CN114567512A - Network intrusion detection method, device and terminal based on improved ART2 - Google Patents
Network intrusion detection method, device and terminal based on improved ART2 Download PDFInfo
- Publication number
- CN114567512A CN114567512A CN202210445030.8A CN202210445030A CN114567512A CN 114567512 A CN114567512 A CN 114567512A CN 202210445030 A CN202210445030 A CN 202210445030A CN 114567512 A CN114567512 A CN 114567512A
- Authority
- CN
- China
- Prior art keywords
- amplitude
- mode
- input
- pattern
- art2
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 102100024405 GPI-linked NAD(P)(+)-arginine ADP-ribosyltransferase 1 Human genes 0.000 title claims abstract description 78
- 101000981252 Homo sapiens GPI-linked NAD(P)(+)-arginine ADP-ribosyltransferase 1 Proteins 0.000 title claims abstract description 78
- 238000001514 detection method Methods 0.000 title claims abstract description 38
- 238000000034 method Methods 0.000 claims abstract description 27
- 239000013598 vector Substances 0.000 claims abstract description 21
- 210000002569 neuron Anatomy 0.000 claims description 36
- 238000004590 computer program Methods 0.000 claims description 21
- 230000015654 memory Effects 0.000 claims description 15
- 238000003909 pattern recognition Methods 0.000 claims description 15
- 238000012545 processing Methods 0.000 claims description 13
- 238000012549 training Methods 0.000 claims description 12
- OKTJSMMVPCPJKN-UHFFFAOYSA-N Carbon Chemical compound [C] OKTJSMMVPCPJKN-UHFFFAOYSA-N 0.000 claims description 9
- 238000004422 calculation algorithm Methods 0.000 claims description 9
- 230000002068 genetic effect Effects 0.000 claims description 7
- 230000002401 inhibitory effect Effects 0.000 claims description 3
- 230000006399 behavior Effects 0.000 description 10
- 230000006870 function Effects 0.000 description 10
- 230000008569 process Effects 0.000 description 9
- 238000010586 diagram Methods 0.000 description 6
- 238000004364 calculation method Methods 0.000 description 4
- 230000003044 adaptive effect Effects 0.000 description 3
- 230000008878 coupling Effects 0.000 description 3
- 238000010168 coupling process Methods 0.000 description 3
- 238000005859 coupling reaction Methods 0.000 description 3
- 230000035772 mutation Effects 0.000 description 3
- 238000013528 artificial neural network Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 2
- 230000007547 defect Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 108090000623 proteins and genes Proteins 0.000 description 2
- 229910000831 Steel Inorganic materials 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 210000000349 chromosome Anatomy 0.000 description 1
- 230000003247 decreasing effect Effects 0.000 description 1
- 238000013461 design Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 230000009191 jumping Effects 0.000 description 1
- 239000000203 mixture Substances 0.000 description 1
- 238000010606 normalization Methods 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 239000000047 product Substances 0.000 description 1
- 230000006403 short-term memory Effects 0.000 description 1
- 230000000087 stabilizing effect Effects 0.000 description 1
- 239000010959 steel Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 239000013589 supplement Substances 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Burglar Alarm Systems (AREA)
- Alarm Systems (AREA)
- Image Analysis (AREA)
Abstract
The application is applicable to the technical field of computer network security, and provides a network intrusion detection method based on improved ART2, which comprises the following steps: the method comprises the steps of obtaining an input mode of a feature vector representing network intrusion data, carrying out mode recognition on the input mode by utilizing an improved ART2, and selecting a target classification mode, wherein the improved ART2 learns a plurality of classification modes in advance, the target classification mode represents one of the classification modes which is most matched with the input mode, the matching degree of the target classification mode and the input mode is not less than the alert value of the improved ART2, calculating the amplitude difference between the input mode and the target classification mode, and if the amplitude difference is less than a preset threshold value, determining the category of the network intrusion data as the category corresponding to the target classification mode.
Description
Technical Field
The application belongs to the technical field of computer network security, and particularly relates to a network intrusion detection method, device, terminal and computer readable storage medium based on improved ART 2.
Background
At present, with the development of network technologies, network intrusion behaviors are increasingly diversified, which relates to a new generation of network security technology.
Intrusion Detection Systems (IDS) are used to identify illegal attacks against computer systems, network systems or more generally information systems, including malicious attacks or heuristics to detect external illegal intruders, and illegal actions by internal legitimate users that override usage rights. Intrusion detection has the characteristics of initiative and real-time performance, and becomes powerful supplement of a firewall, so that intrusion behaviors can be classified quickly and accurately, and intrusion prevention measures can be provided more pertinently.
However, due to the diversification of network intrusion behaviors, many new types of network intrusion behaviors may occur, and if intrusion behavior classification is performed by still referring to the features of the historical data, cases of erroneous judgment and missed judgment may occur, which affects the classification accuracy of intrusion detection.
Disclosure of Invention
In view of the above, the present application provides a network intrusion detection method, apparatus, terminal and computer readable storage medium based on an improved ART2, so as to solve the problem in the prior ART that false judgment and missed judgment may occur when network intrusion classification is performed, which may affect the classification accuracy of intrusion detection.
A first aspect of the present application provides a network intrusion detection method based on an improved ART2, including:
acquiring an input mode, wherein the input mode represents a feature vector of network intrusion data;
performing pattern recognition on the input pattern by using an improved ART2, and selecting a target classification pattern, wherein the improved ART2 learns a plurality of classification patterns in advance, the target classification pattern represents one of the classification patterns which is most matched with the input pattern, and the matching degree of the target classification pattern and the input pattern is not less than the alert value of the improved ART 2;
calculating the amplitude difference of the input mode and the target classification mode;
and if the amplitude difference is smaller than a preset threshold value, determining the category of the network intrusion data as the category corresponding to the target classification mode.
In one implementation, after the calculating the difference in amplitude of the input pattern and the target classification pattern, the method further comprises:
and if the amplitude difference is not smaller than a preset threshold value, inhibiting the selected classification mode, reselecting a target classification mode, and executing the step of calculating the amplitude difference between the input mode and the target classification mode until the calculated amplitude difference between the input mode and the target classification mode is smaller than the preset threshold value.
In one implementation, the method further comprises:
and if all the classification modes in the plurality of classification modes are inhibited, creating a new classification mode, and determining the created new classification mode as the class of the network intrusion data.
In one implementation, the calculating the difference in amplitude of the input pattern and the target classification pattern includes:
calculating the maximum amplitude and the minimum amplitude of the input mode, and recording as the input maximum amplitude and the input minimum amplitude;
calculating the maximum amplitude and the minimum amplitude of the target classification mode, and recording the maximum amplitude and the minimum amplitude as feedback maximum amplitude and feedback minimum amplitude;
calculating the absolute value of the difference between the input maximum amplitude and the feedback maximum amplitude, and recording the absolute value as a first difference value;
calculating the absolute value of the difference between the input minimum amplitude and the feedback minimum amplitude, and recording the absolute value as a second difference value;
if the first difference value and the second difference value are both smaller than a preset threshold value, determining that the amplitude difference is smaller than the preset threshold value;
and if any one of the first difference value and the second difference value is not smaller than a preset threshold value, determining that the amplitude difference is not smaller than the preset threshold value.
In one implementation, prior to the performing the pattern recognition on the input pattern with the enhanced ART2, further comprises: training the improved ART2 by using a preset network intrusion data training set based on a genetic algorithm, acquiring a super parameter, and initializing the parameter of the improved ART2 by using the super parameter.
In one implementation, after the calculating the amplitude difference between the input pattern and the target classification pattern, the method further includes:
and if the amplitude difference is smaller than a preset threshold value, updating the internal star weight of the neuron corresponding to the target classification mode in the improved ART2 and memorizing.
In one implementation, the comparison layer of the attention subsystem of the modified ART2 includes a first amplitude recording neuron and a second amplitude recording neuron; wherein the first amplitude recording neuron is configured to record a maximum amplitude of an input pattern; the second amplitude record is used to record the minimum amplitude of the input pattern.
A second aspect of the present application provides a network intrusion detection apparatus based on an improved ART2, including:
the device comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring an input mode, and the input mode represents a feature vector of network intrusion data;
a recognition unit, configured to perform pattern recognition on the input pattern by using an improved ART2, and select a target classification pattern, where the improved ART2 learns a plurality of classification patterns in advance, the target classification pattern represents one of the classification patterns that is the most matched with the input pattern, and a matching degree of the target classification pattern and the input pattern is not less than an alert value of the improved ART 2;
a calculating unit, configured to calculate a magnitude difference between the input pattern and the target classification pattern;
and the determining unit is used for determining the category of the network intrusion data as the category corresponding to the target classification mode if the amplitude difference is smaller than a preset threshold value.
In one implementation manner, the network intrusion detection apparatus further includes:
and the iteration processing unit is used for inhibiting the selected classification mode at this time when the amplitude difference calculated by the calculating unit is not less than the preset threshold, reselecting the target classification mode, and jumping to the identifying unit to re-execute the step of calculating the amplitude difference between the input mode and the target classification mode until the calculated amplitude difference between the input mode and the target classification mode is less than the preset threshold.
In one implementation, the determining unit is further configured to create a new classification pattern when each of the plurality of classification patterns is suppressed, and determine the created new classification pattern as the class of the network intrusion data.
In one implementation, the computing unit is specifically configured to:
calculating the maximum amplitude and the minimum amplitude of the input mode, and recording as the input maximum amplitude and the input minimum amplitude; calculating the maximum amplitude and the minimum amplitude of the target classification mode, and recording the maximum amplitude and the minimum amplitude as feedback maximum amplitude and feedback minimum amplitude; calculating the absolute value of the difference between the input maximum amplitude and the feedback maximum amplitude, and recording the absolute value as a first difference value; calculating the absolute value of the difference between the input minimum amplitude and the feedback minimum amplitude, and recording the absolute value as a second difference value;
if the first difference value and the second difference value are both smaller than a preset threshold value, determining that the amplitude difference is smaller than the preset threshold value; and if any one of the first difference value and the second difference value is not less than a preset threshold value, determining that the amplitude difference is not less than the preset threshold value.
In one implementation, the network intrusion detection apparatus further includes: and the initialization unit is used for training the improved ART2 by utilizing a preset network intrusion data training set based on a genetic algorithm, acquiring a super parameter and initializing the parameter of the improved ART2 by utilizing the super parameter.
In one implementation, the network intrusion detection apparatus further includes:
and the weight updating unit is used for updating and memorizing the intra-star weight of the neuron corresponding to the target classification mode in the improved ART2 when the amplitude difference is smaller than a preset threshold value.
In one implementation, the comparison layer of the attention subsystem of the improved ART2 includes a first amplitude recording neuron and a second amplitude recording neuron; wherein the first amplitude recording neuron is configured to record a maximum amplitude of an input pattern; the second amplitude record is used to record the minimum amplitude of the input pattern.
A third aspect of the present application provides a terminal comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the network intrusion detection methods as described above when executing the computer program.
A fourth aspect of the present application provides a computer-readable storage medium, in which a computer program is stored, which computer program, when being executed by a processor, performs the steps of the network intrusion detection method according to any one of the above.
Compared with the prior art, the application has the beneficial effects that:
according to the method, a characteristic vector input mode representing network intrusion data is obtained, the input mode is subjected to mode recognition by utilizing an improved ART2, a target classification mode is selected, the amplitude difference between the input mode and the target classification mode is calculated, and if the amplitude difference is smaller than a preset threshold value, the category of the network intrusion data is determined to be the category corresponding to the target classification mode; therefore, the improved ART2 is used for pattern recognition, after the target classification pattern which is most matched with the input pattern is recognized, secondary judgment is carried out according to the amplitude difference between the input pattern and the target classification pattern, and finally a more accurate pattern recognition result is obtained, so that the accuracy of network intrusion behavior classification is improved.
Drawings
In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments or the prior art descriptions will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art to obtain other drawings based on these drawings without inventive exercise.
Fig. 1 is a schematic diagram of the architecture of a unit of an improved ART2 provided by the embodiment of the present application;
fig. 2 is a flowchart of an implementation of a network intrusion detection method based on the improved ART2 according to an embodiment of the present application;
fig. 3 is a flowchart of another implementation of the network intrusion detection method based on the improved ART2 according to the embodiment of the present application;
fig. 4 is a schematic structural diagram of a network intrusion detection device based on an improved ART2 according to an embodiment of the present application;
fig. 5 is a schematic diagram of a terminal provided in an embodiment of the present application.
Detailed Description
In the following description, for purposes of explanation and not limitation, specific details are set forth, such as particular system structures, techniques, etc. in order to provide a thorough understanding of the embodiments of the present application. It will be apparent, however, to one skilled in the art that the present application may be practiced in other embodiments that depart from these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present application with unnecessary detail.
To make the objects, technical solutions and advantages of the present application more clear, the following description is made by way of specific embodiments with reference to the accompanying drawings.
The adaptive Resonance theory art (adaptive Resonance theory) model is an ad-hoc neural network proposed by s.grossberg and a.carpenter in 1986. The ART model successfully solves the problem of the relationship between stability and plasticity in neural network learning. ART models are ART and ART 2. Of these, ART can only process binary data, while ART2 is widely used for pattern clustering and recognition due to its powerful and moderate computational complexity. In some applications, however, direct use of the original ART2 may not work well, and only modification of the original ART2 to address problematic features may yield better results.
For example, the comparison and identification process of the original ART2 ignores the mode vector magnitude information, which may cause inaccurate identification result; for another example, based on the competition mechanism of the winner being the king, the original ART2 also has the problem that only the neuron with the highest matching degree is selected as the output category, and actually the neuron with the highest matching degree is not necessarily the most accurate classification result; for another example, the original ART2 has the defect that noise has a large influence on the result.
Based on the above, the application improves the architecture of the original ART2, adds two amplitude recording neurons, considers the mode vector amplitude information and the noise influence, improves the processing algorithm, does not adopt the competition mechanism of the winner, and is specifically described as follows:
as shown in fig. 1, a schematic diagram of an architecture of a unit of an improved ART2 provided for the embodiment of the present application, the improved ART2 includes: a control subsystem 10 and an attention subsystem 11.
The control subsystem 10 includes a comparison sublayer r1 and a warning parameter ρ.
Note that the subsystem 11 includes a comparison layer F1 and a recognition layer F2, and the comparison layer F1 is composed ofnGroups of neurons (only 1 group is shown in FIG. 1), and each group is composed of many neurons: (1)w i,x i,v i,u i,p i,q iFormed of | P |, | V |, | W |) for accepting external inputnDimension state vector (i 1,i 2,…,i n ) Processing and short-term memory; the identification layer F2 is composed ofmA single neuron (only 1 is shown in FIG. 1) for dividing the data processed by the F1 layer intomClasses, each neuron represents a pattern class, and the link between the F1 level and the F2 level is through weight vectors. The F1 layer receives an n-dimensional input mode from the outside (i 1,i 2,…,i n ) After being treated in the F1 layer, the mixture is sent to the F2 layer and then distributed to the F2 layermProcessing in each neuron, and outputting the result (y 1,y 2,…,y m ) And selecting the neuron with the maximum output value to activate, and then updating the weight vector. When the similarity between the input vector and the feedback vector is lower than the alarm value, the directional subsystem controls the F2 layer, inhibits the neurons activated by the F2 layer, reselects the winning neurons and tests the similarity until the similarity reaches the alarm valueStopping when required. Wherein the open circles in FIG. 1 represent the computational neurons, the filled circles represent the incremental control neurons, and the filled circles with diagonal lines represent the amplitude recording neurons that are added in the present application by improvement: (u minAndu max)。
in the embodiment of the present application, the comparison layer of the attention subsystem of the improved ART2 includes a first amplitude recording neuron and a second amplitude recording neuron; wherein the first amplitude recording neuron is configured to record a maximum amplitude of an input pattern; the second amplitude record is used to record the minimum amplitude of the input pattern.
referring to fig. 2, it shows a flowchart of an implementation of the network intrusion detection method based on the improved ART2 provided in the embodiment of the present application, which is detailed as follows:
in step 201, an input pattern is acquired.
In the embodiment of the application, the input mode is the input of an improved ART2 model, which represents the feature vector of the network intrusion data. Illustratively, a network intrusion data record is represented by a 40-dimensional input vector, also called input vector, through feature extraction. The input vector may include a discrete number or may include continuity data.
In step 202, the input pattern is pattern-recognized using the modified ART2 to select a target classification pattern.
In the embodiment of the present application, the improved ART2 may be previously learned with a plurality of classification patterns, the target classification pattern indicates one of the plurality of classification patterns that most closely matches the input pattern, and the degree of matching of the target classification pattern with the input pattern is not less than the guard value of the improved ART 2.
With reference to fig. 1, the improved ART2 performs pattern recognition on the input pattern as follows:
calculating intermediate variables until the variables according to the following formulauAnd (3) stabilizing:
According to the calculation formula of matching degreeCalculating each component of the comparison vector r if Then the mode fed back by the layer F2 is the target classification mode of the input mode.
Wherein, in the formula, the first and the second groups,to improve the hyper-parameters of the ART2 model, it may be determined based on prior training learning.
In step 203, the amplitude difference between the input pattern and the target classification pattern is calculated.
In the embodiment of the present application, the target classification mode needs to be secondarily compared and determined based on the amplitude difference between the target classification mode and the input mode, and the amplitude difference may include a minimum amplitude difference and a maximum amplitude difference.
Specifically, one implementation of step 203 may include:
calculating the maximum amplitude and the minimum amplitude of the input mode, and recording as the input maximum amplitude and the input minimum amplitude;
calculating the maximum amplitude and the minimum amplitude of the target classification mode, and recording the maximum amplitude and the minimum amplitude as feedback maximum amplitude and feedback minimum amplitude;
calculating the absolute value of the difference between the input maximum amplitude and the feedback maximum amplitude, and recording the absolute value as a first difference value;
calculating the absolute value of the difference between the input minimum amplitude and the feedback minimum amplitude, and recording the absolute value as a second difference value;
if the first difference value and the second difference value are both smaller than a preset threshold value, determining that the amplitude difference is smaller than the preset threshold value;
and if any one of the first difference value and the second difference value is not smaller than a preset threshold value, determining that the amplitude difference is not smaller than the preset threshold value.
In this embodiment, by calculating the amplitude difference between the input mode and the target classification mode, the defect of the indicated original ART model can be avoided, and a more accurate mode recognition result can be obtained, thereby improving the accuracy of network intrusion behavior classification. In practical applications, the preset threshold may be 0.005.
In step 204, if the amplitude difference is smaller than the preset threshold, the class of the network intrusion data is determined to be the class corresponding to the target classification mode.
In this embodiment, the amplitude difference between the input mode and the target classification mode is smaller than the preset threshold, which means that the minimum amplitude difference and the maximum amplitude difference between the input mode and the target classification mode are both smaller than the preset threshold, and the real matching degree between the input mode and the target classification mode is higher, and the input mode and the target classification mode should belong to the same class, so that the class of the network intrusion data may be the class corresponding to the target classification mode.
In one implementation, the advanced ART2 also requires parameter initialization, i.e., setting of each hyper-parameter, prior to pattern recognitionThe value of (c).
Specifically, the improved ART2 may be trained based on a genetic algorithm using a preset network intrusion data training set, a super-parameter may be obtained, and the parameter initialization of the improved ART2 may be performed using the super-parameter.
Illustratively, as a training set of models, a network intrusion data record may be described by 41 features, such as: 2, tcp, smtp, SF, 1684, 363, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0.00, 0.00, 0.00, 0.00, 1.00, 0.00, 0.00, 104, 66, 0.63, 0.03, 0.01, 0.00, 0.00, 0.00, 0.00, 0.00, normal, wherein normal in 42 th dimension represents data identification, 2, 3, 4, 7, 12, 14, 15, 21, 22 is discrete data, and the remaining 32 dimensions are continuous data, and an adjustment is made to the data after reading so that the continuous data to be processed is in 11 th to 32 th columns.
In practical application, the input data needs to be preprocessed: the character type variables (2 nd, 3 rd and 4 th dimensions) are converted into numerical type variables by defining preset arrays; the continuous variable is represented by the formula:
and normalizing the data after normalization.
Taking the second-dimension data as an example for description, for example, if the second-dimension variable is one of tcp, udp and icmp, a preset array protocol _ list = [ "tcp", "udp" and icmp ] is defined, and the character type variable and the position of the variable in the preset array are in one-to-one correspondence, that is, tcp- - -0; the third and the fourth dimensional variables are transformed in the same way.
Specifically, the process of training the genetic algorithm may include:
1) network initialization including but not limited to population size, population evolution times, cross probability, mutation probability, and determining coding mode (which may be binary coding).
2) Calculating the fitness, namely calculating the fitness value by utilizing a fitness function F; a higher fitness value indicates a greater chance of inheritance in the individual, and since the data is intended for intrusion detection, the accuracy rate is selected as a fitness function.
3) And selecting operation, wherein the individuals with higher fitness in the current group are inherited to the next group according to a certain rule or model, and generally, the individuals with high fitness are selected to have more chances to be inherited to the next generation group.
4) Crossover operations, crossover being the main operation in genetic algorithms to generate new individuals, interchange parts of chromosomes between two individuals with a given crossover probability.
5) Mutation operation, which is an operation method for generating new individuals by changing the gene value of one or some genes of an individual according to the input mutation probability.
6) When the evolution times reach the set times, the evolution is stopped, and the parameter corresponding to the maximum fitness is found outAnd output.
The adaptive function in the above process can be defined as:(TP indicates if an instance is a positive class and is predicted to be a positive class; FN indicates if an instance is a positive class but is predicted to be a negative class; FP indicates if an instance is a negative class but is predicted to be a positive class; and TN indicates if an instance is a negative class and is predicted to be a negative class.In particular, because of the multi-classification problem, for example I, if it belongs to the kth class, for I, the kth class is an example, and the other classes are negative classes).
In one implementation, the step 203 may further include, after:
and if the amplitude difference is smaller than the preset threshold, updating the internal star weight of the neuron corresponding to the target classification mode in the improved ART2 and memorizing.
In this embodiment, when the amplitude difference between the input mode and the target classification mode is smaller than the preset threshold, which means that the input mode and the target classification mode belong to the same class, the classification result may be output, and in order to learn the current classification process, the intra-star weight of the neuron corresponding to the target classification mode in the ART2 may be updated and stored.
As can be seen from the above, the method includes the steps of obtaining a feature vector input mode representing network intrusion data, performing mode recognition on the input mode by using the improved ART2, selecting a target classification mode, calculating an amplitude difference between the input mode and the target classification mode, and determining the category of the network intrusion data as a category corresponding to the target classification mode if the amplitude difference is smaller than a preset threshold; therefore, the improved ART2 is used for pattern recognition, after the target classification pattern which is most matched with the input pattern is recognized, secondary judgment is carried out according to the amplitude difference between the input pattern and the target classification pattern, and finally a more accurate pattern recognition result is obtained, so that the accuracy of network intrusion behavior classification is improved.
Fig. 3 shows a flow chart of another implementation of the network intrusion detection method based on the improved ART2 provided by the embodiment of the present application, which is detailed as follows:
in step 301, an input mode is acquired;
in step 302, performing mode recognition on the input mode by using an improved ART2, and selecting a target classification mode;
in step 303, the amplitude difference between the input pattern and the target classification pattern is calculated.
In step 304, if the amplitude difference is smaller than the preset threshold, the class of the network intrusion data is determined as the class corresponding to the target classification mode.
The steps 301 to 304 may specifically refer to the steps 201 to 204 in the embodiment of fig. 2, and are not described herein again.
In step 305, if the amplitude difference is not smaller than the preset threshold, the selected classification mode is suppressed; and reselecting the target classification mode, and executing the step of calculating the amplitude difference between the input mode and the target classification mode until the calculated amplitude difference between the input mode and the target classification mode is smaller than a preset threshold value.
In this embodiment, when the difference between the input mode and the target classification mode is not less than the preset threshold, that is, the difference between the input mode and the target classification mode is not less than the preset threshold, or the difference between the maximum amplitude is not less than the preset threshold, or the difference between the minimum amplitude and the maximum amplitude is not less than the preset threshold, this means that although the target classification mode identified by the improved ART2 mode is actually different from the input mode, the target classification mode should not belong to the same class. Then, the selected classification mode may be suppressed, and the step 302 may be skipped to reselect the target classification mode, and the following steps are performed until the calculated amplitude difference between the input mode and the target classification mode is smaller than the preset threshold.
Further, see fig. 3:
in step 306, if each classification mode of the plurality of classification modes is suppressed, a new classification mode is created, and the created new classification mode is determined as the classification of the network intrusion data.
In this embodiment, when each of the classification patterns learned in advance by the advanced ART2 is suppressed, which means that none of the classification patterns learned in advance matches the current input pattern, a new classification pattern may be created, and the created new classification pattern is determined as the category of the network intrusion data. Therefore, the improved ART2 has better continuous learning, new classification can be automatically identified and created in the face of diversified intrusion modes, and the accuracy of network intrusion behavior classification is further improved.
It should be understood that, the sequence numbers of the steps in the foregoing embodiments do not imply an execution sequence, and the execution sequence of each process should be determined by its function and inherent logic, and should not constitute any limitation to the implementation process of the embodiments of the present application.
The following are apparatus embodiments of the present application, and for details not described in detail therein, reference may be made to the corresponding method embodiments described above.
Fig. 4 shows a schematic structural diagram of a network intrusion detection device based on an improved ART2 provided in an embodiment of the present application, and for convenience of explanation, only the parts related to the embodiment of the present application are shown, which are detailed as follows:
as shown in fig. 4, the network intrusion detection device 4 includes: an acquisition unit 41, a recognition unit 42, a calculation unit 43 and a determination unit 44.
An obtaining unit 41, configured to obtain an input pattern, where the input pattern represents a feature vector of network intrusion data;
a recognition unit 42, configured to perform pattern recognition on the input pattern by using an improved ART2, and select a target classification pattern, where the improved ART2 learns a plurality of classification patterns in advance, the target classification pattern represents one of the classification patterns that is the closest to the input pattern, and a matching degree between the target classification pattern and the input pattern is not less than an alert value of the improved ART 2;
a calculating unit 43 for calculating a magnitude difference between the input pattern and the target classification pattern;
a determining unit 44, configured to determine, if the amplitude difference is smaller than a preset threshold, that the category of the network intrusion data is a category corresponding to the target classification mode.
In one implementation, the network intrusion detection device 4 further includes:
and the iteration processing unit is configured to, when the amplitude difference calculated by the calculating unit 43 is not less than the preset threshold, suppress the currently selected classification mode, reselect the target classification mode, and jump to the identifying unit 42 to re-execute the step of calculating the amplitude difference between the input mode and the target classification mode until the calculated amplitude difference between the input mode and the target classification mode is less than the preset threshold.
In one implementation, the determining unit 44 is further configured to create a new classification pattern when each classification pattern of the plurality of classification patterns is suppressed, and determine the created new classification pattern as the class of the network intrusion data.
In one implementation, the calculation unit 43 is specifically configured to:
calculating the maximum amplitude and the minimum amplitude of the input mode, and recording as the input maximum amplitude and the input minimum amplitude; calculating the maximum amplitude and the minimum amplitude of the target classification mode, and recording the maximum amplitude and the minimum amplitude as feedback maximum amplitude and feedback minimum amplitude; calculating the absolute value of the difference between the input maximum amplitude and the feedback maximum amplitude, and recording the absolute value as a first difference value; calculating the absolute value of the difference between the input minimum amplitude and the feedback minimum amplitude, and recording the absolute value as a second difference value;
if the first difference value and the second difference value are both smaller than a preset threshold value, determining that the amplitude difference is smaller than the preset threshold value; and if any one of the first difference value and the second difference value is not smaller than a preset threshold value, determining that the amplitude difference is not smaller than the preset threshold value.
In one implementation, the network intrusion detection apparatus further includes: and the initialization unit is used for training the improved ART2 by utilizing a preset network intrusion data training set based on a genetic algorithm, acquiring a super parameter and initializing the parameter of the improved ART2 by utilizing the super parameter.
In one implementation, the network intrusion detection apparatus further includes:
and the weight updating unit is used for updating and memorizing the intra-star weight of the neuron corresponding to the target classification mode in the improved ART2 when the amplitude difference is smaller than a preset threshold value.
In one implementation, the comparison layer of the attention subsystem of the improved ART2 includes a first amplitude recording neuron and a second amplitude recording neuron; wherein the first amplitude recording neuron is configured to record a maximum amplitude of an input pattern; the second amplitude record is used to record the minimum amplitude of the input pattern.
As can be seen from the above, the method includes the steps of obtaining a feature vector input mode representing network intrusion data, performing mode recognition on the input mode by using the improved ART2, selecting a target classification mode, calculating an amplitude difference between the input mode and the target classification mode, and determining the category of the network intrusion data as a category corresponding to the target classification mode if the amplitude difference is smaller than a preset threshold; therefore, the improved ART2 is used for pattern recognition, after the target classification pattern which is most matched with the input pattern is recognized, secondary judgment is carried out according to the amplitude difference between the input pattern and the target classification pattern, and finally a more accurate pattern recognition result is obtained, so that the accuracy of network intrusion behavior classification is improved.
Fig. 5 is a schematic diagram of a terminal according to an embodiment of the present application. As shown in fig. 5, the terminal 5 of this embodiment includes: a processor 50, a memory 51 and a computer program 52 stored in the memory 51 and executable on the processor 50. The processor 50, when executing the computer program 52, implements the steps of the various embodiments of the network intrusion detection method based on the improved ART2 described above, such as the steps 101 to 104 shown in fig. 1. Alternatively, the processor 50, when executing the computer program 52, implements the functions of the units in the above-described device embodiments, such as the functions of the units 41 to 43 shown in fig. 4.
Illustratively, the computer program 52 may be divided into one or more units, which are stored in the memory 51 and executed by the processor 50 to accomplish the present application. One or more of the elements may be a series of computer program instruction segments capable of performing specific functions, which are used to describe the execution of the computer program 52 in the terminal 5. For example, the computer program 52 may be divided into an acquisition unit 41, a recognition unit 42, a calculation unit 43 and a determination unit 44.
The terminal 5 may be a desktop computer, a notebook, a palm computer, a cloud server, or other computing devices. The terminal may include, but is not limited to, a processor 50, a memory 51. It will be appreciated by those skilled in the art that fig. 5 is only an example of a terminal 5 and does not constitute a limitation of the terminal 5 and may include more or less components than those shown, or some components in combination, or different components, for example the terminal may also include input output devices, network access devices, buses, etc.
The Processor 50 may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic, discrete hardware components, etc. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.
The memory 51 may be an internal storage unit of the terminal 5, such as a hard disk or a memory of the terminal 5. The memory 51 may also be an external storage device of the terminal 5, such as a plug-in hard disk provided on the terminal 5, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), and the like. Further, the memory 51 may also include both an internal storage unit of the terminal 5 and an external storage device. The memory 51 is used for storing the computer program and other programs and data required by the terminal. The memory 51 may also be used to temporarily store data that has been output or is to be output.
It will be apparent to those skilled in the art that, for convenience and brevity of description, only the above-mentioned division of the functional units and modules is illustrated, and in practical applications, the above-mentioned function distribution may be performed by different functional units and modules according to needs, that is, the internal structure of the apparatus is divided into different functional units or modules to perform all or part of the above-mentioned functions. Each functional unit and module in the embodiments may be integrated in one processing unit, or each unit may exist alone physically, or two or more units are integrated in one unit, and the integrated unit may be implemented in a form of hardware, or in a form of software functional unit. In addition, specific names of the functional units and modules are only for convenience of distinguishing from each other, and are not used for limiting the protection scope of the present application. The specific working processes of the units and modules in the system may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
In the above embodiments, the descriptions of the respective embodiments have respective emphasis, and reference may be made to the related descriptions of other embodiments for parts that are not described or illustrated in a certain embodiment.
Those of ordinary skill in the art will appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
In the embodiments provided in the present application, it should be understood that the disclosed apparatus/terminal and method may be implemented in other ways. For example, the above-described apparatus/terminal embodiments are merely illustrative, and for example, the division of the modules or units is only one type of logical function division, and other division manners may exist in actual implementation, for example, a plurality of units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in an electrical, mechanical or other form.
The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.
In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.
The integrated modules/units, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, all or part of the flow in the method of the embodiments described above can be realized by a computer program, which can be stored in a computer-readable storage medium and can realize the steps of the embodiments of the methods described above when the computer program is executed by a processor. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, Read-Only Memory (ROM), Random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like. It should be noted that the computer readable medium may contain other components which may be suitably increased or decreased as required by legislation and patent practice in jurisdictions, for example, in some jurisdictions, computer readable media which may not include electrical carrier signals and telecommunications signals in accordance with legislation and patent practice.
The above-mentioned embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; such modifications and substitutions do not substantially depart from the spirit and scope of the embodiments of the present application and are intended to be included within the scope of the present application.
Claims (10)
1. A network intrusion detection method based on improved ART2 is characterized by comprising the following steps:
acquiring an input mode, wherein the input mode represents a feature vector of network intrusion data;
performing pattern recognition on the input pattern by using an improved ART2, and selecting a target classification pattern, wherein the improved ART2 learns a plurality of classification patterns in advance, the target classification pattern represents one of the classification patterns which is most matched with the input pattern, and the matching degree of the target classification pattern and the input pattern is not less than the alert value of the improved ART 2;
calculating the amplitude difference of the input mode and the target classification mode;
and if the amplitude difference is smaller than a preset threshold value, determining the category of the network intrusion data as the category corresponding to the target classification mode.
2. The network intrusion detection method of claim 1, wherein after the calculating the magnitude difference of the input pattern and the target classification pattern, the method further comprises:
and if the amplitude difference is not smaller than a preset threshold value, inhibiting the selected classification mode, reselecting a target classification mode, and executing the step of calculating the amplitude difference between the input mode and the target classification mode until the calculated amplitude difference between the input mode and the target classification mode is smaller than the preset threshold value.
3. The method of network intrusion detection according to claim 2, the method further comprising:
and if all the classification modes in the plurality of classification modes are inhibited, creating a new classification mode, and determining the created new classification mode as the class of the network intrusion data.
4. The network intrusion detection method according to any one of claims 1 to 3, wherein the calculating the magnitude difference of the input pattern and the target classification pattern comprises:
calculating the maximum amplitude and the minimum amplitude of the input mode, and recording as the input maximum amplitude and the input minimum amplitude;
calculating the maximum amplitude and the minimum amplitude of the target classification mode, and recording the maximum amplitude and the minimum amplitude as feedback maximum amplitude and feedback minimum amplitude;
calculating the absolute value of the difference between the input maximum amplitude and the feedback maximum amplitude, and recording the absolute value as a first difference value;
calculating the absolute value of the difference between the input minimum amplitude and the feedback minimum amplitude, and recording the absolute value as a second difference value;
if the first difference value and the second difference value are both smaller than a preset threshold value, determining that the amplitude difference is smaller than the preset threshold value;
and if any one of the first difference value and the second difference value is not smaller than a preset threshold value, determining that the amplitude difference is not smaller than the preset threshold value.
5. The network intrusion detection method according to claim 4, further comprising, prior to the pattern recognition of the input pattern using the enhanced ART 2:
training the improved ART2 by using a preset network intrusion data training set based on a genetic algorithm, acquiring a super parameter, and initializing the parameter of the improved ART2 by using the super parameter.
6. The network intrusion detection method of claim 4, further comprising, after the calculating the magnitude difference between the input pattern and the target classification pattern:
and if the amplitude difference is smaller than a preset threshold value, updating the internal star weight of the neuron corresponding to the target classification mode in the improved ART2 and memorizing.
7. The network intrusion detection method according to claim 4, wherein the comparison layer of the attention subsystem of the enhanced ART2 includes a first amplitude recording neuron and a second amplitude recording neuron;
wherein the first amplitude recording neuron is configured to record a maximum amplitude of an input pattern;
the second amplitude record is used to record the minimum amplitude of the input pattern.
8. A network intrusion detection device based on an improved ART2, comprising:
the device comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring an input mode, and the input mode represents a feature vector of network intrusion data;
a recognition unit, configured to perform pattern recognition on the input pattern by using an improved ART2, and select a target classification pattern, where the improved ART2 learns a plurality of classification patterns in advance, the target classification pattern represents one of the classification patterns that is the most matched with the input pattern, and a matching degree of the target classification pattern and the input pattern is not less than an alert value of the improved ART 2;
a calculating unit, configured to calculate a magnitude difference between the input pattern and the target classification pattern;
and the determining unit is used for determining the category of the network intrusion data as the category corresponding to the target classification mode if the amplitude difference is smaller than a preset threshold value.
9. A terminal comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor when executing the computer program implements the steps of the improved ART2 based network intrusion detection method according to any one of claims 1 to 7.
10. A computer readable storage medium storing a computer program, wherein the computer program when executed by a processor implements the steps of the improved ART2 based network intrusion detection method according to any one of claims 1 to 7.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210445030.8A CN114567512B (en) | 2022-04-26 | 2022-04-26 | Network intrusion detection method, device and terminal based on improved ART2 |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN202210445030.8A CN114567512B (en) | 2022-04-26 | 2022-04-26 | Network intrusion detection method, device and terminal based on improved ART2 |
Publications (2)
Publication Number | Publication Date |
---|---|
CN114567512A true CN114567512A (en) | 2022-05-31 |
CN114567512B CN114567512B (en) | 2022-08-23 |
Family
ID=81721122
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
CN202210445030.8A Active CN114567512B (en) | 2022-04-26 | 2022-04-26 | Network intrusion detection method, device and terminal based on improved ART2 |
Country Status (1)
Country | Link |
---|---|
CN (1) | CN114567512B (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN116866047A (en) * | 2023-07-18 | 2023-10-10 | 山东溯源安全科技有限公司 | Method, medium and device for determining malicious equipment in industrial equipment network |
Citations (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
FR2714748A1 (en) * | 1993-12-30 | 1995-07-07 | Caterpillar Inc | Supervised learning of modified adaptive resonance neural network |
US6301572B1 (en) * | 1998-12-02 | 2001-10-09 | Lockheed Martin Corporation | Neural network based analysis system for vibration analysis and condition monitoring |
CN101667252A (en) * | 2009-10-15 | 2010-03-10 | 哈尔滨工业大学 | Classification and identification method for communication signal modulating mode based on ART2A-DWNN |
CN101834875A (en) * | 2010-05-27 | 2010-09-15 | 华为技术有限公司 | Method, device and system for defending DDoS (Distributed Denial of Service) attacks |
CN106599927A (en) * | 2016-12-20 | 2017-04-26 | 中国电子科技集团公司第五十四研究所 | Target grouping method based on fuzzy ART division |
CN108830244A (en) * | 2018-06-22 | 2018-11-16 | 石家庄铁道大学 | Determination method based on ART2 neural network classification |
CN109347872A (en) * | 2018-11-29 | 2019-02-15 | 电子科技大学 | A kind of network inbreak detection method based on fuzziness and integrated study |
CN109768985A (en) * | 2019-01-30 | 2019-05-17 | 电子科技大学 | A kind of intrusion detection method based on traffic visualization and machine learning algorithm |
CN109993182A (en) * | 2017-12-29 | 2019-07-09 | 中移(杭州)信息技术有限公司 | A kind of mode identification method and device based on Fuzzy ART |
KR20200043725A (en) * | 2018-10-18 | 2020-04-28 | 한국과학기술원 | Hierarchical classification-based incremental class learning method and computing device for digital storytelling |
CN111181939A (en) * | 2019-12-20 | 2020-05-19 | 广东工业大学 | Network intrusion detection method and device based on ensemble learning |
US20200280579A1 (en) * | 2017-09-14 | 2020-09-03 | University Of Manitoba | System and method for analyzing internet traffic to detect distributed denial of service (ddos) attack |
CN112464851A (en) * | 2020-12-08 | 2021-03-09 | 国网陕西省电力公司电力科学研究院 | Smart power grid foreign matter intrusion detection method and system based on visual perception |
CN112734094A (en) * | 2020-12-30 | 2021-04-30 | 中南大学 | Smart city intelligent rail vehicle fault gene prediction method and system |
CN113489711A (en) * | 2021-07-01 | 2021-10-08 | 中国电信股份有限公司 | DDoS attack detection method, system, electronic device and storage medium |
-
2022
- 2022-04-26 CN CN202210445030.8A patent/CN114567512B/en active Active
Patent Citations (15)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
FR2714748A1 (en) * | 1993-12-30 | 1995-07-07 | Caterpillar Inc | Supervised learning of modified adaptive resonance neural network |
US6301572B1 (en) * | 1998-12-02 | 2001-10-09 | Lockheed Martin Corporation | Neural network based analysis system for vibration analysis and condition monitoring |
CN101667252A (en) * | 2009-10-15 | 2010-03-10 | 哈尔滨工业大学 | Classification and identification method for communication signal modulating mode based on ART2A-DWNN |
CN101834875A (en) * | 2010-05-27 | 2010-09-15 | 华为技术有限公司 | Method, device and system for defending DDoS (Distributed Denial of Service) attacks |
CN106599927A (en) * | 2016-12-20 | 2017-04-26 | 中国电子科技集团公司第五十四研究所 | Target grouping method based on fuzzy ART division |
US20200280579A1 (en) * | 2017-09-14 | 2020-09-03 | University Of Manitoba | System and method for analyzing internet traffic to detect distributed denial of service (ddos) attack |
CN109993182A (en) * | 2017-12-29 | 2019-07-09 | 中移(杭州)信息技术有限公司 | A kind of mode identification method and device based on Fuzzy ART |
CN108830244A (en) * | 2018-06-22 | 2018-11-16 | 石家庄铁道大学 | Determination method based on ART2 neural network classification |
KR20200043725A (en) * | 2018-10-18 | 2020-04-28 | 한국과학기술원 | Hierarchical classification-based incremental class learning method and computing device for digital storytelling |
CN109347872A (en) * | 2018-11-29 | 2019-02-15 | 电子科技大学 | A kind of network inbreak detection method based on fuzziness and integrated study |
CN109768985A (en) * | 2019-01-30 | 2019-05-17 | 电子科技大学 | A kind of intrusion detection method based on traffic visualization and machine learning algorithm |
CN111181939A (en) * | 2019-12-20 | 2020-05-19 | 广东工业大学 | Network intrusion detection method and device based on ensemble learning |
CN112464851A (en) * | 2020-12-08 | 2021-03-09 | 国网陕西省电力公司电力科学研究院 | Smart power grid foreign matter intrusion detection method and system based on visual perception |
CN112734094A (en) * | 2020-12-30 | 2021-04-30 | 中南大学 | Smart city intelligent rail vehicle fault gene prediction method and system |
CN113489711A (en) * | 2021-07-01 | 2021-10-08 | 中国电信股份有限公司 | DDoS attack detection method, system, electronic device and storage medium |
Non-Patent Citations (2)
Title |
---|
WU DI等: ""Intrusion Detection Based on An Improved ART2 Neural Network"", 《SIXTH INTERNATIONAL CONFERENCE ON PARALLEL AND DISTRIBUTED COMPUTING APPLICATIONS AND TECHNOLOGIES (PDCAT"05)》 * |
徐艺萍等: ""一种改进的ART2网络学习算法"", 《计算机应用》 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN116866047A (en) * | 2023-07-18 | 2023-10-10 | 山东溯源安全科技有限公司 | Method, medium and device for determining malicious equipment in industrial equipment network |
Also Published As
Publication number | Publication date |
---|---|
CN114567512B (en) | 2022-08-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
WO2019109743A1 (en) | Url attack detection method and apparatus, and electronic device | |
CN111753881B (en) | Concept sensitivity-based quantitative recognition defending method against attacks | |
JP2022141931A (en) | Method and device for training living body detection model, method and apparatus for living body detection, electronic apparatus, storage medium, and computer program | |
CN113297572B (en) | Deep learning sample-level anti-attack defense method and device based on neuron activation mode | |
CN110807468B (en) | Method, device, equipment and storage medium for detecting abnormal mail | |
CN111062036A (en) | Malicious software identification model construction method, malicious software identification medium and malicious software identification equipment | |
WO2021168617A1 (en) | Processing method and apparatus for service risk management, electronic device, and storage medium | |
CN112766324A (en) | Image confrontation sample detection method, system, storage medium, terminal and application | |
Zhao et al. | CLPA: Clean-label poisoning availability attacks using generative adversarial nets | |
CN114567512B (en) | Network intrusion detection method, device and terminal based on improved ART2 | |
CN114140670B (en) | Method and device for verifying ownership of model based on exogenous characteristics | |
CN117454187B (en) | Integrated model training method based on frequency domain limiting target attack | |
CN111694954A (en) | Image classification method and device and electronic equipment | |
EP4127984B1 (en) | Neural network watermarking | |
CN114285587A (en) | Domain name identification method and device and domain name classification model acquisition method and device | |
CN111917781A (en) | Intelligent internal malicious behavior network attack identification method and electronic equipment | |
CN116484274A (en) | Robust training method for neural network algorithm poisoning attack | |
CN113557567A (en) | Speaker recognition system and method of use | |
CN114492653A (en) | Training method and device of classifier and electronic equipment | |
LU505793B1 (en) | Defensive method against interpretability camouflage samples in deep recognition neural networks | |
CN111507198B (en) | Training method for printing iris detection model, and printing iris detection method and device | |
Narayana et al. | Effective Machine Leaning Based Malware detection and Classification Using Improved Voting Method based Decision Tree | |
WO2024105036A1 (en) | A method of assessing vulnerability of an ai system and a framework thereof | |
CN116994062A (en) | License classification method, device, equipment and medium | |
Lad et al. | Fast Gradient Sign Method (FGSM) Variants in White Box Settings: A Comparative Study |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PB01 | Publication | ||
PB01 | Publication | ||
SE01 | Entry into force of request for substantive examination | ||
SE01 | Entry into force of request for substantive examination | ||
GR01 | Patent grant | ||
GR01 | Patent grant |