434 results about "Network intrusion detection" patented technology

The invention discloses an intrusion detection method and device based on a graph neural network and a medium, and relates to the field of computer networks, and the method comprises the steps: constructing a graph structure according to network flow data in a current time window; the graph structure comprises a node set, an edge set, a node feature matrix, an edge feature matrix and an adjacent matrix; the adjacent matrix is used for representing a communication state between the nodes; inputting the graph structure corresponding to the current time window into a network node traffic type identification model to obtain the traffic type of each node; the network node traffic type identification model is obtained by training a preset graph neural network by adopting a training sample set; in a preset graph neural network, for an input graph structure, a Bi-LSTM layer is adopted to extract time feature information, and a graph convolution layer and a graph attention mechanism are combined to extract space feature information in a time dimension, so that a traffic type of each node is obtained. According to the invention, more accurate network intrusion detection is realized.

The invention relates to the technical field of Internet, and discloses a network anomaly detection method and system based on multi-modal fusion. The method comprises the following steps: extracting data features of multi-modal information by using multi-head attention; introducing a label to form a weight for expressing the influence degree of the network intrusion detection, and carrying out feature fusion on the data features according to the weight; and inputting the fused features into a classifier to realize network anomaly detection. Through fusion of multi-modal data, the advantages of information complementation and information mutual verification are realized; a multi-attention mechanism is adopted to realize fusion of multi-modal features such as a network flow level, a process level and an alarm event level, association rules existing among different data sources are mined, multi-source heterogeneous information sharing is realized, and the influence of noise such as network flow abruptness and randomness on network anomaly is reduced.

The invention discloses an interpretable fine-grained industrial control network intrusion detection method, which comprises a model structure part and a data processing part, and is characterized in that the model structure part comprises a byte-level interpretable module, a packet-level feature extraction module, a flow-level time sequence analysis module and a result output module; the data processing part comprises a byte-level network model, a packet-level network model, a flow-level network model and a data processing process, and the data processing process comprises data preprocessing, feature extraction and final intrusion detection decision making. Compared with the prior art, the deep learning-based intrusion detection system model has the advantages that the deep learning-based intrusion detection system model is provided and is used for detecting advanced attacks in an ICS network. Through byte, data packet and flow level feature extraction and fusion, the accuracy, interpretability and efficiency of intrusion detection are improved, and the method has significant advantages especially in a complex attack scene.

The invention relates to the technical field of network security, in particular to a network intrusion detection method and system based on behavior analysis, and the method comprises the steps: collecting real-time data of a target network, the real-time data comprising network flow data, user access logs, equipment state parameters, inter-user interaction logs and trust relationship data; performing space-time correlation analysis on the real-time data to generate a dynamic behavior graph; performing anomaly detection on the dynamic behavior map to generate an abnormal node list; and executing attack blocking based on the abnormal node list. According to the invention, the recognition and defense capabilities of abnormal behaviors are effectively improved.

The invention discloses a network intrusion detection method and system based on edge attention learning, and a storage medium, and the method comprises the steps: converting an original network flow into a network flow diagram, and constructing a training diagram and a test diagram under the condition that a coarse-grained label and a fine-grained label are reserved; edge embedding representation is obtained through edge feature reservation, adaptive weight distribution and multi-layer feature extraction of the training graph and the test graph; based on the edge embedding representation, performing coarse-grained detection to identify a basic attack category, and performing fine-grained classification by using multi-scale feature fusion related to global graph attributes; and adversarial training: through initializing adversarial disturbance and optimizing disturbance based on loss function gradient iteration, superposing final disturbance into the training graph, and based on loss function back propagation updating, obtaining a trained network intrusion detection model. The method provided by the invention can effectively capture the depth characteristics of the key attack and maintain the stable detection performance in the confrontation environment.

The invention provides a network intrusion detection and defense system based on artificial intelligence, which belongs to the technical field of network security and comprises a three-dimensional behavior map modeling module, a multi-modal adversarial training module and an edge collaborative defense module. Wherein the three-dimensional behavior graph modeling module is used for constructing a dynamic interaction relation graph of a network entity (user / equipment / service) through a space-time fused graph convolutional network (SF-GCN) and calculating an adaptive behavior entropy value Hnet. According to the network intrusion detection and defense system based on artificial intelligence provided by the invention, the comprehensive detection rate is greatly improved, the false alarm rate is greatly reduced, and the missing report rate is greatly reduced; the end-to-end delay is effectively reduced, and the strategy generation speed is greatly increased; the model size is obviously reduced, the reasoning delay is obviously shortened, and the resource consumption is obviously reduced; dynamic defense strategies of finance, Internet of Things and other scenes are supported, and the blocking success rate is greatly improved; the protocol compliance is obviously improved, and the federal learning data leakage risk is greatly reduced.

The invention provides a network intrusion detection method based on pre-training language model federal segmentation learning, aiming at dual requirements of privacy protection and attack recognition in a network intrusion detection system. For the challenges of difficult traffic feature extraction, limited edge device computing power, data privacy barriers among distributed nodes and the like in attack detection, the method fuses the privacy protection mechanism of federated learning and the computing unloading advantages of segmentation learning, and constructs a pre-training language model learning architecture oriented to traffic feature analysis. According to the method, a pre-training language model is decoupled into an edge side lightweight module and a cloud deep reasoning module through a hierarchical segmentation strategy, and balance optimization of global model stability and local personalization is realized through federal aggregation based on a multi-head attention mechanism. An adversarial enhancement mechanism is introduced to the edge side, the feature extraction ability of a pre-training language model is combined with the dynamic game of a generative adversarial network, and the generalization ability of the model to complex network attacks is improved through adversarial sample reconstruction.

The invention discloses a network intrusion detection method and device for a gating multilayer perceptron based on spatio-temporal feature fusion, and the method comprises the steps: carrying out the preprocessing of the network flow of an Internet of Things system, capturing the time features of network behaviors through a bidirectional LSTM network through designing a new spatio-temporal feature extraction and learning method, and carrying out the detection of the network intrusion of the gating multilayer perceptron. And capturing a network behavior spatial relationship through a full connection layer network with a gating unit, and finally obtaining a space-time fusion feature association relationship through a gMLP network of a feature fusion module. And finally, based on a classification sub-network of a full connection layer, accurately classifying network attack behaviors according to the space-time fusion feature vector. The gMLP is used for mining the space-time relation between network behaviors, so that the network intrusion detection capability is improved. A simple full connection layer is adopted as a classifier, so that malicious behaviors can be effectively detected according to the spatial-temporal correlation of the acquired data.

The invention relates to a lightweight network intrusion detection method fusing multiple tasks and transfer learning. The method comprises the following steps: acquiring to-be-detected traffic data; the to-be-detected traffic data are input into a multi-task intrusion detection model, whether the to-be-detected traffic is abnormal or not is judged, abnormal traffic is classified, performance indexes of network traffic are predicted, and the multi-task intrusion detection model is constructed based on a pre-trained lightweight deep learning model and is obtained through training of a training set. The training set comprises two-dimensional image data marked as normal traffic or abnormal traffic, attack categories and continuous values. According to the method, collaborative optimization of tasks such as anomaly detection, attack classification and performance prediction is realized, the overall performance of detection is remarkably improved, and meanwhile, efficient and accurate network traffic analysis can still be realized under the condition of limited data by utilizing the pre-trained lightweight deep learning model in transfer learning.

The invention discloses a network intrusion detection method and system based on dynamic graph attention and comparative learning. Network traffic is constructed into a dynamic heterogeneous graph (nodes are IPs / ports, and sides are traffic sessions), and dynamic feature fusion is carried out by adopting time window division and a GATv2 network. An optimal transmission contrast learning strategy is innovatively introduced, feature and structure distribution alignment is realized through a Wasserstein distance and a Gaussian Wasserstein distance, and the generalization ability of the model to unknown attacks is improved. And finally, combining node embedding and an alignment matrix, and utilizing an MLP classifier to predict an edge anomaly probability. Experiments show that the accuracy and F1-score of the method on multiple data sets are improved by 5.2%-10.5% compared with those of a baseline, the detection performance under complex attacks is remarkably enhanced, and the method is suitable for real-time scenes such as the Internet of Things. The system can be deployed on edge equipment and has high practical value.

The invention discloses a network intrusion detection method and system based on recursive gating convolution, and relates to the technical field of data processing. The method comprises the steps of obtaining to-be-predicted traffic data; obtaining a network intrusion detection model; training the network intrusion detection model, wherein the training comprises the steps of dividing traffic slices for the preprocessed training data according to a fixed time window; calculating a fusion feature value of each time window and the spatial dimension; generating a spatial-temporal characteristic matrix; splicing the spatial-temporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; training the teacher model and training the student model; and inputting the to-be-predicted traffic data into a trained network intrusion detection model to obtain a prediction result. Through time window division and time-space fusion, the diversity of data is artificially expanded, so that the model contacts richer scenes in training, and the dependence on specific sample distribution is reduced.

The invention relates to the technical field of artificial intelligence, and provides a quantum-enhanced multi-scale network intrusion detection method, which comprises the following steps: calculating a covariance matrix for an original traffic feature matrix, and obtaining a feature value and a feature vector through feature decomposition, mapping each sample xi to a quantum Hilbert space to generate an enhanced feature matrix, executing complex field transformation on the enhanced feature matrix to generate an entangled feature tensor, and realizing dynamic feature enhancement through a multi-head attention mechanism based on a quantum probability amplitude; performing space-time attention calculation and gating fusion on the feature tensor after dynamic feature enhancement to obtain a space-time fusion feature; converting the space-time fusion features into a time sequence form, extracting behavior features through a multi-scale convolution branch, and fusing the behavior features to obtain a three-dimensional feature tensor; and calculating a mean value of the three-dimensional feature tensor in a sequence dimension, generating a two-dimensional feature matrix, and performing classification prediction, uncertainty quantification and threat grading evaluation based on a classification network, an uncertainty network and a threat grading network.

A system including a vehicle, a controller, and an intrusion response component. The vehicle has a plurality of network zones, each network zone including a plurality of end points. The controller includes: a network monitoring component configured to interpret network communications associated with at least one of the network zones; and a network intrusion detection component configured to detect an intrusion event in response to the network communications. The intrusion response component is configured to perform an intrusion response operation in response to the detected intrusion event.

The invention discloses a network intrusion detection method based on multi-task deep learning, and the method comprises the steps: obtaining an intrusion detection data set, carrying out the mapping and one-hot coding of attack class labels of the intrusion detection data set, and obtaining the features of the intrusion detection data set; preprocessing the intrusion detection data set features to obtain a preprocessed intrusion detection data set; constructing a multi-task learning model based on hard sharing, and inputting the preprocessed intrusion detection data set into the multi-task learning model based on hard sharing for training to obtain a trained multi-task learning model based on hard sharing; and obtaining a target intrusion detection data set, inputting the trained hard sharing-based multi-task learning model for detection, and obtaining a detection result of the intrusion network. According to the method, through knowledge sharing among different tasks, the detection accuracy can be obviously optimized, and various network attacks can be effectively identified and responded.

The invention provides a network intrusion detection method and system, a terminal and a storage medium, and the method comprises the steps: determining a target sampling strategy according to the sample number of preprocessed data, and carrying out the sampling of the preprocessed data according to the target sampling strategy, and obtaining a sampling sample; inputting the sampled sample into a network intrusion detection model for feature extraction, deep information extraction and multi-head attention mechanism calculation to obtain a global feature vector; performing data type prediction according to the global feature vector, and calculating model loss based on a weight balance loss function dynamically adjusted based on the category number; training the network intrusion detection model according to the model loss; and inputting to-be-detected network data into the converged network intrusion detection model for intrusion detection to obtain a network intrusion detection result. According to the embodiment of the invention, the pre-processed data is sampled in a layered sampling mode, so that the phenomenon of unbalanced sample data category is effectively prevented.

The invention discloses a network intrusion detection method based on a self-attention residual generative adversarial network, which belongs to the technical field of network intrusion detection and comprises the following steps: collecting network flow data, and preprocessing the network flow data to obtain real training data; a FARD-WGAN-GP model is constructed and trained, and hybrid pseudo data is generated based on the trained FARD-WGAN-GP model; constructing a time sequence attention detection model; training a time sequence attention detection model based on the real training data and the pseudo data; network intrusion real-time detection is carried out based on the trained time sequence attention detection model; on the basis of the real-time detection result, optimizing the FARD-WGAN-GP model, and on the basis of the optimized FARD-WGAN-GP model, optimizing the time sequence attention detection model; and carrying out network intrusion detection based on the optimized time sequence attention detection model. According to the method, the quality of the generated data is improved, and the detection accuracy is improved.

The invention discloses a federated undersampling learning method for unbalanced network intrusion detection, which comprises a federated learning server and a client, and communication connection is established between the federated learning server and the client; all models for network intrusion detection are configured in the server; the server is used for maintaining a global model and deploying the global model to the client for training and learning, and the client adopts a local data set to train a local model downloaded from the server and uploads the local model after training and learning to the server; the server aggregates the local models uploaded by the client to obtain a global model with updated parameters; and when the client adopts the local data set to train the server, undersampling processing is performed on the local data set to obtain a balanced data set to perform learning training on the client. When federated learning is carried out on an intrusion detection network model, the influence of training data imbalance in a client on the model detection performance is solved through an undersampling method.

The invention relates to the field of network security, in particular to a network intrusion detection method based on machine learning. The invention discloses a network intrusion detection method based on machine learning. The method comprises the following steps: data collection: carrying out network flow capture and data preprocessing; feature extraction: extracting flow features and calculating statistical features; model selection: performing supervised learning or unsupervised learning, and selecting a model; model training and evaluation: carrying out model training and evaluating model performance; real-time detection: performing real-time detection on the trained model, including deploying the model and an alarm system; and continuous learning: carrying out continuous learning on the trained model. According to the method, self-learning can be carried out, the model can be updated regularly by using new flow data, the detection capability and adaptability can be gradually improved, and potential security threats can be effectively identified and prevented.

The invention belongs to the technical field of Internet security, and discloses a multi-modal deep learning-based network intrusion detection method and system, which comprises the steps of carrying out collection and modal attribution on multi-source data from different channels, constructing a time-continuous multi-track dynamic sensing track set, integrating a modal attention distribution mechanism, and carrying out multi-modal deep learning. According to the modal energy sensing complexes of each type of modals under different sensing orbits, dynamically distributing modal parameters, and outputting an initial index tensor after multi-orbit modal fusion; receiving an initial index tensor, and establishing a cross-modal dependency relationship by constructing a bidirectional response tensor between a modal and an orbit; constructing a semantic trigger matrix based on semantic tags in a cross-modal dependency relationship, adopting a cross-modal residual connection mechanism, retaining low-order modal coupling features through a parallel residual path, and outputting modal linkage nodes; according to the invention, the identification capability of detection on complex intrusion behaviors is improved, and more comprehensive and accurate detection on complex network attack behaviors is realized.

The invention discloses a knowledge data joint-driven vehicle-mounted CAN network intrusion detection method, which comprises the following steps of: firstly, carrying out standardization processing on original CAN message data, and extracting structural characteristics of the original CAN message data; through a data preprocessing module, original data is converted into an input format suitable for neural network processing, and is prepared together with a knowledge set for subsequent analysis. The processed data and knowledge set are then input to a spatio-temporal attention module based on sparse attention. In the module, a time sequence attention layer extracts possible time sequence characteristics of attacks by capturing time correlation of CAN messages; and the spatial attention layer analyzes the spatial characteristics of the message and identifies data tampering or other abnormal modes. And after being processed by the space-time attention module, the high-order hidden features extracted by the network are transmitted to the output layer, and a final intrusion detection result is displayed through the full connection layer. And if an abnormal or attack behavior is detected, the system gives an alarm to the user in time.

The invention provides an industrial internet network intrusion detection method based on a pre-trained large language model, and the method comprises the steps: carrying out the data preprocessing of original network flow data through protocol self-adaptive flow aggregation and session segmentation, feature screening and feature coding; constructing a stream format text data set used for training a generation model GPT-2 and a packet level classification text-label data set used for training a classification model DistilBERT; then fine tuning training is carried out on the generation model GPT-2 and the classification model DistilBERT; then calling a trained generation model GPT-2 to generate a traffic sequence, obtaining a prediction data packet, calling a trained classification model DistilBERT, performing anomaly judgment on sequence data in the prediction data packet one by one, and outputting a classification result of anomaly judgment; the active intrusion detection of first generation and then discrimination is realized. According to the method, prediction can be made before real attack traffic arrives, and network attacks are prevented.

The invention belongs to the technical field of network security, and discloses a network intrusion detection method and device based on ensemble learning, and the method comprises the steps: obtaining real-time network flow data; performing data preprocessing on the real-time network flow data to obtain to-be-measured flow; predicting the traffic to be measured by using different pre-trained machine learning models to obtain prediction results of multiple machine learning models; according to the voting weight, integrating prediction results of the multiple machine learning models by using a weighted voting mechanism, and outputting a network intrusion detection result for obtaining real-time network flow data; wherein the voting weight is dynamically optimized through a particle swarm algorithm; according to the invention, the prediction results of multiple machine learning models are integrated and summarized by using a weighted voting mechanism according to the voting weight, the advantages of different machine learning models are fully utilized, the final intrusion detection result is ensured to reflect the comprehensive knowledge of multiple machine learning models, and the accuracy and efficiency of the overall detection are improved.

The invention belongs to the technical field of vehicle networking safety, and relates to a lightweight in-vehicle network intrusion detection system and method based on an ADGRU-Net hybrid model, and the system comprises a data loading and cleaning module, a time sequence and feature correlation module, and a space-time hybrid deep learning model. The data loading and cleaning module adopts a block-by-block loading mode to convert multi-source heterogeneous original time sequence data into a standard format; the time sequence and feature association module adopts a sliding window mechanism to intercept a data segment containing L continuous time steps with a preset length from multi-source time sequence data, each time step contains N features, and the data segment is transposed and then converted into a two-dimensional single-channel grayscale image through linear scaling; the space-time hybrid deep learning model comprises a spatial feature extraction module, a remodeling module, a time sequence feature extraction module, a time sequence branch decoder, a spatial branch decoder and a feature fusion module; the problem that an existing model is poor in performance in a complex and changeable real attack scene is solved.

The invention discloses a cloud side-end cooperative multi-scene adaptive network intrusion detection method, and solves the problems of poor scene adaptation, weak dynamic processing, privacy-precision imbalance and the like in the prior art. The method is realized through four steps: 1, multi-scene traffic collection and hierarchical preprocessing, terminal sensing layer optimization frame processing and traffic classification, edge layer screening of high-value traffic, and cloud fragmentation scheduling; 2, multi-scene adaptive feature fusion is carried out, scene exclusive features and general features are extracted, and 50-dimensional feature vectors are generated; 3, a cloud edge-end collaborative detection model and an edge lightweight model are preliminarily screened, a cloud federal fusion model is finely detected, and dynamic weight and differential privacy are combined; 4, dynamic attack response and model iteration are carried out, attacks are responded in a scene mode, and the stability of the model is guaranteed through anti-forgetting optimization. According to the method, multiple scenes are covered, the detection precision is larger than or equal to 98.5%, the edge delay is smaller than or equal to 40 ms, the privacy leakage risk is reduced by 90%, the renaturation is high, and the robustness is high.

The invention discloses an online network intrusion detection method based on deep learning. The method comprises the following steps: acquiring network flow data to be detected; the to-be-detected network flow data is input to a network intrusion detection model, a detection result is obtained, the network intrusion detection model is obtained through training of a training set, the training set is composed of original network data, and the detection result is obtained; the network intrusion detection model comprises a meta-training module, an FAISS index module, a TabPFN inference module, a Cache construction module, a fusion detection module and a continuous maintenance module, rapid response and efficient detection of a dynamic network environment are achieved, and the robustness and the real-time performance of a system in the face of distribution drift are improved.

The invention relates to the technical field of artificial intelligence, and provides a network intrusion detection method based on multidimensional feature collaborative analysis, and the method comprises the steps: calculating the correlation degree eta ij of any two feature columns in an original traffic feature matrix, and when eta ij is greater than eta thr, generating a new feature through Qij = Xi * Xj + (1-eta ij) * (Xi + Xj), outputting a dimension reduction feature matrix to perform nonlinear spatial transformation on the dimension reduction feature matrix X ', dynamically retrieving associated knowledge through a learnable memory library, fusing current input features and memory enhancement features, and outputting refined features; decomposing the refined features to a biological neural oscillation frequency band, applying carrier modulation, and performing feature reconstruction to generate a space-time correlation tensor; the refined features and the space-time correlation tensor are fused, and the intrusion behavior classification probability is output through multi-stage abstract compression and regularization processing; screening difficult samples based on classification confidence to construct a training library, and obtaining a conventional detection model and a special and precise detection model; and preferentially calling the special and precise model during real-time detection, and switching to the conventional model when the confidence coefficient is smaller than a confidence coefficient threshold value.

The invention discloses a network intrusion detection method based on clustering oversampling and Transform, and relates to the technical field of network security and deep learning. The method comprises the following steps: carrying out data cleaning on network flow data, balancing a data set through a clustering oversampling technology, and extracting characteristic values through a method of combining information gain and rapid correlation filtering; normalizing the feature values by adopting a Max-Min normalization method, converting the feature values into images according to timestamps and feature sizes, and marking attack types; amplifying the generated image by adopting a bilinear interpolation method, and dividing the image into a training set and a test set; and fine tuning is carried out on the classification head through transfer learning, deep features of network traffic data are extracted, and accurate classification of normal traffic and various attack traffic is realized. According to the network intrusion detection method based on clustering oversampling and Transform, different types of network attacks can be effectively identified, and the accuracy rate and reliability of intrusion detection are remarkably improved.

The invention relates to the technical field of network security and network simulation, and discloses a malicious traffic remodeling method based on feature serialization. The method comprises the following steps: collecting traffic data of a target network environment, extracting serialization features of a load and a time interval, and further performing statistics to obtain session flow features; according to Pareto distribution, normal distribution, logarithmic normal distribution and Poisson distribution probability distribution models, serialization features conforming to target network flow features are generated, and the probability distribution model with the highest similarity with the target network flow is selected by calculating the Euclidean distance; and finally, on the basis of the model, remodeling the load and time interval sequence of the malicious traffic, and generating the network attack traffic which is difficult to detect. According to the method, the concealment of the malicious traffic is effectively improved, so that the malicious traffic is more difficult to identify by an existing detection system; the generated malicious traffic can effectively test and evaluate the capability of the network intrusion detection system.

The invention relates to a network intrusion detection method based on hierarchical Bloom filtering and a large language model, and belongs to the technical field of network security. The method comprises the following steps: carrying out preliminary rapid screening on input network communication data by using a hierarchical Bloom filter, training a network intrusion detection model, carrying out anomaly detection through a final network intrusion detection model obtained after training, and generating a detailed report of detected anomaly by using a large language model. According to the method, time and computing resources are saved, the overall efficiency of detection is also improved, real-time anomaly detection and response can be realized, the interpretability of a detection result is enhanced through a report generated by a large language model, and the specific condition and possible influence of an abnormal behavior can be understood conveniently.

The invention relates to a network intrusion detection method based on improved WGAN sampling and ensemble learning, and solves the defects that for high-dimensional and class-unbalanced network flow data, a base learner of an integrated model is insufficient in adaptive capacity, noise interference is difficult to restrain, and key attack modes are difficult to mine in the prior art. The method comprises the following steps: acquiring network flow data; performing data enhancement based on a DDWGLO framework; constructing a network intrusion detection model based on Stacking; training a network intrusion detection model; and detecting network intrusion in real time. According to the method, the DDWGLO is adopted for data enhancement, the weight is adaptively allocated based on the Newton-Raphson optimization algorithm improved on the basis of Circle chaotic mapping, and then the accuracy of network intrusion detection is improved.