Intrusion detection method and device based on deep learning under hyper-fusion architecture

Abstract

The invention provides an intrusion detection method and device based on deep learning under a hyper-converged architecture and a storage medium, and relates to the technical field of intrusion detection.The detection method is applied to a virtualization kernel layer of the hyper-converged architecture and comprises the steps that network traffic entering and exiting a virtual machine is captured, IP/MAC address verification is conducted on the network traffic, then related traffic features are extracted, a deep learning model trained by a CICIDS2017 data set is utilized to analyze feature values, so that low-overhead and high-precision DDoS attack detection under the hyper-fusion architecture is realized. Particularly, in order to reduce redundant information, an improved binary cuckoo algorithm is adopted to select features, and while the detection precision is ensured, the size of a deep learning model is reduced, and the extraction time of network traffic features is shortened.

Description

technical field [0001] The present invention relates to the technical field of intrusion detection, in particular to an intrusion detection method, device and storage medium based on deep learning under a hyper-converged framework. Background technique [0002] Hyper-converged architecture is an emerging cloud computing architecture, with virtualization as the core, pre-integrating computing, storage, network and other resources in a standard server (such as X86 or ARM), forming a standardized hyper-converged unit . At the same time, the virtualization of basic functions such as storage, computing, and network is realized through software definition. Multiple hyper-converged units converge into a data center through the network to form an IT infrastructure, so as to achieve the purpose of rapid deployment and simplified operation and maintenance of IT infrastructure. Compared with the traditional data center architecture, the most fundamental change in the hyper-converged ...

AI Technical Summary

Problems solved by technology

For example, although the Chinese patent "CN 111464510 A" improves the accuracy of detection, the feature dimension is too large and the model cost is relatively large

In addition, traditional intrusion detection modules are mostly deployed in physical hosts, while intrusion detection based on virtualization environment is transparent to the information acquisition of virtual machines, and cannot detect malicious behavior between virtual machines in the virtual environment; , installing the intrusion detection module inside each hyper-converged virtual machine will occupy virtual machine resources and generate a large overhead, and lack of unified management, it is impossible to uniformly upgrade the intrusion module of each hyper-converged virtual machine at the same time, which may cause The protection strength of each virtual machine is different, resulting in security risks

Images