Intrusion detection method fusing feature optimization and two-stage pruning optimization

Abstract

The invention relates to the technical field of network security and machine learning, and particularly discloses an intrusion detection method fusing feature optimization and two-stage pruning optimization, which comprises the following steps: screening each feature of an original traffic sample in a training set based on an information gain and grey wolf optimization algorithm to obtain an optimal feature subset and a common feature subset; performing two-stage pruning on the random forest classifier, in the first-stage pruning, performing hierarchical feature sampling according to a fixed proportion, and adopting a Gini index as a measurement index of node splitting purity to control a node splitting process of a single decision tree; in the second stage of pruning, marginal contribution degrees of the current decision tree in different decision tree subsets are quantified by a Shapley value, dynamic smooth updating is performed on the marginal contribution degrees in combination with a sliding window mechanism, and decision trees with low contribution degrees are eliminated. According to the method, on the premise of ensuring high detection precision, the model complexity and calculation overhead are reduced, and current complex and changeable network security threats are dealt with.

Description

An Intrusion Detection Method Integrating Feature Optimization and Two-Stage Pruning Optimization Technical Field

[0001] This invention relates to the fields of network security and machine learning technology, and more specifically to an intrusion detection method that integrates feature optimization and two-stage pruning optimization. Background Technology

[0002] With the rapid development of communication networks and IoT technologies, network traffic is growing exponentially. Various network attacks (such as DDoS attacks, malicious code injection, and brute-force attacks) are becoming increasingly complex, posing a serious threat to network security. Intrusion Detection Systems (IDS) have become one of the core technologies for ensuring network security. Traditional intrusion detection technologies are mainly divided into two categories: signature-based detection and anomaly-based detection. While signature-based detection methods can accurately identify known attacks, they are completely ineffective against unknown attacks such as zero-day attacks and advanced persistent threats. Furthermore, they require frequent updates to the signature database to adapt to new attack patterns, making it difficult to cope with the rapid evolution of attack methods. Anomaly-based detection methods, while possessing the potential to identify unknown attacks, rely heavily on labeled data for building normal behavior models and are sensitive to changes in the network environment, resulting in a high false positive rate. This is especially true in heterogeneous network environments such as the IoT, where diverse device types and complex traffic characteristics make it difficult for existing models to establish a universally applicable baseline of normal behavior, further exacerbating the false positive problem.

[0003] Traditional methods also have certain shortcomings in feature processing, model building, and passive response mechanisms to attack evolution. At the feature level, existing technologies mostly adopt random sampling or single screening strategies, which neither fully consider the correlation between features and attack types nor effectively remove redundant features. This leads to noise interference in high-dimensional network traffic data, which not only increases training complexity but also reduces the accuracy of classification decisions. Although some solutions attempt feature dimensionality reduction, they lack dynamic optimization mechanisms and are difficult to adapt to changes in feature distribution under different attack scenarios.

[0004] At the model level, ensemble learning schemes, such as random forests, often rely on manually pre-setting the number of decision trees, lacking evaluation and screening of the effectiveness of the tree structure. A large number of redundant trees with low contribution not only waste computing resources, but also easily reduce generalization ability due to overfitting. Existing pruning techniques are mostly static single-stage processing, which cannot accurately retain a subset of trees with high discriminative power and strong complementarity, making it difficult to balance model compression rate and detection performance.

[0005] Furthermore, most existing systems employ a passive detection architecture, lacking targeted defense designs against adversarial attacks. Attackers can mislead the model into making incorrect classifications simply by adding minor perturbations, while the model itself lacks the ability to dynamically update and adaptively adjust, thus weakening the actual protective value of the detection system.

[0006] Therefore, how to reduce model complexity and computational overhead while ensuring high detection accuracy, and improve real-time response capabilities to cope with the current complex and ever-changing cybersecurity threats, is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] In view of the above problems, this invention proposes an intrusion detection method that integrates feature optimization and two-stage pruning optimization, so as to overcome the above problems or at least partially solve them.

[0008] To achieve the above objectives, the present invention adopts the following technical solution: an intrusion detection method integrating feature optimization and two-stage pruning optimization, comprising the following steps: acquiring the original network traffic dataset and dividing it into a training set and a validation set; calculating the information gain of each feature of the original traffic samples in the training set, and performing initial screening of the features based on the information gain; using the detection accuracy of the random forest classifier as the fitness value, further screening the remaining features after the initial screening based on the gray wolf optimization algorithm to obtain the optimal feature subset and the ordinary feature subset; performing two-stage pruning on the random forest classifier, wherein the first stage... In the first pruning stage, hierarchical feature sampling is performed from the optimal feature subset and the ordinary feature subset at a fixed ratio. The Gini index is used as a measure of node splitting purity to control the node splitting process of a single decision tree. In the second pruning stage, each decision tree after the first pruning stage is used as a game participant. The Shapley value of each decision tree is calculated on the validation set. The Shapley value is used to quantify the marginal contribution of the current decision tree in different decision tree subsets. The marginal contribution is dynamically and smoothly updated using a sliding window mechanism. Decision trees with low contribution are removed to obtain the final random forest classifier.

[0009] Furthermore, the process of initial feature screening based on information gain includes: dividing the various sample categories in the training set into two classes: normal traffic and attack traffic, and calculating the information entropy. To measure the uncertainty of the training set class distribution:

[0010] in, This represents the proportion of samples of class i in the training set D. This represents the number of samples in the i-th class. This represents the total number of samples in the training set D; Let information entropy be the feature to be evaluated, and its value range be [0,1]. Let F be the feature to be evaluated, and its value set be { The feature F divides the training set D into k subsets D1, D2, ..., Dk. k , where subset D j The value of F is included in all features F.j The sample, ; Calculate conditional entropy To measure the residual uncertainty of the class distribution of the training set D given the values ​​of feature F:

[0011] in, For subset Information entropy Let the feature F take the value F j subset of time Number of samples, conditional entropy The smaller the value of F, the greater the help feature F provides in reducing the uncertainty of the dataset categories, and the stronger the correlation between the feature and the detection target; the difference between the information entropy H(D) and the conditional entropy H(D|F) is used as the feature to be evaluated. Information gain Information gain Features with information gain less than the information gain threshold λ are identified as low-relevance or redundant features and removed. The information gain is then... Features that are greater than or equal to the information gain threshold λ are identified as highly relevant features and retained.

[0012] Furthermore, the process of further filtering the remaining features after the initial screening based on the gray wolf optimization algorithm includes: assuming the number of remaining features after the initial screening is n, each gray wolf corresponds to a binary vector of length n. ,in, This indicates that the i-th feature is selected. This indicates that the i-th feature is removed; the gray wolf population size is initialized to N, and the binary vector of each individual is initialized randomly; the detection accuracy of the random forest classifier is used as the fitness value, the individual with the highest fitness in the population is regarded as α wolf, corresponding to the optimal feature subset, the individual with the second highest fitness is regarded as β wolf, corresponding to the second optimal feature subset, the individual with the third highest fitness is regarded as δ wolf, corresponding to the third optimal feature subset, and the other individuals are regarded as ordinary ω wolves, corresponding to the ordinary feature subset; by simulating the leadership role of α wolf, β wolf, and δ wolf in the gray wolf population, the ordinary ω wolves are guided to search towards the optimal solution until the maximum number of iterations is reached, and the optimal feature subset and the ordinary feature subset are output.

[0013] Furthermore, in each iteration, the distance between each ω wolf and the α, β, and δ wolves is calculated according to the following formula:

[0014] Where t is the current iteration number, , , Let be the position vectors of wolf α, wolf β, and wolf δ respectively at the t-th iteration. Let ω be the position vector of the wolf at time t. , , Let ω be a random coefficient vector; based on the distance calculation results, update the position of wolf ω to move it closer to the region surrounded by wolves α, β, and δ. The position update formula is as follows:

[0015] in, , , The convergence coefficient vector, This represents the candidate position vector of wolf ω after it moves closer to wolf α. This represents the candidate position vector after wolf ω moves closer to wolf β. This represents the candidate position vector after wolf ω moves closer to wolf δ. for The position vector of the wolf at time ω.

[0016] Furthermore, the first stage of pruning includes: performing stratified sampling from the optimal feature subset and any ordinary feature subset according to a fixed ratio to generate a candidate set of splitting features, and constructing a decision tree starting from the root node; assuming that the current decision tree node C to be split contains s samples, where the number of normal traffic samples is s1 and the number of attack traffic samples is s2, calculate the Gini index of this node:

[0017] in, , where represents the proportion of the i-th type of sample in the node C to be split. This represents the number of samples in the i-th class; The Gini index of the node to be split is represented, with a value ranging from [0,1]. The smaller the value, the more concentrated the class distribution of the node samples and the higher the purity of the node. For each feature F in the candidate set of splitting features, all its possible values ​​are traversed as the splitting threshold v, and the node C is divided into left child nodes. with right child node The Gini index of each of the two child nodes is calculated, and the splitting effect of the current feature-threshold combination is evaluated by the Gini index gain. The Gini index gain after splitting is... The calculation formula is:

[0018] in, Indicates the left child node Number of samples included Indicates the right child node Number of samples included and These are the Gini indices for the left and right child nodes, respectively. This represents the proportion of the number of samples in the left child node to the total number of samples in the parent node C. This represents the proportion of the number of samples in the right child node to the number of samples in the parent node. Let C represent the Gini index of node C. For each node to be split, select the feature-threshold combination with the largest Gini index gain as the final splitting method. When the growth process of a single decision tree continues until the node splitting termination condition is met, the last splitting node is taken as the leaf node, and the construction of a single decision tree is completed.

[0019] Furthermore, there are three conditions for terminating node splitting. When any one of these conditions is met, the growth of a single decision tree is considered complete. The three conditions are as follows: Condition 1: The number of samples corresponding to the current node to be split is less than the preset minimum number of samples; Condition 2: The Gini index of the current node to be split is less than the preset purity threshold γ; Condition 3: There are no effective features in the candidate set of splitting features of the current node to be split that can be used to continue splitting.

[0020] Furthermore, in the second stage of pruning, the forest after the first stage of pruning... Considered as a set of participants in a cooperative game, each decision tree As a participant, any subset of decision trees Considered as a consortium, the consortium's revenue is defined as the detection accuracy of the random forest corresponding to that subset of decision trees on the validation set; the marginal contribution of each decision tree is measured by the Shapley value, where the i-th decision tree T i marginal contribution The calculation formula is:

[0021] in, It means all contained in the forest But it does not include the current decision tree T. i The alliance; This indicates the number of decision trees contained in consortium S; The weight coefficient of alliance S represents the probability of that alliance appearing among all possible alliances; Representing a decision tree T i The performance of the random forest classifier after adding consortium S Representing a decision tree T i Performance of the random forest classifier before joining consortium S; Representing a decision tree T i The performance gains brought by joining Alliance S; The value range of is [-1, 1]. When When the value is greater than 0, retain the current decision tree T.i ,when When ≤ 0, the current decision tree T is... i Included in the pruning candidate range.

[0022] Furthermore, the process of dynamically and smoothly updating the marginal contribution using the sliding window mechanism includes: setting the sliding window size to w and the time step to 1; recalculating the marginal contribution of all decision trees based on the latest partitioned validation subset each time the window slides; and updating the marginal contribution of the i-th decision tree T. i Dynamic smoothing contribution at time t , defined as the arithmetic mean of the w most recent marginal contributions within the sliding window, is calculated using the following formula:

[0023] Where k represents the time point index, Let T represent the i-th decision tree. i The marginal contribution calculated at a specific time t in the past.

[0024] Furthermore, the second-stage pruning process includes: sorting all decision trees in the forest after the first-stage pruning according to their dynamic smoothing contribution from low to high, resulting in a decision tree sequence; each pruning operation only removes the lowest-contribution tree ranked first in the sequence, resulting in a new forest; and calculating the new forest. Detection accuracy on the validation set and the forest before removing low-contribution trees. accuracy By comparison, the performance gain of this pruning was obtained. ;like If so, continue with the next pruning; if If the pruning stops, the removed decision tree is restored.

[0025] Furthermore, the second-stage pruning also includes setting a performance gain threshold. , The value ranges from 0 to 0.01. If the performance gain of 3 to 5 consecutive pruning operations satisfies... If the random forest classifier reaches its performance gain saturation point, the pruning operation is stopped.

[0026] As can be seen from the above technical solutions, compared with the prior art, the present invention has the following beneficial effects: 1. The present invention accurately selects the optimal feature subset through a hybrid strategy of information gain and gray wolf optimization algorithm, which reduces the input dimension and improves the correlation between features and detection targets. This solves the technical problem in the prior art that random forests mostly use random feature sampling, which easily includes redundant and low-correlation features, thus leading to a decrease in detection accuracy.

[0027] 2. This invention combines two-stage pruning with hierarchical sampling and dynamic purity pruning to retain high-value decision trees, and then uses adaptive sliding window pruning to remove low-contribution trees, stopping pruning at the performance saturation point, thus achieving a balance between lightweight model and high detection accuracy. This solves the technical problems of existing solutions requiring manual setting of the number of random forest decision trees, and the difficulty in balancing compression ratio and performance with a single pruning technique.

[0028] 3. This invention preserves highly generalizable and complementary decision trees through two-stage pruning and reduces evaluation fluctuations through a dynamic weighting mechanism, which significantly improves the ability to identify various attack and adversarial samples, and is especially suitable for multi-device IoT scenarios.

[0029] 4. This invention significantly reduces model complexity and detection time through feature optimization and pruning, making it suitable for resource-constrained scenarios such as edge devices and broadening the application scope of intrusion detection technology. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0031] Figure 1 is a flowchart of the intrusion detection method that combines feature optimization and two-stage pruning optimization provided in an embodiment of the present invention; Figure 2 is a flowchart of feature filtering based on information gain and gray wolf optimization algorithm provided in an embodiment of the present invention; Figure 3 is a flowchart of the first-stage pruning provided in an embodiment of the present invention; Figure 4 is a flowchart of the second-stage pruning provided in an embodiment of the present invention. Detailed Implementation

[0032] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0033] As shown in Figure 1, this embodiment of the invention discloses an intrusion detection method that integrates feature optimization and two-stage pruning optimization, including the following steps: S1, obtaining the original open-source network traffic dataset, performing data cleaning, numericalization, standardization, and normalization preprocessing, dividing it into a training set and a validation set, calculating the information gain of each feature of the original traffic samples in the training set, and performing initial screening of the features based on the information gain; S2, using the detection accuracy of the random forest classifier as the fitness value, further screening the remaining features after the initial screening based on the gray wolf optimization algorithm to obtain the optimal feature subset and the ordinary feature subset; S3, performing two-stage pruning on the random forest classifier, wherein the first stage... In the first stage of pruning, hierarchical feature sampling is performed from the optimal feature subset and the ordinary feature subset at a fixed ratio. The Gini index is used as a measure of node splitting purity to control the node splitting process of a single decision tree. In the second stage of pruning, each decision tree after the first stage of pruning is used as a game participant. The Shapley value of each decision tree is calculated on the validation set. The Shapley value is used to quantify the marginal contribution of the current decision tree in different decision tree subsets. The marginal contribution is dynamically and smoothly updated using a sliding window mechanism. Decision trees with low contribution are removed to obtain the final random forest classifier. Intrusion detection is performed on real-time network traffic based on the final random forest classifier.

[0034] In intrusion detection scenarios, network traffic data often contains a large number of redundant or noisy features with low relevance to the attack detection target. The completely random feature subspace sampling method used by traditional random forests is prone to including such low-value features in the model training, which not only increases computational complexity but also interferes with the classification judgment of the decision tree, leading to a decrease in detection accuracy. Especially in the Internet of Things environment, the heterogeneous data generated by multiple devices and protocols further exacerbates the difficulty of feature selection. If high-value and low-value features cannot be effectively distinguished, the model will find it difficult to accurately capture the key patterns of attack traffic.

[0035] This invention aims to address the problems of insufficient feature selection, redundant single decision tree structures, low efficiency of forest-level models, and inadequate anti-interference capabilities in existing intrusion detection technologies. The technical details, implementation logic, and key formulas of each step are described in detail below.

[0036] First, this invention designs a hybrid feature selection strategy (IG-GWO) that combines Information Gain (IG) and the Grey Wolf Optimizer (GWO) algorithm. By combining information gain with GWO, and using a measure of feature importance (such as information gain or mutual information) as a guiding term, the update direction of individual grey wolves in the search space is optimized. This achieves a weighted search of key features, finding the optimal feature subset that maximizes the accuracy of random forest detection, thus reducing feature dimensionality and improving discriminative power. Specifically, steps S1-S2 are shown in Figure 2.

[0037] S1. The core principle of information gain is to quantify the information contribution of features to the target variable (i.e., the "normal / attack" label of traffic samples), select features that can significantly reduce the uncertainty of category distribution, and eliminate redundant and low-correlation features. Its calculation process is based on information entropy and conditional entropy. The specific calculation process is as follows: 1) Divide each sample category in the training set into two categories: normal traffic and attack traffic. The number of samples in each category is respectively... and And satisfy + = Calculate information entropy To measure the uncertainty of the training set class distribution:

[0038] in, This represents the proportion of samples of class i in the training set D. This represents the number of samples in the i-th class. This represents the total number of samples in the training set D; represents information entropy, and its value ranges from [0,1]. The smaller the value, the more concentrated the category distribution of the dataset, that is, the lower the uncertainty of the sample labels. Conversely, the larger the value, the more dispersed the category distribution and the higher the uncertainty.

[0039] 2) In the process of calculating conditional entropy, let the feature to be evaluated be F, and its set of values ​​be { The feature F divides the training set D into k subsets D1, D2, ..., Dk. k , where subset D j The value of F is included in all features F. j The sample, ; Calculate conditional entropy To measure the residual uncertainty of the class distribution of the training set D given the values ​​of feature F:

[0040] in, Let the feature F take the value F j subset of time Number of samples; conditional entropy The smaller the value, the greater the help feature F provides in reducing the uncertainty of the dataset categories, and the stronger the correlation between the feature and the detection target. For subset Information entropy, calculation method and the previous information entropy The calculation method is the same as that for the following:

[0041] , For subset The number of samples of class i.

[0042] 3) The difference between the information entropy H(D) and the conditional entropy H(D|F) is used as the feature to be evaluated. Information gain The calculation formula is:

[0043] A larger information gain IG(F, D) indicates that feature F provides more effective information for the attack detection task and contributes more to the classification decision. To accurately select high-value features, the information gain threshold λ is determined on the training set through five-fold cross-validation. Features with information gain less than the information gain threshold λ are identified as low-relevance or redundant features and removed. The information gain is then... Features that are greater than or equal to the information gain threshold λ are identified as highly relevant features and retained, thus initially achieving an effective reduction in feature dimensionality and an improvement in quality.

[0044] S2, the Gray Wolf Algorithm, simulates the encirclement, pursuit, and attack behavior of a gray wolf pack during predation. It possesses strong global search capabilities and can effectively avoid local optima. The specific implementation is as follows: A subset of features is encoded as individual gray wolves. Let n be the number of remaining features after the initial screening. Each individual gray wolf corresponds to a binary vector of length n. ,in, This indicates that the i-th feature is selected and included in the subsequent training of the random forest classifier. This indicates that the i-th feature is removed.

[0045] To ensure population diversity, the gray wolf population size is initialized to N, and the binary vector of each individual is initialized in a random manner to ensure that the initial population covers multiple possible combinations of features.

[0046] The detection accuracy of the random forest classifier is used as the fitness value; that is, the better the performance of the feature subset, the higher the fitness value of the corresponding gray wolf individual.

[0047] The individual with the highest fitness in the population is considered an α wolf, corresponding to the optimal feature subset; the individual with the second highest fitness is considered a β wolf, corresponding to the second-best feature subset; the individual with the third highest fitness is considered a δ wolf, corresponding to the third-best feature subset; and the other individuals are considered ordinary ω wolves, corresponding to the ordinary feature subset. By simulating the leadership role of α, β, and δ wolves in the gray wolf population, the ordinary ω wolves are guided to search towards the optimal solution until the maximum number of iterations is reached. The optimal feature subset and the ordinary feature subset are then output. The ordinary feature subset consists of the feature subsets corresponding to the other ordinary ω wolves besides α, β, and δ wolves, and its number is N-3.

[0048] In each iteration, the distance between each ω wolf and the α, β, and δ wolves is calculated according to the following formula:

[0049] Where t is the current iteration number, , , Let be the position vectors of wolf α, wolf β, and wolf δ respectively at the t-th iteration. Let ω be the position vector of the wolf at time t. , , is a random coefficient vector; the calculation formula is C = 2r1, where r1 is a random number uniformly distributed in the interval [0,1]. Its function is to increase the randomness of the search process and avoid the algorithm from getting trapped in local optima.

[0050] Based on the distance calculation results, update the position of ω wolf to move it closer to the area surrounded by α wolf, β wolf, and δ wolf. The position update formula is as follows:

[0051] in, This represents the candidate position vector of wolf ω after it moves closer to wolf α. This represents the candidate position vector after wolf ω moves closer to wolf β. This represents the candidate position vector after wolf ω approaches wolf δ; for The position vector of the wolf at time ω; , , The convergence coefficient vector is calculated using the following formula: r² is a uniformly distributed random number within the interval [0,1], and 'a' is a convergence factor that decreases linearly from 2 to 0 with each iteration. Its function is to control the rate at which the search range shrinks—a is larger in the early iterations, resulting in a wider search range and facilitating global exploration; a is smaller in the later iterations, shrinking the search range and facilitating precise location of the optimal solution. Using this subset as input in subsequent random forest training not only reduces model training time but also improves detection accuracy, providing a highly discriminative feature base for subsequent single-tree pruning and forest optimization.

[0052] In existing intrusion detection technologies, the pruning operations of random forests are mostly concentrated after the forest is built, compressing the model by removing redundant decision trees with low contribution. However, this ignores the structural optimization during the growth process of individual decision trees. When traditional decision trees split at nodes, if the feature selection is not targeted, it is easy to lead to redundant tree structures (such as too many nodes or too deep trees) due to over-reliance on low-value features. This not only increases the computational cost of individual decision trees but also reduces their ability to capture key attack patterns, thus affecting the detection performance of the entire forest. Especially in IoT scenarios, where device computing power and memory resources are limited, redundant individual decision tree structures will further exacerbate the real-time detection latency problem, making it difficult to meet the low-latency application requirements.

[0053] S3. Perform two-stage pruning on the random forest classifier.

[0054] This invention focuses the first-stage pruning on the growth process of a single decision tree. Based on the optimal feature subset and ordinary feature subset selected by IG-GWO, it controls the selection of node splitting features of a single decision tree through a fixed ratio of hierarchical feature sampling, reducing tree structure redundancy from the source and strengthening the reliance on key attack features. As shown in Figure 3, the first-stage pruning specifically includes: 1) performing hierarchical sampling from the optimal feature subset and any ordinary feature subset (randomly selected from N-3 ordinary feature subsets) according to a fixed ratio, for example, sampling from the optimal feature subset and ordinary feature subset at a 7:3 ratio and merging them to generate a splitting feature candidate set. This allows each tree to randomly select different ordinary feature subsets for hierarchical sampling when constructing multiple decision trees, further improving the ensemble diversity of random forests and enhancing the model's generalization ability.

[0055] 2) Build a decision tree starting from the root node, using the Gini Index as a measure of node splitting purity, and select the combination of features and thresholds that maximizes the improvement of node purity to ensure that a single decision tree can further optimize classification accuracy while maintaining a lightweight structure.

[0056] Suppose that the current decision tree node C to be split contains s samples, where the number of normal traffic samples is s1 and the number of attack traffic samples is s2. Calculate the Gini index of this node:

[0057] in, , where represents the proportion of the i-th type of sample in the node C to be split. This represents the number of samples in the i-th class; The Gini index represents the current node to be split, with a value range of [0,1]. The smaller the value, the more concentrated the class distribution of the node samples and the higher the node purity. When all samples belong to the same class, the Gini index is 0. When the number of samples in the two classes is exactly equal, the Gini index is 0.5, and the purity is the lowest.

[0058] 3) For each feature F in the candidate set of splitting features, iterate through all its possible values ​​as the splitting threshold v, and divide node C into left child nodes. (Corresponding sample feature F ≤ v) and right child node (For the corresponding sample feature F>v), calculate the Gini index of each of the two child nodes, and evaluate the splitting effect of the current feature-threshold combination by the Gini index gain. The Gini index gain after splitting is... The calculation formula is:

[0059] in, Indicates the left child node Number of samples included (of which normal samples) Item, attack sample strip), Indicates the right child node Number of samples included (of which normal samples) Item, attack sample strip), and These are the Gini indices for the left and right child nodes, respectively. This represents the proportion of the number of samples in the left child node to the total number of samples in the parent node C. This represents the proportion of the number of samples in the right child node to the number of samples in the parent node, used for weighted calculation of the overall Gini index after splitting. Gini exponent of node C; Gini exponent gain The larger the value, the more significant the effect of the feature-threshold combination on improving node purity, and the stronger the classification ability of the split child nodes.

[0060] 4) For each node to be split, select the feature-threshold combination with the largest Gini index gain as the final splitting method to ensure the effectiveness of node splitting.

[0061] 5) When the growth process of a single decision tree continues until the node splitting termination condition is met, the last splitting node is taken as a leaf node, and the construction of the single decision tree is completed.

[0062] There are three conditions for terminating node splitting. When any one of these conditions is met, the growth of a single decision tree is considered complete. The three conditions are as follows: Condition 1: The number of samples corresponding to the node to be split is less than the preset minimum number of samples. When the number of samples in a node is too small, continuing to split may lead to the tree structure overfitting local samples and reducing the generalization ability. Therefore, splitting is stopped and the node is marked as a leaf node. The category of the leaf node is determined by the category with the highest proportion in the samples of that node.

[0063] Condition 2: The Gini index of the current node to be split is less than the preset purity threshold γ. When the Gini index of a node reaches this threshold, it means that the node sample categories are highly concentrated and the purity meets the classification requirements. Continuing to split will contribute very little to improving the classification accuracy and will increase the redundancy of the tree structure. Therefore, splitting is stopped and the node is marked as a leaf node.

[0064] Condition 3: There are no valid features in the candidate set of splitting features for the current node to be split; in this case, continuing to split will not improve the purity of the node, but will instead increase the depth of the tree, so the splitting is stopped and the node is marked as a leaf node.

[0065] By integrating hierarchical feature sampling and dynamic purity pruning in the first stage of pruning, the structure of a single decision tree is significantly optimized: compared with decision trees in traditional random forests, the number of nodes is reduced by 25%~35%, the tree depth is reduced by 15%~20%, and the computational cost of a single decision tree is reduced by more than 30%; at the same time, the core depends on important feature splitting to provide a high-quality base tree set for subsequent forest-level pruning.

[0066] After the first stage of pruning individual decision trees, although each decision tree has achieved a lightweight structure and high discriminative power, some decision trees with low contribution may still exist in the entire forest. When facing specific attack types or dynamically changing network traffic, these trees not only fail to provide effective support for the forest's final classification decision, but may even cause a decrease in the overall detection accuracy of the forest due to their own classification errors, while also consuming additional computing resources. In existing technologies, forest-level pruning often uses static scoring mechanisms, which cannot dynamically adapt to changes in the contribution of decision trees under different attack scenarios, easily leading to over-pruning or under-pruning, and making it difficult to achieve a balance between model compression rate and detection performance.

[0067] To address this, this invention proposes a second-stage pruning strategy, introducing the Adaptive Weighted Shapley (AWS) method within the framework of cooperative game theory. Each decision tree is treated as a player in the game, and its importance is assessed by calculating its marginal contribution across different subsets of decision trees. Simultaneously, a sliding window mechanism is used to dynamically and smoothly update the contribution, avoiding the instability of static scoring. Finally, pruning is triggered when a performance gain saturation point is detected, precisely removing low-contribution trees and achieving further compression and performance enhancement of the forest model.

[0068] In cooperative game theory, the Shapley value is used to quantify the average marginal contribution of each participant across all possible alliances, providing a fair and objective measure of a participant's value to the overall performance of the alliance. As shown in Figure 4, the specific steps of the second-stage pruning are as follows: [The text then abruptly shifts to a different topic:] The forest after the first-stage pruning... Considered as a set of participants in a cooperative game, each decision tree As a participant, any subset of decision trees Consider it as a consortium, and the consortium's profit is defined as the detection accuracy of the random forest corresponding to the subset of decision trees on the validation set.

[0069] The marginal contribution of each decision tree is measured by the Shapley value, where the i-th decision tree T i marginal contribution The calculation formula is:

[0070] in, It means all contained in the forest But it does not include the current decision tree T. i The alliance; This indicates the number of decision trees contained in consortium S; The weight coefficient of alliance S represents the probability of that alliance appearing among all possible alliances. All alliances are considered to appear with equal probability.

[0071] Representing a decision tree T i The performance of the random forest classifier after adding consortium S Representing a decision tree T i Performance of the random forest classifier before joining consortium S; Representing a decision tree T i The performance gains brought by joining Alliance S.

[0072] The value range of is [-1, 1]. When When >0, the current decision tree T iIn most alliances, it provides a positive boost to forest performance and makes a positive contribution to attack detection; therefore, it should be retained. When ≤ 0, it indicates that the current decision tree T i Trees that fail to provide positive benefits in most alliances and may even reduce forest performance are considered low-contribution trees and should be included in the pruning candidate range.

[0073] Shapley score calculation allows for an objective assessment of the importance of each tree from a global perspective, avoiding misjudgments caused by traditional static scoring based on a single scenario or metric, and providing accurate decision-making basis for subsequent pruning. However, static Shapley score evaluation is susceptible to fluctuations in the distribution of validation set samples. If pruning is based on the static Shapley score at a given moment, it is easy to mistakenly classify high-contribution trees as low-contribution trees, leading to a decrease in the forest's ability to detect other attack types after pruning.

[0074] To address this issue, this invention introduces a sliding window mechanism to dynamically and smoothly update the marginal contribution of Shapley values, reducing the impact of sample distribution fluctuations on contribution assessment and more stably reflecting the long-term importance of each decision tree. Specifically: 1) The sliding window size is set to w, and the time step is 1. Each time the window slides, the marginal contribution of all decision trees is recalculated based on the latest partitioned validation subset, ensuring that the contribution assessment is synchronized with the current network traffic characteristics. The choice of window size w needs to balance stability and real-time performance. If w is too large, it cannot respond to the real changes in the contribution of decision trees in a timely manner; if w is too small, it cannot effectively smooth the impact of sample fluctuations. In this embodiment, w = 5~10, which achieves the best balance between the two. The latest partitioned validation subset is obtained by dynamically truncating or resampling the original validation set through the time sliding window. After each window slide, a subset synchronized with the current detection scenario is generated, ensuring the real-time performance of contribution assessment. Without the sliding window, the entire original validation set is used for a one-time contribution evaluation. With the sliding window, the latest subset of the validation set is a time slice subset of the original validation set, and the union of all subsets is equal to or covers the original validation set (the union is the original validation set when the windows do not overlap, and covers the original validation set when they overlap).

[0075] 2) Transform the i-th decision tree T i Dynamic smoothing contribution at time t (corresponding to the t-th window slide) , defined as the arithmetic mean of the w most recent marginal contributions within the sliding window, is calculated using the following formula:

[0076] Where k represents the time point index, Let T represent the i-th decision tree. i The marginal contribution calculated at a specific time t in the past.

[0077] Dynamic smoothing contribution It can effectively filter out noise caused by fluctuations in a single sample, and more objectively reflect the tree T. i The core objective of pruning based on the average contribution level over a period of time is to remove low-contribution trees to the maximum extent possible while ensuring forest detection performance. Therefore, it is necessary to accurately determine the performance gain saturation point. Stopping pruning at this point can achieve the best balance between model compression ratio and performance. The specific detection process includes: 3) According to the dynamic smoothing contribution level Sort all decision trees in the forest after the first stage of pruning in ascending order to obtain the decision tree sequence. ,in, Trees ranked higher in the sequence have lower long-term contributions and are therefore prioritized for pruning.

[0078] 4) Each pruning operation only removes the lowest-contribution tree ranked first in the sequence, resulting in a new forest. .

[0079] 5) Calculate the new forest Detection accuracy on the validation set and the forest before removing low-contribution trees. accuracy By comparison, the performance gain of this pruning was obtained. : Performance gain The sign and magnitude of the value directly reflect the impact of this pruning on forest performance: if This indicates that removing low-contribution trees has a negative impact on forest performance. If forest performance improves after pruning, then the current pruning result should be retained, and the next pruning should continue; if ΔAcc(t)>0, = 0: This indicates that the removed low-contribution trees have no impact on forest performance, and forest performance remains unchanged after pruning. Therefore, the current pruning result should be retained, and the next pruning attempt can be continued; if... If the removed trees contribute positively to forest performance, and forest performance declines after pruning, then pruning should be stopped and the removed decision trees restored.

[0080] In the second stage of pruning, to avoid misjudgments caused by single performance fluctuations, a performance gain threshold is also set. , The value ranges from 0 to 0.01. If the performance gain of 3 to 5 consecutive pruning operations satisfies... If the random forest classifier reaches its performance gain saturation point, then continuing to remove low-contribution trees will no longer significantly improve forest performance, and may even lead to performance degradation due to excessive pruning. Therefore, the pruning operation should be stopped.

[0081] Experimental results show that on the CIC-IDS-2017 dataset, the optimal feature subset selected by the IG-GWO hybrid strategy of feature selection reduces the dimension by 42% compared to the original network traffic features, and the model training time is reduced by 38% compared to the traditional random feature selection. At the same time, the random forest trained using this subset improves the detection accuracy on the benchmark dataset by 2.3% compared to the traditional random feature selection. After the first stage of single decision tree pruning, the number of nodes in a single decision tree is reduced by 32% compared to the traditional decision tree, and the tree depth is reduced by 18%. After the second stage of forest-level pruning, the number of decision trees is reduced from the initial 100 to 62, but the detection accuracy is improved by 3.8%, and the single sample detection time is reduced from 0.72ms to 0.58ms, with an efficiency improvement of 56.9%.

[0082] Therefore, this invention effectively solves the problems of inefficient features, model redundancy, insufficient real-time performance, and weak anti-interference ability in existing intrusion detection technologies by using IG-GWO hybrid feature selection and multi-stage pruning optimization strategies. While ensuring high detection accuracy, it significantly reduces model complexity and computational overhead, providing an efficient and reliable technical solution for real-time intrusion detection in enterprise networks, IoT and other scenarios.

[0083] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0084] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An intrusion detection method that integrates feature optimization and two-stage pruning optimization, characterized in that, Includes the following steps: The original network traffic dataset is obtained and divided into training and validation sets. Information gain is calculated for each feature of the original traffic samples in the training set, and the features are initially screened based on the information gain. The detection accuracy of the random forest classifier is used as the fitness value, and the remaining features after the initial screening are further screened based on the Grey Wolf optimization algorithm to obtain the optimal feature subset and the ordinary feature subset. Two-stage pruning is performed on the random forest classifier. In the first stage of pruning, hierarchical feature sampling is performed from the optimal feature subset and the ordinary feature subset according to a fixed ratio. The Gini index is used as a measure of node splitting purity to control the node splitting process of a single decision tree. In the second stage of pruning, each decision tree pruned in the first stage is used as a game participant. The Shapley value of each decision tree is calculated on the validation set. The Shapley value is used to quantify the marginal contribution of the current decision tree in different decision tree subsets. The marginal contribution is dynamically and smoothly updated using a sliding window mechanism. Decision trees with low contribution are removed to obtain the final random forest classifier.

2. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 1, characterized in that, The process of initial feature screening based on information gain includes: dividing the samples in the training set into two categories: normal traffic and attack traffic, and calculating the information entropy. To measure the uncertainty of the training set class distribution: in, This represents the proportion of samples of class i in the training set D. This represents the number of samples in the i-th class. This represents the total number of samples in the training set D; Let information entropy be the feature to be evaluated, and its value range be [0,1]. Let F be the feature to be evaluated, and its value set be { The feature F divides the training set D into k subsets D1, D2, ..., Dk. k , where subset D j The value of F is included in all features F. j The sample, ; Calculate conditional entropy To measure the residual uncertainty of the class distribution of the training set D given the values ​​of feature F: in, For subset Information entropy Let the feature F take the value F j subset of time Number of samples, conditional entropy The smaller the value of F, the greater the help feature F provides in reducing the uncertainty of the dataset categories, and the stronger the correlation between the feature and the detection target; the difference between the information entropy H(D) and the conditional entropy H(D|F) is used as the feature to be evaluated. Information gain Information gain Features with information gain less than the information gain threshold λ are identified as low-relevance or redundant features and removed. The information gain is then... Features that are greater than or equal to the information gain threshold λ are identified as highly relevant features and retained.

3. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 1, characterized in that, The process of further filtering the remaining features after the initial screening based on the gray wolf optimization algorithm includes: assuming the number of remaining features after the initial screening is n, each gray wolf corresponds to a binary vector of length n. ,in, This indicates that the i-th feature is selected. This indicates that the i-th feature is removed; the gray wolf population size is initialized to N, and the binary vector of each individual is initialized randomly; the detection accuracy of the random forest classifier is used as the fitness value, the individual with the highest fitness in the population is regarded as α wolf, corresponding to the optimal feature subset, the individual with the second highest fitness is regarded as β wolf, corresponding to the second optimal feature subset, the individual with the third highest fitness is regarded as δ wolf, corresponding to the third optimal feature subset, and the other individuals are regarded as ordinary ω wolves, corresponding to the ordinary feature subset; by simulating the leadership role of α wolf, β wolf, and δ wolf in the gray wolf population, the ordinary ω wolves are guided to search towards the optimal solution until the maximum number of iterations is reached, and the optimal feature subset and the ordinary feature subset are output.

4. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 3, characterized in that, In each iteration, the distance between each ω wolf and the α, β, and δ wolves is calculated according to the following formula: Where t is the current iteration number, 、 、 Let be the position vectors of wolf α, wolf β, and wolf δ respectively at the t-th iteration. Let ω be the position vector of the wolf at time t. 、 、 Let ω be a random coefficient vector; based on the distance calculation results, update the position of wolf ω to move it closer to the region surrounded by wolves α, β, and δ. The position update formula is as follows: in, 、 、 The convergence coefficient vector, This represents the candidate position vector of wolf ω after it moves closer to wolf α. This represents the candidate position vector after wolf ω moves closer to wolf β. This represents the candidate position vector after wolf ω moves closer to wolf δ. for The position vector of the wolf at time ω.

5. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 1, characterized in that, The first stage of pruning includes: performing stratified sampling from the optimal feature subset and any ordinary feature subset according to a fixed ratio to generate a candidate set of split features, and constructing a decision tree starting from the root node; assuming that the current decision tree node C to be split contains s samples, where the number of normal traffic samples is s1 and the number of attack traffic samples is s2, calculate the Gini index of this node: in, , where represents the proportion of the i-th type of sample in the node C to be split. This represents the number of samples in the i-th class; The Gini index of the node to be split is represented, with a value ranging from [0,1]. The smaller the value, the more concentrated the class distribution of the node samples and the higher the purity of the node. For each feature F in the candidate set of splitting features, all its possible values ​​are traversed as the splitting threshold v, and the node C is divided into left child nodes. with right child node The Gini index of each of the two child nodes is calculated, and the splitting effect of the current feature-threshold combination is evaluated by the Gini index gain. The Gini index gain after splitting is... The calculation formula is: in, Indicates the left child node Number of samples included Indicates the right child node Number of samples included and These are the Gini indices for the left and right child nodes, respectively. This represents the proportion of samples in the left child node to the total number of samples in the parent node C. This represents the proportion of the number of samples in the right child node to the number of samples in the parent node. Let C represent the Gini index of node C. For each node to be split, select the feature-threshold combination with the largest Gini index gain as the final splitting method. When the growth process of a single decision tree continues until the node splitting termination condition is met, the last splitting node is taken as the leaf node, and the construction of a single decision tree is completed.

6. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 5, characterized in that, There are three conditions for terminating node splitting. When any one of these conditions is met, the growth of a single decision tree is considered complete. The three conditions are: Condition 1: The number of samples corresponding to the current node to be split is less than the preset minimum number of samples; Condition 2: The Gini index of the current node to be split is less than the preset purity threshold γ; Condition 3: There are no effective features in the candidate set of splitting features of the current node to be split that can be used to continue splitting.

7. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 1, characterized in that, In the second stage of pruning, the forest after the first stage of pruning... Considered as a set of participants in a cooperative game, each decision tree As a participant, any subset of decision trees Considered as a consortium, the consortium's revenue is defined as the detection accuracy of the random forest corresponding to that subset of decision trees on the validation set; the marginal contribution of each decision tree is measured by the Shapley value, where the i-th decision tree T i marginal contribution The calculation formula is: in, It means all contained in the forest But it does not include the current decision tree T. i The alliance; This indicates the number of decision trees contained in consortium S; The weight coefficient of alliance S represents the probability of that alliance appearing among all possible alliances; Representing a decision tree T i The performance of the random forest classifier after adding consortium S Representing a decision tree T i Performance of the random forest classifier before joining consortium S; Representing a decision tree T i The performance gains brought by joining Alliance S; The value range of is [-1, 1]. When When the value is greater than 0, retain the current decision tree T. i ,when When ≤ 0, the current decision tree T is... i Included in the pruning candidate range.

8. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 7, characterized in that, The process of dynamically and smoothly updating the marginal contribution using a sliding window mechanism includes: setting the sliding window size to w and the time step to 1; recalculating the marginal contribution of all decision trees based on the latest partitioned validation subset each time the window slides; and then updating the marginal contribution of the i-th decision tree T. i Dynamic smoothing contribution at time t , defined as the arithmetic mean of the w most recent marginal contributions within the sliding window, is calculated using the following formula: Where k represents the time point index, Let T represent the i-th decision tree. i The marginal contribution calculated at a specific time t in the past, where k is the historical time point within the sliding window, consistent with the time step at time t.

9. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 8, characterized in that, The second-stage pruning process includes: sorting all decision trees in the forest after the first-stage pruning according to their dynamic smoothing contribution from low to high, resulting in a decision tree sequence; each pruning operation only removes the lowest-contribution tree ranked first in the sequence, resulting in a new forest; and calculating the new forest. Detection accuracy on the validation set and the forest before removing low-contribution trees. accuracy By comparison, the performance gain of this pruning was obtained. ;like If so, continue with the next pruning; if If the pruning stops, the removed decision tree is restored.

10. The intrusion detection method based on the fusion of feature optimization and two-stage pruning optimization as described in claim 9, characterized in that, The second stage of pruning also includes setting a performance gain threshold. ， The value ranges from 0 to 0.

01. If the performance gain of 3 to 5 consecutive pruning operations satisfies... If the random forest classifier reaches its performance gain saturation point, the pruning operation is stopped.

Images