An intrusion detection method based on a self-attention deep auto-encoding neural network

Abstract

The application relates to the technical field of intrusion detection, and discloses an intrusion detection method based on a self-attention deep self-encoding neural network, which comprises the following steps: obtaining network flow data of an intrusion behavior to be detected; constructing a self-attention deep self-encoding neural network model and pretraining; the self-attention deep self-encoding neural network model comprises a forward neural network module of layer-by-layer mapping, an attention module and a post-processing module; the forward neural network module of layer-by-layer mapping is used to perform layer-by-layer mapping on the network flow data, and multi-level network flow features are extracted; the attention module is used to perform weighted fusion of feature space attention and network layer attention on the multi-level network flow features, and network flow deep fusion features are obtained; and the post-processing module is used to classify the network flow deep fusion features, and an intrusion detection result is obtained. The application realizes effective identification of an intrusion behavior by mining deep fusion features of network intrusion behaviors.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and more specifically to an intrusion detection method based on a self-attention deep autoencoder neural network. Background Technology

[0002] In practical applications, an Intrusion Detection System (IDS) is built to monitor network transmissions in real time. If suspicious transmissions are detected, a security alert is sent, and the appropriate security module is activated based on the type of intrusion to eliminate the threat. Intrusion detection is a crucial component of a network security protection system and a key research area in the field of network security.

[0003] Depending on the strategy employed, intrusion detection can generally be divided into misuse detection and anomaly detection. Misuse detection is a feature-based static detection technique. Its characteristic is that it requires building an intrusion feature database in advance based on past intrusion experience and detecting existing intrusion types based on this database. New intrusion types cannot be detected until the database is updated, therefore misuse detection has a high false negative rate. Anomaly detection, on the other hand, is a behavior-based dynamic detection technique. Its characteristic is that it focuses on analyzing normal network behavior. By drawing the boundaries of normal network behavior features, it identifies and monitors abnormal behaviors that do not conform to the current system and network's behavioral norms. Based on the detection principle, anomaly detection often has a lower false negative rate, but not all abnormal behaviors are intrusion behaviors; therefore, compared to misuse detection, anomaly detection has a higher false positive rate.

[0004] In recent years, the complexity and diversity of intrusion behaviors have increased daily. Through the use of techniques such as obfuscation and data encryption, various forms of intrusion have emerged, including polymorphic viruses, polymorphic viruses, and code obfuscation. Relying solely on feature-based static intrusion detection is insufficient to cope with the increasingly complex intrusion detection tasks of the future. Both intrusion detection strategies have their advantages, and future intrusion detection systems will gradually evolve towards hybrid intrusion strategies.

[0005] Intrusion detection is a task that distinguishes between normal and abnormal behavior (anomaly detection or binary classification task) and determines the specific intrusion behavior based on features (multi-classification task). Therefore, intrusion detection is a standard classification problem. Machine learning, as the core of artificial intelligence, has been proven to be able to efficiently complete various classification tasks. This makes how to use machine learning algorithms to improve the effectiveness of intrusion detection a research hotspot in the field of intrusion detection today. Summary of the Invention

[0006] To address the aforementioned shortcomings in existing technologies, this invention provides an intrusion detection method based on a self-attention deep autoencoder neural network. By mining the deep fusion features of network intrusion behavior, it achieves effective identification of intrusion behavior.

[0007] To achieve the above-mentioned objectives, the technical solution adopted by this invention is as follows:

[0008] An intrusion detection method based on a self-attention deep autoencoder neural network includes the following steps:

[0009] Acquire network flow data of the intrusion behavior to be detected;

[0010] A self-attention deep autoencoder neural network model is constructed and pre-trained; the self-attention deep autoencoder neural network model includes a layer-by-layer mapping feedforward neural network module, an attention module, and a post-processing module.

[0011] A layer-by-layer mapping feedforward neural network module is used to map network flow data layer by layer to extract multi-level network flow features.

[0012] By utilizing the attention module, weighted fusion of feature space attention and inter-layer attention is performed on multi-level network flow features to obtain deep fusion features of network flow.

[0013] The intrusion detection results are obtained by classifying the deep fusion features of network flows using a post-processing module.

[0014] In some embodiments, the method for training network mapping parameters when performing layer-by-layer mapping of network stream data using a layer-by-layer mapping feedforward neural network module includes:

[0015] With the goal of minimizing the reconstruction error of the data space and the local structure preservation error of the sample space, the network mapping parameters of each hidden layer are calculated.

[0016] In some embodiments, the learning objective is to minimize the reconstruction error between the data space and the reconstructed data space, and the local structure preservation error of the sample space. Specifically:

[0017] ;

[0018] Where min is the minimum function, F is the overall objective function, and H are the network mapping parameters. This is the reconstruction parameter matrix corresponding to the l-th hidden layer. The output features of the l-th hidden layer are... The output of the l-th hidden layer is the feature data after feature mapping. , Here, is the regularization parameter, tr is the trace of the matrix, and M is the constraint matrix. These are the network mapping parameters between the l-th hidden layer and the (l+1)-th hidden layer. Let T be the norm, and T be the transpose operation.

[0019] In some embodiments, calculating the network mapping parameters of each hidden layer includes:

[0020] Randomly initialize the network mapping parameters of each hidden layer, and determine the initial feature mapping results of each hidden layer based on the initial network parameters of each hidden layer;

[0021] Based on the initial feature mapping results of each hidden layer, the reconstruction parameter matrix corresponding to each hidden layer is calculated using the overall objective function;

[0022] Based on the reconstruction parameter matrix corresponding to each hidden layer, the feature mapping results of each hidden layer are calculated using the network parameter approximation model;

[0023] Based on the feature mapping results of each hidden layer, the reconstruction parameter matrix corresponding to each hidden layer is recalculated using the overall objective function;

[0024] The network mapping parameters of each hidden layer are calculated based on the recalculated reconstruction parameter matrix corresponding to each hidden layer.

[0025] In some embodiments, based on the initial feature mapping results of each hidden layer, the reconstruction parameter matrix corresponding to each hidden layer is calculated using the overall objective function, specifically as follows:

[0026] ;

[0027] Where I is the identity matrix.

[0028] In some embodiments, based on the reconstruction parameter matrix corresponding to each hidden layer, the feature mapping results of each hidden layer are calculated using a network parameter approximation model, specifically:

[0029] .

[0030] In some embodiments, the network mapping parameters of each hidden layer are calculated based on the recalculated reconstruction parameter matrix corresponding to each hidden layer, specifically as follows:

[0031] .

[0032] In some embodiments, an attention module is used to perform weighted fusion of feature space attention and inter-layer attention on multi-level network flow features to obtain deep fusion features of the network flow, including:

[0033] Define a feature space weighting matrix, calculate the feature space weight vector based on the multi-level network flow features, and perform normalization processing.

[0034] The feature space attention features corresponding to each hidden layer are calculated based on the normalized feature space weight vector and the multi-level network flow features.

[0035] Define the inter-layer transformation matrix of the network, and calculate the inter-layer attention features of each hidden layer after transformation based on the feature space attention features corresponding to each hidden layer.

[0036] Set up the inter-layer weighting matrix, calculate the inter-layer weighting matrix corresponding to each hidden layer based on the inter-layer attention features of each hidden layer after transformation, and perform normalization processing;

[0037] The deep fusion features of the network flow are calculated based on the normalized inter-layer weight matrix and the transformed inter-layer attention features of each hidden layer.

[0038] In some embodiments, the post-processing module is used to classify the deep fusion features of network flows to obtain intrusion detection results, including:

[0039] Calculate the Euclidean distance from the deep fusion features of the network flow to the center of each class sphere;

[0040] Depth distance features are constructed based on the calculated Euclidean distances and then normalized.

[0041] The intrusion detection result is obtained by calculating the category prediction probability based on the normalized depth distance features.

[0042] In some embodiments, the loss function for pre-training a self-attention deep autoencoder neural network model is:

[0043] ;

[0044] Where L is the loss function, For cross-entropy loss, For interval loss, The coefficients of the interval loss regularization term are... For depth distance features x i The probability of belonging to category y. Let be the normalized depth distance feature of the corresponding category y in sample i. Let be the normalized deep distance feature of class j in sample i, where C is the number of classes, s is the margin hyperparameter, and n is the number of samples.

[0045] The present invention has the following beneficial effects:

[0046] This invention constructs a self-attention deep autoencoder neural network model to mine deep fusion features of network intrusion behavior, thereby achieving effective identification of intrusion behavior and significantly improving the accuracy and robustness of intrusion detection. Attached Figure Description

[0047] Figure 1 This is a schematic diagram of an intrusion detection method based on a self-attention deep autoencoder neural network;

[0048] Figure 2 This is a schematic diagram of the structure of a self-attention deep autoencoder neural network model;

[0049] Figure 3 Diagram of the unsupervised network mapping parameter learning framework;

[0050] Figure 4 A schematic diagram illustrating the various sample types in the dataset;

[0051] Figure 5 A diagram illustrating the accuracy of different methods in identifying various intrusion categories;

[0052] Figure 6 A schematic diagram illustrating the recall rates of different methods for identifying various intrusion categories;

[0053] Figure 7 A schematic diagram of F1-scores for different methods of identifying various intrusion categories. Detailed Implementation

[0054] The specific embodiments of the present invention are described below to enable those skilled in the art to understand the present invention. However, it should be understood that the present invention is not limited to the scope of the specific embodiments. For those skilled in the art, various changes are obvious as long as they are within the spirit and scope of the present invention as defined and determined by the appended claims. All inventions utilizing the concept of the present invention are protected.

[0055] like Figure 1 As shown, an intrusion detection method based on a self-attention deep autoencoder neural network provided by an embodiment of the present invention includes the following steps S1 to S5:

[0056] S1. Obtain network flow data of the intrusion behavior to be detected;

[0057] In this embodiment, step S1 acquires network flow data of the intrusion behavior to be detected and performs data preprocessing. The data preprocessing process includes character digitization and numerical normalization. Characters are converted using one-hot encoding: there are 9 categories, including the normal state, so the numerical type dimension corresponding to the category after one-hot encoding is 9; in addition, the infinity in the feature value is replaced with the maximum value of the same feature column, and missing values ​​(NaN) are filled with 0. Since the value range of numerical features is different, before feature extraction, the original feature quantity is processed by arctangent transformation to eliminate the difference between orders of magnitude, and then normalization is performed so that the feature value range is in the interval [0, 1].

[0058] This embodiment uses the CICIDS2018 dataset for experiments. The CICIDS2018 dataset contains many redundant features. We first need to perform feature reduction on this dataset, removing six features: FlowID, sourceIP, sourcePort, Destination IP, Protocol, and timestamp. Ultimately, each data point has 77 feature dimensions. Each sample data point after data preprocessing contains 77 data feature fields and one class label.

[0059] S2. Construct a self-attention deep autoencoder neural network model and perform pre-training; the self-attention deep autoencoder neural network model includes a layer-by-layer mapping feedforward neural network module, an attention module, and a post-processing module;

[0060] In this embodiment, step S2 constructs a self-attention deep autoencoder neural network model, and inputs the data output by the data preprocessing module into the self-attention deep autoencoder neural network model for training, thereby obtaining the final network intrusion category recognition model.

[0061] The self-attention deep autoencoder neural network model consists of three modules: a layer-by-layer mapping feedforward neural network module, an attention module, and a post-processing module. The structure diagram is shown below. Figure 2 As shown.

[0062] Each of the three modules performs a different function:

[0063] Module 1: Layer-by-layer mapping feedforward neural network module. This module initially uses unsupervised learning to complete pre-training, extracting features from different levels, and ensuring that the features in each hidden layer are representative during initialization.

[0064] Module 2: Self-attention module, which performs weighted fusion of the features extracted by Module 1 from the feature space dimension and the inter-network layer dimension to obtain deep fused features.

[0065] Module 3: Post-processing module, which is divided into classification module and prediction module according to different tasks. It takes the deep fusion features obtained in Module 2 as input to achieve the final classification or prediction task.

[0066] The three modules work together to form a complete network model, and the network model parameters are trained and optimized according to the loss function set in module 3.

[0067] In this embodiment, the method for training network mapping parameters when performing layer-by-layer mapping of network stream data using a feedforward neural network module with layer-by-layer mapping includes:

[0068] With the goal of minimizing the reconstruction error of the data space and the local structure preservation error of the sample space, the network mapping parameters of each hidden layer are calculated.

[0069] The calculation of network mapping parameters for each hidden layer includes:

[0070] Randomly initialize the network mapping parameters of each hidden layer, and determine the initial feature mapping results of each hidden layer based on the initial network parameters of each hidden layer;

[0071] Based on the initial feature mapping results of each hidden layer, the reconstruction parameter matrix corresponding to each hidden layer is calculated using the overall objective function;

[0072] Based on the reconstruction parameter matrix corresponding to each hidden layer, the feature mapping results of each hidden layer are calculated using the network parameter approximation model;

[0073] Based on the feature mapping results of each hidden layer, the reconstruction parameter matrix corresponding to each hidden layer is recalculated using the overall objective function;

[0074] The network mapping parameters of each hidden layer are calculated based on the recalculated reconstruction parameter matrix corresponding to each hidden layer.

[0075] In this embodiment, the layer-by-layer mapping feedforward neural network module uses a layer-by-layer unsupervised learning approach to obtain the network mapping parameters of each layer, and then stacks them to form a multi-layer feedforward neural network model.

[0076] Unsupervised network mapping parameter learning framework: Network mapping is equivalent to a feature extraction process, and the network mapping parameters are considered as feature transformation matrices. Therefore, the output of the next layer is a linear transformation of the output of the previous layer. Assuming that the feature space obtained after network mapping can linearly reconstruct the original data space through a matrix, this matrix represents the transformation relationship between the original data space and the feature space. It is defined as the reconstruction parameter matrix, as illustrated in the diagram below. Figure 3 As shown.

[0077] With the learning objective of minimizing the reconstruction error between the original data space and the reconstructed data space, and the local structure preservation error of the sample space, the network mapping parameters for each layer are calculated. and reconstructing the parameter matrix .

[0078] This embodiment defines the original input feature space R. m medium dataset Where n is the number of samples and m is the dimension of the original input feature space. The output of the l-th hidden layer is expressed as... , Representation of features The output of the l-th hidden layer after network mapping is expressed as follows: The reconstructed output of the l-th hidden layer is expressed as... , Indicates the feature The reconstructed expression, where i is the sample indicator.

[0079] The local manifold structure of the original input feature space X is obtained and represented by the nearest neighbor weight matrix W. The method for obtaining the structure is as follows:

[0080] A nearest neighbor undirected graph is constructed using the k-nearest neighbor method, and samples are selected using the Euclidean distance formula. Find the k nearest neighbors and solve the following equation:

[0081] ;

[0082] Obtain features Similarity w with each nearest neighbor ij (j=1, 2, ..., k), and set the similarity between non-nearest neighbor samples to 0. Features The set of nearest neighbor similarities, For regularization parameters, The diagonal elements of a diagonal matrix The set of similarity between nearest neighbors W The elements in Features The j-th nearest neighbor, Features The set of nearest neighbors.

[0083] Let the intermediate variable matrix Where D is A diagonal matrix of order n, with diagonal elements of order n. All other elements are 0; w ij (j=1,2,...,n) represents the sample Similarity with each nearest neighbor point, and similarity between non-nearest neighbor samples is 0; W The nearest neighbor weight matrix;T This is the transpose symbol.

[0084] In order to ensure that the neighborhood structure in the input X space is preserved in the reconstructed data space corresponding to each hidden layer of the neural network, the following objective function can be established by minimizing the error of this local nearest neighbor preservation:

[0085] ;

[0086] In the formula: min is the function for finding the minimum value; n is the number of samples; ;w ij These are elements in the nearest neighbor weight matrix W, representing the similarity between samples; Representation of features The output representation of the l-th hidden layer after network mapping, and the sample number is i; This represents the reconstructed sample of the l-th hidden layer. For network mapping functions, The matrix representing the reconstruction parameters of the l-th hidden layer represents the mapped feature space. Before mapping, the data space The relationship between the mapped feature data. As the output of the next hidden layer, i.e. .

[0087] Transforming the objective function of the above equation, we obtain the following objective function for preserving the local structure of the sample space:

[0088] ;

[0089] Indicates to The reconstruction expression is obtained by taking the minimization of the reconstruction error as the objective function F2 to obtain the reconstruction parameter matrix. and feature mapping results The reconstruction error is expressed as follows:

[0090] ;

[0091] Combining the two objective functions above, the overall objective function is obtained as follows:

[0092] ;

[0093] Where min is the minimum function, F is the overall objective function, and H are the network mapping parameters. This is the reconstruction parameter matrix corresponding to the l-th hidden layer. The output features of the l-th hidden layer are... The output of the l-th hidden layer is the feature data after feature mapping. , Here, is the regularization parameter, tr is the trace of the matrix, and M is the constraint matrix. These are the network mapping parameters between the l-th hidden layer and the (l+1)-th hidden layer. Let T be the norm, and T be the transpose operation.

[0094] because , To initialize the network mapping parameters between the l-th hidden layer and the (l+1)-th layer, first... And satisfy Then, the reconstruction parameters of the hidden layer are calculated according to the above formula as follows:

[0095] ;

[0096] When l=0, it indicates that this layer is an input layer, that is... X l = X Then we have:

[0097] ;

[0098] based on The assumption, It can be used Approximate expression, that is:

[0099] ;

[0100] According to the above formula, we can obtain Therefore, the final output of each hidden layer of the network is expressed as:

[0101] ;

[0102] Where: l represents the hidden layer indicator. These are the network mapping parameters between the l-th hidden layer and the (l+1)-th hidden layer.

[0103] Because the overall objective function contains and The optimal solution cannot be obtained directly from two parameter matrices; they need to be initialized first. Solve for the value again Based on the formula for solving the reconstruction parameters of the hidden layer, it can be seen that initialization is required first. get Then calculate to get And then according to Replace the original Since the network is initially initialized randomly to satisfy the orthogonality condition... (Right now To overcome this randomness, this embodiment introduces an iterative update method. Update:

[0104] First, set the iteration update step size. t m Set the number of hidden layers L, and the output dimension of each hidden layer. ,definition t is the iteration step size indicator, and l represents the hidden layer indicator. For the t-th iteration, the th... l Hidden layers and l+ Network mapping parameters between layers 1 For the t-th iteration, the th... l The reconstruction parameter matrix corresponding to the hidden layer.

[0105] Layer-by-layer mapping of feedforward neural network module network mapping parameters The calculation process is as follows:

[0106]

[0107] Based on the above calculation process, the network mapping parameters for each layer were obtained. By combining the final output of each hidden layer, it can be seen that the construction of the layer-by-layer mapping feedforward neural network has been completed.

[0108] In this embodiment, the number of hidden layers L in the feedforward neural network is set, and the output of each layer is taken: , where X 0 X is the original input data.

[0109] This embodiment employs a feature space attention mechanism to weight the features of each layer: firstly, each layer introduces... Dimensional matrix, This represents the output dimension of each hidden layer. (Introduction) The goal is to calculate the weight of each feature in each layer separately. Participate in later training updates.

[0110] Calculate the weight of each feature in the l-th layer to form the feature weight vector:

[0111] ;

[0112] Normalize the feature weight vector:

[0113] ;

[0114] This indicates that a softmax transformation is performed on each row of the matrix to normalize the weights so that the sum of the weights in each row is 1. The following formula is used to weight the features of the l-th layer to obtain the attention features of the l-th layer. :

[0115] .

[0116] This embodiment employs an inter-layer attention mechanism to focus on the attention features of the outputs of each layer. Weighted fusion is performed to obtain deep fusion features: First, each layer introduces... Matrix, for The purpose of this dimensional matrix is ​​to transform features from different dimensions at each layer into a single r-dimensional matrix, facilitating subsequent weighted fusion of features from different layers. The transformed features for each layer are as follows:

[0117] ;

[0118] Introduce another one matrix The weights of each layer are defined as follows: , The calculation formula is as follows:

[0119] ;

[0120] The weights of each layer constitute a weight matrix. And by performing a normalization operation, we obtain:

[0121] ;

[0122] This indicates that a softmax transformation is performed on each row of the matrix, such that the sum of the elements in each row is 1, meaning the sum of the weights of each layer is 1. The deep fusion feature expression obtained by weighted summation of each layer is as follows:

[0123] ;

[0124] R and Participate in later training updates. for Dimensional matrix, deep fusion of features for A matrix of dimensions, where r represents the dimension of the deep fusion features and n represents the number of samples.

[0125] The self-attention mechanism module extracts deep fusion features, and the post-processing module uses these deep fusion features as input to achieve the actual business goal of classification.

[0126] The post-processing module primarily establishes the classification module based on the actual application scenario and sets the loss function. It initializes the class cores for each category using the average value of the deep fusion features extracted from each category in the training set.

[0127] ;

[0128] in This represents the deep fusion feature representation of the c-th class sample. C represents the category indicator; C represents the number of categories; n c This indicates the number of samples in this category.

[0129] Calculate the deep fusion features of the samples To various categories The Euclidean distance values ​​are used to construct the depth distance feature:

[0130] ;

[0131] Where d is A matrix of dimensions, where n represents the number of samples and C represents the number of categories.

[0132] Normalize the depth distance feature vector of each sample ,get This makes the sum of the vector elements equal to 1.

[0133] Using depth distance features to predict the category, therefore x i The probability of belonging to category y can be expressed as:

[0134] ;

[0135] in The hyperparameters used to control probability assignment are such that the closer the depth feature is to a certain class center, the greater the probability of belonging to that class.

[0136] The goal of this embodiment is to learn a deep neural network capable of extracting discriminative features and achieving high classification accuracy. Therefore, designing a suitable loss function is crucial. Based on the above formula, the classification error can be calculated using distance-based cross entropy loss (DCE loss), as shown in the following formula:

[0137] ;

[0138] Where y represents the sample The true class. Minimizing the DCE loss is equivalent to reducing the distance between the depth distance feature and the corresponding class center.

[0139] However, relying solely on DCE loss during training carries the risk of overfitting. Therefore, margin loss (Mloss) is added to the loss function as a regularization term. During training, this reduces the distance between depth features and their corresponding class centroids while increasing the distance between them and the centroids of different classes. Margin loss is defined as:

[0140] ;

[0141] Where 's' is the margin hyperparameter, introduced to further improve the model's generalization ability. Even if the sample is correctly classified, a penalty is imposed on the model. Since the class centers are trainable, minimizing the Mloss means reducing the distance between features and class centers of the same class, and increasing the distance between class centers of different classes, resulting in greater inter-class differences for features from different classes. Finally, the DCEloss and Mloss are combined to train the model parameters, and the overall loss function is:

[0142] ;

[0143] in, It is the coefficient of the interval loss regularization term.

[0144] The offline training process for the classification task in this embodiment is as follows:

[0145]

[0146] In this embodiment, the parameters of the feedforward neural network in module 1 are first initialized in an unsupervised pre-training manner, which enables the features in each hidden layer to have good representativeness during initialization. When training the model, a supervised method is used, which reduces the distance between samples of the same class while increasing the distance between samples of different classes. Therefore, it is possible to extract discriminative features with small intra-class differences and large inter-class differences.

[0147] S3. Use the layer-by-layer mapping feedforward neural network module to perform layer-by-layer mapping on the network flow data and extract multi-level network flow features;

[0148] S4. Use the attention module to perform weighted fusion of feature space attention and inter-layer attention on multi-level network flow features to obtain deep fusion features of network flow.

[0149] In this embodiment, step S4 utilizes the attention module to perform weighted fusion of feature space attention and inter-layer network attention on multi-level network flow features to obtain deep fusion features of the network flow, including:

[0150] Define a feature space weighting matrix, calculate the feature space weight vector based on the multi-level network flow features, and perform normalization processing.

[0151] The feature space attention features corresponding to each hidden layer are calculated based on the normalized feature space weight vector and the multi-level network flow features.

[0152] Define the inter-layer transformation matrix of the network, and calculate the inter-layer attention features of each hidden layer after transformation based on the feature space attention features corresponding to each hidden layer.

[0153] Set up the inter-layer weighting matrix, calculate the inter-layer weighting matrix corresponding to each hidden layer based on the inter-layer attention features of each hidden layer after transformation, and perform normalization processing;

[0154] The deep fusion features of the network flow are calculated based on the normalized inter-layer weight matrix and the transformed inter-layer attention features of each hidden layer.

[0155] S5. The post-processing module is used to classify the deep fusion features of network flows to obtain intrusion detection results.

[0156] In this embodiment, step S5 uses the post-processing module to classify the deep fusion features of network flows to obtain intrusion detection results, including:

[0157] Calculate the Euclidean distance from the deep fusion features of the network flow to the center of each class sphere;

[0158] Depth distance features are constructed based on the calculated Euclidean distances and then normalized.

[0159] The intrusion detection result is obtained by calculating the category prediction probability based on the normalized depth distance features.

[0160] The online recognition process for the classification task in this embodiment is as follows:

[0161]

[0162] The CICIDS2018 dataset used in this embodiment contains both normal traffic and anomalous attacks. More than 80 network traffic features were extracted from this dataset using the CICFlowMeter-V3 tool and a CSV file was generated. The effectiveness of the proposed intrusion detection method was evaluated in the experiments using three performance metrics: precision, recall, and F1-score.

[0163] The CICIDS2018 dataset is huge. To verify the effectiveness of the method of this invention, experiments were conducted on DDoS attack categories. The dataset is shown in Table 1.

[0164] Table 1 Dataset Information Table

[0165]

[0166] To visualize the differences in the number of samples in each category, graphs were drawn showing the sample situation for each category of the dataset, such as... Figure 4 As shown, the sample size of the DDoS attack-LOIC-UDP category is only 0.58%, DoS attacks-Slowloris accounts for 3.64%, and DoS attacks-GoldenEye accounts for 7.34%. This is a clearly imbalanced dataset, and the final detection result of the classification model will be biased towards the majority sample category, resulting in limited recognition performance of the smaller sample category.

[0167] The experiment selected 80% of the samples of each class in the dataset as the training set and 20% as the test set. Three comparison schemes were set up for the experiment: RNN, GRU, and CNN-LSTM.

[0168] The final result is as follows Figure 5 , Figure 6 and Figure 7 As shown in Table 2, the specific values ​​are as follows.

[0169] Table 2 Final Recognition Results

[0170]

[0171] observe Figure 1 As shown in Table 2, the three attack categories of DDoS attack-LOIC-UDP, DoS attacks-Slowloris, and DoS attacks-GoldenEye cannot be detected by RNN and GRU due to the small proportion of training samples. The method of this invention has a precision of 0.633 and a recall of 0.783 on the DDoS attack-LOIC-UD category, which is significantly better than the comparison method. This is because the method of this invention takes into account both reducing the difference between samples of the same class and increasing the distance between samples of different classes during training, and can extract discriminative features with small intra-class differences and large inter-class differences. It has stronger adaptability and robustness when facing imbalanced dataset classification tasks.

[0172] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0173] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0174] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0175] Specific embodiments have been used to illustrate the principles and implementation methods of this invention. The descriptions of the embodiments above are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this invention. Therefore, the content of this specification should not be construed as a limitation of this invention.

[0176] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. An intrusion detection method based on a self-attention deep auto-encoding neural network, characterized by, The method comprises the following steps: obtaining network flow data to be detected for intrusion behavior; constructing and pre-training a self-attention deep auto-encoding neural network model, wherein the self-attention deep auto-encoding neural network model comprises a forward neural network module of layer-by-layer mapping, an attention module and a post-processing module; extracting multi-level network flow features by using the forward neural network module of layer-by-layer mapping to perform layer-by-layer mapping on the network flow data; wherein the network mapping parameter training method when the forward neural network module of layer-by-layer mapping is used to perform layer-by-layer mapping on the network flow data comprises: taking the reconstruction error of the data space and the reconstructed data space and the local structure preservation error of the sample space as the learning goal, specifically: ； where min is a minimum function, F is a total objective function, H is a network mapping parameter, is a reconstruction parameter matrix corresponding to the lth hidden layer, is an output feature of the lth hidden layer, is a feature data mapped by the output feature of the lth hidden layer, , is a regularization parameter, tr is a trace of a matrix, M is a constraint matrix, is a network mapping parameter between the lth hidden layer and the (l+1)th hidden layer, is a norm, T is a transpose operation; calculating the network mapping parameters of each layer of hidden layer, including: randomly initializing the network mapping parameters of each layer of hidden layer, and determining the initial feature mapping results of each layer of hidden layer according to the initial network parameters of each layer of hidden layer; calculating the reconstruction parameter matrix corresponding to each layer of hidden layer by using the total objective function according to the initial feature mapping results of each layer of hidden layer; specifically: ； wherein I is an identity matrix; calculating the feature mapping results of each layer of hidden layer by using the network parameter approximation model according to the reconstruction parameter matrix corresponding to each layer of hidden layer; specifically: ； re-calculating the reconstruction parameter matrix corresponding to each layer of hidden layer by using the total objective function according to the feature mapping results of each layer of hidden layer; calculating the network mapping parameters of each layer of hidden layer according to the re-calculated reconstruction parameter matrix corresponding to each layer of hidden layer, specifically: ； obtaining network flow deep fusion features by using the attention module to perform feature space attention and network interlayer attention weighted fusion on the multi-level network flow features; including: setting a feature space weighting matrix, calculating a feature space weight vector according to the multi-level network flow features and performing normalization processing; calculating the feature space attention features corresponding to each layer of hidden layer according to the normalized feature space weight vector and the multi-level network flow features; setting a network interlayer conversion matrix, calculating the converted network interlayer attention features of each layer of hidden layer according to the feature space attention features corresponding to each layer of hidden layer; setting a network interlayer weighting matrix, calculating the network interlayer weight matrix corresponding to each layer of hidden layer according to the converted network interlayer attention features of each layer of hidden layer and performing normalization processing; calculating the network flow deep fusion features according to the normalized network interlayer weight matrix and the converted network interlayer attention features of each layer of hidden layer; obtaining an intrusion detection result by using the post-processing module to classify the network flow deep fusion features, including: calculating the Euclidean distance from the network flow deep fusion features to the ball center of each category; constructing a deep distance feature according to the calculated each Euclidean distance and performing normalization processing; calculating a category prediction probability according to the normalized deep distance feature to obtain an intrusion detection result.

2. The intrusion detection method based on the self-attention deep auto-encoding neural network according to claim 1, characterized in that, The loss function when the self-attention deep auto-encoding neural network model is pre-trained is: ； where L is a loss function, is a cross-entropy loss, is a margin loss, is a coefficient of the margin loss regularization term, is a deep distance feature x i is a probability of belonging to class y, is a normalized deep distance feature for class y in sample i, is a normalized deep distance feature for class j in sample i, C is the number of classes, s is a margin hyperparameter, and n is the number of samples.

Images