Network intrusion model training method and device, electronic equipment and storage medium

Abstract

According to the training method and device of the network intrusion model, the electronic equipment and the storage medium provided by the embodiment of the invention, data enhancement processing can be performed on the network data by adopting the hybrid rebalance strategy. Training the student model by using a first loss function and the network data, training the teacher model by using the first loss function and the network data subjected to data enhancement processing, and establishing an association constraint output by the teacher model and the student model by using a second loss function, and the student model is further trained, so that the detection accuracy of network intrusion can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a network intrusion model training method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of the Internet of Things technology, a large number of devices access the network, which makes the security risk of the Internet of Things device increasingly become a focus. The demand for improving the accuracy of network intrusion detection in the Internet of Things becomes increasingly urgent. In the face of the problem of uneven distribution and unknown attack types in the network data collected by the Internet of Things device, the accuracy of the detection of network intrusion of the traditional supervised learning model in the actual application is low.

[0003] Therefore, how to improve the detection accuracy of the network intrusion model has become a technical problem to be solved at present. SUMMARY

[0004] Therefore, the embodiments of the present application provide a network intrusion model training method and device, electronic equipment and storage medium, which can improve the detection accuracy of the network intrusion model.

[0005] In a first aspect, the embodiments of the present application provide a network intrusion model training method applied to an Internet of Things system, wherein the network intrusion model comprises a teacher model and a student model; the teacher model comprises a teacher autoencoder, and the student model comprises a student autoencoder.

[0006] The method comprises: adopting a hybrid re-balancing strategy to perform data enhancement processing on network data; training the student model by using a first loss function and the network data; training the teacher model by using the first loss function and the network data after data enhancement processing; and further training the student model by using a second loss function to establish an association constraint of outputs of the teacher model and the student model.

[0007] In a second aspect, the embodiments of the present application provide a network intrusion model training device applied to an Internet of Things system, wherein the network intrusion model comprises a teacher model and a student model; the teacher model comprises a teacher autoencoder, and the student model comprises a student autoencoder.

[0008] The device comprises a processing module configured to perform data enhancement processing on network data by using a hybrid re-balancing strategy; a first training module configured to train the student model by using a first loss function and the network data; a second training module configured to train the teacher model by using the first loss function and the network data after data enhancement processing; and a correlation constraint module configured to further train the student model by using a second loss function to establish a correlation constraint between outputs of the teacher model and the student model.

[0009] In a third aspect, an electronic device is provided, which comprises a housing, a processor, a memory, a circuit board and a power supply circuit. The circuit board is arranged inside a space enclosed by the housing, and the processor and the memory are arranged on the circuit board. The power supply circuit is configured to supply power to each circuit or device of the electronic device. The memory is configured to store executable program codes. The processor is configured to run programs corresponding to the executable program codes by reading the executable program codes stored in the memory, and execute the network intrusion model training method provided in any of the embodiments of the present application.

[0010] In a fourth aspect, a computer readable storage medium is provided, which stores one or more programs executable by one or more processors to implement the network intrusion model training method provided in any of the preceding embodiments.

[0011] The network intrusion model training method, device, electronic device and storage medium provided by the embodiments of the present application can perform data enhancement processing on network data by using a hybrid re-balancing strategy. The student model is trained by using a first loss function and the network data, the teacher model is trained by using the first loss function and the network data after data enhancement processing, and the student model is further trained by using a second loss function to establish a correlation constraint between outputs of the teacher model and the student model, so that the detection accuracy of network intrusion can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0012] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0013] Figure 1 A structure diagram of an Internet of Things provided by the embodiments of the present application is provided.

[0014] Figure 2 A structural schematic diagram of a teacher-guided denoising contrast learning network provided for an embodiment of the present application;

[0015] Figure 3 A flowchart of a network intrusion model training method provided for an embodiment of the present application;

[0016] Figure 4a A schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the NSL-KDD data set is used;

[0017] Figure 4b Another schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the NSL-KDD data set is used;

[0018] Figure 4c Still another schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the NSL-KDD data set is used;

[0019] Figure 5a A schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the UNSW-NB15 data set is used;

[0020] Figure 5b Another schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the UNSW-NB15 data set is used;

[0021] Figure 5c Still another schematic diagram of indexes of a network intrusion model provided for an embodiment of the present application when the UNSW-NB15 data set is used;

[0022] Figure 6a Detection accuracy of a network intrusion model provided for an embodiment of the present application under different learning rates and embedding dimensions;

[0023] Figure 6b F1 score of a network intrusion model provided for an embodiment of the present application under different learning rates and embedding dimensions;

[0024] Figure 6c Recall rate of a network intrusion model provided for an embodiment of the present application under different learning rates and embedding dimensions;

[0025] Figure 6d Matthews correlation coefficient of a network intrusion model provided for an embodiment of the present application under different learning rates and embedding dimensions;

[0026] Figure 7 A structural schematic diagram of a network intrusion model training device provided for an embodiment of the present application;

[0027] Figure 8A structural diagram of an electronic device is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0028] The embodiments of the present application will be described in detail below with reference to the drawings.

[0029] It should be clear that the described embodiments are only some of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor are within the scope of protection of the present application.

[0030] The Internet of Things is a network of intelligent devices that connect and communicate through the Internet, enabling information exchange and intelligent management between objects and humans. It has driven the rapid development of many industries, including smart cities, smart healthcare, smart homes, smart agriculture, and smart grids. However, the Internet of Things has also brought network security risks in related fields, and network intrusion behavior has become one of the biggest risks in the intelligent field.

[0031] With the rapid growth of data, the complexity of Internet of Things security issues is increasing. These security issues are often caused by external attacks, such as denial-of-service attacks, spoofing attacks, interference, and eavesdropping. In addition, inappropriate behavior by personnel when operating Internet of Things devices or transmitting information through them further exacerbates security risks. As the Internet of Things continues to evolve, traditional security measures such as firewalls and identity verification are increasingly difficult to cope with changing intrusion attacks. Intruding into information-physical devices such as wearable devices, medical pacemakers, and self-driving cars, or intruding into expensive industrial processes controlled by networked devices, not only can cause personal or corporate privacy data to be stolen, resulting in huge economic losses, but sometimes can also cause serious life safety accidents.

[0032] The overall architecture of the Internet of Things can be as follows Figure 1How to effectively mitigate the damage caused by network intrusion in IoT devices has become the focus of the industry. Intrusion detection systems (IDS) as an important part of network security have become a key means of detecting network attacks. According to the detection method adopted, intrusion detection systems can be divided into misuse-based intrusion detection systems (MIDS) and anomaly-based intrusion detection systems (AIDS). The development of new intrusion detection systems is of great significance in many fields, such as industrial Internet of Things, ocean Internet of Things, and vehicle Internet of Things. Traditional machine learning methods, such as random forests and support vector machines, perform well in network intrusion detection because they can identify key features in IoT traffic data. However, as IoT nodes become increasingly widespread, the heterogeneity and large influx of data have led to poor performance of traditional machine learning in intrusion detection, especially when dealing with new attacks and complex network threats. Limited and imbalanced network data make it challenging to meet the training needs of machine learning.

[0033] To address these challenges, deep learning technology brings new possibilities to network intrusion detection systems. These systems combined with deep learning technology can effectively handle complex network intrusions and network attacks, overcoming their complexity, difficulty, and widespread distribution. Contrastive learning is often used for detection tasks with imbalanced and unknown samples due to its unique classification mechanism. In the contrastive learning framework, each network stream is converted to a representation space and compared. Similar types of network streams are pulled closer together, while different types are separated, thus achieving the traffic detection task. However, this mechanism usually relies on data augmentation to generate positive sample pairs (i.e., samples from the same instance). If the data augmentation strategy is not suitable for a specific task, it may prevent the model from learning effective representations. At the same time, although contrastive learning can learn good representations of training data, its generalization ability for new, unseen data may be limited. Introducing label embedding can effectively improve the generalization ability of contrastive learning models.

[0034] Rebalancing strategies are the main method to solve the problem of sample imbalance, aiming to increase the weight of minority class samples and reduce model bias caused by imbalanced data. However, existing contrastive learning methods often use a single rebalancing strategy, which faces some challenges. For example, oversampling usually involves duplicating minority class samples, which increases the risk of overfitting. Under-sampling reduces the number of majority class samples, which may result in the loss of important information. Weight adjustment involves complex calculations, especially for highly imbalanced datasets. Therefore, using a hybrid rebalancing strategy according to different detection scenarios is crucial for improving the generalization ability of the model.

[0035] Although contrastive learning can learn good representations of training data, its generalization ability for completely new, unseen data can be limited. Introducing label embeddings can effectively improve the generalization ability of contrastive learning models. However, current supervised contrastive learning methods rely heavily on label quality and need more effective training guidance and optimization functions to enhance representation ability. To solve the problem of poor robustness of intrusion detection models caused by uneven distribution of traffic collected by Internet of Things devices and the existence of unknown attacks, the present application proposes a network intrusion model, which can be specifically a teacher-guided denoising contrastive learning network (TGDCLNet). The model uses a hybrid re-balancing strategy to adapt to different Internet of Things environments. It also designs a dual autoencoder contrastive learning framework for the teacher model and the student model, incorporating additional label information into the teacher model. In addition, the denoising learning and teacher-guided modules introduce two new optimization loss functions to guide model training. This aims to enable the network intrusion detection model of the present application to effectively distinguish various multi-classification tasks of network intrusion detection in complex Internet of Things environments.

[0036] The main technical innovations of the present application are summarized as follows:

[0037] First, a network intrusion detection model, the TGDCLNet framework, is proposed, which is an innovative supervised contrastive learning detection method. By providing additional label information to the teacher autoencoder and designing two optimization loss functions, the representation ability of the model is enhanced.

[0038] Second, a hybrid re-balancing strategy is proposed, which uses cyclic sampling to enhance minority class samples, fuzzy elimination to remove redundant network data, and adaptive weighting to optimize the training strategy for imbalanced samples. For different Internet of Things environments, one or more combinations of enhancement methods are used to mitigate the impact of extreme data imbalance on model training.

[0039] Third, a denoising learning module and a teacher-guided module are designed. In the denoising learning module, a denoising multi-dimensional balanced mean square error loss function is developed to reduce the impact of noise on the training of the teacher and student models, promoting the model to learn more effective data representations. In the teacher-guided module, label information is input as features into the teacher autoencoder to capture the underlying relationships between different network attack categories, and a balanced weighted binary cross-entropy loss function is designed to effectively guide the training of the student autoencoder.

[0040] By using the above techniques, comprehensive experiments were conducted on two representative network intrusion detection datasets (datasets NSL-KDD and UNSW-NB15). The experimental results show that the network intrusion detection model in the present application is superior to the current most advanced method, and performs more stable performance in the real Internet of Things scene where data is scarce and some attack type samples are missing.

[0041] The following describes related methods for detecting network intrusion in the case of unlabeled network data (i.e., in the case of unsupervised learning).

[0042] In recent years, unsupervised contrastive learning has made significant progress in representation learning, especially in scenarios that do not require large-scale labeled data. Some technicians have proposed a framework called SimCLR, which is based on data augmentation and contrastive loss, and learns robust feature representations by maximizing the similarity between augmented views of the same sample. Some technicians have introduced a new BYOL (Bootstrap Your Own Latent) framework that uses momentum encoders and consistency loss to further improve the performance of contrastive learning without negative samples. In addition, some technicians have introduced the concept of online clustering through SwAV, which learns cluster-level feature representations through contrastive learning and multi-view augmentation. These methods construct positive and negative sample pairs, maximize the consistency of representations between similar samples, and minimize the distance between different samples, thereby learning robust feature representations.

[0043] In the field of network intrusion detection, unsupervised contrastive learning is gradually adopted by scholars due to its unique classification method. Unlike traditional rule-based or statistical detection methods, unsupervised contrastive learning can extract deep features from a large amount of unlabeled network data, effectively dealing with unknown attacks in complex network environments. In particular, in the Internet of Things scenario, there are many types of devices and heterogeneous communication protocols, and traditional methods are difficult to fully capture diverse traffic features. Unsupervised contrastive learning, with its adaptive ability, provides a new perspective for solving this problem.

[0044] Specifically, some skilled technicians propose a two-stage lightweight intrusion detection model for Internet of Things networks, which combines self-supervised contrastive learning with self-knowledge distillation, significantly improving the efficiency and accuracy of intrusion detection. By extracting deep features from unlabeled network data and incorporating knowledge distillation techniques, the model achieves lightweight and practical deployment, particularly on resource-constrained Internet of Things devices. Some skilled technicians design a self-supervised method based on Graph Neural Networks (GNN), introducing graph contrastive learning to model network data in depth, enabling multi-class classification tasks in Network Intrusion Detection Systems (NIDS). This method can fully capture complex network topology, making it particularly suitable for traffic analysis of heterogeneous data in Internet of Things scenarios. Some skilled technicians propose an intelligent network-driven Internet of Things intrusion detection system that uses self-supervised learning to detect Distributed Denial of Service (DDoS) attacks, outperforming traditional supervised learning methods in multiple classification tasks.

[0045] Although unsupervised contrastive learning is widely used in network intrusion detection, it may overfit to certain specific distributions, and its generalization ability on new, different datasets may be suboptimal compared to supervised learning. In addition, due to the lack of labels, its training process may be more unstable. Therefore, by adopting supervised contrastive learning and deeply mining label information to guide the learning process, higher accuracy and better generalization ability can be achieved.

[0046] The following describes related methods for detecting network intrusion under the condition that network data is labeled (i.e., supervised contrastive learning).

[0047] Supervised contrastive learning utilizes the feature representations learned during unsupervised pre-training and optimizes them using label information, thereby accurately identifying known attack patterns while maintaining robustness to unknown attacks. In traditional network intrusion detection, the scarcity of labels has always been a key factor limiting model performance. Supervised contrastive learning effectively alleviates this problem by combining unsupervised pre-training with supervised fine-tuning. For example, some skilled technicians propose an intrusion detection method based on contrastive learning, which improves detection accuracy and rate by addressing intra-class diversity and inter-class similarity issues. Some skilled technicians design an end-to-end intrusion detection framework that combines Convolutional Neural Networks (CNN) and Gated Recurrent Unit (GRU) models, and with the help of a small amount of labeled data fine-tuned based on contrastive learning, significantly enhances the detection capability of known and unknown attacks.

[0048] Supervised contrastive learning can leverage the heterogeneity and dynamic characteristics of communication data in Internet of Things (IoT) environments, such as protocols, timing, and contextual information, to further improve the effectiveness of intrusion detection. For example, some researchers have integrated label information into the embedding space and proposed a supervised contrastive learning classification scheme that effectively improves the classification performance of the model. Some researchers have proposed a multi-channel learning method for intrusion detection (MCLDM) that combines supervised and unsupervised strategies, significantly enhancing feature extraction capabilities and detection accuracy. In dynamic and distributed IoT scenarios, the adaptability of supervised contrastive learning has been further expanded by combining it with a federated learning framework. For example, some researchers have proposed an evolutionary federated intrusion detection system (EFIDS) that uses federated learning and contrastive learning techniques to improve the detection accuracy of dynamic industrial IoT (IIoT) attack scenarios by 13.3% to 31.5%. Some researchers have proposed the FIDWATCH federated learning framework, which can efficiently detect dynamic IoT attacks by combining contrastive focal loss, knowledge distillation, and adaptive incremental update mechanisms.

[0049] Other research has also demonstrated the broad applicability of supervised contrastive learning in network intrusion detection. Some researchers have proposed a deep belief network based on fast persistent contrastive divergence (FPCD-DBN) that can achieve efficient and accurate intrusion detection. Some researchers have combined contrastive variational autoencoders for feature generation and improved attack detection performance through deep metric learning. Some researchers have used the SimCSE natural language processing technique to efficiently detect malicious traffic and virtual private network (VPN) activity at the packet level. In addition, some researchers have proposed a unified framework that combines contrastive learning, supervised clustering, and multi-layer perceptron (MLP)-based classification methods to improve the overall performance of network intrusion detection. Some researchers have combined generative adversarial networks (GANs) with contrastive learning and proposed the RFG-HELAD model, which performs well in fine-grained attack detection tasks.

[0050] Figure 2 A teacher-guided denoising contrastive learning network (TGDCLNet) is shown, which uses a supervised contrastive learning framework consisting of two autoencoders. The teacher autoencoder guides the reconstruction task of the student autoencoder. During the training phase, each sample is trained using different labels. x_i represents the features of the i-th sample, L_j represents the one-hot encoding of the j-th label, and C represents the number of classes.

[0051] However, in resource-constrained IoT devices, although existing methods alleviate the problem of label scarcity by fine-tuning with small-scale labeled data, they still face bottlenecks in label- missing scenarios such as unknown attacks. Employing targeted data augmentation techniques in different IoT environments can further optimize the adaptability of the model in dynamic distributed environments. In addition, deep mining of label information and expanding the influence of labels on model training will help IoT devices handle more complex network intrusion detection tasks in various environments.

[0052] The present application can solve the problem of unbalanced traffic data in the Internet of Things scenario. After preprocessing the collected network traffic data, we developed three data augmentation algorithms: cyclic sampling (CS) to increase the number of minority class samples; blur elimination (BC) to remove majority class samples closest to minority class samples; and adaptive weighting (AW) to assign appropriate weights to samples of different categories. The network intrusion detection model of the present application will select appropriate data augmentation strategies for different IoT scenarios to improve the training efficiency of the model.

[0053] First, we address the imbalance problem in the dataset by applying data augmentation techniques to ensure the generalization ability of the model. Next, we carefully create a complete set of pseudo-labels for each sample to simulate noise and uncertainty in real-world environments. Each sample is trained with its true label and multiple pseudo-labels to enhance the model's ability to identify the true label. In the subsequent denoising learning module, we use the denoising multi-dimensional balanced mean square error (DMBMSE) loss function to guide the reconstruction task of the teacher model and the student model. In the teacher guidance module, the teacher model plays a key role in learning and integrating label information in this framework. The balanced weighted binary cross-entropy (EWBCE) loss function ensures that the output of the student model is highly similar to that of the teacher model, thereby improving the model's ability to classify traffic in complex IoT environments.

[0054] The embodiment of the present application provides a network intrusion model training method, which can be applied to an Internet of Things system. The network intrusion model comprises a teacher model and a student model. The teacher model comprises a teacher autoencoder, and the student model comprises a student autoencoder.

[0055] Referring to Figure 3 The method can comprise the following steps:

[0056] S11, a hybrid rebalancing strategy is used to perform data augmentation processing on network data.

[0057] Due to the incompleteness of the traffic collected in the Internet of Things, there are some types of attack traffic that are rare, while some types of attack traffic account for a high proportion, which seriously affects the training effect of supervised contrast learning. In order to solve the class imbalance problem and achieve balanced representation of attack types in the dataset, thereby improving the performance of the network intrusion detection model (TGDCLNet) in intrusion detection, we designed different data augmentation strategies, which include three steps: cyclic sampling, blur elimination, and adaptive weighting. The following is a detailed introduction to the three steps.

[0058] Cyclic sampling step, this step expands the dataset by generating synthetic samples for minority classes. It creates new instances using the support vectors of these minority classes, thereby enhancing the representation of minority classes and alleviating the imbalance between majority and minority class samples. The formula for cyclic sampling is as follows:

[0059] x new =x i +λ(x j -x i )+αsin(θ)(x j -x i )

[0060] Where x_i and x_j are samples from minority classes. θ is a random value between 0 and 2π. λ is a random value between -1 and 1. α is a scaling factor that determines the magnitude of the perturbation. This interpolation and perturbation helps to create a more diverse sample set for minority classes by enhancing the representation of minority classes and improving the model's ability to detect less common attack types.

[0061] Blur elimination step, this technique addresses the imbalance problem by reducing the number of majority class samples. It selects the majority class samples closest to the minority class samples, which helps to balance the class distribution. The distance metric used in blur elimination is:

[0062]

[0063] By applying the blur elimination method, the dataset is balanced, i.e. the majority class samples most similar to the minority class samples are removed, which can improve the model's learning and generalization ability in different attack scenarios. This method helps to ensure that the model does not bias towards the majority class, but can better identify the patterns and features of the minority class, which is crucial for detecting rare events such as security attacks.

[0064] Adaptive weighting step, in traditional loss functions, each sample contributes equally to the loss. However, when adaptive weighting is used, each sample is assigned an appropriate weight to alleviate the problem of extreme data imbalance. Specifically, the weight of class c is calculated as follows:

[0065]

[0066] where N is the total number of samples, K is the number of classes, and Nc is the number of samples belonging to class c. The above weighting scheme adjusts the contribution of each class to the loss function. These two weighted loss functions can make the model pay more attention to minority class samples and reduce attention to majority class samples, thus dealing with imbalanced datasets. Under the guidance of reconstruction loss, the model can learn more generalizable features. This generalization ability makes the model perform better on some unseen samples. For different Internet of Things scenarios, choosing a combination of one or more rebalancing strategies can effectively solve various data imbalance problems and enhance the robustness of TGDCLNet in intrusion detection tasks.

[0067] S12, training the student model using the first loss function and the network data;

[0068] S13, training the teacher model using the first loss function and the network data after data augmentation processing;

[0069] In real-world environments, the data collected by various Internet of Things devices often contains noise. This not only causes the model to learn incorrect information during training, reducing detection accuracy, but also can cause the model to overfit to noise features, weakening its generalization ability for unknown attacks, and even causing normal behavior to be misjudged as an attack, increasing the false positive rate, etc. Denoising can help the model learn the essential features of the data, helping to achieve better detection performance in complex environments and improving the model's generalization ability.

[0070] In supervised contrastive learning, label embedding usually combines semantic information (class labels, attribute labels, etc.) with sensor data to facilitate more effective data analysis, feature extraction, and decision making. However, there may also be noise in it. Therefore, to reduce the noise impact brought by label embedding, we designed a denoising learning module and innovatively proposed a denoising multi-dimensional balanced mean square error loss function to guide the training of the teacher model and the student model. The relevant calculation formula is as follows:

[0071]

[0072] Table 1 Detailed information of TGDCLNet

[0073]

[0074]

[0075] where d is the feature dimension of the sample, p ij is the predicted value of the i-th feature of the j-th sample, tij is the true value of the i-th feature of the j-th sample, and σ 2 is the noise variance.

[0076]

[0077] where X T and X S represent the reconstructed data obtained by the teacher model and the student model through denoising learning, respectively, and X and Y represent the traffic data and label data obtained after the cyclic shift algorithm, respectively. and represent the teacher model and the student model, respectively. The specific parameters are shown in Table 1.

[0078] Through this carefully designed denoising and learning mechanism, our framework not only achieves denoising at the feature level, but also ensures that the student model continuously improves its performance and generalization ability under the precise guidance of the teacher model.

[0079] S14, using a second loss function, establishes an association constraint between the outputs of the teacher model and the student model, and further trains the student model.

[0080] Given the complexity and variability of the Internet of Things environment in different scenarios, a single contrastive learning method may not be sufficient to extract deep information from traffic data. Therefore, we designed a teacher-guided representation algorithm. In the denoising learning module, we constructed a teacher-side autoencoder and a student-side autoencoder. Both work together to learn deep features and represent traffic data.

[0081] At the same time, we input the label information into the teacher model, giving it a more critical role. The teacher model not only learns the label category information in the data, but also ensures that the output of the student side is highly similar to the output of the teacher side through the binary cross-entropy loss function. This design enables the student model to gradually learn and approximate the target output of the teacher model under the guidance of the teacher model, thereby exploiting label information to tackle traffic classification tasks in various complex Internet of Things environments.

[0082] The teacher model acts as a guide, providing the student model with a goal to strive for. By keeping the output of the student model consistent with the output of the teacher model, the student model can effectively learn the underlying patterns and structures in the data corresponding to the label information. This collaborative learning process enhances the student model's ability to classify traffic in diverse and challenging Internet of Things environments.

[0083] We calculate the cosine similarity score (S) based on the feature representation obtained from the denoising learning module. The calculation formula is as follows:

[0084]

[0085] After calculating the cosine similarity, we process the similarity score through the Sigmoid activation function to scale its value to the interval (0, 1), which represents the probability P that the predicted traffic data corresponds to the input label. The corresponding calculation formula is as follows:

[0086]

[0087] P = Sigmoid (S)

[0088] In a specific implementation, a balanced weighted binary cross-entropy loss function can be used to determine the similarity of the output, with the purpose of enabling the student model to learn the output of the teacher model. The balanced weighted binary cross-entropy loss pays more attention to the minority class samples in unbalanced data, thereby better adapting to the classification task of unbalanced data. The calculation formula of the balanced weighted binary cross-entropy loss is as follows:

[0089]

[0090] where y i ,L j is the indicator function, indicating the true label of the i-th sample (0 for false label and 1 for true label), y i is the true label of the i-th sample x i , is the set of N labels, p i is the predicted probability that the i-th sample belongs to the positive class, and w i is the weight of the i-th sample.

[0091] For example, when y i ,L j = 1, it indicates that the data with labeled information from the teacher end and the traffic data output by the student end are a positive sample pair, so the predicted probability obtained by the dot product and the Sigmoid activation function should be as large as possible, which requires a high similarity between the positive sample pair. Conversely, when y i ,L j = 0, it indicates that the data with labeled information from the teacher end and the traffic data output by the student end are a negative sample pair, so the predicted probability should be as small as possible, which requires a low similarity between the negative sample pair. The balanced weighted binary cross-entropy loss (EWBCE) function can calculate the loss by determining the similarity score between two sample points, and through gradient descent, it can achieve the aggregation of positive sample pairs and the separation of negative sample pairs.

[0092] The training process of the network intrusion detection model (TGDCLNet) is described in detail below.

[0093] In the data preprocessing stage, we use a hybrid resampling strategy to preprocess the data to obtain the resampled positive and negative sample pairs and their corresponding weights. Specifically, assuming there are N classes in total, the label information is processed using one-hot encoding. Taking a flow data record as an example, after preprocessing, the flow data will be copied N times, of which only one corresponds to the true label, and the remaining N-1 correspond to false labels. Due to the complex and variable nature of the Internet of Things scenario, we select different combinations from the balance strategies of fuzzy elimination, cyclic sampling, and adaptive weighting according to different actual scenarios. The specific algorithm is shown in Algorithm 1 below.

[0094]

[0095] In the training stage, we combine the flow data and label information, use the DMBMSE loss to guide the training of the teacher model, and make the teacher model learn the label information. At the same time, we only use the original flow data to train the student autoencoder. The reconstructed data on the teacher and student ends are denoised, and the reconstructed data on the teacher end contains label information. Then we calculate the cosine similarity score of the reconstructed data on both ends, and process the obtained value through the Sigmoid activation function to scale it to the range (0, 1). The value represents the prediction probability of the model. We use this probability and an indicator function to calculate the EWBCE loss value. Then we calculate the total loss value using the following formula, and then adjust the weight parameters through backpropagation. We use the RMSProp gradient descent algorithm to optimize the parameters. The specific algorithm is shown in Algorithm 2.

[0096]

[0097] where L TGDCL is the total loss value, and are the denoised multi-dimensional balanced mean square error losses of the teacher model and the student model, respectively, and L EWBCE is the balanced weighted binary cross-entropy loss.

[0098]

[0099]

[0100] In addition, during the model training process, we also set an early stopping strategy to avoid wasting a lot of computing resources. We monitor the validation set loss value within a certain number of training rounds. If the loss value is not less than the previous minimum value, the training will be terminated in advance; we select the best weight parameters for the prediction stage of the model.

[0101] The performance of the network intrusion detection model completed in this application is described in detail below.

[0102] First, we introduce the data sets used in this application. We conducted experiments on two representative benchmark data sets in the field of network intrusion detection, namely NSL-KDD and UNSW-NB15 data sets. These two data sets exhibit significant characteristics in terms of attack type diversity and data distribution imbalance. The NSL-KDD data set covers a wide range of network attack patterns, and its imbalanced data distribution reflects the actual situation of network security events in the real world. The UNSW-NB15 data set contains more complex and novel attack types, as well as richer network traffic features, which can effectively test the generalization ability of the model. The specific distribution of NSL-KDD and UNSW-NB15 data sets is shown in Table II.

[0103] Table II Distribution of different categories in NSL-KDD and UNSW-NB15 data sets

[0104]

[0105]

[0106] 1) NSL-KDD data set: The NSL-KDD data set is a widely used intrusion detection data set in the field of network security, which is optimized and improved based on the KDD Cup 1999 data set. The data set is obviously imbalanced, with a large difference in the number of samples of different attack categories. Specifically, the number of normal traffic samples is much larger than that of attack samples. For example, there are about 125,973 normal samples in the training set, while the U2R and R2L attack types only have 52 and 995 samples, respectively. This imbalance poses a challenge to the training and evaluation of machine learning models, as the model may be biased towards the majority class (normal traffic) and ignore the minority class (attack types), resulting in ineffective identification of minority class attacks in actual applications.

[0107] 2) UNSW-NB15 data set: The UNSW-NB15 data set is designed for network intrusion detection research and created by the University of New South Wales Network Security Laboratory. It covers various network traffic records tailored for Internet of Things environments, including normal traffic and nine different types of attacks, such as denial of service attacks (DoS), reconnaissance attacks, web attacks, SQL injection attacks, and worm attacks. The data set aims to provide researchers with a real, complex, and challenging data set to develop and test network intrusion detection systems. The imbalance of this data set is reflected in the significant difference in the distribution of different types of network attack samples. This imbalance may result in insufficient recognition of minority class attacks by machine learning models during the training process, thereby affecting the performance and reliability of the model in actual applications.

[0108] Table III: Ablation analysis of performance comparison on NSL-KDD and UNSW-NB15 datasets

[0109]

[0110] Next, four evaluation metrics for assessing the performance of network intrusion detection models are introduced, which are: true positives (TP), true negatives (TN), false positives (FP), and false negatives (FN). The performance of the proposed method is evaluated by the following metrics: 1) accuracy, 2) precision, 3) recall, 4) F1 score, and 5) Matthews Correlation Coefficient (MCC).

[0111] Accuracy: Accuracy is the most basic evaluation metric in classification problems, which represents the proportion of correctly predicted samples in the total number of samples. The calculation formula is as follows:

[0112]

[0113] Precision: Also known as positive predictive value, it represents the proportion of actual positive samples in the samples predicted as positive by the model. Precision focuses on the accuracy of positive predictions made by the model, but it may not be sensitive when there are a large number of negative samples. The calculation formula is as follows:

[0114]

[0115] Recall: Also known as true positive rate (TPR), recall represents the proportion of actual positive samples correctly predicted as positive by the model in the total number of actual positive samples. Recall focuses on the ability of the model to identify positive samples, that is, how many positive samples are correctly predicted. The calculation formula is as follows:

[0116]

[0117] F1 Score: F1 score is the harmonic mean of precision and recall, used to measure the overall performance of the model, and the closer the value is to 1, the better the performance. The calculation formula is as follows:

[0118]

[0119] Matthews Correlation Coefficient (MCC): Matthews Correlation Coefficient is an index that considers true positives, true negatives, false positives, and false negatives, suitable for evaluating the performance of binary classification models, especially in the case of class imbalance. The value of MCC is between -1 and 1, where 1 indicates perfect prediction, 0 indicates that the prediction is no different from random guessing, and -1 indicates that the prediction result is completely opposite. The calculation formula is as follows:

[0120]

[0121] The detection results of the network intrusion detection model in the present application are described in detail below. In order to verify the accuracy and robustness of our model, we compare it with other representative machine learning methods and deep learning methods on NSL-KDD and UNSW-NB15 datasets through five indicators. The specific results are shown in Table III.

[0122] 1) NSL-KDD dataset results: On the NSL-KDD dataset, the most prominent traditional machine learning method LM+KA achieved an accuracy rate and F1 score of 80.68% and 79.30%, respectively. In contrast, our TGDCLNet model achieved a significant accuracy rate of 86.01%, leading by 5.33%, and an F1 score of 85.17%, exceeding 5.87%. Among deep learning methods, our method outperformed 1DDRSN, leading by 7.81% and 9.60% in accuracy rate and F1 score, respectively. Compared with the label-embedding-based contrastive learning methods ConLE and ConCE, our network intrusion detection model improved by 15.77% and 15.23% in MCC, respectively. In addition, compared with representative label-based contrastive learning methods such as NMM, AMM, ENMS, NAMM, etc., TGDCLNet has obvious advantages in all indicators.

[0123] 2) UNSW-NB15 dataset results: On the UNSW-NB15 dataset, although there is still room for improvement in the precision rate indicator, overall, our TGDCLNet model is still superior to classical machine learning methods. For example, in terms of accuracy rate, TGDCLNet is 16.23%, 9.58%, and 9.48% higher than logistic regression, decision tree, and random forest methods, respectively. In the field of deep learning, our method also leads classical deep learning methods. For example, in terms of F1 score, TGDCLNet is 3.84% and 9.05% higher than CNN and LSTM, respectively. Compared with 1DDRSN, our method improves by 3.45% and 0.31% in accuracy rate and F1 score, respectively. At the same time, our network intrusion detection model is generally superior to advanced contrastive learning models in all indicators. For example, compared with the label-embedding-based contrastive learning methods ConLE and ConCE, our method improves by 9.54% and 44.04% in MCC, respectively.

[0124] Next, the performance of the trained network intrusion model in detecting unknown attacks is introduced. With the rapid development of technology, attackers are constantly evolving strategies to bypass existing security measures. Given the wide variety of IoT devices, each device can have unique vulnerabilities, providing attackers with numerous entry points. Zero-day attacks and other unknown threats are particularly concerning, as they exploit vulnerabilities that software vendors have not yet discovered, often rendering traditional security defenses ineffective. For example, attackers can exploit unknown vulnerabilities in smart meters or power grid control systems, potentially leading to power outages or data breaches. Zero-day attacks can also target implantable medical devices, such as pacemakers, or medical information systems, stealing sensitive patient data or manipulating device functionality. Additionally, attackers can exploit unknown software vulnerabilities to compromise vehicle control systems, leading to severe consequences such as loss of control. These security incidents result in significant economic losses and pose a serious threat to societal safety.

[0125] To address these challenges in the IoT domain, intrusion detection systems must maintain high detection performance even when faced with unknown attacks. To this end, we intentionally exclude specific types of attack samples during model training while ensuring the integrity of the test set, which contains new attack traffic unseen by the model. This experimental setup more accurately simulates real-world IoT scenarios where known and unknown attacks coexist. We conduct multi-classification experiments based on two benchmark datasets, NSL-KDD and UNSW-NB15.

[0126] The experimental results are presented in Tables Four and Five. It can be observed that when the model is not trained on specific types of attack samples, the overall scores of various models decrease, especially when faced with large-scale unknown attacks, the model performance is slightly insufficient. However, under the same experimental conditions, compared with the most advanced supervised contrastive learning method, the TGDCLNet model proposed in this paper shows better overall performance. In the NSL-KDD test set, when facing the most common denial of service (DoS) attack (accounting for 33.08%), the Matthew Correlation Coefficient (MCC) index of TGDCLNet is still 12.45% and 12.25% higher than that of ConCE and ConLE models, respectively. When dealing with small-scale unknown attacks (such as user-to-root directory (U2R) and remote-to-local (R2L) attacks), our method leads in all indicators.

[0127] Table Four Performance Comparison under Unknown Attacks (NSL-KDD Dataset)

[0128]

[0129] Table Five Performance Comparison under Unknown Attacks (UNSW-NB15 Dataset)

[0130]

[0131]

[0132] On the UNSW-NB15 dataset, the network intrusion detection model of the present application continues to perform well. For example, when considering denial-of-service (DoS) attacks as unknown attacks, the network intrusion detection model of the present application improves the accuracy and F1 score by 18.02% and 5.81%, respectively, compared with the representative label-embedding-based contrastive learning method ENMS. Compared with the label-embedding-based contrastive learning method ConCE, the accuracy and F1 score are improved by 42.54% and 54.27%, respectively. We also found that the performance of the model can be improved when it is not trained on Fuzzers attack samples, which can be due to the large amount of random data generated by the Fuzzers attack, which increases the difficulty for the model to distinguish attack traffic. This finding provides valuable guidance for our hybrid rebalancing strategy. These significant results comprehensively demonstrate the enhanced robustness of the TGDCLNet model in the Internet of Things scenario, even in the face of unknown attacks, and maintain a high accuracy, providing stronger and more reliable protection for Internet of Things network security.

[0133] Next, the performance of the network intrusion model completed in the present application under a small data set is introduced. The diversity and distributed characteristics of Internet of Things devices bring many security challenges. Among them, the limited nature of training data has become a key factor restricting the performance of Internet of Things security models. Due to device resource limitations, data privacy concerns, and data collection costs, among other reasons, it is often difficult to obtain comprehensive and complete data in the Internet of Things environment. This leads to insufficient samples in the training process of traditional security models, which in turn affects their detection effectiveness and robustness. Therefore, the intrusion detection system must have strong learning ability to extract effective features from limited data. In the early stages of an attack, the system should be able to efficiently complete the classification task with a small amount of traffic to cope with complex and variable attack scenarios. To solve this practical problem, the experiment in this section aims to explore and verify the adaptability and superiority of the proposed model in real Internet of Things scenarios with insufficient training samples.

[0134] We conducted simulation experiments on the NSL-KDD and UNSW-NB15 datasets. By randomly sampling, we set different orders of magnitude of training samples, with the minimum number of training samples as low as 100, while keeping the test set unchanged. This setting effectively simulates the difficulty of obtaining comprehensive and complete data in real Internet of Things scenarios. The experiment uses three indicators—accuracy, F1 score, and Matthews correlation coefficient—to comprehensively evaluate the performance of the model to reflect its detection ability in complex Internet of Things environments. Figure 4a 、 Figure 4b and Figure 4cReflect the performance indicators of the network intrusion detection model in this application when using the NSL-KDD dataset, Figure 5a , Figure 5b and Figure 5c Reflect the performance indicators of the network intrusion detection model in this application when using the UNSW-NB15 dataset.

[0135] Tables six and seven show the experimental results. Compared with the current most advanced contrast learning method, the network intrusion detection model in this application shows higher robustness and detection efficiency under limited sample conditions. Our method maintains a significant performance advantage, especially in the scenario of a small number of samples, fully demonstrating its applicability and superiority in actual Internet of Things scenarios. For example, on the NSL-KDD dataset, under the condition of two-dimensional embedding and 100 training samples, the proposed model is 30.85% and 8.33% higher in accuracy than ConCE and ConLE, respectively. In addition, we observe that in most cases, higher embedding dimensions can improve the performance of the model. For example, under the same experimental conditions, the performance of TGDCLNet using a 10-dimensional embedding is better than that using a 2-dimensional embedding. This shows that the setting of embedding dimensions has a certain impact on the performance of the model, providing guidance for our subsequent hyperparameter analysis experiments.

[0136] Table six Performance under small data set (NSL-KDD)

[0137]

[0138] Table seven Performance under small data set (UNSW-NB15)

[0139]

[0140]

[0141] Figure 4a , Figure 4b , Figure 4c , Figure 5a , Figure 5b and Figure 5c The curve shows the changes of various model indicators under different training sample quantities. It is obvious that with the rapid reduction of sample quantity, the indicators of TGDCLNet decrease the slowest, always maintaining the best performance level. This may be due to the fact that the hybrid rebalancing strategy effectively solves the problem of extreme data imbalance, and the design of the denoising learning module and the teacher guidance module gives the network intrusion detection model in this application strong learning ability, making it perform well even in the case of extremely limited training samples.

[0142] Next, the content of hyperparameter analysis is introduced in detail. In order to further study the performance of TGDCLNet in the Internet of Things environment, we conducted hyperparameter experiments on the NSL-KDD dataset to explore the influence of different combinations of learning rate (lr) and embedding dimension (dim) on the multi-classification effect of the model.

[0143] In this experiment, we used four indicators—accuracy (ACC), F1 score, recall (Recall), and Matthew's correlation coefficient (MCC)—to evaluate the performance of the model. The specific results are shown in Figure 6a to Figure 6d , Figure 6a shows the accuracy of the network intrusion detection model under different learning rates and embedding dimensions, Figure 6b shows the F1 score of the network intrusion detection model under different learning rates and embedding dimensions, Figure 6c shows the recall of the network intrusion detection model under different learning rates and embedding dimensions, Figure 6d shows the Matthew's correlation coefficient of the network intrusion detection model under different learning rates and embedding dimensions. Figure 6a to Figure 6d clearly shows the changes in model performance under different combinations of learning rate and embedding dimension. Overall, the change in learning rate has a significant impact on model performance under different embedding dimensions, and a lower learning rate generally improves model performance. This may be due to a smaller step size helping the model converge more effectively to the optimal solution. The overall trend shows that as the embedding dimension increases, the model performance improves to some extent, especially in the case of higher learning rates, which reflects that when dealing with massive multi-dimensional data in the Internet of Things, higher embedding dimensions help the model capture more rich feature information. However, too high a dimension may lead to overfitting and reduce the generalization performance. Overall, as the learning rate decreases and the embedding dimension increases appropriately, the performance indicators of the model show an upward trend. This indicates that under these conditions, the model can more effectively capture the complexity and diversity of the data. Through data visualization analysis, we finally selected the parameter combination (dim=12, lr=0.001) corresponding to the performance peak, under which the model performs best.

[0144] Next, the role of each step in this application is introduced in detail through ablation experiments.

[0145] 1) The role of the hybrid re-balancing strategy (HRS): We compared TGDCLNet with its variant that lacks the hybrid re-balancing strategy (HRS), called TGDCLNet w / o HRS. In this experiment, no re-balancing strategy was applied during the data processing. Referring to the previous ablation experiment based on the hybrid re-balancing strategy, we selected the most suitable re-balancing strategy for the ablation experiment in this section. As shown in Table IX, without HRS, the model performance is lower than TGDCLNet, with a 9.87% and 11.71% decrease in accuracy and F1-score, respectively, which demonstrates the effectiveness of the hybrid re-balancing strategy.

[0146] 2) Ablation experiment of TGDCLNet: In this section, we conducted a detailed ablation experiment on the NSL-KDD dataset to better understand the sub-modules of the teacher-guided denoising contrastive learning model design. The ablation experiment results are shown in Table IX.

[0147] a) The role of the hybrid re-balancing strategy (HRS): We compared TGDCLNet with its variant that lacks the hybrid re-balancing strategy (HRS), called TGDCLNet w / o HRS. In this experiment, no re-balancing strategy was applied during the data processing. Referring to the previous ablation experiment based on the hybrid re-balancing strategy, we selected the most suitable re-balancing strategy for the ablation experiment in this section. As shown in Table IX, without HRS, the model performance is lower than TGDCLNet, with a 9.87% and 11.71% decrease in accuracy and F1-score, respectively, which demonstrates the effectiveness of the hybrid re-balancing strategy.

[0148] b) The role of denoising learning (DL): To evaluate the effectiveness of the denoising learning (DL) module introduced in our model, we compared TGDCLNet with its variant that lacks the denoising learning module, called TGDCLNet w / o DL. In this experiment, both the teacher and student models cannot perform feature denoising learning due to the lack of guidance from the denoising multi-dimensional balanced mean square error loss function. As shown in Table IX, without the denoising learning module, the performance of TGDCLNet significantly decreases, with a 15.48% and 15.24% decrease in accuracy and F1-score, respectively. This module plays a crucial role in the representation learning capability of TGDCLNet.

[0149] c) Role of Teacher Guidance (TG): To evaluate the effectiveness of the teacher guidance (TG) module in TGDCLNet, we compared TGDCLNet with its variant that lacks the teacher guidance module (referred to as TGDCLNet w / o TG). In this experimental setup, we removed the balanced weighted binary cross-entropy loss, resulting in the teacher model being unable to effectively guide the training of the student model. As shown in Table Nine, consistent with our expectations, the model lacking the teacher guidance module performed worse than TGDCLNet, with significant drops in all metrics, with accuracy and F1 score dropping by 73.64% and 70.15%, respectively. This highlights the important guiding role of the teacher guidance module in the model learning process.

[0150] Table Eight Ablation Analysis of Hybrid Re-balancing Strategy

[0151]

[0152]

[0153] Table Nine Ablation Analysis of TGDCLNet on NSL-KDD Dataset

[0154]

[0155] In summary, this paper addresses the challenges posed by traffic imbalance and unknown attack types in the training and detection of network intrusion detection models during the collection of Internet of Things device network traffic data. We propose a novel teacher-guided denoising contrastive learning network. By designing a hybrid re-balancing strategy module and a denoising module, we effectively reduce the impact of data noise on model training and improve detection accuracy. Additionally, we innovatively introduce a teacher guidance module that guides the learning of the student model through label embedding and balanced weighted binary cross-entropy loss function, enhancing training efficiency and the model's detection ability on imbalanced training sets. Experimental results show that on the authoritative datasets NSL-KDD and UNSW-NB15, the performance of TGDCLNet is superior to existing intrusion detection methods. Moreover, our method exhibits robustness in complex and dynamic real-world Internet of Things environments. In particular, in challenging environments where attack types are unknown and traffic data is scarce, TGDCLNet outperforms other contrastive learning methods, demonstrating its effectiveness and stability in practical applications.

[0156] Future work will further optimize the model structure to enhance its generalization ability in different scenarios. More practical application scenarios will also be explored to ensure the safe and stable operation of Internet of Things environments.

[0157] In a second aspect, the embodiments of the present application provide a network intrusion model training device, which can improve the detection accuracy of network intrusion.

[0158] As shown in Figure 7 The network intrusion model training device 7 provided by the embodiments of the present application is applied to an Internet of Things system, and the network intrusion model includes a teacher model and a student model. The teacher model includes a teacher autoencoder, and the student model includes a student autoencoder.

[0159] The device includes:

[0160] The processing module 71 is configured to perform data enhancement processing on network data by using a hybrid rebalancing strategy.

[0161] The first training module 72 is configured to train the student model by using a first loss function and the network data.

[0162] The second training module 73 is configured to train the teacher model by using the first loss function and the network data after data enhancement processing.

[0163] The association constraint module 74 is configured to further train the student model by using a second loss function to establish an association constraint between outputs of the teacher model and the student model.

[0164] In some embodiments of the present application, the hybrid rebalancing strategy includes a cyclic sampling enhancement step, a blur elimination redundancy elimination step, and an adaptive weighting step.

[0165] In some embodiments of the present application, the device includes a preprocessing module configured to perform preprocessing on initial network data to obtain the network data with label information before the network data is processed by using the hybrid rebalancing strategy for data enhancement.

[0166] In some embodiments of the present application, the first loss function is a denoising multi-dimensional balanced mean square error loss function.

[0167] In some embodiments of the present application, the second loss function is a balanced weighted binary cross-entropy loss function.

[0168] The network intrusion model training device provided by the embodiments of the present application can perform data enhancement processing on network data by using a hybrid rebalancing strategy. The student model is trained by using a first loss function and the network data, the teacher model is trained by using the first loss function and the network data after data enhancement processing, and the student model is further trained by using a second loss function to establish an association constraint between outputs of the teacher model and the student model, so that the detection accuracy of network intrusion can be improved.

[0169] The network intrusion model training device provided in the embodiment of the present application and the aforementioned network intrusion model training method belong to the same inventive concept. The technical details not described in the network intrusion model training device can be found in the relevant description in the aforementioned network intrusion model training method and will not be repeated here.

[0170] Accordingly, an embodiment of the present application further provides an electronic device, Figure 8 This is a schematic diagram of the structure of an embodiment of the electronic device of this application, which can realize the application Figure 1 The process of the embodiment shown. Figure 8 As shown, the above-mentioned electronic device may include: a shell 81, a processor 82, a memory 83, a circuit board 84 and a power supply circuit 85, wherein the circuit board 84 is placed inside the space enclosed by the shell 81, and the processor 82 and the memory 83 are set on the circuit board 84; the power supply circuit 85 is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory 83 is used to store executable program code; the processor 82 runs the program corresponding to the executable program code by reading the executable program code stored in the memory 83, so as to execute the method described in any of the above-mentioned embodiments.

[0171] The specific execution process of the above steps by the processor 82 and the steps further performed by the processor 82 by running the executable program code can be found in this application. Figure 1 The description of the illustrated embodiment will not be repeated here.

[0172] This electronic device exists in many forms, including but not limited to:

[0173] (1) Mobile communication devices: These devices are characterized by their mobile communication capabilities and primarily provide voice and data communications. These terminals include smartphones (such as the iPhone), multimedia phones, feature phones, and low-end phones.

[0174] (2) Ultra-mobile personal computer devices: These devices fall under the category of personal computers, have computing and processing capabilities, and generally also have mobile Internet access. These terminals include PDAs, MIDs, and UMPCs, such as the iPad.

[0175] (8) Portable entertainment devices: These devices can display and play multimedia content. These devices include audio and video players (such as iPods), handheld game consoles, e-books, smart toys, and portable car navigation devices.

[0176] (8) Server: a device providing computing services, the configuration of the server includes a processor, a hard disk, a memory, a system bus, etc., the server is similar to a general computer architecture, but since it needs to provide high-reliable services, it has higher requirements in processing capability, stability, reliability, security, scalability, manageability, etc.

[0177] (5) Other electronic devices with data interaction function.

[0178] In addition, the embodiment of the present application also provides a computer readable storage medium, the computer readable storage medium stores one or more programs, the one or more programs can be executed by one or more processors to implement the method provided by any embodiment of the present application, so the corresponding beneficial technical effects can also be realized, the corresponding description has been made before, which will not be repeated here.

[0179] It should be noted that in the present application, relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the existence of other identical elements in the process, method, article or device including the element.

[0180] In the present application, the term "and / or" describes the association relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B can represent the following three cases: A exists alone, A and B exist together, and B exists alone. The character " / " generally represents that the associated objects before and after it are in an "or" relationship.

[0181] Each embodiment in the present specification is described in a relevant manner, and the same or similar parts between each embodiment can be referred to each other, and each embodiment mainly explains the difference from other embodiments.

[0182] Especially, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0183] For the convenience of description, the above device is described as various units / modules respectively described in function. Of course, in the implementation of the present application, the functions of each unit / module can be implemented in the same or multiple software and / or hardware.

[0184] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program. The program can be stored in a computer-readable storage medium, and when the program is executed, the program can include the processes of the above-mentioned embodiment methods. The storage medium can be a magnetic disc, an optical disc, a read-only memory (ROM), a random access memory (RAM), or the like.

[0185] The above merely provides a specific implementation of the present application, but the protection scope of the present application is not limited to this. Any changes or replacements within the technical scope disclosed by the present application can be easily conceived by those skilled in the art, and should be encompassed within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A training method for a network intrusion model, characterized in that: Applied to an Internet of Things system, the network intrusion model includes a teacher model and a student model; the teacher model includes a teacher autoencoder, and the student model includes a student autoencoder; The method comprises: A hybrid rebalancing strategy is used to perform data enhancement on network data; Training the student model using a first loss function and the network data; Training the teacher model using the first loss function and the network data after data augmentation processing; The second loss function is used to establish association constraints between the outputs of the teacher model and the student model, and the student model is further trained.

2. The method according to claim 1, characterized in that The hybrid rebalancing strategy includes: a cyclic sampling enhancement step, a fuzzy elimination and redundancy removal step, and an adaptive weighting step.

3. The method according to claim 1, characterized in that Before adopting the hybrid rebalancing strategy to perform data enhancement processing on the network data, the method further includes: The initial network data is preprocessed to obtain the network data with label information.

4. The method according to claim 1, wherein The first loss function is a denoising multidimensional balanced mean square error loss function.

5. The method according to claim 1, wherein The second loss function is a balanced weighted binary cross entropy loss function.

6. A training device for a network intrusion model, characterized in that: Applied to an Internet of Things system, the network intrusion model includes a teacher model and a student model; the teacher model includes a teacher autoencoder, and the student model includes a student autoencoder; The device comprises: A processing module, used to perform data enhancement processing on network data by adopting a hybrid rebalancing strategy; A first training module, configured to train the student model using a first loss function and the network data; A second training module is used to train the teacher model using the first loss function and the network data after data enhancement processing; The association constraint module is used to use the second loss function to establish the association constraints between the outputs of the teacher model and the student model, and further train the student model.

7. The device according to claim 1, characterized in that The hybrid rebalancing strategy includes: a cyclic sampling enhancement step, a fuzzy elimination and redundancy removal step, and an adaptive weighting step.

8. The device according to claim 1, characterized in that The device comprises: The preprocessing module is used to preprocess the initial network data before performing data enhancement processing on the network data using the hybrid rebalancing strategy to obtain the network data with label information.

9. The device according to claim 1, characterized in that The first loss function is a denoising multidimensional balanced mean square error loss function.

10. The device according to claim 1, characterized in that The second loss function is a balanced weighted binary cross entropy loss function.

11. An electronic device, characterized in that: The electronic device includes: a housing, a processor, a memory, a circuit board and a power supply circuit, wherein the circuit board is placed inside the space enclosed by the housing, and the processor and the memory are arranged on the circuit board; the power supply circuit is used to supply power to various circuits or devices of the above-mentioned electronic device; the memory is used to store executable program code; the processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method described in any one of claims 1 to 5 above.

12. A computer-readable storage medium, characterized in that A computer program is stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images