Network intrusion detection method and apparatus
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- CHINA MOBILE COMM GRP CO LTD
- Filing Date
- 2026-03-27
- Publication Date
- 2026-08-07
Smart Images
Figure CN122533784A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of network security technology, specifically to a network intrusion detection method and apparatus. Background Technology
[0002] With the rapid advancement of information technology, computer networks are easily targeted by malicious attacks, endangering user privacy and corporate security. Therefore, network intrusion detection technology is used to analyze network data flow in real time to detect potential attack behaviors or abnormal activities.
[0003] In existing technologies, traditional intrusion detection methods include rule- and feature-driven methods and deep learning algorithms. Rule- and feature-driven methods rely on security experts to manually customize matching rules and network features, and this method does not have the ability to defend against new and unknown attacks. On the other hand, deep learning-based methods require a large amount of labeled data to improve the model's adaptability to unknown samples, which is computationally intensive, and they also lack the ability to identify new and unknown attacks that have never appeared in the training set.
[0004] Application content This application provides a network intrusion detection method and apparatus to solve the technical problems of existing intrusion detection methods being unable to identify network attacks that have not yet occurred and having a large computational load.
[0005] In a first aspect, embodiments of this application provide a network intrusion detection method, including: The network traffic under test is probabilistically classified based on a known attack classifier to obtain the classification result; the attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels; the attack samples and benign traffic samples are obtained by parsing from the original network traffic, and samples of different categories correspond to different synthetic centroids. Based on the synthetic centroid offset model, the offset between the feature representation of the network traffic under test in the latent feature space and the synthetic centroid corresponding to the classification result is calculated, and the attack type corresponding to the network traffic under test is determined according to the offset. The synthetic centroid offset model is obtained by mapping the training samples to the latent feature space and training the encoder using a target loss function. The target loss function is used to minimize the distance between samples of the same class and their corresponding synthetic centroids.
[0006] In one embodiment, the deep neural network is a deep residual network; The known attack classifier is obtained through the following steps: The session flow is obtained by parsing the raw network traffic, and the data packet size sequence is determined based on the arrival time of each data packet in the session flow; The data packet size sequence is normalized to obtain the attack sample and the benign traffic sample; Using the attack samples and the benign traffic samples as training samples, and the real attack category as the label, the deep residual network is iteratively trained to obtain the known attack classifier when the iteration conditions are met.
[0007] In one embodiment, the deep residual network includes a pooling layer, a fully connected layer, a softmax layer, and multiple residual modules; each residual module includes a batch regularization layer, an activation layer, and multiple convolutional layers.
[0008] In one embodiment, the synthetic centroid offset model is obtained through the following steps: In the latent feature space, the synthesis centroids corresponding to the attack sample and the benign traffic sample are initialized respectively; Using a genetic algorithm, a target centroid combination is determined from the corresponding synthetic centroids based on the distance between different synthetic centroids, and the initial coordinates of the target centroid combination are obtained. The encoder weights are iteratively trained based on the target loss function to obtain the synthetic centroid shift model.
[0009] In one embodiment, the target loss function is expressed as follows: ; in, Let be the target loss function. It is the Kronecker delta function, where |||| represents the norm operation. For the first j The attack category corresponding to each sample For the first i The attack category corresponding to each sample For the first i The feature representation of each sample in the latent feature space for The corresponding centroid; Z For the set of training samples, Y The set of labels corresponding to the training samples. C For the centroid combination, n The total number of samples.
[0010] In one embodiment, resolving the session flow from the raw network traffic includes: Multidimensional network features are extracted from the original network traffic, and the session flow is constructed based on the multidimensional network features; the multidimensional network features include at least one of the following: Five-tuple flow statistics, two-tuple characteristics, and analytical characteristics; The five-tuple traffic statistics features include source IP, destination IP, source port, destination port, and protocol; the two-tuple features include the source IP and the destination IP; and the resolution features include DNS query logs.
[0011] Secondly, embodiments of this application also provide a network intrusion detection device, comprising: The attack classification module is used to perform probabilistic classification of the network traffic under test based on a known attack classifier to obtain the classification result. The attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels. The attack samples and benign traffic samples are obtained by parsing from the original network traffic, and samples of different categories correspond to different synthetic centroids. An attack detection module is used to calculate the offset between the feature representation of the network traffic under test in the latent feature space and the corresponding synthetic centroid of the classification result based on a synthetic centroid offset model, and to determine the attack type corresponding to the network traffic under test based on the offset. The synthetic centroid offset model is obtained by mapping the training samples to the latent feature space and training the encoder using a target loss function, wherein the target loss function is used to minimize the distance between samples of the same class and their corresponding synthetic centroids.
[0012] Thirdly, this application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of any of the network intrusion detection methods described above.
[0013] Fourthly, this application also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the network intrusion detection methods described above.
[0014] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of any of the network intrusion detection methods described above.
[0015] The network intrusion detection method and apparatus provided in this application perform probabilistic classification of the network traffic to be tested using a known attack classifier to obtain classification results, thereby achieving rapid initial screening of massive network traffic and accurately identifying conventional network attacks and normal business traffic already existing in the training set. Then, the offset between the feature representation of the network traffic to be tested in the latent feature space and the corresponding synthetic centroid of the classification result is calculated using a synthetic centroid offset model. This reduces the computational load by calculating only the vector distance and removes disguised or entirely new variants of malicious traffic from the known distribution, thereby improving the system's ability to identify new and unknown attacks. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 This is one of the flowcharts of the network intrusion detection method provided in this application.
[0018] Figure 2 This is a schematic diagram of the structure of the deep residual network provided in this application.
[0019] Figure 3 This is a schematic diagram of the working mechanism of the encoder provided in this application.
[0020] Figure 4 This is the second flowchart of the network intrusion detection method provided in this application.
[0021] Figure 5 This is a schematic diagram of the network intrusion detection device provided in this application.
[0022] Figure 6 This is a schematic diagram of the structure of the electronic device provided in this application. Detailed Implementation
[0023] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0024] The following is combined with Figures 1-5 This application describes a network intrusion detection method and apparatus.
[0025] Figure 1 This is one of the flowcharts of the network intrusion detection method provided in this application; see reference. Figure 1 The method includes the following steps: Step 110: Based on the known attack classifier, perform probability classification on the network traffic to be tested to obtain the classification result; the attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels; the attack samples and benign traffic samples are obtained by parsing from the original network traffic, and different categories of samples correspond to different synthetic centroids.
[0026] In this step, the network traffic to be tested includes the network data stream captured in real time at the network interface of the communication device. In this embodiment, the five-tuple session stream can be parsed from the network traffic to be tested, such as source IP (Internet Protocol), destination IP, source port, destination port, and protocol.
[0027] In this step, the classification result is a probability distribution vector, which indicates the likelihood that the traffic belongs to each known category.
[0028] In this step, the known attack classifier can be a Deep ResNet, a multilayer perceptron, a deep convolutional network, etc. The attack classifier construction process is as follows: first, extract historical traffic features and normalize them, then input them into a deep neural network. After residual calculation and feature extraction, the predicted probability is calculated through a Softmax layer, and the weights are iteratively updated using backpropagation with the real labels. The known attack classifier is obtained when the maximum number of training iterations is met.
[0029] In this embodiment, attack samples and benign traffic samples can be historical data that has been pre-labeled manually or in a sandbox environment. For example, attack samples include known DDoS (Distributed Denial of Service) attacks and SQL injection traffic, while benign traffic samples are traffic generated when browsing web pages or sending emails.
[0030] In this embodiment, a genetic algorithm (GA) can be used to find and fix a central coordinate (i.e., a synthetic centroid) for the attack sample and the benign traffic sample in a multidimensional latent feature space, and ensure that the distance between these centroids is maximized so as to facilitate subsequent differentiation.
[0031] For example, in a company's network security protection scenario, when a network intrusion detection system captures a segment of network traffic from an unknown external IP, the system first extracts the size sequence of the first M (M is an integer greater than 0) data packets in the session, performs normalization processing, and inputs it into a pre-trained known attack classifier, and outputs the classification result (i.e., the Softmax probability): the probability of belonging to benign traffic is 0.05, the probability of belonging to a known DDoS attack is 0.85, and the probability of belonging to a known Trojan communication is 0.10. Since the probability of a known DDoS attack is the highest, the system marks the preliminary classification result of the traffic to be tested as a known DDoS attack and maps it to a pre-set DDoS synthesis centroid.
[0032] Step 120: Based on the synthetic centroid offset model, calculate the offset between the feature representation of the network traffic to be tested in the latent feature space and the synthetic centroid corresponding to the classification result, and determine the attack type corresponding to the network traffic to be tested based on the offset. The synthetic centroid offset model is obtained by mapping training samples to the latent feature space and training the encoder using the target loss function. The target loss function is used to minimize the distance between samples of the same class and the corresponding synthetic centroid.
[0033] In this step, the synthetic centroid offset model is trained by the encoder and is used to reduce the original one-dimensional network traffic features or map them to a specific high-dimensional continuous space.
[0034] In this step, the latent feature space is an abstract high-dimensional vector space generated by the encoder mapping, used to measure the similarity of traffic features.
[0035] In this step, the centroid is a set of coordinate points (vectors) in the space, each representing a specific type of network behavior (such as benign traffic, DDoS attack, or Trojan backlink).
[0036] In this step, the feature representation in the latent feature space is the feature vector output by the encoder with the same dimension as the synthetic centroid. The offset refers to the target distance between the feature representation and the synthetic centroid corresponding to the preliminary classification result determined in step 110.
[0037] In this embodiment, the target distance can be Euclidean distance or other distances.
[0038] In this step, the target loss function can be used to design samples of the same category to be infinitely close to the centroid in space (for example, to make all real DDoS samples cluster around the DDoS centroid in space), thereby calculating the offset between the feature representation and the corresponding synthetic centroid of the classification result.
[0039] In this embodiment, a preset distance threshold can be used to compare with the offset. If the offset exceeds the threshold, it means that even if the network traffic under test belongs to a certain category (i.e., the reference classification result), it does not actually conform to the spatial distribution of that category, thus identifying it as a new type of unknown attack.
[0040] For example, in the aforementioned company network security protection scenario, suppose a hacker launches a new unknown attack by exploiting a vulnerability. The known attack classifier may assign the highest probability (e.g., 0.4) because some characteristics of the traffic are similar to DDoS attacks, thus initially classifying it as a "known DDoS attack." Then, the synthetic centroid offset model (encoder) maps the new attack traffic to the latent feature space to obtain a feature representation vector. The target distance (i.e., offset) between this feature vector and the DDoS synthetic centroid is calculated. If the offset calculation result of the current network traffic under test is as high as 4.2, far exceeding the security threshold set by the system (e.g., 1.5), the attack type of the network traffic under test is determined to be a new unknown attack, and an alarm is triggered.
[0041] The network intrusion detection method provided in this application uses a known attack classifier to probabilistically classify the network traffic under test and obtain the classification results, which enables rapid initial screening of massive network traffic and can accurately identify conventional network attacks and normal business traffic already existing in the training set. Then, the offset between the feature representation of the network traffic under test in the latent feature space and the corresponding synthetic centroid of the classification results is calculated by using a synthetic centroid offset model. The computational load is reduced by calculating only the vector distance, and disguised or new variants of malicious traffic are removed from the known distribution, thereby improving the system's ability to identify new and unknown attacks.
[0042] In one embodiment, the deep neural network is a deep residual network; the known attack classifier is obtained through the following steps: parsing the session flow from the original network traffic and determining the packet size sequence based on the arrival time of each packet in the session flow; normalizing the packet size sequence to obtain attack samples and benign traffic samples; using the attack samples and benign traffic samples as training samples and the real attack category as the label, iteratively training the deep residual network to obtain the known attack classifier under the condition of satisfying the iteration conditions.
[0043] In this embodiment, the original network traffic is the underlying bit stream captured by the network mirror port, and the session stream refers to the complete communication interaction process after being reorganized according to the rules of the five-tuple (source IP, destination IP, source port, destination port, protocol).
[0044] In this embodiment, the packet size sequence is a set of byte sizes of each packet in the session arranged in chronological order of timestamps, used to reflect specific behavioral patterns of different attacks or services (such as sudden large packets or dense small packets).
[0045] In this embodiment, normalization refers to using the Min-Max Scaling method to uniformly map the absolute value of the packet size to the dimensionless interval [0,1], so as to accelerate the convergence speed of the model.
[0046] Specifically, each training sample is a conversation stream split into 5-tuples, represented as follows: Each session stream contains multiple data packets. Each sample session is processed by a feature extractor to extract feature vectors, which are then normalized to the range [0,1]. ; in, The normalized feature vectors, Represents the original data value. min Represents the minimum value in the dataset. max This represents the maximum value of that feature in the dataset; the feature of each network flow can be represented as: ; in, t This represents the size of each data packet in each network flow, arranged according to its arrival time. L refers to the number of data packets extracted from each network flow.
[0047] In this embodiment, the aforementioned iterative training and iterative conditions can be achieved by calculating the prediction error through multiple forward propagations and updating the network weights through backpropagation until the loss function converges or reaches the preset maximum number of training rounds.
[0048] In this embodiment, the classifier weights are trained using known attack samples and benign traffic samples from the training set, enabling the classifier to correctly distinguish between known attacks and benign traffic. The classifier is denoted as... The classifier outputs the normalized probability of classifying the network flow to be detected into a certain known attack or benign traffic. The specific process is expressed by the following formula: ; in, i Representing the i There are 10 attack categories, and the total number of attack categories is 10. N The category with the highest Softmax probability is then used as the class label for the traffic being tested.
[0049] The network intrusion detection method provided in this application eliminates the differences in data dimensions under different network environments by parsing session flows from raw network traffic, extracting and normalizing data packet size features based on time series, and finally using a deep residual network for supervised iterative training. This improves the accuracy of the classifier in identifying known network attacks and normal services, and provides reliable data support for subsequent screening of new unknown attacks.
[0050] In one embodiment, the deep residual network includes a pooling layer, a fully connected layer, a softmax layer, and multiple residual modules; each residual module includes a batch regularization layer, an activation layer, and multiple convolutional layers.
[0051] In this embodiment, Deep Residual Networks ResNet (Network for Residual Networks) can extract complex network behavior features from one-dimensional sequences. Deep residual networks, with their multiple residual modules, effectively avoid the vanishing gradient problem caused by increasing network depth through skip connections, ensuring smooth training of deep networks. Within each residual module, convolutional layers slide across the input one-dimensional data packet size sequence to extract local packet length variation patterns (such as the subtle features of continuously sent data packets of specific sizes commonly found in attack traffic). Batch regularization layers normalize the distribution of input data at each layer, reducing internal covariate bias and thus accelerating model convergence and improving generalization ability. Activation layers (such as ReLU functions) introduce non-linear expressive power into the network, enabling it to fit complex malicious traffic patterns. After deep feature extraction by multiple residual modules, pooling layers downsample and compress the high-dimensional feature maps, reducing computational dimensionality while retaining the most significant attack features. Fully connected layers globally flatten and comprehensively map the extracted high-dimensional local features. Finally, the Softmax layer (normalized exponential layer) transforms the output values of the fully connected layers into normalized probability distributions for various known attack categories and benign traffic categories.
[0052] Figure 2 This is a schematic diagram of the structure of the deep residual network provided in this application. Figure 2 In the embodiment shown, a deep residual network is used as the classifier. The classifier consists of four identical residual modules (corresponding to the residual blocks in the figure), an average pooling layer, a fully connected layer, and a softmax layer. Each residual module consists of multiple convolutional layers, batch regularization layers, and activation layers.
[0053] The network intrusion detection method provided in this application, by clearly defining the specific network structure combination of pooling layers, fully connected layers, softmax layers, and multiple residual modules containing batch regularization, activation, and convolutional layers within a deep residual network, achieves automated, deep, and accurate extraction and classification of the underlying spatiotemporal distribution characteristics of network traffic. This ingenious modular network design not only ensures efficient and stable training of the model when facing massive amounts of complex enterprise network data, but also endows the classifier with extremely strong feature representation capabilities, greatly improving the accuracy of identifying known attacks.
[0054] In one embodiment, the synthetic centroid offset model is obtained through the following steps: in the latent feature space, the synthetic centroids corresponding to the attack samples and benign traffic samples are initialized respectively; the target centroid combination is determined from the corresponding synthetic centroids based on the distance between different synthetic centroids using a genetic algorithm, and the initial coordinates of the target centroid combination are obtained; the weights of the encoder are iteratively trained based on the target loss function to obtain the synthetic centroid offset model.
[0055] In this embodiment, the genetic algorithm searches for an optimal set of coordinates, i.e., the target centroid combination, in a vast potential feature space by simulating the crossover, mutation, and selection mechanisms in the natural evolution process. This ensures that the centroids representing different categories maintain the maximum geometric distance (i.e., the initial coordinates), thereby improving the distinguishability between classes.
[0056] In this embodiment, the encoder is used to embed the normalized original flow sequence into the neural network component of the space. The target loss function is used to calculate the Euclidean distance between the feature point mapped by each sample and the corresponding centroid, driving the encoder to continuously adjust the weights so that samples of the same type gather towards their centroid in the space.
[0057] In this embodiment, the distance between known attack traffic and its synthetic centroid is minimized by training the encoder weights, and a genetic algorithm is used to search for the synthetic centroid combination that maximizes the distance in the feature space.
[0058] Specifically, the initial synthetic centroid search process is as follows: For a training set including k known attacks and 1 benign attack, k+1 synthetic centroids need to be constructed for the training samples. The synthetic centroid is represented by a vector of length m in the latent feature space. = The composite centroid is represented by a vector of length m. This represents the i-th feature in the vector. To maximize the distinguishability between known attacks and benign traffic, we need to maximize the distance between the k+1 centroids, i.e. , It represents Euclidean distance.
[0059] Figure 3This is a schematic diagram of the working mechanism of the encoder provided in this application. Figure 3 In the illustrated embodiment, when training the synthetic centroid shift model, the network traffic (N) of the training set is first... flow1 N flow2 ..., N flown The input is fed into the encoder. Since each known attack class and benign traffic defines a composite centroid, the optimal combination of composite centroids is searched based on a genetic algorithm. The encoding transforms the original features of the network traffic into a latent feature space of the same dimension as the centroid, and makes attack traffic of the same category sufficiently close to its composite centroid. The attack types corresponding to the network traffic include benign traffic, known attack 1, known attack 2, and novel unknown attacks.
[0060] Specifically, the training set X={ } Transformed into latent spatial features by encoder , The attack category label represents each network traffic instance in the training set, and the optimal combination of synthesized centroids is represented as... By building The distance function is used to characterize the degree of offset between all samples belonging to a certain class of known attacks and their corresponding centroids in the latent space. The distance function (i.e., the target loss function) is defined as follows: ; in, Let be the target loss function. It is the Kronecker delta function, where |||| represents the norm operation. For the first j The attack category corresponding to each sample For the first i The attack category corresponding to each sample For the first i The feature representation of each sample in the latent feature space for The corresponding centroid; Z For the set of training samples, Y The set of labels corresponding to the training samples. C For the centroid combination, n The total number of samples.
[0061] This embodiment further classifies each type of known attack and benign traffic. The average distance is used as the loss function for training the synthetic centroid offset model. The transformed target loss function is defined as follows: .
[0062] In this embodiment, the synthetic centroid offset model is achieved by minimizing... The loss function is used for training. After training, each known attack and benign traffic will be very close to its composite centroid, that is, the offset of the composite centroid is very small. For new unknown attacks, they will be kept at a sufficiently large distance from each composite centroid, that is, the offset from each composite centroid is large. This achieves the detection of new unknown attacks while correctly classifying known attacks.
[0063] The network intrusion detection method provided in this application optimizes the initial layout of the synthetic centroid using a genetic algorithm and combines the target loss function to constrain the spatial mapping capability of the encoder. This achieves maximization of inter-class distance and minimization of distribution in the feature space, further improving the accuracy of identifying novel unknown attacks and thus enhancing the system's sensitivity and robustness in complex network environments.
[0064] In one embodiment, resolving a session flow from raw network traffic includes: extracting multidimensional network features from the raw network traffic and constructing a session flow based on the multidimensional network features; the multidimensional network features include at least one of the following: quintuple traffic statistics features, binary features, and resolution features; wherein, the quintuple traffic statistics features include source IP, destination IP, source port, destination port, and protocol, the binary features include source IP and destination IP, and the resolution features include DNS query logs.
[0065] In this embodiment, the five-tuple traffic statistics feature (including source IP, destination IP, source port, destination port, and protocol) in the multidimensional network features is used to accurately locate the end-to-end communication behavior of a specific service (such as web page access or SSH login) between two hosts. In this embodiment, when constructing a session flow using binary features (including only the source IP and destination IP), the restrictions on ports and protocols are relaxed, enabling the monitoring of all data exchanges between two hosts. This strategy can effectively defend against attackers' evasion attempts by constantly changing ports.
[0066] In this embodiment, the resolution features (based on the Domain Name System query log) are key information extracted from the application layer to record the domain names (such as the requested URLs) that internal hosts request to resolve. This plays a crucial role in identifying back-connection communications or DNS tunneling attacks initiated by controlled hosts to external malicious C&C (command and control) servers.
[0067] For example, in the aforementioned company's network security protection scenario, the network intrusion detection system captured a period of abnormal raw network traffic lasting several minutes at the gateway. The system then began extracting multi-dimensional network features: First, the system extracted the conventional five-tuple traffic statistics features, discovering that an internal host (source IP: 192.168.1.50) was using a dynamic high-risk port (source port: 54321) to send data to an external server (destination IP: 203.0.113.5, destination port: 80, protocol: TCP); simultaneously, to prevent hackers from using port hopping techniques to hide their tracks, the system extracted two-tuple features, summarizing and analyzing them to find... The internal IP not only sent probe packets to port 80, but also sent them to multiple different ports of the external IP within one minute. At the same time, the system also extracted the resolution characteristics (DNS query logs) at the gateway and found that the internal host had queried a highly suspicious dynamic domain name (such as x9k2m.malware-cnc.com) composed of random letters before establishing a connection. The system finally aligned and concatenated the feature information of these three dimensions, successfully parsed and constructed a complete session stream containing deep application layer behavior and underlying transmission characteristics, and sent it to the subsequent classifier and synthetic centroid offset model for subsequent attack type classification.
[0068] The network intrusion detection method provided in this application extracts multi-dimensional network features, including quintuples, binary tuples, and DNS query logs, to comprehensively analyze and construct session flows. This enables multi-dimensional characterization of complex network attack behaviors. The method can compensate for the detection blind spots of a single quintuple when facing port spoofing, encrypted traffic, or covert tunnel attacks, and further improves the system's underlying data capture capabilities and overall defense robustness.
[0069] Figure 4 This is the second flowchart of the network intrusion detection method provided in this application. Figure 4 In the illustrated embodiment, the network intrusion detection method includes four stages: Stage 1: Sample traffic partitioning; Stage 2: Construction of a known attack classifier; Stage 3: Construction of a synthetic centroid shift model; and Stage 4: Construction of a detection system. Specifically, in the first stage, raw features are generated from the raw traffic, and the dataset is partitioned into a training set and a test set, i.e., network traffic samples (N... flow1 N flow2 ...N flownThe training set includes benign samples and known attack samples, while the test set includes known attack samples used to test model performance and newly constructed unknown attack samples. In the second stage, the training set data is first normalized and regularized to unify the data scale, and then a classifier is constructed. In this embodiment, a deep residual network is used as the classifier. Next, the known attacks and benign traffic in the training set are used to train the classifier so that the model can correctly detect known attacks and benign traffic. In the third stage, benign traffic and known attacks in the training set are used to construct a synthetic centroid for each known attack and benign traffic in the encoded feature space. Assuming there are n types of known attacks and 1 type of benign traffic, n+1 synthetic centroids are constructed. The synthetic centroids are determined by a genetic algorithm, with the goal of maximizing the distance between the n+1 centroids so that there is a sufficiently large discriminative power between known attacks and benign traffic. The synthetic centroid offset model also has an encoder used to embed the original network traffic encoding into a feature space with the same dimension as the synthetic centroids. The encoder parameters can be trained using samples from the training set so that each type of known sample is close to its corresponding synthetic centroid. In the fourth stage... In this section, a novel network intrusion detection system is constructed. The system includes a pre-trained classifier in the second stage and a synthetic centroid offset model constructed in the third stage. After deployment, the system can perform intrusion detection on new network traffic to be tested. First, the pre-trained classifier module classifies the traffic to be tested. Each traffic is first classified as known attack or benign traffic. Then, the traffic to be tested continues to enter the synthetic centroid offset model. If the traffic offsets its corresponding centroid distance by more than a threshold, it is considered that the traffic does not conform to the distribution of this type of attack and is detected as a new unknown attack. If the traffic offsets its corresponding centroid distance by less than the threshold, the classifier label is retained and it is detected as a known attack or benign traffic with the highest probability of the classifier's Softmax.
[0070] The network intrusion detection device provided in this application is described below. The network intrusion detection device described below can be referred to in correspondence with the network intrusion detection method described above.
[0071] Figure 5 This is a schematic diagram of the network intrusion detection device provided in this application, as shown below. Figure 5 As shown, the network intrusion detection device includes an attack classification module 510 and an attack detection module 520.
[0072] The attack classification module 510 is used to perform probabilistic classification of the network traffic under test based on a known attack classifier to obtain the classification result. The attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels. The attack samples and benign traffic samples are obtained by parsing from the original network traffic, and different categories of samples correspond to different synthetic centroids. The attack detection module 520 is used to calculate the offset between the feature representation of the network traffic under test in the latent feature space and the corresponding synthetic centroid of the classification result based on the synthetic centroid offset model, and to determine the attack type corresponding to the network traffic under test based on the offset. The synthetic centroid offset model is obtained by mapping training samples to the latent feature space and training the encoder using the target loss function. The target loss function is used to minimize the distance between samples of the same class and the corresponding synthetic centroid.
[0073] The network intrusion detection device provided in this application embodiment performs probability classification on the network traffic to be tested using a known attack classifier to obtain classification results, thereby achieving rapid initial screening of massive network traffic and accurately identifying conventional network attacks and normal business traffic already existing in the training set. Then, it calculates the offset between the feature representation of the network traffic to be tested in the latent feature space and the corresponding synthetic centroid of the classification result through a synthetic centroid offset model. This reduces the computational load by calculating only the vector distance and removes disguised or entirely new variants of malicious traffic from the known distribution, thereby improving the system's ability to identify new and unknown attacks.
[0074] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communications interface 620, a memory 630, and a communications bus 640, wherein the processor 610, the communications interface 620, and the memory 630 communicate with each other through the communications bus 640. The processor 610 can call logic instructions in the memory 630 to execute a network intrusion detection method, which includes: performing probabilistic classification of the network traffic to be tested based on a known attack classifier to obtain a classification result; the attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels; attack samples and benign traffic samples are obtained by parsing from the original network traffic, and samples of different categories correspond to different synthetic centroids; based on the synthetic centroid offset model, the offset between the feature representation of the network traffic to be tested in the latent feature space and the synthetic centroid corresponding to the classification result is calculated, and the attack type corresponding to the network traffic to be tested is determined according to the offset; the synthetic centroid offset model is obtained by mapping training samples to the latent feature space and training the encoder using a target loss function, the target loss function being used to minimize the distance between samples of the same category and their corresponding synthetic centroids.
[0075] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.
[0076] On the other hand, this application also provides a non-transitory computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, the computer can execute the network intrusion detection method provided by the above methods. The method includes: performing probabilistic classification of the network traffic to be tested based on a known attack classifier to obtain a classification result; the attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels; the attack samples and benign traffic samples are obtained by parsing from the original network traffic, and samples of different categories correspond to different synthetic centroids; based on the synthetic centroid offset model, calculating the offset between the feature representation of the network traffic to be tested in the latent feature space and the synthetic centroid corresponding to the classification result, and determining the attack type corresponding to the network traffic to be tested based on the offset; the synthetic centroid offset model is obtained by mapping training samples to the latent feature space and training the encoder using a target loss function, the target loss function being used to minimize the distance between samples of the same category and their corresponding synthetic centroids.
[0077] In another aspect, this application also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network intrusion detection method provided by the above methods. The method includes: performing probabilistic classification of the network traffic to be tested based on a known attack classifier to obtain a classification result; the attack classifier is obtained by iteratively training a deep neural network with attack samples and benign traffic samples as training samples and real attack categories as labels; the attack samples and benign traffic samples are obtained by parsing from the original network traffic, and samples of different categories correspond to different synthetic centroids; based on the synthetic centroid offset model, calculating the offset between the feature representation of the network traffic to be tested in the latent feature space and the synthetic centroid corresponding to the classification result, and determining the attack type corresponding to the network traffic to be tested based on the offset; the synthetic centroid offset model is obtained by mapping training samples to the latent feature space and training the encoder using a target loss function, the target loss function being used to minimize the distance between samples of the same category and their corresponding synthetic centroids.
[0078] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.
[0079] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.
[0080] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A network intrusion detection method, characterized in that, include: Based on a known attack classifier, the network traffic under test is probabilistically classified to obtain the classification result; The attack classifier is obtained by iteratively training a deep neural network using attack samples and benign traffic samples as training samples and real attack categories as labels. The attack samples and the benign traffic samples are obtained by parsing from the original network traffic, and different types of samples correspond to different composite centroids; Based on the synthetic centroid offset model, the offset between the feature representation of the network traffic under test in the latent feature space and the synthetic centroid corresponding to the classification result is calculated, and the attack type corresponding to the network traffic under test is determined according to the offset. The synthetic centroid offset model is obtained by mapping the training samples to the latent feature space and training the encoder using a target loss function. The target loss function is used to minimize the distance between samples of the same class and their corresponding synthetic centroids.
2. The network intrusion detection method according to claim 1, characterized in that, The deep neural network is a deep residual network; The known attack classifier is obtained through the following steps: The session flow is obtained by parsing the raw network traffic, and the data packet size sequence is determined based on the arrival time of each data packet in the session flow; The data packet size sequence is normalized to obtain the attack sample and the benign traffic sample; Using the attack samples and the benign traffic samples as training samples, and the real attack category as the label, the deep residual network is iteratively trained to obtain the known attack classifier when the iteration conditions are met.
3. The network intrusion detection method according to claim 2, characterized in that, The deep residual network includes a pooling layer, a fully connected layer, a softmax layer, and multiple residual modules; each residual module includes a batch regularization layer, an activation layer, and multiple convolutional layers.
4. The network intrusion detection method according to claim 1, characterized in that, The synthetic centroid offset model is obtained through the following steps: In the latent feature space, the synthesis centroids corresponding to the attack sample and the benign traffic sample are initialized respectively; Using a genetic algorithm, a target centroid combination is determined from the corresponding synthetic centroids based on the distance between different synthetic centroids, and the initial coordinates of the target centroid combination are obtained. The encoder weights are iteratively trained based on the target loss function to obtain the synthetic centroid shift model.
5. The network intrusion detection method according to claim 1 or 4, characterized in that, The target loss function is expressed by the following formula: ； in, Let be the target loss function. It is the Kronecker delta function, where || represents the norm operation. For the first j The attack category corresponding to each sample For the first i The attack category corresponding to each sample For the first i The feature representation of each sample in the latent feature space for The corresponding centroid; Z For the set of training samples, Y The set of labels corresponding to the training samples. C For the centroid combination, n The total number of samples.
6. The network intrusion detection method according to claim 2, characterized in that, The process of parsing the session stream from the raw network traffic includes: Multidimensional network features are extracted from the original network traffic, and the session flow is constructed based on the multidimensional network features; the multidimensional network features include at least one of the following: Five-tuple flow statistics, two-tuple characteristics, and analytical characteristics; The five-tuple traffic statistics features include source IP, destination IP, source port, destination port, and protocol; the two-tuple features include the source IP and the destination IP; and the resolution features include DNS query logs.
7. A network intrusion detection device, characterized in that, include: The attack classification module is used to perform probability classification on the network traffic under test based on a known attack classifier, and obtain the classification result. The attack classifier is obtained by iteratively training a deep neural network using attack samples and benign traffic samples as training samples and real attack categories as labels. The attack samples and the benign traffic samples are obtained by parsing from the original network traffic, and different types of samples correspond to different composite centroids; An attack detection module is used to calculate the offset between the feature representation of the network traffic under test in the latent feature space and the corresponding synthetic centroid of the classification result based on a synthetic centroid offset model, and to determine the attack type corresponding to the network traffic under test based on the offset. The synthetic centroid offset model is obtained by mapping the training samples to the latent feature space and training the encoder using a target loss function, wherein the target loss function is used to minimize the distance between samples of the same class and their corresponding synthetic centroids.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network intrusion detection method as described in any one of claims 1 to 6.
9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the network intrusion detection method as described in any one of claims 1 to 6.
10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the network intrusion detection method as described in any one of claims 1 to 6.