An intrusion detection method, system, device and medium based on zero-shot learning

Abstract

The application discloses an intrusion detection method, system, device and medium based on zero sample learning, which extracts known intrusion category features from multi-source original data to generate a training sample set; a zero sample learning model with a coupled self-encoder in a hidden layer is constructed, the zero sample learning model establishes a mapping between a feature space and a semantic space based on an intrusion scene knowledge graph of a word vector; the coupled self-encoder includes a known intrusion category self-encoder and an unknown intrusion category self-encoder for joint learning; the training sample set is used to train the zero sample learning model, learn the mapping logic of the known intrusion category features and the word vector, and migrate the mapping logic to the unknown intrusion category semantic space; real-time data is input into the trained zero sample learning model to obtain the intrusion category of the real-time data. The embodiment of the application can adapt to different types and changes of intrusion behaviors, alleviate the sample publishing divergence problem, and improve the detection precision.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intrusion detection, and in particular to an intrusion detection method, system, device and medium based on zero-shot learning. BACKGROUND

[0002] Traditional intrusion detection technology is usually based on machine learning and deep learning methods, which train the model through the features of known attack modes, match the features of actual captured abnormal traffic with known attacks, and finally identify attack data and attack types.

[0003] However, the attack types that can be detected by the existing intrusion detection model based on abnormal traffic are very limited, which is not enough to cope with the increasingly rich and varied attack situation in the cloud network environment, and it can only detect known attack patterns, so the system is vulnerable to zero-day vulnerability attacks. SUMMARY

[0004] The embodiments of the present application aim to provide an intrusion detection method, system, device and medium based on zero-shot learning, which can adapt to different types and changes of intrusion behavior, and alleviate the sample publishing divergence problem, effectively improving the reliability of zero-shot transfer and the detection accuracy of unknown attack categories.

[0005] In a first aspect, the embodiments of the present application provide an intrusion detection method based on zero-shot learning, comprising:

[0006] According to the known intrusion categories, collect multi-source original data, extract known intrusion category features from the multi-source original data, and generate a training sample set;

[0007] A zero-shot learning model is constructed, which establishes a mapping between the feature space and the semantic space based on the word vector intrusion scene knowledge graph; the hidden layer of the zero-shot learning model is provided with a coupled autoencoder; the coupled autoencoder includes a known intrusion category autoencoder and an unknown intrusion category autoencoder learned jointly;

[0008] The training sample set is used to train the zero-shot learning model, learn the mapping logic of the known intrusion category features and the word vector, and migrate the mapping logic to the unknown intrusion category semantic space;

[0009] Real-time data is input into the trained zero-shot learning model to obtain the intrusion category of the real-time data.

[0010] As an improvement of the above-mentioned scheme, the multi-source original data includes network traffic data, log data, configuration data, identity authentication data, abnormal behavior data and system performance data.

[0011] As an improvement of the above scheme, the known intrusion category is collected, multi-source original data is collected, the known intrusion category features are extracted from the multi-source original data, and a training sample set is generated, including:

[0012] According to the known intrusion category, multi-source original data is collected;

[0013] Features associated with the known intrusion category are extracted from the multi-source original data, the features are converted into binary vectors, and an initial feature set is formed;

[0014] The correlation between each feature in the initial feature set is calculated by Pearson correlation coefficient, and feature fusion is performed according to the correlation to obtain the known intrusion category features.

[0015] As an improvement of the above scheme, the input of the coupled autoencoder is the first feature matrix of the known intrusion category, the first semantic attribute matrix of the known intrusion category and the second feature matrix of the unknown intrusion category;

[0016] According to the first feature matrix and the first semantic attribute matrix, the known intrusion category self-encoder is used to obtain the first mapping matrix of the known intrusion category;

[0017] According to the first mapping matrix, the second mapping matrix of the unknown intrusion category is initialized;

[0018] According to the second mapping matrix and the second feature matrix, the unknown intrusion category self-encoder is used to obtain the second semantic attribute matrix of the unknown intrusion category;

[0019] The first mapping matrix, the second mapping matrix and the second semantic attribute matrix are updated until the zero sample learning model converges.

[0020] As an improvement of the above scheme, the zero sample learning model is constructed, and the zero sample learning model establishes the mapping between the feature space and the semantic space based on the word vector intrusion scene knowledge graph, including:

[0021] A label set is established to form a label space; the labels in the label set are bound to the intrusion category;

[0022] According to the general knowledge graph and the label set, an intrusion scene knowledge graph with word vector as node attribute is established to form a semantic space;

[0023] A feature extraction module is constructed to extract attack features of input data to form a feature space;

[0024] According to the intrusion scene knowledge graph, a graph convolutional neural network is established to map the feature space to the semantic space and output a semantic category weight matrix; the semantic category weight matrix is a semantic association strength of input data and each intrusion category;

[0025] A classifier is constructed to output a classification result of an intrusion category according to the semantic category weight matrix;

[0026] According to the label set, the intrusion scene knowledge graph, the feature extraction module, the graph convolutional neural network and the classifier, a zero-shot learning model is obtained.

[0027] As an improvement of the above scheme, the intrusion scene knowledge graph with word vectors as node attributes is established according to the general knowledge graph and the label set, and a semantic space is formed, including:

[0028] According to the general semantic classification knowledge graph and the label set, a known intrusion category node, an unknown intrusion category node and an associated element node are defined to constitute a first knowledge graph subset;

[0029] A word vector of an intrusion category is obtained, and the word vector is embedded into the first knowledge graph subset as a node attribute to obtain a second knowledge graph subset;

[0030] A general scene association knowledge graph is adopted to obtain an intrusion scene knowledge graph according to the first knowledge graph subset and the second knowledge graph subset, and a semantic space is formed.

[0031] As an improvement of the above scheme, according to the intrusion scene knowledge graph, a graph convolutional neural network is established to map the feature space to the semantic space and output a semantic category weight matrix, including:

[0032] An intrusion scene knowledge graph is obtained, and a graph convolutional neural network is established, wherein the nodes of the graph convolutional neural network correspond to the nodes of the intrusion scene knowledge graph;

[0033] The output of the feature extraction module is connected to the graph convolutional neural network, so that the graph convolutional neural network fuses neighbor features into nodes based on the output of the feature extraction module;

[0034] The graph convolutional neural network outputs a semantic category weight matrix through several layers of iteration; elements in the semantic category weight matrix represent the semantic association of the features of input data and nodes in the intrusion scene knowledge graph.

[0035] As an improvement of the above scheme, the classifier adopts a direct attribute prediction model, the classifier includes a plurality of sub-classifiers, the number of the sub-classifiers is consistent with the number of semantic attributes, and the sub-classifiers are used to calculate the association probability of the calculated semantic attribute and the label, and the classifier obtains the target label according to the association probability calculated by each sub-classifier.

[0036] As an improvement of the above scheme, the training of the zero-shot learning model by using the training sample set, the learning of the mapping logic of the known intrusion category feature and the word vector, and the migration of the mapping logic to the unknown intrusion category semantic space include:

[0037] The training sample set is input into the constructed zero-shot learning model, the mapping logic of the known intrusion category feature and the word vector is learned based on the intrusion scene knowledge graph, and the semantic association of the nodes in the intrusion scene knowledge graph is obtained.

[0038] According to the semantic association, the mapping logic is migrated to the unknown intrusion category, so that the trained zero-shot learning model can perform semantic space mapping on the input data, and the classification of the intrusion category is realized.

[0039] As an improvement of the above scheme, before the real-time data is input into the trained zero-shot learning model to obtain the intrusion category of the real-time data, the zero-shot learning based intrusion detection method further includes:

[0040] The trained zero-shot learning model is migrated to a cloud environment to test the unknown intrusion category detection capability of the zero-shot learning model.

[0041] According to the test result, the parameters of the zero-shot learning model are updated.

[0042] As an improvement of the above scheme, the updating of the parameters of the zero-shot learning model according to the test result includes:

[0043] From the test result, the network attack of the undetected unknown intrusion type is screened, and the original data and attack link of the network attack are obtained through traceability analysis;

[0044] According to the original data and the attack link, the training sample set is updated to perform incremental training on the zero-shot learning model.

[0045] In a second aspect, an embodiment of the present application provides an intrusion detection system based on zero-shot learning, which includes:

[0046] A training sample set generation module is configured to collect multi-source original data according to known intrusion categories, extract known intrusion category features from the multi-source original data, and generate a training sample set.

[0047] The model construction module is configured to construct a zero-shot learning model, which establishes a mapping between a feature space and a semantic space based on a word vector intrusion scene knowledge graph.

[0048] The model training module is configured to train the zero-shot learning model using the training sample set, learn a mapping logic between the known intrusion category features and the word vectors, and migrate the mapping logic to an unknown intrusion category semantic space.

[0049] The model application module is configured to input real-time data into the trained zero-shot learning model to obtain an intrusion category of the real-time data.

[0050] In a third aspect, an embodiment of the present application provides an intrusion detection device based on zero-shot learning, which includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor implements the zero-shot learning-based intrusion detection method as described above when executing the computer program.

[0051] In a fourth aspect, a computer-readable storage medium includes a stored computer program, wherein the computer-readable storage medium controls a device where the computer-readable storage medium is located to execute the zero-shot learning-based intrusion detection method as described above when the computer program is running.

[0052] Compared with the prior art, the zero-shot learning-based intrusion detection method, system, device, and medium disclosed by the present application can collect multi-source original data according to known intrusion categories, extract known intrusion category features from the multi-source original data, generate a training sample set, construct a zero-shot learning model, which establishes a mapping between a feature space and a semantic space based on a word vector intrusion scene knowledge graph, the hidden layer of the zero-shot learning model is provided with a coupled autoencoder, the coupled autoencoder includes a known intrusion category autoencoder and an unknown intrusion category autoencoder learned jointly, the zero-shot learning model is trained using the training sample set, a mapping logic between the known intrusion category features and the word vectors is learned, and the mapping logic is migrated to an unknown intrusion category semantic space, and real-time data is input into the trained zero-shot learning model to obtain an intrusion category of the real-time data. The embodiment of the present application can adapt to different types and changes of intrusion behaviors and improve the detection accuracy of unknown attack categories. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1is a step flow schematic diagram of an intrusion detection method based on zero-shot learning provided by an embodiment of the present application.

[0054] Figure 2 is a structural schematic diagram of a direct attribute prediction model provided by an embodiment of the present application.

[0055] Figure 3 is a structural schematic diagram of an intrusion detection system based on zero-shot learning provided by an embodiment of the present application.

[0056] Figure 4 is a structural schematic diagram of an intrusion detection device based on zero-shot learning provided by an embodiment of the present application. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0058] In the description and claims of the specification, it is to be understood that the terms first, second, etc. are used only for the purpose of description and are not to be construed as indicating or implying relative importance or an indicated number of technical features. They are not necessarily used in the order or time sequence described. Where appropriate, terms are interchangeable. Therefore, features with "first" and "second" can explicitly or implicitly include at least one of the features.

[0059] Traditional intrusion detection technology can only detect known attack patterns, and the deep learning algorithm has very high requirements for the data set, and requires a large amount of valid data to achieve high recognition accuracy. However, for new and unknown attack methods, there is not enough real data support to effectively identify, so the system is vulnerable to zero-day vulnerability attacks.

[0060] Based on the above thinking, an intrusion detection method based on zero-shot learning is provided in an embodiment of the present application. Please refer to Figure 1 In this embodiment, the intrusion detection method based on zero-shot learning is specifically executed through steps S1 to S4:

[0061] S1, according to the known intrusion category, collect multi-source original data, extract the known intrusion category features from the multi-source original data, and generate a training sample set;

[0062] S2, a zero-shot learning model is constructed, the zero-shot learning model establishes a mapping between a feature space and a semantic space based on a word vector intrusion scene knowledge graph; a hidden layer of the zero-shot learning model is provided with a coupled autoencoder; the coupled autoencoder comprises a known intrusion category autoencoder and an unknown intrusion category autoencoder learned jointly;

[0063] S3, the zero-shot learning model is trained by using the training sample set, a mapping logic of the known intrusion category feature and the word vector is learned, and the mapping logic is migrated to a semantic space of an unknown intrusion category;

[0064] S4, real-time data is input into the trained zero-shot learning model, and an intrusion category of the real-time data is obtained.

[0065] It should be noted that the known intrusion category is a network attack type that has been clearly identified, has clear feature and behavior mode in the field of network security, and is the basis for the zero-shot learning model to learn the mapping rule between features and semantics. The network attack of the unknown intrusion category does not deviate from the existing network security system, but due to the difference in feature expression from the known intrusion category, the current intrusion detection scheme is difficult to accurately identify it. The multi-source original data is collected based on the known intrusion category, which is collected through multiple data sources, that is, data that can maintain the complete form and initial information of the data source, which can be original data packets or original data entries.

[0066] In the embodiment of the application, the core function of the zero-shot learning model is to realize the mapping between the feature space and the semantic space based on the word vector intrusion scene knowledge graph. Through the knowledge graph and the mapping mechanism, the quantifiable data features and abstract semantics are associated, and at the same time, the semantic association between the intrusion categories provided by the intrusion scene knowledge graph can provide a basis for the subsequent mapping migration of unknown intrusion categories, which is the core support of the zero-shot learning in the application.

[0067] Since the known classes and unknown classes in the zero-shot learning model are disjoint, overfitting state and mapping domain offset problems are prone to occur in the deep learning training process, thereby greatly reducing the learning efficiency of the model. The embodiment of the application can alleviate the sample distribution divergence problem by setting the coupled autoencoder in the hidden layer.

[0068] It should be noted that the hidden layer of the zero-shot learning model focuses on learning the abstract semantic representation of data, and the coupled autoencoder is set in the hidden layer to more efficiently fuse the deep information of multi-source features, and provide more accurate intermediate representation for the mapping between features and semantics.

[0069] In the above scheme, the mapping of the feature space and the semantic space is established by the intrusion scene knowledge graph based on the word vector, the semantic commonness of the attack can be captured, a model does not need to be trained for each attack feature, and the generalization of the model is improved; through the joint learning of the known intrusion class autoencoder and the unknown intrusion class autoencoder, the feature semantic mapping of the known intrusion class and the mapping of the unknown class can form mutual constraints, the known class learning and the unknown class learning are avoided to be disengaged, the sample divergence problem is alleviated, and the reliability of zero sample transfer is improved; and based on the semantic mapping rule of the known attack, the new attack can be directly detected, different types and changed intrusion behaviors can be adapted, and the detection accuracy for unknown attack classes is improved.

[0070] As a preferred embodiment, the multi-source raw data includes network traffic data, log data, configuration data, authentication data, abnormal behavior data, and system performance data.

[0071] The network traffic data can be used to analyze the communication mode and detect abnormal traffic, including the source address, destination address, port number, protocol type and other information of the network packet. The log data can be used to track abnormal operations and events, including system logs, security logs, application logs, etc., which record the running state of the system and application, user operations, etc. The configuration data can be used to identify improper configurations and vulnerabilities, including network device configuration information, firewall rules, router configuration, etc. The authentication data can be used to detect abnormal login and unauthorized access, including user login information, access permissions, account activity records, etc. The abnormal behavior data is used to identify possible intrusion activities, including abnormal login attempts, abnormal operation behaviors, abnormal data access, etc. The system performance data can be used to find the influence of abnormal behaviors on system performance, including CPU utilization, memory usage, disk IO, etc. System performance indicators.

[0072] In the embodiment of the application, by selecting the above multi-source raw data, the traces and features of common intrusion attack behaviors can be covered, which is crucial for subsequent intrusion class feature extraction.

[0073] As a preferred embodiment, step S1, according to the known intrusion class, collects multi-source raw data, extracts the known intrusion class features from the multi-source raw data, and generates a training sample set, including:

[0074] According to the known intrusion class, multi-source raw data is collected;

[0075] Features associated with the known intrusion class are extracted from the multi-source raw data, the features are converted into binary vectors, and an initial feature set is formed;

[0076] The correlation between each feature in the initial feature set is calculated by a Pearson correlation coefficient, and feature fusion is performed according to the correlation to obtain a known intrusion class feature.

[0077] It should be noted that the feature associated with the known intrusion class refers to a feature in the multi-source original data that can reflect the corresponding intrusion class event.

[0078] Preferably, the features of the network traffic data include packet size, packet direction, packet frequency and transmission protocol. The features of the log data include timestamp, event type, source IP, target IP, source port, target port and operation type. The features of the configuration data include firewall rules and access control lists. The features of the authentication data include user login time, IP address, login frequency and device information. The features of the abnormal behavior data include abnormal type, abnormal time, influence range and degree; the abnormal type is login failure or access anomaly; the influence range and degree are single user, user group or the entire system. The features of the system performance data include CPU utilization, memory utilization and IO read-write rate. The features of other data include statistical features and periodic features extracted from time series data.

[0079] Then, the features are converted into binary vectors in an embedding representation or a numerical form to form an initial feature set. In some preferred embodiments, considering that the multi-source feature data greatly differ from each other and have inconsistent distribution ranges, the training effect of the model will inevitably be affected. In the embodiments of the present application, a zero-mean normalization (z-score standardization) method is used to normalize the initial feature set.

[0080] Preferably, a Pearson correlation coefficient is used to calculate a correlation coefficient matrix of the features, features with greater correlation with the prediction value are selected according to the correlation coefficient matrix, and other redundant or less relevant features are cleaned to send the features with greater correlation into a zero-sample learning model for training to automatically assign weights.

[0081] In the above scheme, the correlation between each feature in the initial feature set is calculated by a Pearson correlation coefficient to achieve redundancy elimination and ensure that the fused features can completely cover the key information of the known intrusion class.

[0082] In the embodiments of the present application, the known intrusion class autoencoder is composed of a first encoder and a first decoder, and the unknown intrusion class autoencoder is composed of a second encoder and a second decoder.

[0083] As a preferred embodiment, the known intrusion class semantic vector is defined as , and the unknown intrusion class semantic vector is ; is the semantic representation of the ith intrusion category, and k is the dimension of the semantic representation. and are the projection matrices in the first encoder and the second encoder, respectively, where d is the feature dimension. Correspondingly, the projection matrices in the first decoder and the second decoder are denoted as and .

[0084] The known intrusion category autoencoder is denoted as:

[0085] (1).

[0086] where, is the number of known intrusion category samples; is the feature vector of the known intrusion category sample; is the semantic attribute matrix of the known intrusion category. is the weighting coefficient of the importance between the loss of the first decoder and the loss of the first encoder, is the Frobenius norm.

[0087] The first term in equation (1) is the loss of the first decoder, which projects the semantic attribute into the feature space; the second term is the loss of the first encoder, which projects the feature into the semantic attribute space.

[0088] Similarly, the unknown intrusion category autoencoder is denoted as:

[0089] (2).

[0090] where, is the number of unknown intrusion category samples; is the feature vector of the unknown intrusion category sample; is the semantic attribute matrix of the unknown intrusion category. is the weighting coefficient of the importance between the loss of the second decoder and the loss of the second encoder.

[0091] The coupled autoencoder combines the known intrusion category autoencoder and the unknown intrusion category autoencoder, and is denoted as:

[0092] (3).

[0093] In equation (3), a regularization term is added to ensure that does not deviate too much from , and the parameters , , and are used to adjust the importance of to the degree of adaptation.

[0094] By derivation of equation (1) and assuming that it has a unique solution, we have:

[0095] (4).

[0096] By setting the matrix , equation (4) can be simplified to Sylvester equation:

[0097] (5).

[0098] Similarly, equation (2) can be optimized and expressed as:

[0099] (6);

[0100] where I is the identity matrix.

[0101] On this basis, derivation of equation (3) and assuming that it has a unique solution, we have:

[0102] (7);

[0103] Let , equation (7) can be simplified to:

[0104] (8);

[0105] Similarly, we have:

[0106] (9);

[0107] (10);

[0108] where .

[0109] Further, preferably, the input of the coupled autoencoder is a first feature matrix of known intrusion categories, a first semantic attribute matrix of known intrusion categories, and a second feature matrix of unknown intrusion categories;

[0110] According to the first feature matrix and the first semantic attribute matrix, a first mapping matrix of known intrusion categories is obtained through a known intrusion category autoencoder;

[0111] According to the first mapping matrix, a second mapping matrix of unknown intrusion categories is initialized;

[0112] According to the second mapping matrix and the second feature matrix, a second semantic attribute matrix of unknown intrusion categories is obtained through an unknown intrusion category autoencoder;

[0113] updating the first mapping matrix, the second mapping matrix and the second semantic attribute matrix until the zero-shot learning model converges.

[0114] In the embodiment of the present application, the input of the zero-shot learning model algorithm combined with the coupled autoencoder is the first feature matrix , the first semantic attribute matrix , the second feature matrix and the adjustment weight parameter , , and ; the output is the first mapping matrix of the known intrusion category, the second mapping matrix of the unknown intrusion category and the second semantic attribute matrix .

[0115] The specific training logic is that the first mapping matrix is initialized according to formula (5), and . If the coupled autoencoder has not yet converged, the second semantic attribute matrix is updated according to formula (6), the second mapping matrix is updated according to formula (8), and the first mapping matrix is updated according to formula (10).

[0116] In the above scheme, the known intrusion category autoencoder and the unknown intrusion category autoencoder are alternately updated during training, and the mapping logic of the two is adapted to each other through back propagation, and finally converges to a consistent optimal semantic space.

[0117] As a preferred embodiment, step S2, constructing a zero-shot learning model, the zero-shot learning model establishes the mapping between the feature space and the semantic space by the intrusion scene knowledge graph based on the word vector, and is executed by steps S21 to S26:

[0118] S21, establishing a label set to form a label space; the labels in the label set are bound with the intrusion categories;

[0119] S22, establishing an intrusion scene knowledge graph with word vectors as node attributes according to the general knowledge graph and the label set to form a semantic space;

[0120] S23, constructing a feature extraction module for extracting attack features of input data to form a feature space;

[0121] S24, according to the intrusion scene knowledge graph, a graph convolutional neural network is established to map the feature space to the semantic space and output a semantic category weight matrix; the semantic category weight matrix is the semantic association strength of input data and each intrusion category;

[0122] S25, a classifier is constructed to output a classification result of the intrusion category according to the semantic category weight matrix;

[0123] S26, according to the label set, the intrusion scene knowledge graph, the feature extraction module, the graph convolutional neural network and the classifier, a zero-shot learning model is obtained.

[0124] In the embodiment of the application, the zero-shot learning model is composed of a feature space, a semantic space and a label space, and the zero-shot learning model trains the classifier through known intrusion category samples , wherein X is the feature space, Y is the intrusion category, so as to realize the process of predicting unknown intrusion category samples and performing category identification.

[0125] As a preferred embodiment, the label set in step S21 includes known intrusion category labels and unknown intrusion category labels, and the output result of the classifier is to match the input data with the labels to complete the identification of the intrusion category. By binding the labels with the intrusion categories, the embedding of the label space and the semantic space can be realized.

[0126] In some preferred embodiments, the word vector is selected based on the features of each intrusion category. Exemplarily, network protocols or service names are represented as a vector, such as HTTP, SSH and FTP, for identifying specific protocols or services in communication. Each type of attack is represented as a vector, such as DDOS, SQL injection and malware, for identifying and classifying different types of attacks. IP addresses, port numbers and hostnames are represented as vectors for detecting abnormal behavior related to specific IPs, ports or hosts. Network traffic features are represented as vectors, such as packet size, frequency and direction, for identifying abnormal traffic. Keywords and phrases are represented as vectors, such as "login failure", "excessive password attempts" and "unauthorized access", for identifying log records or communication content related to security incidents.

[0127] It should be noted that the intrusion scene knowledge graph is constructed for the intrusion scene, and the semantic space of the zero-shot learning model can be composed of the semantic space of the intrusion scene knowledge graph and the word vector, realizing the computability and association of semantics.

[0128] It should be further pointed out that the feature extraction module in step S23 is pre-configured with an extraction logic for the intrusion category features, and in some preferred embodiments, the feature extraction module is a pre-trained feature extraction network; in other preferred embodiments, the feature extraction module is trained together with the zero-shot learning module.

[0129] The graph convolutional neural network can utilize the node association relationship of the knowledge graph, aggregate neighbor node information, and learn data features and graph semantics in association, thereby avoiding mapping deviation caused by ignoring the association between semantics.

[0130] In the above scheme, the unknown attack is effectively detected through the association between the semantic space and the feature space; further, in the construction of the semantic space, the intrusion scene knowledge graph and the graph convolutional neural network are used to enable the model to understand the semantic nature of the intrusion behavior, thereby improving the generalization ability for attack variants.

[0131] Further, preferably, step S22 comprises: establishing an intrusion scene knowledge graph with word vectors as node attributes according to the general knowledge graph and the label set, and forming a semantic space, comprising:

[0132] According to the general semantic classification knowledge graph and the label set, defining known intrusion category nodes, unknown intrusion category nodes and associated element nodes to constitute a first knowledge graph subset;

[0133] Obtaining word vectors of the intrusion categories, and embedding the word vectors as node attributes into the first knowledge graph subset to obtain a second knowledge graph subset;

[0134] Using the general scene association knowledge graph, obtaining an intrusion scene knowledge graph according to the first knowledge graph subset and the second knowledge graph subset to form a semantic space.

[0135] In the embodiment of the application, in order to effectively utilize the explicit relationship between all concepts, a knowledge graph is introduced in the construction of the semantic relationship module, and all concepts are divided into Y+Z+O, wherein Y is an attack mode of a known intrusion category, Z is an attack mode of an unknown intrusion category, and O is an attack trace and an impact. Then, an equal number of known intrusion category nodes, unknown intrusion category nodes and associated element nodes are used to construct an intrusion scene knowledge graph corresponding to these concepts.

[0136] Preferably, the general semantic classification knowledge graph uses WordNet, which is a widely used English lexical semantic network. Through WordNet, a minimum common super-set can be extracted for all invisible classes and visible classes, then the path length is used in the super-set to calculate the similarity between each class and other classes, and finally these similarities are used to construct a semantic vector with hierarchical characteristics.

[0137] Preferably, the general scenario association knowledge graph adopts ConceptNet, which can connect words and phrases of natural language edges.

[0138] In the above scheme, the first knowledge graph subset defines nodes based on semantic classification knowledge graph, which can ensure the comprehensive coverage of intrusion category nodes and associated elements, and provides a structured basis for semantic space construction. The second knowledge graph subset embeds word vectors as node attributes, which can accurately measure the semantic association between nodes. Further, the fusion of the general scenario association knowledge graph can make the intrusion scenario knowledge graph not only contain general semantics, but also integrate the exclusive association logic of the intrusion detection scenario, avoiding the disconnection between general knowledge and specific scenarios.

[0139] Preferably, step S24, according to the intrusion scenario knowledge graph, establishes a graph convolutional neural network to map the feature space to the semantic space and outputs a semantic category weight matrix, comprising:

[0140] Obtain an intrusion scenario knowledge graph, and establish a graph convolutional neural network, wherein the nodes of the graph convolutional neural network correspond to the nodes of the intrusion scenario knowledge graph;

[0141] Connect the output of the feature extraction module to the graph convolutional neural network, so that the graph convolutional neural network fuses neighbor features into nodes based on the output of the feature extraction module;

[0142] The graph convolutional neural network outputs a semantic category weight matrix through several layers of iteration; the elements in the semantic category weight matrix represent the semantic association between the features of the input data and the nodes in the intrusion scenario knowledge graph.

[0143] The nodes of the graph convolutional neural network correspond one-to-one to the nodes of the intrusion scenario knowledge graph, so that the network structure naturally adapts to the topological structure of the semantic space. The graph convolutional neural network can enable the zero-shot learning model to capture the multi-dimensional association between features and semantics through neighbor node features; for the iteration of an L-order graph convolutional neural network, each layer l is a feature matrix As input, generate a feature matrix ; The final output semantic category weight matrix converts the association between features and semantic nodes into specific numerical values, providing clear and interpretable decision basis for subsequent classifiers.

[0144] In some preferred embodiments, in the graph convolutional neural network, for one convolution operation of all nodes, the propagation rule of the graph convolutional neural network is represented as:

[0145] (11);

[0146] wherein, , is a feature matrix output by the feature extraction module; is a preset training weight matrix of the previous layer; A is a relation adjacency matrix of the intrusion scene knowledge graph; D is a degree matrix of A; is a nonlinear activation function. In some preferred embodiments, the nonlinear activation function adopts Leaky ReLU.

[0147] In the above scheme, the neighboring nodes of each node in the knowledge graph are weighted and summed, and then multiplied by the parameter matrix to obtain the features of the nodes of a new layer. Through the last layer of network, the semantic category weight matrix of all categories can be output.

[0148] As a preferred implementation, the classifier adopts a direct attribute prediction model, and the classifier includes a plurality of sub-classifiers, the number of the sub-classifiers being consistent with the number of semantic attributes, and the sub-classifiers are used to calculate the association probability of the semantic attributes and the labels. The classifier obtains the target label according to the association probability calculated by each sub-classifier.

[0149] In the embodiment of the application, a classifier is learned for attributes of various known categories by using a direct attribute prediction model (DAP), and then the correlation probability corresponding to each attribute is calculated. In the prediction classification stage, the category with the maximum correlation probability is taken as the final prediction result.

[0150] Please refer to Figure 2 , Figure 2 is a structural schematic diagram of the direct attribute prediction model. In the diagram is a label data set of known intrusion categories, is a label data set of unknown intrusion categories, ; is a semantic attribute matrix; is a feature matrix of input data.

[0151] Each semantic attribute The probability relationship between each semantic attribute and the label layer can be derived by the Bayes formula, and the following equation is obtained:

[0152] (12);

[0153] Further, the posterior probability of each unknown intrusion category is expressed as:

[0154] (13);

[0155] wherein, is a semantic attribute of an unknown intrusion category, The attribute probability obtained by the DAP for the input data x; The prior probability of the unknown intrusion category.

[0156] For a test sample x, there is a classifier The label type of the unknown intrusion category can be predicted, and the classification basis of the sample x is obtained in combination with the maximum a posteriori estimation (MAP):

[0157] (14).

[0158] In the above scheme, by using a direct attribute prediction model for classification prediction, test data can be processed in real time, and due to the data structure characteristics, all test data does not need to be obtained at one time, which makes the method less difficult to implement and has a large follow-up development space.

[0159] As a preferred embodiment, step S3, training the zero-shot learning model using the training sample set, learning the mapping logic of the known intrusion category features and the word vector, and migrating the mapping logic to the unknown intrusion category semantic space, comprises:

[0160] The training sample set is input into the constructed zero-shot learning model, and based on the intrusion scene knowledge graph, the mapping logic of the known intrusion category features and the word vector is learned, and the semantic association of the nodes in the intrusion scene knowledge graph is obtained;

[0161] According to the semantic association, the mapping logic is migrated to the unknown intrusion category, so that the trained zero-shot learning model can perform semantic space mapping on the input data, and realize the classification of the intrusion category.

[0162] It should be noted that the training sample set includes data under the known intrusion category, based on the architecture of the zero-shot learning model given in the embodiment of the application, after the training sample set is input into the model, the semantic association information in the semantic space can be enriched, and the trained model forms a complete mapping logic covering the known and unknown categories. The input data can be mapped to the semantic space through the same framework, ensuring the consistency of the classification process, and providing a unified and reliable logical basis for subsequent classification output based on the semantic category weight matrix.

[0163] As a preferred embodiment, before step S4 is performed, the intrusion detection method based on zero-shot learning further comprises:

[0164] Migrating the trained zero-shot learning model to a cloud environment to test the unknown intrusion category detection capability of the zero-shot learning model;

[0165] Updating the parameters of the zero-shot learning model according to the test result.

[0166] Through the model training process of step S3, the optimal model under the training sample set can be obtained, and in the embodiment of the application, the model is further migrated to the cloud environment to test the actual network intrusion detection effect. On the one hand, the difference between the training environment and the actual cloud environment can be exposed, and the model can be adapted to the characteristics of the cloud environment through parameter updating; on the other hand, the undetected and false alarm problems of the model in the actual scene for new attacks can be accurately found, and the practical precision of unknown class detection can be improved through parameter adjustment.

[0167] Further, preferably, the parameter updating of the zero-shot learning model according to the test result comprises:

[0168] screening the network attack of the unknown intrusion type from the test result, and obtaining the original data and attack link of the network attack through traceability analysis;

[0169] updating the training sample set according to the original data and the attack link, so as to perform incremental training on the zero-shot learning model.

[0170] It should be noted that the zero-shot learning model provided in the embodiment of the application supports incremental training. Exemplarily, the number and architecture of the nodes of the intrusion network knowledge graph are adjustable, and the incremental training of the model can be realized based on the test data, or even the data in the actual application of step S4.

[0171] In the embodiment of the application, the original data and attack link of the unknown type of network attack form that cannot be normally detected are reserved through traceability analysis based on the huge attack data in the cloud network environment, the training set is further expanded, and the precision and detection rate of the model are improved.

[0172] By using the intrusion detection method based on zero-shot learning provided in the embodiment of the application, the mapping between the feature space and the semantic space is established through the intrusion scene knowledge graph based on the word vector, the semantic commonality of the attack can be captured, the model does not need to be trained separately for each attack feature, the generalization of the model is improved, and based on the semantic mapping rule of the known attack, the new attack can be directly detected, the detection precision for unknown attack categories can be improved, and different types and changes of intrusion behaviors can be adapted.

[0173] The embodiment of the application provides an intrusion detection system based on zero-shot learning. Please refer to Figure 3 The intrusion detection system based on zero-shot learning comprises a training sample set generation module 11, a model construction module 12, a model training module 13 and a model application module 14, wherein:

[0174] The training sample set generation module 11 is configured to collect multi-source original data according to known intrusion categories, extract known intrusion category features from the multi-source original data, and generate a training sample set;

[0175] The model construction module 12 is configured to construct a zero-shot learning model, which establishes a mapping between a feature space and a semantic space based on a word vector-based intrusion scene knowledge graph.

[0176] The model training module 13 is configured to train the zero-shot learning model using the training sample set, learn a mapping logic between the known intrusion category features and the word vectors, and migrate the mapping logic to an unknown intrusion category semantic space.

[0177] The model application module 14 is configured to input real-time data into the trained zero-shot learning model to obtain an intrusion category of the real-time data.

[0178] As a preferred embodiment, the multi-source original data includes network traffic data, log data, configuration data, authentication data, abnormal behavior data, and system performance data.

[0179] As a preferred embodiment, the training sample set generation module 11 is configured to:

[0180] collect multi-source original data according to known intrusion categories;

[0181] extract features associated with known intrusion categories from the multi-source original data, convert the features into binary vectors, and form an initial feature set;

[0182] calculate the correlation between each feature in the initial feature set by a Pearson correlation coefficient, perform feature fusion according to the correlation, and obtain known intrusion category features.

[0183] As a preferred embodiment, the input of the coupled autoencoder is a first feature matrix of known intrusion categories, a first semantic attribute matrix of known intrusion categories, and a second feature matrix of unknown intrusion categories.

[0184] According to the first feature matrix and the first semantic attribute matrix, a first mapping matrix of known intrusion categories is obtained through a known intrusion category autoencoder.

[0185] According to the first mapping matrix, a second mapping matrix of unknown intrusion categories is initialized.

[0186] According to the second mapping matrix and the second feature matrix, a second semantic attribute matrix of unknown intrusion categories is obtained through an unknown intrusion category autoencoder.

[0187] The first mapping matrix, the second mapping matrix and the second semantic attribute matrix are updated until a zero-shot learning model converges.

[0188] As a preferred implementation, the model construction module 12 comprises:

[0189] A label set establishing unit is configured to establish a label set to form a label space; labels in the label set are bound to intrusion categories;

[0190] An intrusion scene knowledge graph establishing unit is configured to establish an intrusion scene knowledge graph with word vectors as node attributes according to a general knowledge graph and the label set to form a semantic space;

[0191] An attack feature extraction unit is configured to construct a feature extraction module for extracting attack features of input data to form a feature space;

[0192] A graph convolutional neural network establishing unit is configured to establish a graph convolutional neural network according to the intrusion scene knowledge graph to map the feature space to the semantic space and output a semantic category weight matrix; the semantic category weight matrix is a semantic association strength between input data and each intrusion category;

[0193] A classifier construction unit is configured to construct a classifier to output a classification result of an intrusion category according to the semantic category weight matrix;

[0194] A model integration unit is configured to obtain a zero-shot learning model according to the label set, the intrusion scene knowledge graph, the feature extraction module, the graph convolutional neural network and the classifier.

[0195] Further, preferably, the intrusion scene knowledge graph establishing unit is specifically configured to:

[0196] According to a general semantic classification knowledge graph and the label set, define known intrusion category nodes, unknown intrusion category nodes and associated element nodes to constitute a first knowledge graph subset;

[0197] Obtain word vectors of intrusion categories, and embed the word vectors as node attributes into the first knowledge graph subset to obtain a second knowledge graph subset;

[0198] According to the first knowledge graph subset and the second knowledge graph subset, obtain an intrusion scene knowledge graph by using a general scene association knowledge graph to form a semantic space.

[0199] Preferably, the graph convolutional neural network establishing unit is specifically configured to:

[0200] An intrusion scene knowledge graph is acquired, and a graph convolutional neural network is established, nodes of the graph convolutional neural network corresponding to nodes of the intrusion scene knowledge graph;

[0201] The output of the feature extraction module is connected to the graph convolutional neural network, so that the graph convolutional neural network fuses neighbor features into nodes based on the output of the feature extraction module;

[0202] The graph convolutional neural network outputs a semantic category weight matrix through several layers of iteration; elements in the semantic category weight matrix represent semantic relevance of features of input data and nodes in the intrusion scene knowledge graph.

[0203] Preferably, the classifier adopts a direct attribute prediction model, and the classifier includes a plurality of sub-classifiers, the number of the sub-classifiers being consistent with the number of semantic attributes, and the sub-classifiers are used to calculate association probabilities of semantic attributes and labels, and the classifier obtains a target label according to the association probabilities calculated by the sub-classifiers.

[0204] As a preferred embodiment, the model training module 13 is configured to:

[0205] The training sample set is input into the constructed zero-shot learning model, the mapping logic of the known intrusion category features and the word vectors is learned based on the intrusion scene knowledge graph, and semantic relevance of nodes in the intrusion scene knowledge graph is obtained;

[0206] According to the semantic relevance, the mapping logic is migrated to unknown intrusion categories, so that the trained zero-shot learning model can perform semantic space mapping on input data, and realize classification of intrusion categories.

[0207] As a preferred embodiment, the intrusion detection system based on zero-shot learning further includes a model test updating module, configured to:

[0208] The trained zero-shot learning model is migrated to a cloud environment to test the unknown intrusion category detection capability of the zero-shot learning model;

[0209] According to the test result, the parameters of the zero-shot learning model are updated.

[0210] Further, preferably, the updating of the parameters of the zero-shot learning model according to the test result includes:

[0211] From the test result, a network attack of an undetected unknown intrusion type is screened, and original data and attack links of the network attack are obtained through traceability analysis;

[0212] According to the original data and the attack link, a training sample set is updated to perform incremental training on the zero-shot learning model.

[0213] The zero-shot learning-based intrusion detection system provided by the embodiment of the present application can capture the semantic commonality of attacks by establishing the mapping of the feature space and the semantic space based on the word vector-based intrusion scene knowledge graph, without the need to train a model for each attack feature, thereby improving the generalization of the model. Through the joint learning of the known intrusion class autoencoder and the unknown intrusion class autoencoder, the feature semantic mapping of the known intrusion class and the mapping of the unknown class can form mutual constraints, avoiding the disconnection between the known class learning and the unknown class learning, alleviating the sample divergence problem, and improving the reliability of zero-shot transfer. Moreover, based on the semantic mapping rule of known attacks, new attacks can be directly detected, different types and changes of intrusion behaviors can be adapted, and the detection accuracy for unknown attack classes can be improved.

[0214] Please refer to Figure 4 , Figure 4 is a structural block diagram of a zero-shot learning-based intrusion detection device provided by the embodiment of the present application. The zero-shot learning-based intrusion detection device includes a processor 31, a memory 32, and a computer program stored in the memory 32 and executable on the processor 31. The processor 31 implements the steps in each of the above zero-shot learning-based intrusion detection method embodiments when executing the computer program, such as steps S1-S4.

[0215] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 32 and executed by the processor 31 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the zero-shot learning-based intrusion detection device.

[0216] The zero-shot learning-based intrusion detection device can include, but is not limited to, a processor 31 and a memory 32. Those skilled in the art can understand that the schematic diagram is only an example of the zero-shot learning-based intrusion detection device and does not limit the zero-shot learning-based intrusion detection device, which can include more or fewer components than the diagram, or combine certain components, or different components, for example, the zero-shot learning-based intrusion detection device can also include an input / output device, a network access device, a bus, etc.

[0217] The processor 31 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, or the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The processor 31 is a control center of the zero-shot learning based intrusion detection device, and connects various parts of the zero-shot learning based intrusion detection device through various interfaces and lines.

[0218] The memory 32 can be used to store computer programs and / or modules. The processor 31 realizes various functions of the zero-shot learning based intrusion detection device by running or executing the computer programs and / or modules stored in the memory 32, and calling data stored in the memory 32. The memory 32 can mainly include a program storage area and a data storage area. The program storage area can store an operating system, at least one application program required for a function (such as a sound playing function, an image playing function, etc.), and the like. The data storage area can store data created according to use of the mobile phone (such as audio data, a phone book, etc.), and the like. In addition, the memory 32 can include a high-speed random access memory, and can also include a nonvolatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory device.

[0219] The module / unit of the intrusion detection device integrated based on the zero sample learning can be stored in a computer readable storage medium if it is realized in the form of a software function unit and sold or used as an independent product. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware. The computer program can be stored in a computer readable storage medium. When the computer program is executed by the processor 31, the steps of the above-mentioned various method embodiments can be realized. The computer program includes computer program code, which can be in the form of source code, object code, an executable file, or some intermediate form, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electric carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0220] The above is the preferred embodiment of the present application. It should be pointed out that, for those skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, which are also considered within the scope of protection of the present application.

Claims

1. A zero-shot learning based intrusion detection method, characterized in that, The application comprises the following steps: According to the known intrusion category, collect multi-source original data, extract the known intrusion category features from the multi-source original data, and generate a training sample set; A zero-shot learning model is constructed, which establishes a mapping between the feature space and the semantic space based on the word vector intrusion scene knowledge graph; The hidden layer of the zero-shot learning model is provided with a coupled autoencoder; the coupled autoencoder comprises a known intrusion category autoencoder and an unknown intrusion category autoencoder learned jointly; The training sample set is used to train the zero-shot learning model, learn the mapping logic of the known intrusion category features and the word vector, and migrate the mapping logic to the unknown intrusion category semantic space; Real-time data is input into the trained zero-shot learning model to obtain the intrusion category of the real-time data; The zero-shot learning model establishes a mapping between the feature space and the semantic space based on the word vector intrusion scene knowledge graph, which comprises the following steps: A label set is established to form a label space; the labels in the label set are bound to the intrusion category; According to the general knowledge graph and the label set, an intrusion scene knowledge graph with word vectors as node attributes is established to form a semantic space; A feature extraction module is constructed to extract attack features of input data to form a feature space; According to the intrusion scene knowledge graph, a graph convolutional neural network is established to map the feature space to the semantic space and output a semantic category weight matrix; the semantic category weight matrix is the semantic association strength between the input data and each intrusion category; A classifier is constructed to output the classification result of the intrusion category according to the semantic category weight matrix; According to the label set, the intrusion scene knowledge graph, the feature extraction module, the graph convolutional neural network and the classifier, a zero-shot learning model is obtained; The training sample set is input into the constructed zero-shot learning model, the mapping logic of the known intrusion category features and the word vector is learned based on the intrusion scene knowledge graph, and the semantic association of the nodes in the intrusion scene knowledge graph is obtained; According to the semantic association, the mapping logic is migrated to the unknown intrusion category, so that the trained zero-shot learning model can map the input data in the semantic space and realize the classification of the intrusion category. The multi-source original data comprises network traffic data, log data, configuration data, identity authentication data, abnormal behavior data and system performance data.

2. The zero-shot learning based intrusion detection method of claim 1, wherein, According to the known intrusion category, collect multi-source original data, extract the known intrusion category features from the multi-source original data, and generate a training sample set, which comprises the following steps:

3. The zero-shot learning based intrusion detection method of claim 1, wherein, According to the known intrusion category, collect multi-source original data; From the multi-source original data, extract features associated with the known intrusion category, convert the features into binary vectors to form an initial feature set; ​ Calculate the correlation between each feature in the initial feature set by a Pearson correlation coefficient, and perform feature fusion according to the correlation to obtain a known intrusion class feature.

4. The zero-shot learning based intrusion detection method of claim 1, wherein, The input of the coupled autoencoder is a first feature matrix of a known intrusion class, a first semantic attribute matrix of the known intrusion class, and a second feature matrix of an unknown intrusion class; According to the first feature matrix and the first semantic attribute matrix, a first mapping matrix of the known intrusion class is obtained through a known intrusion class autoencoder; According to the first mapping matrix, a second mapping matrix of the unknown intrusion class is initialized; According to the second mapping matrix and the second feature matrix, a second semantic attribute matrix of the unknown intrusion class is obtained through an unknown intrusion class autoencoder; The first mapping matrix, the second mapping matrix, and the second semantic attribute matrix are updated until the zero-shot learning model converges.

5. The zero-shot learning based intrusion detection method of claim 1, wherein, According to the general knowledge graph and the label set, an intrusion scene knowledge graph with word vectors as node attributes is established to form a semantic space, including: According to the general semantic classification knowledge graph and the label set, a known intrusion class node, an unknown intrusion class node, and an associated element node are defined to constitute a first knowledge graph subset; Obtain the word vector of the intrusion class, and embed the word vector as a node attribute into the first knowledge graph subset to obtain a second knowledge graph subset; According to the first knowledge graph subset and the second knowledge graph subset, an intrusion scene knowledge graph is obtained by using a general scene association knowledge graph to form a semantic space.

6. The zero-shot learning based intrusion detection method of claim 1, wherein, According to the intrusion scene knowledge graph, a graph convolutional neural network is established to map the feature space to the semantic space and output a semantic class weight matrix, including: Obtain the intrusion scene knowledge graph, and establish a graph convolutional neural network, the nodes of the graph convolutional neural network correspond to the nodes of the intrusion scene knowledge graph; Connect the output of the feature extraction module to the graph convolutional neural network, so that the graph convolutional neural network fuses neighbor features into the nodes based on the output of the feature extraction module; The graph convolutional neural network outputs a semantic class weight matrix through several layers of iteration; the elements in the semantic class weight matrix represent the semantic association between the features of the input data and the nodes in the intrusion scene knowledge graph.

7. The zero-shot learning based intrusion detection method of claim 1, wherein, The classifier uses a direct attribute prediction model, the classifier includes a plurality of sub-classifiers, the number of sub-classifiers is consistent with the number of semantic attributes, and the sub-classifiers are used to calculate the association probability of the calculated semantic attribute and the label, and the classifier obtains a target label according to the association probability calculated by each sub-classifier.

8. The zero-shot learning based intrusion detection method of claim 1, wherein, Before the real-time data is input into the trained zero-shot learning model to obtain the intrusion class of the real-time data, the zero-shot learning-based intrusion detection method further includes: Migrate the trained zero-shot learning model to a cloud environment to test the unknown intrusion class detection capability of the zero-shot learning model; Update the parameters of the zero-shot learning model according to the test result.

9. The zero-shot learning based intrusion detection method of claim 8, wherein, The parameter updating of the zero-shot learning model according to the test result includes: Screening a network attack of an unknown intrusion type not detected from a test result, obtaining original data and an attack link of the network attack through traceability analysis; According to the original data and the attack link, updating a training sample set to perform incremental training on the zero-shot learning model.

10. An intrusion detection system based on zero-shot learning, characterized in that, The zero-shot learning-based intrusion detection system comprises: A training sample set generation module is configured to collect multi-source original data according to known intrusion categories, extract known intrusion category features from the multi-source original data, and generate a training sample set; A model construction module is configured to construct a zero-shot learning model, wherein the zero-shot learning model establishes a mapping between a feature space and a semantic space based on a word vector-based intrusion scene knowledge graph; a hidden layer of the zero-shot learning model is provided with a coupled autoencoder; the coupled autoencoder comprises a known intrusion category autoencoder and an unknown intrusion category autoencoder learned jointly; A model training module is configured to train the zero-shot learning model using the training sample set, learn a mapping logic between the known intrusion category features and the word vector, and migrate the mapping logic to an unknown intrusion category semantic space; A model application module is configured to input real-time data into the trained zero-shot learning model to obtain an intrusion category of the real-time data.

11. An intrusion detection device based on zero-shot learning, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the zero-shot learning-based intrusion detection method according to any one of claims 1 to 9 when the computer program is running.

12. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein the computer program controls a device where the computer readable storage medium is located to perform the zero-shot learning-based intrusion detection method according to any one of claims 1 to 9 when the computer program is running.

Images