Time sequence related network intrusion detection method based on attention mechanism

Abstract

The invention provides a time sequence related network intrusion detection method based on an attention mechanism. The method comprises the the steps of training an SSAE network by using an intrusiondetection data set to obtain trained network flow data to be classified, and performing one-hot coding and standardization processing on the network flow data to be classified to obtain preprocessed network flow data; and inputting the preprocessed network flow data into a classifier based on an attention mechanism of the trained laminated sparse auto-encoder SSAE network, and carrying out classification processing on the network flow data to be classified by the classifier to obtain a network intrusion detection result of the network flow data to be classified. According to the method, a double-layer Bi-GRU network structure added with an attention mechanism is designed as a classifier, so that the method has relatively high classification accuracy and relatively low false alarm rate, andmeanwhile, the training and testing time of the model is greatly shortened.

Description

technical field [0001] The invention relates to the technical field of network attack detection, in particular to a timing-related network intrusion detection method based on an attention mechanism. Background technique [0002] With the rapid development of the Internet in recent years, various forms of network attacks emerge in an endless stream. How to effectively detect abnormal behaviors and attack types has become an important topic in the field of network security. NIDS (network intrusion detection system, network intrusion detection system) refers to the combination of hardware and software to detect behaviors that endanger the security of computer systems, such as collecting vulnerability information, resulting in denial of access and access to system control beyond the statutory authority. NIDS mainly includes three functional components: information source, analysis engine and response component. The information source is responsible for collecting various infor...

AI Technical Summary

Problems solved by technology

[0008] The disadvantage of a network intrusion detection scheme using deep learning methods in the above-mentioned prior art is that network intrusion can be regarded as a time-series-related event, and this scheme ignores the influence of the length of data history information on model performance, which is not very good. Balance the detection accuracy and training speed, the accuracy rate is too low, the false positive rate is too high, the training time is too long, and the calculation overhead is too large

Images