Research On Intrusion Detection Technology Based On Multi-head Attention Mechanism

With the development of the internet,it’s no longer be able to separated from people’s life and work,and the accompanying security problems have become increasingly prominent.As a security device,the intrusion detection system(IDS)can monitor network and system activities,prevent and detect bad behaviors,and it plays an important role in enterprise security construction.The intrusion detection technology which based on deep learning,uses deep learning algorithms to learn patterns and rules,then according to the learned patterns and rules,it can detects abnormal behaviors and attacks in the network.Due to the network data has the feature of redundant,high dimensionality and extremely imbalanced,the multi classification and minority class recognition performance of intrusion detection models are usually not ideal.In response to these two issues,this paper proposes an intrusion detection model based on multi-head attention mechanism and develops a system prototype based on the model.The main work of the paper is as follows:(1)An intrusion detection model based on multi-head attention and Bidirectional Gated Recurrent Unit(BiGRU)is proposed.BiGRU can simultaneously consider information in the forward and backward directions so that it can capture long-term dependencies.To further improve the feature extraction ability,the model uses multi-head attention to wrap BiGRU,synchronously computing attention weights on the output data of BiGRU,and capturing complex features of data from a spatial perspective.The experiments show that the model has a remarkable classification effect and can successfully identify minority attacks.(2)An intrusion detection model based on multi-head attention and MultiChannel Convolutional Neural Network(CNN)is proposed.Multi-Channel CNN sets different convolution kernels to process and analyze different features in data,and it achieves good feature extraction effects while optimizing model parameters,reduces training time and saving computational resources.Experimental results demonstrate that the intrusion detection model based on multi-head attention and Multi-Channel CNN has higher accuracy,precision rate,recall rate,and f1 score than other models.Experiments show that the multi-class f1 score of the model on the UNSW-NB15 dataset is 82.22%,and the multi-class f1 score on the CICIDS2017 dataset is 99.83%,which is higher than other models.(3)Pooling techniques are used for dimension reduction in Multi-Channel CNN,different pooling methods are applicable to data with different characteristics.In order to further optimize Multi-Channel CNN,an improved random hybrid pooling method is proposed,which randomly combines the Max Pooling method,Average Pooling method,and Global Average Pooling method to fully extract overall and edge features.Experimental results demonstrate that the use of the hybrid pooling method in intrusion detection models can effectively reduce data dimensions and obtain richer data features.