Network intrusion detection method, device and medium

Abstract

The application is suitable for the network security technical field, and provides a network intrusion detection method, device and medium, the method comprising: acquiring source domain traffic data of a preset reference network and target domain traffic data of a target network; taking traffic samples in the source domain traffic data and the target domain traffic data as graph nodes, constructing K-neighbor graphs of the source domain and the target domain respectively, and extracting source domain traffic features and target domain traffic features through a graph attention network respectively; according to the source domain traffic features and the target domain traffic features, calculating a joint loss through a classifier and at least two different granularity adversarial domain discriminators, and iteratively training to obtain an initial detection model; based on the classification confidence and the category prototype consistency of the initial detection model, screening the target domain traffic data to obtain a pseudo-label sample set; optimizing the initial detection model according to the pseudo-label sample set; and based on the optimized detection model, performing intrusion detection classification on the target network.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and in particular relates to a network intrusion detection method, device and medium. Background Technology

[0002] As a crucial component of the current network architecture, the Internet of Things (IoT) has been widely applied in smart homes, industrial control, intelligent transportation, medical monitoring, and urban infrastructure, making IoT security increasingly critical. Intrusion detection technology, which analyzes network traffic to identify abnormal behavior and attacks, is a core means of safeguarding network security.

[0003] In related technologies, obtaining real and representative network intrusion data is often difficult. For example, in IoT scenarios: on the one hand, IoT devices are diverse and their operating environments are complex, making attack behavior reproduction and traffic collection costly; on the other hand, network traffic labeling usually relies on professional security knowledge, and manual labeling is costly, resulting in a scarcity of labeled samples available for supervised training in the target IoT environment. Traditional supervised learning methods rely on a large number of labeled samples for model training. When labeled data is insufficient, the model struggles to fully learn the attack characteristics in the target environment, and the intrusion detection performance drops significantly. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a network intrusion detection method, device and medium to solve the problem that the intrusion detection effect of existing network intrusion detection models will significantly decrease when there is insufficient labeled data.

[0005] In a first aspect, embodiments of the present invention provide a network intrusion detection method, comprising: Obtain source domain traffic data of the preset reference network and target domain traffic data of the target network; Using traffic samples from the source domain traffic data and the target domain traffic data as graph nodes, K-nearest neighbor graphs for the source domain and the target domain are constructed respectively, and source domain traffic features and target domain traffic features are extracted respectively through a graph attention network. Based on the source domain traffic features and the target domain traffic features, the joint loss is calculated using a classifier and at least two adversarial discriminators of different granularities, and the initial detection model is obtained through iterative training. Based on the classification confidence and category prototype consistency of the initial detection model, the target domain traffic data is filtered to obtain a pseudo-label sample set; The initial detection model is optimized based on the pseudo-label sample set; Based on the optimized detection model, the target network is classified for intrusion detection.

[0006] In one possible implementation, the at least two adversarial discriminators with different granularities include: a global discriminator and a local discriminator; The step of calculating the joint loss based on the source domain traffic features and the target domain traffic features, using a classifier and at least two adversarial discriminators of different granularities, includes: The source domain traffic features and the target domain traffic features are input into the classifier for classification, and the classification loss is obtained. The global discriminator loss is calculated using the global discriminator, the local discriminator loss is calculated using the local discriminator, and the joint loss is determined based on the classification loss, the global discriminator loss, and the local discriminator loss.

[0007] In one possible implementation, determining the joint loss based on the classification loss, the global domain discriminant loss, and the local domain discriminant loss includes: At each iteration, the global A-distance is calculated based on the global discriminator loss, the local A-distance for each class is calculated based on the local discriminator loss, and the dynamic weights of the global discriminator and the local discriminator are determined based on the global A-distance and the local A-distance. Based on the dynamic weights, the global domain discriminator loss and the local domain discriminator loss are weighted and fused to obtain the dynamic domain adversarial loss; The joint loss is determined based on the classification loss and the dynamic domain adversarial loss.

[0008] In one possible implementation, determining the dynamic weights of the global domain discriminator and the local domain discriminator based on the global A-distance and the local A-distance includes: Determine the dynamic weights of the local discriminator ; The dynamic weights of the global domain discriminator are determined to be 1- ; in, For the global A-distance, For the first c The local A-distance corresponding to the class, This represents the total number of categories.

[0009] In one possible implementation, determining the joint loss based on the classification loss and the dynamic domain adversarial loss includes: according to Determine the joint loss; wherein, For the classification loss, For the dynamic domain adversarial loss, The preset weighting coefficients for the domain alignment items.

[0010] In one possible implementation, the step of filtering the target domain traffic data based on the classification confidence and category prototype consistency of the initial detection model to obtain a pseudo-label sample set includes: The target domain traffic data is classified and predicted based on the initial detection model. For each class, based on the predicted probability that the target domain traffic sample belongs to that class, a first preset proportion of traffic samples are selected from high to low to obtain the high confidence candidate set corresponding to that class. Construct source-target domain hybrid prototypes for various types. Based on the similarity between the characteristics of each traffic sample in the target domain and the source-target domain hybrid prototype of each type, select a second preset proportion of traffic samples in each type from high to low to obtain a high consistency candidate set for each type. Based on the high-confidence candidate set and the high-consistency candidate set, a pseudo-label sample set is determined.

[0011] In one possible implementation, the construction of various source-target domain hybrid prototypes includes: Based on the true classification labels of the source domain traffic samples, determine the average value of all sample features under each class to obtain the source domain prototype corresponding to each class; According to the order of prediction probability from high to low, each category extracts a third preset proportion of traffic samples from the target domain, and the sample features are weighted and aggregated according to the corresponding prediction probability to obtain the target domain prototype for each category. Based on a preset mixing coefficient, the source domain prototype and the target domain prototype corresponding to each class are linearly fused to obtain the source domain-target domain hybrid prototype for each class.

[0012] In one possible implementation, optimizing the initial detection model based on the pseudo-label sample set includes: The pseudo-label sample set is merged with the source domain traffic data and the target domain traffic data to form a new training set; Based on the new training set, the model parameters of the initial detection model are iteratively trained and optimized to obtain the optimized detection model.

[0013] In a second aspect, embodiments of the present invention provide an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the method described in the first aspect or any possible implementation thereof.

[0014] Thirdly, embodiments of the present invention provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in the first aspect or any possible implementation thereof.

[0015] The beneficial effects of the embodiments of the present invention compared with the prior art are as follows: This invention constructs a K-nearest neighbor graph of source and target domain traffic data and employs a graph attention network to encode the features of the graph structure data. This allows the model to learn the features of individual traffic samples while further aggregating information from neighboring samples, improving the discriminativeness and robustness of the feature representation. By calculating the joint loss using a classifier and at least two adversarial discriminators of different granularities, the model's adaptability to different types of domain shifts in complex cross-domain scenarios is enhanced. A dual-constraint pseudo-label screening mechanism is used to screen target domain samples based on classification confidence and class prototype consistency, obtaining a reliable set of pseudo-label samples for model optimization. This reduces the probability of high-confidence erroneous samples being included in the training process, weakens the impact of accumulated pseudo-label noise on model training, and improves the model's detection stability and generalization ability. Through these methods, this embodiment can transfer knowledge to target network intrusion detection tasks using well-labeled source domain traffic data when there are insufficient labeled samples in the target network. This reduces reliance on large-scale manually labeled data in the target domain, lowers the cost of re-collecting and labeling training data in new networks, and improves the model's detection performance and generalization ability in cross-domain network intrusion detection tasks. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a schematic diagram illustrating the implementation process of the network intrusion detection method provided in this embodiment of the invention; Figure 2 This is a schematic diagram of the model processing procedure of the network intrusion detection method provided in the embodiments of the present invention; Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0018] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of the invention. However, those skilled in the art will understand that the invention can be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of the invention with unnecessary detail.

[0019] To illustrate the technical solution described in this invention, specific embodiments are described below.

[0020] To address the issue of insufficient labeled samples in the target domain during network intrusion detection, domain adaptation techniques can leverage well-labeled source domain intrusion detection data to transfer knowledge to the sparsely labeled target network environment, mitigating the impact of insufficient labeled samples in the target domain. However, existing domain adaptation methods typically map source and target domain data into a common feature space using feature extractors and distribution alignment strategies, enabling classification models trained on the source domain to be applied to target domain intrusion detection tasks. While existing methods have improved the cross-domain adaptability of models to some extent, they still have the following limitations: First, existing methods typically treat each network traffic sample as an independent input during traffic feature extraction, focusing primarily on the statistical characteristics of individual samples while neglecting to model the local relationships between samples. In reality, similar traffic samples often exhibit certain neighborhood structures, and relying solely on independent sample features can limit the discriminative power and cross-domain robustness of feature representations. Second, existing domain adaptation methods often align the source and target domains at a single level. Since the overall distribution differences and class conditional distribution differences between the source and target domains are not fixed at different training stages, existing alignment strategies struggle to dynamically adjust the contributions of different alignment targets based on the training process, thus affecting the model's adaptability to complex domain shifts. Furthermore, existing pseudo-labeling methods typically select target domain samples based on classifier prediction confidence and use high-confidence samples as pseudo-labels for training. While this approach can utilize unlabeled data from the target domain, high-confidence predictions do not necessarily represent reliable labels when cross-domain distribution differences are significant or when the classification boundary is unstable in the early stages of model training. If erroneous pseudo-labels are added to the training process, noise accumulation can easily occur, impacting target domain detection performance and model training stability.

[0021] The purpose of this invention is to: transfer knowledge from well-labeled source domain intrusion detection data to the target network intrusion detection task when there are insufficient labeled samples in the target network scene; enhance traffic feature representation capabilities through graph structure feature extraction; reduce the distribution differences between the source and target domains through dynamic multi-granularity adversarial domain alignment; and reduce the impact of erroneous pseudo-labels on model training through dual-constraint pseudo-label screening. This reduces the reliance on large-scale manually labeled data in the target domain, lowers the cost of re-collecting and labeling training data in new network environments, and improves the model's detection performance and generalization ability in cross-domain network intrusion detection tasks.

[0022] Figure 1 This is a schematic diagram illustrating the implementation process of the network intrusion detection method provided in this embodiment of the invention. Figure 2 This is a schematic diagram of the model processing procedure of this method.

[0023] The following combination Figure 1 and Figure 2 The following explains the methods for network intrusion detection: Step S101: Obtain source domain traffic data of the preset reference network and target domain traffic data of the target network.

[0024] In this embodiment, after acquiring these data, the source domain traffic data and target domain traffic data can be preprocessed to convert non-numerical features into numerical representations and normalize the numerical features to reduce the impact of differences in the dimensions of different features on model training.

[0025] Step S102: Using traffic samples from the source domain traffic data and the target domain traffic data as graph nodes, construct K-nearest neighbor graphs for the source domain and the target domain respectively, and extract source domain traffic features and target domain traffic features respectively through a graph attention network.

[0026] Here, to fully explore the local correlations between network traffic samples, the traffic samples in the source and target domains are first modeled as graph structures during the feature learning stage, and then representation learning is performed on the graphs. Specifically, a K-nearest neighbor graph (KNN Graph) is first constructed based on the feature similarity between samples. Then, a graph attention network (GAT) is used to encode the graph structure data, and a more discriminative traffic feature representation is learned through adaptive neighborhood aggregation. The detailed steps are as follows: (1) Let the samples in the source domain and the target domain be respectively .in, These represent network traffic samples from the source and destination domains, respectively. The source domain samples are labeled, while the target domain samples are unlabeled. To model the local structural relationships between samples, this embodiment treats each network flow sample as a node in a graph, and explicitly models local neighborhood relationships through feature similarity between samples, establishing a KNN similarity graph for each domain.

[0027] Within each domain, Euclidean distance is used to measure the similarity between samples. For any two samples... and European distance Defined as: For each node Select the one closest to it Each sample forms its nearest neighbor set, denoted as _ ... Then the edge set can be defined as: Furthermore, the corresponding adjacency matrix can be obtained. ,in: Construct source domain graphs in the manner described above. and target domain graph .

[0028] (2) After completing the graph construction, in the source domain graph respectively and target domain graph The graph representation learning is performed on top of this. GAT introduces an attention mechanism that can adaptively allocate aggregation weights based on the correlation between neighboring nodes and the target node, thereby enhancing the discriminativeness and robustness of traffic features.

[0029] Set nodes The input is represented as The initial node satisfies For nodes and its neighboring nodes GAT calculates the importance of neighboring nodes to the current node through an attention mechanism. Its unnormalized attention coefficient is: in, For attention weight vectors, This represents a vector concatenation operation. Represents a node The neighborhood set.

[0030] Perform the above attention coefficients Normalization yields the normalized weights: in, Representing neighboring nodes For nodes Attention weights.

[0031] Based on the normalized attention weights, the node The representation is obtained by weighted summation of neighborhood features, and updated as follows: in, Represents a non-linear activation function. Represents a node Feature representation after graph attention aggregation.

[0032] To further enhance the model's expressive power, a multi-head attention mechanism is introduced. Assuming there are M attention heads in total, then the node... The output is represented as: in, and Let represent the attention weight and linear transformation matrix corresponding to the m-th attention head, respectively.

[0033] After graph attention encoding, the source and target domain samples respectively obtain the final node representations: and By constructing a KNN local neighborhood graph and using GAT to adaptively aggregate neighborhood information, the local correlation between network traffic samples is fully modeled, and the original statistical features of the samples are transformed into a high-level semantic representation that integrates neighborhood context, providing a more reliable feature foundation for subsequent training.

[0034] Step S103: Based on the source domain traffic features and target domain traffic features, calculate the joint loss using a classifier and at least two adversarial discriminators of different granularities, and iteratively train to obtain the initial detection model.

[0035] Domain adversarial learning (DANN) learns domain-invariant features through adversarial training, thereby reducing the distributional differences between the source and target domains. A typical DANN consists of a feature extractor. Tag classifier Domain discriminant The system consists of a feature extractor to extract deep feature representations from input samples, a label classifier to predict the category of the samples, and a domain discriminator to distinguish whether the input features come from the source domain or the target domain. During training, the label classifier minimizes the classification loss, while the domain discriminator, through a gradient reversal layer (GRL), forms an adversarial relationship with the feature extractor, thereby prompting the feature extractor to learn domain-invariant features. Here, CE represents the cross-entropy loss, and the classification loss is: Domain tags ,in Represents the source domain. Let the target domain be denoted, then the domain-discriminatory loss is written as: DANN minimizes And maximize adversarially This method aligns the overall distribution of the source and target domains. However, it primarily focuses on edge distribution alignment, making it difficult to explicitly measure fine-grained distribution differences under different category conditions. Existing domain adaptation methods typically emphasize reducing the overall distribution difference between the source and target domains; however, in complex migration scenarios, edge distribution alignment alone is insufficient to effectively handle category-level cross-domain offsets, easily leading to intra-class mismatches and inter-class aliasing. Conversely, focusing solely on conditional distribution alignment may overlook situations where the overall inter-domain offset remains significant. In fact, the impact of edge and conditional distribution differences on target domain performance varies across different migration tasks, making fixed alignment strategies unsuitable for different domain offset patterns. To address this issue, this embodiment draws upon the concept of dynamic adversarial domain adaptation, combining it with the characteristics of cross-domain network intrusion detection tasks. By jointly using a global and local domain discriminator, and integrating coarse-grained edge distribution alignment with fine-grained conditional distribution alignment, it reduces the domain gap and automatically adjusts the alignment strength using a dynamic balancing factor, thereby improving target domain intrusion detection performance.

[0036] In one possible implementation, step S103 includes: inputting source domain traffic features and target domain traffic features into a classifier for classification to obtain a classification loss; calculating the global domain discriminator loss through a global domain discriminator, calculating the local domain discriminator loss through a local domain discriminator, and determining the joint loss based on the classification loss, the global domain discriminator loss, and the local domain discriminator loss.

[0037] Specifically: The dynamic multi-granularity adversarial domain alignment module includes a feature extractor. Tag classifier And a domain discriminator, where the label classifier outputs the posterior probability of the sample's class, and the domain discriminator is further divided into a global domain discriminator. and local discriminant These are used to align marginal distributions and conditional distributions, respectively. A dynamic equilibrium factor can also be introduced. This is used to adaptively allocate training weights between the two, enabling the model to dynamically adjust the alignment focus based on the domain offset state at different training stages.

[0038] To align the edge distribution between the source and target domains, a global domain discriminator is constructed. Adversarial learning is achieved through a gradient reversal layer, and the global discriminator loss is... .

[0039] Relying solely on edge distribution alignment can easily overlook the problem of class-conditional distribution mismatch. Therefore, a class-level local discriminator is further introduced. Fine-grained conditional alignment is performed on the data for each category. Specifically, this is achieved using the output of the label classifier. Conditional modulation is applied to the feature representation, and Enter the corresponding number The local discriminant is calculated using a local discriminant, and its loss is obtained. Considering that the dominance of marginal distribution differences and conditional distribution differences is not constant in different training stages, the example further introduces a dynamic balance factor. This is used to adaptively adjust the weights of edge distribution alignment and conditional distribution alignment during training. A-distance is used to measure the global (edge) distribution difference and the local (conditional) distribution difference between the source and target domains.

[0040] First, the global domain discriminator loss is utilized. Calculate the global A-distance: Using the corresponding local discriminator loss Calculate the local A-distance: The dynamic equilibrium factor is defined as: It can be abbreviated as: Further obtain dynamic domain adversarial loss for: in, The range of values ​​is ,when When the value is close to 0, edge distribution alignment dominates; when... When the value is close to 1, conditional distribution alignment plays a more significant role. This dynamic equilibrium factor is updated after each iteration.

[0041] Step S104: Based on the classification confidence and category prototype consistency of the initial detection model, the target domain traffic data is filtered to obtain a pseudo-label sample set.

[0042] Dynamic multi-granularity adversarial domain alignment enhances cross-domain adaptability by dynamically coordinating edge distributions and conditional distributions. However, the lack of true label information in the target domain makes it difficult to fully learn the target domain's category structure, thus limiting the accuracy of conditional distribution alignment. To alleviate this problem, this embodiment introduces a dual-constraint pseudo-label selection strategy based on dynamic multi-granularity adversarial domain alignment. This strategy performs dual-constraint screening on the target domain samples to select highly reliable pseudo-label samples, which are then used as auxiliary supervision signals along with the original data to train the subsequent model.

[0043] In one possible implementation, step S104 includes: classifying and predicting the target domain traffic data according to the initial detection model; for each class, selecting a first preset proportion of traffic samples from high to low according to the predicted probability that the target domain traffic samples belong to that class, to obtain a high-confidence candidate set corresponding to that class; constructing source-target domain hybrid prototypes for each class, and selecting a second preset proportion of traffic samples from high to low in each class according to the similarity between the features of each traffic sample in the target domain and the source-target domain hybrid prototype of each class, to obtain a high-consistency candidate set corresponding to each class; and determining a pseudo-label sample set based on the high-confidence candidate set and the high-consistency candidate set.

[0044] In this embodiment, for target domain samples, the predicted probability of the target domain data is output by the model obtained from the first stage of training. Subsequently, the reliability of the target domain samples is evaluated from two dimensions: prediction confidence and class prototype consistency. First, within each class, the target domain samples are sorted according to their probability of belonging to that class, and high-confidence candidate samples with high classification certainty are selected. Based on this, a source domain class prototype is constructed using the feature mean of labeled samples from the source domain, and the target domain class prototype is further fused based on a weighted estimate of the target domain samples with high predicted probabilities in each class to obtain a source-target domain hybrid class prototype. Second, based on the similarity between the sample and each class hybrid prototype, candidate traffic samples with high consistency in structure with the corresponding class hybrid prototype are selected from each class. Finally, only target domain traffic samples that simultaneously meet both conditions are retained as reliable target domain traffic samples for the current stage. This mechanism can simultaneously consider the stability of classification and the consistency of feature structure, thereby effectively reducing the interference of noise and pseudo-labels on cross-domain IoT intrusion detection training. After this double constraint, the target domain samples entering the training phase typically have higher purity and are more suitable for continuous model optimization.

[0045] Specifically: (1) Use the predicted probability output by the first-stage model classifier to perform high-confidence screening of the target domain samples within the class.

[0046] For target domain samples The probability of the model predicting its class is denoted as ,in Indicates sample The predicted probability of belonging to class c. Further, define the sample... The pseudo-tags are Then the first The set of candidate samples for the target domain corresponding to a class can be represented as: Within each category, based on the predicted probability of that sample for the corresponding category. Sort in descending order and select the top... These samples constitute the high-confidence candidate set for this category. : in, Indicates sample In the set In, according to the predicted probability Rankings in descending order; Indicates the first The number of categories to filter is adaptive.

[0047] (2) To enhance the stability of the category representation and the adaptability of the target domain, a source domain-target domain hybrid prototype is further constructed and used to perform secondary screening of the target domain samples.

[0048] For the A class defines its corresponding set of source domain samples: No. The source domain prototype of a class is represented as in, Represents source domain samples The characteristics are represented.

[0049] While using source domain prototypes alone can provide relatively stable category semantic centers, it is insufficient to fully reflect the current distribution structure of the target domain. Therefore, target domain category prototypes are estimated based on high-confidence target samples, and for each class of target samples, the top-ranked predicted probabilities are selected. The target samples constitute a reliable subset And obtain the target domain prototype through weighted aggregation, the first The target domain prototype of the class is: in, Represents target domain samples The characteristics are represented.

[0050] Based on this, this embodiment performs linear fusion of the source domain prototype and the target domain prototype to construct the first... The mixed prototype of a class is: in, The mixing coefficient is used to balance the semantic information of the source domain category with the current distribution structure of the target domain.

[0051] Then, for each target sample feature Perform calculations and prototypes of each category The cosine similarity between them is used to select the class closest to the corresponding class prototype from each category. The target samples constitute the candidate set obtained by screening based on class prototype consistency: in, This represents the ranking of the sample features after sorting them in descending order of cosine similarity to the prototypes of each category.

[0052] Unlike the aforementioned screening based on classifier confidence, this stage starts from the feature geometry and explicitly constrains the consistency between the target sample and the semantic center of the category. Even if some samples have high confidence in the classifier output, they will still be filtered out at this stage if their feature representation deviates significantly from the corresponding category prototype. Therefore, prototype consistency screening can effectively complement classifier confidence screening, further improving the reliability and category purity of pseudo-labeled samples.

[0053] Finally, the candidate set obtained based on classifier confidence can be processed. Candidate set obtained by class prototype consistency screening Taking the intersection yields the pseudo-label sample set. : Step S105: Optimize the initial detection model based on the pseudo-label sample set.

[0054] In this embodiment, after obtaining a reliable pseudo-label sample set through dual-constraint screening, the pseudo-label sample set, source domain traffic data with real category annotations, and the remaining unlabeled target domain traffic data that did not participate in the pseudo-label screening are fused together to form a new expanded training set. The expanded training set retains traffic samples from the source domain with accurate supervision information and adds highly reliable target domain pseudo-label samples, enriching the supervised training data for the target network.

[0055] Then, using the new training set as input, the training logic of graph structure feature extraction, classification loss calculation, and fusion of global and local multi-granularity domain adversarial loss is reused. The entire network parameters of the graph attention network, classifier, global discriminator, and local discriminator in the initial detection model are continuously updated through backpropagation. After multiple rounds of iteration and convergence, the model optimization is completed, and the optimized detection model is obtained.

[0056] Step S106: Based on the optimized detection model, classify the target network for intrusion detection.

[0057] After the model completes parameter iteration optimization, all network parameters of the optimized detection model are fixed, and the adversarial training branches corresponding to the global and local discriminators are closed. Only the main process of K-nearest neighbor graph construction, graph attention network feature extraction and classifier inference is retained. Real-time traffic data generated by the target network is collected as inference input, and the classification result corresponding to each traffic sample is output to distinguish normal network traffic from various attack traffic, thereby realizing intrusion detection and classification of the target network.

[0058] Compared with the prior art, the beneficial effects of the embodiments of the present invention include: (1) Existing methods usually treat traffic samples as independent input objects and lack modeling of local correlation between samples. This embodiment explicitly describes the local neighborhood relationship between traffic samples through graph structure modeling, thereby obtaining traffic feature representation that integrates neighborhood context information and improving the discriminativeness and robustness of feature representation.

[0059] (2) Existing methods usually only focus on single-level distribution alignment or use fixed weights to jointly optimize the differences between different distributions, which is difficult to adapt to the dynamic changes of inter-domain differences during training. In this embodiment, edge distribution alignment is performed by a global domain discriminator and conditional distribution alignment is performed by a local domain discriminator. The weights of the two are adaptively adjusted by a dynamic balance factor, thereby enhancing the model's adaptability to different types of domain shifts in complex cross-domain scenarios.

[0060] (3) This embodiment adopts a dual-constraint pseudo-label screening mechanism to screen target domain samples from two aspects: classifier prediction confidence and class prototype consistency. This can reduce the probability of high-confidence error samples being included in the training process, weaken the impact of pseudo-label noise accumulation on model training, and thus improve the stability and generalization ability of target domain intrusion detection.

[0061] (4) In this embodiment, well-annotated reference network intrusion detection data is used as source domain data, and poorly annotated target network intrusion detection data is used as target domain data. Cross-domain knowledge transfer improves the intrusion detection performance of the model in the target network scenario.

[0062] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0063] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of the present invention. For example... Figure 3 As shown, the electronic device 3 in this embodiment includes a processor 30 and a memory 31. The memory 31 stores a computer program 32. When the processor 30 executes the computer program 32, it implements the steps in the various method embodiments described above.

[0064] For example, computer program 32 may be divided into one or more modules / units, which are stored in memory 31 and executed by processor 30 to complete the present invention. The one or more modules / units may be a series of computer program instruction segments capable of performing a specific function, which describe the execution process of computer program 32 in electronic device 3.

[0065] Electronic device 3 may include, but is not limited to, processor 30 and memory 31. Those skilled in the art will understand that... Figure 3 This is merely an example of electronic device 3 and does not constitute a limitation on electronic device 3. It may include more or fewer components than shown, or combine certain components, or different components. For example, electronic device 3 may also include input / output devices, network access devices, buses, etc.

[0066] For the sake of simplicity and clarity, only the above-described functional modules / units are used as examples. In practical applications, the functions described above can be assigned to different functional modules / units as needed. These modules / units can be implemented in hardware, software, or a combination of both.

[0067] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not detailed or described in a particular embodiment can be referred to in the relevant descriptions of other embodiments. Unless otherwise specified or in conflict with logic, the terminology and / or descriptions between different embodiments are consistent and can be referenced interchangeably. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0068] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A network intrusion detection method, characterized in that, include: Obtain source domain traffic data of the preset reference network and target domain traffic data of the target network; Using traffic samples from the source domain traffic data and the target domain traffic data as graph nodes, K-nearest neighbor graphs for the source domain and the target domain are constructed respectively, and source domain traffic features and target domain traffic features are extracted respectively through a graph attention network. Based on the source domain traffic features and the target domain traffic features, the joint loss is calculated using a classifier and at least two adversarial discriminators of different granularities, and the initial detection model is obtained through iterative training. Based on the classification confidence and category prototype consistency of the initial detection model, the target domain traffic data is filtered to obtain a pseudo-label sample set; The initial detection model is optimized based on the pseudo-label sample set; Based on the optimized detection model, the target network is classified for intrusion detection.

2. The network intrusion detection method as described in claim 1, characterized in that, The at least two adversarial discriminators with different granularities include: a global discriminator and a local discriminator; The step of calculating the joint loss based on the source domain traffic features and the target domain traffic features, using a classifier and at least two adversarial discriminators of different granularities, includes: The source domain traffic features and the target domain traffic features are input into the classifier for classification, and the classification loss is obtained. The global discriminator loss is calculated using the global discriminator, the local discriminator loss is calculated using the local discriminator, and the joint loss is determined based on the classification loss, the global discriminator loss, and the local discriminator loss.

3. The network intrusion detection method as described in claim 2, characterized in that, The step of determining the joint loss based on the classification loss, the global domain discriminator loss, and the local domain discriminator loss includes: At each iteration, the global A-distance is calculated based on the global discriminator loss, the local A-distance for each class is calculated based on the local discriminator loss, and the dynamic weights of the global discriminator and the local discriminator are determined based on the global A-distance and the local A-distance. Based on the dynamic weights, the global domain discriminator loss and the local domain discriminator loss are weighted and fused to obtain the dynamic domain adversarial loss; The joint loss is determined based on the classification loss and the dynamic domain adversarial loss.

4. The network intrusion detection method as described in claim 3, characterized in that, The step of determining the dynamic weights of the global domain discriminator and the local domain discriminator based on the global A-distance and the local A-distance includes: Determine the dynamic weights of the local discriminator ; The dynamic weights of the global domain discriminator are determined to be 1- ; in, For the global A-distance, For the first c The local A-distance corresponding to the class, This represents the total number of categories.

5. The network intrusion detection method as described in claim 3, characterized in that, The determination of the joint loss based on the classification loss and the dynamic domain adversarial loss includes: according to Determine the joint loss; wherein, For the classification loss, For the dynamic domain adversarial loss, The preset weighting coefficients for the domain alignment items.

6. The network intrusion detection method according to any one of claims 1-5, characterized in that, The step involves filtering the target domain traffic data based on the classification confidence and category prototype consistency of the initial detection model to obtain a pseudo-label sample set, including: The target domain traffic data is classified and predicted based on the initial detection model. For each class, based on the predicted probability that the target domain traffic sample belongs to that class, a first preset proportion of traffic samples are selected from high to low to obtain the high confidence candidate set corresponding to that class. Construct source-target domain hybrid prototypes for various types. Based on the similarity between the characteristics of each traffic sample in the target domain and the source-target domain hybrid prototype of each type, select a second preset proportion of traffic samples in each type from high to low to obtain a high consistency candidate set for each type. Based on the high-confidence candidate set and the high-consistency candidate set, a pseudo-label sample set is determined.

7. The network intrusion detection method as described in claim 6, characterized in that, The construction of various source-target domain hybrid prototypes includes: Based on the true classification labels of the source domain traffic samples, determine the average value of all sample features under each class to obtain the source domain prototype corresponding to each class; According to the order of prediction probability from high to low, each category extracts a third preset proportion of traffic samples from the target domain, and the sample features are weighted and aggregated according to the corresponding prediction probability to obtain the target domain prototype for each category. Based on a preset mixing coefficient, the source domain prototype and the target domain prototype corresponding to each class are linearly fused to obtain the source domain-target domain hybrid prototype for each class.

8. The network intrusion detection method according to any one of claims 1-5, characterized in that, The optimization of the initial detection model based on the pseudo-label sample set includes: The pseudo-label sample set is merged with the source domain traffic data and the target domain traffic data to form a new training set; Based on the new training set, the model parameters of the initial detection model are iteratively trained and optimized to obtain the optimized detection model.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 8.

Images