Abstract:In view of the high spatial and temporal complexity of intrusion detection caused by high dimensionality of traffic data features in the modern network environment and low classification accuracy caused by the lack of sensitivity of traditional intrusion detection methods to the correlation between traffic data, an intrusion detection method based on feature reduction and improved self-attention mechanism is proposed to improve the efficiency and accuracy of intrusion detection. Firstly, aiming at the problem of high-dimensional data, an auto-encoder with nonlinear feature extraction capability is used to extract features, which reduces data redundancy and ensures classifier performance to be basically unchanged, so as to ensure that intrusion detection methods can effectively identify attacks. Secondly, aiming at the problem that traditional intrusion-detection methods ignore the correlation of traffic data, a self-attention mechanism is introduced in the intrusion detection classification process to learn the correlation of network data over a period of time. The causal convolution is introduced in original self-attention mechanism to calculate the correlation score between data, and integrate the local location information of current traffic data and the correlation between the traffic data in the concerned domain, which comprehensively analyzes current traffic behavior and complete accurate classification. Experimental results on UNSW-NB15 dataset show that the proposed intrusion detection method attains 98.32% accuracy on the binary classification tasks, and outperforms traditional methods on multi-classification tasks as well, indicating promising applicability in modern network environment.