Abnormity detection system and method for detecting unknown network attack based on deep learning
By integrating lightweight model design, reinforcement learning, and transfer learning, combined with data synthesis and robustness enhancement, an adaptive anomaly detection system is constructed, which solves the problems of training data difficulty and noise sensitivity of deep learning models in network attack detection, and realizes efficient and robust detection of unknown network attacks.
Patent Information
- Application Number
- CN202510750406.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-06
- Publication Date
- 2025-09-09
AI Technical Summary
In existing technologies, deep learning models have problems with training data difficulty and noise sensitivity in network attack detection, resulting in poor detection results.
By adopting lightweight model design, the integration of reinforcement learning and transfer learning, combined with data synthesis and enhancement technology, and through feature selection and robustness enhancement modules, an adaptive anomaly detection system is built.
It achieves efficient and robust detection of unknown network attacks, adapts to data-scarce scenarios, reduces noise sensitivity, and improves detection accuracy and adaptability.
Smart Images
Figure CN120611289A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network attack anomaly detection, and in particular to an anomaly detection system and method for detecting unknown network attacks based on deep learning. Background Art
[0002] With the rapid construction of new power systems, various emerging business terminals are connected to the power grid. The terminal-side protection measures are missing, and data is extremely easy to be stolen. The control instructions of new equipment such as distributed photovoltaics, distribution network terminals, and charging piles are exposed in the open Internet environment and are extremely easy to be tampered with. Customized attacks such as instruction forgery and tampering have no obvious attack characteristics. Current security monitoring equipment based on rule bases and behavioral analysis cannot effectively detect such attacks.
[0003] The existing deep learning-based anomaly detection method for detecting unknown network attacks is a method that uses machine learning or deep learning technology to detect unknown attacks or abnormal behaviors in network data. This method monitors and analyzes network data traffic in real time to identify abnormal behaviors that are different from known attack patterns, thereby promptly discovering unknown network attacks and taking corresponding defensive measures.
[0004] However, the existing deep learning-based anomaly detection systems and methods for detecting unknown network attacks still have the following deficiencies:
[0005] 1. Deep learning models often require a large amount of well-labeled training data to train the model. However, in the field of network security, obtaining large amounts of accurately labeled network data can be difficult, resulting in difficulties in model training and reduced effectiveness.
[0006] 2. Deep learning models are highly sensitive to noise and abnormal data, and may be misjudged due to changes or interference in input data, thereby affecting the model training effect and failing to meet usage requirements.
[0007] Therefore, an adaptive and lightweight deep learning anomaly detection system is developed for the protection of new power system stations. It is deployed on the station network export equipment to achieve full-process protection from data collection to attack blocking. Summary of the Invention
[0008] The present invention aims to address the technical defects of the existing technology and provide an anomaly detection system and method based on deep learning for detecting unknown network attacks. Through the fusion innovation of lightweight model design, reinforcement learning and transfer learning, efficient and robust detection capabilities are achieved.
[0009] The present invention provides the following technical solution: an anomaly detection system for detecting unknown network attacks based on deep learning, including a data acquisition module, a data preprocessing module, a feature extraction and selection module, a model building and training module, an anomaly detection module, and an alarm and response module;
[0010] The model building and training module is used to build an anomaly detection model and train the built model. The model building and training module adopts a deep learning model module, which includes a lightweight model design unit, a reinforcement learning unit, and a transfer learning unit. The lightweight model design unit adopts the following steps:
[0011] Step 1: Extract key communication behavior features from the data preprocessed by the data preprocessing module. The key communication behavior features include source / destination IP, protocol type, average packet length, connection duration, and port frequency. The extracted features are encoded and normalized to obtain a standardized feature input vector.
[0012] Step 2: Design the model structure;
[0013] Step 2-1, input layer,; the shape of the input layer is set to the length of the feature vector, which is used to receive the feature input vector of step 1;
[0014] Step 2-2, add a hidden layer; add a hidden layer with a structure of multi-layer perceptron, random dropout mechanism, and batch normalization. The multi-layer perceptron is used to extract features and perform classification. During training, the neurons of the random dropout mechanism are set to 0. Batch normalization is used to standardize the output of each layer and is inserted between Dense and Activation.
[0015] Step 2-3, output layer; select the binary classification task to determine whether it is an unknown attack;
[0016] Step 3: compress the model structure designed in step 2, and generate a deep learning model by using model pruning, weight quantization, model evaluation and iteration;
[0017] The model performance evaluation and iteration are evaluated using detection accuracy, precision, recall, model size <1MB, and inference latency <5ms. The following formula is used in the evaluation process:
[0018] Detection accuracy: True positive = the actual abnormality is predicted to be abnormal, TN is true negative = the actual normality is predicted to be normal, FP is false positive = the actual normality is predicted to be abnormal (false positive), FN is false negative = the actual abnormality is predicted to be normal (false negative);
[0019] Accuracy: ;
[0020] Recall: ;
[0021] The formula for model size estimation is: , where L represents the number of layers of the model, represents the number of parameters of layer 1, Per Param indicates the number of bits occupied by each parameter;
[0022] The formula for inference latency estimation is: Latency ,
[0023] FLOPs is the number of floating-point operations, which is used to measure the computational complexity of the model. FLOPs / sec is the number of floating-point operations that can be executed per second. Latency is the inference latency.
[0024] The reinforcement learning unit adopts the following steps:
[0025] Extract a state vector representing the "current network behavior" from the key communication behavior features in step 1; define actions and rewards, a ∈ {0: normal, 1: abnormal}, give a positive reward if the prediction is correct (TP / TN), and a negative reward if the prediction is wrong (FP / FN); use Q-learning / DQN to learn the optimal action strategy to maximize the cumulative reward; iterative training, receiving the state and selecting the action in each round to obtain the reward and update the strategy network;
[0026] The steps of the transfer learning unit are as follows:
[0027] A deep learning model trained on the public datasets CICIDS and NSL-KD is selected as the pre-trained model. The feature extraction layer is migrated from the trained deep learning model, and the parameters of the previous layers of the model, including the dense layer, convolution layer, and embedding layer, are retained and frozen. The parameters of the previous layers are migrated to the deep learning model constructed in step 3, and the output layer is fine-tuned using a small amount of data in the new network environment. The accuracy, precision, and recall of the migrated deep learning model in the network environment are checked and adjusted accordingly.
[0028] Based on the features for detecting network attacks extracted by the feature extraction and selection modules, an anomaly detection model is built by training the deep learning model.
[0029] Further,
[0030] The data acquisition module is used to collect network data such as network data flow and log files, and transmit the collected network data to the data preprocessing module.
[0031] Further,
[0032] The data preprocessing module cleans and preprocesses the collected data. The data cleaning and preprocessing include data formatting, removing noise and duplicate data, and using data synthesis and enhancement technology to amplify or synthesize the data to expand the training data set. When amplifying the data, use Perform translation transformation expansion, where I(x′, y′) represents the pixel value in the new coordinate system after the translation transformation, that is, the transformed image pixel value, I(x, y) represents the pixel value in the original image, that is, the image pixel value before translation, x and y represent the pixel coordinates in the original image coordinate system, x′ and y′ represent the new pixel coordinates after the translation transformation, and x and y represent the translation distance in the x and y directions, that is, the translation offset.
[0033] Further,
[0034] The feature extraction and selection module is used to extract effective features from the pre-processed network data and use feature selection technology to determine which features are most important for detecting network attacks;
[0035] The feature selection technology uses the information gain evaluation function for selection, and its expression is: , IG(D,A) represents the information gain of feature (A) to data set (D), H(D) represents the entropy of data set (D), that is, the uncertainty or confusion of the target variable in the data set, H(D|A) represents the conditional entropy of data set (D) under the given condition of feature (A), that is, the uncertainty or confusion of the data set under the condition of feature (A), and the calculation formula of entropy (H) is ,in ) represents the entropy of the data set D, P(i) represents the probability of the i-th category in the data set, and n represents the total number of categories. Represents the logarithm with base 2, and the calculation formula of conditional entropy (H(D|A)) is , where m represents the number of all possible values of feature A, Indicates that feature A= The data subset of the case, Representation subset The entropy of the feature is calculated by calculating the information gain to evaluate the amount of information provided by the feature for the classification of the target variable, and the most informative feature is selected.
[0036] Further,
[0037] The model building and training module also includes a robustness enhancement module, which uses adversarial training technology to introduce adversarial samples to train the model, using the following steps:
[0038] The network traffic data is divided into a training set and a validation set, and the validation set is used to find samples with extremely low confidence in the prediction of the anomaly detection model and samples that are easily disturbed;
[0039] Generate adversarial examples using the fast gradient sign method,
[0040] Its expression is ,in represents the adversarial sample, x represents the original sample, ϵ represents the perturbation size, ∇xJ(θ,x,y) represents the gradient of the loss function J with respect to the input x, θ represents the model parameter, and y represents the true label;
[0041] The original network traffic data samples and adversarial samples are mixed together and input into the anomaly detection model for training. The loss function is used to perform adversarial training on the anomaly detection model, and its expression is , where L is the original cross entropy loss, are weight balancing parameters, The values are 0.5, 0.5 or 0.7, 0.3;
[0042] Perform robustness evaluation to evaluate the accuracy, robustness accuracy degradation rate, and confidence perturbation stability on adversarial samples.
[0043] The accuracy expression is Adv-ACC= ,in is the i-th adversarial sample, is the true label, f(x) is the model prediction function, 1( ) is an indicator function that returns 1 if the condition is true, otherwise 0, and N is the total number of adversarial samples;
[0044] The expression of robust accuracy degradation rate is: = ,in is the accuracy of the model on the original clean data, is the accuracy of the model on adversarial samples;
[0045] The expression of confidence perturbation stability is Conf_Shift= , assuming that f(x) is the abnormal probability of the softmax output, it represents the average magnitude of the change in the prediction result before and after the input is disturbed.
[0046] Further,
[0047] The anomaly detection module is used to apply the trained anomaly detection model to the real-time monitored network data flow to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks.
[0048] Further,
[0049] The alarm and response module is used to issue an alarm or notification to an administrator.
[0050] Further,
[0051] The deep learning-based anomaly detection method for detecting unknown network attacks performs the following steps:
[0052] S1, collects network traffic data through the data acquisition module, cleans and preprocesses the data through the data preprocessing module, and uses data synthesis and enhancement technology to augment or synthesize the processed data to expand the training data set;
[0053] S2, extracting and selecting valuable features from the dataset expanded in step S1 through a feature extraction and selection module, for describing the communication behavior and characteristics of the network, and using feature selection technology to determine which features are most important for detecting network attacks;
[0054] S3, designs a lightweight deep learning model structure through the lightweight model design unit in the deep learning model module, and improves the generalization ability of the deep learning model structure based on the reinforcement learning unit and transfer learning unit;
[0055] S4, establishing an anomaly detection model based on the most important features for detecting network attacks extracted in step S2, and training the established anomaly detection model based on the deep learning model structure in step S3;
[0056] S5, introducing a robustness enhancement technology through a robustness enhancement module, and retraining the anomaly detection model trained in S4 using the adversarial training technology in the enhancement technology;
[0057] S6, applying the model trained in step S5 to the actual monitored network data stream using an anomaly detection module to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks;
[0058] S7, when abnormal behavior is detected in step S6, the alarm and response module will issue an alarm or notify the administrator.
[0059] Compared with the prior art, the present invention has the following beneficial effects:
[0060] To address the two core issues of existing deep learning models in network attack detection, namely data annotation difficulties and noise sensitivity, this paper proposes a deep learning-based unknown network attack anomaly detection system. Through the innovative integration of lightweight model design, reinforcement learning, and transfer learning, this system achieves efficient and robust detection capabilities.
[0061] The system adopts a modular design. The data acquisition module is responsible for collecting raw data from sources such as network traffic and logs in real time. The data preprocessing module cleans, standardizes and converts the raw data into different formats. The feature extraction and selection module extracts key communication behavior features (such as source / destination IP, protocol type, etc.) from the preprocessed data and performs feature selection to reduce the dimensionality. The model building and training module builds a lightweight, adaptive anomaly detection model based on deep learning technology, including lightweight model design, reinforcement learning and transfer learning units. The anomaly detection module uses the trained model to perform real-time detection on new data and output anomaly scores. The alarm and response module triggers alarms based on the anomaly scores.
[0062] Among them, the lightweight model design unit solves the problems of high model complexity and high resource consumption, making it suitable for deployment on embedded or edge devices. The reinforcement learning unit improves the model's adaptability to unknown attacks by dynamically adjusting decision strategies. The transfer learning unit solves the problem of insufficient training data and uses public datasets to improve model generalization.
[0063] Based on the above modules, the following problems are solved:
[0064] Problem 1: Insufficient training data:
[0065] By using data synthesis and enhancement techniques to amplify or synthesize data to expand the training dataset, and combining the designed lightweight deep learning model structure with reinforcement learning and transfer learning techniques, the generalization ability of the deep learning model structure can be effectively improved, data requirements can be reduced, and the difficulty of obtaining network data can be effectively alleviated, thereby improving model training results. Through transfer learning, knowledge from public datasets can be reused to reduce dependence on local labeled data.
[0066] Combined with the online learning capabilities of reinforcement learning, strategies are optimized using a small amount of interaction data.
[0067] Problem 2: Noise Sensitivity:
[0068] Through the adversarial training technology of the robustness enhancement module, the model's robustness to abnormal data is enhanced, the detection accuracy is improved, and thus the effect of model training is further improved;
[0069] Batch normalization and random dropout mechanisms improve model robustness;
[0070] Feature selection filters redundant features and reduces the impact of noise;
[0071] The dynamic reward mechanism of reinforcement learning can correct misjudgments and adapt to changes in data distribution;
[0072] The system effectively solves the problems of data scarcity and noise sensitivity in network security scenarios through the integration of lightweight model design, reinforcement learning and transfer learning. It can adaptively compress models: balance accuracy and resource consumption, online reinforcement learning: dynamically adapt to changes in attack patterns, and knowledge transfer: use public data to improve small sample performance, enhance the model's robustness to abnormal data, and improve detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0073] Figure 1 This is a block diagram of an anomaly detection system based on deep learning for detecting unknown network attacks proposed by the present invention;
[0074] Figure 2 This is a flowchart of an anomaly detection method for detecting unknown network attacks based on deep learning proposed by the present invention. DETAILED DESCRIPTION
[0075] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative work shall fall within the scope of protection of the present invention.
[0076] like Figures 1-2 As shown, it shows a specific embodiment of the present invention: Figures 1-2 As shown,
[0077] The anomaly detection system for detecting unknown network attacks based on deep learning disclosed in the present invention includes a data acquisition module, a data preprocessing module, a feature extraction and selection module, a model building and training module, an anomaly detection module, and an alarm and response module;
[0078] The model building and training module is used to build an anomaly detection model and train the built model. The model building and training module adopts a deep learning model module, which includes a lightweight model design unit, a reinforcement learning unit, and a transfer learning unit. The lightweight model design unit adopts the following steps:
[0079] Step 1: Extract key communication behavior features from the data preprocessed by the data preprocessing module. The key communication behavior features include source / destination IP, protocol type, average packet length, connection duration, and port frequency. The extracted features are encoded and normalized to obtain a standardized feature input vector.
[0080] Step 2: Design the model structure;
[0081] Step 2-1, input layer; the shape of the input layer is set to the length of the feature vector, which is used to receive the feature input vector of step 1;
[0082] Step 2-2, add a hidden layer; add a hidden layer with a structure of multi-layer perceptron, random dropout mechanism, and batch normalization. The multi-layer perceptron is used to extract features and perform classification. During training, the neurons of the random dropout mechanism are set to 0. Batch normalization is used to standardize the output of each layer and is inserted between Dense and Activation.
[0083] Step 2-3, output layer; select the binary classification task to determine whether it is an unknown attack;
[0084] Step 3: compress the model structure designed in step 2, and generate a deep learning model by using model pruning, weight quantization, model evaluation and iteration;
[0085] The model performance evaluation and iteration are evaluated using detection accuracy, precision, recall, model size <1MB, and inference latency <5ms. The following formula is used in the evaluation process:
[0086] Detection accuracy: True positive = the actual abnormality is predicted to be abnormal, TN is true negative = the actual normality is predicted to be normal, FP is false positive = the actual normality is predicted to be abnormal (false positive), FN is false negative = the actual abnormality is predicted to be normal (false negative);
[0087] Accuracy: ;
[0088] Recall: ;
[0089] The formula for model size estimation is: , where L represents the number of layers of the model, represents the number of parameters of layer 1, Per Param indicates the number of bits occupied by each parameter;
[0090] The formula for inference latency estimation is: Latency , where FLOPs is the number of floating-point operations, which is used to measure the computational complexity of the model, FLOPs / sec is the number of floating-point operations that can be executed per second, and Latency is the inference latency;
[0091] The reinforcement learning unit adopts the following steps:
[0092] Extract a state vector representing the "current network behavior" from the key communication behavior features in step 1; define actions and rewards, a ∈ {0: normal, 1: abnormal}, give a positive reward if the prediction is correct (TP / TN), and a negative reward if the prediction is wrong (FP / FN); use Q-learning / DQN to learn the optimal action strategy to maximize the cumulative reward; iterative training, receiving the state and selecting the action in each round to obtain the reward and update the strategy network;
[0093] The steps of the transfer learning unit are as follows:
[0094] A deep learning model trained on the public datasets CICIDS and NSL-KD is selected as the pre-trained model. The feature extraction layer is migrated from the trained deep learning model, and the parameters of the previous layers of the model, including the dense layer, convolution layer, and embedding layer, are retained and frozen. The parameters of the previous layers are migrated to the deep learning model constructed in step 3, and the output layer is fine-tuned using a small amount of data in the new network environment. The accuracy, precision, and recall of the migrated deep learning model in the network environment are checked and adjusted accordingly.
[0095] Based on the features for detecting network attacks extracted by the feature extraction and selection modules, an anomaly detection model is built by training the deep learning model.
[0096] Further,
[0097] The data acquisition module is used to collect network data such as network data flow and log files, and transmit the collected network data to the data preprocessing module.
[0098] Responsible for capturing raw network data (such as traffic and logs) in real time and transmitting it to the preprocessing module in a structured manner.
[0099] It meets the requirements of comprehensiveness, covering multi-source heterogeneous data (traffic, logs, system events, etc.), real-time: supporting millisecond-level data capture, adapting to high-speed networks (such as 10Gbps+), and accuracy: avoiding data loss or tampering to ensure the credibility of subsequent analysis.
[0100] Further,
[0101] The data preprocessing module cleans and preprocesses the collected data. The data cleaning and preprocessing include data formatting, removing noise and duplicate data, and using data synthesis and enhancement technology to amplify or synthesize the data to expand the training data set. When amplifying the data, use Perform translation transformation expansion, where I(x′, y′) represents the pixel value in the new coordinate system after the translation transformation, that is, the transformed image pixel value, I(x, y) represents the pixel value in the original image, that is, the image pixel value before translation, x and y represent the pixel coordinates in the original image coordinate system, x′ and y′ represent the new pixel coordinates after the translation transformation, and x and y represent the translation distance in the x and y directions, that is, the translation offset.
[0102] The data preprocessing module is responsible for converting raw collected data into high-quality, usable training samples. This includes cleaning noisy data, unifying the format, eliminating redundancy, and expanding the dataset size through data augmentation techniques to improve model generalization capabilities.
[0103] Data augmentation solves the problem of data scarcity by generating samples that are similar to but slightly different from the original data, expanding the training dataset. It is particularly suitable for scenarios where attack samples are scarce in network attack detection.
[0104] This invention uses translational transformation to expand the dataset, generate similar variants, and improve model robustness. By generating samples with offset positions, the model is prevented from over-relying on the spatial location of features (such as the fixed position of a specific port number). This is a low-cost data augmentation method. Compared to Generative Adversarial Networks (GANs), translational transformation has significantly lower computational overhead, making it suitable for scenarios with high real-time requirements.
[0105] In network attack detection, designing enhancement strategies by combining domain knowledge (such as protocol characteristics and attack patterns) can significantly alleviate the problem of data scarcity and ultimately achieve high-precision, low-false-alarm detection results.
[0106] Further,
[0107] The feature extraction and selection module is used to extract effective features from the pre-processed network data and use feature selection technology to determine which features are most important for detecting network attacks;
[0108] The feature selection technology uses the information gain evaluation function for selection, and its expression is: , IG(D,A) represents the information gain of feature (A) to data set (D), H(D) represents the entropy of data set (D), that is, the uncertainty or confusion of the target variable in the data set, H(D|A) represents the conditional entropy of data set (D) under the given condition of feature (A), that is, the uncertainty or confusion of the data set under the condition of feature (A), and the calculation formula of entropy (H) is ,in ) represents the entropy of the data set D, P(i) represents the probability of the i-th category in the data set, and n represents the total number of categories. Represents the logarithm with base 2, and the calculation formula of conditional entropy (H(D|A)) is , where m represents the number of all possible values of feature A, Indicates that feature A= The data subset of the case, Representation subset The entropy of the feature is calculated by calculating the information gain to evaluate the amount of information provided by the feature for the classification of the target variable, and the most informative feature is selected.
[0109] The feature extraction and selection module is responsible for extracting key features from massive preprocessed data and quantifying the importance of features to reduce model complexity and improve detection efficiency.
[0110] In power grid applications, we selected information gain to extract key features and quantify them. Specifically, in network attack detection, we extracted the following features from preprocessed network traffic data and calculated their information gain, directly quantifying the contribution of the features to classification. This approach is easy to interpret, computationally efficient, and requires no supervised pre-screening.
[0111] Information gain provides an efficient and explainable feature selection method for network attack detection by quantifying the degree to which a feature reduces classification uncertainty.
[0112] Further,
[0113] The model building and training module also includes a robustness enhancement module, which uses adversarial training technology to introduce adversarial samples to train the model, using the following steps:
[0114] The network traffic data is divided into a training set and a validation set, and the validation set is used to find samples with extremely low confidence in the prediction of the anomaly detection model and samples that are easily disturbed;
[0115] Generate adversarial examples using the fast gradient sign method,
[0116] Its expression is ,in represents the adversarial sample, x represents the original sample, ϵ represents the perturbation size, ∇xJ(θ,x,y) represents the gradient of the loss function J with respect to the input x, θ represents the model parameter, and y represents the true label;
[0117] The original network traffic data samples and adversarial samples are mixed together and input into the anomaly detection model for training. The loss function is used to perform adversarial training on the anomaly detection model, and its expression is , where L is the original cross entropy loss, are weight balancing parameters, The values are 0.5, 0.5 or 0.7, 0.3;
[0118] Perform robustness evaluation to evaluate the accuracy, robustness accuracy degradation rate, and confidence perturbation stability on adversarial samples.
[0119] The accuracy expression is Adv-ACC= ,in is the i-th adversarial sample, is the true label, f(x) is the model prediction function, 1( ) is an indicator function that returns 1 if the condition is true, otherwise 0, and N is the total number of adversarial samples;
[0120] The expression of robust accuracy degradation rate is: = ,in is the accuracy of the model on the original clean data, is the accuracy of the model on adversarial samples;
[0121] The expression of confidence perturbation stability is Conf_Shift= , assuming that f(x) is the abnormal probability of the softmax output, it represents the average magnitude of the change in the prediction result before and after the input is disturbed.
[0122] In network attack detection, traditional models are vulnerable to adversarial examples (e.g., bypassing detection through minor perturbations), resulting in a surge in false positives or an increase in false negatives. To address this issue, the robustness enhancement module uses adversarial training technology to introduce adversarial examples into model training, forcing the model to learn robust features against perturbations, significantly improving its reliability in real-world attack scenarios.
[0123] 1. The core goal of adversarial training
[0124] Defense against adversarial attacks: Simulate the attacker's behavior of constructing adversarial samples through small perturbations, so that the model has the ability to identify "similar malicious traffic".
[0125] Improved generalization capabilities: By perturbing the model with adversarial samples, the model is forced to focus on more essential attack patterns (such as protocol anomalies and timing anomalies) rather than relying on surface features (such as specific port numbers).
[0126] Balance accuracy and robustness: Reduce the misclassification rate of adversarial examples while maintaining the accuracy of normal traffic detection.
[0127] 2. Adversarial Example Generation Method: Fast Gradient Signed Method (FGSM)
[0128] Principle: Based on the gradient of the model loss function J(θ,x,y) with respect to the input x, a perturbation direction is generated that maximizes the loss. By applying perturbations along the gradient direction, the model becomes sensitive to small changes in the input, exposing its vulnerability.
[0129] 3. Introducing the beneficial effects of adversarial training
[0130] Defense against adversarial attacks: For example, an attacker can construct adversarial examples by fine-tuning the TCP window size (e.g., ±1 byte). Traditional models may misclassify these perturbations as normal traffic. After adversarial training, the model can correctly identify these perturbations because it has learned the robust feature of TCP window size consistency with the protocol specification.
[0131] Improved generalization: Adversarial examples force the model to focus on the essential characteristics of the attack (such as protocol anomalies and timing patterns) rather than relying on superficial features (such as specific port numbers or packet sizes).
[0132] Experimental verification: On the CIC-IDS2017 dataset, the adversarially trained model improves the generalization accuracy of the model across attack types (e.g., DoS→PortScan) by 15%.
[0133] Adversarial training simulates noise interference (such as network delay and packet loss) in real attacks by perturbing the input, making the model insensitive to non-malicious perturbations and thus reducing the false alarm rate.
[0134] Experimental data: On the power grid control network (ICS) dataset, adversarial training reduced the model's false positive rate for normal traffic from 8.2% to 3.1%, while maintaining a detection rate of over 92% for attack traffic.
[0135] Further,
[0136] The anomaly detection module is used to apply the trained anomaly detection model to the real-time monitored network data flow to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks.
[0137] The anomaly detection module monitors and identifies unknown attacks in real time. The anomaly detection module deploys the trained model to the real-time data stream, and through behavior pattern matching and deviation analysis, quickly identifies abnormal behaviors that do not match known attack patterns or directly detects unknown threats.
[0138] Known attack detection: Based on attack patterns learned in the training set (such as SQL injection and DDoS traffic characteristics), it matches similar behaviors in real-time data.
[0139] Unknown attack identification: Capture traffic or behavior that is significantly different from historical data distribution (such as covert channels that exploit legitimate protocols) through statistical deviation analysis and behavioral sequence anomalies.
[0140] Output:
[0141] Binary classification: normal / abnormal labels (suitable for simple scenarios).
[0142] Multi-dimensional scoring: anomaly confidence, attack type probability distribution (e.g., Botnet: 0.8, Ransomware: 0.2).
[0143] Explainable evidence: key features that trigger anomalies (such as abnormal TCP window size and sudden changes in DNS query entropy).
[0144] Further,
[0145] The alarm and response module is used to issue an alarm or notification to an administrator.
[0146] The alarm and response module is divided into alarm generation and multi-level notification. It converts the anomaly scores and attack types output by the model into structured alarm information and reaches the administrator through channels such as email, SMS, voice calls, enterprise WeChat / DingTalk, etc.
[0147] The actions that administrators can take in response to issued alerts or notifications include:
[0148] (1) For network connections with malicious behavior or abnormal traffic, the connection with the malicious host or malicious traffic can be immediately disconnected to prevent potential attack behaviors from spreading further or affecting other systems;
[0149] (2) Access to IP addresses or ports associated with abnormal behavior can be temporarily blocked to ensure network security and protect the system from attacks;
[0150] (3) For users or devices suspected of abnormal behavior, additional authentication and authorization may be required to confirm their identity and permissions and limit their access scope;
[0151] (4) For hosts or users whose abnormal behavior is detected, behavioral analysis and monitoring can be performed to continuously track their behavior and understand their activity patterns to ensure that similar abnormal behavior does not occur again;
[0152] (5) When a cyber attack threat is detected, data backup is performed in a timely manner to prevent data loss or data leakage, and data can be restored quickly to mitigate potential losses.
[0153] Further,
[0154] The deep learning-based anomaly detection method for detecting unknown network attacks performs the following steps:
[0155] S1, collects network traffic data through the data acquisition module, cleans and preprocesses the data through the data preprocessing module, and uses data synthesis and enhancement technology to augment or synthesize the processed data to expand the training data set;
[0156] S2, extracting and selecting valuable features from the dataset expanded in step S1 through a feature extraction and selection module, for describing the communication behavior and characteristics of the network, and using feature selection technology to determine which features are most important for detecting network attacks;
[0157] S3, designs a lightweight deep learning model structure through the lightweight model design unit in the deep learning model module, and improves the generalization ability of the deep learning model structure based on the reinforcement learning unit and transfer learning unit;
[0158] S4, establishing an anomaly detection model based on the most important features for detecting network attacks extracted in step S2, and training the established anomaly detection model based on the deep learning model structure in step S3;
[0159] S5, introducing a robustness enhancement technology through a robustness enhancement module, and retraining the anomaly detection model trained in S4 using the adversarial training technology in the enhancement technology;
[0160] S6, applying the model trained in step S5 to the actual monitored network data stream using an anomaly detection module to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks;
[0161] S7, when abnormal behavior is detected in step S6, the alarm and response module will issue an alarm or notify the administrator.
[0162] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings. However, the present invention is not limited to the above embodiments. Various changes can be made within the scope of knowledge possessed by ordinary technicians in this field without departing from the purpose of the present invention. These changes involve related technologies well known to those skilled in the art, and all fall within the scope of protection of the patent of this invention.
[0163] Many other changes and modifications can be made without departing from the spirit and scope of the present invention. It should be understood that the present invention is not limited to the specific embodiments, and the scope of the present invention is defined by the appended claims.
Claims
1. An anomaly detection system for detecting unknown network attacks based on deep learning, characterized by: It includes data acquisition module, data preprocessing module, feature extraction and selection module, model building and training module, anomaly detection module, alarm and response module; The model building and training module is used to build an anomaly detection model and train the built model. The model building and training module adopts a deep learning model module, which includes a lightweight model design unit, a reinforcement learning unit, and a transfer learning unit. The lightweight model design unit adopts the following steps: Step 1: Extract key communication behavior features from the data preprocessed by the data preprocessing module. The key communication behavior features include source / destination IP, protocol type, average packet length, connection duration, and port frequency. The extracted features are encoded and normalized to obtain a standardized feature input vector. Step 2: Design the model structure; Step 2-1, input layer,; the shape of the input layer is set to the length of the feature vector, which is used to receive the feature input vector of step 1; Step 2-2: Add a hidden layer. Add a hidden layer with a multilayer perceptron, a random dropout mechanism, and batch normalization. The multilayer perceptron is used to extract features and perform classification. During training, the neurons in the random dropout mechanism are set to 0. Batch normalization is used to standardize the output of each layer and is inserted between Dense and Activation. Step 2-3, output layer; select the binary classification task to determine whether it is an unknown attack; Step 3: compress the model structure designed in step 2, and generate a deep learning model by using model pruning, weight quantization, model evaluation and iteration; The model performance evaluation and iteration are evaluated using detection accuracy, precision, recall, model size <1MB, and inference latency <5ms. The following formula is used in the evaluation process: Detection accuracy: True positive = the actual abnormality is predicted to be abnormal, TN is true negative = the actual normality is predicted to be normal, FP is false positive = the actual normality is predicted to be abnormal (false positive), FN is false negative = the actual abnormality is predicted to be normal (false negative); Accuracy: ; Recall: ; The formula for model size estimation is: , where L represents the number of layers of the model, represents the number of parameters of layer 1, Per Param indicates the number of bits occupied by each parameter; The formula for inference latency estimation is: Latency , where FLOPs is the number of floating-point operations, which is used to measure the computational complexity of the model, FLOPs / sec is the number of floating-point operations that can be executed per second, and Latency is the inference latency; The reinforcement learning unit adopts the following steps: Extract a state vector representing the "current network behavior" from the key communication behavior features in step 1; define actions and rewards, a ∈ {0: normal, 1: abnormal}, and give positive rewards if the prediction is correct (TP / TN) and negative rewards if the prediction is incorrect (FP / FN); use Q-learning / DQN to learn the optimal action strategy to maximize the cumulative reward; iteratively train, and update the strategy network after receiving the state and selecting the action to obtain the reward in each round; The steps of the transfer learning unit are as follows: A deep learning model trained on the public datasets CICIDS and NSL-KD is selected as the pre-trained model. The feature extraction layer is migrated from the trained deep learning model, and the parameters of the previous layers of the model, including the dense layer, convolution layer, and embedding layer, are retained and frozen. The parameters of the previous layers are migrated to the deep learning model constructed in step 3, and the output layer is fine-tuned using a small amount of data in the new network environment. The accuracy, precision, and recall of the migrated deep learning model in the network environment are checked and adjusted accordingly. Based on the features for detecting network attacks extracted by the feature extraction and selection modules, an anomaly detection model is built by training the deep learning model.
2. The anomaly detection system for detecting unknown network attacks based on deep learning according to claim 1 is characterized in that: The data acquisition module is used to collect network data such as network data flow and log files, and transmit the collected network data to the data preprocessing module.
3. The anomaly detection system for detecting unknown network attacks based on deep learning according to claim 2 is characterized in that: The data preprocessing module cleans and preprocesses the collected data. The data cleaning and preprocessing include data formatting, removing noise and duplicate data, and using data synthesis and enhancement technology to amplify or synthesize the data to expand the training data set. When amplifying the data, use Perform translation transformation expansion, where I(x′, y′) represents the pixel value in the new coordinate system after the translation transformation, that is, the transformed image pixel value, I(x, y) represents the pixel value in the original image, that is, the image pixel value before translation, x and y represent the pixel coordinates in the original image coordinate system, x′ and y′ represent the new pixel coordinates after the translation transformation, and x and y represent the translation distance in the x and y directions, that is, the translation offset.
4. The anomaly detection system for detecting unknown network attacks based on deep learning according to claim 3 is characterized in that: The feature extraction and selection module is used to extract effective features from the pre-processed network data and use feature selection technology to determine which features are most important for detecting network attacks; The feature selection technology uses the information gain evaluation function for selection, and its expression is: , IG(D,A) represents the information gain of feature (A) to data set (D), H(D) represents the entropy of data set (D), that is, the uncertainty or confusion of the target variable in the data set, H(D|A) represents the conditional entropy of data set (D) under the given condition of feature (A), that is, the uncertainty or confusion of the data set under the condition of feature (A), and the calculation formula of entropy (H) is ,in ) represents the entropy of the data set D, P(i) represents the probability of the i-th category in the data set, and n represents the total number of categories. Represents the logarithm with base 2, and the calculation formula of conditional entropy (H(D|A)) is , where m represents the number of all possible values of feature A, Indicates that feature A= The data subset of the case, Representation subset The entropy of the feature is calculated by calculating the information gain to evaluate the amount of information provided by the feature for the classification of the target variable, and the most informative feature is selected.
5. The deep learning-based anomaly detection system for detecting unknown network attacks according to any one of claims 1 to 4, characterized in that: The model building and training module also includes a robustness enhancement module, which uses adversarial training technology to introduce adversarial samples to train the model, using the following steps: The network traffic data is divided into a training set and a validation set, and the validation set is used to find samples with extremely low confidence in the prediction of the anomaly detection model and samples that are easily disturbed; Generate adversarial examples using the fast gradient sign method, Its expression is ,in represents the adversarial sample, x represents the original sample, ϵ represents the perturbation size, ∇xJ(θ,x,y) represents the gradient of the loss function J with respect to the input x, θ represents the model parameter, and y represents the true label; The original network traffic data samples and adversarial samples are mixed together and input into the anomaly detection model for training. The loss function is used to perform adversarial training on the anomaly detection model, and its expression is , where L is the original cross entropy loss, are weight balancing parameters, The values are 0.5, 0.5 or 0.7, 0.3; Perform robustness evaluation to evaluate the accuracy, robustness accuracy degradation rate, and confidence perturbation stability on adversarial samples. The accuracy expression is Adv-ACC= ,in is the i-th adversarial sample, is the true label, f(x) is the model prediction function, 1( ) is an indicator function that returns 1 if the condition is true, otherwise 0, and N is the total number of adversarial samples; The expression of robust accuracy degradation rate is: = ,in is the accuracy of the model on the original clean data, is the accuracy of the model on adversarial samples; The expression of confidence perturbation stability is Conf_Shift= , assuming that f(x) is the abnormal probability of the softmax output, it represents the average magnitude of the change in the prediction result before and after the input is disturbed.
6. The anomaly detection system for detecting unknown network attacks based on deep learning according to claim 5 is characterized in that: The anomaly detection module is used to apply the trained anomaly detection model to the real-time monitored network data flow to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks.
7. The anomaly detection system for detecting unknown network attacks based on deep learning according to claim 6 is characterized in that: The alarm and response module is used to issue an alarm or notification to an administrator.
8. An anomaly detection method for detecting unknown network attacks based on deep learning, characterized in that: Using the deep learning-based anomaly detection system for detecting unknown network attacks as described in claims 1-7, perform the following steps: S1, collects network traffic data through the data acquisition module, cleans and preprocesses the data through the data preprocessing module, and uses data synthesis and enhancement technology to augment or synthesize the processed data to expand the training data set; S2, extracting and selecting valuable features from the dataset expanded in step S1 through a feature extraction and selection module, for describing the communication behavior and characteristics of the network, and using feature selection technology to determine which features are most important for detecting network attacks; S3, designs a lightweight deep learning model structure through the lightweight model design unit in the deep learning model module, and improves the generalization ability of the deep learning model structure based on the reinforcement learning unit and transfer learning unit; S4, establishing an anomaly detection model based on the most important features for detecting network attacks extracted in step S2, and training the established anomaly detection model based on the deep learning model structure in step S3; S5, introducing a robustness enhancement technology through a robustness enhancement module, and retraining the anomaly detection model trained in S4 using the adversarial training technology in the enhancement technology; S6, applying the model trained in step S5 to the actual monitored network data stream using an anomaly detection module to detect abnormal behaviors that do not conform to known patterns and indicate unknown network attacks; S7, when abnormal behavior is detected in step S6, the alarm and response module will issue an alarm or notify the administrator.