CN115130102A - An online adaptive intrusion detection method based on incremental learning - Google Patents

Abstract

The invention discloses an online self-adaptive intrusion detection method based on incremental learning, which mainly solves the problems that an existing method cannot update an intrusion detection model in real time and is poor in detection effect. The method mainly comprises the following steps: 1) training an intrusion detection classification model to be expanded on a data set of a known type to obtain an initial model; 2) sniffing and processing data in the current network in real time and sending the data into a model for detection; 3) when the model detection result is attack data of unknown species, selecting a part of representative samples of known species to be combined with samples of unknown species to serve as an incremental sample set; 4) updating the initial model on line by using incremental learning, and judging the data flow in the current network in real time to train the model again; 5) and completing real-time intrusion detection by utilizing the online updated model. The invention can effectively improve the accuracy of detecting the intrusion behaviors of the known classes and the unknown classes, and can update the intrusion detection model on line in real time.

Description

An online adaptive intrusion detection method based on incremental learning

technical field

The invention belongs to the technical field of network security, and further relates to an intrusion detection method, in particular to an online adaptive intrusion detection method based on incremental learning, which can be used for real-time detection of attack behaviors in a network and online update of an intrusion detection system.

Background technique

As an intelligent algorithm, deep neural network has fully demonstrated its advantages in complex data analysis and can be well applied in the field of intrusion detection. However, most deep neural networks can only be well trained for known types of network intrusions. , that is, most neural network models are designed for a closed environment. In real life, known classes of cyberattacks do not effectively cover all attack classes. Incremental learning is a class of algorithms that can learn to add new samples, extend and update existing models. It can preserve most of the knowledge learned in known categories, and continuously learn new knowledge from new categories. The main characteristics of incremental learning algorithms include: the ability to learn new knowledge from new samples; the model does not need or only needs part of the original data set during the training process; the model has the ability to memorize old knowledge without catastrophic occurrences The problem of forgetting; the model can adaptively learn new classes that may appear in new samples. Although incremental learning provides ideas for dealing with new categories, the current incremental learning algorithms for intrusion detection still cannot detect network intrusion behaviors online and in real time, resulting in the lack of adaptability, real-time and reliability of intrusion detection technology.

Chinese patent application CN108173708A discloses an abnormal traffic detection method based on deep learning. The method includes acquiring user-end traffic data, using traffic detection and classification to perform abnormal traffic detection, and online training of traffic detection classifiers based on the abnormal data. Three stage. First, use the sniffer to obtain the traffic data of the client to construct a trainable data set; secondly, use the traffic detection classifier pre-built in the abnormality detection device to perform abnormality detection on the traffic data; when abnormal data is detected, based on the Abnormal data, training sample data is obtained, and the traffic detection classifier is trained online by using the sample data. However, the above methods cannot achieve perfect results for training all abnormal sample data, and the problem that the sample data is not processed in the incremental process will affect the model classification accuracy and training efficiency.

In the field of intrusion detection, the intrusion detection model needs to be retrained whether it is because of changes in demand or the emergence of new intrusion behaviors. Training time becomes very important when the model needs to be trained daily. Most of the existing related works only consider intrusion detection in a static environment, rarely consider intrusion detection in a dynamic environment that changes with time, and rarely consider the adaptability of intrusion detection methods, which are mainly reflected in the following three aspects: 1) Model Most of them are offline and cannot detect known types of network intrusion behaviors online and in real time; 2) The existing intrusion detection models cannot detect unknown types of intrusion behaviors. When unknown types appear, the model cannot be dynamically updated adaptively. All need to be retrained; 3) Intrusion detection models based on deep learning will generate a lot of time overhead, resulting in low model efficiency. The increase of network complexity and the emergence of a large number of high-dimensional network data also make the detection accuracy of traditional machine learning-based intrusion detection models low; 4) Theoretical research is rarely applied in real scenarios, and lacks consideration of real scenarios in many aspects .

Therefore, the prior art requires a method for improving the classification accuracy of known categories and unknown categories to deal with and solve the identification problem, and an incremental learning method specifically for the field of intrusion detection is required to improve the efficiency of incremental learning and classification .

SUMMARY OF THE INVENTION

The purpose of the present invention is to propose an online adaptive intrusion detection method based on incremental learning, which can effectively improve the accuracy of intrusion behavior detection of known and unknown categories, and can be used online The intrusion detection model is updated in real time; the algorithm classification efficiency is further improved on the basis of the existing incremental learning, so as to ensure the real-time, scalability, adaptability and robustness of the intrusion detection method, which is the basis for the subsequent intrusion detection based on incremental learning. The detection algorithm research and engineering application provide new ideas.

The basic idea of realizing the present invention is as follows: firstly, an initial model is obtained by training the to-be-expanded intrusion detection classification model on a known type of data set; When the result is an unknown type of attack data, some representative samples of known types are selected to be combined with unknown types of samples as an incremental sample set, and incremental learning is used to update the model online, and at the same time judge the current data traffic in the network in real time. When the data flow is less than the threshold, the model to be expanded is retrained with all the data.

The present invention realizes above-mentioned purpose concrete steps are as follows:

(1) Obtain the dataset and preprocess:

Obtain the public intrusion detection data set from the network as the initial known category sample set, extract the features and labels of each data record, remove some invalid data, classify the remaining data records according to the labels, and perform one-hot encoding on the character features , make a binary file sample set containing data, labels, and lists, and divide the data in the file sample set into two parts, the initial known category training set D _old and the verification set D _valid ;

D _old ={X ¹ ,X ² ,...,X ⁿ },

D _valid ={T ¹ ,T ² ,...,T ⁿ },

Among them, n is the number of classes of the initial known class samples, X ⁿ , T ⁿ represent all the nth class initial known class training samples and verification samples, respectively;

(2) Build the classification network model to be expanded:

Using a spatiotemporal network structure, a one-dimensional convolutional neural network and a long short-term memory neural network are concatenated together as the network structure. The classification network model to be expanded composed of the second one-dimensional convolutional neural network layer conv1d_2, the second maximum pooling layer max_pooling_2, the long short-term memory neural network layer lstm, the temporary dropout layer dropout and the first fully connected layer dense_1 is 18*1 The one-dimensional matrix of is as input, and the output represents a 1*1 matrix of sample type prediction scores;

(3) Use the initial known class sample training set D _old and the cross entropy loss function L _c to train the classification network model to be expanded, and obtain an intrusion detection model that can detect known classes, and use the initial known class validation set D _valid to detect intrusion During the training process of the detection model, the state and convergence of the model are checked, and the hyperparameters are adjusted according to the test results to optimize the training effect, and the trained intrusion detection model is obtained.

(4) Utilize the real-time extraction module Realtime of the flow characteristic extraction tool CICFlowMeter to capture the data records in the network in real time, remove some invalid data records, and analyze the valid data records to obtain 50-80 data characteristics and save them;

(5) feature extraction is performed on the data features obtained in step (4), and an online intrusion detection sample set D _online is obtained according to the extracted feature combination;

(6) Real-time intrusion detection:

中进行预测，根据模型预测结果判断在线入侵检测样本集D_online中每一个样本的类型，具体如下：Put the online intrusion sample set D _online into the intrusion detection model trained in step (3)

According to the prediction results of the model, the type of each sample in the online intrusion detection sample set D _online is judged, as follows:

If the sample is classified as a normal sample, continue to perform real-time intrusion detection on other samples in the sample set D _online ;

If the sample is classified as a sample of a known abnormal category, the sample will be fed back to the administrator for further analysis, and at the same time, real-time intrusion detection will continue to be performed on other samples in the sample set D _online ;

If the sample is classified as a sample of an unknown category, perform manual judgment to determine whether the sample is available; if it is determined to be unavailable, continue to perform real-time intrusion detection on other samples in the sample set D _online ; if it is determined to be available, execute step ( 7);

(7) According to the information recorded by the available sample data, manually label the unknown category samples, and construct the unknown category sample set D _unknown :

D _unknown ={X ¹ ,X ² ,...,X ^m },

where m is the number of categories of samples of unknown category, and X ^m is the set of all unknown samples with sample category m.

(8) Select representative samples from the initial known class sample set to construct a known class sample set D _known :

D _known = {D _t , D _f , D _r },

where D _t is the data sample set that is correctly classified on the classification model to be extended and has a high score in the top 1%, D _f is the entire data sample set that is incorrectly classified on the classification model to be extended, and D _r is randomly selected 1% remaining known Data sample set of class samples;

(9) Construct an incremental sample set D _new for subsequent online updating of the model:

D _new ={D _known ,D _unknown }

={D _t ,D _f ,D _r ,D _unknown },

={X ¹ ,X ² ,...,X ⁿ ,X ⁿ⁺¹ ,X ⁿ⁺² ,... X ^n+m }

Among them, n and m represent the number of classes of known class samples and unknown class samples, respectively;

X ^n+m ={(x _j ,y _j ),1≤j≤M,y _j ∈[1,2,...,m]},

分别为已知类别样本的样本特征和样本标签，N为已知类别样本集的样本数量，x_i、y_i分别为未知类别样本的样本特征和样本标签，M为未知类别样本集的样本数量；in,

are the sample features and sample labels of the known class samples, respectively, N is the number of samples in the known class sample set, x _i and y _i are the sample features and sample labels of the unknown class samples, respectively, and M is the sample number of the unknown class sample set ;

(10) Build an extended classification network model:

Build an extended classification network model consisting of a one-dimensional separation convolutional neural network layer separable_conv1d, the first maximum pooling layer max_pooling_1, the transition layer flatten, the second fully connected layer dense_2, the temporary dropout layer dropout and the first fully connected layer dense_1. Input a 18*1 one-dimensional matrix to it, and get a 1*1 matrix representing the prediction score of the sample type;

并用该在线更新后入侵检测模型

替换步骤(6)中的入侵检测模型

完成实时入侵检测。(11) Use the incremental sample set D _new and the loss function L to train the extended classification network model to obtain an online updated intrusion detection model that can detect known and unknown categories

And use the online updated intrusion detection model

Replace the intrusion detection model in step (6)

Complete real-time intrusion detection.

Compared with the prior art, the present invention has the following advantages:

First, the present invention utilizes incremental learning to enable the intrusion detection system to detect known and unknown intrusion behaviors in a dynamic environment that changes over time, greatly reducing the time for model updating and making the model adaptive; Using the incremental learning algorithm, the model can be equipped with the ability to detect unknown types of attacks without retraining the model, thus realizing the real-time and high efficiency of intrusion detection.

Second, the present invention uses different deep neural networks to treat the extended classification model and the extended classification model; uses a one-dimensional separation convolutional neural network with fewer parameters as the extended classification model, and adopts a combination of a convolutional neural network and a long short-term memory neural network. As the classification model to be extended, the model of 2000 significantly reduces the training time, thereby reducing the training cost, making the model more efficient, and improving the detection rate of the model.

Third, the model constructed by the present invention can be deployed in a real network environment, and can be detected and updated online, and can also be retrained when the network is idle. Each step can be independently applied to the real network, including but not limited to In the stages of data collection, feature extraction, intrusion detection, and model update; the design makes use of all data to retrain the model when the current network traffic is less than the threshold, which can effectively deal with the possible catastrophic forgetting problem of the model when the model is continuously updated, while avoiding the problem of catastrophic forgetting in the model. The increased cost of updating the model when the network is heavily used.

Description of drawings

Fig. 1 is the realization flow chart of the present invention;

Fig. 2 is the parameter setting schematic diagram of the classification model to be expanded according to the present invention;

FIG. 3 is a schematic diagram of parameter setting of the extended classification model of the present invention.

Detailed ways

The present invention will be further described below with reference to the accompanying drawings.

Embodiment 1: Referring to FIG. 1, an online adaptive intrusion detection method based on incremental learning proposed by the present invention specifically includes the following steps:

Step 1. Get the dataset and preprocess:

Obtain the public intrusion detection data set from the network as the initial known category sample set, extract the features and labels of each data record, remove some invalid data, classify the remaining data records according to the labels, and perform one-hot encoding on the character features , make a binary file sample set containing data, labels, and lists, and divide the data in the file sample set into two parts, the initial known category training set D _old and the verification set D _valid ;

D _old ={X ¹ ,X ² ,...,X ⁿ },

D _valid ={T ¹ ,T ² ,...,T ⁿ },

Among them, n is the number of classes of the initial known class samples, and X ⁿ and T ⁿ represent all the nth class initial known class training samples and verification samples, respectively.

Step 2. Build the classification network model to be expanded:

Using a spatiotemporal network structure, a one-dimensional convolutional neural network and a long short-term memory neural network are concatenated together as the network structure. The classification network model to be expanded composed of the second one-dimensional convolutional neural network layer conv1d_2, the second maximum pooling layer max_pooling_2, the long short-term memory neural network layer lstm, the temporary dropout layer dropout and the first fully connected layer dense_1 is 18*1 The one-dimensional matrix of is as input, and the output represents a 1*1 matrix of sample type prediction scores;

All one-dimensional convolutional neural network layers use the same padding method, the activation function uses the linear rectification activation function Relu function, the maximum pooling layer pooling size is set to 2, and the long short-term memory neural network layer contains 128 hidden layer, the parameter of the ephemeral layer is 0.1, and the activation function of the fully connected layer adopts the sigmoid function of the sigmoid growth curve activation function.

Step 3. Use the initial known class sample training set D _old and the cross-entropy loss function L _c to train the classification network model to be expanded to obtain an intrusion detection model that can detect known classes, and at the same time use the initial known class validation set D _valid for intrusion detection. During the training process of the detection model, the state and convergence of the model are checked, and the hyperparameters are adjusted according to the test results to optimize the training effect, and the trained intrusion detection model is obtained.

还可以通过如下方式进行训练得到：The intrusion detection model

It can also be obtained by training in the following ways:

(a) Dynamically calculate the data traffic threshold Θ:

Among them, A is the sum of the data traffic from 4:00 am to 6:00 am every day in the 7 days before the current moment;

(b) Compare the received data flow τ of the data records in the network captured every hour in step (4) with the threshold Θ size in real time, when τ < Θ, set all samples as known type samples, and construct step (1) The initial known sample category sample training set D _old in , and use the sample set and the cross entropy loss function L _c to train the classification network model to be expanded, and obtain a trained intrusion detection model that can detect known categories

The cross-entropy loss function L _c is defined as:

分别表示已知样本经过模型得到的预测类型和真实类型。where y and

Represent the predicted type and the real type obtained by the known sample through the model, respectively.

Step 4. Utilize the real-time extraction module Realtime of the flow feature extraction tool CICFlowMeter to capture the data records in the network in real time, remove some invalid data records, and analyze the valid data records to obtain 50-80 data features and save them;

Step 5. Perform feature extraction on the data features obtained in step 4, and obtain an online intrusion detection sample set D _online according to the extracted feature combination. The feature extraction method includes: Pearson correlation coefficient feature extraction method, principal component analysis method, and the like. The present embodiment adopts the Pearson correlation coefficient feature extraction method, and the implementation steps are as follows:

(5.1) Perform one-hot encoding on character features, then calculate the Pearson correlation coefficient r between each feature and other features, and set the coefficient judgment threshold; the Pearson correlation coefficient r here is calculated according to the following formula:

为全部样本第i个特征值的均值，

为全部样本其它特征值的均值。Among them, i∈[1,fnum] is the serial number of the eigenvalue of the sample, fnum is the number of features of the sample set, x _i is the ith eigenvalue of the current sample, y _i is the other eigenvalues of the current sample,

is the mean of the i-th eigenvalue of all samples,

is the mean of other eigenvalues of all samples.

(5.2) sort the correlation coefficient r in descending order, take out the feature whose correlation coefficient value is greater than the judgment threshold, and make the binary file online intrusion detection sample set D _online composed of the features whose correlation coefficient value is greater than the judgment threshold;

Step 6. Real-time intrusion detection:

中进行预测，根据模型预测结果判断在线入侵检测样本集D_online中每一个样本的类型，具体如下：Put the online intrusion sample set D _online into the intrusion detection model trained in step 3

According to the prediction results of the model, the type of each sample in the online intrusion detection sample set D _online is judged, as follows:

If the sample is classified as a normal sample, continue to perform real-time intrusion detection on other samples in the sample set D _online ;

If the sample is classified as a sample of a known abnormal category, the sample will be fed back to the administrator for further analysis, and at the same time, real-time intrusion detection will continue to be performed on other samples in the sample set D _online ;

If the sample is classified as a sample of an unknown category, perform manual judgment to determine whether the sample is available; if it is determined to be unavailable, continue to perform real-time intrusion detection on other samples in the sample set D _online ; if it is determined to be available, go to step 7 ;

Step 7. According to the information recorded by the available sample data, manually label the unknown category samples, and construct the unknown category sample set D _unknown :

D _unknown ={X ¹ ,X ² ,...,X ^m },

where m is the number of categories of samples of unknown category, and X ^m is the set of all unknown samples with sample category m.

Step 8. Select representative samples from the initial known class sample set to construct a known class sample set D _known :

D _known = {D _t , D _f , D _r },

where D _t is the data sample set that is correctly classified on the classification model to be extended and has a high score in the top 1%, D _f is the entire data sample set that is incorrectly classified on the classification model to be extended, and D _r is randomly selected 1% remaining known Data sample set of class samples;

Step 9. Build an incremental sample set D _new for subsequent online updating of the model:

D _new ={D _known ,D _unknown }

={D _t ,D _f ,D _r ,D _unknown },

={X ¹ ,X ² ,...,X ⁿ ,X ⁿ⁺¹ ,X ⁿ⁺² ,... X ^n+m }

Among them, n and m represent the number of classes of known class samples and unknown class samples, respectively;

X ^n+m ={(x _j ,y _j ),1≤j≤M,y _j ∈[1,2,...,m]},

分别为已知类别样本的样本特征和样本标签，N为已知类别样本集的样本数量，x_i、y_i分别为未知类别样本的样本特征和样本标签，M为未知类别样本集的样本数量；in,

are the sample features and sample labels of the known class samples, respectively, N is the number of samples in the known class sample set, x _i and y _i are the sample features and sample labels of the unknown class samples, respectively, and M is the sample number of the unknown class sample set ;

The selection method of incremental samples can also be adopted, such as using only the reservoir sampling algorithm to obtain random samples, and only using samples with higher classification scores.

Step 10. Build an extended classification network model:

Build an extended classification network model consisting of a one-dimensional separation convolutional neural network layer separable_conv1d, the first maximum pooling layer max_pooling_1, the transition layer flatten, the second fully connected layer dense_2, the temporary dropout layer dropout and the first fully connected layer dense_1. Input a 18*1 one-dimensional matrix to it, and get a 1*1 matrix representing the prediction score of the sample type;

All separated one-dimensional convolutional neural network layers use the same padding method, the activation function uses the linear rectification activation function Relu function, the maximum pooling layer pooling size is set to 2, the parameter of the temporary retreat layer is 0.5, and The activation function of the connection layer adopts the sigmoid function of the sigmoid growth curve activation function.

并用该在线更新后入侵检测模型

替换步骤6中的入侵检测模型

完成实时入侵检测。Step 11. Use the incremental sample set D _new and the loss function L to train the extended classification network model to obtain an online updated intrusion detection model that can detect known and unknown categories

And use the online updated intrusion detection model

Replace the intrusion detection model in step 6

Complete real-time intrusion detection.

The loss function L is defined as:

L=λL _d +(1-λ)L _c ,

where λ is a hyperparameter and L _d is the distillation loss function, which is defined as:

Among them, N is the number of all samples, and n+m is the number of all sample types;

为已知种类样本在扩展模型上的预测分数，q为未知种类的样本在扩展模型上的预测分数，t为超参数。in,

is the prediction score of the sample of known species on the extended model, q is the prediction score of the sample of unknown species on the extended model, and t is the hyperparameter.

Embodiment 2: The overall steps of the intrusion detection method proposed in this embodiment are the same as those in Embodiment 1, and the implementation process of the method of the present invention is further described in detail given specific parameters.

Step A. This embodiment preferably discloses the intrusion detection data set CICIDS2017 as a known category sample set. The CICIDS2017 data set contains benign and latest common attacks, similar to real-world data. It also includes the results of network traffic analysis using CICFlowMeter, using tagged flows based on timestamp, source and destination IP, source and destination port, protocol and attack (CSV file). Each extracted data record has 18 features, and the tags have 8 attack types and 1 normal type, then remove some invalid data, classify all data records according to the tags, and perform one-hot encoding on the character features. Make a binary file sample set containing data, labels, and lists, and finally select 80% of the data for training and 20% for verification. Of course, the initial known category training set D _old can also be divided according to other proportions. and the validation set D _valid , for example, 7:3, which is preferably divided according to 8:2 in this embodiment.

For the known species sample set CICIDS2017 can be replaced with other public intrusion detection data sets, such as UNSW-NB15, NSL-KDD and so on.

Step B. Referring to FIG. 2 , build a classification network model to be expanded. The model adopts a spatiotemporal network structure, and a one-dimensional convolutional neural network and a long short-term memory neural network are connected in series as a network structure. The number of trainable parameters of the classification model to be expanded is 123905, and its input is a one-dimensional matrix of 18*1. After one-dimensional convolutional neural network layers conv1d_21, conv1d_22, maximum pooling layer max_pooling1d_16, one-dimensional convolutional neural network layer conv1d_23, The maximum pooling layer max_pooling1d_17, the long short-term memory neural network layer lstm_7, the dropout layer dropout_9 and the fully connected layer dense_11, the final output is a 1*1 matrix, representing the prediction score of the sample type. The one-dimensional convolutional neural network layers all use the same filling method, the activation functions all use the Relu activation function, the pooling size of the maximum pooling layer is set to 2, the long short-term memory neural network layer contains 128 hidden layers, and the Dropout layer has 128 hidden layers. The parameter is 0.1, and the activation function of the fully connected layer adopts the Sigmoid activation function.

这里对模型进行检验，具体是通过得到验证集中每一条数据记录的分类预测概率，进而得到模型预测的准确率，最后判断当前模型是否可用，从而实现优化。其中old表示模型还未经过更新，θ_old为神经网络模型参数。Step C. Use the initial known category training set D _old in step A and the cross entropy loss function L _c to train the to-be-expanded classification network model built in step B to obtain an intrusion detection model that can detect known categories, and at the same time use the initial known category Know the category verification set D _valid to test the state and convergence of the intrusion detection model during the training process, adjust the hyperparameters according to the test results to optimize the training effect, and obtain a trained intrusion detection model

The model is tested here, specifically by obtaining the classification prediction probability of each data record in the verification set, and then obtaining the accuracy of the model prediction, and finally judging whether the current model is available, so as to achieve optimization. Where old indicates that the model has not been updated, and θ _old is the neural network model parameter.

Step D. Sniff network traffic in real time:

Use the Realtime module of CICFlowMeter to capture the data records in the network in real time, remove some invalid data records, and analyze the valid data records to obtain no more than 80 data features and save them; in this embodiment, it is preferable to analyze the valid data records to obtain 80 data features. feature.

Step E. Perform feature extraction on the 80 data features obtained in the previous step, that is, network traffic features using the Pearson correlation coefficient feature extraction method. The specific implementation is as follows:

First, one-hot encoding is performed on the character features, and then the Pearson correlation coefficient r of each feature and other features is calculated, and sorted in descending order according to the size of the correlation coefficient. Feature, in this embodiment, the threshold is set to 0.078, and finally a binary file online intrusion detection sample set D _online containing data is produced.

The calculation method of the Pearson correlation coefficient r is:

为全部样本第i个特征值的均值，

为全部样本其它特征值的均值。Among them, i∈[1,80] is the sequence number of the eigenvalue of the sample, x _i is the ith eigenvalue of the current sample, y _i is the other eigenvalues of the current sample,

is the mean of the i-th eigenvalue of all samples,

is the mean of other eigenvalues of all samples.

Step F. Real-time intrusion detection:

中进行预测，得到线入侵样本集D_online中每一条记录的分类预测概率logits，根据预测概率判断样本集D_online的每一个样本类型，具体如下：Put the online intrusion sample set D _online into the intrusion detection model trained in step C

Prediction is performed in the online intrusion sample set D online to obtain the classification prediction probability logits of each record in the line intrusion sample set D _online , and each sample type of the sample set D _online is judged according to the predicted probability, as follows:

If the sample is classified as a normal sample, continue to perform real-time intrusion detection on other samples in the sample set D _online ;

If the sample is classified as a sample of a known abnormal category, the sample will be fed back to the administrator for further analysis, and at the same time, real-time intrusion detection will continue to be performed on other samples in the sample set D _online ;

If the sample is classified as a sample of an unknown category, a manual judgment is made to determine whether the sample is available. If it is judged to be unavailable, it will continue to perform real-time intrusion detection on other samples in the sample set D _online ; if it is judged to be available, go to the next step. The step is ready to perform data labeling, that is, step G is executed.

Step G. Manually label the data

When the online intrusion detection result is an unknown class sample and it is available, according to the information recorded by the available sample data, the label of the unknown class sample is manually marked, and the unknown class sample set D _unknown is constructed:

D _unknown ={X ¹ ,X ² ,...,X ^m },

where m is the number of categories of samples of unknown category, and X ^m is the set of all unknown samples with sample category m.

Step H. Construct a representative known class sample set D _known :

D _known = {D _t , D _f , D _r },

where D _t is the data sample set that is correctly classified on the classification model to be extended and has a high score in the top 1%, D _f is the entire data sample set that is incorrectly classified on the classification model to be extended, and D _r is randomly selected 1% remaining known A set of data samples for class samples.

Step I. Build an incremental sample set D _new for subsequent online updating of the model:

D _new = {D _known , D _unknown }, namely:

D _new ={X ¹ ,X ² ,...,X ⁿ ,X ⁿ⁺¹ ,X ⁿ⁺² ,... X ^n+m },

where n and m represent the number of classes of known class samples and unknown class samples, respectively,

X ^n+m ={(x _j ,y _j ),1≤j≤M,y _j ∈[1,2,...,m]},

分别为已知类别样本的样本特征和样本标签，N为已知类别样本集的样本数量，x_i，y_i分别为未知类别样本的样本特征和样本标签，M为未知类别样本集的样本数量。in

are the sample features and sample labels of known class samples, respectively, N is the number of samples in the known class sample set, x _i , y _i are the sample features and sample labels of the unknown class samples, respectively, M is the number of samples in the unknown class sample set .

So far, the incremental sample set for the subsequent update of the online expansion model has been successfully constructed.

Step J. Referring to Figure 3, build an extended classification network model. The number of trainable parameters of this model is 37124, and its input is a one-dimensional matrix of 18*1. After one-dimensional separation of the convolutional neural network layer separable_conv1d_1, the maximum pooling layer max_pooling1d_5 , the transition layer flatten_1, the maximum pooling layer max_pooling1d_17, the fully connected layer dense_4, the dropout layer dropout_9 and the fully connected layer dense_5, the final output is a 1*1 matrix, representing the predicted score of the sample. The separation one-dimensional convolutional neural network layer adopts the same filling method, the activation function uses the Relu activation function, the maximum pooling layer pooling size is set to 2, the parameter of the dropout layer is 0.5, and the activation function of the fully connected layer adopts Sigmoid activation function.

其中new表示模型已经更新过了，θ_new代表神经网络模型参数；并用该在线更新后入侵检测模型

替换

实现模型更新，完成实时入侵检测。Step K. Use the incremental sample set D _new and the loss function L to train the extended classification network model to obtain an online updated intrusion detection model that can detect known and unknown categories

Among them, new indicates that the model has been updated, and θ _new indicates the parameters of the neural network model; and use the online updated intrusion detection model

replace

Realize model update and complete real-time intrusion detection.

The to-be-expanded classification model and the expanded classification model constructed by the present invention can also be replaced by any deep learning network structure, such as a convolutional neural network structure, a ResNet residual network structure, a deep convolutional network VGG-Net, etc., but it is necessary to ensure that The parameter value of the extended classification model is smaller than that of the to-be-extended classification model. For step 2, the network sniffing part of the CICFlowMeter can be replaced with other network traffic sniffers, such as Sniffer and whireshark. CICFlowMeter can extract and obtain the flow characteristics of the data packets by itself, which is much more efficient than the alternative solution and realizes efficient data mining.

The parts of the present invention that are not described in detail belong to the common knowledge of those skilled in the art.

The above are only preferred embodiments of the present invention, and are not intended to limit the present invention. Obviously, for those skilled in the art, after understanding the content and principles of the present invention, they may not deviate from the principles of the present invention, In the case of the structure, various corrections and changes in form and details are made, but these corrections and changes based on the idea of the present invention are still within the scope of protection of the claims of the present invention.

Claims (8)

1. An online adaptive intrusion detection method based on incremental learning comprises the following steps:

(1) preprocessing the original data set:

obtaining a public intrusion detection data set from a network as an initial known class sample set, extracting the characteristics and labels of each data record, removing part of invalid data, classifying the rest data records according to the labels, carrying out unique hot coding on character type characteristics, making a binary file sample set containing data, labels and a list, and dividing the data in the file sample set into an initial known class training set D _old And a verification set D _valid Two parts;

D _old ＝{X ¹ ,X ² ,...,X ⁿ }，

D _valid ＝{T ¹ ,T ² ,...,T ⁿ }，

where n is the number of classes of the initial known class sample, X ⁿ 、T ⁿ Respectively representing all nth initial known class training samples and verification samples;

(2) building a classification network model to be expanded:

adopting a space-time network structure, connecting a one-dimensional convolutional neural network and a long-short term memory neural network in series to form a network structure, building a classification network model to be expanded, which sequentially consists of two first one-dimensional convolutional neural network layers conv1d, a first maximum pooling layer max _ pooling _1, a second one-dimensional convolutional neural network layer conv1d _2, a second maximum pooling layer max _ pooling _2, a long-short term memory neural network layer lstm, a temporary regression layer dropout and a first full connection layer dense _1, taking a one-dimensional matrix of 18 x 1 as input, and outputting a matrix of 1 x 1 representing a sample type prediction score;

(3) training set D with initial known class samples _old And cross entropy loss function L _c Training a classification network model to be expanded, acquiring an intrusion detection model capable of detecting known classes, and simultaneously utilizing an initial known class verification set D _valid The state and convergence condition of the model are detected in the intrusion detection model training process, and the hyperparameter is adjusted according to the detection result to realize the training effect optimization, so that the trained intrusion detection model is obtained

(4) A real-time extraction module real-time of a flow characteristic extraction tool CICFlowMeter is used for capturing data records in a network in real time, removing part of invalid data records, analyzing the valid data records to obtain 50-80 data characteristics, and storing the data characteristics;

(5) performing feature extraction on the data features obtained in the step (4), and obtaining an online intrusion detection sample set D according to the extracted feature combinations _online ；

(6) And (3) real-time intrusion detection:

sample set D of online intrusion _online Putting the intrusion detection model trained in the step (3)

According to the model prediction result, judging an online intrusion detection sample set D _online The type of each sample in (1) is as follows:

if the sample is classified as a normal sample, continuing to perform the analysis on the sample set D _online Carrying out real-time intrusion detection on other samples;

if the sample is classified as a sample of a known abnormal category, the sample is fed back to an administrator for further analysis, and meanwhile, the sample set D is continuously processed _online Carrying out real-time intrusion detection on other samples;

if the sample is classified into the sample of unknown category, carrying out manual judgment to determine whether the sample is available, and if the sample is not available, continuing to carry out sample set D _online Carrying out real-time intrusion detection on other samples; if the judgment result is that the data are available, executing the step (7);

(7) manually labeling the label of the unknown type sample according to the information of the available sample data records, and constructing an unknown type sample set D _unknown ：

D _unknown ＝{X ¹ ,X ² ,...,X ^m }，

Where m is the number of classes of the unknown class sample, X ^m All unknown sample sets with sample class m.

(8) Selecting representative samples from the initial known category sample set to construct a known category sample set D _known ：

D _known ＝{D _t ,D _f ,D _r }，

Wherein D _t For classifying a correct and top-scoring 1% high set of data samples on the classification model to be expanded, D _f For classifying the entire data sample set of errors on the classification model to be expanded, D _r Randomly selecting a data sample set of 1% of the remaining known class samples;

(9) constructing an incremental sample set D for a subsequent online update model _new ：

Wherein n and m respectively represent the number of classes of the known class samples and the unknown class samples;

X ^n+m ＝{(x _j ,y _j ),1≤j≤M,y _j ∈[1,2,...,m]}，

wherein,

sample characteristics and sample labels of samples of known classes respectively, N is the number of samples of a sample set of known classes, x _i 、y _i Respectively representing the sample characteristics and the sample labels of the unknown sample, wherein M is the number of samples of the unknown sample set;

(10) building an extended classification network model:

building an extended classification network model sequentially composed of a one-dimensional separation convolutional neural network layer private _ conv1d, a first maximum pooling layer max _ posing _1, a transition layer flatten, a second fully-connected layer dense _2, a temporary regression layer dropout and a first fully-connected layer dense _1, and inputting a one-dimensional matrix of 18 x 1 to the extended classification network model to obtain a 1 x 1 matrix representing a sample type prediction score;

(11) using incremental sample sets D _new Training an extended classification network model by a loss function L to obtain an online updated intrusion detection model capable of detecting known classes and unknown classes

And using the online updated intrusion detection model

Replacing the intrusion detection model in step (6)

And completing real-time intrusion detection.

2. The method of claim 1, wherein: in the step (2), all the one-dimensional convolutional neural network layers adopt the Same filling Same filling mode, the activation functions all use linear rectification activation functions Relu, the pooling size of the maximum pooling layer is set to be 2, the long-term and short-term memory neural network layers comprise 128 hidden layers, the parameters of the temporary backoff layer are 0.1, and the activation functions of the full connection layers adopt S-shaped growth curve activation functions Sigmoid functions.

3. The method of claim 1, wherein: the intrusion detection model in the step (3)

The training can also be achieved by:

(a) dynamically calculating a data flow threshold theta:

wherein A is the sum of data flow from four points to six points in the early morning every day in 7 days before the current moment;

(b) comparing the receiving data flow tau of the data record in the hourly captured network in the step (4) with the threshold theta in real time, and when the tau is larger than the threshold theta<When the sample class is theta, all samples are set as samples of known types, and an initial training set D of samples of known sample classes in the step (1) is constructed _old And using the sample set and the cross entropy loss function L _c Training the classification network model to be expanded to obtain a good intrusion detection model capable of detecting known classes

4. A method according to claim 1 or 3, characterized in that: the cross entropy loss function L _c Is defined as:

wherein y and

respectively representing the prediction type and the real type of the known sample obtained by the model.

5. The method of claim 1, wherein: and (5) extracting the features in the step (5), wherein a Pearson correlation coefficient feature extraction method is adopted, and the method comprises the following steps:

(5.1) carrying out one-hot coding on the character type characteristics, then calculating a Pearson correlation coefficient r of each characteristic and other characteristics, and setting a coefficient judgment threshold;

(5.2) sorting the correlation coefficients r according to the descending order, taking out the features of which the correlation coefficient values are larger than the judgment threshold value, and making a binary file online intrusion detection sample set D formed by combining the features of which the correlation coefficient values are larger than the judgment threshold value _online 。

6. The method of claim 5, wherein: the pearson correlation coefficient r in step (5.1) is calculated according to the following formula:

wherein i belongs to [1, fnum ∈]Is the serial number of the sample characteristic value, fnum is the characteristic number of the sample set, x _i Is the i-th characteristic value, y, of the current sample _i For the other characteristic values of the current sample,

is the average of the ith characteristic values of all samples,

is the average of other characteristic values of all samples.

7. The method of claim 1, wherein: in the step (10), all the separated one-dimensional convolutional neural network layers adopt the Same filling Same filling mode, the activation functions all use linear rectification activation functions Relu, the pooling size of the maximum pooling layer is set to be 2, the parameter of the temporary backoff layer is 0.5, and the activation functions of the full connection layers adopt S-shaped growth curve activation functions Sigmoid functions.

8. The method of claim 1, wherein: the definition of the loss function L in step (11) is:

L＝λL _d +(1-λ)L _c ，

wherein λ is a hyperparameter, L _d As a function of distillation loss, defined as:

wherein N is the number of all samples, and N + m is the number of all sample types;

wherein,

the prediction scores of the samples of the known type on the extended model are obtained, q is the prediction score of the samples of the unknown type on the extended model, and t is a hyperparameter.

Images