1673-159X

CN 51-1686/N

基于分组序列图像表征和视觉Transformer模型的网络入侵检测系统

The Network-Based Intrusion Detection System Based on Packet Sequence Image Representation and the Vision Transformer Model

  • 摘要: 随着新型网络攻击的不断涌现,网络入侵检测系统(NIDS)已成为网络安全中不可或缺的保护机制。为提高入侵检测的准确性和实时性,提出一种基于分组序列特征和深度学习模型的NIDS。首先,利用分组解析算法分析分组报头和有效载荷数据,有效提取分组序列特征;其后,通过图像构建算法对特征集中分组的时序关系进行编码,由此为同一流量的前向和后向特征创建RGB图像;最后,开发基于视觉Transformer (ViT)的入侵检测模型,基于图像分类结果完成入侵检测,并使用分层焦点损失函数提高分类性能,解决数据不平衡问题。NIDS公开数据集上的实验结果表明,与已有NIDS相比,所提系统能够显著提高入侵检测性能,在不同攻击类型下能达到98.03%到100%的高检测率。在当前网络入侵的复杂性和多样性不断增加的情况下,所提方法将有助于提升网络安全。

     

    Abstract: With the continuous emergence of new network attacks, network-based intrusion detection systems (NIDS) have become an indispensable protection mechanism in network security. To enhance the accuracy and real-time performance of intrusion detection, a NIDS based on packet sequence representation and the deep learning model is proposed. Firstly, packet headers and payload data are analyzed using a packet parsing algorithm to effectively extract packet sequence features. Subsequently, an image construction algorithm encodes the temporal relationships within the feature set of packets, creating RGB images for the forward and backward features of the same flow. Finally, an intrusion detection model based on ViT is developed to perform intrusion detection based on image classification results, and the layered focal loss function is employed within the ViT model to improve classification performance and address data imbalance issues. Experimental results on public NIDS datasets demonstrate that the proposed system significantly enhances intrusion detection performance compared to existing NIDS, achieving a high detection rate of 97.7% to 99% across different attack types. Given the increasing complexity and diversity of current network intrusions, the proposed method will contribute to improved network security.

     

/

返回文章
返回