Network intrusion detection method based on improved wgan sampling and ensemble learning

Abstract

The present application relates to a network intrusion detection method based on improved WGAN sampling and ensemble learning, which solves the defects of insufficient adaptive ability of base learners of the ensemble model, difficulty in suppressing noise interference and mining key attack patterns for high-dimensional and class-unbalanced network traffic data compared with the prior art. The present application comprises the following steps: network traffic data acquisition; data enhancement based on DDWGLO framework; network intrusion detection model construction based on stacking; network intrusion detection model training; real-time network intrusion detection. The present application uses DDWGLO for data enhancement, and adaptively assigns weights based on the Newton-Raphson optimization algorithm improved by Circle chaotic mapping, thereby improving the accuracy of network intrusion detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network intrusion detection method based on improved WGAN sampling and ensemble learning. BACKGROUND

[0002] With the rapid development of new generation information technology, the Internet penetration rate continues to rise, the online user group size continues to expand, and network traffic data also presents an explosive growth trend. At the same time, network intrusion behaviors are hidden in massive network traffic data, which further aggravates the concealment and complexity of network intrusion behaviors. In order to ensure the security of network space, it has become an important demand to study accurate and robust network traffic intrusion detection technology.

[0003] In the network security scenario of intrusion detection, class imbalance is a particularly prominent problem. Because abnormal traffic data is much less than normal traffic data, the model is prone to bias towards the majority class during training, making it difficult for the model to learn the characteristics of the minority class and accurately capture the complex patterns and rules of network intrusion samples, so that a large number of potential network intrusion risks are easily ignored in actual application.

[0004] In addition, the complexity and dynamics of the network environment make it difficult for traditional single models to handle high-dimensional nonlinear data, resulting in insufficient generalization ability and easy overfitting, and it is difficult to adapt to the rapid changes of network traffic patterns, thereby affecting the accuracy and stability of network intrusion detection. Although the integrated model can effectively improve the accuracy and stability of the prediction result by combining multiple independent and diversified single prediction models. However, based on the complexity and diversity of network traffic data, the processing ability and adaptability of different base classifiers on the same data set also have certain differences. Correct detection can provide valuable information to help capture complex patterns and improve classification accuracy; but false detection will introduce noise, causing the result to deviate from the true situation. Although the current ensemble algorithm has shown advantages in network anomaly detection, how to optimize the combination of base learners, improve the mining ability of different data features, and enhance the robustness to outliers and noise still needs further exploration.

[0005] Based on this, network intrusion detection faces two major challenges, one is the class imbalance problem of data distribution, and the other is the deficiency of ensemble model in base learner combination optimization, which directly affects the accuracy and effectiveness of network intrusion detection. Therefore, an innovative network intrusion detection method is urgently needed to effectively solve the above problems and improve the performance of network intrusion detection to better cope with the increasingly complex network security threats and protect the security and stability of network space. SUMMARY

[0006] The purpose of the present application is to solve the defects of the prior art that the base learners of the integrated model have insufficient adaptive ability, are difficult to suppress noise interference and mine key attack patterns for high-dimensional and class-imbalance network traffic data, and provide a network intrusion detection method based on improved WGAN sampling and ensemble learning to solve the above problems.

[0007] In order to achieve the above purpose, the technical scheme of the present application is as follows:

[0008] A network intrusion detection method based on improved WGAN sampling and ensemble learning, comprising the following steps:

[0009] 11) Network traffic data acquisition: acquire network traffic data and preprocess to obtain a class-imbalance dataset;

[0010] 12) Data augmentation based on DDWGLO framework: use a hybrid sampling DDWGLO framework to sample and process attack traffic classes in the class-imbalance dataset;

[0011] 13) Constructing a network intrusion detection model based on Stacking;

[0012] 14) Training of the network intrusion detection model: train the network intrusion detection model using the class-balanced training set R2, and use the improved Newton-Raphson optimization algorithm based on Circle chaotic mapping to adaptively assign optimal weights to the output results of the Stacking primary learners, and use the weighted detection results as the training set of the Stacking secondary learners;

[0013] 15) Real-time detection of network intrusion: real-time listen to network traffic data, input the network traffic data into the trained network intrusion detection model, output the detection results, and realize network intrusion detection.

[0014] The network traffic data acquisition comprises the following steps:

[0015] 21) Acquire network traffic data, which is divided into numerical data and classification data, and use mean filling for missing values of numerical data and mode filling for missing values of classification data;

[0016] 22) For classification data, use one-hot encoding to convert it into numerical data, and merge it with numerical data to construct an original dataset;

[0017] 23) Normalize the original dataset to scale the numerical range of each feature to the interval [0, 1], and the normalization formula is:

[0018] ,

[0019] In the formula, The normalized data, The sample value of the feature vector in the original data set, And The minimum and maximum values of the feature vector, respectively;

[0020] 24) Feature selection based on Pearson correlation coefficient test: by calculating the correlation coefficient matrix between each feature in the original data set, identify the feature pair with absolute value greater than 0.8, and remove one of them randomly to reduce redundancy, the calculation formula of Pearson correlation coefficient is:

[0021] ,

[0022] In the formula, Pearson correlation coefficient, its value between-1 and 1, the closer to 1, the stronger the correlation, And The observed values of the first Sample on two different features, And The sample mean of the two features, The number of samples;

[0023] 25) Feature selection based on random forest: by training a random forest classifier, according to the feature importance score, filter out the features with importance higher than 0.005 to get the class imbalance data set R;

[0024] 26) Divide the class imbalance data set R into class imbalance training set R1 and test set E1 according to the ratio of 8:2, select the top 10 features according to the feature importance based on the class imbalance training set R1 to construct the key feature subset R1'.

[0025] The data augmentation based on the DDWGLO framework includes the following steps:

[0026] 31) Set the DDWGLO framework including DDWGAN model and LOF model;

[0027] 32) Setting up the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. All three components use a multilayer perceptron. The generator G includes four fully connected layers, with the hidden layers using LeakyReLU activation and batch normalization, and the output layer using the tanh activation function. The global discriminator D1 and the local discriminator D2 are configured identically, each including three fully connected layers, with the hidden layers using LeakyReLU activation and the output layer using linear activation. During training, all three components use the RMSprop optimizer.

[0028] The loss function for the DDWGAN model is defined by using the Wasserstein distance to measure the distance between distributions, and its calculation formula is as follows:

[0029] ,

[0030] In the formula, Represent two probability distributions and Wasserstein distance between them and These represent the distribution of real data and the distribution of generated data, respectively. Let the infimum of the set be... for and A joint probability distribution, for and The set of all joint distributions, Describe the joint distribution random variables under Expectations yes and Wassertein distance between them;

[0031] Transform it into the following form:

[0032] ,

[0033] In the formula, For the upper bound, This is the Lipschitz constant. Representation function The Lipschitz constant, For function In the true distribution The expected value under, For function In generating distribution the expected value under the distribution of the data set R1;

[0034] 33) Training of DDWGAN model: training the DDWGAN model using the class imbalance training set R1 and the key feature subset R1';

[0035] 34) Setting of LOF model: introducing the LOF model to perform anomaly detection on the samples generated by the generator G, and removing the noise samples therein, and calculating the local outlier factor of each point The local outlier factor formula of the point is:

[0036] ,

[0037] wherein, is a parameter for determining the number of neighbors, represents a feature, which is regarded as a point in space, represents the local outlier factor of the point, represents the set of the nearest neighbors of the point, represents a point in the set, represents the distance from the point to its nearest neighbor, represents the local reachable density of the point , represents the number of elements in the neighbor set ;

[0038] 35) Implementation of data augmentation: using the trained DDWGAN model to perform the first data balancing processing on the class imbalance training set R1; then using the LOF model to perform anomaly detection on the generated samples, and removing the noise samples therein; after removing the noise, the classes become unbalanced again, and the DDWGAN model is used for the second class balancing processing to obtain the final class balanced training set R2.

[0039] The network intrusion detection model based on Stacking comprises the following steps:

[0040] 41) Setting of network intrusion detection model: the network intrusion detection model comprises two-level learners, three classifiers of XGBoost, CatBoost and LightGBM are used as the first-level learners of Stacking, and a logistic regression model is used as the second-level learner of Stacking;

[0041] 42) The parameters of XGBoost, Catboost, LightGBM and logistic regression model are respectively optimized by the method of grid search combined with five-fold cross-validation, wherein:

[0042] For XGBoost, the learning rate learning_rate, the number of trees n_estimators, the subsampling ratio subsample and the column sampling ratio colsample_bytree are optimized;

[0043] For Catboost, the maximum depth of the tree depth, the learning rate learning_rate, the number of iterations iterations and the L2 regularization coefficient l2_leaf_reg are optimized;

[0044] For LightGBM, the maximum depth of the tree max_depth, the learning rate learning_rate, the number of trees n_estimators, the number of leaf nodes num_leaves and the column sampling ratio colsample_bytree are optimized;

[0045] For the logistic regression model, the regularization parameter c and the regularization type penalty are optimized.

[0046] The training of the network intrusion detection model comprises the following steps:

[0047] 51) Train the Stacking primary learners XGBoost, CatBoost and GBDT using the class-balanced training set R2 and obtain the detection results of the three classifiers to form the feature vector ,

[0048] wherein, , and are the output vectors of XGBoost, CatBoost and GBDT, respectively;

[0049] 52) Self-adaptively assign weights to the output vectors of the primary learners by optimization algorithm: based on the detection results of the Stacking primary learners, use the Newton-Raphson optimization algorithm improved based on Circle chaos mapping for self-adaptive weight assignment;

[0050] 53) Assign the optimal weights to the training set R3 and the test set E1, train the Stacking secondary learner, i.e. the logistic regression model, using the weighted training set R3, and output the detection results of the weighted test set E1 to realize network intrusion detection.

[0051] The training of the DDWGAN model comprises the following steps:

[0052] 61) Initialize model parameters: set the initial parameters of the generator G, global discriminator D1 and local discriminator D2, and determine the hyperparameters in the training process, including learning rate, iteration number;

[0053] 62) The generator G receives random noise satisfying Gaussian distribution as input, and generates false data similar to the real data in the class imbalance dataset R;

[0054] 63) The global discriminator D1 evaluates the real data and generated data in the class imbalance training set R1 from the whole, and outputs a continuous score, and the local discriminator D2 evaluates the real data and generated data in the key feature subset R1' from the local;

[0055] 64) The generator G performs adversarial training by minimizing the discriminant score of the generated data in the global discriminator D1 and the local discriminator D2, and the goal is to generate high-quality false data that can deceive both the global discriminator D1 and the local discriminator D2;

[0056] 65) Update the model parameters using the RMSprop optimizer, and perform hard clipping on the gradient tensor when backpropagating the global discriminator D1 and the local discriminator D2, to approximately satisfy the Lipschitz continuity condition;

[0057] 66) In each training cycle, first update the global discriminator D1 and the local discriminator D2 for five iterations respectively, then fix the parameters of the global discriminator D1 and the local discriminator D2 and train the generator G, through multiple iterations, the generator G gradually approximates the real data distribution in the class imbalance dataset, and finally realizes high-fidelity data generation.

[0058] The method for adaptively assigning weights to the output vector of the primary learner through an optimization algorithm comprises the following steps:

[0059] 71) Define the maximum iteration number of the Newton-Raphson optimization algorithm as , the current iteration number as , and initialize ;

[0060] 72) Initialize the first generation population using the Circle chaotic mapping function, the first generation population containing individuals, the Circle chaotic mapping function making the population individuals uniformly distributed in the search space, and the Circle chaotic mapping function being defined as follows:

[0061] ,

[0062] wherein Indicates the position after mapping. Indicates the original position of the target. The sequence number generated by the mapping. This represents the modulo operation. and For parameters, the default value is... It is 0.5. It is 0.2;

[0063] 73) The first The weight vector generated this time Weighting the feature vector A training set R3 is formed, which is then further divided into a training set R4 and a validation set.

[0064] in, , and These are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT, respectively, during the first optimization process.

[0065] 74) Train the logistic regression model using the training set R4, and evaluate the detection performance of the logistic regression model using the validation set;

[0066] 75) To evaluate the impact of iteratively updated weights on detection performance under the adaptive weight allocation strategy, the objective function is set as follows:

[0067] in, The AUC value is the output of logistic regression, used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression, which reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is reduced while ensuring the model's global discrimination ability.

[0068] The fitness function is The fitness value is fed back to the Newton-Raphson optimization algorithm, and the search direction is updated accordingly.

[0069] 76) Combining the Newton-Raphson search rule and trap avoidance operator updates. In the next iteration, the feature vector weight combination ,in, , and The first The adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT during the optimization process.

[0070] The Newton-Raphson search rule uses the gradient information of the fitness function to accelerate convergence, and its update rule is:

[0071]

[0072]

[0073] wherein, is the direction of position update, is a random number of normal distribution, and represent the optimal solution and the worst solution in the current population respectively, represents the position of the current individual, is a random vector for adjusting the search direction, is a 1xdim uniform random number vector, and dim is the dimension, represents the current iteration number;

[0074] The trap avoidance operator applies random disturbance to the solution with a fitness value lower than the optimal solution in the current population, and the update formula of the trap avoidance operator is:

[0075]

[0076] wherein, represents the position of the updated individual, represents the position of the current individual, represents the optimal solution in the current population, represents the average value of the positions of all individuals in the current iteration, and are random numbers of uniform distribution, is an adaptive coefficient, and are binary random numbers;

[0077] 77) Repeat steps 73)-76), and after the iteration number set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight .

[0078] A computer readable storage medium, the storage medium has a computer program stored thereon, when the computer program is executed by a processor, a network intrusion detection method based on improved WGAN sampling and ensemble learning is realized.

[0079] A computer device, comprising a memory, a processor and a computer program stored on the memory and running on the processor, when the processor executes, a network intrusion detection method based on improved WGAN sampling and ensemble learning is realized. ​​​

[0080] Advantages

[0081] Compared with the prior art, the network intrusion detection method based on the improved WGAN sampling and the integrated learning of the application adopts DDWGLO for data enhancement, and adaptively assigns weights based on the Newton-Raphson optimization algorithm improved based on Circle chaos mapping, thereby improving the accuracy of network intrusion detection.

[0082] The application performs data enhancement through a DDWGAN model, optimizes its own parameters from two levels of macro and micro by setting a global discriminator and a local discriminator, and generates high-quality samples. On this basis, the LOF algorithm is introduced to detect and eliminate noise samples, effectively solving the class imbalance problem and providing a better data basis for subsequent network intrusion detection. In addition, based on the Stacking integrated learning framework, the Newton-Raphson optimization algorithm improved based on Circle chaos mapping is combined to adaptively assign weights, fully capture the complex nonlinear features and potential patterns in network traffic, and enhance the generalization ability and detection accuracy of the model.

[0083] The weight adaptive allocation mechanism of the network intrusion detection method belongs to a multi-objective optimization problem, and common intelligent optimization algorithms include genetic algorithms, particle swarm algorithms, simulated annealing algorithms, etc. Compared with other algorithms, the Newton-Raphson optimization algorithm improved based on Circle chaos mapping involved in the application can not only enhance the convergence speed of the algorithm, but also avoid local optimal solutions. BRIEF DESCRIPTION OF DRAWINGS

[0084] Figure 1 The method sequence diagram of the application;

[0085] Figure 2 The DDWGAN structure diagram involved in the application;

[0086] Figure 3 The process flow diagram for adaptively assigning weights using the Newton-Raphson optimization algorithm improved based on Circle chaos mapping involved in the application;

[0087] Figure 4 The performance comparison diagram of the network intrusion detection method involved in the application and other models. DETAILED DESCRIPTION

[0088] In order to have a further understanding and understanding of the structural characteristics and effects achieved by the application, the following detailed description is provided in combination with preferred embodiments and drawings:

[0089] As shown in Figure 1 A network intrusion detection method based on improved WGAN sampling and integrated learning according to the application comprises the following steps:

[0090] The first step is to obtain network traffic data and preprocess it to obtain an imbalanced dataset.

[0091] (1) Obtain network traffic data, which is divided into numerical data and classification data. For numerical data, the missing values are filled with the mean value, and for classification data, the missing values are filled with the mode value.

[0092] (2) For classification data, use one-hot encoding to convert it to numerical data and merge it with numerical data to construct an original dataset.

[0093] (3) Normalize the original dataset to scale the numerical range of each feature to the interval [0, 1]. The normalization formula is:

[0094] ,

[0095] where is the normalized data, is the sample value of the feature vector in the original dataset, and are the minimum and maximum values of the feature vector, respectively.

[0096] (4) Feature selection based on Pearson correlation coefficient test: Calculate the correlation coefficient matrix between each feature in the original dataset to identify feature pairs with an absolute correlation coefficient greater than 0.8, and randomly remove one feature to reduce redundancy. The calculation formula of Pearson correlation coefficient is:

[0097] ,

[0098] where is the Pearson correlation coefficient, whose value is between -1 and 1, and the closer the absolute value is to 1, the stronger the correlation, and are the observed values of the th sample on two different features, and are the sample means of the two features, is the sample size.

[0099] (5) Feature selection based on random forest: Train a random forest classifier and select features with importance scores higher than 0.005 to obtain an imbalanced dataset R.

[0100] (6) Divide the class-imbalanced dataset R into a class-imbalanced training set R1 and a test set E1 in a ratio of 8:2. Based on the class-imbalanced training set R1, select the top 10 features in terms of feature importance to construct a key feature subset R1'.

[0101] The second step is to perform data augmentation based on the DDWGLO framework: use the hybrid sampling DDWGLO framework to sample attack traffic categories in the imbalanced dataset.

[0102] (1) The DDWGLO framework is defined as including the DDWGAN model and the LOF model.

[0103] (2) Setting up the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. The generator G, the global discriminator D1, and the local discriminator D2 all use a multilayer perceptron. The generator G includes four fully connected layers. The hidden layers use the LeakyReLU activation function and batch normalization, and the output layer uses the tanh activation function. The global discriminator D1 and the local discriminator D2 are set up the same way, each including three fully connected layers. The hidden layers use the LeakyReLU activation function, and the output layer uses linear activation. During training, the generator G, the global discriminator D1, and the local discriminator D2 all use the RMSprop optimizer.

[0104] The loss function for the DDWGAN model is defined by using the Wasserstein distance to measure the distance between distributions, and its calculation formula is as follows:

[0105] ,

[0106] In the formula, Represent two probability distributions and Wasserstein distance between them and These represent the distribution of real data and the distribution of generated data, respectively. Let the infimum of the set be... for and A joint probability distribution, for and The set of all joint distributions, Describe the joint distribution random variables under Expectations yes and Wassertein distance between them;

[0107] Transform it into the following form:

[0108] ,

[0109] wherein, is the upper bound, is the Lipschitz constant, denotes the Lipschitz constant of the function , is the expectation value of the function under the real distribution , is the expectation value of the function under the generated distribution ;

[0110] (3) Training of the DDWGAN model: training the DDWGAN model using the class- imbalanced training set R1 and the key feature subset R1'.

[0111] The training of the DDWGAN model includes the following steps:

[0112] A1) Initialization of model parameters: setting the initial parameters of the generator G, the global discriminator D1 and the local discriminator D2, and determining the hyperparameters in the training process, including the learning rate, the number of iterations;

[0113] A2) The generator G receives random noise satisfying a Gaussian distribution as input, and generates fake data similar to the real data in R;

[0114] A3) The global discriminator D1 evaluates the real data and the generated data in the class- imbalanced training set R1 as a whole, and outputs a continuous score, and the local discriminator D2 evaluates the real data and the generated data in the key feature subset R1' from the local;

[0115] A4) The generator G performs adversarial training by minimizing the discriminant score of the generated data in the global discriminator D1 and the local discriminator D2, and the goal is to generate high-quality fake data that can deceive both the global discriminator D1 and the local discriminator D2;

[0116] A5) Update the model parameters using the RMSprop optimizer, and perform hard clipping on the gradient tensor when backpropagating the global discriminator D1 and the local discriminator D2, to approximately satisfy the Lipschitz continuity condition;

[0117] A6) In each training cycle, first update the global discriminator D1 and the local discriminator D2 for five iterations respectively, and then fix the parameters of the global discriminator D1 and the local discriminator D2 and train the generator G. Through multiple iterations, the generator G gradually approximates the real data distribution in the class- imbalanced data set, and finally realizes high-fidelity data generation.

[0118] (4) Set the LOF model: introduce the LOF model to detect the abnormal samples generated by the generator G, and remove the noise samples, calculate the local anomaly factor of the point The formula of the local anomaly factor of the point

[0119] ,

[0120] Among them, is a parameter for determining the number of neighbors, represents a feature, which is regarded as a point in space, represents the local outlier factor of the point, represents the set of k nearest neighbors of the point, represents a point in , represents the distance from the point to its kth nearest neighbor, represents the local reachable density of the point , represents the number of elements in the nearest neighbor set .

[0121] Network traffic data often has complex structure and multiple influencing factors, and density-based detection methods can better adapt to such complex data structure. LOF is a density-based unsupervised learning method, and its core principle is to detect abnormal points in the data set by comparing the local density of data points. Network intrusion events are usually caused by multiple complex factors, and their characteristics may have subtle differences from normal samples, while the LOF algorithm can sensitively capture these differences and accurately identify abnormal points that are different from the surrounding samples, and retain generated samples that are closer to real samples.

[0122] (5) Implementation of data augmentation: use the trained DDWGAN model to perform the first data balancing processing on the class imbalanced training set R1; then use the LOF model to detect the generated samples, and remove the noise samples; After removing the noise, the classes become imbalanced again, and the DDWGAN model is used for the second class balancing processing to obtain the final class balanced training set R2.

[0123] Step 3: Build a network intrusion detection model based on Stacking.

[0124] ​​​​​Stacking algorithm is essentially to stack multiple classification models together to form a multi-layer classification model, which can significantly improve the overall performance by heterogeneous integration of multiple base models. Specifically, the algorithm usually adopts a two-layer structure. In the first layer, multiple base classifiers run in parallel, each independently learning and predicting the original training data. The prediction results of these base classifiers are integrated into a new set of features as input for the second layer. In the second layer, the meta-classifier learns and integrates this new set of features to generate the prediction results. This hierarchical structure design can fully integrate the advantages of different models, make use of the expertise of each base model in different features and samples, make up for the shortcomings of single model in some aspects, effectively reduce the bias and variance, and improve the accuracy and stability of prediction. Compared with homogeneous integrated models, the Stacking algorithm avoids the homogenization problem of homogeneous models through heterogeneous base models, and can better mine multiple patterns and information in data, thus showing better performance in handling complex data structures.

[0125] (1) Set the network intrusion detection model to include two-level learners, use XGBoost, CatBoost, and LightGBM as the first-level learners of Stacking, and use a logistic regression model as the second-level learner of Stacking;

[0126] (2) Use the grid search combined with five-fold cross-validation method to optimize the parameters of XGBoost, CatBoost, LightGBM, and logistic regression model respectively, wherein:

[0127] For XGBoost, optimize the learning rate learning_rate, the number of trees n_estimators, the subsampling ratio subsample, and the column sampling ratio colsample_bytree;

[0128] For Catboost, optimize the maximum depth of the tree depth, the learning rate learning_rate, the number of iterations iterations, and the L2 regularization coefficient l2_leaf_reg;

[0129] For LightGBM, optimize the maximum depth of the tree max_depth, the learning rate learning_rate, the number of trees n_estimators, the number of leaf nodes num_leaves, and the column sampling ratio colsample_bytree;

[0130] For the logistic regression model, optimize the regularization parameter c and the regularization type penalty.

[0131] Step 4: Training of the network intrusion detection model: The network intrusion detection model is trained using the class-balanced training set R2. The Newton-Raphson optimization algorithm improved based on Circle chaotic mapping is used to adaptively assign optimal weights to the output results of the Stacking primary learners, and the detection results after weighting are used as the training set of the Stacking secondary learners.

[0132] (1) The Stacking primary learners XGBoost, CatBoost and GBDT are trained using the class-balanced training set R2, and the detection results of the three classifiers are obtained to form the feature vector ,

[0133] wherein, , and are the output vectors of XGBoost, CatBoost and GBDT, respectively;

[0134] (2) Adaptive weight assignment for the output vectors of the primary learners: Based on the detection results of the Stacking primary learners, the Newton-Raphson optimization algorithm improved based on Circle chaotic mapping is used for adaptive weight assignment.

[0135] Adaptive weight assignment for the output vectors of the primary learners includes the following steps:

[0136] B1) Define the maximum number of iterations of the Newton-Raphson optimization algorithm as , the current number of iterations as , and initialize ;

[0137] B2) Initialize the first generation of population using the Circle chaotic mapping function , which contains individuals. The Circle chaotic mapping function ensures that these population individuals are uniformly distributed within the search space. The Circle chaotic mapping function is defined as follows:

[0138] ,

[0139] wherein, represents the position after mapping, represents the target original position, is the serial number generated by mapping, represents the modulo operation, and are parameters, with default values 0.5, 0.2;

[0140] B3) will be the first The weight vector generated this time Weighting the feature vector A training set R3 is formed, which is then further divided into a training set R4 and a validation set.

[0141] in, , and These are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT, respectively, during the first optimization process.

[0142] B4) Train the logistic regression model using the training set R4, and evaluate the detection performance of the logistic regression model using the validation set;

[0143] B5) To evaluate the impact of iteratively updated weights on detection performance under the adaptive weight allocation strategy, the objective function is set as follows:

[0144] in, The AUC value is the output of logistic regression, used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression, which reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is reduced while ensuring the model's global discrimination ability.

[0145] The fitness function is The fitness value is fed back to the Newton-Raphson optimization algorithm, and the search direction is updated accordingly.

[0146] B6) Combining the Newton-Raphson search rule and traps to avoid operator updates. In the next iteration, the feature vector weight combination ,in, , and The first The adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT during the optimization process.

[0147] The Newton-Raphson search rule utilizes the gradient information of the fitness function to accelerate convergence, and its update rule is as follows:

[0148] ,

[0149] ,

[0150] in, It is the direction of the location update. It is a normally distributed random number. and Let these represent the best and worst solutions in the current population, respectively. This indicates the current position of the individual. It is a random vector used to adjust the search direction. To generate a 1×dim dimensional uniform random number vector, where dim is the dimension, Indicates the current iteration number;

[0151] The trap avoidance operator applies a random perturbation to solutions with fitness values ​​lower than the current population optimum. The update formula for the trap avoidance operator is:

[0152] ,

[0153] in, Indicates the position of the individual after the update. This indicates the current position of the individual. This represents the optimal solution in the current population. This represents the average position of all individuals in the current iteration. and It is a uniformly distributed random number. It is an adaptive coefficient. and It is a binary random number;

[0154] B7) Repeat steps B3)-B6). After the number of iterations set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight. .

[0155] The Newton-Raphson optimization algorithm based on the Circle chaotic mapping can dynamically adjust weights according to the performance of the base classifier on the training and validation sets, rather than fixing weights or statically relying on a single evaluation metric for weight allocation. Furthermore, by introducing the initial population generation mechanism of the chaotic mapping, it breaks the dependence of traditional optimization algorithms on random initialization. Utilizing the ergodicity and sensitivity of chaotic sequences, it ensures efficient coverage of the weight search space and avoids getting trapped in local optima. Further, by combining Newton-Raphson gradient acceleration and a random perturbation mechanism, the algorithm can converge quickly during iteration and escape local optima. Finally, the optimization algorithm incorporates multi-objective optimization into the weight allocation process, customizing a composite objective function according to the needs of the actual problem. This dynamically balances the model's global discriminative power with the risk of missing key attack behaviors, ensuring detection accuracy while enhancing the ability to capture covert attack patterns.

[0156] (3) The optimal weight is given to the training set R3 and the test set E1, the weighted training set R3 is used to train the Stacking secondary learner, that is, the logistic regression model, and the detection result of the weighted test set E1 is output, so that network intrusion detection is realized.

[0157] In the fifth step, real-time detection of network intrusion: real-time listening to network traffic data, inputting the network traffic data into the trained network intrusion detection model, and outputting the detection result to realize network intrusion detection.

[0158] As shown in Figure 2 The DDWGAN structure diagram related to the application is shown in the figure, and the core is to introduce the double-discriminator architecture of the global discriminator D1 and the local discriminator D2. The global discriminator D1 evaluates the authenticity of the generated sample from the perspective of the overall distribution of data, and ensures that the generated data is consistent with the statistical characteristics of the real data in the macroscopic level. The local discriminator D2 focuses on the key feature subset, and verifies the detail fidelity of the generated sample in the key attack mode from the microscopic level. The adversarial training mechanism of the double discriminators constrains the generator from multiple angles, reducing the risk of mode collapse. The generator G needs to balance between the continuity score of the global discriminator D1 and the key feature matching degree of the local discriminator D2, so as to generate samples closer to the real data distribution. This cooperative mechanism forces the generator G to meet the discrimination standards of global distribution and local features at the same time, significantly improves the quality of the generated samples, and avoids the local mode deviation that may be ignored by the traditional single discriminator.

[0159] As shown in Figure 3As shown, this invention relates to a flowchart of adaptive weight allocation using a Newton-Raphson optimization algorithm improved based on Circle chaotic mapping. In the process of adaptive weight allocation optimization for network intrusion detection, based on the goals of improving model detection accuracy and reducing the risk of missed detections, a function is constructed that maximizes the combination of AUC and Recall values ​​as the objective function. Based on this, iterative optimization is performed using the Newton-Raphson algorithm improved by Circle chaotic mapping to adaptively allocate weights to the prediction results of the base classifier, thereby optimizing the model combination strategy and improving the overall performance of the intrusion detection system. The sequences generated by Circle chaotic mapping have good randomness and diversity, making individuals more dispersed throughout the search space, providing more favorable initial conditions for subsequent iterative optimization, thus enhancing the algorithm's global search capability and avoiding local optima. Furthermore, its chaotic characteristics allow the population to traverse the search space quickly, improving the algorithm's convergence speed and efficiency. Further, the fitness of each weight combination is evaluated to determine the current iterative optimal solution and the global potential optimal direction. Gradient convergence is accelerated through the Newton-Raphson search rule, and traps are introduced to avoid random perturbations imposed by the operators. The process involves continuous iteration, synchronously updating the adaptive coefficients and population diversity distribution, and continuously verifying whether the preset maximum number of iterations has been reached. Through this process, the optimal weight allocation scheme can be determined, meeting the core requirements of high accuracy and low false negatives in intrusion detection in complex network environments, while simultaneously promoting the in-depth development of network security detection technology towards adaptive optimization.

[0160] like Figure 4 The figure shows a performance comparison between the network intrusion detection method of this invention and other models. The proposed complete model and a simplified model with key modules removed were compared in intrusion detection performance. As can be seen from the figure, the complete model performs best across all four evaluation metrics. Removing the adaptive weight allocation module reduces model performance; removing the data augmentation module significantly reduces performance; and when both modules are removed, the model performs the worst. This indicates that the DDWGLO data augmentation module effectively solves the class imbalance problem, providing a higher-quality data foundation for the model; while the Newton-Raphson optimization algorithm based on the Circle chaotic mapping significantly improves the model's weight allocation effect, enhancing its generalization ability and detection accuracy. Experimental results show that these modules play a crucial role in this invention, collectively improving the accuracy and effectiveness of network intrusion detection.

[0161] The above shows and describes the basic principles, main features and advantages of the present application. Those skilled in the art should understand that the present application is not limited to the above-mentioned embodiments, and the above-mentioned embodiments and descriptions in the specification are only the principles of the present application. Various changes and improvements can be made without departing from the spirit and scope of the present application, and these changes and improvements all fall within the scope of the claimed present application. The scope of protection of the present application is defined by the appended claims and their equivalents.

Claims

1. A network intrusion detection method based on improved WGAN sampling and ensemble learning, characterized in that, Includes the following steps: 11) Acquisition of network traffic data: Acquire network traffic data and preprocess it to obtain an imbalanced dataset; divide the imbalanced dataset R into an imbalanced training set R1 and a test set E1 in an 8:2 ratio; select the top 10 features by feature importance based on the imbalanced training set R1 to construct a key feature subset R1'. 12) Data augmentation based on the DDWGLO framework: The DDWGLO framework with hybrid sampling is used to sample attack traffic categories in the imbalanced dataset; The data augmentation is implemented as follows: the trained DDWGAN model is used to perform the first data balancing process on the class-imbalanced training set R1; then the LOF model is used to detect anomalies in the generated samples and remove noisy samples; after the noise is removed, the classes become imbalanced again, and the DDWGAN model is used to perform the second class balancing process to obtain the final class-balanced training set R2. 13) Construct a network intrusion detection model based on Stacking; 14) Training of the network intrusion detection model: The network intrusion detection model is trained using the class-balanced training set R2. The Newton-Raphson optimization algorithm based on the Circle chaotic mapping is used to adaptively assign the optimal weights to the output of the Stacking first-level learner. The weighted detection results are used as the training set for the Stacking second-level learner. 15) Real-time detection of network intrusion: Real-time monitoring of network traffic data, inputting the network traffic data into the trained network intrusion detection model, and outputting the detection results to achieve network intrusion detection.

2. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that, The acquisition of the network traffic data includes the following steps: 21) Obtain network traffic data, which is divided into numerical data and categorical data. For missing values ​​in numerical data, the mean is used to fill in the missing values ​​in categorical data; for missing values ​​in categorical data, the mode is used to fill in the missing values. 22) For categorical data, one-hot encoding is used to convert it into numerical data, and then the numerical data is merged with it to construct the original dataset; 23) Normalize the original dataset, scaling the numerical range of each feature to the [0, 1] interval. The normalization formula is: ， In the formula, The data is after normalization. These are the sample values ​​of the feature vectors in the original dataset. and These are the minimum and maximum values ​​of the eigenvectors, respectively. 24) Feature selection based on Pearson correlation coefficient test: By calculating the correlation coefficient matrix between features in the original dataset, feature pairs with an absolute correlation coefficient greater than 0.8 are identified, and one feature is randomly removed to reduce redundancy. The formula for calculating the Pearson correlation coefficient is: ， In the formula, This is the Pearson correlation coefficient, which ranges from -1 to 1. The closer the absolute value is to 1, the stronger the correlation. and The first The observations of a sample on two different features and These are the sample means of the two features, respectively. The number of samples; 25) Feature selection based on random forest: By training a random forest classifier, features with importance higher than 0.005 are selected based on feature importance scores to obtain an imbalanced dataset R.

3. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that, The data augmentation based on the DDWGLO framework includes the following steps: 31) Define the DDWGLO framework as including the DDWGAN model and the LOF model; 32) Setting up the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. All three components use a multilayer perceptron. The generator G includes four fully connected layers, with the hidden layers using LeakyReLU activation and batch normalization, and the output layer using the tanh activation function. The global discriminator D1 and the local discriminator D2 are configured identically, each including three fully connected layers, with the hidden layers using LeakyReLU activation and the output layer using linear activation. During training, all three components use the RMSprop optimizer. The loss function for the DDWGAN model is defined by using the Wasserstein distance to measure the distance between distributions, and its calculation formula is as follows: ， In the formula, Represent two probability distributions and Wasserstein distance between them and These represent the distribution of real data and the distribution of generated data, respectively. Let the infimum of the set be... for and A joint probability distribution, for and The set of all joint distributions, Describe the joint distribution random variables under Expectations yes and Wassertein distance between them; Transform it into the following form: ， In the formula, For the upper bound, This is the Lipschitz constant. Representation function The Lipschitz constant, For function In the true distribution The expected value under, For function In generating distribution The expected value below; 33) Training the DDWGAN model: The DDWGAN model is trained using the class-imbalanced training set R1 and the key feature subset R1'; 34) Setting the LOF model: Introducing the LOF model to perform anomaly detection on the samples generated by generator G, and removing noisy samples, and calculating points. The formula for the local anomaly factor is: ， in, It is a parameter used to determine the number of neighbors. The feature is represented by a point in space. express Local outlier of a point express Pointed The set of nearest neighbors, express One of the points, Point To its first The distance to the nearest neighbor, Point Locally achievable density, express Nearest neighbor set The number of elements in the middle.

4. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that, The method for building a network intrusion detection model based on Stacking includes the following steps: 41) The network intrusion detection model is set to include two levels of learners. XGBoost, CatBoost and LightGBM classifiers are used as the first-level learner of Stacking, and the logistic regression model is used as the second-level learner of Stacking. 42) The parameters of XGBoost, Catboost, LightGBM, and logistic regression models were optimized using a combination of grid search and five-fold cross-validation. For XGBoost, optimize the learning rate (learning_rate), the number of trees (n_estimators), the subsample ratio (subsample), and the column sample ratio (colsample_bytree); For Catboost, optimize the maximum tree depth, learning rate, number of iterations, and L2 regularization coefficient l2_leaf_reg; For LightGBM, optimize the maximum tree depth (max_depth), learning rate (learning_rate), number of trees (n_estimators), number of leaf nodes (num_leaves), and column sampling ratio (colsample_bytree); For the logistic regression model, optimize the regularization parameter c and the regularization type penalty.

5. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that, The training of the network intrusion detection model includes the following steps: 51) Train Stacking first-level learners XGBoost, CatBoost, and GBDT using the class-balanced training set R2 and obtain the detection results of the three classifiers to form feature vectors. , in, , and These are the output vectors of XGBoost, CatBoost, and GBDT, respectively. 52) Adaptively assign weights to the output vector of the first-level learner using an optimization algorithm: Based on the detection results of the Stacking first-level learner, the Newton-Raphson optimization algorithm based on the Circle chaotic mapping is used to adaptively assign weights; 53) Assign the optimal weights to the training set R3 and the test set E1, train the Stacking secondary learner (i.e., the logistic regression model) using the weighted training set R3, and output the detection results on the weighted test set E1 to achieve network intrusion detection.

6. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 3, characterized in that, The training of the DDWGAN model includes the following steps: 61) Initialize model parameters: Set the initial parameters of generator G, global discriminator D1 and local discriminator D2, and determine the hyperparameters during training, including learning rate and number of iterations; 62) Generator G receives random noise that follows a Gaussian distribution as input and generates fake data that is similar to the real data in the class-imbalanced dataset R; 63) The global discriminator D1 evaluates the real and generated data in the class-imbalanced training set R1 as a whole and outputs a continuous score, while the local discriminator D2 evaluates the real and generated data in the key feature subset R1' locally. 64) Generator G is adversarially trained by minimizing the discrimination scores of generated data in global discriminator D1 and local discriminator D2. Its goal is to generate high-quality fake data that can deceive both global discriminator D1 and local discriminator D2. 65) The RMSprop optimizer is used to update the model parameters. During backpropagation of the global discriminator D1 and the local discriminator D2, the gradient tensor is hard-pruned to approximately satisfy the Lipschitz continuity condition. 66) In each training cycle, the global discriminator D1 and the local discriminator D2 are updated five times each. Then, the parameters of the global discriminator D1 and the local discriminator D2 are fixed and the generator G is trained. Through multiple iterations, the generator G gradually approximates the real data distribution in the class imbalance dataset, and finally achieves high-fidelity data generation.

7. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 5, characterized in that, The adaptive weight allocation to the output vector of the first-level learner using the optimization algorithm includes the following steps: 71) Define the maximum number of iterations for the Newton-Raphson optimization algorithm as: The current iteration number is and initialize ; 72) Initialize the first generation population using the Circle chaotic mapping function. The first generation population includes For each individual, the Circle chaotic mapping function makes this... The individuals in the population are uniformly distributed within the search space. The Circle chaotic mapping function is defined as follows: ， in, Indicates the position after mapping. Indicates the original position of the target. The sequence number generated by the mapping. This represents the modulo operation. and For parameters, the default value is... It is 0.

5. It is 0.2; 73) The first The weight vector generated this time Weighting the feature vector A training set R3 is formed, which is then further divided into a training set R4 and a validation set. in, , and These are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT, respectively, during the first optimization process. 74) Train the logistic regression model using the training set R4, and evaluate the detection performance of the logistic regression model using the validation set; 75) To evaluate the impact of iteratively updated weights on detection performance under the adaptive weight allocation strategy, the objective function is... Set as , in, The AUC value is the output of logistic regression, used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression, which reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is reduced while ensuring the model's global discrimination ability. The fitness function is The fitness value is fed back to the Newton-Raphson optimization algorithm, and the search direction is updated accordingly. 76) Combining the Newton-Raphson search rule and trap avoidance operator updates. In the next iteration, the feature vector weight combination ,in, , and The first The adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT during the optimization process. The Newton-Raphson search rule utilizes the gradient information of the fitness function to accelerate convergence, and its update rule is as follows: ， ， in, It is the direction of the location update. It is a normally distributed random number. and Let these represent the best and worst solutions in the current population, respectively. This indicates the current position of the individual. It is a random vector used to adjust the search direction. To generate a 1×dim dimensional uniform random number vector, where dim is the dimension, Indicates the current iteration number; The trap avoidance operator applies a random perturbation to solutions with fitness values ​​lower than the current population optimum. The update formula for the trap avoidance operator is: ， in, Indicates the position of the individual after the update. This indicates the current position of the individual. This represents the optimal solution in the current population. This represents the average position of all individuals in the current iteration. and It is a uniformly distributed random number. It is an adaptive coefficient. and It is a binary random number; 77) Repeat steps 73)-76). After the number of iterations set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight. .

8. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the network intrusion detection method based on improved WGAN sampling and ensemble learning as described in any one of claims 1-7.

9. A computer device, characterized in that, The method includes a memory, a processor, and a computer program stored in the memory and running on the processor, which, when executed by the processor, implements the network intrusion detection method based on any one of claims 1-7, namely, the method described in any one of claims 1-7.

Images