# Computer Network Intrusion Anomaly Detection Based on Rough Fourier Fast Algorithm

Authors: Xindong Duan
Journal: Mathematical Problems in Engineering
 (2022)

---

## Abstract

Since there is a close relationship between network information security attack events and time complexity, it is necessary to count the degree of correlation between the current connection record and the connection record within a certain period of time before. Only in this way can the relationship between network connection data and network information security attack events be better reflected. In this paper, a rough Fourier fast algorithm based on rough set theory is proposed. Based on the characteristic attributes of the intrusion detection data set with the most value of character attributes as the data division basis, the computer network intrusion anomaly detection data set is intelligently divided into small data sets, so as to carry out attribute reduction. The network intrusion detection rule update experiment adopts the misuse detection method, extracts some samples from the KDD99 data set for training, obtains the computer network intrusion detection rules in the hierarchical decision table, and uses the incremental learning algorithm to update the rules, compared with the intrusion detection rules expressed by the decision table to test the feasibility and effectiveness of the rule update, and compared with the improved RSDB, RE-RFE algorithm, and KNN algorithm to evaluate the effect of the rough Fourier fast detection model applied to the problem of network intrusion anomaly detection. Using the attribute subset reduced by the rough Fourier algorithm to perform classification and modeling of computer network intrusion anomaly detection is significantly reduced, and the average time is reduced by 0.09 seconds, and this paper lays a good foundation for the application of network security intrusion detection algorithm.


---

## Body

## 1. Introduction

With the advancement of computer technology and the popularization of the Internet, computer networks and the Internet have become an important part of modern life. E-commerce transactions, e-mails, online social activities, and online games are also closely related to people's lives. In recent years, the technologies and methods of intrusion detection have been continuously updated and developed, and the scale of detected data has become larger and larger. The structure of the detection model has been continuously improved, the functions have become more and more complete, and the integration and analysis of other security technologies and other resources have greatly improved the detection effect and the detection efficiency. The network is not only the basis of personal life and business activities but also stores a large amount of private information. Over-reliance on the network may lead to some potential security problems, weaken the security of our private information, and cause huge economic losses. Therefore, people pay more and more attention to network security issues. In this context, the reasonable selection of detection technology is a problem worthy of discussion. Misuse detection has a high detection rate for known types of attacks, but cannot detect new attacks. Therefore, it is of practical significance to improve the detection accuracy and reduce the false detection rate by optimizing the classification model.Network intrusion detection technology is one of the key technologies to ensure network security. Murugan and Suresh proposed an abnormal intrusion detection scheme based on SA-NBC [1]. Zavrak and Iskefiyeli use flow-based features extracted from network traffic data, including typical and different types of attacks [2]. Moukhafi et al. proposed a new intrusion detection method [3]. Aldwairi et al. proposed RBM to distinguish normal and abnormal network traffic [4]. Pajouh et al. proposed an intrusion detection model to detect malicious activities [5]. However, the computer network intrusion anomaly detection technology they proposed is not very effective. This paper introduces a rough Fourier fast algorithm to optimize it.Rough Fourier fast algorithm can perform attribute reduction according to the different characteristics of computer network data subsets and attack types. Music studied the inverse scattering method [6]. Cooper et al. tested their hypothesis by using flexible Fourier transform (FFT) [7]. Chen et al. proposed a compact fractional Fourier transform (CFRFT) to detect chirps with low SNR [8]. Xu et al. proposed a new hybrid ensemble method to accelerate the implementation of GRFT [9]. Satpathi et al. performed a quantitative study of high-frequency components under transient conditions using STFT [10]. But their proposed rough Fourier fast algorithm runs very long.By constructing the attack and defense model, this paper solves the problem of intrusion detection environment and demand analysis. The attack-defense model is the basis of theoretical research and security engineering design and also establishes important connections for intrusion detection and security strategies, vulnerability scanning and vulnerability analysis, attack scenario models, and information protection objects. The target-based ontology modeling not only considers the target characteristics of vulnerability attacks, the software design and use root causes of vulnerability, and the relationship between the two, but also incorporates information model modeling features to explicitly model the relationship between information models and vulnerabilities. The attack scenario model in this paper attempts to describe the correlation characteristics, hierarchy, and uncertainty of the attack in one model and also attempts to express the game relationship between the attacker and the defender, as well as the time and cost constraints of the attacker. This paper proposes an attack and defense model, studies and analyzes the requirements of network intrusion detection, and proposes a network intrusion detection method based on rough Fourier fast algorithm to improve the detection rate of intrusion detection, which has certain theoretical and practical value. Fast Fourier algorithm can reduce the average detection time by 0.04 s. Compared with the classifier’s F-measure value, the scheme of the article has an average improvement of 0.93%.


## 2. Anomaly Detection Method of Computer Network Intrusion

### 2.1. Computer Network Intrusion Anomaly Detection

Network intrusion attacks refer to threats and violations of the network security situation, including intrusion tools, intrusion methods, and intrusion results. The first line of defense mechanism for network intrusion (authentication, encryption and decryption, firewall, and other technologies) is not flexible enough and perfect to block different types of attacks and intrusions, and attackers can easily bypass them. Antivirus software emerges as the second line of defense, but it can only detect attacks with known characteristics in the database. Their ability to respond is limited, and responding to an attack may take several hours until the next update. Intrusion detection technology collects relevant information about the violation of security policy, and intrusion detection technology collects and analyzes information from network modules to determine the element characteristics that violate the security policy. Accuracy, scalability, and adaptability are three important characteristics of intrusion detection schemes. The intrusion detection scheme must have good accuracy and adaptability to resist the intruder's attack. Intrusion detection scheme is the cornerstone of maintaining computer security, and it can detect unknown attack types through some techniques [11, 12].Assuming that the dimension of the sample space setD of computer network intrusion anomaly detection is n, the distance between p and q is defined as(1)d∞=∑i=1npi−qix.The formula for dimensionless processing of computer network intrusion anomaly detection using standard quantitative methods is [13](2)yi=xis.Among them,(3)x¯=∑i=1nxin,s=1n−1∑i=1nxi−x¯.The IDS general model classification is shown in Figure1. IDS can be classified differently according to the audit data source, detection principle, working method, architecture, and so on. The former is to store the characteristics of known attack models in a database and compare the network data to be detected with the abnormal behavior characteristics in the database, if they match, it is determined as abnormal behavior. When there are unknown features or changes from the real feature model, the detection effect of misuse detection is not ideal. Likewise, it also exists as antivirus software and needs to be regularly updated to detect new types of attacks. The latter is to establish a database of normal behavior by observing and analyzing the normal behavior of the network module and compare the detected data with the normal behavior in the database. If there is any deviation, it is judged as an outlier, and if it deviates from normal behavior, it is regarded as an attack [14]. In the anomaly detection scheme, there is no need to know the attack characteristics in advance, and the detection of unknown attack types can be realized, which is more feasible in the real environment. Static detectors work on the principle that the detection module fixes parts that will not change, such as the operating software. The dynamic detector is based on network traffic data and audit records and sets thresholds to distinguish normal consumption from abnormal resource consumption. Another disadvantage is that if an attacker knows it is being detected, it can change its profile and train an anomaly detection module to think that the malicious behavior of the network is normal [15].Figure 1
IDS generic model classification.The information module and vulnerability together constitute the research object of the attack-defense model. The attacker attacks the target information module based on its own information module. From the perspective of the defense side, the assets mapped by the information module together with the vulnerabilities and threats constitute the input of the risk assessment in the defense model. Attackers and defenders interact through information modules. Adding information modules to the security model can not only organize various security core technologies around the information modules but also further clarify the specific objects of security attack and defense, which can be targeted, which is one of the characteristics of the attack and defense security model in this paper. The information module contains the information technology module and the people, organization, and management components of the information module. The latter is the research area of management science and so on. Offensive and defensive models model information technology solutions into both static and dynamic aspects. The static part of the core layer mainly includes a hierarchical network topology model and a product model. The hierarchical network topology model models the basic network as consisting of hosts and links corresponding to the set of interfaces. Based on the basic network model, it is extended by using the concepts of hierarchy and object-oriented to describe the actual hierarchical network structure. When the covariance matrix of the computer network intrusion anomaly detection sample is a diagonal matrix, the Mahalanobis distance becomes the standard Euclidean distance [16, 17]:(4)dX,Y=xi−yi2θi2.Constructing the information model is only the first step of the security model, other nonsecurity modules, such as business modules, share information modules. The research on vulnerability analysis is the essence of the security program. The information module includes the information technology module and the personnel, organization, and management parts of the information module. Correspondingly, the vulnerability includes four types: management vulnerability, human vulnerability, network structure vulnerability, and host vulnerability. Among them, host vulnerabilities are the most commonly used types by attackers, which are generated by input validation errors, logic defects, and other inputs, and have effects such as information leakage, access rights acquisition, privilege escalation, and denial of service. The above is the gist of the purpose section of the vulnerability model. The vulnerability model also includes the root part; that is, the introduction of vulnerability is caused by the violation of existing or new software engineering techniques, software usage, and environmental assumptions. New vulnerabilities can be discovered through vulnerability testing and analysis. Vulnerability constitutes the basic factor of threat, and attackers use vulnerability knowledge to construct vulnerability exploit tools and use exploit tools to construct attack scenarios. Vulnerability is also a fundamental factor in risk analysis. The risk assessment of the protected module can be carried out according to the vulnerability, threat, and asset model, and risk assessment is the basis of information assurance. Therefore, vulnerability as the intrinsic object of the security module is also an analysis point for both the offensive and defensive [18, 19].


### 2.2. Application of Rough Fourier Fast Algorithm in Intrusion Anomaly Detection

The traditional Fourier algorithm adopts the method of sequentially taking blocks in the frequency domain and replacing the amplitude, which is an algorithm based on the most primitive phase recovery idea. The discretization of continuous attribute data means that the numerical data with continuous characteristics are represented by discrete values in a certain method. The discretization process will inevitably lead to the loss of useful intrusion anomaly detection information. By choosing an appropriate method, this loss can be minimized. There are redundant attributes in the classification method under the premise of satisfying a certain classification accuracy. Through attribute reduction, not only the reduced attribute set can be obtained but also the rules can be extracted from the data, and knowledge can be obtained through attribute reduction. In addition, the attribute set of intrusion anomaly detection reduction is not unique. The distinguishing function of the decision tableS for computer network intrusion anomaly detection is defined as [20](5)Δ∗=∑x,y∈Uα∗x,y.In general, the attribute reduction of rough sets is not unique, but the core is unique. Rough sets also provide the ability to extract rules from the computer network intrusion anomaly detection decision table, that is, the ability to generate decision rules. For a discrete given sequence ofN points {x (k)}, 0 ≤ k ≤ N − 1, after Fourier transform it becomes a new sequence {y (k)}, 0 ≤ k ≤ N − 1, this transformation can be described by the following formula [21]:(6)yi=∑k=0Nxkωki.Assuming thatn represents the length, the maximum similarity of the observed abnormal sequence X of computer network intrusion is(7)Smax=nn−12.At this time, it indicates that there is a sequenceY that exactly matches the observed sequence X in the computer network intrusion anomaly sequence library, and the occurrence of intrusion can be judged. As long as the abnormal degree of computer network intrusion is greater than the set threshold, the occurrence of intrusion can also be judged. If a certain sequence appears in large numbers and has a high degree of abnormality, the module can update the sequence as a computer network intrusion abnormal sequence sample into the module abnormal sequence database [22].The anomaly detection process based on the rough Fourier fast algorithm is shown in Figure2. Due to the advantages of fast rough Fourier algorithm in dealing with the relationship between massive data, the fast rough Fourier algorithm is applied to the field of anomaly detection, which can automatically extract knowledge and patterns useful to users from a large amount of data and then determine whether abnormal behavior occurs. Generally speaking, anomaly detection module based on rough Fourier algorithm mainly consists of six components: data collector, data warehouse, data miner, pattern generator, detector, and response engine. The advantage of anomaly detection based on rough Fourier fast algorithm is that the module can automatically mine normal and intrusion behavior models from massive data sets, without manual analysis, and the degree of automation is high. The disadvantage is that the detection results of the module largely depend on the purity of the initial training data set, and the detection ability of new, unknown, and yet to be discovered attack types is weak [23].Figure 2
Anomaly detection process based on rough Fourier fast algorithm.The classical rough set model regards knowledge as an indistinguishable relationship and uses the set inclusion relationship and the nonempty overlap condition to define a pair of upper and lower approximations for a given set of anomaly detection information. At the same time, since in many cases, we can allow some degree of error in order to make more accept or reject decisions for other objects. So a strict formula may limit its applicability and flexibility. The rough Fourier fast algorithm membership degreeαA can be defined as [24](8)αAx=x∪xx.In practical applications, a looser classification might make more sense. If the conditional probability of a computer network intrusion anomaly detection object is large enough, it is classified into the positive domain. Similarly, if the conditional probability of a computer network intrusion anomaly detection object is small enough, it will be assigned to the negative field.IfPωi|x represents the probability of a given computer network intrusion anomaly detection object x when the true state is, the expected cost of taking the action of aj is [25](9)Raj|x=∑i=1mPωi|x.In this paper, the rough Fourier algorithm is selected. After discretization, there are only hundreds of conflict records, which is acceptable compared to hundreds of thousands of records. The dataset adopts the standard intrusion detection test dataset of KDD99. The data is divided into three groups: Probe attack detection data (only including “basic attribute set + traffic attribute set” features), DoS attack detection data (only include “basic attribute set + traffic attribute set” feature), and U2R&R2L attack detection data (only include “basic attribute set + content attribute set” feature). For each type of data set, a decision module is constructed separately. In each class of datasets, our goal is to learn and classify normal (marked as +1) and attack (marked as −1) data examples. The method is to sample the above three types of data sets according to the rough set classification algorithm described in the previous section (where the ratio of training set and test set is 8 : 2), discretize (equal frequency interval method), and other processing. The specific data preprocessing results are as follows: for the Probe attack, the processed data set contains a total of 2400 records, of which 300 are attack data, and the rest are normal. 1900 data are used for training, and the rest are used for testing. For the DoS attack, our processed dataset contains a total of 5300 records, of which 3200 are attack data, and the rest are normal. 4200 data are used for training, and the rest are used for testing. For the U2R&R2L attack, our processed dataset contains a total of 2200 records, of which 90 are attack data, and the rest are normal. 1100 data are used for training, and the rest are used for testing [26].


### 2.3. Computer Network Intrusion Anomaly Detection Results

With the advent of the “Internet +” era, more and more people join the Internet army, and people's daily life, study, and work are quietly changing. On the one hand, the growing Internet technology provides convenience to people's daily life, and on the other hand, it is also used by hackers to endanger network and information security. Many network security incidents have all sounded the alarm for people, and network security issues cannot be ignored. With the development of many Internet technologies such as intelligent technology, cloud computing, mobile payment, network security problems are not limited to viruses, Trojans, phishing websites, or traditional system vulnerabilities. Establishing a unified network security defense system and doing a good job in risk prevention is the direction of network security construction.Almost all the problems faced by website security come from illegal phishing, website backdoor intrusion, and malicious tampering of webpages. Therefore, we must quickly seize this rare historical opportunity of the development of informatization, strengthen the promotion of positive information, and maintain the network security environment. The number of network attacks using IP addresses controlled by malicious programs such as Trojans and botnets accounted for 96.3% of the total in China. From January 2020 to January 2021, 80.3% of the exploited attack locations were remote attacks, of which 33% were high risk, and 42% are low risk. In 2020, there were 19,930 information system security vulnerabilities, an increase of 24.2% over 2019. Among them, high-risk vulnerabilities accounted for 33.2% of the total number of vulnerabilities in the year, a year-on-year increase of 36.4%. The types of objects affected by these vulnerabilities mainly include computer operating systems, web applications, network devices (switches), blockchain alliance chains, databases, security products, and blockchain public chains. The degree of risk of vulnerability exploitation is shown in Figure3.Figure 3
The level of risk of exploits.Existing intrusion detection systems, vulnerability scanning systems, and many other network security products are mainly based on passive defense and lack of cooperation and communication with each other. Although they play a role in security defense to a certain extent, there are still some defects. The traditional firewall technology only isolates the internal and external network to realize the defense of the external network intrusion, but cannot deal with the intrusion behavior inside the network. Intrusion detection technology generates various alarm information when the system is running. With the continuous expansion of the network scale, the amount of alarm information is also increasing. How to distinguish valid information and remove redundant information has become a research difficulty in network security defense. Information security risk management technology relies more on human subjective factors in the process of network security defense. Especially in the face of distributed, complex, and large-scale network attacks and intrusions, it is difficult for existing defense systems to fully protect users' network security.In the field of network security, the NSL-KDD data set is the benchmark data set for evaluation, but there is a lot of redundancy in the training set data. In order to accurately reflect the network security situation, this paper uses the KDD99 data set, which is optimized compared to the NSL-KDD data set to remove some duplicate data. The basic information of the KDD99 dataset is shown in Table1.Table 1
Basic information of KDD99 dataset.
Classification algorithmTrain datasetTest datasetLib-SVM2020filteredClassifier2515J482213RandomTree2311Using the attribute subsets reduced by the rough Fourier fast algorithm to train different classifiers, the classification accuracy rates of the running results are all high. At the same time, the classification and modeling time of the attribute subsets reduced by the rough Fourier fast algorithm is significantly reduced on the premise of ensuring that the attack type identification accuracy is not reduced. Among them, the modeling time of the Lib-SVM classifier is shortened by 20.55 s. In general, the performance of the attribute subset after attribute reduction using the rough Fourier fast algorithm is effectively improved compared with the original attribute set. The essence of attribute reduction is to select the attributes with higher contribution to the objective function one by one from the kernel according to the different attribute importance and add them to the kernel in turn until the requirements of the objective function are met. The classification accuracy of the running results is shown in Figure4.Figure 4
Classification accuracy of running results.Situational environment and security loopholes are inherent characteristics of network conditions, and their security conditions determine whether hackers will carry out network intrusion attacks. The original data of the network security situation are usually collected and aggregated by a variety of network security equipment in different collection methods to the complex and changeable network operation situation, so the data obtained are in various forms. The main purpose of the extraction of situational elements is to find information that can provide an important basis for situational assessment and prediction from these mixed and diverse original situational data. The reduced attribute subsets of classical reduction algorithm, genetic algorithm (GA), greedy search algorithm (GSA), attribute reduction based on mutual information (ARMI), and the rough Fourier fast algorithm proposed in this paper are used to identify attack types, and the classifiers all use Lib-SVM. This experiment is used to verify the influence of the quality of the attribute subset obtained after the reduction of the proposed algorithm on the classification results (the recall rate is shown in Figure5(a)). Compared with the data processed by other reduction algorithms, the data processed by the rough Fourier fast algorithm shows higher attack type identification performance, which shows that the rough Fourier fast algorithm has a better extraction effect of situational elements (the false alarm rate is shown in Figure 5(b)). Situational elements are the premise and foundation of situational awareness, and their quality directly affects the results of subsequent situational assessment and prediction. Especially in the contemporary society where the amount of data is expanding day by day, how to extract the element information that can effectively reflect the situation from the massive network security data has very important research significance. First of all, the data source for the extraction of situational elements is composed of network data collected by various security devices, which can comprehensively reflect the overall situation of network security; furthermore, more complex intrusion behaviors can be found for the security information provided by a variety of different network security devices, and the performance of network security defense is improved; last but not least, a large amount of redundant data are usually generated when the data provided by the network security device is fused, and situational element extraction technology can effectively remove redundant information and improve the accuracy of situational information, thereby providing more reliable decision-making basis for network workers to conduct situational assessment and prediction.Figure 5
Comparison of recall and false alarm rates. (a) Recall rate. (b) False alarm rate.
(a)(b)The process of situational awareness is to infer the future situation according to the transformation of various elements in the network environment, especially to make early warnings of security threats that may be encountered in the future to prevent them from happening, while it is difficult for people to predict the future situation; that is, it is difficult to obtain prior knowledge. Network security workers need to make timely judgments based on the collected network situation information. With the development of network technology, the data scale is increasing exponentially. How to extract key information from massive situational element data and respond to the network situation in time has become an important content of the current network security situational element extraction research. In order to further deal with the mixed network situational element data with the coexistence of nominal and numerical types, this paper proposes a situational element extraction method based on a rough Fourier fast algorithm. Making full use of the rough Fourier fast detection model can effectively deal with the typical characteristics of numerical data, effectively avoid the loss of information caused by preprocessing such as discrete decomposition, and further improve the accuracy of element extraction.Using the four classifiers Lib-SVM (a simple, easy-to-use and fast and efficient software package for SVM pattern recognition and regression), filtered classifier, J48, and random tree provided by the data mining tool WEKA, the data sets formed by the full set of sample attributes and the attribute subsets reduced by the algorithm proposed in this paper are used for attack type identification training, respectively, and the relationship between attributes and classification modeling time is shown in Table2.Table 2
Relationship between attributes and classification modeling time.
Type of attackTrain dataset (%)Test dataset (%)DoS7060R2L1216Probe1014U2R810Using the attribute subsets reduced by the rough Fourier algorithm to train different classifiers, the F-measure value of the classifiers trained on all attribute sets is increased by 0.93% on average. At the same time, the time for classification and modeling of the attribute subset reduced by the rough Fourier fast algorithm is significantly reduced, and the average time is shortened by 0.09 seconds, of which the training time of the J48 classifier is shortened to one third of the original.When a real network security attack occurs, if some pobe attacks use slow attack mode to scan hosts or ports, when their scanning frequency is greater than 2 seconds, time-based statistical methods are basically difficult to find correlations from data, and it also means that such attacks cannot be detected. The experimental comparison between the method proposed in this paper and the traditional random forest method is shown in Figure6, and the experimental comparison is also carried out considering the minority class and not considering the minority class during the experiment. Without considering the minority class, the algorithm in this paper has the problem of deleting the attributes that have a greater impact on U2R as redundant attributes, which will affect the model's detection effect on U2R. The random forest is a classifier that can be trained on samples and make predictions. The recall rate indicates the probability that the model also predicts a positive class in all data that are actually a positive class. The proposed model not only improves the precision and accuracy rate but also improves the recall rate. For the minority class (U2R), although the recall rate increases from 0.649 to 0.776, the recall rate is only 0.589 if the minority class is not considered. That is to say, for the overall dataset, the number of attack types such as U2R is too small, resulting in the information gain algorithm is not sensitive to the minority class U2R class, but is only sensitive to the majority class.Figure 6
The experimental comparison between the method proposed in this paper and the traditional random forest method.Attribute reduction is extremely important for data analysis and data mining, because it can delete some feature attributes that are relatively poorly correlated with class labels, and its impact on the classification and decision-making ability of the system can be said to be minimal. Under the rough Fourier fast algorithm, the results of precision, recall, and FPR in different dimensions are compared as shown in Figure7. It can be found that for the precision, recall, and FPR of the category DoS, the effect is the best in 30 dimensions. But for the precision, recall, and FPR of normal, U2R, probe, and R2L, the effect is the highest at 25 dimensions. The Chinese name of the R2L attack is remote user attack. As the name suggests, this type of attack is mainly through illegal remote access to the target server. This attack usually occurs because the system administrator fails to comply with the basic requirements of national network security and does not do a good job in the security of the remote control user name and user password. In this way, network attackers can use illegally obtained usernames and passwords to remotely log in to the target server or workstation host and also depend on the size of the user’s management authority opened by the target server and workstation host, the greater the user’s authority, the higher the possibility of illegally obtaining the root authority of the local host. For the two categories of normal and DoS, the difference between the results in the 30 dimension and the 25 dimension is small, but for the three categories of U2R, Probe, and R2L, the difference between the results in the 35 dimension and the 30 dimension is large. It can be seen that when the rough Fourier fast algorithm reduces the dimension of network intrusion detection data and when the dimension is 25, it has the best effect compared with other dimensions. Whether it is PCA, fast Fourier algorithm, or rough Fourier fast algorithm, it will not get the best results in very high dimensions or very low dimensions. The effect of the traditional Fourier fast algorithm is not as good as that of the PCA algorithm, but the effect of the Fourier fast algorithm optimized by rough set theory has a good improvement, and it will achieve better results than the PCA (principal component analysis) algorithm in lower dimensions. There is a linear relationship between time and data dimensions, and time increases as the dimension increases. It can not only save time and cost but also significantly improve the classification effect of minority classes.Figure 7
Results comparison of precision, recall, and FPR in different dimensions.In the field of network security intrusion detection, besides the detection rate, another important reference index is the average detection time of the attack behavior. Figure8 shows the experimental results of simulating IDS (intrusion detection system) for time detection of different attacks. Compared with other schemes, the average detection time of the improved RSDB and RE-RFE algorithms (the full name of the RFE algorithm is recursive feature elimination, which can obtain the optimal combination of variables.) is greatly shortened. Due to the different calculation characteristics of each classification algorithm, the average detection time of the rough Fourier algorithm is shorter than that of the KNN algorithm, and the efficiency is relatively higher. Overall, due to attribute reduction, the Fourier fast algorithm and efficient kernel algorithm based on rough set theory can achieve higher detection efficiency, the average classification accuracy is increased by more than 43%, and the average detection time is shortened by 0.05 s on average.Figure 8
Experimental results of simulating IDS (intrusion detection system) for temporal detection of different attacks.


## 2.1. Computer Network Intrusion Anomaly Detection

Network intrusion attacks refer to threats and violations of the network security situation, including intrusion tools, intrusion methods, and intrusion results. The first line of defense mechanism for network intrusion (authentication, encryption and decryption, firewall, and other technologies) is not flexible enough and perfect to block different types of attacks and intrusions, and attackers can easily bypass them. Antivirus software emerges as the second line of defense, but it can only detect attacks with known characteristics in the database. Their ability to respond is limited, and responding to an attack may take several hours until the next update. Intrusion detection technology collects relevant information about the violation of security policy, and intrusion detection technology collects and analyzes information from network modules to determine the element characteristics that violate the security policy. Accuracy, scalability, and adaptability are three important characteristics of intrusion detection schemes. The intrusion detection scheme must have good accuracy and adaptability to resist the intruder's attack. Intrusion detection scheme is the cornerstone of maintaining computer security, and it can detect unknown attack types through some techniques [11, 12].Assuming that the dimension of the sample space setD of computer network intrusion anomaly detection is n, the distance between p and q is defined as(1)d∞=∑i=1npi−qix.The formula for dimensionless processing of computer network intrusion anomaly detection using standard quantitative methods is [13](2)yi=xis.Among them,(3)x¯=∑i=1nxin,s=1n−1∑i=1nxi−x¯.The IDS general model classification is shown in Figure1. IDS can be classified differently according to the audit data source, detection principle, working method, architecture, and so on. The former is to store the characteristics of known attack models in a database and compare the network data to be detected with the abnormal behavior characteristics in the database, if they match, it is determined as abnormal behavior. When there are unknown features or changes from the real feature model, the detection effect of misuse detection is not ideal. Likewise, it also exists as antivirus software and needs to be regularly updated to detect new types of attacks. The latter is to establish a database of normal behavior by observing and analyzing the normal behavior of the network module and compare the detected data with the normal behavior in the database. If there is any deviation, it is judged as an outlier, and if it deviates from normal behavior, it is regarded as an attack [14]. In the anomaly detection scheme, there is no need to know the attack characteristics in advance, and the detection of unknown attack types can be realized, which is more feasible in the real environment. Static detectors work on the principle that the detection module fixes parts that will not change, such as the operating software. The dynamic detector is based on network traffic data and audit records and sets thresholds to distinguish normal consumption from abnormal resource consumption. Another disadvantage is that if an attacker knows it is being detected, it can change its profile and train an anomaly detection module to think that the malicious behavior of the network is normal [15].Figure 1
IDS generic model classification.The information module and vulnerability together constitute the research object of the attack-defense model. The attacker attacks the target information module based on its own information module. From the perspective of the defense side, the assets mapped by the information module together with the vulnerabilities and threats constitute the input of the risk assessment in the defense model. Attackers and defenders interact through information modules. Adding information modules to the security model can not only organize various security core technologies around the information modules but also further clarify the specific objects of security attack and defense, which can be targeted, which is one of the characteristics of the attack and defense security model in this paper. The information module contains the information technology module and the people, organization, and management components of the information module. The latter is the research area of management science and so on. Offensive and defensive models model information technology solutions into both static and dynamic aspects. The static part of the core layer mainly includes a hierarchical network topology model and a product model. The hierarchical network topology model models the basic network as consisting of hosts and links corresponding to the set of interfaces. Based on the basic network model, it is extended by using the concepts of hierarchy and object-oriented to describe the actual hierarchical network structure. When the covariance matrix of the computer network intrusion anomaly detection sample is a diagonal matrix, the Mahalanobis distance becomes the standard Euclidean distance [16, 17]:(4)dX,Y=xi−yi2θi2.Constructing the information model is only the first step of the security model, other nonsecurity modules, such as business modules, share information modules. The research on vulnerability analysis is the essence of the security program. The information module includes the information technology module and the personnel, organization, and management parts of the information module. Correspondingly, the vulnerability includes four types: management vulnerability, human vulnerability, network structure vulnerability, and host vulnerability. Among them, host vulnerabilities are the most commonly used types by attackers, which are generated by input validation errors, logic defects, and other inputs, and have effects such as information leakage, access rights acquisition, privilege escalation, and denial of service. The above is the gist of the purpose section of the vulnerability model. The vulnerability model also includes the root part; that is, the introduction of vulnerability is caused by the violation of existing or new software engineering techniques, software usage, and environmental assumptions. New vulnerabilities can be discovered through vulnerability testing and analysis. Vulnerability constitutes the basic factor of threat, and attackers use vulnerability knowledge to construct vulnerability exploit tools and use exploit tools to construct attack scenarios. Vulnerability is also a fundamental factor in risk analysis. The risk assessment of the protected module can be carried out according to the vulnerability, threat, and asset model, and risk assessment is the basis of information assurance. Therefore, vulnerability as the intrinsic object of the security module is also an analysis point for both the offensive and defensive [18, 19].


## 2.2. Application of Rough Fourier Fast Algorithm in Intrusion Anomaly Detection

The traditional Fourier algorithm adopts the method of sequentially taking blocks in the frequency domain and replacing the amplitude, which is an algorithm based on the most primitive phase recovery idea. The discretization of continuous attribute data means that the numerical data with continuous characteristics are represented by discrete values in a certain method. The discretization process will inevitably lead to the loss of useful intrusion anomaly detection information. By choosing an appropriate method, this loss can be minimized. There are redundant attributes in the classification method under the premise of satisfying a certain classification accuracy. Through attribute reduction, not only the reduced attribute set can be obtained but also the rules can be extracted from the data, and knowledge can be obtained through attribute reduction. In addition, the attribute set of intrusion anomaly detection reduction is not unique. The distinguishing function of the decision tableS for computer network intrusion anomaly detection is defined as [20](5)Δ∗=∑x,y∈Uα∗x,y.In general, the attribute reduction of rough sets is not unique, but the core is unique. Rough sets also provide the ability to extract rules from the computer network intrusion anomaly detection decision table, that is, the ability to generate decision rules. For a discrete given sequence ofN points {x (k)}, 0 ≤ k ≤ N − 1, after Fourier transform it becomes a new sequence {y (k)}, 0 ≤ k ≤ N − 1, this transformation can be described by the following formula [21]:(6)yi=∑k=0Nxkωki.Assuming thatn represents the length, the maximum similarity of the observed abnormal sequence X of computer network intrusion is(7)Smax=nn−12.At this time, it indicates that there is a sequenceY that exactly matches the observed sequence X in the computer network intrusion anomaly sequence library, and the occurrence of intrusion can be judged. As long as the abnormal degree of computer network intrusion is greater than the set threshold, the occurrence of intrusion can also be judged. If a certain sequence appears in large numbers and has a high degree of abnormality, the module can update the sequence as a computer network intrusion abnormal sequence sample into the module abnormal sequence database [22].The anomaly detection process based on the rough Fourier fast algorithm is shown in Figure2. Due to the advantages of fast rough Fourier algorithm in dealing with the relationship between massive data, the fast rough Fourier algorithm is applied to the field of anomaly detection, which can automatically extract knowledge and patterns useful to users from a large amount of data and then determine whether abnormal behavior occurs. Generally speaking, anomaly detection module based on rough Fourier algorithm mainly consists of six components: data collector, data warehouse, data miner, pattern generator, detector, and response engine. The advantage of anomaly detection based on rough Fourier fast algorithm is that the module can automatically mine normal and intrusion behavior models from massive data sets, without manual analysis, and the degree of automation is high. The disadvantage is that the detection results of the module largely depend on the purity of the initial training data set, and the detection ability of new, unknown, and yet to be discovered attack types is weak [23].Figure 2
Anomaly detection process based on rough Fourier fast algorithm.The classical rough set model regards knowledge as an indistinguishable relationship and uses the set inclusion relationship and the nonempty overlap condition to define a pair of upper and lower approximations for a given set of anomaly detection information. At the same time, since in many cases, we can allow some degree of error in order to make more accept or reject decisions for other objects. So a strict formula may limit its applicability and flexibility. The rough Fourier fast algorithm membership degreeαA can be defined as [24](8)αAx=x∪xx.In practical applications, a looser classification might make more sense. If the conditional probability of a computer network intrusion anomaly detection object is large enough, it is classified into the positive domain. Similarly, if the conditional probability of a computer network intrusion anomaly detection object is small enough, it will be assigned to the negative field.IfPωi|x represents the probability of a given computer network intrusion anomaly detection object x when the true state is, the expected cost of taking the action of aj is [25](9)Raj|x=∑i=1mPωi|x.In this paper, the rough Fourier algorithm is selected. After discretization, there are only hundreds of conflict records, which is acceptable compared to hundreds of thousands of records. The dataset adopts the standard intrusion detection test dataset of KDD99. The data is divided into three groups: Probe attack detection data (only including “basic attribute set + traffic attribute set” features), DoS attack detection data (only include “basic attribute set + traffic attribute set” feature), and U2R&R2L attack detection data (only include “basic attribute set + content attribute set” feature). For each type of data set, a decision module is constructed separately. In each class of datasets, our goal is to learn and classify normal (marked as +1) and attack (marked as −1) data examples. The method is to sample the above three types of data sets according to the rough set classification algorithm described in the previous section (where the ratio of training set and test set is 8 : 2), discretize (equal frequency interval method), and other processing. The specific data preprocessing results are as follows: for the Probe attack, the processed data set contains a total of 2400 records, of which 300 are attack data, and the rest are normal. 1900 data are used for training, and the rest are used for testing. For the DoS attack, our processed dataset contains a total of 5300 records, of which 3200 are attack data, and the rest are normal. 4200 data are used for training, and the rest are used for testing. For the U2R&R2L attack, our processed dataset contains a total of 2200 records, of which 90 are attack data, and the rest are normal. 1100 data are used for training, and the rest are used for testing [26].


## 2.3. Computer Network Intrusion Anomaly Detection Results

With the advent of the “Internet +” era, more and more people join the Internet army, and people's daily life, study, and work are quietly changing. On the one hand, the growing Internet technology provides convenience to people's daily life, and on the other hand, it is also used by hackers to endanger network and information security. Many network security incidents have all sounded the alarm for people, and network security issues cannot be ignored. With the development of many Internet technologies such as intelligent technology, cloud computing, mobile payment, network security problems are not limited to viruses, Trojans, phishing websites, or traditional system vulnerabilities. Establishing a unified network security defense system and doing a good job in risk prevention is the direction of network security construction.Almost all the problems faced by website security come from illegal phishing, website backdoor intrusion, and malicious tampering of webpages. Therefore, we must quickly seize this rare historical opportunity of the development of informatization, strengthen the promotion of positive information, and maintain the network security environment. The number of network attacks using IP addresses controlled by malicious programs such as Trojans and botnets accounted for 96.3% of the total in China. From January 2020 to January 2021, 80.3% of the exploited attack locations were remote attacks, of which 33% were high risk, and 42% are low risk. In 2020, there were 19,930 information system security vulnerabilities, an increase of 24.2% over 2019. Among them, high-risk vulnerabilities accounted for 33.2% of the total number of vulnerabilities in the year, a year-on-year increase of 36.4%. The types of objects affected by these vulnerabilities mainly include computer operating systems, web applications, network devices (switches), blockchain alliance chains, databases, security products, and blockchain public chains. The degree of risk of vulnerability exploitation is shown in Figure3.Figure 3
The level of risk of exploits.Existing intrusion detection systems, vulnerability scanning systems, and many other network security products are mainly based on passive defense and lack of cooperation and communication with each other. Although they play a role in security defense to a certain extent, there are still some defects. The traditional firewall technology only isolates the internal and external network to realize the defense of the external network intrusion, but cannot deal with the intrusion behavior inside the network. Intrusion detection technology generates various alarm information when the system is running. With the continuous expansion of the network scale, the amount of alarm information is also increasing. How to distinguish valid information and remove redundant information has become a research difficulty in network security defense. Information security risk management technology relies more on human subjective factors in the process of network security defense. Especially in the face of distributed, complex, and large-scale network attacks and intrusions, it is difficult for existing defense systems to fully protect users' network security.In the field of network security, the NSL-KDD data set is the benchmark data set for evaluation, but there is a lot of redundancy in the training set data. In order to accurately reflect the network security situation, this paper uses the KDD99 data set, which is optimized compared to the NSL-KDD data set to remove some duplicate data. The basic information of the KDD99 dataset is shown in Table1.Table 1
Basic information of KDD99 dataset.
Classification algorithmTrain datasetTest datasetLib-SVM2020filteredClassifier2515J482213RandomTree2311Using the attribute subsets reduced by the rough Fourier fast algorithm to train different classifiers, the classification accuracy rates of the running results are all high. At the same time, the classification and modeling time of the attribute subsets reduced by the rough Fourier fast algorithm is significantly reduced on the premise of ensuring that the attack type identification accuracy is not reduced. Among them, the modeling time of the Lib-SVM classifier is shortened by 20.55 s. In general, the performance of the attribute subset after attribute reduction using the rough Fourier fast algorithm is effectively improved compared with the original attribute set. The essence of attribute reduction is to select the attributes with higher contribution to the objective function one by one from the kernel according to the different attribute importance and add them to the kernel in turn until the requirements of the objective function are met. The classification accuracy of the running results is shown in Figure4.Figure 4
Classification accuracy of running results.Situational environment and security loopholes are inherent characteristics of network conditions, and their security conditions determine whether hackers will carry out network intrusion attacks. The original data of the network security situation are usually collected and aggregated by a variety of network security equipment in different collection methods to the complex and changeable network operation situation, so the data obtained are in various forms. The main purpose of the extraction of situational elements is to find information that can provide an important basis for situational assessment and prediction from these mixed and diverse original situational data. The reduced attribute subsets of classical reduction algorithm, genetic algorithm (GA), greedy search algorithm (GSA), attribute reduction based on mutual information (ARMI), and the rough Fourier fast algorithm proposed in this paper are used to identify attack types, and the classifiers all use Lib-SVM. This experiment is used to verify the influence of the quality of the attribute subset obtained after the reduction of the proposed algorithm on the classification results (the recall rate is shown in Figure5(a)). Compared with the data processed by other reduction algorithms, the data processed by the rough Fourier fast algorithm shows higher attack type identification performance, which shows that the rough Fourier fast algorithm has a better extraction effect of situational elements (the false alarm rate is shown in Figure 5(b)). Situational elements are the premise and foundation of situational awareness, and their quality directly affects the results of subsequent situational assessment and prediction. Especially in the contemporary society where the amount of data is expanding day by day, how to extract the element information that can effectively reflect the situation from the massive network security data has very important research significance. First of all, the data source for the extraction of situational elements is composed of network data collected by various security devices, which can comprehensively reflect the overall situation of network security; furthermore, more complex intrusion behaviors can be found for the security information provided by a variety of different network security devices, and the performance of network security defense is improved; last but not least, a large amount of redundant data are usually generated when the data provided by the network security device is fused, and situational element extraction technology can effectively remove redundant information and improve the accuracy of situational information, thereby providing more reliable decision-making basis for network workers to conduct situational assessment and prediction.Figure 5
Comparison of recall and false alarm rates. (a) Recall rate. (b) False alarm rate.
(a)(b)The process of situational awareness is to infer the future situation according to the transformation of various elements in the network environment, especially to make early warnings of security threats that may be encountered in the future to prevent them from happening, while it is difficult for people to predict the future situation; that is, it is difficult to obtain prior knowledge. Network security workers need to make timely judgments based on the collected network situation information. With the development of network technology, the data scale is increasing exponentially. How to extract key information from massive situational element data and respond to the network situation in time has become an important content of the current network security situational element extraction research. In order to further deal with the mixed network situational element data with the coexistence of nominal and numerical types, this paper proposes a situational element extraction method based on a rough Fourier fast algorithm. Making full use of the rough Fourier fast detection model can effectively deal with the typical characteristics of numerical data, effectively avoid the loss of information caused by preprocessing such as discrete decomposition, and further improve the accuracy of element extraction.Using the four classifiers Lib-SVM (a simple, easy-to-use and fast and efficient software package for SVM pattern recognition and regression), filtered classifier, J48, and random tree provided by the data mining tool WEKA, the data sets formed by the full set of sample attributes and the attribute subsets reduced by the algorithm proposed in this paper are used for attack type identification training, respectively, and the relationship between attributes and classification modeling time is shown in Table2.Table 2
Relationship between attributes and classification modeling time.
Type of attackTrain dataset (%)Test dataset (%)DoS7060R2L1216Probe1014U2R810Using the attribute subsets reduced by the rough Fourier algorithm to train different classifiers, the F-measure value of the classifiers trained on all attribute sets is increased by 0.93% on average. At the same time, the time for classification and modeling of the attribute subset reduced by the rough Fourier fast algorithm is significantly reduced, and the average time is shortened by 0.09 seconds, of which the training time of the J48 classifier is shortened to one third of the original.When a real network security attack occurs, if some pobe attacks use slow attack mode to scan hosts or ports, when their scanning frequency is greater than 2 seconds, time-based statistical methods are basically difficult to find correlations from data, and it also means that such attacks cannot be detected. The experimental comparison between the method proposed in this paper and the traditional random forest method is shown in Figure6, and the experimental comparison is also carried out considering the minority class and not considering the minority class during the experiment. Without considering the minority class, the algorithm in this paper has the problem of deleting the attributes that have a greater impact on U2R as redundant attributes, which will affect the model's detection effect on U2R. The random forest is a classifier that can be trained on samples and make predictions. The recall rate indicates the probability that the model also predicts a positive class in all data that are actually a positive class. The proposed model not only improves the precision and accuracy rate but also improves the recall rate. For the minority class (U2R), although the recall rate increases from 0.649 to 0.776, the recall rate is only 0.589 if the minority class is not considered. That is to say, for the overall dataset, the number of attack types such as U2R is too small, resulting in the information gain algorithm is not sensitive to the minority class U2R class, but is only sensitive to the majority class.Figure 6
The experimental comparison between the method proposed in this paper and the traditional random forest method.Attribute reduction is extremely important for data analysis and data mining, because it can delete some feature attributes that are relatively poorly correlated with class labels, and its impact on the classification and decision-making ability of the system can be said to be minimal. Under the rough Fourier fast algorithm, the results of precision, recall, and FPR in different dimensions are compared as shown in Figure7. It can be found that for the precision, recall, and FPR of the category DoS, the effect is the best in 30 dimensions. But for the precision, recall, and FPR of normal, U2R, probe, and R2L, the effect is the highest at 25 dimensions. The Chinese name of the R2L attack is remote user attack. As the name suggests, this type of attack is mainly through illegal remote access to the target server. This attack usually occurs because the system administrator fails to comply with the basic requirements of national network security and does not do a good job in the security of the remote control user name and user password. In this way, network attackers can use illegally obtained usernames and passwords to remotely log in to the target server or workstation host and also depend on the size of the user’s management authority opened by the target server and workstation host, the greater the user’s authority, the higher the possibility of illegally obtaining the root authority of the local host. For the two categories of normal and DoS, the difference between the results in the 30 dimension and the 25 dimension is small, but for the three categories of U2R, Probe, and R2L, the difference between the results in the 35 dimension and the 30 dimension is large. It can be seen that when the rough Fourier fast algorithm reduces the dimension of network intrusion detection data and when the dimension is 25, it has the best effect compared with other dimensions. Whether it is PCA, fast Fourier algorithm, or rough Fourier fast algorithm, it will not get the best results in very high dimensions or very low dimensions. The effect of the traditional Fourier fast algorithm is not as good as that of the PCA algorithm, but the effect of the Fourier fast algorithm optimized by rough set theory has a good improvement, and it will achieve better results than the PCA (principal component analysis) algorithm in lower dimensions. There is a linear relationship between time and data dimensions, and time increases as the dimension increases. It can not only save time and cost but also significantly improve the classification effect of minority classes.Figure 7
Results comparison of precision, recall, and FPR in different dimensions.In the field of network security intrusion detection, besides the detection rate, another important reference index is the average detection time of the attack behavior. Figure8 shows the experimental results of simulating IDS (intrusion detection system) for time detection of different attacks. Compared with other schemes, the average detection time of the improved RSDB and RE-RFE algorithms (the full name of the RFE algorithm is recursive feature elimination, which can obtain the optimal combination of variables.) is greatly shortened. Due to the different calculation characteristics of each classification algorithm, the average detection time of the rough Fourier algorithm is shorter than that of the KNN algorithm, and the efficiency is relatively higher. Overall, due to attribute reduction, the Fourier fast algorithm and efficient kernel algorithm based on rough set theory can achieve higher detection efficiency, the average classification accuracy is increased by more than 43%, and the average detection time is shortened by 0.05 s on average.Figure 8
Experimental results of simulating IDS (intrusion detection system) for temporal detection of different attacks.


## 3. Conclusion

Network abnormal behavior detection is the process of monitoring network behavior to find events that violate normal network behavior. The anomaly detection system is configured in the important nodes of the network system. By collecting and analyzing the information data in the network in real time, it detects whether there is a deviation from the normal behavior of the network, so as to prevent attacks. The application of network abnormal behavior detection technology can detect the intrusion attack before the abnormal behavior occurs in the network system and use the alarm and protection system to respond to the abnormal event, so as to reduce the loss caused by the abnormal behavior. In this paper, a rough Fourier fast algorithm based on rough set theory is proposed, which can help us reduce the conditional properties of the data and remix the data. The simulation results show that the method can effectively solve the above problems in the research and application of the intrusion detection algorithm based on rough set theory, while ensuring the original data is not distorted. Compared with other attribute reduction algorithms, the algorithm proposed in this paper has higher accuracy and lower false alarm rate, which proves the excellent performance of the algorithm proposed in this paper. The attribute reduction operation is only the data preprocessing stage of the network security intrusion detection algorithm. How to effectively detect various types of network attacks is the most important research in the field of network security, and further study and research should be carried out on algorithms such as machine learning and deep learning in future work.



---

*Source: 4751844-2022-09-29.xml*