An Intrusion Detection Method Based on Visual Self-Attention Mechanism

Abstract

This invention discloses an intrusion detection method based on a visual self-attention mechanism, belonging to the field of intrusion detection technology. Its specific process includes: preprocessing intrusion detection data to obtain key features for intrusion detection; converting the key features to obtain RGB image data; introducing a multi-scale feature fusion network into the encoder of the visual self-attention mechanism, and performing multi-scale spatiotemporal feature capture and traffic image label assignment on the RGB image data. By introducing correlation coefficients and eigenvalue correlation thresholds during data preprocessing for feature selection, redundant features are eliminated and key features are identified. Simultaneously, by introducing a multi-scale feature fusion network into the encoder of the visual self-attention mechanism, accurate identification of attacks that are complex and difficult to classify in the dataset is achieved, exhibiting advantages such as generalization ability and strong universality.

Description

Technical Field

[0001] This invention relates to the field of intrusion detection technology, and more specifically to an intrusion detection method based on a visual self-attention mechanism. Background Technology

[0002] With the continuous evolution of cyberattack techniques, ensuring robust network security has become a fundamental requirement for network defense. Intrusion detection systems (IDS), with their ability to identify and respond to unauthorized activities, have been widely deployed in military communications, power grids, and cloud infrastructure. However, as cyber threats become increasingly complex and diverse, traditional IDS continue to face challenges such as high false positive rates and insufficient adaptability to new attack types. Therefore, improving the detection capabilities and reliability of IDS has become a critical issue that urgently needs to be addressed in modern network security protection.

[0003] From the perspective of detection methods, intrusion detection systems can generally be divided into two categories: anomaly-based detection and feature-based detection. The former identifies abnormal patterns by modeling normal system behavior, thereby discovering previously unknown attacks, but often suffers from a high false positive rate; the latter relies on predefined attack features, which can achieve a lower false positive rate, but cannot effectively detect new or evolving threats.

[0004] In recent years, deep learning methods have demonstrated significant potential in intrusion detection due to their ability to automatically extract discriminative features and model nonlinear relationships in large-scale network data. To address these challenges, an increasing number of studies are exploring the transformation of network traffic into image representations, thereby leveraging visual models to uncover the inherent spatial and structural patterns within the traffic data. Through this representation, visual self-attention mechanisms have been introduced as a focal technique to capture complex dependencies between traffic flows. Thanks to its global self-attention mechanism, visual self-attention can effectively model long-range relationships often overlooked by traditional convolutional networks, thus enhancing the interpretability and adaptability of intrusion detection.

[0005] However, current intrusion detection methods based on visual self-attention mechanisms are still limited by issues such as redundancy and noise features, adaptation to traffic diversity, and sensitivity to class imbalance, resulting in unstable detection performance for potential threats.

[0006] Therefore, there is an urgent need to propose a new intrusion detection framework and method to effectively improve the detection accuracy and robustness of covert intrusions in complex network environments. Summary of the Invention

[0007] To address the aforementioned problems, this invention aims to provide an intrusion detection method based on a visual self-attention mechanism. This method selects features by introducing correlation coefficients and characteristic correlation thresholds during data preprocessing to eliminate redundant features and identify key features. Simultaneously, by introducing a multi-scale feature fusion network into the encoder of the visual self-attention mechanism, it achieves accurate identification of attacks that are complex and difficult to classify in the dataset, exhibiting advantages in generalization ability and universality. The intrusion detection system of this application can effectively bridge the modal differences between the original network data and the visual model, providing structured, high-quality input for the visual self-attention mechanism, thereby fully releasing the potential of the visual self-attention mechanism in intrusion detection and improving the detection accuracy of complex intrusions and potential threats.

[0008] To achieve the above objectives, the technical solution adopted by the present invention is as follows: In a first aspect, embodiments of this application provide an intrusion detection method based on a visual self-attention mechanism, comprising: By acquiring network traffic data and performing data preprocessing, key features for intrusion detection can be obtained. Data transformation is performed on key features to obtain RGB image data; The RGB image data is labeled with traffic images to obtain an RGB traffic image dataset with attack category labels; A multi-scale feature fusion network is introduced into the encoder of the visual self-attention mechanism to extract multi-scale spatiotemporal features from RGB traffic images with attack category labels, and the visual self-attention mechanism is used to obtain discriminative features that can characterize network traffic attack behavior from the multi-scale spatiotemporal features. Based on the correspondence between discriminative features and attack category labels in RGB traffic image data, the attack detection results of the corresponding images are output, thereby enabling the identification of attack behaviors in network traffic.

[0009] As a further preferred embodiment of the intrusion detection method based on the visual self-attention mechanism of this application, network traffic data is acquired and preprocessed to obtain key features for intrusion detection, specifically including: Calculate the correlation coefficients among all features of the network traffic dataset. ρ And introduce a correlation threshold between features. α Candidate features are selected by filtering out redundant features; Calculate the mutual information between candidate features and multi-class labels, and introduce a mutual information threshold. β The key features are selected by filtering out irrelevant features.

[0010] As a further preferred embodiment of the intrusion detection method based on the visual self-attention mechanism of this application, data transformation is performed on key features to obtain RGB image data, specifically including: Key features are converted to a 24-bit RGB color space using a linear mapping method. Construct a two-dimensional network, where each column represents a key feature and each row represents traffic data that changes over time; The 24-bit RGB color space is mapped onto the pixels of a two-dimensional grid to generate RGB image data.

[0011] As a further preferred embodiment of the intrusion detection method based on the visual self-attention mechanism of this application, the specific process of assigning traffic image labels to RGB image data to obtain RGB traffic image data with attack category labels includes: RGB image data is obtained, and continuous network traffic samples in the RGB image data are grouped by setting a sliding window. The network traffic samples in the window are mapped to construct a fixed-size RGB traffic image. Each network traffic sample in the RGB traffic image carries its original attack type label. Obtain the original attack type labels of all network traffic samples within the sliding window, and assign labels to the corresponding RGB traffic images based on the attack composition of the network traffic samples within the window, generating an RGB traffic image dataset with attack category labels.

[0012] As a further preferred embodiment of the intrusion detection method based on the visual self-attention mechanism proposed in this application, the specific rules for labeling the corresponding RGB traffic images according to the attack composition of the network traffic samples within the window are as follows: When all network traffic samples within the window are normal traffic, the RGB traffic image is marked as normal. When the window contains at least one attack traffic sample, the RGB traffic image is labeled with the corresponding attack category; When a window contains multiple attack traffic samples, assign multiple attack category labels to the RGB traffic image.

[0013] As a further preferred embodiment of the intrusion detection method based on visual self-attention mechanism proposed in this application, the multi-scale feature fusion network includes three parallel feature extraction paths A, B, and C and a fusion module; wherein, Path A is a local and row feature extraction path, which uses two consecutive convolutional layers to generate a 64-channel feature map of RGB image data. Path B is a mesoscale global context extraction path, which uses a 3×3 convolution kernel to refine the features of the generated RGB image data. Path C is a lightweight multi-scale branch path, which achieves feature projection through 1×1 convolution combined with batch normalization and ReLU activation, and uses 3×3 dilated convolution to expand the receptive field to generate a 64-channel feature map with spatial context features. The fusion module uses path concatenation to combine the 64-channel features of path A, path B and path C, and performs feature reconstruction and channel compression through two 1×1 convolutions to generate multi-scale spatiotemporal features.

[0014] Secondly, this application provides an intrusion detection system based on a visual self-attention mechanism. The intrusion detection system includes: The processing module is used to preprocess the acquired network traffic dataset to obtain key features for intrusion detection; The conversion module is used to convert key features into RGB image data. The label assignment module assigns labels to the RGB image data to obtain an RGB traffic image dataset with attack category labels. The feature extraction module is used to introduce a multi-scale feature fusion network into the encoder of the visual self-attention mechanism, to extract multi-scale spatiotemporal features from RGB traffic images with attack category labels, and to obtain discriminative features that can characterize network traffic attack behavior from the multi-scale spatiotemporal features using the visual self-attention mechanism. The output module is used to output the attack detection results of the corresponding image based on the correspondence between the discriminant features and the attack category labels of the RGB traffic image data.

[0015] Thirdly, this application provides a computer device, including: a memory and a processor; the memory stores a computer program, and the processor executes the computer program to implement the steps of an intrusion detection method based on a visual self-attention mechanism.

[0016] Fourthly, this application provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps in an intrusion detection method based on a visual self-attention mechanism.

[0017] The beneficial effects of this invention are as follows: Compared with the prior art, the improvements of this invention are: 1. The intrusion detection method of the present invention selects features by introducing correlation coefficients and characteristic correlation thresholds during data preprocessing to eliminate redundant features and identify key features; at the same time, by introducing a multi-scale feature fusion network into the encoder of the visual self-attention mechanism, it can accurately identify the categories of hidden and extremely imbalanced data samples, and achieve accurate identification of attacks that are complex and difficult to classify in the dataset. It has the advantages of generalization ability and strong universality. 2. The intrusion detection system of the present invention can effectively bridge the modal differences between the original network data and the visual model, providing a structured, high-quality input for the visual self-attention mechanism, thereby fully releasing the potential of the visual self-attention mechanism in intrusion detection and improving the detection accuracy of complex intrusions and potential threats. Attached Figure Description

[0018] Figure 1 This is a flowchart of an intrusion detection method based on a visual self-attention mechanism according to the present invention.

[0019] Figure 2 This is a schematic diagram illustrating the conversion of the features of the present invention into RGB image data. Detailed Implementation

[0020] To enable those skilled in the art to better understand the technical solutions of the present invention, the technical solutions of the present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0021] Firstly, refer to the appendix Figure 1-2 As shown, this application provides an intrusion detection method based on a visual self-attention mechanism, characterized by comprising: S1: Obtain network traffic datasets and perform data preprocessing to obtain key features for intrusion detection; Specifically, the preprocessing of the acquired network traffic dataset in this embodiment includes data cleaning, normalization, data balancing, and feature selection. Data preprocessing is used to ensure effective information while eliminating redundant data attributes and identifying key features.

[0022] Specifically, based on the above technical solutions, step S1 in this embodiment of the application performs data preprocessing on the acquired network traffic dataset to obtain key features for intrusion detection, including the following process: S11: Data Cleaning The network traffic dataset in this embodiment is derived from the network traffic dataset. Each network traffic sample contains multi-dimensional feature information for characterizing communication behavior. The multi-dimensional feature information includes, but is not limited to, port features, protocol features, time features, traffic statistics features, and data packet length-related features, such as source port, destination port, transmission protocol type, flow duration, number of forward and backward data packets, mean and variance of data packet length, traffic rate, activity time features, and flag bit statistics features.

[0023] Specifically, during the data cleaning process, redundant fields, invalid fields, and abnormal data in the original network traffic data are processed. This includes: deleting identifier fields that are irrelevant to intrusion detection; deleting feature fields with constant values ​​that lack discriminative power; filling features with missing or outlier values ​​with the median; and standardizing the naming format of feature fields and correcting abnormal characters, thereby ensuring the integrity and consistency of the input data and providing a reliable data foundation for subsequent feature selection and model training.

[0024] S12: Normalization Processing Specifically, in this embodiment, the normalization process uses a minimum-maximum normalization method, which linearly maps the feature values ​​to the [0,1] interval. The calculation formula is as follows:

[0025] in, Represents the normalized eigenvalues. Represents the original feature values. and These represent the minimum and maximum values ​​of the feature in the dataset, respectively. Through the above normalization process, different features are placed within a uniform numerical range, providing stable data input for subsequent feature selection and model training.

[0026] S13: Data Balancing Data balancing is performed on intrusion detection data to mitigate the adverse effects of uneven distribution of sample numbers across different attack categories on model training. Specifically, the data balancing process includes: random undersampling of normal traffic categories with a significantly larger sample size to reduce their proportion in the dataset, bringing their sample numbers to the same order of magnitude as the main attack categories; using feature-preserving synthetic sampling to generate new attack samples for attack categories with fewer samples; expanding the number of minority class attack samples by introducing controlled perturbations based on the original sample features while maintaining their original feature distribution characteristics; and introducing a weighting mechanism based on sample difficulty during model training to assign higher training weights to attack samples that are difficult to distinguish, thereby further improving the model's ability to identify minority class attacks and complex attack behaviors.

[0027] For minority attack samples, a synthetic sampling method based on feature distribution preservation is used to generate new attack samples. The generation method involves introducing controlled perturbations based on the features of the original samples. The specific calculation method is as follows: ; in, This indicates the generation of new attack sample feature vectors. This represents the feature vector of the original attack sample. and These represent the mean and standard deviation of the corresponding features, respectively. This is the perturbation amplitude control coefficient, used to limit the offset range between the synthesized sample and the original sample.

[0028] Through the above data balancing process, the distribution of network traffic samples of different categories is more balanced, thereby improving the overall detection performance and stability of the intrusion detection model in multi-attack scenarios.

[0029] S14: Feature Selection After data cleaning, normalization, and data balancing, feature selection is performed on network traffic characteristics to eliminate redundant features and identify key features. Specifically, in this embodiment, feature selection for network traffic characteristics to eliminate redundant features and identify key features includes: First, to identify redundant relationships between network traffic features, the correlation coefficient between any two network traffic features in the network traffic dataset is calculated. In this embodiment, the Pearson correlation coefficient is used to measure the degree of linear correlation between features in order to assess the degree of linear correlation between features. The calculation formula is as follows: in, Representation of features With features Covariance between and Representing features respectively With features standard deviation The range of values ​​for is [ [1], the larger the absolute value, the stronger the linear correlation between the two features.

[0030] Secondly, by calculating the correlation coefficient between all features pairwise and setting a correlation threshold α between features, highly correlated feature pairs are filtered out to eliminate redundant features, thus obtaining a candidate feature set. Specifically, when any pair of features satisfies... When a feature pair is deemed to have strong redundancy, features with large variance are retained to ensure information representation capability; the remaining redundant features are removed.

[0031] In this embodiment of the application, the relevance threshold α is set to 0.9. Under this threshold condition, a total of 27 redundant features are eliminated and 40 candidate features are retained, achieving a balance between redundancy elimination and information integrity.

[0032] Next, based on this, the correlation between features and attack categories is further combined to filter key features from the candidate features for subsequent processing. In this embodiment, 35 key features were finally selected to construct a traffic image and perform intrusion detection.

[0033] Specifically, to further evaluate the correlation between candidate features and attack categories, the mutual information values ​​between the 40 candidate features and multi-class labels are calculated, and features that are irrelevant to intrusion detection or have a weak correlation are selected accordingly. In this embodiment, the mutual information between features and multi-class labels is defined as:

[0034] in, The candidate feature is represented by a random variable. This represents a random variable that represents the corresponding attack category label; Representation of features With tags The joint probability distribution of ; and Representing features respectively With tags Marginal probability distribution. Mutual information. Used to measure characteristics Attack categories The higher the value of the feature's contribution to information, the stronger its ability to distinguish attack categories.

[0035] In this embodiment of the application, the mutual information value between each candidate feature and multiple attack tags is calculated, the mutual information results are sorted, and a mutual information threshold β is set in combination with the mutual information distribution. Features with mutual information scores lower than the threshold β are judged as irrelevant features with weak correlation to intrusion detection and are removed.

[0036] S2: Perform data transformation on key features to obtain RGB image data; Specifically, based on the above technical solutions, the key features are converted into data in this embodiment of the application, which includes the following process: S21: The 35 selected key features are converted into a 24-bit RGB color space through linear mapping, so that their numerical range corresponds to the complete 24-bit color space (0x000000-0xFFFFFF), where each 8-bit segment is directly encoded as the intensity value of the R, G, and B channels respectively. S22: Construct a two-dimensional grid, where each column of the two-dimensional network represents the 35 selected key features, and each row represents the network traffic data features that change over time. This structured layout preserves both the time dynamics of the features and the correlation between different features. S23: Map each (R,G,B) triple to the pixel of the constructed two-dimensional grid. The final sample image data size of the intrusion detection input is N×35×3, where 35 is the number of selected features, 3 represents the number of RGB channels, and N is the number of time-series traffic samples.

[0037] S3: Assign traffic image labels to the RGB image data to obtain an RGB traffic image dataset with attack category labels.

[0038] Specifically, in the technical solution of this application embodiment, after completing the key feature selection and data conversion, the RGB image data is labeled with traffic images to obtain an RGB traffic image dataset with attack category labels. The specific process includes the following steps: S31: Input Acquisition RGB image data is acquired, and continuous network traffic samples in the RGB image data are grouped using a sliding window method. The network traffic samples in the window are mapped to construct a fixed-size RGB traffic image. Each RGB traffic image sample corresponds to a fixed-size sliding window, each RGB traffic image corresponds to a time-continuous network traffic segment, and the sliding window contains several time-continuous network traffic samples. Each network traffic sample carries its original attack type label. S32: In-Window Flow Analysis The network traffic samples contained in each sliding window are traversed to obtain the original attack type labels of all network traffic samples in the sliding window, so as to determine the attack composition of the network traffic in the sliding window.

[0039] S33: Image-level label generation Specifically, in this embodiment of the application, labels are assigned to the corresponding RGB traffic images based on the attack composition of the network traffic samples within the sliding window. The specific rules for label assignment are as follows: When all network traffic samples within the window are normal traffic, the attack category of the RGB traffic image is marked as normal; when the window contains at least one attack traffic sample, the RGB traffic image is marked as the corresponding attack category; when the window contains multiple attack traffic samples simultaneously, multiple attack category labels are assigned to the RGB traffic image.

[0040] like Figure 2As shown, in this application, to meet the N×35×3 input dimension requirement of the classifier in the visual self-attention mechanism, the present invention further designs an adjustable overlap rate sliding window mechanism. Specifically, in this invention, N=35, that is, the sliding window size is set to 35×35. Each window maps the window position (i,j) to pixel coordinates (i,j) through RGB triples to convert it into a 35×35×3 RGB image, and assigns a label to each 35×35×3 image according to the flow components within the corresponding window. Specifically, the image is marked as "normal" only when all flows within the window are judged as normal; otherwise, if the window contains any attack flows, the image is marked as the corresponding attack type. Furthermore, if multiple attack types exist within the same window, the image will be assigned multiple attack labels according to the actual situation.

[0041] S34: Tag Binding and Output: The generated image-level labels are bound one-to-one with the corresponding RGB traffic images to form a labeled traffic image dataset, which serves as the input for subsequent multi-scale spatiotemporal feature extraction and intrusion detection model discrimination.

[0042] S4: Introduce a multi-scale feature fusion network into the encoder of the visual self-attention mechanism to extract multi-scale spatiotemporal features from RGB traffic images with attack category labels, and use the visual self-attention mechanism to obtain discriminative features that can characterize network traffic attack behavior from the multi-scale spatiotemporal features. Specifically, based on the above technical solution, in this step, after completing label allocation and obtaining the RGB traffic image dataset with attack category labels, the RGB traffic images with attack category labels are used as input and fed into a visual self-attention mechanism embedded with a multi-scale feature fusion network. Multi-scale spatiotemporal features are extracted from these images, and the visual self-attention mechanism is used to model these multi-scale spatiotemporal features to obtain discriminative features that can characterize network traffic attack behavior. Here, the multi-scale spatiotemporal features are feature representations of the RGB traffic images, enriching the input features of the visual self-attention mechanism, enabling it to better allocate attention and target features advantageous for classification. A correspondence is established between the multi-scale spatiotemporal features and the traffic image labels through the same image sample. Then, based on the discrimination result of the visual self-attention mechanism on the multi-scale spatiotemporal features, an intrusion detection result corresponding to the RGB traffic image is output, achieving the identification of attack behavior in network traffic.

[0043] Specifically, the multi-scale feature fusion network in step S3 includes three parallel feature extraction paths A, B, and C, and a fusion module, as follows: (1) Path A is a local and row feature extraction path, which uses two consecutive convolutional layers. First, a 3×1 convolutional kernel (stride=1, padding=(1,0)) is used to focus on vertical features, and then a 1×3 convolutional kernel (stride=1, padding=(0,1)) is used to capture horizontal correlations. Each convolutional layer is followed by batch normalization and ReLU activation, which finally generates a 64-channel feature map.

[0044] (2) Path B is a medium-scale global context extraction path. It uses a 3×3 convolution kernel (stride=2) for spatial downsampling, and after batch normalization and ReLU activation, it is refined by a 3×3 convolution with stride=1.

[0045] (3) Path C is a lightweight multi-scale branch path. It achieves feature projection by combining 1×1 convolution with batch normalization and ReLU activation. Then, it expands the receptive field by using 3×3 dilated convolution with an expansion rate of 2 and a padding rate of 2 without aggressive downsampling, and finally generates a 64-channel feature map with a wider spatial context.

[0046] (4) The fusion module is used to stitch together the three 64-channel feature paths into a 192-channel feature map, and to reconstruct the features through a 1×1 convolution of the 192 output channels; then the feature expression capability is enhanced by batch normalization and ReLU activation function; finally, the number of feature channels is compressed from 192 to 3 through a second 1×1 convolution.

[0047] To verify the detection performance of the intrusion detection method in this application, please refer to Tables 1-3, which are experimental comparison tables of the proposed method on the CICIDS-2017 and UNSW-NB15 datasets. As shown in Table 1, the proposed method achieves a good balance between precision and recall across 15 attack categories in the CICIDS dataset, with an overall precision of 98.69%. This result demonstrates the model's superior ability to correctly identify most attack types. In particular, the F1 scores for categories such as DDoS, DoS GoldenEye, DoS Slowhttptest, DoS Slowloris, and Infiltration all exceed 0.99, with DDoS reaching as high as 0.9998, indicating the model's robustness in handling high-frequency or large-scale attacks. However, the F1 scores for Brute Force and XSS attacks are relatively low, at 0.8539 and 0.6550 respectively, indicating confusion between these categories and other similar types.

[0048] Table 1 Performance metrics of the present invention on the CICIDS-2017 dataset

[0049] Table 2 shows the comparison results of the intrusion detection method of the present invention on the CICIDS-2017 dataset. The comparative experimental results based on the CICIDS-2017 dataset (see Table 2) show that the proposed method is superior to several recent advanced methods in key indicators such as accuracy, precision and F1 score. This fully demonstrates that the model has significant comprehensive performance advantages in intrusion detection tasks.

[0050] Table 2 shows the results of multi-class classification comparison on the CICIDS-2017 dataset.

[0051] Table 3 shows that the proposed intrusion detection method achieves an overall accuracy of 96.89% and a weighted average F1 score of 0.9691 on the UNSW-NB15 dataset, indicating that the model possesses excellent detection capabilities in most attack categories. Specifically, the F1 scores for the Generic, Worms, Reconnaissance, and Shellcode categories are all close to 1.00, fully demonstrating the model's high accuracy and robustness in handling these attack types. Similarly, the Exploits and Fuzzers categories achieve F1 scores of 0.9475 and 0.9708, respectively, showcasing strong detection performance. In contrast, the Backdoor and DoS categories have relatively low F1 scores of 0.8663 and 0.8014, respectively, indicating that the model still suffers from some degree of classification ambiguity for these types of attacks.

[0052] Table 3 shows the performance metrics of the proposed invention on the UNSW-NB15 dataset.

[0053] Secondly, this application proposes an intrusion detection system based on a visual self-attention mechanism, comprising: The processing module is used to preprocess the acquired network traffic dataset to obtain key features for intrusion detection; The conversion module is used to convert key features into RGB image data. The feature extraction module is used to capture multi-scale spatiotemporal features of RGB image data by introducing a multi-scale feature fusion network into the encoder with a visual self-attention mechanism. The label assignment module is used to assign labels to capture multi-scale spatiotemporal features.

[0054] Thirdly, this application proposes a computer device, including: a memory and a processor; the memory stores a computer program, and the processor executes the computer program to implement the steps of an intrusion detection method based on a visual self-attention mechanism.

[0055] Fourthly, this application proposes a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of an intrusion detection method based on a visual self-attention mechanism.

[0056] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of this invention is defined by the appended claims and their equivalents.

Claims

1. An intrusion detection method based on a visual self-attention mechanism, characterized in that, include: Obtain network traffic datasets and perform data preprocessing to obtain key features for intrusion detection; Data transformation is performed on key features to obtain RGB image data; A sliding window is set up to group consecutive network traffic samples in the RGB image data. The network traffic samples within the sliding window are mapped to construct a fixed-size RGB traffic image. Each network traffic sample in the RGB traffic image carries its original attack type label. Obtain the original attack type labels for all network traffic samples within the sliding window, and assign labels to the corresponding RGB traffic images based on the attack composition of the network traffic samples within the window, generating an RGB traffic image dataset with attack category labels. The specific rules for labeling the corresponding RGB traffic images based on the attack composition of the network traffic samples within the window are as follows: When all network traffic samples in the window are normal traffic, the RGB traffic image is marked as normal. When the window contains at least one attack traffic sample, the RGB traffic image is labeled with the corresponding attack category; When the window contains multiple attack traffic samples at the same time, assign multiple attack category labels to the RGB traffic image; A multi-scale feature fusion network is introduced into the encoder of the visual self-attention mechanism to extract multi-scale spatiotemporal features from RGB traffic images labeled with attack categories. The visual self-attention mechanism is then used to obtain discriminative features characterizing network traffic attack behavior from these multi-scale spatiotemporal features. The multi-scale feature fusion network includes three parallel feature extraction paths A, B, and C, and a fusion module. Path A is a local and row feature extraction path, which uses two consecutive convolutional layers to generate a 64-channel feature map of the RGB image data. Path B is a mid-scale global context extraction path, which uses a 3×3 convolutional kernel to refine the features of the generated RGB image data. Path C is a lightweight multi-scale branch path, which uses 1×1 convolution combined with batch normalization and ReLU activation to achieve feature projection, and uses 3×3 dilated convolution to expand the receptive field to generate a 64-channel feature map with spatial context features. The fusion module concatenates the 64-channel features from paths A, B, and C, and performs feature reconstruction and channel compression through two 1×1 convolutions to generate multi-scale spatiotemporal features. Based on the correspondence between discriminative features and attack category labels in RGB traffic image data, the attack detection results of the corresponding images are output, thereby enabling the identification of attack behaviors in network traffic.

2. The intrusion detection method based on visual self-attention mechanism as described in claim 1, characterized in that, The network traffic dataset is acquired and preprocessed to obtain key features for intrusion detection, including: Calculate the correlation coefficients among all features of the network traffic dataset. ρ And introduce a correlation threshold between features. α Candidate features are selected by filtering out redundant features; Calculate the mutual information between candidate features and multi-class labels, and introduce a mutual information threshold. β The key features are selected by filtering out irrelevant features.

3. The intrusion detection method based on visual self-attention mechanism as described in claim 1, characterized in that, Data transformation is performed on key features to obtain RGB image data, specifically including: A linear mapping method is used to convert key features into a 24-bit RGB color space; Construct a two-dimensional network, where each column represents a key feature and each row represents traffic data that changes over time; The 24-bit RGB color space is mapped onto the pixels of a two-dimensional grid to obtain the RGB image data of network traffic data.

4. An intrusion detection system based on a visual self-attention mechanism, characterized in that, Intrusion detection systems include: The processing module is used to preprocess the acquired network traffic data to obtain key features for intrusion detection; The conversion module is used to convert key features into RGB image data. The labeling module assigns labels to RGB image data to obtain an RGB traffic image dataset with attack category labels. Specifically, this involves: acquiring RGB image data and grouping consecutive network traffic samples within the RGB image data using a sliding window; mapping the network traffic samples within the sliding window to construct fixed-size RGB traffic images; each network traffic sample in the RGB traffic image carries its original attack type label; acquiring the original attack type labels of all network traffic samples within the sliding window; and assigning labels to the corresponding RGB traffic images based on the attack composition of the network traffic samples within the window, generating an RGB traffic image dataset with attack category labels. The specific rules for labeling the corresponding RGB traffic images based on the attack composition of the network traffic samples within the window are as follows: when all network traffic samples within the window are normal traffic, the RGB traffic image is labeled as normal; when the window contains at least one attack traffic sample, the RGB traffic image is labeled as the corresponding attack category; when the window contains multiple attack traffic samples simultaneously, multiple attack category labels are assigned to the RGB traffic images. The feature extraction module introduces a multi-scale feature fusion network into the encoder of the visual self-attention mechanism to extract multi-scale spatiotemporal features from RGB traffic images labeled with attack categories. It then uses the visual self-attention mechanism to obtain discriminative features characterizing network traffic attack behavior from these multi-scale spatiotemporal features. The multi-scale feature fusion network includes three parallel feature extraction paths A, B, and C, and a fusion module. Path A is a local and row feature extraction path, employing two consecutive convolutional layers to generate a 64-channel feature map of the RGB image data. Path B is a mid-scale global context extraction path, using 3×3 convolutional kernels to refine the features of the generated RGB image data. Path C is a lightweight multi-scale branch path, using 1×1 convolution combined with batch normalization and ReLU activation to achieve feature projection, and employing 3×3 dilated convolution to expand the receptive field and generate a 64-channel feature map with spatial context features. The fusion module concatenates the 64-channel features from paths A, B, and C, and performs feature reconstruction and channel compression through two 1×1 convolutions to generate multi-scale spatiotemporal features. The output module is used to output the attack detection results of the corresponding image based on the correspondence between the discriminative features and the attack category labels of the RGB traffic image data.

5. A computer device, comprising: Memory and processor; The memory stores a computer program, characterized in that: when the processor executes the computer program, it implements the steps of the intrusion detection method based on the visual self-attention mechanism as described in any one of claims 1-3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the intrusion detection method based on the visual self-attention mechanism as described in any one of claims 1-3.

Images