融合稀疏自注意力机制的增量入侵检测模型

Incremental intrusion detection model incorporating sparse self-attention mechanism

关键词:  入侵检测  自注意力机制  增量学习  深度学习  灾难性遗忘

Key words:  intrusion detection  self-attention mechanism  incremental learning  deep learning  catastrophic forgetting

摘要:

传统的基于自注意力的入侵检测模型在注意力值计算中存在时间复杂度较高的问题,且多数模型面向静态网络环境。针对上述问题,提出融合稀疏自注意力机制的增量入侵检测模型。首先,引入稀疏度度量公式以降低时间复杂度,在不影响模型检测性能的前提下减轻模型计算压力；其次,构建动态示例存储器,以极小内存开销缓解增量学习中的概念漂移现象；最后,设计类别平衡损失函数,无需动态调整模型即可增强旧类别样本学习能力。推导与实验结果证明:稀疏自注意力机制的时间复杂度更低、分类效果更优；对比其他方案,所提增量学习机制的旧知识记忆能力更强,该入侵检测模型在现代网络环境中有着较好的应用前景。

Abstract:

Traditional self-attention-based intrusion detection models have high time complexity in the calculation of attention values, and most intrusion detection models are oriented to static network environments. To address the above problems, we proposed an incremental intrusion detection model incorporating a sparse self-attention mechanism. First, we introduced a sparsity metric formula to reduce the time complexity, so as to alleviate the computational pressure of the model without affecting the detection performance of the model; Second, we constructed a dynamic example memory to alleviate the concept drift phenomenon of the model in incremental learning at the cost of a very small amount of memory space; Finally, we designed a category-balanced loss function, which is capable of enhancing the learning ability of the model for old-category samples without dynamically adjusting the model. Derivation and experiments prove that the sparse self-attention mechanism has lower time complexity and better classification effect. Compared with other schemes, the incremental learning mechanism shows a stronger ability to memorize old knowledge. The intrusion detection model has a better application prospect in the modern network environment.