Method and device for detecting network intrusion

1. A method for detecting network intrusion, comprising:

obtaining a feature vector of a network flow to be detected; and

detecting the feature vector using a deep neural network, and determining a network intrusion category of the network flow to be detected according to a detecting result, wherein the deep neural network is generated by training with training data, the training data comprises feature vectors of normal samples and feature vectors of attack samples, the attack samples comprise original attack samples and generated attack samples by adding noise to the original attack samples,

wherein the method further comprises:

collecting original samples, wherein the original samples comprise the normal samples and the original attack samples;

adding the noise to the original attack samples to obtain the generated attack samples;

performing feature extraction on the normal samples, the original attack samples and the generated attack samples respectively to obtain the feature vectors of the normal samples and the feature vectors of the attack samples, wherein the attack samples comprise the original attack samples and the generated attack samples;

taking the feature vectors of the normal samples and the feature vectors of the attack samples as the training data to train the deep neural network,

wherein each original attack corresponds to a plurality of generated attack samples,

wherein the number of the plurality of generated attack samples is inversely proportional to the number of existing attack samples in a category of an original attack sample corresponding to the plurality of generated attack samples.

2. The method according to claim 1 , after obtaining a feature vector of a network flow to be detected, further comprising:

identifying the feature vector according to a linear classifier, and determining whether to detect the feature vector using the deep neural network according to an identifying result.

3. The method according to claim 1 , wherein the adding the noise to the original attack samples to obtain the generated attack samples comprises:

adding the noise to the original attack samples according to a predetermined sample base and a predetermined rule base to obtain the generated attack samples.

4. The method according to claim 1 , wherein the deep neural network comprises a plurality of auto-encoder layers.

5. A network device for detecting network intrusion, comprising:

one or more processors; and

a memory for storing instructions executable by the one or more processors,

wherein the one or more processors are configured to:

obtain a feature vector of a network flow to be detected; and

detect the feature vector using a deep neural network, and determine a network intrusion category of the network flow to be detected according to a detecting result, wherein the deep neural network is generated by training with training data, the training data comprises feature vectors of normal samples and feature vectors of attack samples, the attack samples comprise original attack samples and generated attack samples by adding noise to the original attack samples,

wherein the one or more processors are configured to:

collect original samples, wherein the original samples comprise the normal samples and the original attack samples;

add the noise to the original attack samples to obtain the generated attack samples;

perform feature extraction on the normal samples, the original attack samples and the generated attack samples respectively to obtain the feature vectors of the normal samples and the feature vectors of the attack samples, wherein the attack samples comprise the original attack samples and the generated attack samples;

take the feature vectors of the normal samples and the feature vectors of the attack samples as the training data to train the deep neural network,

wherein each original attack corresponds to a plurality of generated attack samples,

wherein the number of the plurality of generated attack samples is inversely proportional to the number of existing attack samples in a category of an original attack sample corresponding to the plurality of generated attack samples.

6. The device according to claim 5 , wherein the one or more processors are configured to:

after obtaining a feature vector of a network flow to be detected, identify the feature vector according to a linear classifier, and determine whether to detect the feature vector using the deep neural network according to an identifying result.

7. The device according to claim 5 , wherein the one or more processors are configured to add the noise to the original attack samples to obtain the generated attack samples by acts of:

adding the noise to the original attack samples according to a predetermined sample base and a predetermined rule base to obtain the generated attack samples.

8. The device according to claim 5 , wherein the deep neural network comprises a plurality of auto-encoder layers.

9. A non-transitory computer-readable storage medium having stored therein instructions that, when executed by a processor of a device, causes the device to perform a method for detecting network intrusion, the method comprising:

obtaining a feature vector of a network flow to be detected; and

detecting the feature vector using a deep neural network, and determining a network intrusion category of the network flow to be detected according to a detecting result, wherein the deep neural network is generated by training with training data, the training data comprises feature vectors of normal samples and feature vectors of attack samples, the attack samples comprise original attack samples and generated attack samples by adding noise to the original attack samples,

wherein the method further comprises:

collecting original samples, wherein the original samples comprise the normal samples and the original attack samples;

adding the noise to the original attack samples to obtain the generated attack samples;

performing feature extraction on the normal samples, the original attack samples and the generated attack samples respectively to obtain the feature vectors of the normal samples and the feature vectors of the attack samples, wherein the attack samples comprise the original attack samples and the generated attack samples;

taking the feature vectors of the normal samples and the feature vectors of the attack samples as the training data to train the deep neural network,

wherein each original attack corresponds to a plurality of generated attack samples,

wherein the number of the plurality of generated attack samples is inversely proportional to the number of existing attack samples in a category of an original attack sample corresponding to the plurality of generated attack samples.

10. The non-transitory computer-readable storage medium according to claim 9 , wherein after obtaining a feature vector of a network flow to be detected, the method further comprises:

identifying the feature vector according to a linear classifier, and determining whether to detect the feature vector using the deep neural network according to an identifying result.

11. The non-transitory computer-readable storage medium according to claim 9 , wherein the adding the noise to the original attack samples to obtain the generated attack samples comprises:

adding the noise to the original attack samples according to a predetermined sample base and a predetermined rule base to obtain the generated attack samples.

12. The non-transitory computer-readable storage medium according to claim 9 , wherein the deep neural network comprises a plurality of auto-encoder layers.