Research On Intrusion Detection Model And Application Based On Deep Learning And Attention Mechanism

With the increasing popularity of the Internet,more and more offline businesses have been replaced by online businesses,and the Internet has become a part of people’s lives.At the same time,network security is becoming more and more important.In network security issues,attacks from individuals or groups of hackers are a serious security risk.Hackers attack the Internet by maliciously accessing Internet resources,uploading malicious codes,etc.,stealing database resources or extorting attacked objects to earn ill-gotten wealth..Because the financial system manages the wealth of the masses,there are more and more online wealth management businesses,and the Internet is getting deeper and deeper,and the financial system faces more serious network security problems.Therefore,the study of network security theory and technology is of great significance to improve the security of the financial system.Intrusion Detection System(IDS)is a proactive network security technology that monitors the network and system operating status in real time according to certain security policies,and tries to find various attack attempts,attack behaviors or attack results.To ensure the confidentiality,integrity and availability of network system resources.The traditional intrusion detection system requires experienced network security practitioners to manually design a signature database and perform signature matching for each network traffic flowing through the system.This method not only relies heavily on the defense experience of network security practitioners,but also requires a huge signature database.To save malicious traffic characteristics,and its accuracy is also unsatisfactory.Although the machine learning-based intrusion detection system optimizes the operation process and uses computers to perform complex calculations to ensure its accuracy,it still relies on artificially designed features,which are easily outdated and cannot detect new attack methods.The problem brings a great challenge to the research of intrusion detection system.The current intrusion detection technology still has the following problems:(1)The gradient problem in the long-cycle training process.In practical work,the traffic data passing through the intrusion detection system is very large,which leads to the problem of gradient explosion or gradient disappearance during the training process of the traditional Recurrent Neural Network(RNN).(2)The network traffic data has time series characteristics,and the types of attacks are various.The current intrusion detection system cannot accurately identify each type of attack,and the false alarm rate is high.(3)The convolutional neural network in the deep learning method regards the features as independent of each other during training,but the features in the network traffic are related.In addition,the key features are different in different attack types.,so it will lead to inaccurate classification and high false positive rate.In order to solve the problems of high false positive rate,high false negative rate and low accuracy rate of traditional intrusion detection systems,this paper proposes an intrusion detection system based on deep learning,which innovatively introduces excellent performance in the field of natural language processing.The attention mechanism is combined with convolutional neural network and gated recurrent unit to design an intrusion detection model.The research work of this paper mainly includes the following contents:(1)Propose a CGA(CNN-GRU-Attention)intrusion detection model.In order to solve the problem of feature independence,this paper innovatively introduces the excellent attention mechanism in the field of natural language processing into the field of intrusion detection,and designs an intrusion detection model based on convolutional neural network-gated recurrent unit-attention mechanism,the model uses the convolutional neural network to analyze the spatial characteristics of the traffic data,then uses the gated recurrent unit to analyze the time series characteristics of the traffic data,and finally uses the attention mechanism to optimize the model operation process and improve the accuracy.After the theoretical analysis,the UNSW-NB15 data set is used to verify the validity of the model.The experimental results show that the accuracy of the CGA intrusion detection model is improved by 6%-8% compared with the traditional intrusion detection model.(2)Analyze the characteristics of the financial network and apply the CGA model to the financial system.Firstly,the characteristics of the financial network are analyzed from the three aspects of physical equipment,external network status and internal network status,and the challenges facing the current financial network are summarized.For real traffic data,first use the Flow Handler program to extract the feature matrix in the original traffic,and then train the model based on the data set.The verification results show that the CGA model performs well in the financial system.