Multi-source heterogeneous feature fusion intrusion detection method and device based on bidirectional interaction

Abstract

The invention discloses a multisource heterogeneous feature fusion intrusion detection method and device based on bidirectional interaction, and the method comprises the steps: firstly constructing a dual-channel feature extraction and enhancement architecture to respectively process heterogeneous data sources, and then achieving the deep information interaction through a cross-modal bidirectional attention mechanism, and finally, designing a three-feature fusion strategy to form a high-dimensional decision space. The multi-source information collaborative interaction advantage is realized, and the detection robustness in a complex attack scene is improved.

Description

Technical Field

[0001] This invention belongs to the technical field of network security, specifically relating to an intrusion detection method and device based on bidirectional interaction and multi-source heterogeneous feature fusion. Background Technology

[0002] As cyberattacks become increasingly complex, traditional intrusion detection systems (IDS) face multiple challenges, including high-dimensional feature processing, identification of unknown attacks, and adaptation to dynamic environments. Deep learning, with its automatic feature learning and pattern recognition capabilities, has become a key technology for improving detection accuracy and robustness, demonstrating significant advantages, especially when processing large-scale network traffic data. In recent years, research has focused on three main areas: feature engineering optimization, dynamic update mechanisms, and enhanced interpretability, driving the continuous development of IDS towards intelligence and adaptability.

[0003] In terms of innovation in feature representation and selection mechanisms, feature engineering optimization significantly improves the ability to identify high-dimensional traffic features by integrating statistical analysis and neural networks. Thakkar et al. proposed a feature selection method based on statistical importance fusion, which constructs a comprehensive feature ranking index by fusing standard deviation and mean-median difference, effectively screening feature subsets with high discriminative power and strong bias, significantly improving the model's generalization ability on high-dimensional intrusion data, and achieving higher detection accuracy and lower false alarm rate compared to traditional feature selection methods. Andresini et al. designed the CLAIRE model, which innovatively transforms network flow into a 2D image structure containing spatial neighborhood information: first, the feature dimension is compressed through an autoencoder, then a pixel grid representation is constructed by combining K-means cluster center search, and finally, a CNN is used to capture the spatial dependencies between features. This geometric representation significantly enhances the robustness of identifying complex traffic patterns and outperforms traditional 1D vector processing methods in multiple tests. Feng et al. proposed the NSIBF framework, combining variational autoencoders and Bayesian filtering to construct a noise-resistant detection system. First, a state-space model is fitted using a neural network to quantify process noise. Then, the hidden state distribution is tracked in real-time using an unscented Kalman filter. Finally, anomalies are identified through probability estimation. This framework demonstrates excellent robustness in industrial IoT scenarios with strong noise interference, significantly improving the stability of temporal anomaly identification compared to residual detection methods.

[0004] Regarding continuous learning mechanisms in dynamic environments, this study addresses the dynamic evolution of attack patterns by introducing incremental updates and knowledge distillation to achieve sustainable model optimization. Yang et al. proposed a lightweight open-set intrusion detection framework for the Industrial Internet of Things (IIoT), employing a three-stage dynamic detection mechanism to solve the problem of identifying unknown attacks in resource-constrained environments. This method first uses a variational autoencoder (VAE) to extract known attack features and build a classification model. Then, based on the reconstruction error distribution, extreme value theory (EVT) is used to model and distinguish unknown attacks. Finally, knowledge distillation is used to compress the teacher model into a student model for dynamic updates. This framework significantly reduces computational overhead and storage requirements during model updates while maintaining the ability to continuously learn from new attacks. Its core innovation lies in combining knowledge distillation with a lightweight architecture, enabling the model to maintain high detection accuracy while improving deployment efficiency. Li et al., addressing the limitations of traditional ensemble learning models in terms of attack sensitivity differences and historical knowledge reuse, proposed a sustainable ensemble learning model. This method innovatively constructs a multi-class regression model, using the probability output and classification confidence of individual classifiers as training data to achieve adaptive weight allocation for different attack types. During the model update phase, historical model decisions are incorporated into the new model training process through parameter passing, forming an incremental learning mechanism. This strategy effectively suppresses performance fluctuations during model updates and improves the system's stability and detection accuracy under dynamic attack environments.

[0005] To enhance interpretability and decision transparency, attention mechanisms have been used to improve decision traceability in order to overcome the "black box" problem of deep learning. Andresini et al. developed the ROULETE model, which converts network traffic features into grayscale images through convolutional neural networks to achieve spatial association learning. It also combines a pixel-level attention mechanism to generate feature heatmaps. This mechanism uses 1×1 convolutional layers to adaptively weight input features, and then compresses the multi-channel output into a single-channel heatmap through an averaging layer, which intuitively identifies key traffic features. At the same time, the model introduces a multi-output architecture. The main branch handles multi-class attack identification tasks, while the auxiliary branch performs normal / abnormal binary classification tasks. Knowledge transfer is achieved through a joint loss function, which effectively optimizes attack classification performance, significantly improves detection stability and decision interpretability, and heatmap analysis reveals the core feature dependencies of different types of attacks (such as the surge in connection numbers in DoS attacks).

[0006] However, while Thakkar's statistical feature fusion and Andresini's 2D imaging method optimize single-modal feature processing, they fail to establish a unified embedding space for network traffic and physical signals. The two types of data have significantly different scales (e.g., discrete protocol fields versus continuous sensor readings). Traditional methods rely on manual design or single-modal transformation, lacking an automated cross-domain mapping mechanism, leading to ineffective feature alignment. For example, the CLAIRE model only converts network flow into an image, ignoring the time-series characteristics of physical signals. Meanwhile, while Feng's Bayesian filtering framework can handle temporal anomalies, its state-space model only models single-modal time series, failing to capture the nonlinear causal relationship between network attack events and physical device states. Existing methods, such as Yang's dynamic detection, focus on identifying single-modal unknown attacks, lacking a bidirectional cross-modal attention mechanism, making it difficult to analyze dynamic chain reactions like "malicious command injection → traffic anomaly → temperature surge." Furthermore, Li's ensemble learning model improves detection stability through weight allocation, but feature fusion still relies on traditional concatenation or weighted averaging. Such methods cannot simultaneously preserve modality specificity (such as the burstiness of port scans) and collaborative enhancement information (such as the spatiotemporal coupling of network packet surges and pressure fluctuations), leading to an increased false detection rate for multi-stage combined attacks. The fundamental reason is that the fusion process does not construct a three-level decision space of "original-interaction-summation," which weakens the recognizability of complex attack patterns.

[0007] Given the characteristics of existing technologies, it is urgent to construct a unified representation foundation for heterogeneous data, establish deep bidirectional cross-modal association, and innovate a three-feature fusion decision-making mechanism. Summary of the Invention

[0008] The main objective of this invention is to overcome the shortcomings and deficiencies of the prior art and provide a method and device for intrusion detection based on bidirectional interaction and multi-source heterogeneous feature fusion. First, a dual-channel feature extraction and enhancement architecture is constructed to process heterogeneous data sources respectively. Second, deep information interaction is achieved through a cross-modal bidirectional attention mechanism. Finally, a three-feature fusion strategy is designed to form a high-dimensional decision space, thereby realizing the synergistic effect of multi-source information and improving the detection robustness in complex attack scenarios.

[0009] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides an intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion, comprising the following steps: S1. Utilize a dual-channel feature extraction and enhancement architecture to process heterogeneous data sources, extract and enhance heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; S2. Based on the cross-modal bidirectional attention mechanism, the enhanced heterogeneous data feature representation is subjected to modal interaction in stages to obtain cross-modal associated physical enhancement features and network enhancement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other; S3. Concatenate the physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress the features of the multi-dimensional fusion vector and output the decision through the classification head to obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration optimization.

[0010] As a preferred technical solution, step S1 includes: Network traffic and physical signals are collected from heterogeneous information sources. Network traffic feature matrices and physical signal feature matrices are constructed based on network traffic and physical signals, respectively. Nonlinear spatial transformation is performed to obtain heterogeneous features. The heterogeneous features are mapped to a unified 128-dimensional embedding space through a fully connected layer to obtain input features. Depthwise separable convolutions are used to process the input features separately, and output physical signal features and network signal features separately. The physical signal features and network signal features are added to the learnable location code respectively. The learnable location code is automatically extended through a broadcast mechanism. The summation result is processed using a Dropout layer to obtain an enhanced heterogeneous feature representation.

[0011] As a preferred technical solution, the method of using depthwise separable convolution to process the input features separately is as follows: The input features are expanded in dimensionality using an unsqueeze operation, and then grouped using convolutional kernels to capture local temporal patterns, as shown in the following equation: ; Where U represents the local temporal pattern, H represents the input feature, and K represents the input feature. d For convolution kernel; GELU is used to activate and enhance the nonlinearity of local time-series modes, as shown in the following equation: ; In the point convolution stage, a convolution kernel is used. By fusing cross-channel information, a learnable parameter matrix is ​​generated: ; Compress the feature dimension using adaptive max pooling. The dimension is reduced to B×128 by the squeeze operation to obtain the key spatiotemporal vector.

[0012] As a preferred technical solution, step S2 includes a first stage, specifically: Using the enhanced physical signal features as the query vector and the enhanced network signal features as the key-value pairs, the physical attention weights are calculated as follows: ; Wherein, projection matrix , , This is the parameter matrix for independent learning in this direction; The enhanced physical signal features are segmented into multiple attention heads, and layer normalization is used to perform residual connections on the physical attention weights. This preserves the mode specificity of the physical signal and suppresses the risk of overfitting, thereby obtaining the physical enhancement features of the associated network traffic information in B×1×128 dimensions. As shown in the following formula: .

[0013] As a preferred technical solution, step S2 includes a second stage, specifically: Utilizing physical signal characteristics Using key-value pairs, the enhanced network signal features are represented as query vectors, and the network attention weights are calculated: ; Wherein, projection matrix , , This is the parameter matrix for independent learning in this direction; The enhanced network signal is segmented into multiple attention heads, and layer normalization is used to perform residual connections on the network attention weights. This preserves the network traffic mode specificity and suppresses the risk of overfitting, thereby obtaining network enhancement features with B×1×128 dimensions of associated physical signal information. As shown in the following formula: Output physical enhancement features and network reinforcement features .

[0014] As a preferred technical solution, the step of concatenating physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector and constructing a decision space includes: The physical enhancement features and network enhancement features are reduced in dimensionality by squeezing and then concatenated to obtain the summed features. The physical enhancement features, network enhancement features, and summed features are then concatenated along the feature dimensions to form a multidimensional fusion vector, which is used to construct the decision space.

[0015] As a preferred technical solution, the step of performing feature compression and decision output on the multi-dimensional fusion vector through the classification head includes: The multidimensional fused vector is mapped to a 256-dimensional space through a fully connected layer, the GELU activation function is used to enhance nonlinearity, and the Dropout layer is used to suppress overfitting to obtain 256-dimensional features. The 256-dimensional features are directly mapped to the target category space through a linear transformation layer. The output layer generates the original score of each sample in each category. After normalization by the Softmax function, the final classification probability distribution of the intrusion detection is obtained. The dimension of the target category space is determined by the number of attack types.

[0016] As a preferred technical solution, the training phase is optimized, including: The loss gradient is calculated based on the prediction results and the true labels. The network weights are updated by the AdamW optimizer. The learning rate is dynamically adjusted by the cosine annealing learning rate scheduler. Gradient clipping is performed before the optimizer is updated to stabilize the training. During training, the F1 score on the validation set is monitored. An early stopping strategy is adopted and the model parameters with the highest F1 score on the validation set are saved.

[0017] Secondly, the present invention also provides a multi-source heterogeneous feature fusion intrusion detection system based on bidirectional interaction, applied to the aforementioned multi-source heterogeneous feature fusion intrusion detection method based on bidirectional interaction, including a first processing module, a second processing module, and a task execution module; The first processing module is used to process heterogeneous data sources using a dual-channel feature extraction and enhancement architecture, extracting and enhancing heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; The second processing module is used to perform modal interaction on the enhanced heterogeneous data feature representation in stages according to the cross-modal bidirectional attention mechanism to obtain cross-modal associated physical enhancement features and network enhancement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other; The task execution module is used to concatenate physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress features and output decisions on the multi-dimensional fusion vector through a classification head, obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration and optimization.

[0018] Thirdly, the present invention provides an electronic device, the electronic device comprising: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which are executed by the at least one processor to enable the at least one processor to execute the multi-source heterogeneous feature fusion intrusion detection method based on bidirectional interaction.

[0019] Compared with the prior art, the present invention has the following advantages and beneficial effects: (1) This invention uses a dual-channel feature extraction architecture to perform nonlinear transformation and spatiotemporal enhancement on network traffic and physical signals respectively, thereby constructing a unified representation basis for heterogeneous data, solving the problem of feature structure and scale heterogeneity, and providing an aligned vector space for cross-modal interaction.

[0020] (2) This invention designs a two-stage independent learning attention mechanism, realizing bidirectional interaction between "physics → network" and "network → physics" for the first time. Through the directional projection matrix and 8-head attention calculation, it dynamically captures nonlinear correlations such as "abnormal temperature → malicious command", overcoming the limitations of unidirectional modeling in existing technologies.

[0021] (3) This invention employs a splicing strategy to fuse original modal features, interactive features, and additive features to form a high-dimensional enhanced decision space. Compared with the single-level fusion of existing technologies, this strategy fully preserves modal specificity and synergistic effects, and improves the robustness to identification of combined attacks. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0023] Figure 1 This is a flowchart of an intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to an embodiment of the present invention; Figure 2 This is a flowchart of the dual-channel feature extraction and enhancement architecture mechanism according to an embodiment of the present invention; Figure 3 This is a flowchart of the cross-modal bidirectional attention mechanism according to an embodiment of the present invention; Figure 4 This is a flowchart of the feature fusion decision optimization mechanism according to an embodiment of the present invention; Figure 5 This is a schematic diagram of the structure of the multi-source heterogeneous feature fusion intrusion detection system based on bidirectional interaction according to an embodiment of the present invention; Figure 6 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present application without creative effort are within the scope of protection of the present application.

[0025] In this application, the reference to "embodiment" means that a specific feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a mutually exclusive, independent, or alternative embodiment. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described in this application can be combined with other embodiments.

[0026] Please see Figure 1 This embodiment provides an intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion, including the following steps: S1. Utilize a dual-channel feature extraction and enhancement architecture to process heterogeneous data sources, extract and enhance heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features.

[0027] This embodiment employs a dual-channel feature extraction architecture to perform nonlinear transformations and spatiotemporal enhancements on network traffic and physical signals respectively, addressing the issue of feature structure and scale heterogeneity. It provides an aligned vector space for cross-modal interactions, primarily including the following steps: Figure 2 As shown: S11, First, analyze the network traffic feature matrix. and physical signal feature matrix Nonlinear spatial transformations are performed on each. Network traffic characteristics include IP address, port, protocol type, etc., where B is the batch size. The feature dimension refers to the physical signal characteristics, including signal characteristics such as temperature, pressure, and frequency.

[0028] Heterogeneous features are mapped to a unified 128-dimensional embedding space through independent fully connected layers: ; in and To obtain a learnable parameter matrix, the GELU activation function is used to enhance nonlinear expressive power. Subsequently, a Dropout layer is applied to suppress intramodal noise, thereby establishing a unified feature space for cross-modal interactions and obtaining 128-dimensional network traffic features. and .

[0029] S12. Use depthwise separable convolutions to process the input features separately. and ,by For example, first, the dimensions are expanded to B×128×1 using the unsqueeze operation, and then a depthwise convolution is performed: using a convolution kernel. Packet processing of input channels (number of packets equals number of input channels), capture of local timing patterns (such as port scan intervals), output: ; Subsequently, GELU activation is applied to enhance nonlinearity: ; The point convolution stage uses convolution kernels By integrating cross-channel information, the following can be generated: ; Finally, adaptive max pooling is used to compress the feature dimensions to... The dimensions are then reduced to B×128 using a squeeze operation to extract key spatiotemporal vectors. This step outputs 128-dimensional network traffic features. Characteristics of physical signals .

[0030] S13. To enhance spatiotemporal location awareness, For example, let's take single-step features. As a sequence of length 1 (its dimension is expanded to B×1×128 by unsqueeze), with learnable positional encoding The first vector Addition. The broadcast mechanism automatically expands the positional encoding to a B×1×128 dimension, enabling the features to carry spatial order information: .

[0031] A Dropout layer is applied to the summation results to randomly mask some neurons, thereby enhancing the model's robustness. Finally, the final output is a B×1×128 dimensional enhanced spatiotemporal feature. and The Dropout layer is set to a drop rate of 0.1.

[0032] S2. Based on the cross-modal bidirectional attention mechanism, the enhanced heterogeneous data feature representation is subjected to modal interaction in stages to obtain cross-modal associated physical reinforcement features and network reinforcement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other.

[0033] In step S2, this embodiment designs a two-stage independent learning attention mechanism, achieving bidirectional interaction between "physics → network" and "network → physics" for the first time. Through directional projection matrices and 8-head attention calculation, it dynamically captures nonlinear correlations such as "abnormal temperature → malicious commands," for example... Figure 3 As shown.

[0034] Specifically, the steps are as follows: S21, First Phase (Physical → Network Direction): Based on physical signal characteristics For query vectors, network features For key-value pairs, calculate attention weights: .

[0035] Where the projection matrix , , The parameter matrix is ​​learned independently in this direction, which segments the features into 8 attention heads. Layer normalization (LayerNorm) performs residual connections on this output, thereby preserving the physical signal mode specificity and suppressing the risk of overfitting. .

[0036] Therefore, we obtain the physical reinforcement features of the B×1×128 dimensional associated network traffic information. .

[0037] S22, Second Stage (Network → Physical Direction): Physical signal characteristics updated in step S21 Key-value pairs, network traffic characteristics For the query vector, calculate the attention weights: ; Where the projection matrix , , The parameter matrix, learned independently in this direction, is also divided into 8 attention heads. Layer normalization (LayerNorm) is applied to the output as a residual, thereby preserving the network traffic modality specificity and suppressing the risk of overfitting. ; Therefore, the network reinforcement features that output B×1×128-dimensional associated physical signal information .

[0038] S23. Output the acquired physical and network enhancement features, such as sensor temperature fluctuations and DDoS attack traffic peaks.

[0039] Next, this embodiment employs a splicing strategy to fuse original modality features, interaction features, and additive features to form a high-dimensional enhanced decision space, as shown in step S3. This part integrates the features output by the above modules, preserving modality specificity while fusing the correlations between modalities, thereby enabling accurate and robust intrusion detection decisions. After training and iterative optimization, the best model is selected and deployed in the network system for real-time threat perception.

[0040] S3. Concatenate the physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress the features of the multi-dimensional fusion vector and output the decision through the classification head to obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration optimization.

[0041] For a better explanation of step S3, please refer to [link / reference]. Figure 4 And the following steps: S31, First, use the squeeze operation to... and The dimension was compressed from B×1×128 to B×128. Subsequently, feature fusion was performed, concatenating three complementary types of information: network traffic modality features. Physical signal modal characteristics and additive characteristics The 384-dimensional fusion vector is formed by concatenating the vectors along the feature dimensions, and the decision space is constructed accordingly. .

[0042] What can be explained is the additive characteristic. To characterize modal synergy, this embodiment integrates three types of complementary information, which can fully preserve modal specificity and synergistic effects, and improve the robustness to identification of combinatorial attacks.

[0043] S32. After obtaining the 384-dimensional enhanced decision space, feature compression and decision output are achieved through a classification head. First, the space is mapped to 256 dimensions through a fully connected layer. The GELU activation function is applied to enhance nonlinearity, and a Dropout layer (dropout rate of 0.3) is used to suppress overfitting. Then, the processed 256-dimensional features are directly mapped to the target class space (the dimension is determined by the number of attack types) through a linear transformation layer. Finally, the output layer generates the raw scores (logits) of each sample in each class, which are normalized by the Softmax function to form the final classification probability distribution for intrusion detection.

[0044] It's worth explaining that the output layer generates a set of unnormalized raw scores (logits) for each input sample, corresponding to various predefined intrusion categories (such as normal, DoS, probe, U2R, R2L, etc.). These logits are then normalized using a softmax function, transforming them into a valid probability distribution. This distribution represents the posterior probability of the input sample belonging to each intrusion category, providing a direct basis for the final classification decision (e.g., selecting the category with the highest probability).

[0045] S33. After obtaining the classification probability distribution, the system enters the iterative optimization training phase. The loss gradient is calculated based on the prediction results and the true labels, and the network weights are updated using the AdamW optimizer. A cosine annealing learning rate scheduler is applied to dynamically adjust the learning rate, and gradient clipping is performed before the optimizer update to stabilize training. During training, the validation set F1 score is monitored, an early stopping strategy is adopted, and the model parameters with the highest validation set F1 score are saved.

[0046] Specifically, in step S33, after obtaining the predicted logits of the samples through forward propagation, the cross-entropy loss between these logits and the ground truth is calculated. Then, the backpropagation process is initiated, using an automatic grading mechanism to calculate the gradients of the loss function with respect to the learnable parameters (weights) of each layer of the neural network along the computation graph. Using these gradients, the AdamW optimizer performs a parameter update: it integrates the first moment (momentum) and second moment (adaptive learning rate) of the current gradient and historical gradients, and combines this with a decoupled weight decay strategy to calculate the update amount for each weight. This update amount is directly applied to the network parameters to minimize the loss, thereby optimizing the model's classification performance for the intrusion detection task.

[0047] The early stop strategy specifically means: if there is no improvement after 10 consecutive cycles, the process will be terminated.

[0048] Finally, the model with optimal parameters from this embodiment is deployed to a production environment (such as an industrial control system). Real-time parallel acquisition of network traffic data (including IP addresses, ports, and other features) and physical signal data (including temperature, pressure, and other features) is performed, generating batch data based on time windows or event triggers. This data is input into the model, which sequentially performs dual-channel feature extraction and enhancement, cross-modal bidirectional attention interaction to determine intrusion behavior and type, and triggers alarms and defense responses (such as log recording or firewall linkage), achieving real-time intrusion detection through multi-source information collaboration.

[0049] It should be noted that, for the sake of simplicity, the aforementioned method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously.

[0050] Based on the same idea as the bidirectional interactive multi-source heterogeneous feature fusion intrusion detection method in the above embodiments, the present invention also provides a bidirectional interactive multi-source heterogeneous feature fusion intrusion detection system, which can be used to execute the above-described bidirectional interactive multi-source heterogeneous feature fusion intrusion detection method. For ease of explanation, the structural diagram of the bidirectional interactive multi-source heterogeneous feature fusion intrusion detection system embodiment only shows the parts related to the embodiments of the present invention. Those skilled in the art will understand that the illustrated structure does not constitute a limitation on the device, and may include more or fewer components than illustrated, or combine certain components, or have different component arrangements.

[0051] Please see Figure 5 In another embodiment of this application, a multi-source heterogeneous feature fusion intrusion detection system 10 based on bidirectional interaction is provided. The system includes a first processing module 11, a second processing module 12, and a task execution module 13. The first processing module 11 is used to process heterogeneous data sources using a dual-channel feature extraction and enhancement architecture, extracting and enhancing heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; The second processing module 12 is used to perform modal interaction on the enhanced heterogeneous data feature representation in stages according to the cross-modal bidirectional attention mechanism, and to obtain cross-modal associated physical enhancement features and network enhancement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other; Task execution module 13 is used to concatenate physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, perform feature compression and decision output on the multi-dimensional fusion vector through the classification head, obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration optimization.

[0052] It should be noted that the intrusion detection system based on bidirectional interaction and the intrusion detection method based on bidirectional interaction of the present invention correspond one-to-one. The technical features and beneficial effects described in the embodiments of the intrusion detection method based on bidirectional interaction are applicable to the embodiments of the intrusion detection method based on bidirectional interaction. For details, please refer to the description in the embodiments of the method of the present invention, which will not be repeated here.

[0053] Furthermore, in the above embodiments of the multi-source heterogeneous feature fusion intrusion detection system based on bidirectional interaction, the logical division of each program module is only an example. In actual applications, the above functions can be assigned to different program modules as needed, for example, for the sake of corresponding hardware configuration requirements or the convenience of software implementation. That is, the internal structure of the multi-source heterogeneous feature fusion intrusion detection system based on bidirectional interaction is divided into different program modules to complete all or part of the functions described above.

[0054] Please see Figure 6 In one embodiment, an electronic device is provided for implementing a multi-source heterogeneous feature fusion intrusion detection method based on bidirectional interaction. The electronic device 20 may include a first processor 21, a first memory 22 and a bus, and may also include a computer program stored in the first memory 22 and executable on the first processor 21, such as a multi-source heterogeneous feature fusion intrusion detection program 23 based on bidirectional interaction.

[0055] The first memory 22 includes at least one type of readable storage medium, including flash memory, portable hard drive, multimedia card, card-type memory (e.g., SD or DX memory), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the first memory 22 can be an internal storage unit of the electronic device 20, such as the portable hard drive of the electronic device 20. In other embodiments, the first memory 22 can be an external storage device of the electronic device 20, such as a plug-in portable hard drive, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the electronic device 20. Furthermore, the first memory 22 can include both internal storage units and external storage devices of the electronic device 20. The first memory 22 can be used not only to store application software and various types of data installed on the electronic device 20, such as the code of a multi-source heterogeneous feature fusion intrusion detection program 23 based on bidirectional interaction, but also to temporarily store data that has been output or will be output.

[0056] In some embodiments, the first processor 21 may be composed of integrated circuits, such as a single packaged integrated circuit or multiple integrated circuits with the same or different functions, including combinations of one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and various control chips. The first processor 21 is the control unit of the electronic device, connecting various components of the entire electronic device through various interfaces and lines. It executes programs or modules stored in the first memory 22 and calls data stored in the first memory 22 to perform various functions of the electronic device 20 and process data.

[0057] Figure 6 Only electronic devices with components are shown; those skilled in the art will understand that... Figure 6 The structure shown does not constitute a limitation on the electronic device 20, and may include fewer or more components than shown, or combine certain components, or have different component arrangements.

[0058] The first memory 22 in the electronic device 20 stores a multi-source heterogeneous feature fusion intrusion detection program 23 based on bidirectional interaction, which is a combination of multiple instructions. When run in the first processor 21, it can achieve the following: S1. Utilize a dual-channel feature extraction and enhancement architecture to process heterogeneous data sources, extract and enhance heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; S2. Based on the cross-modal bidirectional attention mechanism, the enhanced heterogeneous data feature representation is subjected to modal interaction in stages to obtain cross-modal associated physical enhancement features and network enhancement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other; S3. Concatenate the physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress the features of the multi-dimensional fusion vector and output the decision through the classification head to obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration optimization.

[0059] Furthermore, if the modules / units integrated in the electronic device 20 are implemented as software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a portable hard drive, a magnetic disk, an optical disk, a computer memory, or a read-only memory (ROM).

[0060] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0061] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0062] The above embodiments are preferred embodiments of the present invention, but the embodiments of the present invention are not limited to the above embodiments. Any changes, modifications, substitutions, combinations, or simplifications made without departing from the spirit and principle of the present invention shall be considered equivalent substitutions and shall be included within the protection scope of the present invention.

Claims

1. A multi-source heterogeneous feature fusion intrusion detection method based on bidirectional interaction, characterized in that, Includes the following steps: S1. Utilize a dual-channel feature extraction and enhancement architecture to process heterogeneous data sources, extract and enhance heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; S2. Based on the cross-modal bidirectional attention mechanism, the enhanced heterogeneous data feature representations are subjected to modal interaction in stages to obtain cross-modal associated physical enhancement features and network enhancement features. The cross-modal bidirectional attention mechanism includes a network traffic channel and a physical signal channel, which learn independently from each other. S3. Concatenate the physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress the features of the multi-dimensional fusion vector and output the decision through the classification head to obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration optimization.

2. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 1, characterized in that, Step S1 includes: Network traffic and physical signals are collected from heterogeneous information sources. Network traffic feature matrices and physical signal feature matrices are constructed based on network traffic and physical signals, respectively. Nonlinear spatial transformation is performed to obtain heterogeneous features. The heterogeneous features are mapped to a unified 128-dimensional embedding space through a fully connected layer to obtain input features. Depthwise separable convolutions are used to process the input features separately, and output physical signal features and network signal features separately. The physical signal features and network signal features are added to the learnable location code respectively. The learnable location code is automatically extended through a broadcast mechanism. The summation result is processed using a Dropout layer to obtain an enhanced heterogeneous feature representation.

3. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 2, characterized in that, The method of using depthwise separable convolution to process the input features separately is as follows: The input features are expanded in dimensionality using an unsqueeze operation, and then grouped using convolutional kernels to capture local temporal patterns, as shown in the following equation: ； Where U represents the local temporal pattern, H represents the input feature, and K represents the input feature. d For convolution kernel; GELU is used to activate and enhance the nonlinearity of local time-series modes, as shown in the following equation: ； In the point convolution stage, a convolution kernel is used. By fusing cross-channel information, a learnable parameter matrix is ​​generated: ； Compress the feature dimension using adaptive max pooling. The dimensions are reduced to [number] after the squeeze operation. To obtain key spatiotemporal vectors.

4. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 1, characterized in that, Step S2 includes a first stage, specifically: Using the enhanced physical signal features as the query vector and the enhanced network signal features as the key-value pairs, the physical attention weights are calculated as follows: ； Wherein, projection matrix , , This is the parameter matrix for independent learning in this direction; The enhanced physical signal features are segmented into multiple attention heads, and layer normalization is used to perform residual connections on the physical attention weights. This preserves the mode specificity of the physical signal and suppresses the risk of overfitting, thereby obtaining the physical enhancement features of the associated network traffic information in B×1×128 dimensions. As shown in the following formula: .

5. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 4, characterized in that, Step S2 includes a second stage, specifically: Utilizing physical signal characteristics Using key-value pairs, the enhanced network signal features are represented as query vectors, and the network attention weights are calculated: ； Wherein, projection matrix , , This is the parameter matrix for independent learning in this direction; The enhanced network signal is segmented into multiple attention heads, and layer normalization is used to perform residual connections on the network attention weights. This preserves the network traffic mode specificity and suppresses the risk of overfitting, thereby obtaining network enhancement features with B×1×128 dimensions of associated physical signal information. As shown in the following formula: Output physical enhancement features and network reinforcement features .

6. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 1, characterized in that, The step of concatenating physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector and constructing a decision space includes: The physical enhancement features and network enhancement features are reduced in dimensionality by squeezing and then concatenated to obtain the summed features. The physical enhancement features, network enhancement features, and summed features are then concatenated along the feature dimensions to form a multidimensional fusion vector, which is used to construct the decision space.

7. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 1, characterized in that, The step of performing feature compression and decision output on the multi-dimensional fusion vector through the classification head includes: The multidimensional fused vector is mapped to a 256-dimensional space through a fully connected layer, the GELU activation function is used to enhance nonlinearity, and the Dropout layer is used to suppress overfitting to obtain 256-dimensional features. The 256-dimensional features are directly mapped to the target category space through a linear transformation layer. The output layer generates the original score of each sample in each category. After normalization by the Softmax function, the final classification probability distribution of the intrusion detection is obtained. The dimension of the target category space is determined by the number of attack types.

8. The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion according to claim 1, characterized in that, Optimize the training phase, including: The loss gradient is calculated based on the prediction results and the true labels. The network weights are updated by the AdamW optimizer. The learning rate is dynamically adjusted by the cosine annealing learning rate scheduler. Gradient clipping is performed before the optimizer is updated to stabilize the training. During training, the F1 score on the validation set is monitored. An early stopping strategy is adopted and the model parameters with the highest F1 score on the validation set are saved.

9. A multi-source heterogeneous feature fusion intrusion detection system based on bidirectional interaction, characterized in that, The intrusion detection method based on bidirectional interaction and multi-source heterogeneous feature fusion, applied to any one of claims 1-8, comprises: a first processing module, a second processing module, and a task execution module; The first processing module is used to process heterogeneous data sources using a dual-channel feature extraction and enhancement architecture, extracting and enhancing heterogeneous feature representations, including enhancing physical signal features and enhancing network signal features; The second processing module is used to perform modal interaction on the enhanced heterogeneous data feature representation in stages according to the cross-modal bidirectional attention mechanism to obtain cross-modal associated physical enhancement features and network enhancement features; the cross-modal bidirectional attention mechanism includes network traffic channels and physical signal channels, and the channels learn independently from each other; The task execution module is used to concatenate physical enhancement features and network enhancement features to obtain a multi-dimensional fusion vector, construct a decision space, compress features and output decisions on the multi-dimensional fusion vector through a classification head, obtain the classification probability distribution, and select the best model for deployment in the network system after training iteration and optimization.

10. An electronic device, characterized in that, The electronic device includes: At least one processor; and, A memory communicatively connected to the at least one processor; wherein, The memory stores computer program instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the bidirectional interactive multi-source heterogeneous feature fusion intrusion detection method as described in any one of claims 1-8.

Images