| At present,the Internet has become an indispensable part of people’s life and work,but the subsequent security problems can not be ignored.The constantly updated means of network illegal attacks have higher requirements for prevention technology.Preventing network attacks and reducing the losses caused by network attacks have been an essential part of individuals and enterprises.Therefore,the research of network intrusion detection is of great significance.At the same time,with the complexity of the network model and hundreds of features,the feature engineering of traditional machine learning becomes more complex and the prediction accuracy is more uncontrollable.The tens of millions of parameters make the model training process more demanding on hardware and less efficient.Firstly,in view of the large amount of parameters of the deep learning model,this paper proposes the ResGhost BiLSTM model combined with Ghost and BiLSTM.The model extracts the spatial features of the data through the convolution neural network(ResGhost),and obtains the time series features through the bidirectional cyclic neural network(BiLSTM);Secondly,aiming at the problem of sample imbalance in the actual scene,this paper proposes mixed sampling to form relatively balanced sample data,so as to further improve the detection accuracy when the sample is unbalanced;Finally,aiming at the correlation between different features of data,this paper proposes an intrusion detection model based on attention mechanism and deformation convolution.The correlation of different features is obtained by deformation convolution,and the corresponding weight is automatically assigned to different features by attention mechanism,so as to further improve the detection accuracy of the model.The experimental results show that the ResGhost BiLSTM model improves the accuracy by 6.78%and nearly doubles the computational efficiency compared with the traditional machine learning RF. |
