Network intrusion detection method based on self-attention residual generative adversarial network

Abstract

The invention discloses a network intrusion detection method based on a self-attention residual generative adversarial network, which belongs to the technical field of network intrusion detection and comprises the following steps: collecting network flow data, and preprocessing the network flow data to obtain real training data; a FARD-WGAN-GP model is constructed and trained, and hybrid pseudo data is generated based on the trained FARD-WGAN-GP model; constructing a time sequence attention detection model; training a time sequence attention detection model based on the real training data and the pseudo data; network intrusion real-time detection is carried out based on the trained time sequence attention detection model; on the basis of the real-time detection result, optimizing the FARD-WGAN-GP model, and on the basis of the optimized FARD-WGAN-GP model, optimizing the time sequence attention detection model; and carrying out network intrusion detection based on the optimized time sequence attention detection model. According to the method, the quality of the generated data is improved, and the detection accuracy is improved.

Description

Technical Field

[0001] The present application relates to the field of network intrusion detection technology, and in particular to a network intrusion detection method based on self-attention residual generative adversarial network. Background Art

[0002] Network intrusion detection is a key technology in network security, aiming to identify anomalous network behavior and protect systems from attacks. Traditional methods such as rule-based detection and machine learning models (e.g., support vector machines and random forests) face challenges when processing complex network traffic, especially in the presence of imbalanced data. For example, the NSL-KDD dataset has a sparse sample size for minority attacks (e.g., U2R), resulting in degraded detection performance.

[0003] Generative adversarial networks (GANs) have been used in recent years to generate synthetic data to enhance training sets. However, existing GAN models (such as standard GANs or Wasserstein GANs) are generally not optimized for the mixed-type features of network security data (discrete features such as protocol type and continuous features such as traffic volume) and lack the ability to handle temporal dependencies. Furthermore, existing methods often suffer from low quality when generating minority class samples, making it difficult to effectively improve detection performance. For example, existing techniques use standard GANs to generate network traffic, but fail to consider the differences between discrete and continuous features and do not incorporate temporal modeling, resulting in limited quality of generated data.

[0004] Therefore, there is an urgent need for a network intrusion detection method that can process mixed-type data, generate high-quality minority class samples, and combine temporal features to improve detection performance and address the data imbalance problem. Summary of the Invention

[0005] In response to the above-mentioned deficiencies in the prior art, this application provides a network intrusion detection method based on self-attention residual generative adversarial network, which solves the problems in the prior art such as lack of mixed-type data, failure to introduce temporal features, data imbalance and low detection performance.

[0006] In order to achieve the above-mentioned invention objectives, the technical solutions adopted in this application are: This application provides a network intrusion detection method based on self-attention residual generative adversarial network, including: S1: Collect network traffic data and preprocess it to obtain real training data; S2: Build and train the FARD-WGAN-GP model, and generate hybrid pseudo data based on the trained FARD-WGAN-GP model; S3: Build a temporal attention detection model; S4: Train a temporal attention detection model based on real training data and mixed pseudo data; S5: Real-time network intrusion detection based on trained temporal attention detection model; S6: Based on the real-time detection results, optimize the FARD-WGAN-GP model, and optimize the temporal attention detection model based on the optimized FARD-WGAN-GP model; S7: Network intrusion detection based on the optimized temporal attention detection model.

[0007] Furthermore, the S1 includes: S101: Using network mirroring technology to collect network traffic data of the core switch, and storing the network traffic data in pcap format to obtain a pcap file; S102: Use Bro-IDS technology to parse the pcap file, extract basic features from the parsed pcap file, and generate real training data based on the extracted basic features; S103: Perform sample balancing processing on the real training data.

[0008] Furthermore, the FARD-WGAN-GP model includes a generator and a discriminator; The generator uses random noise input, extracts features through three shared feature extraction layers, and enhances feature expression through residual blocks and self-attention mechanisms. Based on the enhanced features, it uses two branches to output mixed pseudo data containing discrete and continuous features. The residual block uses a bilinear layer and ReLU structure, and the self-attention mechanism uses a QKV mechanism combined with residual block connections to model long-range dependencies. The discriminator determines the difference between the mixed pseudo data generated by the generator and the real training data, and outputs a true-false score; The generator optimizes the loss function based on the authenticity score of the discriminator.

[0009] Furthermore, the dual-branch output includes a Softmax discrete branch and a Tanh continuous branch.

[0010] Furthermore, the loss function is:

[0011] in, For expectations, is the score of the discriminator on the mixed pseudo data, is the score of the discriminator on the real training data, is the generated mixed pseudo data, is the real training data, is a random noise vector.

[0012] Furthermore, the training of the FARD-WGAN-GP model includes: A1: Initialize training parameters, including generator learning rate, discriminator learning rate, training size, and number of training rounds; A2: Based on the Adam optimizer and the initialized training parameters, the discriminator is trained using real training data and mixed pseudo data, and the discriminator loss is calculated. The discriminator parameters are updated based on the backpropagation of the discriminator loss. A3: Based on the Adam optimizer and initialized training parameters, the generator is trained using a hybrid of pseudo data generated by a generator optimized based on the authenticity score of the trained discriminator. The generator loss is calculated and the generator parameters are updated by backpropagation based on the generator loss.

[0013] Furthermore, the temporal attention detection model in S3 adopts a bidirectional LSTM module, a temporal attention module and a fully connected classifier structure; The bidirectional LSTM module obtains the temporal dependency of network traffic, obtains temporal features, and forms a temporal feature matrix; the temporal attention module obtains the attention weights of the time dependency between temporal features, and aggregates the temporal features based on the attention weights; the fully connected classifier obtains the aggregated temporal features.

[0014] Furthermore, the S4 includes: S401: Fuse the real training data and the mixed pseudo data to construct a mixed dataset; S402: Fusing the real labels corresponding to the real training data and the labels corresponding to the mixed pseudo data to construct a mixed label set; S403: Based on the mixed label set, the cross entropy loss function is used to guide the fully connected layer classifier of the temporal attention detection model to learn the decision boundary between normal traffic and attack traffic; S404: Input the mixed data set into the temporal attention detection model, perform temporal feature modeling through the bidirectional LSTM module, and after feature aggregation through the temporal attention module, pass the aggregated temporal features into the learned fully connected classifier for network intrusion identification.

[0015] Furthermore, the S5 includes: S501: Deploy the trained temporal attention detection model on the edge computing node and detect real-time network traffic through the stream processing framework; S502: Record the detection results. When the intrusion probability in the detection results exceeds a set threshold, trigger an alarm and record the attack feature sample of the intrusion.

[0016] Furthermore, the S6 includes: S601: Collect new attack feature samples and generate new hybrid pseudo data based on the FARD-WGAN-GP model; S602: Train a temporal attention detection model based on the new hybrid pseudo data and update the feature library of the temporal attention detection model.

[0017] The beneficial effects of this application are: This application provides a network intrusion detection method based on a self-attention residual generative adversarial network. This method generates high-quality, diverse pseudo-attack data using the FARD-WGAN-GP model, effectively addressing data scarcity and imbalance issues and improving the quality of generated data. Furthermore, the method utilizes a temporal attention detection model to accurately capture complex, long-range temporal dependencies in network traffic, focusing on key information. Furthermore, real-time detection result feedback is used to continuously improve the FARD-WGAN-GP model and the temporal attention detection model, making the entire detection process dynamically adaptable and improving detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0019] Figure 1 A flowchart of a network intrusion detection method based on a self-attention residual generative adversarial network provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field based on this application are within the scope of protection of this application.

[0021] The present invention provides a network intrusion detection method based on self-attention residual generative adversarial network. Figure 1 , Figure 1 The figure shows a flow chart of a network intrusion detection method based on self-attention residual generative adversarial network provided by an embodiment of the present application, including: S1: Collect network traffic data and preprocess the network traffic data to obtain real training data.

[0022] Furthermore, the S1 includes: S101: Using network mirroring technology to collect network traffic data of the core switch, and storing the network traffic data in pcap format to obtain a pcap file; S102: Use Bro-IDS technology to parse the pcap file, extract basic features from the parsed pcap file, and generate real training data based on the extracted basic features; S103: Perform sample balancing processing on the real training data.

[0023] In one embodiment of the present application, multi-source traffic collection can be performed using network mirroring technology to collect full traffic data from core switches. The tcpdump tool is used to capture data packets at 5-minute intervals and store them in pcap format. The collection scope covers key nodes such as server areas and border firewalls, ensuring that complete TCP / UDP protocol session data is included.

[0024] Bro-IDS was used to parse the pcap file and extract 41 basic features (such as categorical features like protocol_type, service, and flag, and continuous features like duration and bytes) to generate a structured dataset. One-hot encoding (OHE) was used for categorical features, and continuous features were normalized to [0, 1] using MinMaxScaler. This ultimately generated the real training data consisting of the feature matrix X and the label Y (U2R = 1, normal = 0).

[0025] Sample balancing: For high-risk, extremely unbalanced malicious traffic, such as the imbalance problem where the U2R (user to root) sample ratio is less than 0.1%, first pass Filter the target category, and then use FARD-WGAN-GP to generate pseudo samples, generating 5000 high-risk and extremely unbalanced samples, among which, represents the dataset after sample extraction, Represents a sample, represents the original dataset, Representation sample Tags, and is the target label of the sample that you want to extract from the original dataset, For normal traffic, Targeted attack.

[0026] S2: Build and train the FARD-WGAN-GP model, and generate hybrid pseudo data based on the trained FARD-WGAN-GP model.

[0027] In one embodiment of the present application, the generator FARD-WGAN-GPGenerator and the discriminator FARD-WGAN-GPDiscriminator are the core components of FARD-WGAN-GP. The generator uses 100-dimensional noise input and extracts features through a three-layer shared mapping (1024→512→256). The residual blocks (res_block1, res_block2) and the self-attention mechanism (SelfAttention) are combined to enhance feature expression. Finally, a dual-branch output contains a mixture of three-dimensional discrete features (such as protocol type) and continuous features (such as traffic bytes). The residual block uses a bilinear layer and ReLU structure. The self-attention mechanism uses the QKV mechanism combined with the residual block connection to model long-distance dependencies, solving the problem of generating minority class features. The discriminator inputs real data and generated pseudo data, and the dual-branch structure processes the discrete and continuous features respectively, and outputs a authenticity score. Each fake data generated by the generator is evaluated by the discriminator. The discriminator evaluates the difference based on the WGAN-GP loss and gradient penalty. The generator then optimizes the loss function, striving to make the fake data closer to the real data distribution. The discriminator and generator are strengthened in the adversarial process, improving their ability to distinguish and forcing the generator to produce more realistic data. This iterative optimization ultimately improves the quality of U2R samples generated by FARD-WGAN-GP and its detection performance.

[0028] The dual-branch output includes a Softmax discrete branch and a Tanh continuous branch, which fundamentally avoids feature type confusion.

[0029] The loss function is:

[0030] in, For expectations, is the score of the discriminator on the mixed pseudo data, is the score of the discriminator on the real training data, is the generated mixed pseudo data, is the real training data, is a random noise vector.

[0031] Furthermore, the training of the FARD-WGAN-GP model includes: A1: Initialize the training parameters, including the generator learning rate of 0.0004, the discriminator learning rate of 0.0001, the training size of 128, and the number of training rounds of 100 rounds; A2: Based on the Adam optimizer and the initialized training parameters, the discriminator is trained using real training data and mixed pseudo data, and the discriminator loss is calculated. The discriminator parameters are updated based on the backpropagation of the discriminator loss. A3: Based on the Adam optimizer and initialized training parameters, the generator is trained using a hybrid of pseudo data generated by a generator optimized based on the authenticity score of the trained discriminator. The generator loss is calculated and the generator parameters are updated by backpropagation based on the generator loss.

[0032] In one embodiment of the present application, the FARD-WGAN-GP model achieved a G-mean of 0.4349, a significant improvement of 25.6% over direct classification, 25.6% over SMOTE, and 58.8% over WGAN-GP. Specifically, by modeling the relationships between samples within a batch, this mechanism captures the global characteristic patterns of rare U2R (user-to-root) attacks. This enhances the generator's ability to learn contextual dependencies, improves the quality of generated samples, and enhances detection of minority classes. This performance leap effectively balances the detection capabilities of positive and negative classes, addressing the challenges of imbalanced datasets. Furthermore, the residual block mitigates gradient vanishing, ensuring stable training. The dual-branch structure processes discrete and continuous features separately, simplifying computation and accelerating inference while maintaining sample diversity. Compared to models designed for tabular data generation, such as CTGAN, the optimized architecture reduces computational overhead and achieves fast inference while improving accuracy. In addition, for the U2R class, the model captures the global patterns of rare U2R attacks, enabling the generator to generate realistic samples and improve the detection sensitivity and recall of low-frequency events. The independent branches of different feature types (e.g., discrete and continuous) strengthen the discriminator's ability to distinguish subtle U2R attack patterns.

[0033] S3: Build a temporal attention detection model.

[0034] In one embodiment of the present application, the temporal attention detection model adopts a bidirectional LSTM module, a temporal attention module and a fully connected classifier structure. The bidirectional LSTM module obtains the temporal features of the network traffic to form a temporal feature matrix. The temporal attention time_attention module captures the time dependency between the temporal feature matrices. The input is the temporal expansion of the feature matrix X, and the temporal features are aggregated based on the time dependency. The fully connected classifier obtains the aggregated temporal features and implements binary classification through three layers of full connection (200→1024→512→2). The activation function uses ReLU, and the output layer uses Softmax to generate the attack probability. The specific detection process is to process the input network traffic time series data through a bidirectional LSTM module. This module captures the time series dependency from both the forward and backward directions and generates a feature matrix containing rich time series information; the feature matrix is ​​processed using a time series attention module. This module calculates the importance score of each time step through a fully connected layer and a Tanh activation function, and then obtains the attention weight representing the time dependency through Softmax normalization. Finally, the time series features are weighted and aggregated based on these weights to form a comprehensive context vector; finally, the aggregated feature vector is input into a fully connected classifier, which gradually extracts high-level features through a multi-layer neural network and outputs the final classification prediction result to complete the network traffic detection task.

[0035] S4: Train a temporal attention detection model based on real training data and pseudo data.

[0036] Furthermore, the S4 includes: S401: vertically concatenate the real training data and the mixed pseudo data to form a mixed dataset Xc; S402: The real labels corresponding to the real training data and the labels corresponding to the hybrid pseudo data are merged to construct a hybrid label set Yc, where the real training data retains the original labels (normal traffic is marked as 0, U2R attack is marked as 1), and the labels corresponding to all hybrid pseudo data created by the generator are uniformly marked as attack class 1; S403: The mixed label set is used as a supervisory signal to help the detection network complete training and classification. The cross-entropy loss function is used to guide the fully connected layer classifier of the temporal attention detection model to learn the decision boundary between normal traffic and attack traffic. S404: The mixed data set is input into the temporal attention detection model, and temporal feature modeling is performed through the bidirectional LSTM module. After feature aggregation through the temporal attention module, the aggregated temporal features are passed into the learned fully connected classifier for network intrusion identification, ultimately achieving accurate identification of network intrusions.

[0037] In one embodiment of the present application, based on a mixed data set and a mixed label set, a cross entropy loss function is used, an Adam optimizer (learning rate 0.001) is used, and 20 rounds of training are performed. An early stopping strategy is used in each round to avoid overfitting. The cross entropy loss function can be expressed as follows:

[0038] Where, is the batch size, For the The true label of each sample (0 represents normal, 1 represents U2R attack), The model predicts The fraction of samples belonging to the normal class, The model predicts The score of samples belonging to the attack class.

[0039] S5: Real-time network intrusion detection based on trained temporal attention detection model.

[0040] In one embodiment of this application, a trained temporal attention detection model is deployed on edge computing nodes. Real-time traffic is preprocessed using a stream processing framework (such as Flink) using the transform_test process, achieving a single-sample inference time of ≤ 0.0006ms (based on an RTX 4060 GPU). Detection results are recorded. When the intrusion probability in the detection result exceeds a threshold, an alarm is triggered and attack signature samples (such as high-frequency root instruction calls and abnormal port connection sequences) are recorded.

[0041] S6: Based on the real-time detection results, optimize the FARD-WGAN-GP model, and optimize the temporal attention detection model based on the optimized FARD-WGAN-GP model.

[0042] In one embodiment of the present application, new attack samples are collected regularly (weekly), new pseudo data are incrementally generated through the FARD-WGAN-GP model, the temporal attention detection model is trained based on the new pseudo data, and the feature library of the temporal attention detection model is updated (such as the traffic features of newly added ransomware variants).

[0043] S7: Network intrusion detection based on the optimized temporal attention detection model.

[0044] This application provides a network intrusion detection method based on a self-attention residual generative adversarial network. This method generates high-quality, diverse pseudo-attack data using the FARD-WGAN-GP model, effectively addressing data scarcity and imbalance issues and improving the quality of generated data. Furthermore, the method utilizes a temporal attention detection model to accurately capture complex, long-range temporal dependencies in network traffic, focusing on key information. Furthermore, real-time detection result feedback is used to continuously improve the FARD-WGAN-GP model and the temporal attention detection model, making the entire detection process dynamically adaptable and improving detection accuracy.

[0045] It should be noted that those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of this application, and it should be understood that the scope of protection of this application is not limited to such specific descriptions and embodiments. Those skilled in the art can make various other specific variations and combinations based on the technical teachings disclosed in this application without departing from the essence of this application, and such variations and combinations are still within the scope of protection of this application.

Claims

1. A network intrusion detection method based on self-attention residual generative adversarial network, characterized in that: include: S1: Collect network traffic data and preprocess it to obtain real training data; S2: Build and train the FARD-WGAN-GP model, and generate hybrid pseudo data based on the trained FARD-WGAN-GP model; S3: Build a temporal attention detection model; S4: Train a temporal attention detection model based on real training data and mixed pseudo data; S5: Real-time network intrusion detection based on trained temporal attention detection model; S6: Based on the real-time detection results, optimize the FARD-WGAN-GP model, and optimize the temporal attention detection model based on the optimized FARD-WGAN-GP model; S7: Network intrusion detection based on the optimized temporal attention detection model.

2. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 1 is characterized in that Said S1 comprises: S101: Using network mirroring technology to collect network traffic data of the core switch, and storing the network traffic data in pcap format to obtain a pcap file; S102: Use Bro-IDS technology to parse the pcap file, extract basic features from the parsed pcap file, and generate real training data based on the extracted basic features; S103: Perform sample balancing processing on the real training data.

3. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 1 is characterized in that The FARD-WGAN-GP model includes a generator and a discriminator; The generator uses random noise input, extracts features through three shared feature extraction layers, and enhances feature expression through residual blocks and self-attention mechanisms. Based on the enhanced features, it uses two branches to output mixed pseudo data containing discrete and continuous features. The residual block uses a bilinear layer and ReLU structure, and the self-attention mechanism uses a QKV mechanism combined with residual block connections to model long-range dependencies. The discriminator determines the difference between the mixed pseudo data generated by the generator and the real training data, and outputs a true-false score; The generator optimizes the loss function based on the authenticity score of the discriminator.

4. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 3 is characterized in that The dual-branch output includes a Softmax discrete branch and a Tanh continuous branch.

5. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 4 is characterized in that The loss function is: in, For expectations, is the score of the discriminator on the mixed pseudo data, is the score of the discriminator on the real training data, is the generated mixed pseudo data, is the real training data, is a random noise vector.

6. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 5 is characterized in that The training of the FARD-WGAN-GP model includes: A1: Initialize training parameters, including generator learning rate, discriminator learning rate, training size, and number of training rounds; A2: Based on the Adam optimizer and the initialized training parameters, the discriminator is trained using real training data and mixed pseudo data, and the discriminator loss is calculated. The discriminator parameters are updated based on the backpropagation of the discriminator loss. A3: Based on the Adam optimizer and initialized training parameters, the generator is trained using a hybrid of pseudo data generated by a generator optimized based on the authenticity score of the trained discriminator. The generator loss is calculated and the generator parameters are updated by backpropagation based on the generator loss.

7. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 1 is characterized in that The temporal attention detection model in S3 adopts a bidirectional LSTM module, a temporal attention module and a fully connected classifier structure; The bidirectional LSTM module obtains the temporal dependency of network traffic, obtains temporal features, and forms a temporal feature matrix; The temporal attention module obtains the attention weights of the temporal dependencies between temporal features and aggregates the temporal features based on the attention weights; The fully connected classifier obtains aggregated time series features.

8. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 1 is characterized in that The S4 includes: S401: Fuse the real training data and the mixed pseudo data to construct a mixed dataset; S402: Fusing the real labels corresponding to the real training data and the labels corresponding to the mixed pseudo data to construct a mixed label set; S403: Based on the mixed label set, the cross entropy loss function is used to guide the fully connected layer classifier of the temporal attention detection model to learn the decision boundary between normal traffic and attack traffic; S404: Input the mixed data set into the temporal attention detection model, perform temporal feature modeling through the bidirectional LSTM module, and after feature aggregation through the temporal attention module, pass the aggregated temporal features into the learned fully connected classifier for network intrusion identification.

9. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 1 is characterized in that The S5 includes: S501: Deploy the trained temporal attention detection model on the edge computing node and detect real-time network traffic through the stream processing framework; S502: Record the detection results. When the intrusion probability in the detection results exceeds a set threshold, trigger an alarm and record the attack feature sample of the intrusion.

10. The network intrusion detection method based on self-attention residual generative adversarial network according to claim 9 is characterized in that The S6 includes: S601: Collect new attack feature samples and generate new hybrid pseudo data based on the FARD-WGAN-GP model; S602: Train a temporal attention detection model based on the new hybrid pseudo data and update the feature library of the temporal attention detection model.

Images