Network intrusion detection method based on multi-feature time sequence graph collaborative coding

Abstract

The invention discloses a network intrusion detection method for multi-feature time sequence atlas collaborative coding, which aims at the characteristics of high network flow data dimension, feature isomerism and strong time sequence dependence, takes a plurality of continuous flow records belonging to the same source IP as a time sequence, and performs decomposition based on GASF to form a two-dimensional time sequence atlas. By using the two-dimensional space texture processing capability of a convolutional neural network, stacking the generated feature maps in sequence according to channel dimensions to form a multi-channel tensor with time sequence-feature relevance; meanwhile, in order to solve the problem of high-dimensional feature redundant noise, a channel attention mechanism is introduced, so that the model can adaptively learn the weight of a feature channel, and passively accept full data to actively pay attention to a key attack mode, thereby solving the problem that tiny attack features cannot be captured in a complex network environment.

Description

Technical Field

[0001] This invention belongs to the field of network intrusion detection technology, specifically relating to the design of a network intrusion detection method using multi-feature temporal graph collaborative coding. Background Technology

[0002] Existing network intrusion detection technologies are shifting from rule-based approaches to anomaly detection. This is because DDoS attacks, botnets, and APT attacks are becoming increasingly sophisticated and automated, prompting the industry to explore applying deep learning technologies to traffic detection. However, existing approaches based on different data processing methods still have significant limitations when dealing with high-dimensional, complex network flow data.

[0003] Early research on network intrusion detection methods based on one-dimensional sequence models focused on directly modeling the statistical features or raw payloads of CSV using RNNs, LSTMs, or one-dimensional CNNs. For example, LSTMs are typically applied to datasets like CiCIDS2017 to uncover attack traces based on temporal variations. However, the drawbacks of this direct modeling are obvious: First, insufficient feature coupling. Simple linear splicing of heterogeneous features such as packet length variance and arrival time intervals fails to represent deeper nonlinear interactions. For instance, drastic fluctuations in packet length and time interval compression during an attack are strongly correlated, but simple splicing leads the model to ignore these. Second, the problem of information loss in long sequences. Although LSTM aims to address long dependencies, it doesn't completely solve the gradient vanishing problem with extremely long network stream sequences. The model struggles to detect short-term mutations at the microscopic level, and one-dimensional models are not as sensitive as convolutional kernels in extracting local high-dimensional topological features.

[0004] To leverage the powerful 2D convolutional neural networks in computer vision, some researchers have begun to attempt to transform network traffic into images, i.e., network intrusion detection methods based on simple image transformation. These methods suffer from feature confusion and information loss. Existing GASF (Gramian Angular Summation Field) methods are mostly used for single-variable time periods in time series, or to represent single images by dimensionality reduction or averaging of multi-dimensional features. This leads to confusion of features with different physical meanings, loss of different evolutionary patterns, and a lack of multi-dimensional collaborative representation. Most existing image transformation methods generate single-channel or simple three-channel images, which cannot carry information from dozens of features, such as those found in CICIDS2017. Because the adjacency relationships between pixels are physically meaningless when simply viewing the feature matrix as an image, CNNs cannot extract suitable features. Furthermore, most CNN-based network intrusion detection methods use direct interfaces with ResNet structures, while network attack features are generally sparse. Traditional CNNs perform equal-weight convolutions on the entire image, making them easily obscured by background traffic noise, resulting in a high false negative rate for slow attacks or minor traffic anomalies. Summary of the Invention

[0005] The purpose of this invention is to address the problem of low detection accuracy in existing network intrusion detection technologies when processing high-dimensional, heterogeneous network traffic data with strong temporal dependencies. A network intrusion detection method based on multi-feature temporal graph collaborative coding is proposed.

[0006] The technical solution of this invention is: a network intrusion detection method using multi-feature temporal graph collaborative coding, comprising the following steps: S1. Construct a dataset based on network traffic data and perform subset partitioning and sorting.

[0007] S2. Obtain the feature matrix by slicing from the sorted subset through temporal serialization, and construct sequence samples.

[0008] S3. Divide the sequence samples into training and test sets.

[0009] S4. Perform independent micro-temporal mapping encoding on all feature column vectors in the feature matrix to obtain the grayscale image corresponding to each feature column vector.

[0010] S5. Stack all grayscale images along the channel dimension to obtain the model input tensor.

[0011] S6. Construct a CNN detection model with an embedded attention mechanism.

[0012] S7. Train the CNN detection model with embedded attention mechanism using the training set to obtain a trained network intrusion detection model.

[0013] S8. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and output the detection results.

[0014] Further, step S1 includes the following sub-steps: S11. Obtain network traffic data.

[0015] S12. Clean the network traffic data and remove invalid data rows containing zero or infinite values.

[0016] S13. Construct a dataset based on the cleaned data.

[0017] S14. Set the grouping key to the source IP address and divide the dataset into K subsets, each subset representing all network behaviors initiated by a specific host.

[0018] S15. Within each subset, sort the data in ascending order based on the timestamp.

[0019] Furthermore, step S2 includes the following sub-steps: S21. Set the length of the time window. and step length .

[0020] S22. By sliding a time window over the sorted subset, multiple segments of size are extracted. The feature matrix of , where This indicates the number of features selected.

[0021] S23. Construct sequence samples using feature matrices.

[0022] Further, step S3 specifically involves randomly dividing the sequence samples into a training set and a test set in an 8:2 ratio.

[0023] Furthermore, step S4 includes the following sub-steps: S41. For any feature column vector in the feature matrix Scale the feature values ​​to Normalize the interval: in Represents the feature column vector Mid-time step The corresponding feature values, Indicates the normalized time step The corresponding feature values.

[0024] S42. Map the normalized feature values ​​to angles in polar coordinates: in Indicates time step The corresponding angle in the polar coordinate system.

[0025] S43. By calculating the cosine value of the sum of angles at different time steps, a size of [size missing] is generated. GSAF correlation matrix : in Indicates time step and time step The strength of the temporal correlation between them Indicates the normalized time step The corresponding feature values, Indicates time step The corresponding angle in the polar coordinate system.

[0026] S44. Repeat steps S41-S43, performing independent micro-time series mapping encoding based on GASF for each feature column vector in the feature matrix, to obtain... Each size is GSAF correlation matrix ,correspond The size is A grayscale image.

[0027] Furthermore, the CNN detection model with embedded attention mechanism in step S6 includes a convolutional layer, a channel attention module, a pooling layer, and a fully connected layer connected in sequence.

[0028] Furthermore, the channel attention module adopts the SE attention module, and its data processing steps are as follows: A1. Feature map of the input SE attention module Global average pooling is performed to compress each two-dimensional feature channel into a real number, resulting in a global feature descriptor. : in Represents the real number field. Indicates the first Global feature descriptors for each channel, , This indicates a feature compression operation. Representation of feature map height, Representation of feature map width, Indicates the number of feature channels. Representation of feature map In the Features of each channel.

[0029] A2. Based on global feature descriptors By learning the non-linear interaction relationship between channels through two fully connected layers, the weights of each channel are generated: in Indicates the first The weight of each channel, Indicates feature activation operation, This represents the Sigmoid activation function. Represents the ReLU activation function. Indicates the weights of the dimensionality reduction layer. Indicates the weights of the dimension-upgrading layer. This represents the scaling factor.

[0030] A3. Weight each channel With feature map Multiplying the corresponding channels yields the recalibrated feature map: in The recalibrated feature map is in the th... Features of each channel.

[0031] Furthermore, in step S7, cross-entropy is used as the training loss function, and the Adam optimizer is used to iteratively update the training parameters.

[0032] Furthermore, step S8 includes the following sub-steps: S81. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and calculate the probability distribution of each intrusion category in the output layer of the network intrusion detection model using the Softmax function: in This represents the high-dimensional feature vector of the temporal graph extracted by CNN in the network intrusion detection model. This represents a preset index of network intrusion categories. Indicates the current network traffic sample Belongs to the Posterior probability of network intrusion-like behaviors Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category, Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category.

[0033] S82. Output the intrusion category with the highest probability as the detection result.

[0034] The beneficial effects of this invention are: (1) Based on GASF micro-temporal graph encoding, this invention can convert a feature into a two-dimensional texture, preserve the polar coordinate time dependence of the data, and adopt a multi-channel collaborative stacking structure, which can identify the small fluctuations of a single feature and the coupling relationship between different features as if recognizing a color image, thereby identifying slow DDoS attacks or BoTnet command control patterns that 1D-CNN cannot recognize, greatly enhancing the ability to identify covert attacks and slow attacks.

[0035] (2) The channel attention module designed in this invention can learn the importance weights of different feature channels according to the loss function. During detection, the model will suppress statistical features that are not related to the current attack and highlight the attack features, saving the network's computing time, solving the problem of false alarms caused by environmental noise, improving robustness in complex networks, and realizing the automation of feature selection and noise resistance.

[0036] (3) The time-series stream reassembly mechanism based on the source host proposed in this invention logically restores the attacker's continuous actions, so that the model is no longer a point observation, but observes a complete behavioral trajectory. It can be used for network intrusion behaviors with a large time span, such as advanced persistent threats, and breaks through the limitations of single-stream statistics, and can extract the time series of network intrusions. Attached Figure Description

[0037] Figure 1 The diagram shown is a flowchart of a network intrusion detection method based on multi-feature temporal graph co-coding provided by an embodiment of the present invention. Detailed Implementation

[0038] Exemplary embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the embodiments shown and described in the drawings are merely exemplary and are intended to illustrate the principles and spirit of the invention, and are not intended to limit the scope of the invention.

[0039] This invention provides a network intrusion detection method using multi-feature temporal graph collaborative coding, such as... Figure 1 As shown, the process includes the following steps S1 to S8: S1. Construct a dataset based on network traffic data and perform subset partitioning and sorting.

[0040] Step S1 includes the following sub-steps S11 to S15: S11. Obtain network traffic data.

[0041] In this embodiment of the invention, the network traffic data is the raw CSV traffic data.

[0042] S12. Clean the network traffic data and remove invalid data rows containing zero or infinite values.

[0043] S13. Construct a dataset based on the cleaned data.

[0044] S14. Set the grouping key to the source IP address and divide the dataset into K subsets, each subset representing all network behaviors initiated by a specific host.

[0045] S15. Within each subset, sort the data in ascending order based on timestamps to ensure that traffic records conform to the chronological order of the attack.

[0046] S2. Obtain the feature matrix by slicing from the sorted subset through temporal serialization, and construct sequence samples.

[0047] Step S2 includes the following sub-steps S21 to S23: S21. Set the length of the time window. and step length .

[0048] In this embodiment of the invention, the length of the time window is set. Step length .

[0049] S22. By sliding a time window over the sorted subset, multiple segments of size are extracted. The feature matrix of , where Indicates the number of selected features, in the embodiments of the present invention .

[0050] S23. Construct sequence samples using feature matrices.

[0051] In this embodiment of the invention, in view of the problem that flow records in actual network traffic data are often arranged in random order and a single record cannot reflect the attack evolution process, this step aims to construct host behavior sequence samples with strict temporal causal relationship.

[0052] S3. Divide the sequence samples into training and test sets.

[0053] In this embodiment of the invention, the sequence samples are randomly divided into training and test sets in an 8:2 ratio to ensure that the samples cover various attack scenarios.

[0054] S4. Perform independent micro-temporal mapping encoding on all feature column vectors in the feature matrix to obtain the grayscale image corresponding to each feature column vector.

[0055] Unlike traditional methods that directly process numerical matrices, this embodiment of the invention uses GASF to convert each feature column vector obtained in step S1 into a two-dimensional image, so as to express temporal correlation through spatial texture.

[0056] Step S4 includes the following sub-steps S41 to S44: S41. For any feature column vector in the feature matrix Scale the feature values ​​to Normalize the interval: in Represents the feature column vector Mid-time step The corresponding feature values, Indicates the normalized time step The corresponding feature values.

[0057] S42. Map the normalized feature values ​​to angles in polar coordinates: in Indicates time step The corresponding angle in the polar coordinate system.

[0058] S43. By calculating the cosine value of the sum of angles at different time steps, a size of [size missing] is generated. GSAF correlation matrix : in Indicates time step and time step The strength of the temporal correlation between them Indicates the normalized time step The corresponding feature values, Indicates time step The corresponding angle in the polar coordinate system.

[0059] Temporal correlation strength It constitutes the GSAF correlation matrix The basic elements, equivalent to individual pixels in a grayscale image, are used to quantify the traffic correlation between two specific time steps. The GASF correlation matrix, on the other hand, is a complete two-dimensional feature map formed by orderly arranging the correlation strengths of all pairs of corresponding time steps. It realizes the transformation from one-dimensional numerical values ​​to two-dimensional texture, enabling the detection model to discover network attack features through image recognition.

[0060] S44. Repeat steps S41-S43, performing independent micro-time series mapping encoding based on GASF for each feature column vector in the feature matrix, to obtain... Each size is GSAF correlation matrix ,correspond The size is A grayscale image.

[0061] In this embodiment of the invention, a one-dimensional time-series signal is mapped into a two-dimensional image-like correlation matrix by independent encoding of micro-temporal spectra based on GASF. The main diagonal of the image reflects the original numerical sequence, while the remaining pixels encode the correlation between different time steps, enabling the subsequent CNN to identify the temporal pattern of the attack as if it were an image texture.

[0062] S5. Stack all grayscale images along the channel dimension to obtain the model input tensor. .

[0063] This tensor is a multi-feature collaborative map, which preserves the temporal pattern of a single feature in the spatial dimension and the parallel collaborative relationship between features in the channel dimension.

[0064] S6. Construct a CNN detection model with an embedded attention mechanism.

[0065] To address the issues of excessive input tensor channels and noisy features, this invention embeds a channel attention module between convolutional layers to automatically filter key features during model training.

[0066] In this embodiment of the invention, the CNN detection model with embedded attention mechanism includes a convolutional layer, a channel attention module, a pooling layer, and a fully connected layer connected in sequence.

[0067] The channel attention module uses the SE attention module, and its data processing steps are as follows: A1. Feature map of the input SE attention module Global average pooling is performed to compress each two-dimensional feature channel into a real number, resulting in a global feature descriptor. : in Represents the real number field. Indicates the first Global feature descriptors for each channel, , This indicates a feature compression operation, which in this embodiment of the invention is specifically global average pooling. Representation of feature map height, Representation of feature map The width is affected by the stride of the pooling layer or convolution before the channel attention module. and It may be smaller than the original input. , This indicates the number of convolutional kernels in the channel attention module, i.e., the number of feature channels. It typically increases with network depth, for example, 64, 128, 256, etc. Representation of feature map In the Features of each channel.

[0068] A2. Based on global feature descriptors By learning the non-linear interaction relationship between channels through two fully connected layers, the weights of each channel are generated: in Indicates the first The weight of each channel, This represents a feature activation operation used to generate channel weight coefficients for adaptive recalibration of the feature map. This represents the Sigmoid activation function, used to normalize the weights to... , Represents the ReLU activation function. Indicates the weights of the dimensionality reduction layer. Indicates the weights of the dimension-upgrading layer. In this embodiment of the invention, the scaling factor is represented. Take 16.

[0069] A3. Weight each channel With feature map Multiplying the corresponding channels yields the recalibrated feature map: in The recalibrated feature map is in the th... Features of each channel.

[0070] In this embodiment of the invention, the weights of each channel are... Forming a dimension The channel weight vector is then compared with the original feature map. Perform channel-by-channel multiplication to obtain the recalibrated feature map.

[0071] S7. Train the CNN detection model with embedded attention mechanism using the training set to obtain a trained network intrusion detection model.

[0072] In this embodiment of the invention, cross-entropy is used as the training loss function, and the Adam optimizer is used for iterative updating of training parameters. During training, the model automatically assigns greater weight to key attack features while suppressing irrelevant background traffic noise, thereby improving detection accuracy.

[0073] S8. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and output the detection results.

[0074] Step S8 includes the following sub-steps S81~S82: S81. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and calculate the probability distribution of each intrusion category in the output layer of the network intrusion detection model using the Softmax function: in This represents the high-dimensional feature vector of the temporal graph extracted by CNN in the network intrusion detection model. This represents a preset index of network intrusion categories. Indicates the current network traffic sample Belongs to the The posterior probability of network intrusion-like behaviors serves as a quantitative basis for determining the final detection result. Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category, Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category.

[0075] S82. Output the intrusion category with the highest probability as the detection result.

[0076] Those skilled in the art will recognize that the embodiments described herein are intended to help the reader understand the principles of the invention, and should be understood that the scope of protection of the invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific modifications and combinations based on the technical teachings disclosed in this invention without departing from the spirit of the invention, and these modifications and combinations are still within the scope of protection of this invention.

Claims

1. A network intrusion detection method using multi-feature temporal graph collaborative coding, characterized in that, Includes the following steps: S1. Construct a dataset based on network traffic data and perform subset partitioning and sorting; S2. Obtain the feature matrix by slicing from the sorted subset through temporal serialization, and construct sequence samples; S3. Divide the sequence samples into a training set and a test set; S4. Perform independent micro-temporal spectral encoding based on GASF on all feature column vectors in the feature matrix to obtain the grayscale image corresponding to each feature column vector; S5. Stack all grayscale images along the channel dimension to obtain the model input tensor; S6. Construct a CNN detection model with embedded attention mechanism; S7. Train the CNN detection model with embedded attention mechanism using the training set to obtain a trained network intrusion detection model. S8. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and output the detection results.

2. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, Step S1 includes the following sub-steps: S11. Obtain network traffic data; S12. Perform data cleaning on network traffic data, and remove invalid data rows containing zero or infinite values ​​from the network traffic data. S13. Construct a dataset based on the cleaned data; S14. Set the grouping key to the source IP address and divide the dataset into K subsets, each subset representing all network behaviors initiated by a specific host; S15. Within each subset, sort the data in ascending order based on the timestamp.

3. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, Step S2 includes the following sub-steps: S21. Set the length of the time window. and step length ; S22. By sliding a time window over the sorted subset, multiple segments of size are extracted. The feature matrix of , where Indicates the number of features selected; S23. Construct sequence samples using feature matrices.

4. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, Step S3 specifically involves randomly dividing the sequence samples into a training set and a test set at a ratio of 8:

2.

5. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 3, characterized in that, Step S4 includes the following sub-steps: S41. For any feature column vector in the feature matrix Scale the feature values ​​to Normalize the interval: in Represents the feature column vector Mid-time step The corresponding feature values, Indicates the normalized time step The corresponding feature values; S42. Map the normalized feature values ​​to angles in polar coordinates: in Indicates time step The corresponding angle in the polar coordinate system; S43. By calculating the cosine value of the sum of angles at different time steps, a size of [size missing] is generated. GSAF correlation matrix : in Indicates time step and time step The strength of the temporal correlation between them Indicates the normalized time step The corresponding feature values, Indicates time step The corresponding angle in the polar coordinate system; S44. Repeat steps S41-S43, performing independent micro-time series mapping encoding based on GASF for each feature column vector in the feature matrix, to obtain... Each size is GSAF correlation matrix ,correspond The size is A grayscale image.

6. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, The CNN detection model with embedded attention mechanism in step S6 includes a convolutional layer, a channel attention module, a pooling layer, and a fully connected layer connected in sequence.

7. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 6, characterized in that, The channel attention module uses the SE attention module, and its data processing steps are as follows: A1. Feature map of the input SE attention module Global average pooling is performed to compress each two-dimensional feature channel into a real number, resulting in a global feature descriptor. : in Represents the real number field. Indicates the first Global feature descriptors for each channel, , This indicates a feature compression operation. Representation of feature map height, Representation of feature map width, Indicates the number of feature channels. Representation of feature map In the Characteristics of each channel; A2. Based on global feature descriptors By learning the non-linear interaction relationship between channels through two fully connected layers, the weights of each channel are generated: in Indicates the first The weight of each channel, Indicates feature-driven activation operations. This represents the Sigmoid activation function. Represents the ReLU activation function. Indicates the weights of the dimensionality reduction layer. Indicates the weights of the dimension-upgrading layer. Indicates the scaling factor; A3. Weight each channel With feature map Multiplying the corresponding channels yields the recalibrated feature map: in The recalibrated feature map is in the th... Features of each channel.

8. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, In step S7, cross-entropy is used as the training loss function, and the Adam optimizer is used to iteratively update the training parameters.

9. The network intrusion detection method based on multi-feature temporal graph collaborative coding according to claim 1, characterized in that, Step S8 includes the following sub-steps: S81. Input the model corresponding to the test set into the tensor of the trained network intrusion detection model, and calculate the probability distribution of each intrusion category in the output layer of the network intrusion detection model using the Softmax function: in This represents the high-dimensional feature vector of the temporal graph extracted by CNN in the network intrusion detection model. This represents a preset index of network intrusion categories. Indicates the current network traffic sample Belongs to the Posterior probability of network intrusion-like behaviors Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category, Indicates that the fully connected layer is for the first The original logical response value output by each network intrusion category; S82. Output the intrusion category with the highest probability as the detection result.

Images