Research On Intrusion Detection Based On Contrastive Learning

With the continuous development of information fields such as the Internet of Things,5G technology,and big data,cyber attacks have become more and more complex and difficult to control.Many researchers take the network intrusion detection system as a defense layer and propose methods to detect malicious network traffic.However,the traditional intrusion detection technology can not meet the new security requirements.An effective intrusion detection system requires a higher accuracy and detection rate,as well as a lower positive alarm rate.Aiming at the existing problems,this paper applies the comparative learning model to the research of intrusion detection system.In this paper,an intrusion detection model based on AE-CPC is proposed,which uses Auto-Encoder to perform dimensionality reduction and feature extraction on complex and redundant network traffic data,using comparative predictive coding perform characterization learning on the flow data after dimensionality reduction.The model can reduce the dependence on sample labels and is suitable for application in real-time network environments.By letting the model learn the similarities and differences between data samples,it can learn the characteristics of all samples in the data set.The two-classification and multi-classification experiments on KDD CUP99,NSL-KDD and UNSW-NB15 data sets show that AE-CPC intrusion detection model has high accuracy.In order to improve that the code generated by the autoencoder cannot keep the topological structure of the input space well,an intrusion detection model based on SOM-DAGMM-MoCo is studied in this paper.Self-Organizing Map(SOM)can maintain a good topology of the input space,making up for the shortcomings of AE.Deep Autoencoder Gaussian Mixture Model(DAGMM)mainly consists of two parts:compression network and estimation network.Using the compression network,the input sample data can be mapped into a low-dimensional space,and the space for storing key information is reserved for intrusion detection.Estimation networks are used to evaluate data in low-dimensional spaces in Gaussian mixture models.Finally,in order to further improve the accuracy of the model,combined with the characteristic that Momentum Contrast(MoCo)learning can accurately classify sample data,an efficient intrusion detection system is constructed.The intrusion detection model based on SOM-DAGMM-MoCo is tested on the CICIDS-2017 dataset,which has normal traffic data and the latest common attacks,which is a dataset similar to real-world network traffic.The experimental results verify the efficiency of the model.