Network intrusion detection model end adversarial training defense method and device

Abstract

The invention relates to the technical field of network security, in particular to a network intrusion detection model end adversarial training defense method and device, and the method comprises the steps: dynamically outputting an attack strategy through an adversarial strategy generator according to a traffic feature vector and a current strategy parameter. Limitation is applied to problem space disturbance through adversarial domain constraints, and it is ensured that generated adversarial samples meet the requirements of network protocol specifications and feature logic consistency. On the basis, a dynamic game mechanism is formed for an intrusion detection model and a confrontation strategy generator by alternately executing confrontation training and strategy parameter optimization, so that the model gradually improves the defense capability for mixed threats of a feature space and a problem space in the process of continuously adapting to increasingly complex attack modes; finally, collaborative improvement of robustness and generalization of the intrusion detection model is realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and apparatus for end-to-end adversarial training and defense of network intrusion detection models. Background Technology

[0002] Cybersecurity threats not only lead to data breaches, service disruptions, and physical infrastructure damage, but also pose serious challenges to national security and social well-being. Against this backdrop, Network Intrusion Detection Systems (NIDS), as a key technological means, effectively identify abnormal behaviors and attack patterns by monitoring and analyzing network traffic in real time, providing early warnings and support for cybersecurity protection. Traditional intrusion detection systems primarily rely on rule-based detection mechanisms, which are limited in that they can only identify attacks matching existing rule bases and cannot address unknown threats. Furthermore, while detection methods based on statistical analysis or feature engineering have improved detection capabilities to some extent, their performance heavily depends on expert experience and is inefficient when handling large-scale traffic data, requiring system administrators and security teams to continuously invest significant resources in monitoring.

[0003] In recent years, with the rapid development of artificial intelligence technology, deep learning-based network intrusion detection systems have gradually become a research hotspot. These systems exhibit significant advantages in feature processing and unknown threat detection, effectively improving detection accuracy and efficiency. However, existing research shows that the inherent vulnerability of deep learning models makes them perform poorly when facing adversarial examples (AEs). In the field of traffic intrusion detection, attackers can use carefully crafted adversarial examples to modify original traffic data or features, inducing the detection system to make misclassifications. Specifically, attackers can implement various forms of perturbation attacks in the feature space or problem space, such as finely adjusting specific feature values ​​to evade detection, or influencing classification results through multi-dimensional feature perturbations, thereby achieving their attack objectives.

[0004] In the field of adversarial traffic defense, existing defense methods all have limitations in generalization ability: existing defense mechanisms are unable to effectively resist adversarial attacks with different perturbation intensities and attacks in different spaces (feature space and problem space), and may lead to a decrease in the classification accuracy of intrusion detection models for clean traffic data. As a classic model-side adversarial defense method, adversarial training requires high-quality adversarial samples as training samples, but current training samples lack diversity, and the training strategies are simplistic. Specifically, current training sample generation methods mostly involve adversarial attacks with fixed strategies in the feature space, and the sample set lacks adversarial samples in the problem space and training samples with different attack strategies, resulting in adversarial training failing to effectively enhance the model's robustness to adversarial attacks in the problem space and attacks of different intensities. Summary of the Invention

[0005] This invention provides a method and apparatus for adversarial training defense of network intrusion detection models, which addresses the shortcomings of existing technologies. By setting up three stages—adversarial sample generator based on adversarial domain constraints, adversarial strategy generation, and adversarial training—the robustness of the intrusion detection model is improved.

[0006] This invention provides a method for end-to-end adversarial training defense for network intrusion detection models, comprising: Acquire network traffic data and extract features from the network traffic data to obtain a traffic feature vector; The traffic feature vector is input into the adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and the current strategy parameters. Based on the attack space identifier in the dynamic attack strategy, unconstrained perturbation and adversarial domain constrained perturbation are applied to the traffic feature vector respectively to generate feature space adversarial samples and problem space adversarial samples. The adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples are input into the intrusion detection model for adversarial training. The model parameters of the intrusion detection model are updated by minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space. Based on the performance of the intrusion detection model during the adversarial training process, the strategy parameter optimization step of the adversarial strategy generator is executed. The adversarial training and strategy parameter optimization steps are executed alternately to form a dynamic game mechanism between the intrusion detection model and the adversarial strategy generator, resulting in a trained intrusion detection model for network traffic intrusion detection.

[0007] Furthermore, the step of applying unconstrained perturbations and adversarial domain constrained perturbations to the traffic feature vectors based on the attack space identifier in the dynamic attack strategy to generate feature space adversarial samples and problem space adversarial samples includes: Based on the attack space identifier in the dynamic attack strategy, perform feature space adversarial perturbation generation operation and problem space adversarial perturbation generation operation respectively: When the attack space identifier indicates the feature space, a perturbation is applied to the traffic feature vector based on the adversarial attack algorithm to generate an adversarial perturbation of the feature space; When the attack space identifier indicates the problem space, the traffic feature vector is perturbed based on the adversarial attack algorithm, and the resulting perturbation is subject to adversarial domain constraints to generate a problem space adversarial perturbation; the adversarial domain constraints are used to ensure that the perturbed samples conform to network protocol specifications and feature logic consistency requirements. The feature space adversarial perturbation and the problem space adversarial perturbation are superimposed on the traffic feature vector to obtain feature space adversarial samples and problem space adversarial samples, respectively.

[0008] Furthermore, the adversarial domain constraint includes a traffic feature perturbation dimension constraint, which includes: The features in the traffic feature vector are divided into a set of variable features and a set of immutable features; When generating the adversarial perturbation in the problem space, the feature values ​​in the immutable feature set remain unchanged, and perturbations are applied only to the features in the variable feature set to generate adversarial sample features that meet the network protocol specifications and functional requirements.

[0009] Furthermore, the adversarial domain constraint also includes range and size constraint, wherein the range and size constraint includes: For continuous features, the perturbation amplitude is limited to between a preset lower and upper bound to ensure that the perturbed feature value is within a reasonable range. For discrete features, the inverse normalization operation, the round-up operation, and the re-normalization operation are performed in sequence to map the perturbed continuous values ​​to integer values ​​that conform to the discrete characteristics.

[0010] Furthermore, the adversarial domain constraint also includes the traffic feature dependency constraint, which includes: For features with computational dependencies, the derived feature values ​​are recalculated according to the calculation formula of the computational dependencies after applying a perturbation; For features with size dependencies, a size dependency check is performed after applying a perturbation to ensure that the minimum feature is not greater than the maximum feature.

[0011] Furthermore, the step of optimizing the policy parameters of the adversarial policy generator based on the performance of the intrusion detection model during the adversarial training process includes: Based on the reinforcement learning framework, a multi-dimensional reward signal is calculated according to the performance of the intrusion detection model during the adversarial training process; Based on the multi-dimensional reward signal, optimize the strategy parameters of the adversarial strategy generator; The multi-dimensional reward signals include attack effect reward, robustness improvement reward, key feature perturbation reward, and clean sample classification reward; The attack effect reward is determined based on the classification loss of the intrusion detection model for the adversarial samples in the feature space and the adversarial samples in the problem space. The robustness enhancement reward is determined based on the degree of robustness improvement of the intrusion detection model after single-step adversarial training; The key feature perturbation reward is determined based on the difference in Shapley values ​​between the traffic feature vector and the adversarial samples in the feature space and the adversarial samples in the problem space. The clean sample classification reward is determined based on the classification accuracy of the clean sample by the intrusion detection model.

[0012] Furthermore, based on the multi-dimensional reward signal, the Actor-Critic reinforcement learning method is used to optimize the policy parameters of the adversarial policy generator; wherein, the Actor network generates the dynamic attack policy based on the current state, and the Critic network estimates the state value function and guides the policy update of the Actor network through temporal difference error.

[0013] Furthermore, the alternating execution of the adversarial training and the policy parameter optimization steps, to enable the intrusion detection model and the adversarial policy generator to form a dynamic game mechanism, includes: Generate alternating training parameters to control the training rhythm of the intrusion detection model and the adversarial strategy generator; In the early stages of training, when the robustness of the intrusion detection model is lower than a preset threshold, the adversarial strategy generator generates diverse attack strategies, including weak attack strategies and strong attack strategies. In the later stages of training, when the robustness of the intrusion detection model exceeds a preset threshold, the adversarial strategy generator, guided by the multi-dimensional reward signal, learns to generate high-intensity adversarial samples and complex attack patterns.

[0014] Furthermore, the calculation of the key feature perturbation reward includes: Calculate the first Shapley value vector of the traffic feature vector in the intrusion detection model, and the second Shapley value vectors of the feature space adversarial sample and the problem space adversarial sample in the intrusion detection model, respectively; The L1 norm distance between the first Shapley value vector and the second Shapley value vector is calculated and used as the reward for the key feature perturbation. The key feature perturbation reward is used to quantify the degree of change in the dependence of the perturbation on the key feature and guide the adversarial strategy generator to generate effective perturbations for the key feature.

[0015] The calculation of the robustness enhancement reward includes: Based on the model parameters of the current intrusion detection model and the adversarial samples generated by the dynamic attack strategy, single-step adversarial training is performed to obtain the updated model parameters; The updated intrusion detection model is constructed using the updated model parameters, and the classification loss of the updated intrusion detection model on the same adversarial sample is calculated. The robustness enhancement reward is determined based on the negative value of the classification loss. The robustness enhancement reward is used to evaluate the effect of the adversarial examples on improving the robustness of the model after single-step adversarial training.

[0016] Secondly, the present invention also provides a network intrusion detection model adversarial training defense device, comprising: a traffic feature vector extraction module, used to acquire network traffic data and extract features from the network traffic data to obtain a traffic feature vector; An attack strategy generator is used to input the traffic feature vector into an adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and current strategy parameters. An adversarial sample generator is used to apply unconstrained perturbations and adversarial domain constrained perturbations to the traffic feature vector according to the attack space identifier in the dynamic attack strategy, thereby generating feature space adversarial samples and problem space adversarial samples. The adversarial training module is used to input the adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples into the intrusion detection model for adversarial training. By minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space, the model parameters of the intrusion detection model are updated. The strategy parameter optimization module is used to execute the strategy parameter optimization step of the adversarial strategy generator based on the performance of the intrusion detection model during the adversarial training process. The dual-space joint defense module is used to alternately execute the adversarial training and the strategy parameter optimization steps, so that the intrusion detection model and the adversarial strategy generator form a dynamic game mechanism, and the trained intrusion detection model is used for network traffic intrusion detection.

[0017] The adversarial training defense method and apparatus based on network intrusion detection model provided by this invention have the following advantages compared with the prior art: This invention utilizes an adversarial strategy generator to dynamically output attack strategies based on traffic feature vectors and current strategy parameters, enabling adaptive adjustment of parameters such as attack strength, step size, and iteration count. This generates diverse adversarial samples covering different attack surfaces. Simultaneously, by imposing constraints on the problem space perturbations through adversarial domain constraints, it ensures that the generated adversarial samples comply with network protocol specifications and feature logic consistency requirements. This ensures that the adversarial training samples include both unconstrained perturbations in the feature space and protocol-compliant perturbations in the problem space, effectively expanding the distribution range of training samples. Furthermore, the intrusion detection model and the adversarial strategy generator form a dynamic game mechanism through alternating adversarial training and strategy parameter optimization. This allows the model to gradually improve its defense capabilities against mixed threats in the feature and problem spaces as it continuously adapts to increasingly complex attack patterns. This solves the problem of limited defense generalization capabilities in existing adversarial training methods due to insufficient sample diversity and fixed attack strategies, ultimately achieving a synergistic improvement in the robustness and generalization of the intrusion detection model. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0019] Figure 1 This is one of the flowcharts of an optional network intrusion detection model adversarial training defense method provided by the present invention; Figure 2 This is the second flowchart of an optional network intrusion detection model adversarial training defense method provided by the present invention; Figure 3 This is a flowchart illustrating an optional adversarial strategy generator optimization process provided by the present invention. Figure 4 This is a flowchart illustrating an optional adversarial training process provided by the present invention; Figure 5 This is a schematic diagram of the framework of an optional network intrusion detection model adversarial training defense device provided by the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0021] Figure 1 This is one of the flowcharts illustrating the adversarial training and defense method for network intrusion detection model provided by this invention, such as... Figure 1 As shown, including but not limited to the following steps: Step 102: Obtain network traffic data and extract features from the network traffic data to obtain a traffic feature vector; Step 104: Input the traffic feature vector into the adversarial strategy generator, and the adversarial strategy generator outputs a dynamic attack strategy based on the traffic feature vector and the current strategy parameters; Step 106: Based on the attack space identifier in the dynamic attack strategy, apply unconstrained perturbation and adversarial domain constrained perturbation to the traffic feature vector respectively to generate feature space adversarial samples and problem space adversarial samples. Step 108: Input the adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples into the intrusion detection model for adversarial training. Update the model parameters of the intrusion detection model by minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space. Step 110: Based on the performance of the intrusion detection model during the adversarial training process, perform the strategy parameter optimization step of the adversarial strategy generator; Step 112: Alternately execute the adversarial training and the strategy parameter optimization steps to form a dynamic game mechanism between the intrusion detection model and the adversarial strategy generator, and obtain the trained intrusion detection model for network traffic intrusion detection.

[0022] Regarding step 102, network traffic data is acquired, and features are extracted from the network traffic data to obtain a traffic feature vector.

[0023] In this embodiment, the traffic feature vector may include statistical features, protocol-related features, directional features, and temporal features.

[0024] Traffic features are extracted from the network traffic data to be detected using traffic feature extraction tools such as CIC Flow Meter. Four types of features are extracted for each flow: statistical features, protocol-related features, directional features, and temporal features, to obtain the traffic feature vector of the network traffic data to be detected.

[0025] Regarding step 104, the traffic feature vector is input into the adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and the current strategy parameters.

[0026] In this embodiment, the dynamic attack strategy may include an attack space identifier, a perturbation magnitude, a perturbation step size, and an iteration count. The attack space identifier is used to indicate the feature space or problem space.

[0027] The attack strategy generator dynamically outputs attack parameters based on the input traffic feature vector and model robustness, controlling parameters such as attack strength, step size, and number of iterations in the feature space and problem space to form a dynamic attack strategy. :

[0028] in, As input traffic features, adversarial strategy generator The parameters are .

[0029] Regarding step 106, based on the attack space identifier in the dynamic attack strategy, unconstrained perturbation and adversarial domain constrained perturbation are applied to the traffic feature vector respectively to generate feature space adversarial samples and problem space adversarial samples.

[0030] Based on different adversarial attack algorithms and strategies, adversarial perturbations are generated according to the attack space identifiers in the dynamic attack strategy.

[0031]

[0032] in, and Input traffic characteristics and labels, For parameters Intrusion detection model, For loss function, To counter attack methods.

[0033] Adversarial domain constraints can be imposed on the perturbation from three levels: the dimension of the perturbation characteristics, the range and size limitations, and the feature dependencies, ultimately forming adversarial examples.

[0034] in, To counter domain constraints.

[0035] In an optional embodiment, based on the attack space identifier in the dynamic attack strategy, feature space adversarial perturbation generation operation and problem space adversarial perturbation generation operation are performed respectively: When the attack space identifier indicates the feature space, the traffic feature vector is perturbed based on the adversarial attack algorithm to generate an adversarial perturbation of the feature space.

[0036] When the attack space identifier indicates the problem space, the traffic feature vector is perturbed based on the adversarial attack algorithm, and the resulting perturbation is subject to adversarial domain constraints to generate an adversarial perturbation for the problem space.

[0037] The adversarial domain constraints can include flow feature perturbation dimension constraints, value range and size constraint constraints, and flow feature dependency constraints. Flow feature perturbation dimension constraints distinguish between variable and immutable features and apply perturbations only to the variable features. Value range and size constraint constraints limit the perturbed feature values ​​to a preset range and round the discrete features. Flow feature dependency constraints maintain computational and size dependencies between features.

[0038] Optional constraints on the dimensions of traffic feature perturbation include: The features in the traffic feature vector are divided into a set of variable features and a set of immutable features; When generating the adversarial perturbation in the problem space, the feature values ​​in the immutable feature set remain unchanged, and perturbations are applied only to the features in the variable feature set to generate adversarial sample features that meet the network protocol specifications and functional requirements.

[0039] In this embodiment, network traffic characteristics in problem space adversarial attacks can be divided into two categories: variable characteristics and immutable characteristics.

[0040] Among them, variable characteristics refer to traffic characteristics that are allowed to be disturbed under the premise of meeting network protocol specifications; while immutable characteristics are traffic characteristics that cannot be changed due to network protocol or functional constraints.

[0041] Specifically, variable characteristics include, but are not limited to, the following attributes: source byte count, destination byte count, connection duration, and port number. Time-related and directional characteristics are often variable. These characteristics typically have a certain degree of flexibility and can be perturbed within a reasonable range without violating protocol rules.

[0042] In contrast, immutable characteristics are determined by the fundamental rules of network communication, including protocol type, connection state, and service type, such as some protocol-related features. These characteristics directly determine the functionality and compliance of traffic, and therefore must remain unchanged during the generation of adversarial examples.

[0043] Formally, the set of immutable features can be represented as The variable feature is represented as ,in The total dimension represents the variable features. An adversarial example under constraints is defined as:

[0044] Based on this, adversarial examples under the constraint of perturbation dimension of traffic features can be defined as: satisfying the immutable features Under the premise of variable features Samples generated by applying perturbations.

[0045] Optional range and size constraints include: For continuous features, the perturbation amplitude is limited to between a preset lower and upper bound to ensure that the perturbed feature value is within a reasonable range. For discrete features, the inverse normalization operation, the round-up operation, and the re-normalization operation are performed in sequence to map the perturbed continuous values ​​to integer values ​​that conform to the discrete characteristics.

[0046] In this embodiment, when generating adversarial examples, the perturbable network traffic features must simultaneously consider their value range constraints and perturbation amplitude limitations.

[0047] Specifically, flow perturbability characteristics may manifest as discrete values, continuous values, or binary values.

[0048] Temporal and directional characteristics are mostly continuous, such as the number of packets per second (Fwd Pkts / s) in the forward flow.

[0049] Some statistical and protocol-related features are discrete features, such as the total number of forward packets (Fwd Pkt Num).

[0050] For discrete features, the perturbed values ​​need to be denormalized and mapped back to the original flow space. The values ​​are then rounded up to ensure they conform to discrete characteristics before being normalized again to the feature space of the input vector.

[0051] Furthermore, to avoid impacting the functionality of network traffic, the magnitude of the disturbance must be strictly constrained within a reasonable range. Formally, the above process can be expressed as:

[0052] in, and These represent the normalization and denormalization operations, respectively. This represents the floor function, used to ensure that the values ​​of discrete features conform to their domain. and These represent the lower and upper bounds of the disturbance amplitude, respectively, used to limit the reasonable range of the disturbance.

[0053] Optional traffic characteristic dependency constraints include: For features with computational dependencies, the derived feature values ​​are recalculated according to the calculation formula of the computational dependencies after applying a perturbation; For features with size dependencies, a size dependency check is performed after applying a perturbation to ensure that the minimum feature is not greater than the maximum feature.

[0054] It should be noted that the features extracted from network traffic often exhibit certain dependencies. These dependencies can be categorized into two types: computational dependencies and size dependencies. These two types of dependencies will be elaborated upon below.

[0055] Computational dependency This refers to certain features that are derived from other features through specific calculation formulas, and is commonly found in statistical features and directional features.

[0056] For example, the number of packets per second (Flow Pkts / s) in flow-level traffic is calculated as the ratio of the total number of packets to the connection duration. Therefore, when generating adversarial examples, this type of feature cannot be freely perturbed; it must be recalculated based on the perturbed values ​​of the relevant features to ensure consistency with logical dependencies. Formally, computational dependencies can be expressed as:

[0057] in, Features in clean flow samples By characteristics Constraints calculated from other features. and These represent the values ​​of the features corresponding to the adversarial examples.

[0058] Size Dependency This refers to a constraint relationship in numerical range between certain features, which is commonly seen in time features and statistical features.

[0059] For example, the minimum forward packet arrival time interval (Fwd IAT Min) reflects the shortest idle time in the session; the maximum forward packet arrival time interval (Fwd IAT Max) reflects the longest idle time in the session. Clearly, during adversarial attacks, it is essential to ensure that the perturbed maximum value is not less than the minimum value to maintain logical consistency between features. Formally, size dependency can be expressed as:

[0060] in, and These represent the minimum and maximum values ​​of the disturbance characteristic, respectively.

[0061] Considering the various constraints such as computational dependence and size dependence mentioned above, the generation process of adversarial examples in the problem space must be carried out under the premise of strictly satisfying these constraints. The mapping relationship between adversarial domain constraints and feature classification is shown in Table 1.

[0062] Table 1. Mapping relationship between adversarial domain constraints and feature classification

[0063] In summary, to enhance the diversity of adversarial training samples, this invention generates adversarial sample feature vectors that conform to the characteristics of the problem space by imposing the aforementioned adversarial domain constraints on the adversarial sample attack algorithm. The generation of feature vectors for adversarial samples in the feature space is based on traditional adversarial attack methods (such as PGD), achieved by applying carefully designed perturbations to the input feature vectors. The adversarial samples in the problem space and the adversarial samples in the feature space together constitute the training data foundation for the collaborative adversarial training framework.

[0064] Regarding step 108, the adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples are input into the intrusion detection model for adversarial training. The model parameters of the intrusion detection model are updated by minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space.

[0065] In this embodiment, adversarial examples in the feature space and adversarial examples in the problem space are mixed in a preset ratio and combined with clean samples to form a training batch. The total loss function of the intrusion detection model on this training batch is calculated; the total loss function is the sum of the classification losses of the adversarial examples in the feature space and the adversarial examples in the problem space. The total loss function is minimized using, for example, gradient descent, and the model parameters are updated, enabling the intrusion detection model to learn defenses against both feature space and problem space attacks simultaneously.

[0066] This invention minimizes the classification loss of the intrusion detection model on these two types of adversarial examples, enabling the model to learn to identify malicious traffic patterns after different spatial perturbations, thereby updating the model parameters to improve its robustness.

[0067] It is worth noting that the dynamic attack strategies generated by the adversarial policy generator determine the perturbation characteristics of the adversarial examples, which in turn serve as training data to drive model parameter updates. Simultaneously, the model's classification performance on these adversarial examples acts as a reward signal, feeding back to the adversarial policy generator and guiding its policy parameter optimization. Through the adversarial training step, the adversarial example generation step, and the subsequent policy parameter optimization step forming a closed loop, the intrusion detection model continuously adapts to increasingly complex attack patterns during its interaction with the adversarial policy generator, ultimately achieving a synergistic improvement in robustness across both attack and space.

[0068] Regarding step 110, based on the performance of the intrusion detection model during the adversarial training process, the strategy parameter optimization step of the adversarial strategy generator is executed.

[0069] In this embodiment, Figure 2 This is the second flowchart of an optional network intrusion detection model adversarial training defense method provided by the present invention, as shown below. Figure 2 As shown, this invention optimizes an adversarial policy generator based on a reinforcement learning framework. Using this framework, a multi-dimensional reward signal is calculated based on the performance of the intrusion detection model during adversarial training. The policy parameters of the adversarial policy generator are then optimized based on this multi-dimensional reward signal.

[0070] The reinforcement learning framework will be described in detail below from four aspects: state, action, reward function, and policy optimization.

[0071] State is determined by the characteristics of the input flow. and the current parameters of the adversarial strategy generator Common definition. That is, state. ,in, Provide traffic characteristic information, This reflects the decision-making tendency of the adversarial strategy generator and the game state between the current intrusion detection model and the adversarial strategy generator.

[0072] Actions are generated by the adversarial strategy generator. Generate, representing dynamic attack strategy parameters. ,in, This represents the attack space (feature space or problem space). Indicates the magnitude of the disturbance. Indicates the perturbation step size. These parameters, representing the number of iterations, collectively determine the strategy for generating adversarial training samples.

[0073] The reward function consists of several parts, designed to guide the adversarial policy generator to produce effective adversarial examples while maintaining the intrusion detection model's classification accuracy on clean samples. To guide the adversarial policy generator to produce high-quality adversarial training examples, In an optional embodiment, the multi-dimensional reward signal includes an attack effectiveness reward, a robustness improvement reward, a key feature perturbation reward, and a clean sample classification reward. The attack effectiveness reward is determined based on the classification loss of the intrusion detection model for the adversarial samples in the feature space and the adversarial samples in the problem space. The robustness improvement reward is determined based on the degree of robustness improvement of the intrusion detection model after single-step adversarial training. The key feature perturbation reward is determined based on the difference in Shapley values ​​between the traffic feature vector and the adversarial samples in the feature space and the adversarial samples in the problem space. The clean sample classification reward is determined based on the classification accuracy of the intrusion detection model for the clean samples.

[0074] In this embodiment, the present invention designs a multi-dimensional reward function, comprising the following four parts: 1) Attack effect bonus: The attack effect reward is the intrusion detection model. Classification adversarial examples The cross-entropy loss can be defined as:

[0075] in, For the sample labels, the adversarial policy generator maximizes This is used to generate more powerful adversarial examples for adversarial training, thereby improving the robustness of the intrusion detection model. The reward measures the impact of adversarial examples on the classification performance of the intrusion detection model, by maximizing... This can encourage the generation of adversarial examples that can significantly mislead the model.

[0076] 2) The calculation of robustness enhancement rewards includes: Based on the model parameters of the current intrusion detection model and the adversarial samples generated by the dynamic attack strategy, single-step adversarial training is performed to obtain the updated model parameters; The updated intrusion detection model is constructed using the updated model parameters, and the classification loss of the updated intrusion detection model on the same adversarial sample is calculated. The robustness enhancement reward is determined based on the negative value of the classification loss. The robustness enhancement reward is used to evaluate the effect of the adversarial examples on improving the robustness of the model after single-step adversarial training.

[0077] In this embodiment, the robustness improvement effect can be evaluated using the robustness of the intrusion detection model after single-step adversarial training optimization.

[0078] Specifically, firstly, regarding intrusion detection models Generate adversarial examples and then use them for adversarial training to optimize the parameters of the intrusion detection model in one step. For the updated intrusion detection model Conduct a robustness assessment, if If the robustness is improved, then the attack strategy is effective. The loss function for evaluating the robustness improvement can be defined as:

[0079] in Rewards for learning rate Evaluate the effect of adversarial examples on the robustness of the model after single-step adversarial training. If adversarial examples can significantly improve the robustness of the model, then the attack strategy is effective.

[0080] 3) Calculation of key feature perturbation rewards, including: Calculate the first Shapley value vector of the traffic feature vector in the intrusion detection model, and the second Shapley value vectors of the feature space adversarial sample and the problem space adversarial sample in the intrusion detection model, respectively; The L1 norm distance between the first Shapley value vector and the second Shapley value vector is calculated and used as the reward for the key feature perturbation. The key feature perturbation reward is used to quantify the degree of change in the dependence of the perturbation on the key feature and guide the adversarial strategy generator to generate effective perturbations for the key feature.

[0081] In this embodiment, the perturbation dimension of traffic adversarial examples may be related to the meaning of features. For example, adversarial attacks on problem space often perturb temporal and statistical features.

[0082] Therefore, in order to improve the attack effect on adversarial training samples, this invention quantifies feature importance using Shapley values ​​and dynamically adjusts the adversarial attack strategy. The principle will be explained in detail below.

[0083] The Shapley score is a metric in game theory used to measure an individual's contribution to the overall cooperative payoff. In machine learning, the Shapley score is used to interpret model predictions, representing the contribution of each feature to the model's output.

[0084] In this invention, the Shapley value of the original input reflects the model's dependence on each feature under normal input conditions. The Shapley value of the adversarial example reflects the model's dependence on features in the perturbed input. By comparing the Shapley values ​​of the original input and the adversarial example, it is possible to analyze which features were perturbed and affected the model's decision. If the Shapley values ​​of certain features change significantly, it indicates that the perturbation successfully weakened the model's dependence on these features. Furthermore, it is possible to analyze whether the perturbation effectively interfered with the model's inference. If the Shapley value of the adversarial example shows that the model began to depend on irrelevant features, it indicates that the perturbation effectively misled the model. The Shapley-guided reward function is designed as follows:

[0085] in, Indicates the number of feature dimensions. Using changes in the Shapley value as a reward aims to encourage adversarial perturbations to precisely target key features. If the perturbation leads to a decrease in the model's dependence on key features (a decrease in the Shapley value), the reward increases, prompting the policy network to generate more effective perturbations.

[0086] In addition, it can penalize ineffective perturbations. If a perturbation fails to change the Shapley value of a key feature, the reward is reduced to suppress inefficient perturbations. Furthermore, it can enhance the interpretability of adversarial examples; changes in the Shapley value can provide an intuitive understanding of the attack logic of the adversarial example. By introducing this reward term, the policy network can be incentivized to generate adversarial examples that target perturbations of key features, enabling the intrusion detection model to learn more robust feature representations.

[0087] 4) Calculation of clean sample classification reward, including: The clean precision reward function is defined as:

[0088] In this embodiment, the attack strategy should not only aim to improve the robustness of the intrusion detection model, but also ensure the model's detection performance on clean samples, i.e., maintain high clean accuracy. To more effectively guide the optimization process of the adversarial strategy generator, this invention introduces the clean accuracy of the intrusion detection model after one-step adversarial training as an evaluation metric and incorporates it as an important component of the reward function. This aims to ensure that the generated adversarial examples enhance the model's robustness while minimizing the negative impact on the classification performance of clean samples, thereby achieving a balance between robustness and accuracy.

[0089] In summary, the multi-dimensional reward signal in this embodiment consists of four aspects: attack effect reward, robustness improvement reward, key feature perturbation reward, and clean sample classification reward, and is weighted by coefficients. and Balancing the importance of different reward items, for example: ; In an optional embodiment, the policy parameters of the adversarial policy generator are optimized using the Actor-Critic reinforcement learning method based on the multi-dimensional reward signal; wherein, the Actor network generates the dynamic attack policy based on the current state, and the Critic network estimates the state value function and guides the policy update of the Actor network through temporal difference error.

[0090] In this embodiment, the goal of reinforcement learning is to maximize the cumulative reward through policy optimization, thereby generating more effective adversarial training samples. Since the adversarial policy generator cannot be directly optimized through gradients, and optimization based on the Reinforce policy gradient method may lead to training instability due to its high variance gradient estimation, the Actor-Critic method from reinforcement learning is introduced to optimize the adversarial policy generator. Figure 3 This is a flowchart illustrating an optional adversarial strategy generator optimization process provided by the present invention, as shown below. Figure 3 As shown, by introducing a Critic network to guide the parameter updates of the adversarial policy generator, the gradient variance during training is reduced, thereby improving training stability. The Actor-Critic method will be described below.

[0091] The Actor-Critic method uses a value function. The Critic network guides the updates of the adversarial policy generator, thereby reducing gradient variance during training and improving training stability and efficiency. The Critic network is responsible for estimating the value of the current state, i.e., the potential impact of the adversarial example on the intrusion detection model in the current state. The parameters of the Critic network... The update is performed using the timing difference error, calculated as follows:

[0092] in, It is the state value estimate output by the Critic network. The next state is... It is a discount factor used to balance current rewards with future rewards. The adversarial policy generator, the Actor network, is then updated using a value estimate provided by the Critic network. Generate attack strategy based on current state And update its parameters using the value estimate provided by the Critic network. :

[0093] Through the above methods, such as Figure 3 As shown, this invention is based on reinforcement learning-guided adversarial strategy generator optimization to generate high-quality adversarial training samples for training. The adversarial strategy generator dynamically adjusts attack parameters according to input traffic characteristics and model state, covering diverse attack surfaces and avoiding the limitations of traditional fixed attack strategies.

[0094] Regarding step S112, the adversarial training and the strategy parameter optimization steps are executed alternately to enable the intrusion detection model and the adversarial strategy generator to form a dynamic game mechanism, thereby obtaining a trained intrusion detection model for network traffic intrusion detection.

[0095] In this embodiment, Figure 4 This is a flowchart illustrating an optional adversarial training process provided by the present invention, such as... Figure 4 As shown, the present invention will generate an adversarial strategy generator. Dynamic adversarial attack strategies are generated based on traffic input characteristics, and adversarial training samples are further generated and applied to the intrusion detection model. Adversarial training is conducted to improve robustness. For example, adversarial training can be represented as:

[0096] Among them, model parameters Adversarial strategy generator Input is clean flow characteristics Output dynamic attack strategy parameters In the strategy parameters Represents the attack space, controlling the problem space to counteract disturbances. Combating perturbations in the feature space generate, Indicates the magnitude of the disturbance. Indicates the perturbation step size. Indicates the number of perturbation iterations. Let the loss function be the intrusion detection model. Classify traffic categories and tags. This represents the adversarial attack algorithm. Furthermore, the adversarial training optimization objective can be expressed as:

[0097] In adversarial training, the robustness of intrusion detection is improved through a game against the adversarial policy generator. Therefore, it is necessary to alternately optimize the adversarial policy generator and the intrusion detection model. This embodiment achieves this by setting alternating training parameters. This effectively balances the training pace of the two types of models while maintaining the original design goals of the algorithm.

[0098] Optionally, the specific implementation of the dynamic game mechanism includes: Set alternating training parameters to control the training rhythm of the intrusion detection model and the adversarial strategy generator; In the early stages of training, when the robustness of the intrusion detection model is low, the adversarial strategy generator generates diverse attack strategies, including weak attack strategies and strong attack strategies. In the later stages of training, as the robustness of the intrusion detection model improves, the adversarial strategy generator, guided by the multi-dimensional reward signals, learns to generate high-intensity adversarial samples and complex attack patterns. The robustness improvement of the intrusion detection model drives the strategy optimization of the adversarial strategy generator, and the complex attacks generated by the adversarial strategy generator expose the decision boundary vulnerabilities of the intrusion detection model, forming a two-way feedback mechanism that enables the intrusion detection model to gradually adapt to the mixed threats in the feature space and problem space.

[0099] It should be noted that, based on the above analysis, the adversarial strategy generator enhances the diversity of adversarial training samples in this invention across multiple dimensions, including attack space, attack strength, attack step size, and number of iterations. The core advantage of this invention lies not only in the diversity of adversarial training samples but also in the fact that the game process between the intrusion detection model and the adversarial strategy generator effectively improves the model's robustness. The game process will be analyzed in detail below.

[0100] In this invention, the adversarial training objective game consists of an intrusion detection model and an adversarial strategy generator. In the early stages of training, the intrusion detection model lacks effective defense capabilities, and weak attacks (such as small perturbations) can significantly increase adversarial losses. At this time, the adversarial strategy generator tends to generate diverse attack strategies (including weak and strong attacks), all of which can successfully deceive the model. In the later stages of training, the robustness of the intrusion detection model gradually increases, the effectiveness of weak attacks decreases, and the adversarial strategy generator optimizes towards generating high-intensity adversarial examples. This competitive mechanism forces the intrusion detection model to continuously adapt to dynamically escalating attack patterns, thereby achieving progressively enhanced robustness.

[0101] In contrast, traditional adversarial training methods typically optimize inner layers only for predefined, fixed attack strategies. This invention, by introducing an adversarial strategy generator, transforms inner layer optimization into one based on dynamic attack strategy parameters, thus creating a bidirectional feedback mechanism: the improved robustness of the intrusion detection network drives the adversarial strategy generator to progressively optimize, enabling it to explore more complex attack patterns. The adversarial strategy generator guides the model's defense enhancement, and complex attacks expose potential vulnerabilities in the model's decision boundaries, providing more challenging training samples for the intrusion detection model. This game-theoretic process essentially simulates the dynamic adversarial relationship between attackers and defenders, allowing the model to adapt to mixed threats in the feature space and problem space during training, ultimately achieving improved robustness and generalization ability across both spaces.

[0102] In summary, the adversarial training defense method for network intrusion detection models provided by this invention has the following technical effects: This invention proposes a three-dimensional adversarial domain constraint: a flow feature perturbation dimension constraint. By applying the above adversarial domain constraint to the perturbation in the adversarial example attack algorithm, adversarial example feature vectors that conform to the characteristics of the problem space are generated.

[0103] Feature vector generation for adversarial examples in the feature space is based on adversarial attack methods (such as PGD), which are achieved by applying carefully designed perturbations to the input feature vectors. Adversarial examples in the problem space and adversarial examples in the feature space together constitute the training data foundation for the collaborative adversarial training framework.

[0104] This invention designs an adversarial strategy generator to dynamically generate adversarial training strategies. It dynamically adjusts attack parameters based on input traffic characteristics and model robustness, controlling parameters such as attack strength, step size, and number of iterations in the feature space and problem space to cover different attack surfaces.

[0105] This paper innovatively designs a reward function based on a reinforcement learning-guided adversarial policy generator, focusing on four aspects: attack effectiveness, robustness improvement, key feature perturbation, and clean sample classification. Through policy optimization, the cumulative reward is maximized, thereby generating more effective adversarial training samples. Furthermore, the adversarial policy generator dynamically adjusts attack parameters based on input traffic characteristics and model state, covering diverse attack surfaces and avoiding the limitations of traditional fixed attack strategies.

[0106] This invention achieves a progressive improvement in the robustness of the intrusion detection model by constructing a dynamic game mechanism between the intrusion detection model and the adversarial strategy generator. Traditional adversarial training methods typically optimize inner layers only for predefined, fixed attack strategies. However, this invention, by introducing an adversarial strategy generator, transforms inner layer optimization into one based on dynamic attack strategy parameters, thus forming a two-way feedback mechanism. The improved robustness of intrusion detection networks drives the progressive optimization of adversarial policy generators, enabling them to explore more complex attack patterns. The adversarial policy generator guides the model's defense enhancements, and complex attacks expose potential vulnerabilities in the model's decision boundaries, providing more challenging training samples for the intrusion detection model. This game-theoretic process essentially simulates the dynamic adversarial relationship between attackers and defenders, allowing the model to adapt to mixed threats in both the feature and problem spaces during training, ultimately achieving improved robustness and generalization ability across both spaces.

[0107] On the other hand, the present invention also provides a network intrusion detection model end-to-end adversarial training defense device. Figure 5This is a schematic diagram of the framework of an optional network intrusion detection model adversarial training defense device provided by the present invention. The device includes: a traffic feature vector extraction module, used to acquire network traffic data and extract features from the network traffic data to obtain a traffic feature vector; An attack strategy generator is used to input the traffic feature vector into an adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and current strategy parameters. An adversarial sample generator is used to apply unconstrained perturbations and adversarial domain constrained perturbations to the traffic feature vector according to the attack space identifier in the dynamic attack strategy, thereby generating feature space adversarial samples and problem space adversarial samples. The adversarial training module is used to input the adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples into the intrusion detection model for adversarial training. By minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space, the model parameters of the intrusion detection model are updated. The strategy parameter optimization module is used to execute the strategy parameter optimization step of the adversarial strategy generator based on the performance of the intrusion detection model during the adversarial training process. The dual-space joint defense module is used to alternately execute the adversarial training and the strategy parameter optimization steps, so that the intrusion detection model and the adversarial strategy generator form a dynamic game mechanism, and the trained intrusion detection model is used for network traffic intrusion detection.

[0108] It should be noted that the network intrusion detection model end-to-end adversarial training and defense device provided in this embodiment of the invention can execute the network intrusion detection model end-to-end adversarial training and defense method of any of the above embodiments during specific operation, which will not be elaborated in this embodiment.

[0109] It should be noted that, in the description of the embodiments of the present invention, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for end-to-end adversarial training and defense of network intrusion detection models, characterized in that, include: Acquire network traffic data and extract features from the network traffic data to obtain a traffic feature vector; The traffic feature vector is input into the adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and the current strategy parameters. Based on the attack space identifier in the dynamic attack strategy, unconstrained perturbation and adversarial domain constrained perturbation are applied to the traffic feature vector respectively to generate feature space adversarial samples and problem space adversarial samples. The adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples are input into the intrusion detection model for adversarial training. The model parameters of the intrusion detection model are updated by minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space. Based on the performance of the intrusion detection model during the adversarial training process, the strategy parameter optimization step of the adversarial strategy generator is executed. The adversarial training and strategy parameter optimization steps are executed alternately to form a dynamic game mechanism between the intrusion detection model and the adversarial strategy generator, resulting in a trained intrusion detection model for network traffic intrusion detection.

2. The network intrusion detection model adversarial training defense method according to claim 1, characterized in that, The step of applying unconstrained perturbations and adversarial domain constrained perturbations to the traffic feature vector based on the attack space identifier in the dynamic attack strategy, respectively, to generate feature space adversarial samples and problem space adversarial samples includes: Based on the attack space identifier in the dynamic attack strategy, perform feature space adversarial perturbation generation operation and problem space adversarial perturbation generation operation respectively: When the attack space identifier indicates the feature space, a perturbation is applied to the traffic feature vector based on the adversarial attack algorithm to generate an adversarial perturbation of the feature space; When the attack space identifier indicates the problem space, the traffic feature vector is perturbed based on the adversarial attack algorithm, and the resulting perturbation is subject to adversarial domain constraints to generate a problem space adversarial perturbation; the adversarial domain constraints are used to ensure that the perturbed samples conform to network protocol specifications and feature logic consistency requirements. The feature space adversarial perturbation and the problem space adversarial perturbation are superimposed on the traffic feature vector to obtain feature space adversarial samples and problem space adversarial samples, respectively.

3. The network intrusion detection model adversarial training defense method according to claim 2, characterized in that, The adversarial domain constraint includes a traffic feature perturbation dimension constraint, which includes: The features in the traffic feature vector are divided into a set of variable features and a set of immutable features; When generating the adversarial perturbation in the problem space, the feature values ​​in the immutable feature set remain unchanged, and perturbations are applied only to the features in the variable feature set to generate adversarial sample features that meet the network protocol specifications and functional requirements.

4. The network intrusion detection model adversarial training defense method according to claim 3, characterized in that, The adversarial domain constraint also includes range and size constraint, wherein the range and size constraint include: For continuous features, the perturbation amplitude is limited to between a preset lower and upper bound to ensure that the perturbed feature value is within a reasonable range. For discrete features, the inverse normalization operation, the round-up operation, and the re-normalization operation are performed in sequence to map the perturbed continuous values ​​to integer values ​​that conform to the discrete characteristics.

5. The network intrusion detection model adversarial training defense method according to claim 3, characterized in that, The adversarial domain constraint also includes the traffic feature dependency constraint, which includes: For features with computational dependencies, the derived feature values ​​are recalculated according to the calculation formula of the computational dependencies after applying a perturbation; For features with size dependencies, a size dependency check is performed after applying a perturbation to ensure that the minimum feature is not greater than the maximum feature.

6. The network intrusion detection model adversarial training defense method according to claim 1, characterized in that, The step of optimizing the policy parameters of the adversarial policy generator based on the performance of the intrusion detection model during the adversarial training process includes: Based on the reinforcement learning framework, a multi-dimensional reward signal is calculated according to the performance of the intrusion detection model during the adversarial training process; Based on the multi-dimensional reward signal, optimize the strategy parameters of the adversarial strategy generator; The multi-dimensional reward signals include attack effect reward, robustness improvement reward, key feature perturbation reward, and clean sample classification reward; The attack effect reward is determined based on the classification loss of the intrusion detection model for the adversarial samples in the feature space and the adversarial samples in the problem space. The robustness enhancement reward is determined based on the degree of robustness improvement of the intrusion detection model after single-step adversarial training; The key feature perturbation reward is determined based on the difference in Shapley values ​​between the traffic feature vector and the adversarial samples in the feature space and the adversarial samples in the problem space. The clean sample classification reward is determined based on the classification accuracy of the clean sample by the intrusion detection model.

7. The network intrusion detection model adversarial training defense method according to claim 6, characterized in that, Based on the multi-dimensional reward signal, the policy parameters of the adversarial policy generator are optimized using the Actor-Critic reinforcement learning method; wherein, the Actor network generates the dynamic attack policy based on the current state, and the Critic network estimates the state value function and guides the policy update of the Actor network through temporal difference error.

8. The network intrusion detection model adversarial training defense method according to claim 6, characterized in that, The alternating execution of the adversarial training and the policy parameter optimization steps, to enable the intrusion detection model and the adversarial policy generator to form a dynamic game mechanism, includes: Generate alternating training parameters to control the training rhythm of the intrusion detection model and the adversarial strategy generator; In the early stages of training, when the robustness of the intrusion detection model is lower than a preset threshold, the adversarial strategy generator generates diverse attack strategies, including weak attack strategies and strong attack strategies. In the later stages of training, when the robustness of the intrusion detection model exceeds a preset threshold, the adversarial strategy generator, guided by the multi-dimensional reward signal, learns to generate high-intensity adversarial samples and complex attack patterns.

9. The network intrusion detection model adversarial training defense method according to claim 6, characterized in that, The calculation of the key feature perturbation reward includes: Calculate the first Shapley value vector of the traffic feature vector in the intrusion detection model, and the second Shapley value vectors of the feature space adversarial sample and the problem space adversarial sample in the intrusion detection model, respectively; The L1 norm distance between the first Shapley value vector and the second Shapley value vector is calculated as the reward for the key feature perturbation. The key feature perturbation reward is used to quantify the degree of change in the dependence of the perturbation on the key feature, and guide the adversarial strategy generator to generate effective perturbations for the key feature. The calculation of the robustness enhancement reward includes: Based on the model parameters of the current intrusion detection model and the adversarial samples generated by the dynamic attack strategy, single-step adversarial training is performed to obtain the updated model parameters; The updated intrusion detection model is constructed using the updated model parameters, and the classification loss of the updated intrusion detection model on the same adversarial sample is calculated. The robustness enhancement reward is determined based on the negative value of the classification loss. The robustness enhancement reward is used to evaluate the effect of the adversarial examples on improving the robustness of the model after single-step adversarial training.

10. A network intrusion detection model adversarial training defense device, characterized in that, include: The traffic feature vector extraction module is used to acquire network traffic data and extract features from the network traffic data to obtain a traffic feature vector. An attack strategy generator is used to input the traffic feature vector into an adversarial strategy generator, which outputs a dynamic attack strategy based on the traffic feature vector and current strategy parameters. An adversarial sample generator is used to apply unconstrained perturbations and adversarial domain constrained perturbations to the traffic feature vector according to the attack space identifier in the dynamic attack strategy, thereby generating feature space adversarial samples and problem space adversarial samples. The adversarial training module is used to input the adversarial samples in the feature space, the adversarial samples in the problem space, and the clean samples into the intrusion detection model for adversarial training. By minimizing the classification loss of the intrusion detection model on the adversarial samples in the feature space and the adversarial samples in the problem space, the model parameters of the intrusion detection model are updated. The strategy parameter optimization module is used to execute the strategy parameter optimization step of the adversarial strategy generator based on the performance of the intrusion detection model during the adversarial training process. The dual-space joint defense module is used to alternately execute the adversarial training and the strategy parameter optimization steps, so that the intrusion detection model and the adversarial strategy generator form a dynamic game mechanism, and the trained intrusion detection model is used for network traffic intrusion detection.

Images