feature set of the data to be detected, and the elements in the feature subset correspond one-to-one to the elements in the detection feature set; the detection unit is used to input the detection feature set into the target data classification model to obtain the classification result of the data to be detected output by the target data classification model.

[0148] For the description of the features in the embodiment corresponding to the feature selection device, please refer to the relevant description of the embodiment corresponding to the feature selection method, and no further details will be given here.

[0149] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any of the above-mentioned feature selection method embodiments.

[0150] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above-mentioned feature selection method embodiments when run.

[0151] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0152] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any one of the above-mentioned feature selection method embodiments are implemented.

[0153] An embodiment of the present application further provides another computer program product, comprising a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above-mentioned feature selection method embodiments are implemented.

[0154] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0155] The above is a detailed introduction to a feature selection method, electronic device, readable storage medium, and program product provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only intended to help understand the method and core ideas of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, several improvements and modifications may be made to the present application, and these improvements and modifications also fall within the scope of protection of the claims of the present application.

Claims

1. A feature selection method, characterized in that: include: Select new features from multiple candidate features and add them to the feature subset; Determining at least one associated feature of the newly added feature from the multiple candidate features; If it is determined, based on the classification contribution degree of each of the associated features, that a target feature corresponding to the newly added feature exists in the at least one associated feature, then the target feature is added to the feature subset, where the classification contribution degree of the associated feature is the degree of correlation between the feature subset and the data classification result after the associated feature is added to the feature subset; The target feature is used as a new feature of the feature subset, and a next target feature is searched for among the multiple candidate features until the next target feature does not exist among the multiple candidate features, thereby obtaining a feature subset corresponding to the multiple candidate features.

2. The feature selection method according to claim 1, wherein: The step of selecting a new feature from a plurality of candidate features and adding it to the feature subset includes: The candidate feature with the greatest correlation with the data classification result among the multiple candidate features is added as a new feature to the feature subset.

3. The feature selection method according to claim 1, wherein: If it is determined, based on the classification contribution degree of each of the associated features, that a target feature corresponding to the newly added feature exists in the at least one associated feature, then the target feature is added to the feature subset, including: If, among the at least one associated feature, the associated feature with the greatest classification contribution is added to the feature subset, the correlation between the feature subset and the data classification result increases, then the associated feature with the greatest classification contribution is determined as the target feature corresponding to the newly added feature.

4. The feature selection method according to claim 1, wherein: After taking the target feature as a new feature of the feature subset and searching for a next target feature among the multiple candidate features, the method further includes: If, among at least one associated feature corresponding to the target feature, the associated feature with the greatest classification contribution is added to the feature subset, the correlation between the feature subset and the data classification result does not increase, it is determined that the next target feature does not exist among the multiple candidate features.

5. The feature selection method according to claim 1, wherein: The step of searching for the next target feature among the plurality of candidate features includes: The next target feature is searched in the difference set between the plurality of candidate features and the current feature subset.

6. The feature selection method according to claim 1, wherein: Before selecting a new feature from a plurality of candidate features and adding it to the feature subset, the method further includes: Calculating the correlation between each of the plurality of original features and the data classification result; At least one original feature whose correlation with the data classification result is greater than a preset correlation threshold is determined as the candidate feature.

7. The feature selection method according to claim 6, wherein: The original features include original features corresponding to a general preset data set and original features corresponding to a real-time acquisition data set.

8. The feature selection method according to claim 1, wherein: The method further comprises: Determining the association relationship between the plurality of candidate features according to the degree of association between a set consisting of each two candidate features and the data classification result; Accordingly, determining at least one associated feature of the newly added feature from the multiple candidate features includes: At least one associated feature of the newly added feature is determined based on the association relationship between the multiple candidate features.

9. The feature selection method according to claim 8, wherein: The determining of the association relationship between the plurality of candidate features according to the degree of association between a set consisting of each two candidate features and the data classification result includes: Taking the candidate features as vertices, determining edges between a plurality of vertices according to the degree of association between a set consisting of every two candidate features and the data classification result; A navigable small-world graph corresponding to the plurality of candidate features is constructed according to the vertices and the edges.

10. The feature selection method according to claim 9, characterized in that: Determining edges between a plurality of vertices according to a degree of association between a set consisting of each two candidate features and the data classification result includes: Inserting vertices corresponding to the plurality of candidate features into the navigable small-world graph in descending order of relevance to the data classification result; When inserting a current vertex, determining at least one feature evaluation set consisting of candidate features corresponding to the current vertex and candidate features corresponding to existing vertices in the navigable small-world graph, the feature evaluation set including the candidate feature corresponding to the current vertex and a candidate feature corresponding to an existing vertex; Calculating the correlation between the at least one feature evaluation set and the data classification result respectively, and determining m feature evaluation sets with the highest correlation with the data classification result as target sets corresponding to the current vertex, where m is a preset positive integer; Connect the current vertex with the existing vertices corresponding to the target set to obtain m edges corresponding to the current vertex.

11. The feature selection method according to claim 1, wherein: The method further comprises: Performing model training based on the original sample data corresponding to the multiple candidate features to obtain multiple candidate data classification models; A target data classification model is determined from the multiple candidate data classification models according to the data classification accuracy of the candidate data classification models.

12. The feature selection method according to claim 11, wherein: The method further comprises: Acquiring data to be detected, where the data to be detected includes multiple data features; screening multiple data features of the data to be detected according to the feature subset to obtain a detection feature set of the data to be detected, wherein the elements in the feature subset correspond one-to-one to the elements in the detection feature set; The detection feature set is input into the target data classification model to obtain the classification result of the data to be detected output by the target data classification model.

13. An electronic device, characterized in that: include: memory for storing computer programs; A processor, configured to implement the steps of the feature selection method according to any one of claims 1 to 12 when executing the computer program.

14. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program, when executed by a processor, implements the steps of the feature selection method according to any one of claims 1 to 12.

15. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the feature selection method according to any one of claims 1 to 12 are implemented.

Images