Network intrusion detection method, device, equipment, storage medium and product

Abstract

This application relates to the field of Internet of Things (IoT) technology and discloses a network intrusion detection method, apparatus, device, storage medium, and product. The method includes: processing a network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset, where the network traffic dataset is a set of single-class samples with pseudo-labels generated based on a self-supervised mechanism; using the compressed representation as the center of an anomaly detection model; determining the distance between the model output of the compressed representation and the center of the sphere; obtaining a pre-trained anomaly detection model by minimizing the distance; and thus obtaining the network intrusion detection result. This application processes the pseudo-labeled network traffic dataset using a variational autoencoder, and the obtained compressed representation retains key features. Using this compressed representation as the center of the anomaly detection sphere, and combining it with a hyperspherical distance metric to construct a pre-trained anomaly detection model, anomaly samples are accurately identified due to their deviation from the center of the sphere, reducing computational complexity and improving detection efficiency.

Description

Technical Field

[0001] This application relates to the field of Internet of Things (IoT) technology, and in particular to a network intrusion detection method, apparatus, device, storage medium, and product. Background Technology

[0002] Currently, the number of mobile and IoT devices (such as smart home, smart healthcare, and connected vehicle devices) is surging, requiring independent computational tasks. Edge computing employs a distributed architecture, distributing computational load across edge servers and terminals. However, these edge devices are dispersed and poorly defended, making them vulnerable to various attacks. In edge computing scenarios, existing network intrusion detection methods exhibit low detection efficiency in single-sample scenarios, facing practical challenges such as high costs of acquiring high-quality labeled data, difficulty in dealing with unknown attack types, and large computational and storage overhead. Summary of the Invention

[0003] The main objective of this application is to provide a network intrusion detection method, apparatus, device, storage medium, and product, aiming to solve the technical problem of low detection efficiency of existing network intrusion detection methods in single-sample scenarios.

[0004] To achieve the above objectives, this application proposes a network intrusion detection method, the method comprising:

[0005] A network traffic dataset is obtained, and the network traffic dataset is processed by a variational autoencoder to obtain a compressed representation of the network traffic dataset. The network traffic dataset is a set of single-class samples with pseudo-labels generated based on a self-supervised mechanism. The pseudo-labels are labels derived based on preset rules.

[0006] The compressed representation is used as the center of an anomaly detection model, and the distance between the model output of the compressed representation and the center of the sphere is determined, wherein the center of the sphere is a benchmark in the feature space used to determine whether there are anomalies in the network traffic dataset;

[0007] A pre-trained anomaly detection model is obtained by minimizing the distance. The pre-trained anomaly detection model includes a hypersphere, which is a set of points whose distance is equal to the radius.

[0008] The network traffic dataset is input into the pre-trained anomaly detection model to obtain network intrusion detection results.

[0009] In one embodiment, the step of inputting the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results includes:

[0010] The network traffic dataset is input into the pre-trained anomaly detection model to obtain the output result, which includes the feature representation of the network traffic dataset and anomaly judgment label. The anomaly judgment label is an anomaly score generated based on the distance of each sample in the network traffic dataset to the center of the sphere.

[0011] Determine the contribution of the feature representation to the anomaly score, and generate a feature importance ranking list based on the contribution.

[0012] The network traffic dataset is simplified based on the feature importance ranking list to obtain a reduced dataset;

[0013] The pre-trained anomaly detection model is optimized based on the reduced dataset to obtain an optimized model, and network intrusion detection results are obtained through the optimized model.

[0014] In one embodiment, the step of determining the contribution of each feature to the anomaly score includes:

[0015] The network traffic dataset and the output results are input into the interpretability model to determine the contribution of the feature representation to the anomaly score;

[0016] Alternatively, the network traffic dataset can be input into an expert network, and the contribution of the feature representation to the anomaly score can be determined by attention weighted aggregation.

[0017] In one embodiment, the step of acquiring a network traffic dataset and processing the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset includes:

[0018] Obtain network traffic dataset;

[0019] The network traffic dataset is dimensionality reduced by a variational autoencoder to obtain an intermediate output, and the relative entropy between the intermediate output and the network traffic dataset is determined.

[0020] The network traffic dataset is reconstructed using a decoder of a variational autoencoder to obtain a reconstructed output, and the loss value between the reconstructed output and the network traffic dataset is determined.

[0021] Minimize the relative entropy and the loss value to obtain a compressed representation of the network traffic dataset.

[0022] In one embodiment, the step of determining the distance between the compressed representation model output and the center of the sphere, using the compressed representation as the center of the anomaly detection model, includes:

[0023] The compressed representation is used as the center of the anomaly detection model;

[0024] Obtain the encoder parameters of the variational autoencoder, and obtain the initial anomaly detection model based on the encoder parameters;

[0025] The compressed representation is mapped to a feature space, where the model output of the compressed representation is obtained through an initial anomaly detection model.

[0026] The distance between the model output and the center of the sphere is determined based on a preset metric algorithm.

[0027] In one embodiment, before the step of acquiring the network traffic dataset and processing the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset, the method further includes:

[0028] Capture network data packets using preset requirements parameters;

[0029] The network data packets are parsed according to preset keywords to obtain parsed data packets;

[0030] The parsed data packets are filtered and encoded according to data type to obtain processed data;

[0031] The processed data is normalized to obtain preprocessed data;

[0032] A fixed-length subsequence is iteratively extracted from the preprocessed data using a sliding window approach, and all extracted subsequences are used as the final network traffic dataset.

[0033] Furthermore, to achieve the above objectives, this application also proposes a network intrusion detection device, which includes:

[0034] The data compression module is used to acquire a network traffic dataset, process the network traffic dataset through a variational autoencoder, and obtain a compressed representation of the network traffic dataset. The network traffic dataset is a single-class sample set with pseudo-labels generated based on a self-supervised mechanism. The pseudo-labels are labels derived based on preset rules.

[0035] An anomaly detection module is used to determine the distance between the compressed representation model output and the center of the sphere, with the compressed representation as the center of the sphere. The center of the sphere is a benchmark in the feature space used to determine whether there are anomalies in the network traffic dataset.

[0036] A model building module is used to obtain a pre-trained anomaly detection model by minimizing the distance, wherein the pre-trained anomaly detection model includes a hypersphere, which is a set of points whose distance is equal to the radius;

[0037] An anomaly detection module is used to input the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results.

[0038] In addition, to achieve the above objectives, this application also proposes a network intrusion detection device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the network intrusion detection method as described above.

[0039] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the network intrusion detection method described above.

[0040] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the network intrusion detection method described above.

[0041] The technical solution proposed in this application includes: acquiring a network traffic dataset; processing the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset; the network traffic dataset being a set of single-class samples with pseudo-labels generated based on a self-supervised mechanism, where the pseudo-labels are labels derived based on preset rules; using the compressed representation as the center of an anomaly detection model; determining the distance between the model output of the compressed representation and the center of the sphere, where the center of the sphere is a benchmark in the feature space used to determine whether there are anomalies in the network traffic dataset; obtaining a pre-trained anomaly detection model by minimizing the distance; the pre-trained anomaly detection model including a hypersphere, where the hypersphere is a set of points at a distance equal to the radius; and inputting the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results. This application processes the pseudo-labeled single-class network traffic dataset using a variational autoencoder, and the resulting compressed representation retains key features. Using this compressed representation as the center of the anomaly detection sphere, combined with the hypersphere distance metric, a pre-trained anomaly detection model is constructed, enabling anomaly samples to be accurately identified due to their deviation from the center of the sphere, reducing computational complexity and improving the efficiency of network intrusion detection. Attached Figure Description

[0042] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0043] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 This is a flowchart illustrating an embodiment of the network intrusion detection method of this application.

[0045] Figure 2 This is a flowchart illustrating Embodiment 2 of the network intrusion detection method of this application;

[0046] Figure 3 This is a flowchart illustrating Embodiment 3 of the network intrusion detection method of this application;

[0047] Figure 4 This is a schematic diagram of the overall framework for network intrusion detection;

[0048] Figure 5 A diagram illustrating the feature importance ranking list;

[0049] Figure 6 This is a schematic diagram of the module structure of the network intrusion detection device according to an embodiment of this application;

[0050] Figure 7 This is a schematic diagram of the device structure of the hardware operating environment involved in the network intrusion detection method in this application embodiment.

[0051] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0052] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0053] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0054] In edge computing scenarios, existing network intrusion detection methods have low detection efficiency in single-sample scenarios and face practical difficulties such as high cost of acquiring high-quality labeled data, difficulty in dealing with unknown attack types, and large computational and storage overhead.

[0055] Therefore, in order to overcome the above-mentioned defects, this application provides a solution that processes a single-class network traffic dataset with pseudo-labels through a variational autoencoder. The resulting compressed representation retains key features and is used as the center of anomaly detection. A pre-trained anomaly detection model is constructed by combining it with a hyperspherical distance metric, so that anomaly samples are accurately identified because they deviate from the center of the sphere. This reduces computational complexity and improves the efficiency of network intrusion detection.

[0056] It should be noted that the executing entity of each embodiment of this application can be a computing service system with data processing, network communication, and program execution functions, such as an electronic system or a network intrusion detection system capable of implementing the above functions. The following description uses a network intrusion detection system (hereinafter referred to as "the system") as an example to illustrate the following embodiments.

[0057] Based on this, embodiments of this application provide a network intrusion detection method, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network intrusion detection method of this application.

[0058] In this embodiment, the network intrusion detection method includes steps S10 to S40:

[0059] Step S10: Obtain a network traffic dataset, process the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset, wherein the network traffic dataset is a single-class sample set with pseudo-labels generated based on a self-supervised mechanism, and the pseudo-labels are labels derived based on preset rules.

[0060] Currently, mobile devices and IoT devices are growing rapidly, encompassing smart devices in industries such as smart homes, smart healthcare, and connected vehicles. These devices need to independently complete computing tasks and event processing. Edge computing adopts a distributed architecture, where the central server offloads computing load to edge servers and edge smart terminals. However, edge servers and edge smart terminals are scattered in various locations, making them vulnerable to threats such as distributed denial-of-service attacks, man-in-the-middle attacks, and side-channel attacks.

[0061] In edge computing scenarios, existing network intrusion detection technologies have shortcomings. To ensure high accuracy, a large amount of high-quality labeled data is required for training, which is costly and difficult to obtain; existing methods perform multi-classification of traffic data based on assumptions about known attack types, making it difficult to cope with constantly emerging new attack types; deep learning-based methods have high computational and storage overhead, making them unsuitable for resource-constrained edge computing scenarios.

[0062] To address the aforementioned issues, this application proposes a network intrusion detection method for edge computing scenarios. This method can be divided into four main modules: data preprocessing, feature extraction, anomaly detection, and model compression. In the preparation phase, the data preprocessing module collects a large amount of traffic data, which is then preprocessed and used as input for the feature extraction, anomaly detection, and model compression modules. The feature extraction module learns the latent variables in the input features to obtain a compressed representation of the network traffic dataset. The anomaly detection module maps the compressed representation from the input space to the feature space, minimizing the hypersphere that can separate normal / abnormal traffic features (i.e., determining the distance between the model output of the compressed representation and the center of the sphere), and distinguishing between normal / abnormal traffic based on whether it is inside or outside the sphere. The model compression module applies an interpretable model to explain the anomaly detection results, sorts the inputs by importance, selects important feature subsets of different sizes, compresses the anomaly detection model, and retrains the compressed model.

[0063] This step begins by collecting network data packets from the network environment. This data encompasses information generated by various network communication activities, such as data transmission between different applications and data packets generated by user website access behavior. Collection can be achieved by deploying data acquisition devices, such as network probes and switch port mirroring, at key network nodes to ensure comprehensive acquisition of network traffic information.

[0064] In network intrusion detection scenarios, abnormal traffic (intrusion behavior) samples are often difficult to obtain comprehensively and are few in number, while normal traffic samples are relatively abundant. Therefore, a self-supervised mechanism is used to generate pseudo-labels for the collected single-class samples (containing only normal network traffic data). The self-supervised mechanism derives labels from the data's own characteristics based on preset rules. For example, network traffic data can be divided into multiple time periods according to time sequence, allowing the model to predict the values ​​of certain key features (such as the number of data packets, traffic size, etc.) in the next time period. Pseudo-labels are generated based on the accuracy of the prediction, thus providing supervision information for subsequent model training.

[0065] It should be noted that a variational autoencoder (VAE) is a deep generative model consisting of an encoder and a decoder. In network intrusion detection scenarios, VAEs are used to process single-class sample network traffic datasets with self-supervised pseudo-labels to obtain their compressed representations.

[0066] As one implementation, before step S10 above in this embodiment, the method may further include: capturing network data packets by pre-defined requirement parameters; parsing the network data packets according to pre-defined keywords to obtain parsed data packets; filtering and encoding the parsed data packets according to data type to obtain processed data; normalizing the processed data to obtain pre-processed data; iteratively extracting fixed-length subsequences from the pre-processed data using a sliding window method, and using all extracted subsequences as the final network traffic dataset.

[0067] In practical implementation, a series of requirement parameters are pre-set based on the specific tasks and objectives of network intrusion detection. These include: the time range for capturing data packets to determine when data collection will occur, focusing on high-incidence periods of intrusion activity; specifying the network interfaces to capture to ensure comprehensive coverage of network traffic by obtaining data from critical network connection points; setting the source / destination Internet Protocol Address (IP) range to target communication between specific network areas or devices; and defining the port number range to focus on ports used by common network services, as intrusion activities are often associated with these ports. Following these pre-set requirements, network packets are captured from the network environment using a network packet capture tool. This tool can monitor network traffic in real time, filter packets that meet the requirements based on the set parameters, and save them.

[0068] Furthermore, keywords related to network protocols and data fields are preset. For example, for the HTTP protocol, keywords may include request methods (GET, POST, etc.), URLs, user agents, etc.; for the TCP protocol, keywords may include source port, destination port, sequence number, acknowledgment number, etc. Using a packet parsing library or a custom parsing program, the captured network packets are parsed according to the preset keywords. This involves separating and identifying the various parts of the packet according to the protocol specifications, thereby obtaining a structured parsed data packet.

[0069] To remove irrelevant or redundant data, the parsed data packets are filtered based on data type. Integer and floating-point numbers in the parsed packets are directly retained without additional conversion or encoding, preserving their original form. String data, however, requires encoding (such as binary encoding, one-hot encoding, Gray code encoding, etc.).

[0070] Because data with different characteristics has different units and value ranges—for example, packet size ranges from hundreds to thousands of bytes, while port numbers range from 0 to 65535—if normalization is not performed, features with larger values ​​will have an excessive impact on the model during subsequent training, preventing the model from accurately learning information from other features. Therefore, normalization methods, such as min-max normalization, can be used to adjust the value range of the processed data to a specific interval.

[0071] The size and step size of the sliding window are determined. The size of the sliding window determines the length of the subsequence extracted each time. For example, the window size can be set to 100 data packets, meaning that 100 consecutive data packets are extracted as a subsequence each time. The step size represents the distance the window moves each time. If the step size is 50, the window will skip 50 data packets each time it moves. Fixed-length subsequences are iteratively extracted from the preprocessed data using a sliding window method. That is, starting from the beginning of the data, data segments are sequentially extracted according to the set window size and step size. Each extracted subsequence contains network traffic information within a specific time period, reflecting the local characteristics of network traffic. All extracted subsequences are used as the final network traffic dataset.

[0072] Step S20: Using the compressed representation as the center of the anomaly detection model, determine the distance between the model output of the compressed representation and the center of the sphere, wherein the center of the sphere is a benchmark in the feature space used to determine whether the network traffic dataset has anomalies.

[0073] It's important to note that in machine learning, the feature space is an abstract mathematical space. The compressed representation of network traffic data after VAE processing can be represented as points in this space. Each point contains specific feature information about the network traffic data, and its position in the feature space reflects the similarity and differences between the data. The center of the sphere is a key reference point in the feature space, representing typical characteristics of normal network traffic data.

[0074] Using compressed representation as the center of the anomaly detection model means establishing a standard for judging anomalies centered on the features of normal data. When new network traffic data is input, the model converts it into a point in the feature space and calculates the distance between this point and the center of the sphere. This distance reflects the degree of deviation between the new data and the features of normal data. If the distance is small, it indicates that the new data is similar to the features of normal data and can be judged as normal network traffic; if the distance is large, it indicates that the new data differs significantly from the features of normal data and can be judged as an anomaly. The distance between the model output and the center of the sphere can be obtained using specific distance metrics (such as Euclidean distance, Mahalanobis distance, etc.).

[0075] Step S30: Obtain a pre-trained anomaly detection model by minimizing the distance. The pre-trained anomaly detection model includes a hypersphere, which is a set of points whose distance is equal to the radius.

[0076] It should be noted that the hypersphere is the set of all points centered at the center of the sphere and with a preset fixed value as the radius. In anomaly detection, the hypersphere plays the role of distinguishing between normal and abnormal data.

[0077] To improve the model's performance and generalization ability in real-world tasks, the anomaly detection model is pre-trained to minimize the distance between the compressed representation of the model's output and the center of the hypersphere. As the model parameters are continuously optimized, the distance gradually decreases, and a suitable radius is determined so that the hypersphere accurately includes normal data. When new network traffic data is input into the model, if its corresponding point falls within the hypersphere, the data is considered normal; if it falls outside the hypersphere, it is judged as an anomaly. In this step, the parameters of the anomaly detection model can be continuously adjusted using optimization algorithms (such as stochastic gradient descent) to minimize the distance, gradually determining the radius of the hypersphere, ultimately resulting in a pre-trained anomaly detection model that includes the hypersphere.

[0078] Step S40: Input the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results.

[0079] The pre-trained anomaly detection model has learned the characteristic distribution of normal network traffic data and determined the hypersphere as the boundary for judging anomalies. The network traffic dataset is input into the pre-trained anomaly detection model to determine whether network intrusion behavior exists. If so, the model outputs the corresponding network intrusion detection results, such as intrusion type and intrusion severity.

[0080] This embodiment uses a Virtual Object (VAE) to process a single-class network traffic dataset with pseudo-labels. The resulting compressed representation retains key features and is used as the center of anomaly detection. A pre-trained anomaly detection model is constructed using a hyperspherical distance metric, enabling accurate identification of anomaly samples due to their deviation from the center. This reduces computational complexity and improves network intrusion detection efficiency. Furthermore, by capturing and filtering data packets using preset parameters, irrelevant fields are eliminated; encoding normalization unifies the data scale, eliminating the influence of units; and a sliding window extracts fixed-length subsequences to address the issue of inconsistent traffic time-series lengths. This provides high-quality input to the VAE and avoids model training failures caused by data noise or distribution bias.

[0081] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. On this basis, refer to Figure 2Step S40 may include steps S401 to S404:

[0082] Step S401: Input the network traffic dataset into the pre-trained anomaly detection model to obtain the output result. The output result includes the feature representation of the network traffic dataset and the anomaly judgment label. The anomaly judgment label is an anomaly score generated based on the distance of each sample in the network traffic dataset to the center of the sphere.

[0083] It should be understood that the network traffic dataset is input into the pre-trained anomaly detection model according to the preset input format and requirements (such as format conversion, dimensionality adjustment, etc.). The model analyzes each sample based on the previously learned normal network traffic characteristic patterns and obtains the output results, which include the feature representation of the network traffic dataset and anomaly judgment labels. The feature representation is obtained after the model extracts and transforms features from the input data, and can reflect the key features and internal structure of the data; the anomaly judgment label is an anomaly score calculated based on the distance of each sample in the network traffic dataset to the center of the sphere determined in the previous pre-training stage. The higher the anomaly score, the greater the deviation of the sample from the normal data features, and the more likely it is to contain intrusive behavior.

[0084] Step S402: Determine the contribution of the feature representation to the abnormal score, and generate a feature importance ranking list based on the contribution.

[0085] Based on the contribution of each feature to the anomaly score, all features in the feature representation are sorted to generate a feature importance ranking list.

[0086] As one implementation, the step of determining the contribution of the feature representation to the anomaly score in this embodiment may include: inputting the network traffic dataset and the output result into an interpretability model to determine the contribution of the feature representation to the anomaly score; or, inputting the network traffic dataset into an expert network and determining the contribution of the feature representation to the anomaly score through attention weighted aggregation.

[0087] In practice, the network traffic dataset and the output of the pre-trained anomaly detection model (including the feature representation of the network traffic dataset and anomaly judgment labels, i.e., anomaly scores) are input together into an interpretability model (such as the Shapley Additive Explanation (SHAP)). The interpretability model internally uses specific algorithms and mechanisms to analyze the relationship between feature representations and anomaly scores, that is, to quantify the role of each feature in the model's decision-making process. For example, based on interpretable structures such as decision trees and rule sets, the model can determine the contribution of each feature to the anomaly score by analyzing factors such as the frequency of occurrence and the scope of influence of features in the decision path. Specifically, if a feature frequently appears in the decision path leading to a high anomaly score and plays a key branching role, the interpretability model will assign a high contribution value to that feature; conversely, features with a smaller role and lower frequency of occurrence in the decision-making process will be assigned a lower contribution value. In this way, the interpretability model can clearly demonstrate the specific degree of influence of each feature on the anomaly score.

[0088] Another way to determine contribution is to input the network traffic dataset into a pre-built expert network. The attention mechanism in the expert network assigns corresponding attention weights to each feature, dynamically adjusting the weights based on the feature's importance; important features are given higher weights, while less important features are given lower weights. When assigning attention weights, not only is the correlation between the feature and known intrusion patterns considered, but also the feature's real-time performance in anomaly detection and its historical contribution are introduced as reference factors for weight allocation. Real-time performance refers to the feature's statistical characteristics within the current detection window, such as frequency, mean, and variance, while historical contribution is calculated based on the feature's anomaly contribution records in past detections using methods such as weighted averaging or exponential decay. These factors collectively determine the feature's final weight.

[0089] After assigning attention weights to each feature, the expert network performs a weighted aggregation operation on these features. Specifically, this involves multiplying the value of each feature by its corresponding attention weight, then summing the weighted results of all features or performing other aggregation operations, and / or using a weighted aggregation algorithm based on feature contribution. This algorithm introduces interactions and nonlinear transformations between features, and can more accurately capture the combined impact of features on anomaly scores by constructing interaction terms between features (such as multinomial features, feature crosses, etc.) and applying nonlinear activation functions. By combining the influence of each feature on the anomaly score through the above weighted aggregation, the final contribution of each feature representation to the anomaly score is determined.

[0090] Step S403: Simplify the network traffic dataset according to the feature importance ranking list to obtain a reduced dataset.

[0091] Referring to the generated feature importance ranking list, a threshold is set or a certain number of top-ranking features are selected for retention. For example, the top 80% of features by contribution can be retained, while discarding features with less impact on anomaly scores and lower rankings. Then, based on the selected features, corresponding data is extracted from the original network traffic dataset to construct a reduced dataset containing only the most critical features for anomaly detection, removing redundant and irrelevant information. This reduces the amount of data and computational complexity to some extent, while improving model training efficiency and detection accuracy.

[0092] Step S404: Optimize the pre-trained anomaly detection model based on the reduced dataset to obtain an optimized model, and obtain network intrusion detection results through the optimized model.

[0093] The pre-trained anomaly detection model is retrained and optimized using a scaled-down dataset. During optimization, the model adjusts its internal parameters based on the new dataset to better adapt to these key features, further improving its ability to identify anomalous data. Optimization methods can employ machine learning algorithms such as stochastic gradient descent and Adam, iteratively updating model parameters to achieve optimal performance on the scaled-down dataset.

[0094] After optimization, the model re-detects the input network traffic dataset. Based on the learned feature patterns and optimized parameters, the model judges each sample and outputs the final network intrusion detection result, including information such as whether intrusion behavior exists and the type of intrusion.

[0095] This embodiment generates an importance ranking list based on the contribution of feature representations to anomaly scores. This list is used to filter key features and simplify the dataset, preserving core detection capabilities while reducing computational overhead. The optimized model focuses on key features, avoiding redundant information and significantly improving detection efficiency and interpretability, achieving a balance between model lightweighting and performance. Furthermore, it provides two contribution determination paths: an interpretable model analyzes output results through post-processing to independently quantify feature impact; and an expert network directly and intrinsically interprets feature importance, avoiding reliance on external tools. This dual-path design balances interpretive flexibility and model integration, adapting to different scenario needs and ensuring the accuracy and scalability of feature contribution calculation.

[0096] Based on the first embodiment of this application, in the third embodiment of this application, the content that is the same as or similar to that in the first embodiment described above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 3Step S20 may include steps S201 to S204:

[0097] Step S201: Use the compressed representation as the center of the anomaly detection model.

[0098] Step S202: Obtain the encoder parameters of the variational autoencoder, and obtain the initial anomaly detection model based on the encoder parameters.

[0099] The VAE encoder maps high-dimensional network traffic data to a low-dimensional latent space, thus obtaining a compressed representation. In this process, the encoder learns various feature patterns and intrinsic structures within the network traffic data, and its parameters (such as neuron weights and biases) record this learned information. The encoder parameters are used to construct the initial anomaly detection model because these parameters contain rich information about normal network traffic patterns. By transferring some structures or parameters from the encoder to the anomaly detection model—for example, using some neural network layers from the encoder as the basic architecture of the anomaly detection model and initializing the corresponding parameters based on the encoder parameters—the resulting initial anomaly detection model can inherit the VAE's understanding of normal network traffic characteristics.

[0100] Step S203: Map the compressed representation to the feature space, and obtain the model output result of the compressed representation through the initial anomaly detection model in the feature space.

[0101] Mapping the compressed representation to the feature space using a mapping function (which could be a partial transformation in the encoder or an additional feature transformation operation) allows for data analysis within a unified space suitable for distance calculation and anomaly detection. The feature space can be defined based on specific needs and model design; for example, a high-dimensional Euclidean space could be chosen. Within the feature space, the compressed representation is input into the initial anomaly detection model. This model, through multi-layer neural network computation, recombines and extracts features from the compressed representation, ultimately outputting a result. This result can be a vector or a scalar, reflecting the feature representation obtained after the compressed representation has been processed by the model.

[0102] Step S204: Determine the distance between the model output and the center of the sphere based on a preset metric algorithm.

[0103] It should be noted that the preset metric algorithm is used to accurately calculate the distance between the model output and the center of the sphere. The metric algorithm can be Euclidean distance, Manhattan distance, Mahalanobis distance, etc. Euclidean distance is the most intuitive distance metric, calculating the straight-line distance between two points in the feature space, suitable for situations where features are independent and have the same scale. Manhattan distance calculates the sum of the absolute values ​​of the distances between two points on each coordinate axis, making it more suitable for data with specific structures. Mahalanobis distance considers the covariance matrix of the data, can handle situations where features are correlated, and has some adaptability to data distribution. Based on the selected preset metric algorithm, the distance between the model output and the compressed representation serving as the center of the sphere is calculated.

[0104] In one implementation, step S10 may include: acquiring a network traffic dataset; reducing the dimensionality of the network traffic dataset using a variational autoencoder encoder to obtain an intermediate output, and determining the relative entropy between the intermediate output and the network traffic dataset; reconstructing the network traffic dataset using a variational autoencoder decoder to obtain a reconstructed output, and determining the loss value between the reconstructed output and the network traffic dataset; minimizing the relative entropy and the loss value to obtain a compressed representation of the network traffic dataset.

[0105] In the specific implementation, the acquired network traffic dataset is input into the encoder part of the VAE. The encoder consists of multiple neural network layers, such as convolutional layers and fully connected layers. In the convolutional layers, convolution operations are performed between the convolutional kernel and the input data to extract local features from the data, such as specific patterns or regularities in network traffic; the fully connected layers integrate and transform the features extracted by the convolutional layers, gradually reducing the dimensionality of the data.

[0106] After being processed by the encoder, the data is compressed into a lower-dimensional latent space, resulting in an intermediate output, which is a concise representation of network traffic data in the latent space, preserving the main characteristic information of the data.

[0107] It's important to note that relative entropy (KL divergence) measures the difference between two probability distributions. In VAEs, it's necessary to determine the KL divergence between the probability distribution represented by the intermediate output and the original probability distribution of the network traffic dataset. First, it's assumed that the network traffic dataset follows a certain probability distribution, which can be modeled using a Gaussian mixture model, etc. Then, based on the intermediate output from the encoder, its probability distribution in the latent space is calculated. The KL divergence value is then determined using the formula for calculating the KL divergence between these two probability distributions. The smaller this value, the closer the probability distribution represented by the intermediate output is to the probability distribution of the original dataset; that is, the better the encoder's dimensionality reduction effect on the data, and the more accurately it can preserve the main features of the data.

[0108] Furthermore, the intermediate output of the encoder is used as the input to the decoder. The decoder, also composed of multiple neural network layers, has a structure corresponding to the encoder but functions in the opposite way: it remaps the intermediate output from the latent space back to the original data space, thus reconstructing the network traffic dataset. During reconstruction, the decoder gradually restores the dimensions and features of the data through deconvolution operations or backpropagation of fully connected layers. For example, starting with a low-dimensional latent space representation, it gradually increases the dimensions of the data, generating new data similar to the original network traffic dataset—the reconstructed output.

[0109] It should be understood that the loss value is used to measure the degree of difference between the reconstructed output and the original network traffic dataset. It can be obtained through a loss function, such as mean squared error or cross-entropy loss. The smaller the loss value, the closer the reconstructed output is to the original data, meaning the better the reconstruction effect of the decoder, and the more accurately the VAE can restore the characteristics of the network traffic data.

[0110] Based on the gradient information of KL divergence and loss value with respect to model parameters, the parameters of the encoder and decoder in the VAE are adjusted to gradually reduce the KL divergence and loss value. During iterative training, the network traffic dataset can be divided into multiple batches and sequentially input into the VAE for training. In each iteration, the KL divergence and loss value of the current batch of data are calculated, and then the model parameters are updated using an optimization algorithm. Through continuous iterative training, the parameters of the encoder and decoder are gradually adjusted, causing the KL divergence and loss value to continuously decrease. When the KL divergence and loss value reach a small stable value, the VAE is considered to have converged. At this point, the intermediate output of the encoder is a compressed representation of the network traffic dataset, which greatly reduces the dimensionality of the data while retaining the main features of the network traffic data.

[0111] This embodiment initializes the anomaly detection model through encoder parameters, ensuring alignment between the encoder and the detection model's feature space and avoiding detection errors caused by distribution offset. A pre-defined metric algorithm simplifies distance calculation complexity and improves real-time detection efficiency. Furthermore, relative entropy constraints on the encoder output distribution are introduced during VAE training, combined with minimizing reconstruction loss, forcing the model to learn the essential structural features of the data. This preserves key information while eliminating noise, solving the information loss problem of traditional dimensionality reduction methods and improving the anomaly detection model's generalization ability to complex traffic patterns.

[0112] For ease of understanding, please refer to Figure 4 and Figure 5 ( Figure 4 This is a schematic diagram of the overall framework for network intrusion detection; Figure 5 The diagram illustrating the feature importance ranking is provided for illustrative purposes only and is not intended to limit the network intrusion detection method of this application. The overall framework of the network intrusion detection method applied to edge computing scenarios is as follows: Figure 4 As shown, it can be divided into four core modules: data preprocessing, feature extraction, anomaly detection, and model compression. The specific processing steps are as follows:

[0113] (1) Data preprocessing

[0114] The data preprocessing module uses the network data acquisition and analysis tool tcpdump to obtain raw network traffic data packets and filters key features. The processing flow of this module is as follows:

[0115] Preparatory steps: Download the tcpdump and libpcap compressed packages from the official website; install the relevant dependent libraries; install the libpcap library; install tcpdump.

[0116] Step 1: Specify the network card, host IP address, port number, etc., and capture a certain amount of network data packets.

[0117] Step 2: Parse network packets, using keywords such as host, port, src, and dst to specify the source IP address, destination IP address, source port, destination port, etc.

[0118] Step 3: Retain integer and floating-point data, and encode string data. Encoding methods include, but are not limited to, binary encoding, one-hot encoding, Gray code encoding, etc.

[0119] Step 4: Select a reasonable numerical range based on the characteristics of network traffic data and normalize the traffic data.

[0120] (2) Feature extraction

[0121] The feature extraction module measures the difference in distribution between the input and intermediate outputs based on the KL divergence, and extracts key features from the original input by minimizing the reconstruction error, thus compressing the network traffic data. The processing flow of this module is as follows:

[0122] Preliminary steps: Obtain the preprocessed abnormal network traffic dataset from the data preprocessing module as the data source for this module; determine the dimensions of the network traffic dataset as one of the input parameters for the feature extraction model.

[0123] Step 1: Iteratively extract a fixed number of abnormal traffic data points as input samples for the model at a specified step size until all data has been traversed. Specifically, this data also serves as its own label.

[0124] Step 2: Apply VAE to reduce the dimensionality of the input flow data through the encoder, obtain the intermediate output after the encoder, and measure the distribution difference between the input and intermediate output based on KL divergence.

[0125] Step 3: Apply VAE to reconstruct the original input through the decoder to obtain the reconstructed output. Calculate the loss between the reconstructed output and the original input based on the loss function, which includes, but is not limited to, 0-1 loss function, squared loss function, logarithmic loss function, etc.

[0126] Step 4: Minimize the joint error of KL divergence and loss function to obtain a compressed representation of the network traffic dataset.

[0127] It should be noted that it is also possible to directly train an anomaly detection model without performing feature extraction on network traffic data to reduce its dimensionality.

[0128] (3) Anomaly detection

[0129] The anomaly detection module maps the compressed representation of the network traffic dataset from the input space to the feature space, and detects anomalies based on the distance from the data to the center of the sphere. The processing flow of this module is as follows:

[0130] Preliminary operations: Obtain the preprocessed network traffic dataset from the data preprocessing module as the data source for this module; obtain the encoder parameters from the feature extraction module and initialize the Deep Support Vector Data Descriptor (Deep SVDD) model; obtain the compressed representation of the network traffic data from the feature extraction module as the center of this module.

[0131] Step 1: Iteratively extract a fixed number of abnormal traffic data as input samples to initialize the DeepSVDD model at a specified step size until all data has been traversed.

[0132] Step 2: Calculate the Deep SVDD model output and measure the distance between the model output and the center of the sphere. The measurement algorithm includes, but is not limited to, Euclidean distance, Chebyshev distance, cosine distance, etc.

[0133] Step 3: Minimize the metric distance to obtain a hypersphere that can separate normal / abnormal traffic features and a trained Deep SVDD model.

[0134] (4) Model compression

[0135] The model compression module uses the interpretability tool SHAP to interpret the anomaly detection results of the Deep SVDD model, measures the influence of different input features on the output results, selects important feature subsets of different sizes, and retrains the Deep SVDD anomaly detection model, thereby reducing the model size and computational and storage overhead. The processing flow of this module is as follows:

[0136] Preliminary steps: Obtain the preprocessed abnormal network traffic dataset from the data preprocessing module as the data source for this module; obtain the trained Deep SVDD model from the anomaly detection module as the initial model for this module.

[0137] Step 1: Iteratively extract a certain amount of abnormal traffic data as input samples for the trained DeepSVDD model at a specified step size until all data has been traversed, and obtain the output of the DeepSVDD model and the anomaly judgment results.

[0138] Step 2: Use the abnormal traffic data from Step 1, the output of the Deep SVDD model, and the anomaly detection results as input to the interpretability tool SHAP to interpret the output of the Deep SVDD model and obtain the importance ranking of the traffic data features.

[0139] like Figure 5 The SHAP (SHapley Additive exPlanations) value plot shown illustrates the impact (contribution) of each feature on the model output. The plot lists several network traffic-related features, such as flow bytes / s, minimum forward segment size, and flow packet rate / s. The color of the dots indicates the magnitude of the feature value (the value represented by the feature in the network traffic dataset), with closer to red indicating a high feature value and closer to blue indicating a low feature value. The plot shows that some features, such as "Flow Bytes / s," have relatively large SHAP values, indicating a significant impact on the model output.

[0140] Step 3: Based on the feature importance ranking list obtained in Step 2, extract a smaller scale of network traffic as input to the Deep SVDD model and retrain the Deep SVDD model.

[0141] The key features of this technical solution are: a low-cost hybrid framework for network intrusion detection applied to edge computing scenarios, comprising four core parts: data preprocessing, feature extraction, anomaly detection, and model compression; training the feature extraction and anomaly detection models using abnormal network traffic, significantly reducing reliance on manually labeled high-quality datasets; applying self-supervised learning methods to train the model to learn abnormal traffic behavior patterns, rather than performing multi-classification tasks, thus enabling it to cope with unknown attacks; employing interpretable models to explain anomaly detection results, reducing the black-box nature of deep learning models to some extent; and measuring the influence of different input features on anomaly results, selecting feature subsets of different sizes to retrain the anomaly detection model, significantly reducing model size and computational and storage overhead.

[0142] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the network intrusion detection method of this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0143] This application also provides a network intrusion detection device; please refer to... Figure 6 The network intrusion detection device includes:

[0144] The data compression module 10 is used to acquire a network traffic dataset, process the network traffic dataset through a variational autoencoder, and obtain a compressed representation of the network traffic dataset. The network traffic dataset is a single-class sample set with pseudo-labels generated based on a self-supervised mechanism. The pseudo-labels are labels derived based on preset rules.

[0145] The anomaly detection module 20 is used to determine the distance between the compressed representation model output and the center of the sphere, using the compressed representation as the center of the sphere of the anomaly detection model, wherein the center of the sphere is a benchmark in the feature space used to determine whether the network traffic dataset has anomalies.

[0146] The model building module 30 is used to obtain a pre-trained anomaly detection model by minimizing the distance, wherein the pre-trained anomaly detection model includes a hypersphere, and the hypersphere is a set of points whose distance is equal to the radius;

[0147] The anomaly detection module 40 is used to input the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results.

[0148] The network intrusion detection device provided in this application, employing the network intrusion detection method described in the above embodiments, can solve the technical problem of low detection efficiency in single-sample scenarios of existing network intrusion detection methods. Compared with the prior art, the beneficial effects of the network intrusion detection device provided in this application are the same as those of the network intrusion detection method provided in the above embodiments, and other technical features in the network intrusion detection device are the same as those disclosed in the methods of the above embodiments, and will not be repeated here.

[0149] This application provides a network intrusion detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network intrusion detection method in Embodiment 1 above.

[0150] The following is for reference. Figure 7 This document illustrates a structural diagram suitable for implementing a network intrusion detection device according to embodiments of this application. The network intrusion detection device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Detection), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 7 The network intrusion detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0151] like Figure 7As shown, a network intrusion detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.) that can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the network intrusion detection device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the network intrusion detection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows network intrusion detection devices with various systems, it should be understood that it is not required to implement or possess all of the systems shown. More or fewer systems may be implemented alternatively.

[0152] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0153] The network intrusion detection device provided in this application, employing the network intrusion detection method described in the above embodiments, can solve the technical problem of low detection efficiency in single-sample scenarios of existing network intrusion detection methods. Compared with the prior art, the beneficial effects of the network intrusion detection device provided in this application are the same as those of the network intrusion detection method provided in the above embodiments, and other technical features of this network intrusion detection device are the same as those disclosed in the previous embodiment method, and will not be repeated here.

[0154] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0155] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0156] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, the computer-readable program instructions being used to execute the network intrusion detection method described in the above embodiments.

[0157] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0158] The aforementioned computer-readable storage medium may be included in the network intrusion detection device; or it may exist independently and not be assembled into the network intrusion detection device.

[0159] The aforementioned computer-readable storage medium carries one or more programs. When these programs are executed by a network intrusion detection device, the network intrusion detection device performs the following actions: acquires a network traffic dataset; processes the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset, wherein the network traffic dataset is a set of single-class samples with pseudo-labels generated based on a self-supervised mechanism, and the pseudo-labels are labels derived based on preset rules; uses the compressed representation as the center of an anomaly detection model; determines the distance between the model output of the compressed representation and the center of the sphere, wherein the center of the sphere is a benchmark in the feature space used to determine whether there is an anomaly in the network traffic dataset; obtains a pre-trained anomaly detection model by minimizing the distance, wherein the pre-trained anomaly detection model includes a hypersphere, which is a set of points at a distance equal to the radius; and inputs the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results.

[0160] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. These programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—and conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, entirely on a remote computer or server, or on an ARM (Advanced RISC Machines) development board. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0161] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0162] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0163] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described network intrusion detection method, which can solve the technical problem of low detection efficiency of existing network intrusion detection methods in single-sample scenarios. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as the beneficial effects of the network intrusion detection method provided in the above embodiments, and will not be repeated here.

[0164] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network intrusion detection method described above.

[0165] The computer program product provided in this application can solve the technical problem of low detection efficiency of existing network intrusion detection methods in single-sample scenarios. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the network intrusion detection methods provided in the above embodiments, and will not be repeated here.

[0166] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the content of this application specification and drawings, or direct / indirect applications in other related technical fields, are included in the scope of protection of this application.

Claims

1. A network intrusion detection method, characterized in that, The method includes the following steps: A network traffic dataset is obtained, and the network traffic dataset is processed by a variational autoencoder to obtain a compressed representation of the network traffic dataset. The network traffic dataset is a set of single-class samples with pseudo-labels generated based on a self-supervised mechanism. The pseudo-labels are labels derived based on preset rules. The compressed representation is used as the center of an anomaly detection model, and the distance between the model output of the compressed representation and the center of the sphere is determined, wherein the center of the sphere is a benchmark in the feature space used to determine whether there are anomalies in the network traffic dataset; A pre-trained anomaly detection model is obtained by minimizing the distance. The pre-trained anomaly detection model includes a hypersphere, which is a set of points whose distance is equal to the radius. The network traffic dataset is input into the pre-trained anomaly detection model to obtain network intrusion detection results; The step of inputting the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results includes: The network traffic dataset is input into the pre-trained anomaly detection model to obtain the output result, which includes the feature representation of the network traffic dataset and anomaly judgment label. The anomaly judgment label is an anomaly score generated based on the distance of each sample in the network traffic dataset to the center of the sphere. Determine the contribution of the feature representation to the anomaly score, and generate a feature importance ranking list based on the contribution. The network traffic dataset is simplified based on the feature importance ranking list to obtain a reduced dataset; The pre-trained anomaly detection model is optimized based on the reduced dataset to obtain an optimized model, and network intrusion detection results are obtained through the optimized model.

2. The network intrusion detection method as described in claim 1, characterized in that, The step of determining the contribution of each feature to the anomaly score includes: The network traffic dataset and the output results are input into the interpretability model to determine the contribution of the feature representation to the anomaly score; Alternatively, the network traffic dataset can be input into an expert network, and the contribution of the feature representation to the anomaly score can be determined by attention weighted aggregation.

3. The network intrusion detection method as described in claim 1 or 2, characterized in that, The step of acquiring the network traffic dataset and processing it using a variational autoencoder to obtain a compressed representation of the network traffic dataset includes: Obtain network traffic dataset; The network traffic dataset is dimensionality reduced by a variational autoencoder to obtain an intermediate output, and the relative entropy between the intermediate output and the network traffic dataset is determined. The network traffic dataset is reconstructed using a decoder of a variational autoencoder to obtain a reconstructed output, and the loss value between the reconstructed output and the network traffic dataset is determined. Minimize the relative entropy and the loss value to obtain a compressed representation of the network traffic dataset.

4. The network intrusion detection method as described in claim 1 or 2, characterized in that, The step of determining the distance between the compressed representation model output and the center of the sphere, using the compressed representation as the center of the anomaly detection model, includes: The compressed representation is used as the center of the anomaly detection model; Obtain the encoder parameters of the variational autoencoder, and obtain the initial anomaly detection model based on the encoder parameters; The compressed representation is mapped to a feature space, where the model output of the compressed representation is obtained through an initial anomaly detection model. The distance between the model output and the center of the sphere is determined based on a preset metric algorithm.

5. The network intrusion detection method as described in claim 1 or 2, characterized in that, Before the step of acquiring the network traffic dataset and processing the network traffic dataset using a variational autoencoder to obtain a compressed representation of the network traffic dataset, the method further includes: Capture network data packets using preset requirements parameters; The network data packets are parsed according to preset keywords to obtain parsed data packets; The parsed data packets are filtered and encoded according to data type to obtain processed data; The processed data is normalized to obtain preprocessed data; A fixed-length subsequence is iteratively extracted from the preprocessed data using a sliding window approach, and all extracted subsequences are used as the final network traffic dataset.

6. A network intrusion detection device, characterized in that, The network intrusion detection device includes: The data compression module is used to acquire a network traffic dataset, process the network traffic dataset through a variational autoencoder, and obtain a compressed representation of the network traffic dataset. The network traffic dataset is a single-class sample set with pseudo-labels generated based on a self-supervised mechanism. The pseudo-labels are labels derived based on preset rules. An anomaly detection module is used to determine the distance between the compressed representation model output and the center of the sphere, with the compressed representation as the center of the sphere. The center of the sphere is a benchmark in the feature space used to determine whether there are anomalies in the network traffic dataset. A model building module is used to obtain a pre-trained anomaly detection model by minimizing the distance, wherein the pre-trained anomaly detection model includes a hypersphere, which is a set of points whose distance is equal to the radius; An anomaly detection module is used to input the network traffic dataset into the pre-trained anomaly detection model to obtain network intrusion detection results; The anomaly detection module is further configured to input the network traffic dataset into the pre-trained anomaly detection model to obtain an output result, the output result including the feature representation of the network traffic dataset and anomaly judgment labels, the anomaly judgment labels being anomaly scores generated based on the distance of each sample in the network traffic dataset to the center of the sphere; determine the contribution of the feature representation to the anomaly score, and generate a feature importance ranking list based on the contribution; simplify the network traffic dataset according to the feature importance ranking list to obtain a reduced dataset; optimize the pre-trained anomaly detection model based on the reduced dataset to obtain an optimized model, and obtain network intrusion detection results through the optimized model.

7. A network intrusion detection device, characterized in that, The network intrusion detection device includes: a memory, a processor, and a network intrusion detection program stored in the memory and executable on the processor. When the network intrusion detection program is executed by the processor, it implements the network intrusion detection method as described in any one of claims 1 to 5.

8. A storage medium, characterized in that, The storage medium stores a network intrusion detection program, which, when executed by a processor, implements the network intrusion detection method as described in any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the network intrusion detection method as described in any one of claims 1 to 5.

Images