Online intrusion detection method based on pseudo label confidence perception and dual-classifier collaborative decision and medium

Abstract

The invention discloses an online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision and a medium, and belongs to the field of online intrusion detection under the condition of few labels. According to the method, a confidence coefficient calculation model and a Gaussian classifier are trained in parallel through a small number of labeled samples; in the online detection stage, for each inflowing unmarked sample, the confidence calculation model generates an initial pseudo tag and a corresponding category confidence difference, samples with high classification uncertainty are identified through comparison with a confidence threshold, and samples with low confidence difference are classified through a Gaussian classifier to determine whether attack data is contained or not; the samples of the confidence coefficient calculation model and the pseudo labels decided by the Gaussian classifier are used as an extended training set for regular updating of the model and dynamic adjustment of a confidence coefficient threshold value. According to the method, continuous self-adaptive online learning can be realized, and the dynamic change of network data distribution can be effectively coped with.

Description

Technical Field

[0001] This invention relates to the field of online intrusion detection under conditions with few labels, specifically to an online intrusion detection method and medium based on pseudo-label confidence perception and dual-classifier collaborative decision-making. Background Technology

[0002] With the rapid development of network technology, network attack methods are becoming increasingly complex and covert, making intrusion detection systems a critical line of defense for network security. Traditional intrusion detection methods typically rely on large amounts of high-quality labeled data for model training to accurately distinguish between normal and malicious traffic. However, in real-world network environments, acquiring large amounts of labeled data is costly and time-consuming, and new attacks are constantly emerging, making it difficult for models trained on static datasets to adapt to the dynamically changing network threat environment.

[0003] To address the scarcity of labeled data, semi-supervised learning techniques have been introduced into the field of intrusion detection. These methods augment the model's knowledge by utilizing large amounts of unlabeled data. Pseudo-labeling is a common technique, where predicted labels are assigned to unlabeled data and then added to the training set to update the model. However, existing pseudo-labeling methods have significant drawbacks:

[0004] First, the model lacks an effective assessment of the confidence level of its own predictions, making it prone to using low-confidence erroneous predictions as pseudo-labels. This leads to the accumulation and amplification of errors during model updates. Furthermore, some methods still require manual intervention for sample labeling during their active learning phase, failing to achieve fully automated pseudo-label generation and resulting in efficiency bottlenecks in practical deployments (1. Zhang, Yong, et al. "Network intrusion detection based on active semi-supervised learning." 2021 51st Annual IEEE / IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W). IEEE, 2021.).

[0005] Secondly, most methods rely on a single classifier, and under initial conditions with few labels, the decision boundaries learned by a single classifier are often not accurate or robust enough. For samples with ambiguous confidence, the decision itself is unstable. (2. Dash, Smruti P., Kedar V. Khandeparkar, and Nipun Agrawal. "CRUPL: A Semi-Supervised Cyber ​​Attack Detection with Consistency Regularization and Uncertainty-aware Pseudo-Labeling in Smart Grid." arXiv preprint arXiv:2503.00358 (2025). 3. Nugraha, Beny, et al. "Improving the detection of unknown DDoS attacks through continual learning." 2023 IEEE International Conference on Cyber ​​Security and Resilience (CSR). IEEE, 2023.)

[0006] Therefore, existing technologies lack an online intrusion detection scheme that can effectively evaluate the quality of false labels, prevent error accumulation, and achieve continuous model adaptation under the demanding conditions of few labels and continuous data streams. Summary of the Invention

[0007] The purpose of this invention is to provide an online intrusion detection method and medium based on pseudo-label confidence perception and dual-classifier collaborative decision-making. By using the collaborative decision-making mechanism of dual classifiers to screen high-quality pseudo-labels, the model can achieve stable, efficient and adaptive learning in continuous data streams.

[0008] To achieve the above objectives, the present invention is implemented using the following technical solution.

[0009] In a first aspect, the present invention provides an online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision-making, comprising:

[0010] Obtain the raw data stream;

[0011] The original data stream is preprocessed and input into the confidence calculation model to obtain an intermediate dataset with initial pseudo-labels and class confidence differences;

[0012] Based on the class confidence difference of the intermediate dataset, it is determined whether the confidence threshold is met. If it is met, the prediction result of the confidence calculation model is used to obtain the sample with the final pseudo label. If it is not met, the sample with the final pseudo label is obtained by reclassifying through a Gaussian classifier.

[0013] The intrusion detection results of each sample in the original data stream are obtained by evaluating the samples with the final pseudo-labels.

[0014] The samples with final pseudo-labels and their corresponding class confidence differences obtained from the confidence calculation model and Gaussian classifier decisions are stored in an extended training set. The extended training set is used for updating and training the confidence calculation model and Gaussian classifier, as well as updating the confidence threshold.

[0015] Optionally, the confidence calculation model and the Gaussian classifier are updated and trained using the expanded training set at preset time intervals.

[0016] By training the confidence calculation model and Gaussian classifier at preset intervals to update the model, the accuracy of the model detection is ensured.

[0017] Optionally, the loss function formula used in the confidence calculation model training process is as follows:

[0018] (1)

[0019] in, This represents the model's predicted probability of the true class. γ represents the class weight balancing factor, used to adjust the importance of different classes; γ represents the focusing parameter, used to adjust the weight of hard samples. This represents the Focal Loss function.

[0020] Updating and training the confidence model using the aforementioned loss function improves the model's convergence efficiency.

[0021] Optionally, the update training process of the Gaussian classifier includes:

[0022] Obtain the labeled raw dataset;

[0023] The training set is obtained by feature extraction and standardization based on the labeled dataset;

[0024] Based on the sample data in the training set and the extended training set, a corresponding Gaussian classifier is fitted for each category using the maximum likelihood estimation method.

[0025] The accuracy of intrusion detection results is ensured by using a Gaussian classifier to perform secondary classification on low-confidence samples.

[0026] Optionally, the formula for calculating the category confidence difference is:

[0027] (2)

[0028] in, The confidence score is the confidence score by which the model classifies a sample into class 0. The confidence score is the confidence score used by the confidence calculation model to classify a sample into one category. The category has poor confidence.

[0029] By calculating the confidence difference, low-confidence samples obtained from the confidence calculation model are filtered out, which improves the accuracy of intrusion detection results and avoids the accumulation of erroneous samples that cause the detection results to deviate.

[0030] Optionally, the confidence threshold is adaptively updated based on the expanded training set using a sliding window mechanism, including:

[0031] In response to an increase in the number of samples in the expanded training set, a sliding window is used to obtain the class confidence difference of the latest N samples in the expanded training set.

[0032] When the sliding window slides to a preset number of steps, the Kth percentile of the confidence difference among the N categories within the current sliding window is calculated and updated to the confidence threshold.

[0033] The sliding window mechanism enables dynamic adjustment of the confidence threshold, improving the adaptability of the invention and ensuring the accuracy of intrusion detection results.

[0034] Optionally, the sliding window has a width of 5000, a step size of 1, and a preset number of steps of 1000.

[0035] By storing 1000 samples with final pseudo-labels and their corresponding class confidence differences at intervals, the confidence threshold is dynamically updated by calculating the 10th percentile, which avoids the accumulation and amplification of errors in this invention and improves the accuracy and robustness of the decision boundary.

[0036] Optionally, the value range of the Kth percentile is 70 to 90.

[0037] Setting the K value to 70 to 90 achieves an optimal balance between efficiency and accuracy, establishing a reliable pseudo-label quality assurance system and controlling the data quality of the expanded training set from the source.

[0038] In a second aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision-making as described in the first aspect.

[0039] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0040] This invention improves the accuracy of sample detection and avoids the accumulation of low-confidence samples by using a dual-classifier structure of a confidence calculation model and a Gaussian classifier. By inputting samples with final pseudo-labels into an expanded training set, pseudo-label generation is automated, increasing the training load for both the confidence calculation model and the Gaussian classifier. Updating the confidence threshold through the expanded training set ensures the accuracy and robustness of the decision boundary. Secondary classification using a Gaussian classifier after comparing with the confidence threshold ensures the accuracy of data processing. Therefore, this invention can generate pseudo-labels with high precision, improving the efficiency and accuracy of intrusion detection. Attached Figure Description

[0041] Figure 1 The diagram shows a flowchart of the online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision-making according to the present invention. Detailed Implementation

[0042] The technical solution of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the embodiments of the present invention and the specific features in the embodiments are detailed descriptions of the technical solution of the present invention, rather than limitations thereof. In the absence of conflict, the embodiments of the present invention and the technical features in the embodiments can be combined with each other.

[0043] The term "and / or" simply describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " generally indicates that the preceding and following related objects have an "or" relationship.

[0044] Example 1

[0045] This embodiment introduces an online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision-making;

[0046] The original data stream is preprocessed and then input into the confidence calculation model to obtain an intermediate dataset with initial pseudo-labels and corresponding class confidence differences;

[0047] The confidence calculation model is pre-trained using a small number of labeled data samples.

[0048] Based on the class confidence difference of the intermediate dataset, and based on the class confidence difference, it is determined whether the class confidence difference of each sample meets the confidence threshold. If it meets the threshold, the decision result of the confidence calculation model is used to obtain the sample with the final pseudo label. If it does not meet the threshold, the sample with the final pseudo label is obtained by reclassifying it through a Gaussian classifier.

[0049] Based on the samples with the final pseudo-labels, each sample is judged to determine whether it contains attack data by a preset category. If it contains attack data, an alarm signal is output. If it does not contain attack data, the sample is input into the extended training set.

[0050] The extended training set includes samples with final pseudo-labels obtained from the decisions of the multilayer perceptron model and the Gaussian classifier, used for iterative calculations of the multilayer perceptron model and the Gaussian classifier, as well as dynamic updates of the confidence threshold.

[0051] In summary, this embodiment achieves efficient preprocessing and classification of sample data through pseudo-label confidence perception; by comparing the class confidence difference of samples with the confidence threshold, it effectively improves data detection efficiency and avoids secondary classification of accurately classified data; through collaborative decision-making by dual classifiers, it ensures the accuracy of data processing; by inputting the samples with final pseudo-labels output by the multilayer perceptron model and Gaussian classifier into the extended training set, this invention can automatically generate pseudo-labels and continuously adaptively train the multilayer perceptron model and Gaussian classifier. This curbs error accumulation and semantic drift from the source, enabling the model to maintain stability and high performance even under conditions with few labels.

[0052] Example 2

[0053] Based on the same inventive concept as Embodiment 1, this embodiment introduces an online intrusion detection method based on pseudo-label confidence perception and dual-classifier collaborative decision-making. The confidence calculation model is a multilayer perceptron model, such as... Figure 1 As shown, the specific implementation process includes:

[0054] Step 1: Train an initial classification model using a small number of labeled samples, including a multilayer perceptron (MLP) model and a Gaussian classifier. The multilayer perceptron can be replaced by a convolutional neural network or the like.

[0055] Step 1-1: Train the MLP model using labeled training data, where Focal Loss is used as the loss function to handle class imbalance and hard sample problems. The loss function is defined as follows:

[0056] (1)

[0057] in, This represents the model's predicted probability of the true class. The category weight balancing factor is used to adjust the importance of different categories, and γ represents the focusing parameter used to adjust the weight of difficult samples; the category weight balancing factor The value of is between 0.2 and 0.9, and the value of the focusing parameter γ is between 1.0 and 5.0. In practice, these parameters can be optimized according to the class distribution of the training data.

[0058] Steps 1-2: Based on the labeled data, a Gaussian distribution classifier is fitted for each category. The parameters of the Gaussian classifier include the mean and covariance matrix, which are calculated by the maximum likelihood estimation method, thus improving the detection accuracy of samples with low confidence.

[0059] Step 2: Capture network traffic data in real time and obtain the raw data stream using a traffic capture tool;

[0060] Step 3: Convert the raw data stream into a structured dataset D, wherein data preprocessing includes feature extraction and normalization; the conversion tool can be cicflowmeter.

[0061] Step 4: Input each sample in dataset D into the MLP model to generate initial pseudo-labels and corresponding confidence scores, wherein the confidence scores are calculated based on the output probability distribution of the MLP model.

[0062] Step 5: Based on the confidence score, calculate the category confidence difference, and according to the comparison result of the confidence difference and the preset threshold, use the MLP model and Gaussian classifier to make a collaborative decision to determine the final pseudo label;

[0063] Step 5-1: Calculate the class confidence difference of the MLP model output, using the following formula:

[0064] (2)

[0065] in, It is the confidence score of the MLP in classifying a sample as class 0. It is the confidence score that classifies a sample into category 1. Poor confidence level for the category;

[0066] Step 5-2: Adaptive adjustment of the dynamic threshold θ using a sliding window mechanism. A sliding window of size N is maintained to store the confidence difference (CD) values ​​of the most recent N samples. After processing M new samples, the Kth percentile of the CD values ​​within the window is calculated, and the dynamic threshold θ is set to this value. Specifically, when the sliding window slides to a preset number of steps, the Kth percentile of the confidence difference values ​​of the N categories within the current sliding window is calculated and updated to the aforementioned confidence threshold. Here, N, M, and K are preset positive integers, where N can be set to 2000 or 5000, and M is N / 5. For example, if the window width N = 5000 and the preset number of steps M = 1000, with a step size of 1, it means that after processing 1000 new samples, the Kth percentile is calculated based on the CD values ​​of the most recent 5000 samples as θ. The preset number of steps can be selected according to different intrusion detection accuracies, including selecting a preset number of steps of 1, where the confidence threshold is dynamically adjusted once each time the extended dataset is updated.

[0067] The optimal K value is neither less than 70 nor greater than 90. Setting K to 70-90 offers several advantages: First, it achieves an optimal balance between efficiency and accuracy, ensuring that 70%-90% of high-confidence samples are quickly classified by the MLP, while only the 10%-30% of samples with the highest uncertainty trigger the Gaussian classifier's collaborative decision-making. Second, it establishes reliable pseudo-label quality assurance, controlling the data quality of the expanded training set from the source. Finally, in conjunction with the sliding window, it endows the system with adaptive capabilities, dynamically responding to changes in data distribution, ensuring the accuracy and robustness of the decision boundary. The K value can be adjusted accordingly to adapt to different application scenarios.

[0068] Step 5-3: Compare the confidence difference CD of the current sample with the dynamic threshold θ; if the confidence difference is lower than the threshold θ, the sample is regarded as a low-confidence sample and input into the Gaussian classifier for reclassification, and the output of the Gaussian classifier is used as the final pseudo-label; otherwise, the prediction result of the MLP model is kept as the final pseudo-label. The above steps realize the accurate evaluation of the pseudo-label quality and ensure timely error correction during the model update process, preventing the accumulation and amplification of errors.

[0069] Step 6: Add the samples with the final pseudo-labels to the training set to form an expanded training set;

[0070] Step 7: Periodically update the parameters of the MLP model and Gaussian classifier using the extended training set to enable online learning and adaptation of the model; by expanding the training set to increase the confidence calculation of the model, the training amount of the model is increased, ensuring the detection accuracy of the model.

[0071] Steps 2, 3, 4, 5, 6, and 7 are repeated as shown in the flowchart, allowing the dual classifier of MLP and Gaussian classifier to update itself in the real-time data stream and continue learning without frequent manual intervention and retraining.

[0072] In summary, this embodiment calculates the confidence difference of samples based on a confidence calculation model, and cyclically calculates the percentage of the built-in confidence difference of the sliding window at preset intervals to obtain a preset threshold; it realizes dynamic adjustment of the preset threshold, improves the accuracy of prediction results, and achieves online adaptation and continuous iterative updates of the detection method.

[0073] Example 3

[0074] Based on the same inventive concept as Embodiment 2, this embodiment introduces a computer storage medium that can be located in a server to store at least one instruction, at least one program, code set, or instruction set for implementing the method embodiments. The at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by the processor to implement the steps of the online intrusion detection method based on pseudo-label confidence perception and dual classifier collaborative decision-making as described in either Method Embodiment 1 or 2.

[0075] Optionally, in embodiments of the present invention, the storage medium may be located at at least one of a plurality of network servers in a computer network. Optionally, in embodiments of the present invention, the storage medium may include, but is not limited to, various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0076] As can be seen from the technical solutions provided in the embodiments of this specification above, the present invention utilizes a small number of labeled samples to train a multilayer perceptron model and a Gaussian classifier in parallel. During the online detection phase, for each incoming unlabeled sample, the multilayer perceptron model generates an initial pseudo-label and a corresponding class confidence difference. By using a preset threshold, samples with high classification uncertainty are identified. For samples with low confidence differences, a Gaussian classifier is used to classify them to determine whether they contain attack data. The samples with pseudo-labels determined by the multilayer perceptron model and the Gaussian classifier are used as an extended training set, which, along with the training set, is used for periodic model updates. This invention enables continuous adaptive online learning, effectively responding to dynamic changes in network data distribution and effectively avoiding the accumulation and amplification of errors during intrusion detection.

[0077] In summary, the present invention uses a collaborative decision-making mechanism of dual classifiers to screen high-quality pseudo-labels, thereby achieving stable, efficient, and adaptive learning of the model in continuous data streams.

[0078] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0079] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0080] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0082] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims. All of these forms are within the protection scope of the present invention.

Claims

1. An online intrusion detection method based on pseudo-label confidence awareness and double classifier collaborative decision-making, characterized in that, The method comprises the following steps: obtaining an original data stream; preprocessing the original data stream and inputting the same into a confidence calculation model to obtain an intermediate data set with initial pseudo-labels and class confidence differences; judging whether a confidence threshold is met based on the class confidence differences of the intermediate data set, and if the confidence threshold is met, obtaining samples with final pseudo-labels by using a prediction result of the confidence calculation model, and if the confidence threshold is not met, obtaining the samples with final pseudo-labels by reclassifying through a Gaussian classifier; obtaining an intrusion detection result of each sample in the original data stream by final pseudo-label evaluation on the samples with final pseudo-labels; storing the samples with final pseudo-labels and corresponding class confidence differences obtained by the confidence calculation model and the Gaussian classifier in an extended training set, and the extended training set is used for updating training of the confidence calculation model and the Gaussian classifier, and updating of the confidence threshold.

2. The online intrusion detection method based on pseudo-label confidence awareness and double classifier collaborative decision-making according to claim 1, characterized in that, The confidence calculation model and the Gaussian classifier are updated and trained by using the extended training set at a preset time interval.

3. The online intrusion detection method based on pseudo-label confidence awareness and double classifier collaborative decision-making according to claim 1, characterized in that, A loss function formula used in the training process of the confidence calculation model is: （1） where, represents the prediction probability of the model for the real class, represents the class weight balancing factor for adjusting the importance of different classes, and γ represents the focusing parameter for adjusting the weight of difficult samples, represents the Focal Loss function.

4. The online intrusion detection method based on pseudo-label confidence awareness and double classifier collaborative decision-making according to claim 1, characterized in that, The updating training process of the Gaussian classifier comprises the following steps: obtaining a labeled original data set; obtaining a training set by feature extraction and standardization based on the labeled data set; fitting a corresponding Gaussian classifier for each class by maximum likelihood estimation based on sample data in the training set and the extended training set.

5. The online intrusion detection method based on pseudo-label confidence-aware and double classifier co-decision according to claim 1, characterized in that, A calculation formula of the class confidence difference is: （2） wherein, is a confidence score that the confidence calculation model classifies the sample as a 0 class, is a confidence score that the confidence calculation model classifies the sample as a 1 class, is a class confidence difference.

6. The online intrusion detection method based on pseudo-label confidence-aware and double classifier co-decision according to claim 1, characterized in that, The confidence threshold is updated adaptively by a sliding window mechanism based on the extended training set, and the method comprises the following steps: in response to an increase in the samples in the extended training set, obtaining class confidence difference values of N latest samples in the extended training set by using a sliding window; when the sliding window slides to a preset step number, calculating a Kth percentile of the N class confidence difference values in the current sliding window, and updating the Kth percentile as the confidence threshold.

7. The online intrusion detection method based on pseudo-label confidence-aware and double classifier co-decision according to claim 7, characterized in that, The window width of the sliding window is 5000, the step length is 1, and the preset step number is 1000 steps.

8. The online intrusion detection method based on pseudo-label confidence awareness and double classifier collaborative decision according to claim 7 or 8, characterized in that, The value range of K in the Kth percentile is 70 to 90.

9. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by a processor to implement the steps of the online intrusion detection method based on pseudo-label confidence awareness and double-classifier collaborative decision in any one of claims 1 to 8.

Images