Network intrusion detection method and device, computer equipment and storage medium

Abstract

The invention belongs to the field of information security, and relates to a network intrusion detection method and device, computer equipment and a storage medium, and the method comprises the steps: collecting historical traffic data, and carrying out the structured preprocessing of the historical traffic data; generating a new synthetic minority class sample through active boundary oversampling based on an inter-class gap between normal traffic, namely a majority class, and attack traffic, namely a minority class; a branch convolutional neural network model is constructed, independent branch networks are designed for different protocol layers, and normal traffic and various abnormal traffic are distinguished; performing supervised training on the branch convolutional neural network model, and optimizing model parameters; deploying the trained and optimized branch convolutional neural network model to a production environment, and carrying out real-time flow intrusion detection; and continuously collecting prediction feedback and new network threat samples of the branch convolutional neural network model in a real environment. The active boundary can be optimized; the controllability and the safety are high; and protocol layer feature intelligent identification can be carried out.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a network intrusion detection method and device, a computer device and a storage medium. BACKGROUND

[0002] Although the convolutional neural network performs well in intrusion detection, it still faces some challenges, among which the class imbalance problem is a key factor that exists universally in network intrusion detection and seriously affects the detection performance. In actual network environment, normal traffic usually accounts for the vast majority of network traffic (majority class), while abnormal traffic and attack behavior (minority class) are relatively rare. This unbalanced distribution will cause the detection model to pay excessive attention to the majority class, while ignoring the minority class attack behavior which is crucial to network security. SUMMARY

[0003] In order to solve the above technical problems, the present application provides a network intrusion detection method, which adopts the technical scheme as follows, comprising the steps of: Collecting historical traffic data and structurally preprocessing the historical traffic data; According to the preprocessed historical traffic data, based on the class gap between normal traffic (majority class) and attack traffic (minority class), new synthetic minority class samples are generated through active boundary oversampling; A branch convolutional neural network model is constructed, independent branch networks are designed for different protocol layers, and through fusion and classification mechanism, joint recognition of complex patterns across protocol layers is realized to distinguish normal and abnormal traffic of various types; The balanced training data is used to supervise the training of the constructed branch convolutional neural network model, the model parameters are optimized, the test set is evaluated on the original distribution, and the model is iteratively optimized according to the results; The trained and optimized branch convolutional neural network model is deployed to the production environment for real-time traffic intrusion detection; The prediction feedback and new network threat samples of the branch convolutional neural network model in the real environment are continuously collected, and the branch convolutional neural network model is updated and optimized using this information.

[0004] Preferably, the step of collecting historical traffic data and structurally preprocessing the historical traffic data specifically comprises: Collecting the historical traffic data; Protocol analysis is performed on the historical traffic data to construct a multi-protocol layer feature matrix; According to the multi-protocol layer feature matrix, data set division and preprocessing are performed.

[0005] Preferably, the step of generating new synthetic minority class samples based on the inter-class gap between normal traffic (majority class) and attack traffic (minority class) through active boundary oversampling according to the preprocessed historical traffic data specifically comprises: Boundary minority class sample identification is performed according to the preprocessed historical traffic data; Security direction synthetic samples are generated according to the identified boundary minority class samples; Quality verification and screening are performed on the synthetic samples.

[0006] Preferably, the step of constructing a branch convolutional neural network model, designing independent branch networks for different protocol layers, and realizing joint identification of complex patterns across protocol layers through fusion and classification mechanisms to distinguish normal traffic from various types of abnormal traffic specifically comprises: Multi-protocol layer input splitting and branch design are performed; Cross-branch feature fusion is performed; After the fusion layer, a classification head is connected to construct an output layer.

[0007] Preferably, the step of using balanced training data to supervise the training of the constructed branch convolutional neural network model, optimizing model parameters, evaluating on a test set that maintains the original distribution, and iteratively optimizing the model based on the results specifically comprises: Loss function design and model compilation are performed; A training strategy is adopted to monitor the training process; Multi-dimensional performance evaluation and model tuning are performed.

[0008] Preferably, the step of deploying the training-optimized branch convolutional neural network model to a production environment for real-time traffic intrusion detection specifically comprises: The training-optimized branch convolutional neural network model is deployed to a production environment to capture network traffic data in real time; The trained branch convolutional neural network model is loaded into memory and a reasoning pipeline is constructed to predict the real-time generated feature matrix; The detection results of the branch convolutional neural network model are converted into alarm information, and response actions are executed according to predefined security policies.

[0009] Preferably, the step of continuously collecting prediction feedback of the branch convolutional neural network model in a real environment and new network threat samples, and updating and optimizing the branch convolutional neural network model using this information specifically comprises: Feedback data of the branch convolutional neural network model in a real environment is continuously collected for sample library management; Based on a three-dimensional evaluation system, performance monitoring of the branch convolutional neural network model is performed; Incremental updating and security deployment of a branch convolutional neural network model are performed.

[0010] To solve the above technical problems, the application further provides a network intrusion detection device, which adopts the technical scheme as follows, comprising: A preprocessing module is configured to collect historical traffic data and perform structural preprocessing on the historical traffic data; A generating module is configured to generate new synthetic minority class samples based on the inter-class gap between normal traffic (majority class) and attack traffic (minority class) through active boundary oversampling according to the preprocessed historical traffic data; An identification module is configured to construct a branch convolutional neural network model, design independent branch networks for different protocol layers, realize joint identification of complex patterns across protocol layers through fusion and classification mechanism, and distinguish normal traffic from various types of abnormal traffic; An optimization module is configured to perform supervised training on the constructed branch convolutional neural network model using balanced training data, optimize model parameters, evaluate on a test set that maintains the original distribution, and iteratively optimize the model according to the results; A detection module is configured to deploy the trained and optimized branch convolutional neural network model to a production environment for real-time traffic intrusion detection; An updating module is configured to continuously collect prediction feedback and new network threat samples of the branch convolutional neural network model in a real environment, and update and optimize the branch convolutional neural network model using this information.

[0011] To solve the above technical problems, the application further provides a computer device, which adopts the technical scheme as follows, comprising a memory and a processor, the memory stores computer readable instructions, and the processor executes the computer readable instructions to realize the steps of the network intrusion detection method described above.

[0012] To solve the above technical problems, the application further provides a computer readable storage medium, which adopts the technical scheme as follows, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by the processor to realize the steps of the network intrusion detection method described above.

[0013] Compared with the prior art, the application has the following beneficial effects: (1) By utilizing inter-class difference information, combining majority class samples and minority class samples to determine the safe generation direction, ensuring that the new samples are far away from the majority class area and maintain similarity with the real minority class samples, making the boundary between the majority class and the minority class more clear, helping the convolutional neural network to learn more discriminative features, thereby improving the network intrusion detection and recognition performance, breaking the passive filling mode of traditional oversampling method, and optimizing the active boundary; (2) Through boundary sample screening, dynamic lambda coefficient mechanism, eigenvalue constraint verification, etc., it is ensured that the sample generation process is controlled and safe, the risk of generating noise samples between the majority classes is effectively reduced, it is helpful for the convolutional neural network to learn more correct features, thereby improving the network intrusion detection and recognition performance, and the controllability and safety are strong; (3) The convolutional neural network architecture with multiple protocol layer branches is adopted, independent branches for protocol layers (network layer, transmission layer and application layer) are created, and then fusion classification is performed, the branches can be optimized according to the feature structure of a specific protocol layer, the specific modes of each protocol layer are more effectively learned, and the fusion classification ensures the learning and identification of cross-protocol layer features, and protocol layer feature intelligent identification can be performed. BRIEF DESCRIPTION OF DRAWINGS

[0014] In order to more clearly illustrate the scheme in the present application, the drawings needed in the description of the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0015] Figure 1 is a flow chart of an embodiment of the network intrusion detection method of the present application; Figure 2 is a balanced sample set generation flow chart adopted in the network intrusion detection method of the present application; Figure 3 is a structural schematic diagram of an embodiment of the network intrusion detection device of the present application; Figure 4 is a structural schematic diagram of another embodiment of the network intrusion detection device of the present application; Figure 5 is a structural schematic diagram of an AI analysis engine module adopted in another embodiment of the network intrusion detection device of the present application; Figure 6 is a structural schematic diagram of an embodiment of the computer equipment of the present application. DETAILED DESCRIPTION

[0016] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs; the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "include" and "have" in the specification and claims of the present application and the above description of drawings mean to cover the non-exclusive inclusion; the terms "first", "second" and the like in the specification and claims of the present application or the above description of drawings are used to distinguish different objects, not to describe a specific order.

[0017] Reference to an "embodiment" herein means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase that an "embodiment" in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. As will be apparent to those of ordinary skill in the art, embodiments described herein can be combinable with other embodiments.

[0018] In order to better understand the technical scheme of the present application, the technical scheme in the embodiments of the present application will be described clearly and completely below with reference to the drawings.

[0019] It should be noted that the network intrusion detection method provided by the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the network intrusion detection device is generally arranged in the server / terminal device.

[0020] It should be understood that the number of terminal devices, networks and servers is only illustrative. Any number of terminal devices, networks and servers can be provided according to the implementation needs.

[0021] Embodiment one Please refer to Figure 1 , which shows a flowchart of one embodiment of the network intrusion detection method of the present application. The network intrusion detection method comprises the following steps: Step S1, collecting historical traffic data and performing structured preprocessing on the historical traffic data.

[0022] In this embodiment, the electronic device (such as a server / terminal device) on which the network intrusion detection method runs can receive a network intrusion detection request through a wired connection or a wireless connection. It should be noted that the wireless connection can include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection methods.

[0023] In this embodiment, step S1 can specifically include the following steps: S11, collecting the historical traffic data.

[0024] In a bypass deployment mode, the original packet copies flowing through key network nodes (such as core switches, data center entrances) are obtained through switch port mirroring (SPAN) or network tap (TAP). This method ensures that monitoring system failure does not affect business network and avoids introducing delay.

[0025] Configure network devices to replicate traffic from specified ports to monitoring ports, or physically deploy optical splitters to split optical signals. Use libraries such as libpcap, PF_RING, etc. for high-speed packet capture, supporting line-speed processing, striving for no packet loss in a gigabit environment.

[0026] Deploy NetFlow / sFlow / IPFIX collectors to receive traffic statistics metadata sent by network devices; interface with security devices such as firewalls, IDS / IPS, WAF, etc. through protocols such as Syslog, SNMP, RESTful API, etc. to collect security event logs.

[0027] Deploy Logstash, Fluentd, etc. on the collection node to parse, filter and forward heterogeneous logs, and realize the integration of security context.

[0028] Design a unified data collection node in the data collection layer for data standardization, timestamp synchronization and flow control.

[0029] Convert all data to a unified internal representation format (such as Apache Avro or Protocol Buffers), use NTP protocol for time synchronization, and use back pressure mechanism (such as TCP window control or message queue flow control) to prevent data flood from causing system overload.

[0030] The role of step S11 is to non-invasively capture network full-flow data and security context information, providing real and comprehensive data sources for model training.

[0031] S12, protocol analysis of the historical traffic data, construction of multi-protocol layer feature matrix.

[0032] Use protocol recognition engine based on rules and machine learning (such as nDPI, L7-Filter) to parse packets, not only according to port number, but also according to payload characteristics and behavior pattern to identify application layer protocols (such as HTTP, DNS, SSL / TLS).

[0033] Parse each layer protocol header and extract key fields. For example, extract source / destination IP, protocol type, TTL from IP header; extract flag, window size from TCP header; extract method, URL, User-Agent from HTTP payload.

[0034] Use multiple encoding methods to convert classification features into numerical values.

[0035] One-Hot Encoding: used for unordered categorical variables, such as protocol type (TCP=001, UDP=010, ICMP=100).

[0036] Label Encoding: Used for ordinal categorical variables, such as TCP priority.

[0037] Hashing Trick: Used for high cardinality features, such as IP addresses. The original value is mapped to a fixed-size feature space through a hash function, formula: where: hash(feature): Hash function calculation on the original feature value (such as IP string). N: Pre-set feature space dimension.

[0038] Map high-dimensional, sparse categorical features (such as IP addresses) to a fixed low-dimensional vector space, effectively control the dimension, but there may be hash collisions.

[0039] Construct a two-dimensional matrix , with dimensions . Where: : represents the number of protocol layers (such as network layer, transport layer, application layer). : represents the feature dimension of each protocol layer (uniform length by zero padding).

[0040] Each row of the matrix corresponds to a feature vector of a protocol layer. For example: Row 1 (Network Layer): [Source IP Hash, Destination IP Hash, Protocol Type Encoding, TTL, Packet Length, …]; Row 2 (Transport Layer): [Source Port, Destination Port, TCP Flag Combination Value, Window Size, …]; Row 3 (Application Layer): [HTTP Method Encoding, Status Code, Content Length, SSL / TLS Version Encoding, …].

[0041] The role of step S12 is to parse the original data packet and log into features with clear physical meaning, and organize them into a two-dimensional matrix according to protocol layers, to retain the association information between protocol stack layers, and facilitate CNN to capture cross-layer anomaly patterns.

[0042] S13, according to the multi-protocol layer feature matrix, data set division and preprocessing.

[0043] Divide the entire labeled (normal / abnormal type) data set into training set and test set by stratified sampling (Stratified Sampling) method.

[0044] Use the StratifiedShuffleSplit function of the scikit-learn library to ensure that the proportion of each class (normal, each type of attack) in the training set and test set remains consistent with the original data set, preventing bias introduced by partitioning.

[0045] Scale continuous numerical features to conform to a standard distribution or fall within a specific interval.

[0046] Z-score standardization: Where: : Original feature value. : Mean of the feature on the training set. : Standard deviation of the feature on the training set.

[0047] The mean of the processed feature is 0 and the standard deviation is 1, suitable for the case where the feature approximately conforms to a Gaussian distribution.

[0048] Min-Max Scaling: Where: : Original feature value. : Minimum value of the feature on the training set. : Maximum value of the feature on the training set.

[0049] The processed feature value falls within the interval [0, 1]. Eliminate the negative impact of different features due to different dimensions and value ranges on the model, so that optimization algorithms such as gradient descent can converge more quickly and stably.

[0050] For missing feature values, use context-based filling (such as filling with subsequent packet values in the same protocol session) or safely discard the record. For outliers, use robust standardization (use median and interquartile range) or perform truncation.

[0051] Use the interpolate and clip functions of data processing libraries such as Pandas for processing.

[0052] The role of step S13 is to prepare a standardized data set for model training and evaluation, and to standardize the features to speed up model convergence and improve performance.

[0053] The role of step S1 is to obtain comprehensive and diverse historical traffic data from the original network environment and convert it into a structured feature matrix that preserves protocol layer association information for deep learning models. The goal is to build a high-quality, information-rich training data set.

[0054] Step S2, according to the preprocessed historical traffic data, based on the difference between the normal traffic (majority class) and the attack traffic (minority class), a new synthetic minority class sample is generated through active boundary oversampling.

[0055] In the embodiment, step S2 can specifically include the following steps: S21, according to the preprocessed historical traffic data, boundary minority class sample identification is performed.

[0056] For each minority class sample , find its nearest neighbors in the whole training set. The distance metric needs to consider the structure of the feature matrix.

[0057] Calculate the weighted Frobenius norm distance, and consider the feature matrix and of the two samples as a whole, calculate: wherein: : represents element-wise multiplication (Hadamard product). : a weight matrix of the same shape as , , different rows (protocol layers) can be assigned different weights. : represents the Frobenius norm (square root of the sum of squares of all elements).

[0058] Calculate the distance (such as Euclidean distance) between the feature vectors and of the two samples at each protocol layer, and then weighted sum: wherein: : the preset weight of the th layer, and . : any applicable distance function, such as Euclidean distance .

[0059] For large-scale data, use data structures such as KD-Tree or Ball-Tree to perform efficient nearest neighbor search in combination with custom distance functions.

[0060] For minority class samples , count the number of samples belonging to the majority class (normal) among the nearest neighbors , and calculate the proportion: .

[0061] Reflects the surrounding enemy and me strength contrast. The higher, the more The more surrounded by majority classes, the closer to the classification boundary, the more likely to be misclassified.

[0062] Filtering based on threshold of boundary samples, setting lower threshold (like 0.3) and upper threshold (like 0.7). The minority samples satisfying are selected into boundary sample set . The samples satisfying are considered as safe inner points or outliers, surrounded by same class, generating new samples is not meaningful. The samples satisfying may be considered as noise or extremely difficult samples, with high risk of generating samples nearby.

[0063] The role of step S21 is to filter out samples near the classification boundary from the original minority class samples, which are the key to affect the performance of the classifier and the most effective parent to generate new samples.

[0064] S22, according to the identified boundary minority class samples, generate safe direction synthetic samples.

[0065] Combine the majority class neighbor and minority class neighbor information of boundary samples to calculate the safe generation direction vector . The following three progressive strategies are used to calculate: First basic strategy: where is the nearest majority class neighbor of

[0066] Second anti-encirclement strategy: where is the center (mean vector) of all majority class samples in the nearest neighbors of . When is surrounded by multiple majority class samples, this direction is more effective.

[0067] Third fidelity strategy: where is a minority class neighbor of , and are weight coefficients ( such as , ). This direction not only moves away from the majority class, but also approaches the true minority class distribution, avoiding the generation of outliers deviating from the actual distribution. may be the nearest minority class neighbor, or the center of multiple minority class neighbors .

[0068] Dynamic step control and sample positioning are performed, and the generation position of a new sample is determined by the following formula: . Wherein, , is a basic step randomly selected in the range of [0.5, 1.5], and randomness is introduced to increase sample diversity. is the majority class neighbor ratio of the boundary sample.

[0069] The larger, the closer the sample is to the boundary or trapped in the majority class, and a larger step ( ) is needed to jump to the safe area. This is an adaptive dynamic mechanism.

[0070] For each feature value of the generation position of the new sample, a constraint is performed to ensure that it conforms to the rules of real data.

[0071] Continuous features: clip the generation position value of the new sample to the minimum value and the maximum value of the original minority class sample on the feature: .

[0072] Discrete features: round the value of to the nearest legal code value.

[0073] Prevent the generated feature value from being physically meaningless (such as negative TTL, non-existent protocol code), and ensure the rationality of the synthesized sample.

[0074] The purpose of step S22 is to generate a specified number of synthetic new samples for each boundary sample along a calculated safe direction, which aims to make the new sample away from the majority class and close to the minority class real distribution.

[0075] S23, quality verification and screening of synthetic samples.

[0076] The double verification conditions include: Condition one (distance test): calculate the distance of the new sample to its nearest majority class sample , and the distance to its nearest minority class sample. Require . This ensures that the new sample is closer to the minority class population in feature space.

[0077] Condition two (neighbor component test): find the nearest neighbors Can be set to a smaller value, such as 5, statistics of a small number of class samples . Request (I.e. the minority class neighbors account for the majority). This confirms its identity from the local neighborhood composition.

[0078] If any of the above verification fails, discard the .

[0079] Try to adjust the parameters (such as slightly reduce , or use strategy 2 / 3 to recalculate ) and regenerate. To prevent infinite loop, set the maximum number of attempts (such as 10 times) for each boundary sample.

[0080] The final sample selection, according to the total number of new samples required for each minority class And its boundary sample number , preliminary for each boundary sample to generate Sample, get the total candidate pool.

[0081] From the verified candidate pool, preferentially select those The value is larger (i.e. the original boundary is more ambiguous) boundary sample generated synthetic samples, or directly randomly selected , constitute the final balanced training set.

[0082] The role of step S23 is: to verify the generated synthetic samples after the fact, to ensure that it is indeed in the ideal minority class area, and to filter out unqualified samples, to ensure the quality of the oversampled dataset.

[0083] Figure 2 Is the network intrusion detection method of the present application Balance sample set generation flow chart. As Figure 2 Shown, balance sample set generation flow specifically includes the following steps: S211, input unbalanced training set; S212, calculate the proportion of majority class samples in its near neighbors for each minority class; S213, determine whether , then go to step S215, otherwise go to step S214; S214, discard the sample; S215, marked as boundary sample; S216, generate new samples based on the safe generation direction and feature value constraints; S217, determine whether the new sample meets the quality requirements, yes go to step S218, otherwise go to step S216; S218, join the synthetic dataset; S219, determine whether the new sample meets the quality requirements, yes to step S220, otherwise to step S216; S220, output the balanced sample set.

[0084] The role of step S2 is: in view of the class imbalance problem that the majority class (normal traffic) is much more than the minority class (attack traffic) in the training set, this step innovatively proposes an active boundary oversampling algorithm. Instead of simply interpolating within the minority class, it uses the gap information between classes (between the minority class and the majority class) to generate new synthetic minority class samples in the safe direction away from the majority class and close to the real minority class, thereby actively optimizing and strengthening the classification decision boundary and improving the model's recognition sensitivity to the minority class.

[0085] Step S3, construct a branch convolutional neural network model, design independent branch networks for different protocol layers, realize joint identification of complex patterns across protocol layers through fusion and classification mechanism, and distinguish normal and various abnormal traffic.

[0086] In this embodiment, step S3 can specifically include the following steps: S31, perform multi-protocol layer input splitting and branch design.

[0087] The model input is a feature matrix with shape After the input layer, it is immediately split into independent feature vectors by row (protocol layer), and the length of each vector is (the actual length after removing the filled zeros may be different).

[0088] In TensorFlow or PyTorch, this splitting operation can be implemented using slice or custom layers.

[0089] Design an independent branch CNN for each protocol layer. Each branch usually includes: One-dimensional convolution layer (Conv1D): use multiple convolution kernels to slide on the feature vector to extract local correlation features. For example, the transmission layer branch may use a larger convolution kernel to capture the port number range pattern.

[0090] Activation function (ReLU): , introduce nonlinearity to enable the network to learn complex patterns.

[0091] Batch normalization layer (BatchNorm): standardize the convolution output, accelerate training convergence, and improve stability.

[0092] Pooling layer (MaxPooling1D / AvgPooling1D): Reduce feature dimension, preserve significant features, and provide a certain degree of translation invariance.

[0093] Fully connected layer (Dense): Combine learned high-level features.

[0094] Example (Transport layer branch enhancement): Introduce a lightweight attention module after the convolutional layer, allowing the network to automatically learn which features (such as specific TCP flag combinations) are more important. For example, use a fully connected layer to generate attention weights Then multiply the weights with the feature maps element by element .

[0095] The end of each branch is passed through a fully connected layer to unify the dimension of its output feature vector to a fixed value (such as 128 dimensions), denoted as .

[0096] Prepare for subsequent feature fusion, ensuring that the outputs of different branches are consistent in dimension.

[0097] The role of step S31 is to disassemble the structured feature matrix according to the protocol layer and input it into a specially designed subnetwork to achieve professionalization of feature learning.

[0098] S32, cross-branch feature fusion.

[0099] The output vectors of branches are directly concatenated in the feature dimension to form a long vector . .

[0100] Advantages: simple and direct, preserving all original branch information.

[0101] Attention weighted fusion (Attentive Fusion): Introduce an attention network to dynamically calculate the importance weights of each branch.

[0102] Calculate attention score: For each branch vector , calculate a scalar score through a small fully connected network (or shared fully connected layer): where and are learnable parameters.

[0103] Normalize as weight: Use the softmax function to convert the score to weight: where: represents the importance of the branch to the current detection task.

[0104] Weighted sum: get the fused vector: .

[0105] Make the model able to dynamically adjust the attention to different protocol layer features according to different traffic patterns (such as whether it is an application layer attack), and realize more intelligent feature fusion.

[0106] The fused vector is further nonlinearly transformed and reduced dimension by one or more fully connected layers, preparing for the final classification.

[0107] The role of step S32 is to effectively integrate the feature vectors learned by each branch, which represent different protocol layer information, to form a global and unified representation of network traffic.

[0108] S33, after the fusion layer, connect the classification head to build the output layer.

[0109] After the fusion layer, connect a classification head composed of 2-3 fully connected layers. The number of neurons in these layers decreases layer by layer (such as 256 -> 128), and each layer is usually followed by ReLU activation and Dropout regularization.

[0110] Dropout randomly sets the output of the last layer of neurons to zero with a probability (such as 0.5) during training. This is an effective regularization method that can prevent overfitting between neurons and reduce overfitting.

[0111] The last layer of the classification head is the output layer, whose number of neurons is equal to the total number of categories.

[0112] Multi-classification (such as normal, DDoS, port scanning, SQL injection…): use the Softmax function: where: is the original output (logits) of the i-th neuron of the output layer. Softmax converts logits into a probability distribution, and the sum is 1.

[0113] Binary classification (normal / abnormal): Sigmoid function can be used: where: is the logits of a single output neuron.

[0114] In the entire network structure, BatchNorm and Dropout are strategically placed between layers to work together to improve the generalization ability of the model.​

[0115] Final architecture: input -> L independent branch CNN -> feature fusion layer -> fully connected classification head -> Softmax / Sigmoid output.

[0116] The role of step S33 is to perform the final classification decision based on the fused global features and output the probability of belonging to each class (normal or specific attack type).

[0117] The role of step S3 is to design a deep learning model optimized for multi-protocol layer feature matrix. By designing independent branch networks for different protocol layers, it can learn specific features for each layer's data structure. Finally, through fusion and classification mechanism, it realizes the joint recognition of cross-protocol layer complex patterns, and accurately distinguishes normal and various abnormal traffic.

[0118] Step S4, using the balanced training data to supervise the training of the branch convolutional neural network model, optimize the model parameters, evaluate on the test set that maintains the original distribution, and iterate the model according to the results.

[0119] In this embodiment, step S4 can specifically include the following steps: S41, loss function design and model compilation.

[0120] To solve the slight imbalance or importance difference of different attack types after oversampling, weighted cross-entropy loss is used.

[0121] Formula (multi-classification): , where: : batch size. : number of classes. : true label (one-hot encoding) of sample , belonging to class is 1, otherwise 0. : probability of model predicting that sample belongs to class . : weight of class . Usually inversely proportional to the frequency of the class, or manually set according to business sensitivity (e.g. give higher weight to attack types with high false negative cost).

[0122] By assigning higher loss weights to minority classes or important classes, the model is forced to pay more attention to the classification correctness of these classes during training.

[0123] In order to promote each branch to learn diversified and protocol-specific features and avoid branch convergence, a regularization term is added. The formula is: where: is the output vector of the th branch (computed over the batch). The mean or sum of the variances over the dimensions of this vector is computed.

[0124] Maximizing the variance of the output vectors of each branch encourages them to explore different regions of the feature space, thus learning more discriminative protocol-level representations.

[0125] The total loss is: where is a balancing hyperparameter (usually set to 0.1).

[0126] The optimizer used is the Adam optimizer. It combines the advantages of momentum (Momentum) and adaptive learning rate (RMSProp), and its update rule can automatically adjust the learning rate of each parameter, which is usually faster and more stable in practice. Its core formula involves computing the first and second moment estimates of the gradient and making bias corrections.

[0127] The role of step S41 is to define the goal of model optimization, guiding the training process to improve the overall classification accuracy and enhance the specificity of each branch learning.

[0128] S42, using training strategy, training process monitoring.

[0129] From the balanced training set after oversampling, a part (such as 20%) is divided as a validation set. The validation set does not participate in gradient update, and is only used to evaluate the model generalization ability.

[0130] Real-time data augmentation (such as adding slight random noise to the feature matrix or randomly masking rows) can be used to increase data diversity without changing the label, further improving model robustness.

[0131] Embed callback functions (Callbacks) in the training loop.

[0132] Early stopping (Early Stopping): Monitor the validation set loss. When it does not decrease for consecutive periods (patience, such as 10), automatically terminate training to avoid overfitting.

[0133] Model checkpoint (Model Checkpoint): Save model parameters regularly (such as every epoch) or when the validation set index reaches the best, ensuring that the optimal model is always retained.

[0134] Learning rate scheduling (ReduceLROnPlateau): When the validation set metric stagnates, automatically reduce the learning rate to facilitate the model to converge to a better local minimum.

[0135] Set the batch size (Batch Size, such as 64, 128), initial learning rate, and number of training epochs (Epochs). Different initial learning rates can be set for different branches (for example, the application layer branch structure may be more complex and require a smaller learning rate).

[0136] The function of step S42 is to efficiently and stably train the model and monitor its performance in real time to prevent overfitting and save the best model.

[0137] S43, multi-dimensional performance evaluation and model optimization.

[0138] A series of indicators are calculated based on the confusion matrix (Confusion Matrix). Let TP be the true positive, FP be the false positive, TN be the true negative, and FN be the false negative.

[0139] Precision: Measures how many of the alerts reported by the model are true attacks. High precision means low false positives.

[0140] Recall: Measures how many of the actual attacks are successfully detected by the model. High recall means low false negatives.

[0141] F1 Score: The harmonic mean of precision and recall, which is the core indicator for evaluating the detection ability of the model.

[0142] For multi-classification problems, calculate P, R, and F1 for each abnormal class, then take the arithmetic mean (macro-average) or weighted average according to the support (weighted average) to comprehensively evaluate the detection ability of each type of attack.

[0143] Business impact and performance efficiency indicators include false positive rate, false negative rate, inference delay and throughput, and AUC-ROC curve, etc.

[0144] False positive rate (FPR): .

[0145] False negative rate (FNR): .

[0146] Inference delay and throughput: the average time (delay) for the model to process a single sample and the number of samples (throughput) that can be processed per unit of time (such as per second).

[0147] AUC-ROC curve: draw the curve with FPR as the horizontal axis and TPR (Recall) as the vertical axis, and calculate the area under the curve (AUC). The closer the AUC is to 1, the better the overall ranking ability of the model.

[0148] These indicators evaluate the model from the actual deployment perspective of operation and maintenance burden (false positives), security risks (false negatives), real-time requirements (delays), and system load (throughput).

[0149] According to the evaluation results, perform hyperparameter tuning (such as using grid search, random search, or Bayesian optimization to adjust the number of CNN layers, the number of convolution kernels, the learning rate, value, etc.) or lightweight architecture adjustment (such as increasing / decreasing the depth of a certain branch).

[0150] Automated tuning tools such as Keras Tuner or Optuna are used to assist in the completion of the tuning process. The tuning process is performed on the validation set, and the final performance is measured on the test set.

[0151] The purpose of step S43 is to comprehensively evaluate the performance of the model on an independent test set that maintains the original unbalanced distribution, understand its advantages and disadvantages from multiple dimensions, and guide subsequent model optimization.

[0152] The purpose of step S4 is to use balanced training data to perform supervised training on the constructed multi-branch CNN, and through the use of a carefully designed loss function and optimization strategy, the model parameters are optimized. Subsequently, a comprehensive evaluation is performed on the test set that maintains the original distribution, and the model is iteratively optimized based on the results.

[0153] Step S5 deploys the trained and optimized branch convolutional neural network model to the production environment for real-time traffic intrusion detection.

[0154] In this embodiment, step S5 can specifically include the following steps: S51, deploy the trained and optimized branch convolutional neural network model to the production environment to capture network traffic data in real time.

[0155] Using DPDK (Data Plane Development Kit) or PF_RING ZC (Zero Copy) kernel bypass, directly map the network card data to the user space, bypass the operating system kernel protocol stack, and achieve microsecond-level packet capture to meet the needs of high-throughput environments.

[0156] Based on the five-tuple (source IP, destination IP, protocol, source port, and destination port), the data packets are aggregated into flow sessions. A sliding time window (such as 60 seconds) or a session end flag (such as TCP FIN) is set to define a detection unit.

[0157] Maintain a Flow Table in memory, updating the statistical features of flows (e.g. packet count, byte total, duration, etc.) in real-time.

[0158] For each detection unit (a set of packets within a flow or a time window), run the same protocol parsing and feature extraction logic as in Step 1.2. The key point is that the same encoding mappings (e.g. IP hash table, label encoder) and the same normalization parameters (mean , standard deviation , minimum , maximum ) calculated from the training set must be used for transformation, ensuring consistency of the feature space.

[0159] The role of Step S51 is to continuously capture network traffic with extremely low latency and quickly convert it into a feature matrix consistent with the format during training.

[0160] S52, load the trained branch convolutional neural network model into memory and build an inference pipeline to predict the real-time generated feature matrix.

[0161] Use inference optimization frameworks such as TensorRT (NVIDIA), OpenVINO (Intel), or ONNX Runtime to convert and optimize the trained model. These frameworks can perform graph optimization, layer fusion, precision calibration (e.g. FP16 / INT8 quantization), significantly improving inference speed and reducing resource consumption.

[0162] Pipeline feature extraction and model inference. For example, use multi-threading or asynchronous programming: thread A is responsible for packet capture and flow reorganization, thread B is responsible for feature extraction, and thread C is responsible for model inference. Data is passed between parts through a lock-free queue to achieve parallel processing.

[0163] Input the preprocessed feature matrix into the optimized model. The model outputs the probability of each class. Set a detection threshold (e.g. 0.9), when the maximum probability value exceeds the threshold and the corresponding class is not "normal", it is determined as an intrusion.

[0164] The role of Step S52 is to load the trained model into memory and build an efficient inference pipeline to quickly predict the real-time generated feature matrix.

[0165] S53, convert the detection results of the branch convolutional neural network model into alarm information, and execute response actions according to the pre-defined security policy.

[0166] The alert information containing rich context is generated, and the format can adopt JSON or CEF (Common Event Format). The necessary fields include timestamp, five-tuple information, detected attack type, confidence score, and feature summary triggering the alert (such as abnormal TCP flag combination, suspicious HTTP request path).

[0167] A hierarchical response is implemented according to the attack type and confidence.

[0168] High-confidence and high-risk attack: Trigger automatic blocking by calling the firewall API (such as RESTful interface) to dynamically add rules and isolate the attack source IP in real time.

[0169] Medium-confidence or medium-risk attack: Generate a work order and notify the security operation center (SOC) analyst for manual research and judgment.

[0170] Low-confidence: Only record to the log or store in the "suspicious event library" for subsequent correlation analysis.

[0171] Through SIEM (Security Information and Event Management) integration, the alert is pushed to the SOC platform, and correlation analysis is performed with the alerts of other security devices (such as EDR and threat intelligence platform) to form a more comprehensive attack view. The threat intelligence input in the STIX / TAXII standard format is supported, so that the model can update the detection logic based on real-time intelligence for malicious IP or domain name.

[0172] The function of step S53 is to convert the detection results of the model into operable alert information, and automatically or manually execute response actions according to the predefined security policy.

[0173] The function of step S5 is to deploy the trained and optimized model to the production environment for online analysis of real-time network traffic, to immediately discover intrusion behaviors and trigger response mechanisms, and to realize real-time perception and disposal of security threats.

[0174] In step S6, the feedback of the branch convolutional neural network model in the real environment and new network threat samples are continuously collected, and the branch convolutional neural network model is updated and optimized using this information.

[0175] In this embodiment, step S6 can specifically include the following steps: S61, continuously collect feedback data of the branch convolutional neural network model in the real environment, and manage the sample library.

[0176] In the SOC platform or custom management interface, feedback buttons for confirming, false positives, and false negatives (supplement) are provided for each alert. The operation results of the analysts are automatically recorded and associated with the original traffic data.

[0177] Build a versioned sample repository. Not only store the original traffic feature matrix and final labels, but also store: Feedback labels: Analyst-confirmed results.

[0178] Correlation metadata: Time, source probe, original confidence, etc.

[0179] Sample source: From historical data, active oversampling generation, or real environment feedback.

[0180] Use a database (such as PostgreSQL) or a distributed file system (such as HDFS) for management, and use Git-like version control ideas to track changes to the dataset.

[0181] For high-confidence but model-unrecognized abnormal traffic (i.e., the model judges as unknown or classification error with high confidence), after sandbox analysis, threat intelligence comparison, or expert analysis, perform manual labeling and add it to the warehouse as a new type of attack sample.

[0182] The role of step S61 is to systematically collect the results of manual verification of model output (including alarms and false negatives), as well as newly emerging unknown threat data, forming a high-quality incremental dataset.

[0183] S62, based on a three-dimensional evaluation system, to monitor the performance of branch convolutional neural network model.

[0184] Regularly calculate the macro-average F1 score and recall rate of each category on an independent test set containing new threats. Focus on whether the recall rate of the minority class (especially new attacks) meets the standard.

[0185] Statistical production environment model daily false alarm number, average detection time (MTTD). Set threshold, when the false alarm rate rises to affect the operation and maintenance efficiency, or the detection time of a certain type of high-hazard attack is too long, trigger an alarm.

[0186] The average detection time formula is: Where: is the number of confirmed attack events. It can directly measure the real-time performance of detection.

[0187] Monitor the CPU / memory / GPU usage of the deployment server, the P99 delay (99% request response time) and throughput of model inference. Ensure that model updates do not cause resource overload or performance degradation, and cannot meet real-time requirements.

[0188] The role of step S62 is to regularly or before model update, use a comprehensive evaluation system that goes beyond traditional accuracy to measure the practical value of the model, providing data support for update decisions.

[0189] S63, branch convolutional neural network model incremental update and security deployment.

[0190] Incremental learning algorithms such as Elastic Weight Consolidation (EWC) are used. The core idea of EWC is to impose constraints on parameters important to old tasks in the model when training new data, preventing them from changing dramatically. Its loss function is:

[0191] Where: is the model parameter. is the parameter The Fisher information matrix on the old task is diagonally approximated importance. is the parameter value of the old model (good performance on old tasks). is the super parameter that balances the importance of new and old tasks.

[0192] Make the model learn to detect new threats while not forgetting (or minimizing forgetting) how to detect old threats.

[0193] A / B testing: Deploy the new model (group B) in parallel with the current production model (group A), and direct a small portion (such as 5%) of real-time traffic to group B. Compare the detection results (precision, recall) and resource consumption of both groups within the same time period.

[0194] Canary release: If the A / B test passes, first deploy the new model to a few non-core business area probes and observe the stability and performance over a period of time.

[0195] Hot switching: Design the service architecture so that the model runs as an independent service (such as a gRPC microservice). When updating, first start the service instance loaded with the new model, then gradually switch traffic from the old instance to the new instance, achieving seamless upgrade without restarting the detection service.

[0196] Rollback mechanism: Keep the model files and service configurations of the last few versions. Once serious problems (such as a surge in false positives) are found after the new model goes live, immediately switch traffic back to the previous stable version.

[0197] The role of step S63 is to retrain or fine-tune the existing model using the new accumulated data in a safe and controllable manner, and smoothly deploy the new model with better performance to the production environment.

[0198] The role of step S6 is to establish a closed-loop system that continuously collects prediction feedback and new network threat samples in real-world environments, and uses this information to periodically or trigger updates and optimizations to the model, enabling it to adapt to changing network threat environments.

[0199] The embodiment is implemented, and the beneficial effects are: (1) By utilizing the inter-class difference information, combining the majority class samples and the minority class samples to determine the safe generation direction, ensuring that the new samples are far away from the majority class area and maintain the similarity with the real minority class samples, making the boundary between the majority class and the minority class more clear, helping the convolutional neural network to learn more discriminative features, thereby improving the network intrusion detection and recognition performance, breaking the passive filling mode of the traditional oversampling method, and optimizing the active boundary; (2) Through boundary sample screening, dynamic lambda coefficient mechanism, feature value constraint verification, etc., it is ensured that the sample generation process is controlled and safe, the risk of generating noise samples in the majority class is effectively reduced, and the convolutional neural network is helped to learn more correct features, thereby improving the network intrusion detection and recognition performance, and the controllability and safety are strong; (3) The convolutional neural network architecture with multiple protocol layer branches is adopted, independent branches for protocol layers (network layer, transmission layer and application layer) are created, and then fusion classification is performed, the branches can be optimized according to the feature structure of specific protocol layers, more effectively learn the specificity of each protocol layer, and the fusion classification ensures the learning and identification of cross-protocol layer features, and protocol layer feature intelligent identification can be performed.

[0200] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in a distributed computing environment, in which tasks are performed by remote processing devices connected by a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media, including storage devices.

[0201] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through computer readable instructions, and the computer readable instructions can be stored in a computer readable storage medium. When the program is executed, it can include the processes of the above-mentioned embodiment methods. Among them, the storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0202] It should be understood that although each step in the flowchart of the accompanying drawings is shown in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other orders. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be alternately executed with at least part of other steps or sub-steps or stages of other steps.

[0203] Embodiment two Further reference Figure 3 , as an implementation of the method shown above Figure 1 , the present application provides an embodiment of a network intrusion detection device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied to various electronic devices.

[0204] As shown in Figure 3 , the network intrusion detection device 70 of the present embodiment comprises a preprocessing module 71, a generation module 72, an identification module 73, an optimization module 74, a detection module 75 and an update module 76. Among them: The preprocessing module 71 is used for collecting historical traffic data and structurally preprocessing the historical traffic data; The generation module 72 is used for generating new synthetic minority class samples through active boundary oversampling based on the class gap between normal traffic (majority class) and attack traffic (minority class) according to the preprocessed historical traffic data; The identification module 73 is used for constructing a branch convolutional neural network model, designing an independent branch network for different protocol layers, and realizing joint identification of cross-protocol layer complex patterns through fusion and classification mechanism to distinguish normal and various types of abnormal traffic; An optimization module 74 is configured to perform supervised training on the constructed branch convolutional neural network model using the balanced training data, optimize the model parameters, perform evaluation on a test set maintaining the original distribution, and iteratively optimize the model according to the results; A detection module 75 is configured to deploy the trained and optimized branch convolutional neural network model to a production environment to perform real-time traffic intrusion detection. An update module 76 is configured to continuously collect prediction feedback of the branch convolutional neural network model in a real environment and new network threat samples, and update and optimize the branch convolutional neural network model using the information.

[0205] The embodiment has the following beneficial effects: (1) The inter-class difference information is used to determine the safe generation direction in combination with the majority class samples and the minority class samples, so as to ensure that the new samples are far away from the majority class region and maintain the similarity with the real minority class samples, the boundary between the majority class and the minority class is clearer, the convolutional neural network can learn more discriminative features, the network intrusion detection and recognition performance is improved, the passive filling mode of the traditional oversampling method is broken, and the active boundary can be optimized. (2) The sample generation process is controlled and safe through the boundary sample screening, the dynamic lambda coefficient mechanism, and the feature value constraint verification, the risk of generating noise samples among the majority classes is effectively reduced, the convolutional neural network can learn more correct features, the network intrusion detection and recognition performance is improved, and the controllability and safety are high. (3) The multi-protocol layer branch convolutional neural network architecture is adopted, independent branches for protocol layers (network layer, transmission layer, and application layer) are created, and fusion classification is performed, the branches can be optimized according to the feature structures of specific protocol layers, the specific modes of the protocol layers are more effectively learned, the fusion classification ensures the learning and recognition of cross-protocol layer features, and intelligent identification of protocol layer features can be performed.

[0206] Embodiment Three Further referring to Figure 4 , as an implementation of the method shown in the above Figure 1 , the present application provides another embodiment of a network intrusion detection device, which corresponds to the method embodiment shown in Figure 1 , and the device can be applied to various electronic devices.

[0207] As Figure 4As shown, the network intrusion detection device described in the embodiment includes: a data collection layer-bypass deployment module, specifically including a network traffic probe, a security device log probe, and a unified data collection node; a data processing layer data cleaning and verification module, a protocol analysis and feature extraction module, and a feature engineering processing module; a model training and updating layer sample data management module, a three-dimensional intelligent evaluation module, and a model evolution update module; a data analysis layer-AI analysis engine module, specifically including a multi-branch CNN model, a GNN model-protocol interaction analysis module, and an LSTM model-time series analysis module.

[0208] The embodiment adopts a bypass deployment mode and constructs a network intrusion detection system integrating data collection, preprocessing, intelligent analysis, and model self-evolution. Network data is collected non-invasively by a distributed probe group, deep analysis is performed using a multi-branch convolutional neural network, and innovative three-dimensional evaluation indicators are introduced to ensure continuous optimization of the model. The entire device consists of four core parts: a data collection layer, a data processing layer, a data analysis layer, and a model training and updating layer, forming a complete closed loop from data input to intelligent response and then to self-optimization. The data collection layer-bypass deployment module is connected to the data processing layer and the model training and updating layer, and the data processing layer and the model training and updating layer are connected to the data analysis layer-AI analysis engine module.

[0209] Full bypass deployment is adopted to ensure zero impact on monitored network traffic. Multi-source data fusion can integrate multi-dimensional information such as network traffic, security logs, and system logs. The intelligent analysis core is based on deep learning algorithms to achieve high-precision anomaly detection. Through feedback loops and four-dimensional evaluation, the model can be self-optimized.

[0210] The data collection layer adopts a complete bypass deployment mode, obtaining monitoring data through physical or logical means without being connected in series in the network traffic path. This architecture ensures that the system does not affect normal business operation during failure or maintenance, and avoids network delay and single point failure problems that may be caused by traditional series deployment.

[0211] The network traffic probe deployment method is to obtain network traffic copies through switch port mirroring (SPAN) or network tap (TAP). The collected content includes raw network packets and flow data (NetFlow / sFlow / IPFIX), etc. It supports line-speed capture without packet loss in a gigabit network environment; it has packet slicing function, which can only collect packet headers to reduce storage pressure. The deployment location can be set at the network core switch, data center entrance, key network segment boundary, etc.

[0212] Security device log probes interface with devices such as firewalls, IDS / IPS, WAF, antivirus systems, etc. The collected content includes security event logs, policy hit records, threat intelligence data. Protocols supported include Syslog, SNMP, RESTful API, etc. Real-time parsing of binary or text format logs, extracting key security event fields.

[0213] The collection layer is designed with a unified data aggregation node, responsible for receiving data uploaded by various probes, and performing preliminary processing and buffering. This includes data standardization: converting data from different sources and formats into a unified internal representation format. Time synchronization: applying precise timestamps to all data, supporting cross-data source correlation analysis. Flow control: using back pressure mechanism to prevent data flood from causing system overload. Data encryption: encrypting the transmission channel between probes and aggregation nodes to prevent monitoring data from being stolen.

[0214] After the raw traffic data enters the data processing layer, it goes through a multi-stage preprocessing process and is converted into a feature representation suitable for AI model analysis.

[0215] Data quality checks include integrity verification: checking for the presence of required fields and identifying missing values. Consistency checks: verifying the logical relationship between fields (such as TCP flag combinations). Legitimacy verification: IP address range, port number range, protocol value domain check. Timestamp correction: uniform time format, handling clock drift. Abnormal data processing, including damaged packet processing: CRC check failure, length exception packet discard. Illegal field value processing: enumeration value out of bounds, numerical overflow field repair or marking. Duplicate record identification: based on unique identifier (five tuple + timestamp) to remove duplicates. Missing value processing: intelligent filling based on context or safe discarding.

[0216] Deep packet analysis (DPI) engine includes protocol identification: protocol identification based on port, payload characteristics, and behavior patterns. Dynamic protocol discovery: machine learning assisted unknown protocol identification. Encrypted traffic analysis: TLS / SSL handshake information extraction, JA3 / JA3s fingerprint generation. Application layer protocol analysis: HTTP, DNS, FTP, SMTP protocol field extraction. Key field extraction, including network layer fields: source / destination IP, protocol type, TTL, service type. Transport layer fields: source / destination port, TCP flags, window size, sequence number. Application layer fields: HTTP method / status code, DNS query type, SSL version number.

[0217] Feature engineering process includes numerical encoding, including numerical encoding strategies: one-hot encoding: suitable for unordered categorical variables (such as protocol type). Label encoding: suitable for ordered categorical variables (such as TCP priority). Hash encoding: suitable for high base features (such as IP address, user agent). Standardization process, including Z-score standardization: standardize continuous numerical features. Min-max scaling: scale bounded features to the [0, 1] range. Robust standardization: use median and interquartile range, resistant to outliers. Piecewise standardization: use different standardization strategies for different distributions of features.

[0218] The AI analysis engine module is the intelligent core of the device, which uses a multi-branch convolutional neural network model to analyze the preprocessed feature matrix in real time.

[0219] Figure 5 is another embodiment of the AI analysis engine module structure used in the network intrusion detection device of the present application. As shown in Figure 5 The input layer is used to receive the feature matrix generated in the first step, with a shape of (protocol layer number, feature number). The feature matrix is split into independent feature vectors according to the protocol layer, and each vector corresponds to a protocol layer. For each protocol layer vector, identify and remove the filled zeros to obtain multiple feature vectors of different dimensions, each containing the features of the corresponding protocol layer.

[0220] The input features of the network layer branch include: source IP address encoding, destination IP address encoding, protocol type, time to live (TTL), packet length, IP header length, fragmentation flag, service type, etc. Network layer features mainly describe the properties and behaviors of packets at the network layer, so this branch aims to learn the spatial distribution of IP addresses, the usage patterns of protocol types, and the statistical rules of TTL and other features. The input layer receives the input. Convolutional layer 1 uses multiple one-dimensional convolution kernels (e.g. 32, kernel size = 3) for feature extraction, with ReLU as the activation function. The batch normalization layer performs batch normalization on the convolutional output, accelerating training and improving stability. Convolutional layer 2 uses 64 one-dimensional convolution kernels (kernel size = 3) to extract features again, then uses ReLU activation. The pooling layer uses global max pooling to convert the feature map to a fixed-length vector. The fully connected layer connects the pooled features to a 128-dimensional fully connected layer, then uses Dropout (e.g. 0.5) to prevent overfitting. The output is a 128-dimensional feature vector, which is the output of the network layer branch.

[0221] The transport layer branch input features include: source port number, destination port number, TCP flag combination, window size, urgent pointer, sequence number, acknowledgement number, transport layer header length, protocol option, payload size, retransmission flag, etc. The transport layer features reflect the status and quality of end-to-end communication, and this branch aims to learn the port sequence pattern, TCP flag combination, and flow control features (such as window size), etc. The input layer receives the input. The convolutional layer 1 uses 32 one-dimensional convolution kernels (kernel size = 5) with ReLU as the activation function. A larger kernel size is chosen to capture the local relationship between port numbers (e.g. port range). The batch normalization layer performs batch normalization on the convolutional output. The convolutional layer 2 uses 64 one-dimensional convolution kernels (kernel size = 3) with ReLU as the activation function. The attention mechanism introduces a lightweight attention module to weight the feature maps of the convolutional output to highlight important features. This attention module can be a simple fully connected layer that outputs weights of the same length as the feature maps, which are then multiplied point-by-point with the feature maps. The pooling layer uses global average pooling. The fully connected layer connects the pooled features to a 128-dimensional fully connected layer with Dropout (0.5). The output is a 128-dimensional feature vector as the output of the transport layer branch.

[0222] The application layer branch input features include: HTTP method type, HTTP status code, content type, content length, user agent encoding, SSL / TLS version, encryption suite, certificate type, DNS query type, DNS response code, FTP command, SMTP command, etc. The application layer features reveal the specific behavior of the application layer protocol, and this branch needs to learn the commands, status codes, and payload features of the application layer protocol, etc. Input: receives the input. Convolutional layer: uses 64 one-dimensional convolution kernels (kernel size = 3) with ReLU as the activation function. The batch normalization layer performs batch normalization on the convolutional output. Convolutional layer 2 uses 128 one-dimensional convolution kernels (kernel size = 3) with ReLU as the activation function. The global max pooling layer pools the feature maps into a fixed length vector. The fully connected layer connects the pooled features to a 128-dimensional fully connected layer with Dropout (0.5). The output is a 128-dimensional feature vector as the output of the application layer branch.

[0223] The attention network concatenates the output feature vectors of the multiple branches into a feature matrix, and then calculates the weight of each branch feature through an attention network. The feature vector of each branch is converted into an attention score through a fully connected layer (which can be the same or different). The softmax function is used to convert the three scores into weights, which represent the importance of each branch to the current detection task. The feature vectors of each branch are multiplied by the corresponding weights, and then summed to obtain the fused feature vector.

[0224] The fused feature vector is classified by a fully connected layer: fully connected layer 1: 256 nodes, using ReLU activation, with Dropout to prevent overfitting. Fully connected layer 2: 128 nodes, using ReLU activation, with Dropout. Output layer: number of nodes equal to the number of classes (normal and multiple abnormal types), using a Softmax activation function (multi-classification) or Sigmoid (binary classification).

[0225] The AI analysis engine can also integrate various neural network analysis models, such as a GNN model for protocol interaction analysis and an LSTM model for time series analysis.

[0226] The sample warehouse stores historical network traffic data and corresponding labels, and automatically associates the original traffic with the corresponding labels through association rules (such as matching timestamps and five-tuples), generating a labeled (normal / abnormal type) training dataset, greatly reducing the cost of manual labeling.

[0227] By accurately identifying key minority class samples in the training set located at the classification decision boundary, filtering out outliers and noise, intelligent sample balancing can be achieved. Based on the filtered boundary samples and near neighbor majority and minority class samples in the feature space, new samples are generated, and feature value constraints are introduced to reasonably generate new samples. The generated new samples are verified to ensure that they meet the quality requirements, otherwise they are discarded and regenerated.

[0228] Sample version control can track the change history of the training dataset.

[0229] A three-dimensional evaluation index system can comprehensively measure the practical value of the model.

[0230] The performance dimension can be detected, specifically: Precision: The proportion of true threats in the detection results, measures the accuracy of the alarm, the calculation formula is P=TP / (TP+FP), TP is the true positive, and FP is the false positive.

[0231] Recall: The proportion of successfully detected actual threats, measures the detection coverage, the calculation formula is R=TP / (TP+FN), TP is the true positive, and FN is the false negative.

[0232] F1 score: The harmonic mean of precision and recall, comprehensive evaluation of detection ability, F1=2*P*R / (p+r).

[0233] Classification accuracy: The detection accuracy of attack types, the calculation formula is A=(TP+TN) / (TP+TN+FP+FN), TN is the true negative.

[0234] In terms of business impact dimensions, the following are involved: false positive rate: the proportion of normal traffic misjudged as attack, directly affecting the operation and maintenance efficiency, the calculation formula is FPR = FP / (FP+TN). False negative rate: the proportion of real attacks that are not detected, reflecting the security risk, the calculation formula is FNR = FN / (TP+FN). Average detection time: the time interval from attack occurrence to alarm generation, the calculation formula is T = ∑ti / n. Confidence distribution: the confidence distribution of the model judgment result, which can be represented by the mean and standard deviation of the confidence.

[0235] In terms of performance efficiency dimensions, the following are involved: inference delay: the time required for a single detection, affecting real-time performance, the calculation formula is L = ∑li / m. Throughput: the amount of traffic data that can be processed per unit time, the calculation formula is N / T, N is the total number of samples processed, and T is the total time. Resource occupation: CPU / memory / GPU resource consumption, such as CPU usage and memory usage, which can be obtained through system monitoring tools. Concurrent capability: the ability to handle multiple detection tasks simultaneously, which can be measured by the maximum number of concurrent connections or the number of traffic sessions handled simultaneously.

[0236] By setting up a model updating process, the model can be continuously optimized. Triggering conditions: regular updates (such as weekly / monthly), performance threshold triggering (such as recall rate falling below a threshold), emergence of new threat types, and significant changes in network environment. Incremental training: incremental learning of existing models based on newly collected samples, application of transfer learning techniques to quickly adapt to new threats, control of catastrophic forgetting, and maintenance of original detection capabilities. Evaluation and verification: comprehensive evaluation in four dimensions on an independent test set, A / B testing to compare the performance of new and old models, business impact evaluation to ensure that the update does not cause a surge in false positives. Deployment and release: canary release, first small-scale deployment to verify stability. Hot switching technology, no need to restart the service to complete the model update. Rollback mechanism, quickly recover to the previous version when problems are found.

[0237] The implementation of the embodiment has the following beneficial effects: (1) By utilizing the inter-class difference information, combining the majority class samples and the minority class samples to determine the security generation direction, ensuring that the new samples are far away from the majority class region and maintain similarity with the real minority class samples, making the boundary between the majority class and the minority class more clear, helping the convolutional neural network to learn more discriminative features, thereby improving the network intrusion detection and recognition performance, breaking the passive filling mode of traditional oversampling method, and optimizing the active boundary. (2) Through boundary sample screening, dynamic lambda coefficient mechanism, and feature value constraint verification, the sample generation process is controlled and safe, effectively reducing the risk of generating noise samples among the majority classes, helping the convolutional neural network to learn more correct features, thereby improving the network intrusion detection and recognition performance, and having strong controllability and safety. (3) The multi-protocol layer branch convolutional neural network architecture is adopted to create independent branches for the protocol layers (network layer, transmission layer and application layer) and then fuse the classification, the branches can be optimized according to the specific feature structure of the specific protocol layer, the specific modes of the protocol layers can be learned more effectively, the fusion classification can ensure the learning and identification of the cross-protocol layer features, and the protocol layer feature intelligent identification can be performed.

[0238] Embodiment Four To solve the above technical problems, the embodiment of the present application further provides a computer device. For details, please refer to Figure 6 , Figure 6 The basic structure block diagram of the computer device of the present embodiment is shown in the figure.

[0239] The computer device 8 includes a memory 81, a processor 82 and a network interface 83 which are connected to each other through a system bus. It should be pointed out that only the computer device 8 with the components of the memory 81, the processor 82 and the network interface 83 is shown in the figure, but it should be understood that it is not required to implement all the shown components, and more or less components can be alternatively implemented. Among them, the computer device herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, which hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0240] The computer device can be a desktop computer, a notebook computer, a palm computer and a cloud server, etc. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad or a voice control device, etc.

[0241] The memory 81 includes at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 81 can be an internal storage unit of the computer device 8, such as a hard disk or a memory of the computer device 8. In other embodiments, the memory 81 can also be an external storage device of the computer device 8, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 8. Of course, the memory 81 can also include both the internal storage unit and the external storage device of the computer device 8. In this embodiment, the memory 81 is generally used to store an operating system and various application software installed on the computer device 8, such as computer readable instructions of the network intrusion detection method, etc. In addition, the memory 81 can also be used to temporarily store various data that have been output or will be output.

[0242] The processor 82 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 82 is generally used to control the overall operation of the computer device 8. In this embodiment, the processor 82 is used to run computer readable instructions or process data stored in the memory 81, such as computer readable instructions of the network intrusion detection method.

[0243] The network interface 83 can include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 8 and other electronic devices.

[0244] The implementation of this embodiment has the beneficial effects of breaking the passive filling mode of the traditional oversampling method, optimizing the active boundary, and having strong controllability and safety, and being capable of performing intelligent identification of protocol layer features.

[0245] Embodiment Five The present application also provides another implementation, i.e., a computer readable storage medium storing computer readable instructions, which can be executed by at least one processor to enable the at least one processor to perform the steps of the network intrusion detection method as described above.

[0246] The embodiment is implemented, and the beneficial effects are as follows: the passive filling mode of the traditional oversampling mode is broken, and the active boundary can be optimized; the controllability and safety are high; and the protocol layer feature intelligent identification can be performed.

[0247] Through the above description of the embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be realized by means of software and the necessary general hardware platform, of course, they can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as a ROM / RAM, a magnetic disk, or an optical disk) and includes a plurality of instructions for causing a terminal device (which can be a mobile phone, a computer, a server, an air conditioner, or a network device) to execute the various embodiment methods of the present application.

[0248] Obviously, the above-described embodiments are only some of the embodiments of the present application, not all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be realized in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or equivalently replace some of the technical features. Any equivalent structure made by using the content of the present application specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.

Claims

1. A network intrusion detection method, characterized in that, Includes the following steps: Collect historical traffic data and perform structured preprocessing on the historical traffic data; Based on the preprocessed historical traffic data, and based on the inter-class difference between normal traffic (majority class) and attack traffic (minority class), new synthetic minority class samples are generated through active boundary oversampling. A branched convolutional neural network model is constructed, with independent branch networks designed for different protocol layers. Through fusion and classification mechanisms, joint recognition of complex patterns across protocol layers is achieved, distinguishing normal traffic from various abnormal traffic types. The constructed branch convolutional neural network model is trained in a supervised manner using balanced training data to optimize model parameters. The model is then evaluated on a test set that maintains the original distribution, and the model is iteratively optimized based on the results. Deploy the trained and optimized branch convolutional neural network model to the production environment for real-time traffic intrusion detection; We continuously collect prediction feedback from branch convolutional neural network models in real-world environments and new network threat samples, and use this information to update and optimize the branch convolutional neural network models.

2. The network intrusion detection method according to claim 1, characterized in that, The steps of collecting historical traffic data and performing structured preprocessing on the historical traffic data specifically include: Collect the historical traffic data; The historical traffic data is parsed to construct a multi-protocol layer feature matrix; Data sets are partitioned and preprocessed based on the feature matrix of the multi-protocol layer.

3. The network intrusion detection method according to claim 1, characterized in that, The step of generating new synthetic minority class samples by actively oversampling the boundary based on the preprocessed historical traffic data and the inter-class difference between normal traffic (majority class) and attack traffic (minority class) specifically includes: Based on the preprocessed historical traffic data, boundary minority sample identification is performed. Based on the identified boundary minority class samples, generate safe orientation synthetic samples; The synthesized samples were subjected to quality verification and screening.

4. The network intrusion detection method according to claim 1, characterized in that, The steps involved in constructing the branched convolutional neural network model, designing independent branch networks for different protocol layers, and achieving joint recognition of complex patterns across protocol layers through fusion and classification mechanisms to distinguish normal traffic from various abnormal traffic types, specifically include: Perform multi-protocol layer input splitting and branching design; Perform cross-branch feature fusion; After the fusion layer, the classification head is connected to build the output layer.

5. The network intrusion detection method according to claim 1, characterized in that, The steps of using balanced training data to perform supervised training on the constructed branch convolutional neural network model, optimizing model parameters, evaluating the model on a test set that maintains the original distribution, and iteratively optimizing the model based on the results specifically include: Design the loss function and compile the model; A training strategy is adopted to monitor the training process; Perform multi-dimensional performance evaluation and model optimization.

6. The network intrusion detection method according to claim 1, characterized in that, The step of deploying the trained and optimized branch convolutional neural network model to the production environment for real-time traffic intrusion detection specifically includes: Deploy the trained and optimized branch convolutional neural network model to the production environment and capture network traffic data in real time; The trained branch convolutional neural network model is loaded into memory, and an inference pipeline is built to predict the feature matrix generated in real time. The detection results of the branched convolutional neural network model are converted into alarm information, and response actions are executed according to predefined security policies.

7. The network intrusion detection method according to any one of claims 1 to 6, characterized in that, The steps of continuously collecting prediction feedback from the branch convolutional neural network model in real-world environments and new network threat samples, and using this information to update and optimize the branch convolutional neural network model, specifically include: Continuously collect feedback data of branched convolutional neural network models in real-world environments and manage the sample library; Performance monitoring of branch convolutional neural network models is conducted based on a three-dimensional evaluation system. Perform incremental updates and secure deployment of branched convolutional neural network models.

8. A network intrusion detection device, characterized in that, include: A preprocessing module is used to collect historical traffic data and perform structured preprocessing on the historical traffic data; The generation module is used to generate new synthetic minority class samples based on the preprocessed historical traffic data and the inter-class difference between normal traffic (majority class) and attack traffic (minority class) through active boundary oversampling. The identification module is used to build a branched convolutional neural network model, designing independent branch networks for different protocol layers. Through fusion and classification mechanisms, it achieves joint identification of complex patterns across protocol layers and distinguishes between normal and various abnormal traffic. The optimization module is used to perform supervised training on the constructed branch convolutional neural network model using balanced training data, optimize the model parameters, evaluate the model on a test set that maintains the original distribution, and iteratively optimize the model based on the results. The detection module is used to deploy the trained and optimized branched convolutional neural network model to the production environment for real-time traffic intrusion detection; The update module is used to continuously collect prediction feedback from the branch convolutional neural network model in real-world environments and new network threat samples, and to use this information to update and optimize the branch convolutional neural network model.

9. A computer device, characterized in that, The method includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the steps of the network intrusion detection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the network intrusion detection method as described in any one of claims 1 to 7.

Images