CN115422995A - Intrusion detection method for improving social network and neural network - Google Patents

Intrusion detection method for improving social network and neural network Download PDF

Info

Publication number
CN115422995A
CN115422995A CN202210929517.3A CN202210929517A CN115422995A CN 115422995 A CN115422995 A CN 115422995A CN 202210929517 A CN202210929517 A CN 202210929517A CN 115422995 A CN115422995 A CN 115422995A
Authority
CN
China
Prior art keywords
neural network
intrusion detection
network
algorithm
data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
CN202210929517.3A
Other languages
Chinese (zh)
Inventor
杨忠君
王琪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenyang University of Chemical Technology
Original Assignee
Shenyang University of Chemical Technology
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenyang University of Chemical Technology filed Critical Shenyang University of Chemical Technology
Priority to CN202210929517.3A priority Critical patent/CN115422995A/en
Publication of CN115422995A publication Critical patent/CN115422995A/en
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods
    • G06N3/084—Backpropagation, e.g. using gradient descent
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Computing Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Evolutionary Computation (AREA)
  • Biophysics (AREA)
  • Molecular Biology (AREA)
  • Biomedical Technology (AREA)
  • Artificial Intelligence (AREA)
  • General Physics & Mathematics (AREA)
  • Computational Linguistics (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

The invention discloses an intrusion detection method for improving a social network and a neural network, and relates to an intrusion detection method for improving a network. And encoding the operation parameters of the BP neural network to serve as individuals of the improved social network, performing population initialization by using chaotic initialization, taking an error function as an adaptive value function of an improved social network algorithm, selecting parameters with optimal fitness after multiple iterations as an initial weight and a threshold of the BP neural network for training, and finally applying the trained BP neural network to a classifier of intrusion detection. The method improves the detection accuracy of the BP neural network in network intrusion detection by improving the defects that the BP neural network is easy to fall into a local minimum value and has low convergence speed due to the randomization of initial parameters.

Description

Intrusion detection method for improving social network and neural network
Technical Field
The invention relates to an intrusion detection method for an improved network, in particular to an intrusion detection method for an improved social network and a neural network.
Background
The process of discovery of attempted or ongoing network intrusion behavior in a network is referred to as intrusion detection. The emphasis is on the analysis of network traffic, detecting anomalies and discriminating correctly. In recent years, the serious security accidents of network intrusion behaviors suffered by various countries are increasing, the influence is also increasing, and the information security of each person is threatened continuously. By collecting and analyzing system flow and protocol information in real time, the intrusion detection system judges and classifies various behaviors in the network.
Machine learning methods have been widely used to identify different types of attacks, and can help network administrators to take appropriate actions to cope with network intrusions. However, most of the conventional machine learning methods belong to shallow learning, require artificial large amount of feature classification and feature selection, and they cannot solve the classification problem of large amount of attack and intrusion data faced in real network application environment. In addition, shallow learning is not suitable for the prediction requirements of intelligent analysis and high-dimensional learning of mass data. The BP neural network model has good adaptability, self-learning and nonlinear approximation capabilities, can meet the requirements, and is widely applied to the fields of prediction, modeling, classification, adaptive control and the like. The BP neural network is applied to intrusion detection on network attacks by Liangchen and the like (PCA-BP neural network intrusion detection method [ J ]. University of air force study (Nature science edition), 2016, 17 (6): 93-98.), and the BP neural network is proved to have higher detection accuracy, lower false alarm rate and lower false alarm rate compared with the traditional intrusion detection.
Liusan et al (PSO-BP intrusion detection research [ J ] based on PCA. Computer application research, 2016,33 (09): 2795-2798.) propose a PSO-BP intrusion detection model based on PCA, which is optimized by a variable inertia factor particle swarm algorithm, and although a good classification effect is obtained, the PSO-BP intrusion detection model does not perform well on small sample balance data, tyvek et al (an improved HS algorithm optimizes the intrusion detection research [ J ] of the BP neural network, computer engineering and science, 2019,41 (01): 65-72.) use an improved harmonic search algorithm (HS) to optimize the BP neural network for intrusion detection, wherein the initial value of the BP neural network is optimized by the improved harmonic search algorithm, but the parameters are excessively set, rayufei et al (a research [ J ] software engineering based on the intrusion detection technology optimization algorithm of the PSO-BP neural network, 2017, 20 (9): 49-51.) use the PSO-BP neural network model in intrusion detection, the optimal initial value is optimized by the particle swarm optimization algorithm, and the optimal convergence speed is obtained, and the error is guaranteed by iterative optimization.
The Social Network Search (SNS) algorithm was proposed by Siamak et al (Social Network Search for global optimization J. IEEE Access, 2021, 9: 92815-92863.) in 9 months of 2021, mainly mimicking the Social behavior of people, and the main part of the algorithm was four individual random update behaviors without setting other parameters. The algorithm fully considers the mutual connection among individuals and introduces more random parts, so that the algorithm has better population diversity and higher convergence rate in the early stage of iteration. However, an optimal individual guiding mechanism is not involved, and a random initialization method is adopted, so that most individuals are trapped in local optimization and are difficult to separate when a seed group is initialized, and the convergence effect of an algorithm is influenced. The advantages and the disadvantages of the SNS algorithm are fully considered, and an Improved Social Network Service (ISNS) based intrusion detection method is provided for optimizing the BP neural Network. With the ISNS algorithm we can get better initial weights and thresholds, which are then fine-tuned by back-propagation. Therefore, the problem that the BP neural network is easy to fall into a local optimal state is solved.
Disclosure of Invention
The invention aims to provide an intrusion detection method for improving a social network and a neural network, which combines an improved social network algorithm and an intrusion detection method for a BP (back propagation) neural network, obtains better weight and threshold by using excellent optimizing capability of the improved social network, establishes a neural network model to detect network data, avoids the problem that the traditional BP neural network is easy to fall into a local optimal value, improves the detection rate of network attack and reduces the false alarm rate.
The purpose of the invention is realized by the following technical scheme:
a method of improving intrusion detection in social and neural networks, the method comprising the steps of:
s1, collecting and preprocessing network security data to serve as intrusion detection model training data; the pretreatment specifically comprises the following steps:
step S1-1, digitizing, namely, expanding character type characteristics in the intrusion detection data into unit vectors through One-hot operation to complete digitization; assuming that the feature has i feature values, it is set to a corresponding one of {0, 1.., i-1 };
s1-2, normalizing, scaling the data, and uniformly mapping the data to the range of [ -1,1 ]; the calculation expression is shown in formula (1):
Figure RE-93168DEST_PATH_IMAGE001
where x denotes the original data, x max Representing the upper bound, x, of the original data min Representing the lower bound of the original data, y representing the data after normalization, y max Representing the upper bound, y, of the normalized data min Represents the lower bound of the normalized data;
s2, designing a BP neural network model, and setting corresponding activation functions for neurons of a hidden layer and an output layer; the BP neural network is a machine learning algorithm and is a calculation model simulating the structure and the function of a biological neural network; the neural network is calculated by connecting a large number of artificial neurons, and is a self-adaptive system; the method specifically comprises the following steps:
s2-1, setting the number of nodes of a network layer, and setting the number of neurons of an input layer, a hidden layer and an output layer; the number of input layer and output layer nodes is determined by the input data dimensions and data types. The number of nodes of the hidden layer is determined by the number of nodes of the input layer and the output layer;
s2-2, establishing connection among the input layer, the hidden layer and the output layer of the neural network, and setting corresponding weight and threshold parameters;
s2-3, setting corresponding activation functions for neurons of the hidden layer and the output layer to enable the neural network model to have classification characteristics;
s3, pre-training a neural network model by using an improved social network algorithm, and outputting an optimal initial trial weight and a threshold vector; the improved social network algorithm is formed by combining Logistic chaotic mapping and an elite mechanism on the basis of a classical social network algorithm;
the improved social networking algorithm also simulates the behavior of users expressing opinions in the social network and acts as an optimization operation step. Assuming that the social user scale is N and the elite number is N × rate in the D-dimensional space, the position of each social individual is initialized by using Logistic chaotic map, and is denoted as X = { X = { X } 1 ，X 2 ，X 3 ...，X N }; sorting each round based on each fitness, selecting top N rate individuals as elite, and then respectively carrying out optimization operation;
the improved social networking algorithm is divided into two parts: the first part is the optimization of elite individuals, and the second part is the optimization of common individuals;
step S3-1. Elite individual optimization operation: the Elite individuals perform iterative loop, only perform Mood2, namely dialogue action, and simultaneously dialogue individuals
Figure RE-255159DEST_PATH_IMAGE002
From the elite population and randomly selected,
Figure RE-500677DEST_PATH_IMAGE003
；
Figure RE-785028DEST_PATH_IMAGE004
step S3-2, carrying out optimization operation on common individuals, wherein the optimization operation is randomly selected from Mood1 to Mood4 each time:
and Mood1: when individuals underwent Mood1 (mock behavior), 80% of them mock random elite individuals, the remaining 20% of them mock randomly,
Figure RE-RE-DEST_PATH_IMAGE005
mood2: the user can see the event through other viewpoints, and finally, because of different opinions, they can form a new view angle for the problem according to the formula:
Figure RE-135238DEST_PATH_IMAGE006
here, the
Figure RE-DEST_PATH_IMAGE007
For a conversation object to be selected at random,
Figure RE-350188DEST_PATH_IMAGE008
is a chat effect and can produce different feedback effects based on different viewpoints. It should be noted that
Figure RE-RE-DEST_PATH_IMAGE009
Is randomly selected, and
Figure RE-656404DEST_PATH_IMAGE010
。
Figure RE-RE-DEST_PATH_IMAGE011
namely that
Figure RE-783760DEST_PATH_IMAGE011
The function of the function(s) is,
Figure RE-870534DEST_PATH_IMAGE012
、
Figure RE-RE-DEST_PATH_IMAGE013
respectively correspond to the individuals
Figure RE-374327DEST_PATH_IMAGE014
An individual
Figure RE-RE-DEST_PATH_IMAGE015
The corresponding fitness value; by comparison
Figure RE-865876DEST_PATH_IMAGE016
To determine
Figure RE-164133DEST_PATH_IMAGE007
The direction of movement of (a);
and Mood3: when the individual carries out Mood3 (dispute behavior), carrying out Mood3 behavior with the elite individual; when a certain dimension among the elite group is optimal, the position variable average value M of the elite group can better converge for the dimension of the iterative individual;
Figure RE-RE-DEST_PATH_IMAGE017
and 4, mood: by changing the concept of a topic in a subject, the general concept of the subject will change and a new perspective will be achieved; with this concept, a new view is created by innovating emotions as follows:
Figure RE-738203DEST_PATH_IMAGE018
wherein the content of the first and second substances,
Figure RE-DEST_PATH_IMAGE019
is in the interval [1, D ]]D is the number of the problem variables;
Figure RE-45687DEST_PATH_IMAGE020
and
Figure RE-RE-DEST_PATH_IMAGE021
is the interval [0,1]Two independent random numbers of (1); in addition to this, the present invention is,
Figure RE-123234DEST_PATH_IMAGE022
and
Figure RE-RE-DEST_PATH_IMAGE023
is the maximum and minimum of the d variable;
Figure RE-857972DEST_PATH_IMAGE024
a new value representing the d dimension for the problem;
Figure RE-RE-DEST_PATH_IMAGE025
is selected by another user (randomly selected first)
Figure RE-653758DEST_PATH_IMAGE015
Individual users) current ideas about the d-dimensional variable;
s3-3, judging whether a termination condition is met, if not, returning to the S3-1 and the S3-2 to continue optimization, otherwise, outputting an optimal individual position;
s4, setting an initial weight and a threshold of the neural network model according to the optimal honey source position vector output in the step S3;
s5, designing a back propagation algorithm and training a neural network by using intrusion detection data to obtain a neural network intrusion detection model; the back propagation algorithm is a universal method for training a neural network, and the weight and the threshold of the neural network are adjusted by minimizing a loss function of the neural network; the method specifically comprises the following steps:
s5-1, designing a back propagation algorithm; selecting cross entropy as a cost function, and avoiding overfitting of neural network training;
Figure RE-827250DEST_PATH_IMAGE026
wherein
Figure RE-RE-DEST_PATH_IMAGE027
The predicted label is output by the current model, and y is the true value of the current label;
selecting a random gradient descent method, adjusting the weight and the threshold value in the negative gradient direction of the loss function, iteratively reducing the value of the loss function, adding a random factor when calculating the gradient in order to improve the capability of jumping out of a local minimum value in the neural network training process, even if the calculated gradient is trapped in a local minimum point, possibly not being zero, and having an opportunity of jumping out of a local minimum for continuous search;
s5-2, taking the intrusion detection data as training data of the neural network, and training the neural network model by using a back propagation algorithm to obtain a neural network intrusion detection model;
and S6, designing a network intrusion detection software module according to the neural network intrusion detection model, deploying the network intrusion detection software module in a network environment to detect network data traffic in real time, and giving an alarm to the detected abnormal network traffic.
The network intrusion detection software module specifically comprises the following modules:
the attack early warning module is the first layer of network intrusion detection software, monitors the change of a request flow in real time, and forwards the flow to the flow preprocessing module for preliminary processing when the request flow reaches a certain limited threshold value;
the flow preprocessing module collects the received network flow data packet, performs data preprocessing on the data packet, and sends the data packet to the neural network intrusion detection module.
The network intrusion detection software module specifically comprises the following modules:
the neural network intrusion detection module receives the data packet forwarded by the flow preprocessing module, and the neural network intrusion detection module detects the data packet;
and the attack response module receives the detection result of the neural network intrusion detection module and generates corresponding alarm information for the data with abnormal detection result.
The invention has the advantages and effects.
Drawings
FIG. 1 is a flow diagram of an improved social networking algorithm;
FIG. 2 is a flow chart of an intrusion detection method based on an improved social networking algorithm;
FIG. 3 is a graph of the performance of a social networking algorithm versus an improved social networking algorithm;
FIG. 4 is a boxed graph of a social networking algorithm and an improved social networking algorithm;
FIG. 5 is a graph of performance of an improved social networking algorithm versus other algorithms;
FIG. 6 is a box diagram of a class four crowd-sourcing algorithm;
FIG. 7 is a diagram of an improvement of the invention to social networking algorithm population initialization;
FIG. 8 is a diagram of the present invention for modeling behavior improvement for a social networking algorithm;
FIG. 9 is a diagram illustrating the improvement of dispute behavior of social networking algorithm according to the present invention.
Detailed Description
The present invention will be described in detail with reference to the embodiments shown in the drawings.
The invention discloses an intrusion detection method based on an improved social network algorithm, which comprises the following steps:
s1, collecting and preprocessing network security data to serve as intrusion detection model training data; the pretreatment specifically comprises the following steps:
s1-1, digitizing, namely, expanding character type characteristics in the intrusion detection data into unit vectors through One-hot operation to complete digitization; assuming that the feature has i feature values, it is set to a corresponding one of {0, 1.., i-1 };
s1-2, normalizing, scaling the data, and uniformly mapping the data to the range of [ -1,1 ]; the calculation expression is shown in formula (1):
Figure RE-775615DEST_PATH_IMAGE028
wherein x represents original data, xmax represents an upper bound of the original data, xmin represents a lower bound of the original data, y represents data after normalization, ymax represents an upper bound of the normalized data, and ymin represents a lower bound of the normalized data;
s2, designing a BP neural network model, and setting corresponding activation functions for neurons of a hidden layer and an output layer; the BP neural network is a machine learning algorithm and is a calculation model simulating the structure and the function of a biological neural network; the neural network is calculated by connecting a large number of artificial neurons, and is a self-adaptive system; the method specifically comprises the following steps:
s2-1, setting the number of nodes of a network layer, and setting the number of neurons of an input layer, a hidden layer and an output layer; the number of input layer and output layer nodes is determined by the input data dimensions and data types. The number of nodes of the hidden layer is jointly determined by the number of nodes of the input layer and the output layer.
S2-2, establishing connection among the input layer, the hidden layer and the output layer of the neural network, and setting corresponding weight and threshold parameters;
s2-3, setting corresponding activation functions for neurons of the hidden layer and the output layer to enable the neural network model to have classification characteristics;
s3, improving a classic social network algorithm; the classic social networking algorithm is basically described as: in a social network, the algorithm mainly simulates the behavior of users when expressing opinions: imitation, conversation, dispute and innovation, which are the real behaviors of people in social interaction. These behaviors are used as optimization operation steps and simulate how users are affected and motivated to share their new opinions. The algorithm regards the variables as the perspective of social individuals, and constantly optimizes the positions of the variables in the process of mutual communication, thereby outputting optimal values.
Behavior 1: simulation
When the attendee issues some views and information, we usually imitate them, so the mathematical formula of this imitation behavior can be expressed as:
Figure RE-RE-DEST_PATH_IMAGE029
in the formula
Figure RE-927592DEST_PATH_IMAGE030
Represents a random selection
Figure RE-RE-DEST_PATH_IMAGE031
A vector of individual positions. Wherein
Figure RE-961407DEST_PATH_IMAGE032
And
Figure RE-RE-DEST_PATH_IMAGE033
are each [ -1,1 [ ]]And [0,1]A random vector of intervals.
Figure RE-859962DEST_PATH_IMAGE034
Is an individual
Figure RE-DEST_PATH_IMAGE035
Of a magnitude of
Figure RE-849783DEST_PATH_IMAGE036
Multiples of (a).
Figure RE-988641DEST_PATH_IMAGE036
The value of (b) represents
Figure RE-509752DEST_PATH_IMAGE035
The prevalence radius of an individual is based on
Figure RE-759468DEST_PATH_IMAGE031
Individual and the first
Figure RE-931692DEST_PATH_IMAGE035
Individual differences were calculated.
Behavior 2: dialogue
In a dialog, the user can see the event from other viewpoints, and finally, due to the difference of opinions, they can form a new perspective for the problem according to the formula:
Figure RE-RE-DEST_PATH_IMAGE037
here, the
Figure RE-179134DEST_PATH_IMAGE038
For a conversation object to be selected at random,
Figure RE-RE-DEST_PATH_IMAGE039
is a chat effect and can produce different feedback effects based on different viewpoints. It should be noted that
Figure RE-439738DEST_PATH_IMAGE040
Is selected randomly, an
Figure RE-RE-DEST_PATH_IMAGE041
。
Figure RE-430828DEST_PATH_IMAGE042
Namely that
Figure RE-270608DEST_PATH_IMAGE042
The function of the function(s) is,
Figure RE-RE-DEST_PATH_IMAGE043
、
Figure RE-875902DEST_PATH_IMAGE044
respectively correspond to the individuals
Figure RE-168343DEST_PATH_IMAGE031
Individuals, and
Figure RE-212391DEST_PATH_IMAGE035
the corresponding fitness value. By comparison
Figure RE-RE-DEST_PATH_IMAGE045
To determine
Figure RE-844361DEST_PATH_IMAGE038
The direction of movement of (a).
Behavior 3: controversial matters
The debate mood imagines a state where users explain their opinion of the event to others and defend their own view. Under this emotion, a random number of users are considered to be members of a panel or group:
Figure RE-495922DEST_PATH_IMAGE046
Figure RE-RE-DEST_PATH_IMAGE047
is the average of the position vectors of reviewers or friends in the group.
Figure RE-728189DEST_PATH_IMAGE048
Is a permission factor that indicates how much the user agrees to the opinion when discussing with others.
Figure RE-RE-DEST_PATH_IMAGE049
Is a function that rounds its input to the nearest integer,
Figure RE-61081DEST_PATH_IMAGE049
is the interval [0,1]A random number of (2).
Figure RE-817333DEST_PATH_IMAGE050
Is the size of the panel or group of reviews, is 1 and
Figure RE-RE-DEST_PATH_IMAGE051
a random number in between, and a random number,
Figure RE-843058DEST_PATH_IMAGE051
is the number of users of the network (network size).
Behavior 4: innovation of
By changing the concept of a topic in a subject, the general concept of the subject will change and a new perspective will be realized. With this concept, a new view is created by innovating emotions as follows:
Figure RE-297041DEST_PATH_IMAGE052
wherein the content of the first and second substances,
Figure RE-RE-DEST_PATH_IMAGE053
is in the interval [1, D ]]D is the number of the problem variables.
Figure RE-433625DEST_PATH_IMAGE054
And
Figure RE-RE-DEST_PATH_IMAGE055
interval [0, 1]]Two independent random numbers in (1). In addition, in the case of the present invention,
Figure RE-23875DEST_PATH_IMAGE056
and
Figure RE-RE-DEST_PATH_IMAGE057
are the maximum and minimum values of the d-th variable.
Figure RE-220501DEST_PATH_IMAGE058
Representing a new value for the d-dimension of the problem.
Figure RE-RE-DEST_PATH_IMAGE059
Is selected by another user (randomly selected first)
Figure RE-161781DEST_PATH_IMAGE035
Individual users) about the d-th dimension variable.
In a social networking algorithm, each individual performs only one of four predefined models in each iteration, and the algorithm considers the chances of these behaviors occurring to be average. After the individual is subjected to the behavior model, the individual is compared with the adaptive value of the previous position, and the adaptive value is preferentially selected to replace the adaptive value until an iteration stop condition is reached.
S3-1, improving the social network algorithm initialization: the standard social network algorithm uses random initialization, so that population diversity and non-repeatability in a social group are difficult to guarantee, the algorithm efficiency is low, and the algorithm may fall into a local optimal value to a certain extent. The improved social network algorithm uses Logistic chaotic mapping to initialize individuals, so that the positions of the individuals can be uniformly distributed in a variable space, and the searching efficiency of the algorithm is improved.
Figure RE-898793DEST_PATH_IMAGE060
Wherein, the proportion of the position of the individual in the variable space is represented, and the current individual is represented as the bifurcation parameter. Logistic mapping at bifurcation parameter 3.57<And when the value is less than or equal to 4, the system is in a complete chaotic state, and the equation motion trail presents chaotic characteristics. A good effect is obtained when 4 is taken, where =4 is taken. The last initialized bit positions are:
Figure RE-RE-DEST_PATH_IMAGE061
；
step S3-2. Improvement added to the elite mechanism: in the standard social network algorithm, each iteration individual is selected from four random behaviors, but an optimal individual guiding mechanism is not provided, so that the convergence speed is low after the range of the target value is close, and the convergence is not easy. Thus, a social elite mechanism is introduced herein. The number of elite is N rate, N is the total population in the social network, and rate is the proportion of elite individuals to the total population. After the individual positions are initialized, the adaptive values of all individuals are sorted, and the experimental values are carried out before
Figure RE-549742DEST_PATH_IMAGE062
Each is elite and this step is performed for each iteration to update the social elite individual, the formula is as follows.
Figure RE-RE-DEST_PATH_IMAGE063
After an elite mechanism is introduced, four individual behaviors are correspondingly improved, and the elite mechanism is adapted:
1. individuals
Figure RE-917269DEST_PATH_IMAGE064
Performing an iterative loop if the individual
Figure RE-893315DEST_PATH_IMAGE064
If it is an elite individual, only Mood2, i.e. a dialogue action, is performed, and the individual is conversed at the same time
Figure RE-620969DEST_PATH_IMAGE035
From the elite population and randomly selected,
Figure RE-RE-DEST_PATH_IMAGE065
. The behavior utilizes a plurality of optimal individuals to directly carry out Mood2 with each other, so that the elite individuals are close to each other, the searching is carried out around the optimal value in the space variable, and the elite individuals trapped in local optimal can also be separated from the optimal value;
Figure RE-202123DEST_PATH_IMAGE066
2. mood1 was improved when individuals performed Mood1 (mimic behavior), in the original standard algorithm, individuals
Figure RE-537289DEST_PATH_IMAGE064
Will randomly select individuals
Figure RE-453162DEST_PATH_IMAGE035
Mood1 was performed. The behavior is improved, and in individuals performing the Mood1 behavior, 80% of individuals simulate random elite individuals, and the rest 20% of individuals simulate the random elite individuals, so that the convergence speed is increased, the approach is performed on the elite individuals, meanwhile, the vicinity of the elite individuals is searched, and the elite individuals are prevented from falling into local optimum. And the other 20% of individuals search randomly to search the variable space near the individuals;
Figure RE-RE-DEST_PATH_IMAGE067
3. mood3 was improved when individuals were
Figure RE-469659DEST_PATH_IMAGE064
When Mood3 (dispute behavior) is performed, the original standard algorithm group randomly selects a part of the whole population, and the behavior makes the algorithm more random, but also causes the optimal individual not to be converged better. Therefore, all elite individuals are referred to herein as elite cohorts, individuals
Figure RE-967637DEST_PATH_IMAGE064
Mood3 behavior with elite individuals. When the precision English group reaches the optimum in a certain dimension, the mean value M of the position variable of the precision English group is better to be an iterative individual
Figure RE-660655DEST_PATH_IMAGE064
This dimension converges.
Figure RE-876873DEST_PATH_IMAGE068
In order to verify the optimization performance of the improved SNS algorithm, the performance of the improved SNS optimization algorithm is tested by using three single-peak functions of a Step function, a Sphere function and an Ackley function and three multi-peak functions of a Girewank function, a Rastrigin function and an Alpine function. Table 1 shows the function expressions of 6 functions and the variables, such as the value ranges and the optimal values of the variables.
TABLE 1 Performance test function
Figure RE-RE-DEST_PATH_IMAGE069
In the function performance test experiment, the function dimension is 30, and the maximum iteration number is 100. In the PSO algorithm, c 1 =c 2 = ω =0.9; in both the SSA algorithm and the ISNS algorithm, the producer scale factor and the elite individual scale factor are 0.2. The maximum iteration number in the intrusion detection model is 1000, and the input layer and the output layer of the neural network are determined by the actual data setThe number of nodes in the hidden layer is 30.
The Step function, the Sphere function and the Ackley function are all single-peak functions, are used for checking the convergence speed of the algorithm approaching a target value in a large-range variable space, and meanwhile, three multi-peak functions of Girewank, rastrigin and Alpine are set, so that the algorithm can get rid of the local optimal capability under the condition that the algorithm has a plurality of local optimal values.
On three single peak functions of Step, sphere and Ackley, the convergence speed of the improved social network algorithm is obviously superior to that of the standard social network algorithm, and the optimal value is found earlier than that of the standard social network algorithm. And as can be seen in the box type fig. 4, the average value and the distribution range of the value of the improved social network algorithm are better than the performance of the social network algorithm; on three multi-peak functions of Girewank, rastrigin and Alpine, the improved social network algorithm can jump out a local optimal value by using chaos initialization and the guidance of an elite mechanism, and is fast converged. On the Girewank function, although the algorithm of the initial standard social network algorithm converges fast, in the follow-up view, the optimal value is not better approached. And the improved social network algorithm performs stable convergence. The above experiments demonstrate that the improved social networking algorithm is superior to the standard social networking algorithm in both convergence speed and convergence accuracy.
TABLE 2 test results for unimodal and multimodal functions
Figure RE-697061DEST_PATH_IMAGE070
Fig. 5 and 6 show the performance of the ISNS algorithm compared to the sparrow search algorithm, the particle swarm algorithm, and the grayish wolf algorithm on a single peak function and three multi-peak functions. As seen in a convergence curve and a box-type graph, the ISNS algorithm and the SSA algorithm are obviously superior to the PSO algorithm and the GWO algorithm in convergence speed and convergence accuracy, and can better and faster approach an optimal value. However, the image cannot better reflect the difference between the SSA algorithm and the ISNS algorithm, so the average value and the standard deviation of the output value of each iteration in the convergence process are calculated, and as can be seen from table 2, the ISNS algorithm is lower than the SSA algorithm in the average value and the standard deviation, which indicates that the ISNS algorithm converges to the optimal value earlier, and at the same time, a variable space where the optimal value exists is found earlier.
S4, applying the improved social network algorithm to the optimization of BP neural network parameters;
and S4-1, setting parameters of the improved social network, such as the scale M of the social network, the dimensionality D of the social individual, the maximum iteration number iter, a fitness function F (X), upper and lower position boundaries ub and lb and the proportion rate of the elite individual.
Dimension: dimension is input +1 + mid (out + 1), for example NSK-KDD, input layer 41, hidden layer 30, output layer 5, and therefore dimension 1415;
and (4) optimizing by using the cross entropy of the BP neural network output result and the tag set after one-hot processing as a cost function. A fitness function of a document (bat algorithm optimization neural network intrusion detection [ J ] computer simulation, 2015,32 (02): 311-314+ 445.) is selected as an intrusion detection accuracy rate, on one hand, the number of correct models to be classified needs to be counted, and the algorithm calculation amount is increased, and on the other hand, if the number of correct models to be classified is calculated improperly, the result of training the neural network is not ideal. The cross entropy function formula is as follows:
Figure RE-RE-DEST_PATH_IMAGE071
wherein
Figure RE-171249DEST_PATH_IMAGE072
And y is the actual value of the current label for the predicted label output by the model.
And S4-2, initializing the position of each individual by using Logistic chaotic mapping to establish a BP neural network, using data forward propagation to calculate the fitness of each individual by using a fitness function, and selecting an elite individual.
S4-3, updating the position according to the four updating behaviors of the improved social network, calculating the fitness value of the updated individual, comparing the current fitness value of the social individual with the fitness value of the previous round of the social individual, if the fitness value of the particle in the current iteration is superior to the fitness value of the previous round, keeping the current position of the particle, and if not, keeping the position unchanged;
s4-4, judging whether a termination condition is met, wherein the termination condition is that the maximum iteration times are reached or the error of the adaptive value reaches the set error limit of the adaptive value;
s4-5, if the termination condition is met, stopping iteration, and outputting globally optimal particles as initial weight and threshold of the BP neural network, otherwise, returning to the S4-3 to continue searching;
s4-6, continuing to train the neural network by using a BP algorithm;
s4-7, calculating a network training error;
and S4-8, judging whether the error reaches a target error, if not, continuing to train by using a BP algorithm, otherwise, ending the algorithm.
The intrusion detection method for optimizing the BP neural network based on the improved social network algorithm is characterized in that S3 and S4 comprise
In the intrusion detection method for optimizing the BP neural network based on the improved social network algorithm, the BP neural network is combined with the improved social network algorithm, the BP neural network is used as a classifier, the initial weight and value of the neural network are adjusted by continuously iterating and minimizing a cost function through the social network algorithm, then the BP algorithm is utilized to carry out more accurate search in the local space, and the optimal connection weight and threshold of the neural network are obtained, so that the compensation and tracking of unknown linear or nonlinear channels are realized, and the blind equalization purpose is achieved.
The beneficial effects of the invention are as follows: the invention improves the social network algorithm on the basis of the social network algorithm, and provides the improved social network algorithm for optimizing the neural network; the improved social network algorithm adopts chaotic initialization in the population initialization stage, so that the search range and population diversity in the early iteration stage are ensured, and the population is completely chaotic in a search space; simultaneously, an elite mechanism is established, and is used for guiding other individuals, so that the convergence speed and communication are accelerated, the defect of random initialization in a crowd-sourcing algorithm is overcome, and the convergence is accelerated by using the elite mechanism; compared with other optimization algorithms, the improved social network algorithm does not need to set too many parameters, only needs to set the proportion of the elite individuals in the whole, and is more stable in the training process.
Examples
Fig. 1 is a flowchart of an improved social networking algorithm according to an embodiment of the present invention, which has better searching capability and faster convergence speed than before, and is more suitable for a BP neural network classification model than other intelligent algorithms.
Fig. 2 is a flowchart of an intrusion detection method based on an improved social network algorithm according to an embodiment of the present invention, and the detection method has a higher detection rate and a lower false alarm rate, and has certain learning and adaptive capabilities, compared with the similar methods.
FIG. 3 is a line graph of test results of the SNS algorithm and the ISNS algorithm on six test functions;
FIG. 4 is a box diagram of test results of the SNS algorithm and the ISNS algorithm on six test functions;
FIG. 5 is a line graph of test results of an improved social networking algorithm and a particle swarm algorithm, a grayish wolf algorithm, and a sparrow algorithm on four test functions;
FIG. 6 is a box plot of the results of testing the improved social networking algorithm with the particle swarm algorithm, the grayish wolf algorithm, and the sparrow algorithm on four test functions;
the detection method comprises the following steps:
s1, collecting and preprocessing network security data to serve as intrusion detection model training data; the pretreatment specifically comprises the following steps:
s1-1, digitizing, namely, expanding character type characteristics in the intrusion detection data into unit vectors through One-hot operation to complete digitization; assuming that the feature has i feature values, it is set to a corresponding one of {0, 1.., i-1 };
s1-2, normalizing, scaling the data in proportion, and uniformly mapping the data to the range of [ -1,1 ]; the calculation expression is shown in formula (1):
Figure RE-RE-DEST_PATH_IMAGE073
where x denotes the original data, x max Representing the upper bound, x, of the original data min Representing the lower bound of the original data, y representing the data after normalization, y max Representing the upper bound, y, of the normalized data min Represents the lower bound of the normalized data;
s2, designing a BP neural network model, and setting corresponding activation functions for neurons of a hidden layer and an output layer; the BP neural network is a machine learning algorithm and is a calculation model simulating the structure and the function of a biological neural network; the neural network is calculated by connecting a large number of artificial neurons, and is a self-adaptive system; the method specifically comprises the following steps:
s2-1, setting the number of nodes of a network layer, and setting the number of neurons of an input layer, a hidden layer and an output layer; the number of nodes in the input layer and the output layer is determined by the dimension of the input data and the data type. The number of nodes of the hidden layer is jointly determined by the number of nodes of the input layer and the output layer.
S2-2, establishing connection among the input layer, the hidden layer and the output layer of the neural network, and setting corresponding weight and threshold parameters;
s2-3, setting corresponding activation functions for neurons of the hidden layer and the output layer to enable the neural network model to have classification characteristics;
s3, pre-training the neural network model by using an improved social network algorithm, and outputting an optimal initial test weight and a threshold vector; the improved social network algorithm is formed by combining Logistic chaotic mapping and elite mechanism on the basis of a classical social network algorithm;
the improved social networking algorithm also simulates the behavior of a user expressing opinions in a social network and acts as an optimization operation step. Suppose that in the D-dimensional space, the social user scale is N and the elite quantity is N*And rate, initializing the position of each social individual by using Logistic chaotic mapping, and recording as X = { X = { (X) 1 ，X 2 ，X 3 ...，X N }; each timeFirstly, sorting the first-turn individuals based on each fitness, selecting the first-turn individuals as elites, and then respectively carrying out optimization operation;
the improved social networking algorithm is divided into two parts: the first part is the optimization of elite individuals, and the second part is the optimization of common individuals;
step S3-1, performing elite individual optimization operation: elite individuals
Figure RE-300748DEST_PATH_IMAGE074
Performing iterative loop, performing Mood2 only, namely dialogue action, and simultaneously conversing individuals
Figure RE-RE-DEST_PATH_IMAGE075
From the elite population and randomly selected,
Figure RE-676366DEST_PATH_IMAGE076
。
Figure RE-RE-DEST_PATH_IMAGE077
s3-2, carrying out optimization operation on the common individuals, wherein the optimization operation is randomly selected from Mood1 to Mood4 each time:
and Mood1: when individuals underwent Mood1 (mock behavior), 80% of them mock random elite individuals, the remaining 20% of them mock randomly;
Figure RE-283933DEST_PATH_IMAGE078
mood2: the user can see the event through other viewpoints, and finally, due to the difference of opinions, they can form a new view angle for the problem according to the formula:
Figure RE-RE-DEST_PATH_IMAGE079
here, the
Figure RE-694186DEST_PATH_IMAGE080
For a conversation object to be selected at random,
Figure RE-RE-DEST_PATH_IMAGE081
is a chat effect and can produce different feedback effects based on different viewpoints. It should be noted that
Figure RE-729007DEST_PATH_IMAGE082
Is selected randomly, an
Figure RE-RE-DEST_PATH_IMAGE083
。
Figure RE-591921DEST_PATH_IMAGE084
Namely that
Figure RE-816229DEST_PATH_IMAGE084
The function of the function(s) is,
Figure RE-RE-DEST_PATH_IMAGE085
、
Figure RE-333185DEST_PATH_IMAGE086
respectively correspond to the individuals
Figure RE-RE-DEST_PATH_IMAGE087
Individuals, and
Figure RE-555219DEST_PATH_IMAGE088
the corresponding fitness value. By comparison
Figure RE-RE-DEST_PATH_IMAGE089
To determine
Figure RE-92380DEST_PATH_IMAGE080
The direction of movement of (a).
Mood3: when the individual is
Figure RE-854800DEST_PATH_IMAGE087
When Mood3 (dispute action) is performed, it is proceeded with elite individualThe behaviour of mod 3. When the precision English group reaches the optimum in a certain dimension, the mean value M of the position variable of the precision English group is better to be an iterative individual
Figure RE-223333DEST_PATH_IMAGE087
This dimension converges.
Figure RE-678585DEST_PATH_IMAGE090
Mood4: by changing the concept of a topic in a subject, the general concept of the subject will change and a new perspective will be achieved. With this concept, a new view is created by innovating emotions as follows:
Figure RE-RE-DEST_PATH_IMAGE091
wherein, the first and the second end of the pipe are connected with each other,
Figure RE-516091DEST_PATH_IMAGE092
is in the interval [1, D ]]D is the number of the problem variables.
Figure RE-RE-DEST_PATH_IMAGE093
And
Figure RE-269152DEST_PATH_IMAGE094
is the interval [0,1]Two independent random numbers in (1). In addition, in the case of the present invention,
Figure RE-DEST_PATH_IMAGE095
and
Figure RE-242924DEST_PATH_IMAGE096
are the maximum and minimum values of the d-th variable.
Figure RE-DEST_PATH_IMAGE097
Representing the new value of the d dimension for the problem.
Figure RE-53099DEST_PATH_IMAGE098
Is selected by another user (randomly selected first)
Figure RE-377901DEST_PATH_IMAGE088
Individual users) about the d-th dimension variable.
S3-3, judging whether a termination condition is met, if not, returning to the S3-1 and the S3-2 to continue optimization, otherwise, outputting an optimal individual position;
s4, setting an initial weight and a threshold of the neural network model according to the optimal honey source position vector output in the step S3;
s5, designing a back propagation algorithm and training a neural network by using intrusion detection data to obtain a neural network intrusion detection model; the back propagation algorithm is a universal method for training a neural network, and the weight and the threshold of the neural network are adjusted by minimizing a loss function of the neural network; the method specifically comprises the following steps:
s5-1, designing a back propagation algorithm; selecting cross entropy as a cost function, and avoiding overfitting of neural network training;
Figure RE-RE-DEST_PATH_IMAGE099
wherein
Figure RE-669074DEST_PATH_IMAGE100
And y is the actual value of the current label for the predicted label output by the model.
Selecting a random gradient descent method, adjusting the weight and the threshold value in the negative gradient direction of the loss function, iteratively reducing the value of the loss function, adding a random factor when calculating the gradient in order to improve the capability of jumping out of a local minimum value in the neural network training process, even if the calculated gradient is trapped in a local minimum point, possibly not being zero, and having an opportunity of jumping out of a local minimum for continuous search;
s5-2, taking the intrusion detection data as training data of the neural network, and training the neural network model by using a back propagation algorithm to obtain a neural network intrusion detection model;
s6, designing a network intrusion detection software module according to the neural network intrusion detection model, deploying the network intrusion detection software module in a network environment to detect network data traffic in real time, and giving an alarm to the detected abnormal network traffic; the network intrusion detection software module specifically comprises the following modules:
the attack early warning module is the first layer of network intrusion detection software, monitors the change of a request flow in real time, and forwards the flow to the flow preprocessing module for primary processing when the request flow reaches a certain limited threshold value;
the flow preprocessing module collects the received network flow data packet, performs data preprocessing on the data packet and sends the data packet to the neural network intrusion detection module;
the neural network intrusion detection module receives the data packet forwarded by the flow preprocessing module, and the neural network intrusion detection module detects the data packet;
the following table shows a comparison table of various detection methods:
TABLE 3 NSL-KDD dichotomy results (unit:%)
Figure RE-RE-DEST_PATH_IMAGE101
TABLE 4 UNSW-NB15 dichotomous results (unit:%)
Figure RE-762932DEST_PATH_IMAGE102
The classification results of the second classification of each model are shown in tables 3 and 4. In the aspect of accuracy, the improved SNS _ BP model is optimal and has better effect than other existing models, namely AdaBoost, elm, KNN and SVM. In order to prove the effect of ISNS in an ISNS _ BP network, an SSA algorithm with similar performance to the ISNS is added into a comparison test in an algorithm test experiment to establish an SSA _ BP model, and the SSA _ BP model is compared with a BP model, an SNS _ BP model and the ISNS _ BP model. The test result shows that the SSA algorithm, the SNS algorithm and the ISNS algorithm all improve the BP network, but the ISNS algorithm has more excellent performance on the accuracy of an intrusion detection data set. Compared with the two tables, the classification effect of each classification model on the NSL-KDD data set is better than that of the UNSW-NB15 data set and is infinitely close to the accuracy of 0.98-0.99, and the ISNS _ BP model with the best classification effect on the UNSW-NB15 data set is the highest to achieve the accuracy of close to 0.93.
TABLE 5 NSL-KDD Multi-Classification results (Unit:%)
Figure RE-746937DEST_PATH_IMAGE104
TABLE 6 UNSW-NB15 multiple classification results (unit:%)
Figure RE-355773DEST_PATH_IMAGE106
Tables 5 and 6 show the multi-classification performance of various algorithms on the intrusion detection data set, and the true rate, false positive rate and AUC value of the multi-classification are shown in the tables. For an NSL-KDD data set, the ISNS _ BP model is better in performance, the performance is particularly higher on a U2R type than other three types of BP networks, and the identification capability is obvious on a small classification sample. The recognition degree of other three models on the class is poor, and the true rate is 0. For the UNSW-NB15 dataset, the sample types were also increased from 5 to 10 and contained much smaller sample data than the NSL-KDD dataset, which is much more complex. In five types of small sample data, namely Reconnaissance, analysis, worms, background and Shellcode, various algorithms are poor in performance, and even the true rate of many models is 0. This is due to two reasons: 1. the data samples are too few to fully learn the model; 2. the sample is too complex and the model does not fit well. And constructing an ROC curve according to the model output value to obtain an AUC value, and finding that the ISNS _ BP model is slowly fitted under the same iteration condition.
The invention discloses an intrusion detection method based on an improved social network algorithm and a BP neural network. The improved social network algorithm avoids the dependence of the BP neural network on the initial parameters, accelerates the training of the neural network and improves the stability of the algorithm. A network intrusion detection software module is constructed, the neural network model is applied to intrusion detection to detect abnormal data traffic, and the intrusion detection method has higher identification and classification capabilities.
While the present invention has been described in detail with reference to the preferred embodiments, it should be understood that the above description should not be taken as limiting the invention. Various modifications and alterations to this invention will become apparent to those skilled in the art upon reading the foregoing description. Accordingly, the scope of the invention should be limited only by the attached claims.

Claims (3)

1. An intrusion detection method for improving social and neural networks, the method comprising the steps of:
s1, collecting and preprocessing network security data to serve as intrusion detection model training data; the pretreatment specifically comprises the following steps:
step S1-1, digitizing, namely, expanding character type characteristics in the intrusion detection data into unit vectors through One-hot operation to complete digitization; assuming that the feature has i feature values, it is set to a corresponding one of {0, 1.., i-1 };
s1-2, normalizing, scaling the data in proportion, and uniformly mapping the data to the range of [ -1,1 ]; the calculation expression is shown in formula (1):
Figure DEST_PATH_IMAGE002
where x denotes the original data, x max Representing the upper bound, x, of the original data min Representing the lower bound of the original data, y representing the data after normalization, y max Representing the upper bound, y, of the normalized data min Represents the lower bound of the normalized data;
s2, designing a BP neural network model, and setting corresponding activation functions for neurons of a hidden layer and an output layer; the BP neural network is a machine learning algorithm and is a calculation model simulating the structure and the function of a biological neural network; the neural network is calculated by connecting a large number of artificial neurons, and is a self-adaptive system; the method specifically comprises the following steps:
s2-1, setting the number of nodes of a network layer, and setting the number of neurons of an input layer, a hidden layer and an output layer; the number of nodes of the input layer and the output layer is determined by the dimension of input data and the type of the data;
the number of nodes of the hidden layer is jointly determined by the number of nodes of the input layer and the output layer;
s2-2, establishing connection among the input layer, the hidden layer and the output layer of the neural network, and setting corresponding weight and threshold parameters;
s2-3, setting corresponding activation functions for neurons of the hidden layer and the output layer to enable the neural network model to have classification characteristics;
s3, pre-training a neural network model by using an improved social network algorithm, and outputting an optimal initial trial weight and a threshold vector; the improved social network algorithm is formed by combining Logistic chaotic mapping and elite mechanism on the basis of a classical social network algorithm;
the improved social network algorithm also simulates the behavior of the user expressing the opinions in the social network and is used as an optimization operation step;
assuming that the social user scale is N and the elite number is N × rate in the D-dimensional space, the position of each social individual is initialized by using Logistic chaotic map, and is denoted as X = { X = { X } 1 ，X 2 ，X 3 ...，X N }; sorting each round based on each fitness, selecting top N rate individuals as elite, and then respectively carrying out optimization operation;
the improved social networking algorithm is divided into two parts: the first part is the optimization of elite individuals, and the second part is the optimization of common individuals;
step S3-1. Elite individual optimization operation: elite crystalBody
Figure DEST_PATH_IMAGE004
An iterative loop is performed, only the Mood2, i.e. the dialogue acts, and the individual is conversed at the same time
Figure DEST_PATH_IMAGE006
From an elite population and randomly selected,
Figure DEST_PATH_IMAGE008
；
Figure DEST_PATH_IMAGE010
s3-2, carrying out optimization operation on the common individuals, wherein the optimization operation is randomly selected from Mood1 to Mood4 each time:
and Mood1: when individuals underwent Mood1 (mock behavior), 80% of them mock random elite individuals, the remaining 20% of them mock randomly,
Figure DEST_PATH_IMAGE012
mood2: the user can see the event through other viewpoints, and finally, because of different opinions, they can form a new view angle for the problem according to the formula:
Figure DEST_PATH_IMAGE014
here, the
Figure DEST_PATH_IMAGE016
For a conversation object to be selected at random,
Figure DEST_PATH_IMAGE018
is a chat effect, can generate different viewsFeedback effect; it should be noted that
Figure DEST_PATH_IMAGE020
Is selected randomly, an
Figure DEST_PATH_IMAGE022
；
Figure DEST_PATH_IMAGE024
Namely that
Figure 57948DEST_PATH_IMAGE024
The function of the function(s) is,
Figure DEST_PATH_IMAGE026
、
Figure DEST_PATH_IMAGE028
respectively correspond to the individuals
Figure DEST_PATH_IMAGE030
Individuals, and
Figure DEST_PATH_IMAGE032
the corresponding fitness value; by comparison
Figure DEST_PATH_IMAGE034
To determine
Figure DEST_PATH_IMAGE036
The direction of movement of;
mood3: when the individual is
Figure 898997DEST_PATH_IMAGE030
When Mood3 (dispute behavior) is performed, mood3 behavior is performed with elite individuals; when the precision English group reaches the optimum in a certain dimension, the mean value M of the position variable of the precision English group is better to be an iterative individual
Figure 18262DEST_PATH_IMAGE030
The dimension converges;
Figure DEST_PATH_IMAGE038
and 4, mood: by changing the concept of a topic in a subject, the general concept of the subject will change and a new perspective will be realized; with this concept, a new view is created by innovating emotions as follows:
Figure DEST_PATH_IMAGE040
wherein the content of the first and second substances,
Figure DEST_PATH_IMAGE042
is in the interval [1, D ]]D is the number of the problem variables;
Figure DEST_PATH_IMAGE044
and
Figure DEST_PATH_IMAGE046
interval [0, 1]]Two independent random numbers in (1); in addition, in the case of the present invention,
Figure DEST_PATH_IMAGE048
and
Figure DEST_PATH_IMAGE050
is the maximum and minimum of the d variable;
Figure DEST_PATH_IMAGE052
a new value representing the d-dimension for the question;
Figure DEST_PATH_IMAGE054
is selected by another user (randomly selected first)
Figure DEST_PATH_IMAGE056
Individual users) current ideas about d-dimensional variables;
s3-3, judging whether a termination condition is met, if not, returning to the S3-1 and the S3-2 to continue optimization, otherwise, outputting an optimal individual position;
s4, setting an initial weight and a threshold of the neural network model according to the optimal honey source position vector output in the step S3;
s5, designing a back propagation algorithm and training a neural network by using intrusion detection data to obtain a neural network intrusion detection model; the back propagation algorithm is a universal method for training a neural network, and the weight and the threshold of the neural network are adjusted by minimizing a loss function of the neural network; the method specifically comprises the following steps:
s5-1, designing a back propagation algorithm; selecting cross entropy as a cost function, and avoiding overfitting of neural network training;
Figure DEST_PATH_IMAGE058
wherein
Figure DEST_PATH_IMAGE060
The predicted label is output by the current model, and y is the true value of the current label;
selecting a random gradient descent method, adjusting the weight and the threshold value in the negative gradient direction of the loss function, iteratively reducing the value of the loss function, and adding a random factor when calculating the gradient in order to improve the capability of jumping out of a local minimum value in the neural network training process, wherein the calculated gradient is possibly not zero even if trapped in a local minimum point, and the local minimum is jumped out for continuous search at an opportunity;
s5-2, taking the intrusion detection data as training data of the neural network, and training the neural network model by using a back propagation algorithm to obtain a neural network intrusion detection model;
and S6, designing a network intrusion detection software module according to the neural network intrusion detection model, deploying the network intrusion detection software module in a network environment to detect network data traffic in real time, and giving an alarm to the detected abnormal network traffic.
2. The method of claim 1, wherein the network intrusion detection software module specifically comprises the following modules:
the attack early warning module is the first layer of network intrusion detection software, monitors the change of a request flow in real time, and forwards the flow to the flow preprocessing module for preliminary processing when the request flow reaches a certain limited threshold value;
the flow preprocessing module collects the received network flow data packet, performs data preprocessing on the data packet, and sends the data packet to the neural network intrusion detection module.
3. The method of claim 1, wherein the network intrusion detection software module further comprises:
the neural network intrusion detection module receives the data packet forwarded by the flow preprocessing module, and the neural network intrusion detection module detects the data packet;
and the attack response module receives the detection result of the neural network intrusion detection module and generates corresponding alarm information for the data with abnormal detection result.
CN202210929517.3A 2022-08-03 2022-08-03 Intrusion detection method for improving social network and neural network Withdrawn CN115422995A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202210929517.3A CN115422995A (en) 2022-08-03 2022-08-03 Intrusion detection method for improving social network and neural network

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202210929517.3A CN115422995A (en) 2022-08-03 2022-08-03 Intrusion detection method for improving social network and neural network

Publications (1)

Publication Number Publication Date
CN115422995A true CN115422995A (en) 2022-12-02

Family

ID=84196279

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202210929517.3A Withdrawn CN115422995A (en) 2022-08-03 2022-08-03 Intrusion detection method for improving social network and neural network

Country Status (1)

Country Link
CN (1) CN115422995A (en)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115941322A (en) * 2022-12-07 2023-04-07 中国平安财产保险股份有限公司 Attack detection method, device, equipment and storage medium based on artificial intelligence
CN116306893A (en) * 2023-05-24 2023-06-23 华东交通大学 Contact net icing early warning method
CN117722699A (en) * 2023-12-11 2024-03-19 电子科技大学中山学院 Control method for operation of combustion equipment and electronic equipment
CN118133146A (en) * 2024-05-10 2024-06-04 国网江西省电力有限公司南昌供电分公司 Artificial intelligence-based risk intrusion recognition method for Internet of things
CN118133146B (en) * 2024-05-10 2024-07-16 国网江西省电力有限公司南昌供电分公司 Artificial intelligence-based risk intrusion recognition method for Internet of things

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115941322A (en) * 2022-12-07 2023-04-07 中国平安财产保险股份有限公司 Attack detection method, device, equipment and storage medium based on artificial intelligence
CN115941322B (en) * 2022-12-07 2024-05-24 中国平安财产保险股份有限公司 Attack detection method, device, equipment and storage medium based on artificial intelligence
CN116306893A (en) * 2023-05-24 2023-06-23 华东交通大学 Contact net icing early warning method
CN117722699A (en) * 2023-12-11 2024-03-19 电子科技大学中山学院 Control method for operation of combustion equipment and electronic equipment
CN117722699B (en) * 2023-12-11 2024-05-28 电子科技大学中山学院 Control method for operation of combustion equipment and electronic equipment
CN118133146A (en) * 2024-05-10 2024-06-04 国网江西省电力有限公司南昌供电分公司 Artificial intelligence-based risk intrusion recognition method for Internet of things
CN118133146B (en) * 2024-05-10 2024-07-16 国网江西省电力有限公司南昌供电分公司 Artificial intelligence-based risk intrusion recognition method for Internet of things

Similar Documents

Publication Publication Date Title
Zhang et al. Intrusion detection for IoT based on improved genetic algorithm and deep belief network
Han et al. A survey on metaheuristic optimization for random single-hidden layer feedforward neural network
CN110084610B (en) Network transaction fraud detection system based on twin neural network
Wang et al. Assessing optimizer impact on DNN model sensitivity to adversarial examples
CN115422995A (en) Intrusion detection method for improving social network and neural network
Ghanem et al. An efficient intrusion detection model based on hybridization of artificial bee colony and dragonfly algorithms for training multilayer perceptrons
CN109120610A (en) A kind of fusion improves the intrusion detection method of intelligent ant colony algorithm and BP neural network
Rashid et al. Adversarial training for deep learning-based cyberattack detection in IoT-based smart city applications
CN112087442A (en) Time sequence related network intrusion detection method based on attention mechanism
CN111988329A (en) Network intrusion detection method based on deep learning
CN109840413A (en) A kind of detection method for phishing site and device
CN113239638A (en) Overdue risk prediction method for optimizing multi-core support vector machine based on dragonfly algorithm
Sarkar et al. Robust classification of financial risk
CN114218457B (en) False news detection method based on forwarding social media user characterization
Zhou et al. A hybrid butterfly optimization algorithm for numerical optimization problems
Ahraminezhad et al. An intelligent ensemble classification method for spam diagnosis in social networks
Wei et al. Multi-objective evolving long–short term memory networks with attention for network intrusion detection
Ramadevi et al. Deep Learning Based Distributed Intrusion Detection in Secure Cyber Physical Systems.
CN117375983A (en) Power grid false data injection identification method based on improved CNN-LSTM
CN109597946B (en) Bad webpage intelligent detection method based on deep belief network algorithm
Abaimov et al. Understanding machine learning
Duan et al. Design of intrusion detection system based on improved ABC_elite and BP neural networks
Babu et al. Improved Monarchy Butterfly Optimization Algorithm (IMBO): Intrusion Detection Using Mapreduce Framework Based Optimized ANU-Net.
Deekshitha et al. URL Based Phishing Website Detection by Using Gradient and Catboost Algorithms
Narengbam et al. Harris hawk optimization trained artificial neural network for anomaly based intrusion detection system

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
WW01 Invention patent application withdrawn after publication
WW01 Invention patent application withdrawn after publication

Application publication date: 20221202