Network intrusion detection method based on deep learning and related device

Abstract

The invention discloses a deep learning-based network intrusion detection method and a related device. The method comprises the following steps: inputting to-be-detected network traffic into a pre-constructed network intrusion detection model for detection to obtain a network intrusion detection result; the network intrusion detection model adopts a three-dimensional data sequence generation method based on a bidirectional time sliding window, and can effectively capture a local time sequence relationship between adjacent flow groups, thereby remarkably improving the detection precision of the model. Meanwhile, a context position encoding strategy is introduced into an encoder of the model, position information and context information are combined, and a more efficient and more flexible position encoding mode is provided. The encoder is arranged, so that the capability of the model in identifying network traffic abnormity is enhanced, and the fine change of the traffic mode can be more accurately captured.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network intrusion detection method based on deep learning and related devices. BACKGROUND

[0002] With the widespread application of the Internet, the Internet carries more and more complex business and brings new security challenges. The rapid expansion of the Internet leads to the diversification of network traffic types, which hides various potential network threats. These threats include distributed denial of service (DDoS) attacks, port scanning, remote control, and other advanced persistent threats (APTs). APT attacks usually adopt a composite attack strategy, which poses a serious threat to network security.

[0003] In order to prevent these network threats and attacks, a network intrusion detection system (IDS) is usually used to identify abnormal behavior activities. Traditional network intrusion detection methods usually rely on feature matching and anomaly detection techniques. Feature matching method compares the features of known attack patterns, which can quickly identify known attacks, but cannot cope with new or unknown attacks. The anomaly detection method detects abnormal behavior that does not match the normal behavior pattern, but due to the inaccuracy of the definition of normal behavior pattern, it is easy to produce a high false alarm rate.

[0004] With the advancement of technology, machine learning methods have been introduced into the field of network intrusion detection to overcome the limitations of traditional IDS methods. By using machine learning techniques such as random forests, decision trees, and support vector machines, network attack detection efficiency can be effectively improved. However, when faced with large-scale network traffic or high-dimensional feature space, traditional single-dimensional feature analysis methods have been difficult to meet the recognition needs of complex attacks.

[0005] In this context, deep learning technology, as an important branch of machine learning, has gradually been introduced into the field of network intrusion detection (NIDS) with its successful application in image recognition, speech processing, and other fields. Deep learning has shown significant advantages in detecting complex attack patterns and is expected to improve the detection capability of network intrusion detection systems.

[0006] Although deep learning methods have made significant progress in the field of network intrusion detection, there is still room for optimization. On the one hand, existing methods lack sufficient precision when dealing with the local time series relationship of adjacent traffic; on the other hand, most deep learning models fail to fully consider the natural imbalance of data traffic types in actual network environments when dealing with data set imbalance problems, resulting in fluctuations in detection effectiveness under different network environments and data distributions, affecting the stability and accuracy of detection. SUMMARY

[0007] The patent provides a network intrusion detection method based on deep learning and related devices to solve the problems of insufficient local timing modeling accuracy and poor minority class recognition ability in multi-classification of existing network intrusion detection methods.

[0008] To achieve the above object, the application provides the following technical solutions. The first aspect of the application provides a network intrusion detection method based on deep learning, comprising: inputting the network traffic to be detected into a pre-constructed network intrusion detection model for detection to obtain a network intrusion detection result; The construction process of the network intrusion detection model comprises: obtain network traffic data and preprocess it, process the preprocessed network traffic data using a time-based bidirectional sliding window to obtain a network traffic three-dimensional data sequence, and group the network traffic three-dimensional data sequence and the real label of the network traffic into a network traffic data set; use the network traffic data set to train a preset network intrusion detection model to obtain a network intrusion detection model, the preset network intrusion detection model includes a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a fully connected layer, and a softmax function layer; the learnable dynamic embedding layer is used to add a position mark to the start position of the network traffic three-dimensional data sequence to obtain a first data sequence; input the first data sequence into the Transformer encoder integrated with context position encoding to obtain network traffic recognition features; and sequentially pass the network traffic recognition features through the fully connected layer and the softmax function layer to obtain the predicted behavior class of the intrusion network traffic; adjust the parameters of the preset network intrusion detection model by comparing the real label of the network traffic with the predicted behavior class of the network traffic to obtain the network intrusion detection model.

[0009] Further, the position mark in the learnable dynamic embedding layer is a CLS_TOKEN mark, and the CLS_TOKEN mark is a learnable parameter that is updated through the back propagation mechanism according to the loss function of the model during the training process of the network intrusion detection model.

[0010] Further, the input of the first data sequence into the Transformer encoder integrated with context position encoding to obtain network traffic recognition features specifically comprises: perform layer normalization processing on the first data sequence to obtain a second data sequence; input the second data sequence into an attention layer containing context position encoding for processing to obtain a third data sequence; add the obtained first data sequence and the third data sequence by residual to obtain a fourth data sequence; The fourth data sequence is fed into the FNN neural network after being processed by layer normalization to obtain network traffic identification features.

[0011] Furthermore, the step of inputting the second data sequence into an attention layer containing contextual position encoding for processing to obtain the third data sequence specifically involves: The second data sequence is linearly transformed to generate the first query vector, the first key vector, and the first value vector. Calculate the dot product of the first query vector of the current token and the first key vector of the previous token in the second data sequence, and then process it through the sigmoid activation function to generate the first attention matrix;

[0012] Among them, g ij Indicates the threshold value; q i k represents the first query vector of the current token. j The first key vector of the previous token; σ represents the sigmoid activation function; The cumulative position matrix is ​​obtained by summing the results from the first attention matrix. The cumulative position matrix is ​​subjected to integer encoding interpolation to obtain the position encoding matrix; The second attention matrix is ​​obtained by adding the position encoding matrix to the first attention matrix; Perform a softmax operation on the second attention matrix to obtain a third attention matrix with attention weights; The third attention matrix is ​​multiplied by the second value vector to generate the third data sequence.

[0013] Furthermore, the cumulative summation process specifically involves:

[0014] Where, p ij This represents the cumulative threshold value from the j-th token to the i-th token; gik represents the threshold value between the current token i and token k.

[0015] Furthermore, the formula for calculating the positional interpolation used in the integer encoding interpolation process can be expressed as:

[0016] Where e[pij] represents the position embedding vector obtained based on pij interpolation.

[0017] Furthermore, the softmax operation is specifically defined as follows:

[0018] wherein aij is the adjusted attention weight, k j is the key vector of the jth token.

[0019] The second aspect of the present application provides a network intrusion detection system based on deep learning, comprising: The detection module is configured to input the network traffic to be detected into a pre-constructed network intrusion detection model for detection to obtain a network intrusion detection result. The network intrusion detection model construction module, the construction process of the network intrusion detection model, comprises: Obtaining network traffic data and preprocessing, processing the preprocessed network traffic data using a time-based bidirectional sliding window to obtain a network traffic three-dimensional data sequence, and combining the network traffic three-dimensional data sequence and the real label of the network traffic to form a network traffic data set. Training a preset network intrusion detection model using the network traffic data set to obtain a network intrusion detection model, the preset network intrusion detection model comprising a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a fully connected layer, and a softmax function layer; the learnable dynamic embedding layer is configured to add a position mark at the starting position of the three-dimensional data sequence of the network traffic to obtain a first data sequence; inputting the first data sequence into the Transformer encoder integrated with context position encoding to obtain network traffic recognition features; and sequentially passing the network traffic recognition features through the fully connected layer and the softmax function layer to obtain the predicted behavior class of the network traffic. Adjusting the parameters of the preset network intrusion detection model using the real label of the network traffic and the predicted behavior class of the network traffic to obtain the network intrusion detection model.

[0020] The third aspect of the present application provides an electronic device, comprising: a memory, one or more processors; the memory is coupled with the processor; wherein the memory has computer program code stored therein, the computer program code comprises computer instructions, when the computer instructions are executed by the processor, the electronic device executes the steps of the above-mentioned network intrusion detection method based on deep learning.

[0021] The fourth aspect of the present application provides a computer readable storage medium, the computer readable storage medium stores a computer program, the computer program is executed by a processor to realize the steps of the above-mentioned network intrusion detection method based on deep learning.

[0022] Compared with the prior art, the present application has the following advantages: The application provides a network intrusion detection method based on deep learning, constructs a network intrusion detection model, adopts a three-dimensional data sequence generation method based on a bidirectional time sliding window in the network intrusion detection model, can effectively capture local time sequence relationships between adjacent traffic packets, and thus significantly improves the detection accuracy of the model. BRIEF DESCRIPTION OF DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed to be used in the embodiments will be briefly introduced as follows. It should be understood that the following drawings only show some of the embodiments of the application, and therefore should not be regarded as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor on the basis of these drawings.

[0024] Figure 1 The flowchart of the network intrusion detection method based on deep learning of the application; Figure 2 The framework schematic diagram of the BTWTIDS model provided by the application; Figure 3 The bidirectional sliding window in the BTWTIDS model of the application; Figure 4 The structure schematic diagram of the learnable dynamic embedding layer in the BTWTIDS model of the application; Figure 5 The structure schematic diagram of the encoding layer in the BTWTIDS model of the application; Figure 6 The structure schematic diagram of the multi-head self-attention layer in the BTWTIDS model of the application; Figure 7 The structure schematic diagram of the context position encoding layer in the BTWTIDS model of the application; Figure 8 The structure schematic diagram of the network intrusion detection system based on deep learning of the preferred embodiment of the application; Figure 9This is a schematic diagram of the electronic device structure according to a preferred embodiment of the present invention. Detailed Implementation

[0025] To enable those skilled in the art to understand the features and effects of the present invention, the terms and expressions used in the specification and claims are explained and defined in general below. Unless otherwise specified, all technical and scientific terms used herein have the ordinary meaning understood by those skilled in the art regarding the present invention, and in case of conflict, the definitions in this specification shall prevail.

[0026] The theories or mechanisms described and disclosed herein, whether right or wrong, should not in any way limit the scope of the invention, that is, the contents of the invention can be implemented without being limited by any particular theory or mechanism.

[0027] In this document, all features defined by numerical ranges or percentage ranges, such as numerical values, quantities, contents, and concentrations, are for the sake of brevity and convenience only. Accordingly, descriptions of numerical ranges or percentage ranges should be considered as covering and specifically disclosing all possible sub-ranges and individual numerical values ​​(including integers and fractions) within those ranges.

[0028] In this article, unless otherwise specified, “contains,” “includes,” “containing,” “has,” or similar terms cover the meanings of “composed of” and “mainly composed of,” for example, “A contains a” covers the meanings of “A contains a and others” and “A contains only a.”

[0029] For the sake of brevity, not all possible combinations of the technical features in each implementation scheme or embodiment are described herein. Therefore, as long as there is no contradiction in the combination of these technical features, the technical features in each implementation scheme or embodiment can be combined arbitrarily, and all possible combinations should be considered within the scope of this specification.

[0030] Example 1 like Figure 1 As shown in the exemplary embodiment of this disclosure, a network intrusion detection method based on deep learning is provided, including: The network data to be detected is input into a pre-built network intrusion detection model for detection, in order to obtain network intrusion detection results; like Figure 2 As shown, the construction process of the network intrusion detection model (BTWTIDS) includes: S1. Obtain network traffic data and preprocess it. Use a time-based bidirectional sliding window to process the preprocessed network traffic data to obtain a three-dimensional network traffic data sequence. Combine the three-dimensional network traffic data sequence and the real labels of network traffic to form a network traffic dataset. S2, training the preset network intrusion detection model using the network traffic dataset to obtain a network intrusion detection model, the preset network intrusion detection model comprising a learnable dynamic embedding layer; a Transformer encoder integrated with context position encoding, a fully connected layer, and a softmax function layer; the learnable dynamic embedding layer is configured to add position markers to a starting position of a three-dimensional data sequence of network traffic to obtain a first data sequence; the first data sequence is input into the Transformer encoder integrated with context position encoding to obtain network traffic recognition features; the network traffic recognition features are sequentially input into the fully connected layer and the softmax function layer to obtain a predicted behavior category of the network traffic under intrusion; S3, adjusting parameters of the preset network intrusion detection model using a true label of the network traffic and the predicted behavior category of the network traffic to obtain a network intrusion detection model.

[0031] In some embodiments, the network traffic data is obtained and preprocessed in S1, and specific preprocessing steps include: using Numpy and Pandas libraries to clean the network traffic data in the obtained dataset, removing missing values and invalid fields through a data screening mechanism and a screening mechanism; then processing the category type features in the dataset through One-Hot encoding to eliminate the order ambiguity between categories; using the MaxMin normalization method to standardize the numerical type features in the dataset; finally, to address the class imbalance problem (the ratio of normal traffic to attack traffic is about 1:100) in the dataset, the SMOTE oversampling technology is used to enhance the minority class samples, avoiding classification bias caused by large differences in sample quantities during model training.

[0032] As shown in Figure 3 , the network traffic three-dimensional data sequence is obtained by processing the preprocessed network traffic data using a time-based bidirectional sliding window in S1, specifically: setting the data stream length in the dataset as S, and the sliding window length of each data window as w, then there are m non-overlapping data windows on each data stream, and m is calculated through formula (1); (1) respectively taking the m data windows as center windows, and bidirectionally sliding the specified step length r to obtain left and right data windows, if the slid data window exceeds the position of the sequence, 0 is used for padding to maintain the same window length, and N groups of three-dimensional data sequences are obtained after bidirectional sliding window processing, and the construction method is shown in formula (2): (2) wherein, each N m contains a group of three-dimensional data sequences, i.e. .

[0033] The preprocessed network traffic data is input into a bidirectional sliding window to obtain a network traffic three-dimensional data sequence. Through repeated sequence data, the time sequence relationship between sequence units can be extracted and enhanced, thereby improving the overall detection effect of the model.

[0034] The network traffic three-dimensional data sequence and the real label of the network traffic are combined to form a network traffic data set.

[0035] S2, the preset network intrusion detection model is trained by using the network traffic data set to obtain a network intrusion detection model; As shown in Figure 2 The preset network intrusion detection model includes a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a full connection layer, and a softmax function layer. The training process of the preset network intrusion detection model is as follows: S201, the learnable dynamic embedding layer is used to add a position mark at the starting position of the network traffic three-dimensional data sequence to obtain a first data sequence. The first data sequence is a network packet feature, including traffic size, packet time interval, etc. As shown in Figure 4 The position mark is a CLS_TOKEN mark. A learnable parameter CLS_TOKEN mark is introduced in the learnable dynamic embedding layer. The CLS_TOKEN mark is placed at the starting position of the network traffic three-dimensional data sequence to obtain the first data sequence. The first data sequence is a data sequence with position encoding. The CLS_TOKEN mark is used to capture the comprehensive information of the entire network traffic three-dimensional data sequence as the starting position of the entire data sequence.

[0036] It should be noted that the CLS_TOKEN mark is a dynamic parameter, and its value is updated through the back propagation mechanism according to the loss function of the model during the training process of the network intrusion detection model, and the performance of the network intrusion detection model is optimized, so that it can more accurately reflect the characteristics of the input network traffic three-dimensional data sequence. The introduction of the CLS_TOKEN mark aims to enhance the ability of the model to capture key information of the input network traffic three-dimensional data sequence. Specifically, the network intrusion detection task usually involves sequence analysis of network traffic data, and some data contains complex patterns and abnormal behaviors. By adding the CLS_TOKEN mark at the starting position of the network traffic three-dimensional data sequence, the network intrusion detection model can learn the representative features of the entire data sequence, rather than just local information. During the training process of the network intrusion detection model, the parameter value of the CLS_TOKEN mark will be dynamically adjusted according to the recognition accuracy of the network intrusion detection model for intrusion behavior, thereby improving the detection accuracy and efficiency of the model for network intrusion.

[0037] As shown in Figure 5 andFigure 6 As shown, S202, the first data sequence is input into an integrated context position encoding Transformer encoder to obtain network traffic recognition features; The first data sequence is subjected to layer normalization to obtain a second data sequence, and the second data sequence is input into a multi-head self-attention layer containing context position encoding for processing to obtain a third data sequence. The multi-head self-attention layer processes the second data sequence through three different linear transformation layers to obtain h groups (i.e., h attention heads) of first query vectors Q, first key vectors K, and first value vectors V. The h groups of first query vectors Q, first key vectors K, and first value vectors V are input into an attention aggregation module in parallel to obtain h attentions. The outputs of the h attentions are spliced together and converted through another learnable linear projection to generate, as shown in equation (3): (3) Wherein, head i represents the attention of the i-th head. represents the i-th new query vector. represents the i-th new key vector. represents the i-th new value vector. The attentions of all heads are spliced together to obtain multi-head attention, as shown in equation (4): (4) Wherein, as shown in Figure 7 Each attention head of the multi-head attention contains a context position encoding layer, and the specific processing procedure is as follows: First, the dot product of the first query vector of the current token and the first key vector of the previous token in the second data sequence is calculated, and then the sigmoid activation function is processed to generate the first attention matrix, which is calculated as shown in equation (5): (5) Wherein, g ij represents a threshold value; q i represents the first query vector of the current token; k j is the first key vector of the previous token; and σ represents the sigmoid activation function.

[0038] Based on the first attention matrix, a cumulative position matrix is obtained by cumulative summation. The cumulative summation processing is specifically as follows: the threshold value is used to quantify the position relationship of each token relative to the current token, and the cumulative summation is performed between the current token and the target token to achieve, as shown in equation (6): (6) where p ij represents the cumulative threshold value from the jth token to the ith token; g ik represents the gate value between the current token i and token k; The cumulative position matrix can capture the context-aware position information of each vector in the three-dimensional data sequence; Based on the cumulative position matrix, an integer encoding interpolation process is used to obtain a position encoding matrix, and the integer encoding interpolation process is specifically: Unlike traditional token-based position encoding, CoPE allows the position value to be a non-integer value, so it cannot directly assign an embedding vector. CoPE calculates the position embedding by interpolating the embedding vector of the closest integer value. The calculation formula (7) of the position interpolation can be expressed as: (7) where e [p ij] represents the position embedding vector interpolated based on p ij. The position encoding matrix is added to the first attention matrix to obtain a second attention matrix, and the second attention matrix is an attention matrix containing rich context information; this allows the model to not only consider the behavior itself when judging whether the network behavior is an intrusion, but also consider its position and context in the entire network activity sequence.

[0039] The second attention matrix is subjected to a softmax operation to obtain a third attention matrix with attention weights (atten), which reflects the relative importance of each element in the sequence in the attention mechanism. By multiplying the third attention matrix with the first value vector (V), the context position encoding layer generates a final third data sequence; the softmax operation is specifically: CoPE uses these position embeddings to adjust the attention weights, so that the query vector can use them in the attention operation. The adjusted attention weight calculation formula (8) can be expressed as: (8) where a ij is the adjusted attention weight, representing the attention intensity of token j to token i after considering the dynamic position information, and k j is the key vector (key vector) of the jth token; The first data sequence and the third data sequence are subjected to residual connection to obtain a fourth data sequence, The fourth data sequence is subjected to layer normalization processing and then sent to an FNN neural network to obtain network traffic recognition features.

[0040] In the encoder of the network intrusion detection model provided in the application, the context position encoding is embedded, the position encoding of each network packet can be dynamically adjusted according to the specific content (such as source IP, destination IP, protocol type, etc.) of the data sequence, so as to more accurately reflect the time sequence relationship of network behavior, especially in DDoS or scanning attacks, the attack mode may span a long sequence, and the design of CoPE enables the model to more effectively identify the long-distance association; through the gate value calculation and position interpolation introduced by CoPE, the model can more finely judge that certain network packets have a significant impact on the position information of the current packet, thereby improving the accuracy of intrusion detection in complex network environments.

[0041] S203, the network traffic recognition features are sequentially input into the full connection layer and the softmax function layer for binary classification and multi-classification, to obtain the prediction of the attack behavior of the network traffic.

[0042] In some embodiments, the network traffic dataset is divided into a training set, a validation set and a test set, the training set is input into a preset network intrusion detection model for training, the validation set is input into the test set, the trained network intrusion detection model is input into the trained network intrusion detection model, and the model parameters are optimized and adjusted, the test set is input into the optimized network intrusion detection model, and the accuracy of the predicted intrusion network traffic behavior category of the network intrusion detection model is evaluated.

[0043] Embodiment 2 This embodiment is based on the CIC-IDS-2017 dataset to construct and apply to network traffic analysis, as shown in Table 1, the performance of the model in this paper on the CIC-IDS-2017 dataset for binary classification (i.e. normal and abnormal traffic classification) is shown, including accuracy, precision, recall and F1 index. As can be seen from the table, the detection performance of the model for normal traffic and abnormal traffic is ideal, and the accuracy, precision, recall and F1 are all above 99%.

[0044] Table 2 shows the performance of BTWTIDS on the CIC-IDS-2017 dataset for multi-classification. It can be seen that after appropriate sampling expansion of the minority class samples, the detection accuracy of the model for Heartbleed reaches 100%, and the detection accuracy for normal traffic is also as high as 99.8522%. The accuracy is relatively low for the Web Attack-BruteForce category, with an accuracy of 77.955300%. This result may be due to the limitation of the protection mechanism, the behavior frequency of this type of attack is low, the characteristics are not obvious, and there is a certain degree of overlap between the normal access behavior in multiple feature dimensions, thereby reducing the discrimination ability of the model.

[0045] Table 1 Binary classification performance on CIC-IDS-2017 dataset

[0046] Table 2 Multi-classification performance on CIC-IDS-2017 dataset

[0047] In this paper, when using deep learning models for anomaly traffic detection on the CIC-IDS-2017 dataset, the models are compared with other deep learning models in terms of the above four evaluation indicators, and are divided into two categories of comparison, namely binary classification and multi-classification.

[0048] As can be seen from Table 3, the accuracy, precision, recall and F1 index of the model in this paper on binary classification are higher than those of the other several comparison targets. Compared with the TACGAN-IDS model, the model in this paper improves the accuracy by nearly 4% while significantly enhancing the stability. Compared with the stacked LSTM structure (Figueiredo et al.), the model in this paper learns the time series features through an improved Transformer model, so that the model can capture more detailed traffic behavior features and improve the detection accuracy and stability of intrusion detection. Compared with DE-VIT with added deformable attention mechanism, the detection accuracy of the model in this paper is higher, and the granularity of data processing is more detailed. In addition, the model in this paper has an accuracy of nearly 4 percentage points higher than that of the TACGAN-IDS model, and the overall detection index performance is more stable.

[0049] As can be seen from Table 4, the accuracy, precision, recall and F1 index of the model in this paper on multi-classification are higher than those of the other several comparison targets. Compared with the RTIDS using the Encoder-Decoder Transformer model, the model in this paper uses an improved Encoder-only structure Transformer and introduces dynamic position encoding technology, so that the model can better understand the time series relationship between local traffic and improve the detection accuracy. At the same time, the model in this paper is superior to MRIME in terms of detection accuracy and evaluation index.

[0050] Table 3 Comparison of binary classification performance on CIC-IDS-2017 dataset

[0051] Table 4 Comparison of multi-classification performance on CIC-IDS-2017 dataset

[0052] Example 3 As Figure 8As shown, another object of the present application is to provide a deep learning-based network intrusion detection system, comprising: a detection module for inputting the network traffic to be detected into a pre-constructed network intrusion detection model for detection to obtain a network intrusion detection result; a network intrusion detection model construction module, the construction process of the network intrusion detection model comprising: obtaining network traffic data and preprocessing, processing the preprocessed network traffic data using a time-based bidirectional sliding window to obtain a network traffic three-dimensional data sequence, and combining the network traffic three-dimensional data sequence and the real label of the network traffic to form a network traffic data set; training a preset network intrusion detection model using the network traffic data set to obtain a network intrusion detection model, the preset network intrusion detection model comprising a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a fully connected layer, and a softmax function layer; the learnable dynamic embedding layer is used to add position markers to the starting position of the network traffic three-dimensional data sequence to obtain a first data sequence; the first data sequence is input into the Transformer encoder integrated with context position encoding to obtain network traffic recognition features; the network traffic recognition features are sequentially input into the fully connected layer and the softmax function layer to obtain the predicted behavior category of the network traffic; adjusting the parameters of the preset network intrusion detection model using the real label of the network traffic and the predicted behavior category of the network traffic to obtain the network intrusion detection model.

[0053] Embodiment 4 Please refer to Figure 9 As shown, the present application also provides an electronic device 100 for a deep learning-based network intrusion detection method; the electronic device 100 comprises a memory 101, at least one processor 102, a computer program 103 stored in the memory 101 and executable on the at least one processor 102, and at least one communication bus 104.

[0054] The memory 101 can be used to store the computer program 103, and the processor 102 implements the steps of the deep learning-based network intrusion detection method according to Embodiment 1 by running or executing the computer program stored in the memory 101 and calling the data stored in the memory 101. The memory 101 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), and the like; and the data storage area can store data (such as audio data) created according to the use of the electronic device 100. In addition, the memory 101 can include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device.

[0055] The at least one processor 102 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 102 can be a microprocessor or the processor 102 can also be any conventional processor, etc. The processor 102 is the control center of the electronic device 100, and connects all parts of the electronic device 100 through various interfaces and lines.

[0056] The memory 101 in the electronic device 100 stores a plurality of instructions to implement a deep learning-based network intrusion detection method, and the processor 102 can execute the plurality of instructions to implement: inputting the network traffic to be detected into a pre-constructed network intrusion detection model for detection to obtain a network intrusion detection result; The construction process of the network intrusion detection model includes: obtaining network traffic data and preprocessing, processing the preprocessed network traffic data by using a time-based bidirectional sliding window to obtain a network traffic three-dimensional data sequence, and combining the network traffic three-dimensional data sequence and a real label of the network traffic to form a network traffic data set; The preset network intrusion detection model is trained by using a network flow data set to obtain a network intrusion detection model, the preset network intrusion detection model comprising a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a full connection layer, and a softmax function layer; the learnable dynamic embedding layer is configured to add position marks to a starting position of a three-dimensional data sequence of network flow to obtain a first data sequence; the first data sequence is input into the Transformer encoder integrated with context position encoding to obtain network flow recognition features; the network flow recognition features are sequentially input into the full connection layer and the softmax function layer to obtain a predicted behavior category of the network flow. The preset network intrusion detection model is trained by using a network flow data set to obtain a network intrusion detection model, the preset network intrusion detection model comprising a learnable dynamic embedding layer, a Transformer encoder integrated with context position encoding, a full connection layer, and a softmax function layer; the learnable dynamic embedding layer is configured to add position marks to a starting position of a three-dimensional data sequence of network flow to obtain a first data sequence; the first data sequence is input into the Transformer encoder integrated with context position encoding to obtain network flow recognition features; the network flow recognition features are sequentially input into the full connection layer and the softmax function layer to obtain a predicted behavior category of the network flow.

[0057] Embodiment 5 The modules / units integrated in the electronic device 100, if realized in the form of software function units and sold or used as independent products, can be stored in a computer-readable storage medium. Based on such understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer-readable storage medium. When executed by a processor, the computer program can implement the steps of the above-mentioned various method embodiments. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms. The computer-readable medium can include any entity or device capable of carrying the computer program code, recording medium, U disk, mobile hard disk, magnetic disk, optical disk, computer memory, and read-only memory (ROM).

[0058] Those skilled in the art will appreciate that embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Moreover, the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage, etc.) containing computer-usable program code.

[0059] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks. Figure 1 one or more flow or blocks.

[0060] These computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flow or blocks. Figure 1 one or more flow or blocks.

[0061] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flow or blocks. Figure 1 one or more flow or blocks.

[0062] Finally, it should be noted that the above-mentioned embodiments are merely intended to illustrate the technical solutions of the present application, but not to limit the same. Although the present application has been described in detail with reference to the above-mentioned embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalent replaced without departing from the spirit and scope of the present application, and any modification or equivalent replacement should be covered within the scope of protection of the claims of the present application.

Claims

1. A network intrusion detection method based on deep learning, characterized in that, include: The network traffic to be detected is input into a pre-built network intrusion detection model for detection to obtain network intrusion detection results; The construction process of the network intrusion detection model includes: Network traffic data is acquired and preprocessed. A time-based bidirectional sliding window is used to process the preprocessed network traffic data to obtain a three-dimensional network traffic data sequence. The three-dimensional network traffic data sequence and the real labels of network traffic are combined to form a network traffic dataset. A pre-defined network intrusion detection model is trained using a network traffic dataset. This model includes a learnable dynamic embedding layer, a Transformer encoder integrating contextual location encoding, a fully connected layer, and a softmax function layer. The learnable dynamic embedding layer adds position markers to the starting positions of the three-dimensional data sequence of network traffic to obtain a first data sequence. The first data sequence is then input into the Transformer encoder integrating contextual location encoding to obtain network traffic identification features. These features are then passed sequentially through a fully connected layer and a softmax function layer to obtain the predicted behavior category of the intrusive network traffic. The network intrusion detection model is obtained by adjusting the parameters of the preset network intrusion detection model using the actual labels of network traffic and the predicted behavioral categories of network traffic.

2. The network intrusion detection method based on deep learning according to claim 1, characterized in that, The position marker in the learnable dynamic embedding layer is the CLS_TOKEN marker, which is a learnable parameter that is updated during the training of the network intrusion detection model based on the model's loss function through a backpropagation mechanism.

3. The network intrusion detection method based on deep learning according to claim 1, characterized in that, The process of inputting the first data sequence into a Transformer encoder with integrated context location encoding to obtain network traffic identification features specifically involves: The first data sequence is subjected to layer normalization to obtain the second data sequence; The second data sequence is input into an attention layer containing context position encoding for processing to obtain the third data sequence; The residuals of the first data sequence and the third data sequence are added together to obtain the fourth data sequence; The fourth data sequence is fed into the FNN neural network after being processed by layer normalization to obtain network traffic identification features.

4. The network intrusion detection method based on deep learning according to claim 3, characterized in that, The process of inputting the second data sequence into an attention layer containing context position encoding for processing to obtain the third data sequence is as follows: The second data sequence is linearly transformed to generate the first query vector, the first key vector, and the first value vector. Calculate the dot product of the first query vector of the current token and the first key vector of the previous token in the second data sequence, and then process it through the sigmoid activation function to generate the first attention matrix; Among them, g ij Indicates the threshold value; q i k represents the first query vector of the current token. j The first key vector of the previous token; σ represents the sigmoid activation function; The cumulative position matrix is ​​obtained by summing the results from the first attention matrix. The cumulative position matrix is ​​subjected to integer encoding interpolation to obtain the position encoding matrix; The second attention matrix is ​​obtained by adding the position encoding matrix to the first attention matrix; Perform a softmax operation on the second attention matrix to obtain a third attention matrix with attention weights; The third attention matrix is ​​multiplied by the second value vector to generate the third data sequence.

5. The network intrusion detection method based on deep learning according to claim 4, characterized in that, The cumulative summation process is specifically as follows: Where, p ij This represents the cumulative threshold value from the j-th token to the i-th token; gik represents the threshold value between the current token and tokenk.

6. The network intrusion detection method based on deep learning according to claim 4, characterized in that, The formula for calculating positional interpolation used in the integer encoding interpolation process can be expressed as follows: Where e[pij] represents the position embedding vector obtained based on pij interpolation.

7. The network intrusion detection method based on deep learning according to claim 4, characterized in that, The softmax operation is specifically defined as follows: Where aij is the adjusted attention weight, k j It is the key vector of the j-th token.

8. A network intrusion detection system based on deep learning, characterized in that, include: The detection module is used to input the network traffic to be detected into a pre-built network intrusion detection model for detection, so as to obtain network intrusion detection results; A network intrusion detection model construction module, wherein the construction process of the network intrusion detection model includes: Network traffic data is acquired and preprocessed. A time-based bidirectional sliding window is used to process the preprocessed network traffic data to obtain a three-dimensional network traffic data sequence. The three-dimensional network traffic data sequence and the real labels of network traffic are combined to form a network traffic dataset. A pre-defined network intrusion detection model is trained using a network traffic dataset. This model includes a learnable dynamic embedding layer, a Transformer encoder integrating contextual location encoding, a fully connected layer, and a softmax function layer. The learnable dynamic embedding layer adds position markers to the starting positions of the three-dimensional data sequence of network traffic to obtain a first data sequence. The first data sequence is then input into the Transformer encoder integrating contextual location encoding to obtain network traffic identification features. These features are then passed sequentially through a fully connected layer and a softmax function layer to obtain the predicted behavior category of the intrusive network traffic. The network intrusion detection model is obtained by adjusting the parameters of the preset network intrusion detection model using the actual labels of network traffic and the predicted behavioral categories of network traffic.

9. An electronic device, characterized in that, include: A memory, one or more processors; the memory is coupled to the processors; wherein the memory stores computer program code, the computer program code including computer instructions, and when the computer instructions are executed by the processor, the electronic device performs the steps of the deep learning-based network intrusion detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the deep learning-based network intrusion detection method according to any one of claims 1-7.

Images