Network intrusion detection method and system based on adaptive behavior modeling, and storage medium
Through the adaptive behavior modeling method, network traffic data is collected in real time, abnormal detection thresholds are dynamically adjusted and feature extraction is optimized, which solves the problem of detection performance degradation caused by changes in the network environment and achieves efficient and accurate network intrusion detection.
Patent Information
- Application Number
- CN202510741528.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-05
- Publication Date
- 2025-08-12
AI Technical Summary
The existing network intrusion detection methods are difficult to quickly adapt to the dynamic changes in the network environment, resulting in a degradation of detection performance. In addition, traditional methods have high computational complexity when dealing with large-scale network traffic, which cannot meet the real-time requirements, which can easily lead to missed and false alarms.
Adaptive behavior modeling method is adopted to collect network traffic data in real time, and the dynamically updated Gaussian mixed model is used to calculate the probability density of normal behavior, and the abnormal detection threshold is adjusted in combination with the exponential weighted moving average mechanism, and the network optimization feature extraction process is generated through adversarial generation to output the detection results.
It realizes accurate adaptation to dynamic changes in the network, improves the accuracy and efficiency of detection, reduces false alarms and missed alarms, and enhances the ability to identify complex attack patterns.
Smart Images
Figure CN120474802A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of network security, and in particular relates to a network intrusion detection method, system and storage medium based on adaptive behavior modeling. Background Art
[0002] With the rapid development of information technology, the internet plays a vital role in people's lives, work, and social operations. From daily online activities for individual users to critical business operations for enterprises and even the functioning of national infrastructure, all rely heavily on the stability and security of the internet. However, cybersecurity threats are also increasing, with cyber intrusions emerging one after another, posing significant risks to personal privacy, corporate interests, and national security.
[0003] Network intrusion methods are becoming increasingly complex and diverse, posing a significant challenge to traditional intrusion detection methods. Early rule-based detection methods could only identify known types of attacks and were unable to protect against new and evolving intrusion behaviors. For example, when hackers exploit unknown vulnerabilities, these attacks can easily bypass detection systems because there are no corresponding matching rules in the rule base, causing severe damage to the network.
[0004] The application of machine learning algorithms in network intrusion detection has improved detection capabilities to a certain extent, but many limitations still exist. Many machine learning models require large amounts of well-labeled sample data for training. However, in real-world network environments, obtaining large amounts of high-quality labeled data is not only costly but also extremely difficult. Furthermore, network environments are dynamically changing, and network traffic characteristics are constantly evolving. Existing machine learning models struggle to adapt quickly to these changes, resulting in reduced detection performance. For example, when new applications or services are introduced to the network, the traffic characteristics they generate differ from previous ones, and existing detection models may be unable to accurately determine whether this traffic is an anomaly.
[0005] Furthermore, the real-time nature of network attacks requires intrusion detection systems to respond quickly, detecting and preventing intrusions promptly. However, some current detection methods suffer from high computational complexity and low detection efficiency when processing large amounts of network traffic, failing to meet real-time requirements. Failure to detect and address an attack in a timely manner can lead to irreparable damage.
[0006] Faced with such a complex and severe network security situation, it is urgent to develop an efficient, accurate, and adaptive intrusion detection method that can adapt to dynamic network changes. This will not only help protect the information security of individuals and enterprises and maintain the normal order of the network, but also have important significance for the national information security strategy.
[0007] The information disclosed in this background technology section is only intended to deepen the understanding of the overall background technology of the present invention and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to those skilled in the art. Summary of the Invention
[0008] The purpose of the present invention is to provide a network intrusion detection method, system and storage medium based on adaptive behavior modeling to solve the problems existing in the prior art.
[0009] In order to achieve the above object, the present invention adopts the following technical solutions:
[0010] A network intrusion detection method based on adaptive behavior modeling, the steps comprising:
[0011] S1: collect network traffic data in real time and extract time series feature vectors;
[0012] S2: Calculate the normal behavior probability density through a dynamically updated Gaussian mixture model;
[0013] S3: Dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism;
[0014] S4: Combine the adversarial generative network to optimize the feature extraction process and output the detection results.
[0015] Furthermore, the real-time collection of network traffic data and extraction of time series feature vectors in step S1 includes:
[0016] S11: Use network traffic collection tools to collect network data packets in real time at key locations such as network border nodes and core switches to build a network traffic dataset;
[0017] S12: Preprocess the collected network traffic data; normalize the data, map the data of different ranges and magnitudes to a unified interval, and use the minimum-maximum normalization method. For each feature x in the data set, the normalized feature value x norm The calculation is as follows:
[0018]
[0019] Among them, x min and x max are the minimum and maximum values of the feature respectively;
[0020] S13: Extracting a time series feature vector from the preprocessed network traffic data. The extracted features include but are not limited to the source IP address, destination IP address, source port number, destination port number, packet size, transmission protocol type, packet arrival time interval, etc. of the data packet. These features are arranged in chronological order to form a time series feature vector.
[0021] Furthermore, the calculation of the normal behavior probability density by the dynamically updated Gaussian mixture model in step S2 includes:
[0022] S21: Initialize the parameters of the Gaussian mixture model GMM and calculate the normal behavior probability density P(x i ), the calculation formula is as follows:
[0023]
[0024] Among them, x i is the time series eigenvector, K is the number of Gaussian components, k = 1, 2, 3…, K, and satisfies π k is the weight of the kth Gaussian component, μ k is the mean of each Gaussian component, ∑ k is the covariance matrix, is the probability density function of the kth Gaussian component, which is expressed as:
[0025]
[0026] Where exp represents the exponential function operation with the natural constant e as the base, and d is the time series feature vector x i dimension.
[0027] S22: Use the expectation-maximization (EM) algorithm to train the Gaussian mixture model, which includes the following steps:
[0028] M1: Expected E step: For each time series feature vector x i , calculate the posterior probability γ of its kth Gaussian component ik , the calculation formula is:
[0029]
[0030] M2: Maximize the M step: according to the posterior probability γ ik Update the parameters of the Gaussian mixture model. The update formula is as follows:
[0031]
[0032] Where N is the number of time series feature vectors, and T represents the transpose operation of the vector.
[0033] Furthermore, the network intrusion detection method based on adaptive behavior modeling uses the expectation maximization (EM) algorithm to optimize the parameters of the Gaussian mixture model (GMM) and uses the log-likelihood value to determine whether the model has converged. The formula is as follows:
[0034]
[0035] When the log-likelihood value gradually increases and the growth rate slows down, the change between adjacent iterations is very small and is less than the pre-set threshold of 10. -6 , indicating that the model has converged.
[0036] Furthermore, the step S3 of dynamically adjusting the anomaly detection threshold according to the exponentially weighted moving average mechanism includes:
[0037] S31: setting the initial anomaly detection threshold T0 and the exponentially weighted moving average smoothing factor α, where 0<α<1, and T0 and α are determined by analyzing historical network data;
[0038] S32: In each detection cycle t, obtain the currently calculated normal behavior probability density value P t , the calculation formula is as follows:
[0039]
[0040] That is, P t is all P(x i ), where n is the time series feature vector x contained in period t i the number of
[0041] S33: Calculate the updated anomaly detection threshold T based on the exponentially weighted moving average formula t , the calculation formula is:
[0042] T t =αP t +(1-α)T t-1
[0043] In this formula, T t-1 is the anomaly detection threshold of the previous monitoring period. Through this formula, the normal behavior probability density value P of the detection period t is converted to t and the anomaly detection threshold T of the previous cycle t-1 Perform weighted calculations so that the threshold can be dynamically adjusted according to the real-time changes in network behavior. When the network behavior is relatively stable and the probability density of normal behavior fluctuates slightly, (1-α)T t-1 The proportion of normal behavior is large, and the threshold changes slowly. However, when the network behavior changes significantly, the probability density value of normal behavior changes significantly. t The role of the threshold is enhanced, and the threshold can quickly respond to such changes, thereby more accurately adapting to the dynamic characteristics of the network environment and improving the accuracy of anomaly detection.
[0044] Furthermore, in step S4, the feature extraction process is optimized by combining the adversarial generative network and outputting the detection results, including:
[0045] S41: Construct a generative adversarial network (GAN), which includes a generator G and a discriminator D. The generator G receives random noise z and outputs a simulated feature vector G(z); the discriminator D receives the input feature vector and outputs the judgment result D(x), which has a value range of [0,1].
[0046] S42: The preprocessed real network traffic feature vector x r The simulated feature vector G(z) generated by the generator is input into the discriminator D. The discriminator D updates its parameters based on the cross entropy loss function to improve its ability to distinguish between real and simulated data. The calculation formula of the cross entropy loss function is:
[0047]
[0048] Where: E represents the mathematical expectation, and different x are obtained by multiple sampling from the real data distribution r Sample, calculate log(D(x r )), and then find the average value of these calculation results. When the number of sampling times tends to infinity, this average value is
[0049] S43: Generator G updates its parameters based on the loss function according to the feedback from the discriminator D, so that the generated simulated feature vector is closer to the real data. The loss function is calculated as:
[0050] L G =-E z [log(D(G(z)))]
[0051] S44: After multiple rounds of training, when the adversarial generative network reaches stability, the trained generator G is used to generate the original time series feature vector x ori Perform feature enhancement. Generate relevant new features G(x ori ), and compare it with x ori Fusion obtains the optimized feature vector x opt =[x ori ,G(x ori )].
[0052] S45: x opt Input classifier. Based on normal behavior probability density And the dynamically adjusted abnormal detection threshold T is used for judgment. Determine it as abnormal behavior and output abnormal information; if Determined to be normal behavior. is x opt The corresponding behavior probability density.
[0053] Furthermore, the network intrusion detection method based on adaptive behavior modeling, the network traffic collection tools used in S11 include tcpdump and Wireshark.
[0054] Furthermore, S12 pre-processes the collected network traffic data, including data cleaning, and removing noise data, duplicate data, and erroneous data.
[0055] The present invention also provides a network intrusion detection system based on adaptive behavior modeling, the detection system comprising:
[0056] Network data acquisition module: used to collect network traffic data in real time and extract time series feature vectors;
[0057] Normal behavior probability density calculation module: used to calculate the normal behavior probability density through a dynamically updated Gaussian mixture model;
[0058] Anomaly detection threshold adjustment module: used to dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism;
[0059] Detection result output module: used to combine the adversarial generative network to optimize the feature extraction process and output the detection results.
[0060] The present invention also provides a computer-readable storage medium storing computer program instructions. When the computer program instructions are executed by a computer, the computer executes the steps of any one of the above-mentioned network intrusion detection methods based on adaptive behavior modeling.
[0061] By adopting the above technical solution, the present invention has the following beneficial effects:
[0062] 1) Accurately adapting to dynamic network changes, improving detection accuracy. This technical solution uses an exponentially weighted moving average mechanism to dynamically adjust the anomaly detection threshold. By setting a smoothing factor and integrating the current probability density of normal behavior with the threshold from the previous cycle, it accurately adapts to changes in network behavior. When the network is stable, the threshold remains stable; when the network fluctuates significantly, the threshold responds rapidly. Compared to traditional fixed threshold methods, this significantly reduces false positives and missed negatives, resulting in more accurate intrusion detection.
[0063] 2) It optimizes feature extraction and enhances detection capabilities. By combining a generative adversarial network (GAN) to optimize feature extraction, the generator and discriminator are trained in a game of mutual competition. Once stabilized, new features are generated and fused with the original features. These new features contain more information about network behavior, enrich the feature dimensionality, and improve the classifier's ability to distinguish between normal and abnormal behavior, thereby enhancing the overall intrusion detection system's ability to identify complex attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS
[0064] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0065] Figure 1 A flow chart of the network intrusion detection method based on adaptive behavior modeling of the present invention;
[0066] Figure 2 Schematic diagram of the network intrusion detection system based on adaptive behavior modeling of the present invention. DETAILED DESCRIPTION
[0067] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.
[0068] Combine Figure 1 As shown, the present invention provides a network intrusion detection method based on adaptive behavior modeling, the steps comprising:
[0069] S1: collect network traffic data in real time and extract time series feature vectors;
[0070] S2: Calculate the normal behavior probability density through a dynamically updated Gaussian mixture model;
[0071] S3: Dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism;
[0072] S4: Combine the adversarial generative network to optimize the feature extraction process and output the detection results.
[0073] Specifically, the real-time collection of network traffic data and extraction of time series feature vectors in step S1 include:
[0074] S11: Use network traffic collection tools to collect network data packets in real time at key locations such as network border nodes and core switches to build a network traffic dataset;
[0075] S12: Preprocess the collected network traffic data; normalize the data, map the data of different ranges and magnitudes to a unified interval, and use the minimum-maximum normalization method. For each feature x in the data set, the normalized feature value x norm The calculation is as follows:
[0076]
[0077] Among them, x min and x max are the minimum and maximum values of the feature respectively;
[0078] S13: Extracting a time series feature vector from the preprocessed network traffic data. The extracted features include but are not limited to the source IP address, destination IP address, source port number, destination port number, packet size, transmission protocol type, packet arrival time interval, etc. of the data packet. These features are arranged in chronological order to form a time series feature vector.
[0079] Specifically, the calculation of the normal behavior probability density by the dynamically updated Gaussian mixture model in step S2 includes:
[0080] S21: Initialize the parameters of the Gaussian mixture model GMM and calculate the normal behavior probability density P(x i ), the calculation formula is as follows:
[0081]
[0082] Among them, x i is the time series eigenvector, K is the number of Gaussian components, k = 1, 2, 3…, K, and satisfies π k is the weight of the kth Gaussian component, μ k is the mean of each Gaussian component, ∑ k is the covariance matrix, is the probability density function of the kth Gaussian component, which is expressed as:
[0083]
[0084] Where exp represents the exponential function operation with the natural constant e as the base, and d is the time series feature vector x i dimension.
[0085] S22: Use the expectation-maximization (EM) algorithm to train the Gaussian mixture model, which includes the following steps:
[0086] M1: Expected E step: For each time series feature vector x i , calculate the posterior probability γ of its kth Gaussian component ik , the calculation formula is:
[0087]
[0088] π jis the weight of the j-th Gaussian component. j is an index variable used to traverse all Gaussian components in the Gaussian mixture model. It has no specific meaning and can be replaced by any letter, but its function here is to sum all K Gaussian components in the denominator. j starts from 1 and takes values up to K in sequence.
[0089] M2: Maximize the M step: according to the posterior probability γ ik Update the parameters of the Gaussian mixture model. The update formula is as follows:
[0090]
[0091] Where N is the number of time series feature vectors, and T represents the transpose operation of the vector.
[0092] Specifically, the network intrusion detection method based on adaptive behavior modeling uses the expectation maximization (EM) algorithm to optimize the parameters of the Gaussian mixture model (GMM) and uses the log-likelihood value to determine whether the model has converged. The formula is as follows:
[0093]
[0094] Where N is the number of time series feature vectors and K is the number of Gaussian components.
[0095] When the log-likelihood value gradually increases and the growth rate slows down, the change between adjacent iterations is very small and is less than the pre-set threshold of 10. -6 , indicating that the model has converged.
[0096] Specifically, the step S3 of dynamically adjusting the anomaly detection threshold according to the exponentially weighted moving average mechanism includes:
[0097] S31: setting the initial anomaly detection threshold T0 and the exponentially weighted moving average smoothing factor α, where 0<α<1, and T0 and α are determined by analyzing historical network data;
[0098] S32: In each detection cycle t, obtain the currently calculated normal behavior probability density value P t , the calculation formula is as follows:
[0099]
[0100] That is, P t is all P(x i ), where n is the time series feature vector x contained in period t i the number of
[0101] S33: Calculate the updated anomaly detection threshold T according to the exponentially weighted moving average formula t , the calculation formula is:
[0102] T t =αP t +(1-α)T t-1
[0103] In this formula, T t-1 is the anomaly detection threshold of the previous monitoring period. Through this formula, the normal behavior probability density value P of the detection period t is converted to t and the anomaly detection threshold T of the previous cycle t-1 Perform weighted calculations so that the threshold can be dynamically adjusted according to the real-time changes in network behavior. When the network behavior is relatively stable and the probability density of normal behavior fluctuates slightly, (1-α)T t-1 The proportion of normal behavior is large, and the threshold changes slowly. However, when the network behavior changes significantly, the probability density value of normal behavior changes significantly. t The role of the threshold is enhanced, and the threshold can quickly respond to such changes, thereby more accurately adapting to the dynamic characteristics of the network environment and improving the accuracy of anomaly detection.
[0104] Specifically, in step S4, the feature extraction process is optimized by combining the adversarial generative network and outputting the detection results, including:
[0105] S41: Construct a generative adversarial network (GAN), which includes a generator G and a discriminator D. The generator G receives random noise z and outputs a simulated feature vector G(z); the discriminator D receives the input feature vector and outputs the judgment result D(x), which has a value range of [0,1].
[0106] S42: The preprocessed real network traffic feature vector x r The simulated feature vector G(z) generated by the generator is input into the discriminator D. The discriminator D updates its parameters based on the cross entropy loss function to improve its ability to distinguish between real and simulated data. The calculation formula of the cross entropy loss function is:
[0107]
[0108] Where: E represents the mathematical expectation, and different x are obtained by multiple sampling from the real data distribution r Sample, calculate log(D(x r )), and then find the average value of these calculation results. When the number of sampling times tends to infinity, this average value is
[0109] S43: Generator G updates its parameters based on the loss function according to the feedback from the discriminator D, so that the generated simulated feature vector is closer to the real data. The loss function is calculated as:
[0110] L G =-Ez [log(D(G(z)))]
[0111] S44: After multiple rounds of training, when the adversarial generative network reaches stability, the trained generator G is used to generate the original time series feature vector x ori Perform feature enhancement. Generate relevant new features G(x ori ), and compare it with x ori Fusion obtains the optimized feature vector x opt =[x ori ,G(x ori )].
[0112] S45: x opt Input classifier. Based on normal behavior probability density And the dynamically adjusted abnormal detection threshold T is used for judgment. Determine it as abnormal behavior and output abnormal information; if Determined to be normal behavior. is x opt The corresponding behavior probability density.
[0113] Specifically, the network intrusion detection method based on adaptive behavior modeling, the network traffic collection tools used in S11 include tcpdump and Wireshark.
[0114] Specifically, S12 pre-processes the collected network traffic data, including data cleaning, and removing noise data, duplicate data, and erroneous data.
[0115] In another embodiment, see Figure 2 , a network intrusion detection system based on adaptive behavior modeling, the detection system comprising:
[0116] Network data acquisition module: used to collect network traffic data in real time and extract time series feature vectors;
[0117] Normal behavior probability density calculation module: used to calculate the normal behavior probability density through a dynamically updated Gaussian mixture model;
[0118] Anomaly detection threshold adjustment module: used to dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism;
[0119] Detection result output module: used to combine the adversarial generative network to optimize the feature extraction process and output the detection results.
[0120] In yet another embodiment, a computer-readable storage medium stores computer program instructions. When the computer program instructions are executed by a computer, the computer performs the steps of the network intrusion detection method based on adaptive behavior modeling as described above.
[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A network intrusion detection method based on adaptive behavior modeling, characterized in that: The steps include: S1: collect network traffic data in real time and extract time series feature vectors; S2: Calculate the normal behavior probability density through a dynamically updated Gaussian mixture model; S3: Dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism; S4: Combine the adversarial generative network to optimize the feature extraction process and output the detection results.
2. The network intrusion detection method based on adaptive behavior modeling according to claim 1, characterized in that: The real-time collection of network traffic data and extraction of time series feature vectors in step S1 includes: S11: Use network traffic collection tools to collect network data packets in real time at key locations such as network border nodes and core switches to build a network traffic dataset; S12: Preprocess the collected network traffic data; normalize the data, map the data of different ranges and magnitudes to a unified interval, and use the minimum-maximum normalization method. For each feature x in the data set, the normalized feature value x norm The calculation is as follows: Among them, x min and x max are the minimum and maximum values of the feature respectively; S13: Extracting a time series feature vector from the preprocessed network traffic data. The extracted features include but are not limited to the source IP address, destination IP address, source port number, destination port number, packet size, transmission protocol type, packet arrival time interval, etc. of the data packet. These features are arranged in chronological order to form a time series feature vector.
3. The network intrusion detection method based on adaptive behavior modeling according to claim 1, characterized in that: The calculation of the normal behavior probability density by the dynamically updated Gaussian mixture model in step S2 includes: S21: Initialize the parameters of the Gaussian mixture model GMM and calculate the normal behavior probability density P(x i ), the calculation formula is as follows: Among them, x i is the time series eigenvector, K is the number of Gaussian components, k = 1, 2, 3…, K, and satisfies π k is the weight of the kth Gaussian component, μ k is the mean of each Gaussian component, ∑ k is the covariance matrix, is the probability density function of the kth Gaussian component, which is expressed as: Where exp represents the exponential function operation with the natural constant e as the base, and d is the time series feature vector x i dimension. S22: Use the expectation-maximization (EM) algorithm to train the Gaussian mixture model, which includes the following steps: M1: Expected E step: For each time series feature vector x i , calculate the posterior probability γ of its kth Gaussian component ik , the calculation formula is: M2: Maximize the M step: according to the posterior probability γ ik Update the parameters of the Gaussian mixture model. The update formula is as follows: Where N is the number of time series feature vectors, and T represents the transpose operation of the vector.
4. The network intrusion detection method based on adaptive behavior modeling according to claim 3, characterized in that: When using the expectation maximization EM algorithm to optimize the parameters of the Gaussian mixture model GMM, the log-likelihood value is used to determine whether the model converges. The formula is as follows: When the log-likelihood value gradually increases and the growth rate slows down, the change between adjacent iterations is very small and is less than the pre-set threshold of 10. -6 , indicating that the model has converged.
5. The network intrusion detection method based on adaptive behavior modeling according to claim 1, characterized in that: The step S3 of dynamically adjusting the anomaly detection threshold according to the exponentially weighted moving average mechanism includes: S31: setting the initial anomaly detection threshold T0 and the exponentially weighted moving average smoothing factor α, where 0<α<1, and T0 and α are determined by analyzing historical network data; S32: In each detection cycle t, obtain the currently calculated normal behavior probability density value P t , the calculation formula is as follows: That is, P t is all P(x i ), where n is the time series feature vector x contained in period t i the number of S33: Calculate the updated anomaly detection threshold T according to the exponentially weighted moving average formula t , the calculation formula is: T t =αP t +(1-α)T t-1 In this formula, T t-1 is the anomaly detection threshold of the previous monitoring period. Through this formula, the normal behavior probability density value P of the detection period t is converted to t and the anomaly detection threshold T of the previous cycle t-1 Perform weighted calculations so that the threshold can be dynamically adjusted according to the real-time changes in network behavior. When the network behavior is relatively stable and the probability density of normal behavior fluctuates slightly, (1-α)T t-1 The proportion of normal behavior is large, and the threshold changes slowly. However, when the network behavior changes significantly, the probability density value of normal behavior changes significantly. t The role of the threshold is enhanced, and the threshold can quickly respond to such changes, thereby more accurately adapting to the dynamic characteristics of the network environment and improving the accuracy of anomaly detection.
6. The network intrusion detection method based on adaptive behavior modeling according to claim 1, characterized in that: In step S4, the feature extraction process is optimized by combining the adversarial generative network and outputting the detection results, including: S41: Construct a generative adversarial network (GAN), which includes a generator G and a discriminator D. The generator G receives random noise z and outputs a simulated feature vector G(z); the discriminator D receives the input feature vector and outputs the judgment result D(x), which has a value range of [0,1]. S42: The preprocessed real network traffic feature vector x r The simulated feature vector G(z) generated by the generator is input into the discriminator D. The discriminator D updates its parameters based on the cross entropy loss function to improve its ability to distinguish between real and simulated data. The calculation formula of the cross entropy loss function is: Where: E represents the mathematical expectation, and different x are obtained by multiple sampling from the real data distribution r Sample, calculate log(D(x r )), and then find the average value of these calculation results. When the number of sampling times tends to infinity, this average value is S43: Generator G updates its parameters based on the loss function according to the feedback from the discriminator D, so that the generated simulated feature vector is closer to the real data. The loss function is calculated as: L G =-E z [log(D(G(z)))] S44: After multiple rounds of training, when the adversarial generative network reaches stability, the trained generator G is used to generate the original time series feature vector x ori Perform feature enhancement. Generate relevant new features G(x ori ), and compare it with x ori Fusion obtains the optimized feature vector x opt =[x ori ,G(x ori )]. S45: x opt Input classifier. Based on normal behavior probability density And the dynamically adjusted abnormal detection threshold T is used for judgment. Determined to be abnormal behavior, output abnormal information; if Determined to be normal behavior. is x opt The corresponding behavior probability density.
7. The network intrusion detection method based on adaptive behavior modeling according to claim 2, characterized in that: S11 describes the use of network traffic collection tools, including tcpdump and Wireshark.
8. The network intrusion detection method based on adaptive behavior modeling according to claim 2, characterized in that: S12 pre-processes the collected network traffic data, including data cleaning, removing noise data, duplicate data and erroneous data.
9. A network intrusion detection system based on adaptive behavior modeling, characterized in that: The detection system comprises: Network data acquisition module: used to collect network traffic data in real time and extract time series feature vectors; Normal behavior probability density calculation module: used to calculate the normal behavior probability density through a dynamically updated Gaussian mixture model; Anomaly detection threshold adjustment module: used to dynamically adjust the anomaly detection threshold based on the exponentially weighted moving average mechanism; Detection result output module: used to combine the adversarial generative network to optimize the feature extraction process and output the detection results.
10. A computer-readable storage medium storing computer program instructions, wherein when the computer program instructions are executed by a computer, the computer executes the steps of the network intrusion detection method based on adaptive behavior modeling according to any one of claims 1 to 8.