Research On Network Intrusion Detection Based On CNN And Attention Mechanism

With the continuous development of the Internet,network security threats have increased.Network intrusion detection as an active defense means to defend against network attacks has an important role.Facing the increasing network traffic data and complex network attacks,it is vital to study new and more reliable network intrusion detection methods.Aiming at the fact that most of the existing intrusion detection methods based on convolutional neural networks are not deep enough to mine the deep features of network traffic data,this thesis proposes a network intrusion detection method that combines Dense Net（CNN structure）and attention mechanism.In addition,in view of the problem of poor identification of minority class samples and long detection time based on the Dense Net model,the thesis proposes a network intrusion detection method based on improved Conformer.Finally,the thesis designs a network intrusion detection deployment scheme for the campus network in conjunction with the network architecture of the Huludao Campus of Liaoning Technical University,and designs a set of intrusion detection management interactive interfaces for network security administrators to manage it more conveniently.The network intrusion detection method that combines Dense Net and attention mechanism uses Dense Net for feature extraction,which can make the network deepen while suppressing gradient disappearance.The ECANet is introduced to increase the weight of important features;and then the Swish activation function is introduced to further improve Dense Net,which makes the model have better accuracy.Experiments were conducted using the NSL-KDD,UNSW-NB15,CIC-IDS2017,and CSE-CIC-IDS2018 datasets.The experiment shows that the model has an accuracy of 80.8%on NSL-KDD and 78.7%on UNSW-NB15.The model improves on accuracy and F₁-score metrics over other shallow intrusion detection models based on convolutional neural networks,and is also competitive in the experiments of CIC-IDS2017and CSE-CIC-IDS2018 compared to intrusion detection models based on other methods.The network intrusion detection method based on the improved Conformer draws on the network structure idea of the Conformer,CNN is combined with Vision Transformer and the combination is improved.Meanwhile,in order to reduce the time cost brought by Vision Transformer,the method introduces the Ghost module to reduce the number of CNN parameters to reduce the detection time.Experiments were conducted using the NSL-KDD,UNSW-NB15datasets,and the model identified the three minority class types on average 10.5%better than the Dense Net method,and the detection time was reduced by 42%on average on both datasets.The experiments show that the improved Conformer-based network intrusion detection method is able to enhance the recognition of a small number of samples with less detection time while maintaining the overall detection capability compared to the intrusion detection method that combines the attention mechanism and Dense Net.The thesis has 41 figures,13 tables,and 62 references.