基于改进残差网络与注意力机制的网络入侵检测方法

Network Intrusion Detection Method Based on Improved Residual Network and Attention Mechanism

摘要: 当前，网络攻击手段的复杂性不断升级，传统入侵检测技术因自身局限性，已难以应对现代网络安全的挑战。具体而言，基于规则的模型无法适应攻击模式的快速变化，难以检测未知攻击；基于特征的方法则因特征提取的准确性和效率不足，容易在新型攻击面前出现误报或漏报。为此本文提出了一种基于改进残差网络(ResNet)和注意力机制的网络入侵检测模型。该模型结合了自动编码器(AutoEncoder)进行特征提取，利用残差网络的深层结构进行特征学习，并引入多头注意力机制以增强特征表示能力。实验结果表明，该模型展现出了优异的表现，其中模型精确率达到了97.27%，F1-score达到了97.78%，模型的损失值(Loss)在训练过程中持续下降并趋于稳定，保持在0.01左右，这些结果验证了模型在处理复杂网络入侵数据时的有效性和可行性，为网络安全领域提供了一种新的解决方案。

Abstract: At present, the complexity of network attack means is escalating, and the traditional intrusion detection technology has been difficult to meet the challenges of modern network security because of its own limitations. Specifically, the rule-based model can not adapt to the rapid changes of attack patterns, and it is difficult to detect unknown attacks; Feature-based methods are prone to false positives or false negatives in the face of new attacks because of the lack of accuracy and efficiency of feature extraction. Therefore, this paper proposes a network intrusion detection model based on improved residual network (ResNet) and attention mechanism. This model combines AutoEncoder to extract features, uses the deep structure of residual network to learn features, and introduces multi-head attention mechanism to enhance the ability of feature representation. The experimental results show that the model shows excellent performance, in which the accuracy rate of the model reaches 97.27%, the F1-score reaches 97.78%, and the Loss value of the model keeps decreasing and tends to be stable during the training process, and keeps around 0.01. These results verify the effectiveness and feasibility of the model in dealing with complex network intrusion data, and provide a new solution for the field of network security.