Abstract: Aiming at the problems of incomplete feature extraction and limited model generalization ability in intrusion detection research, a domain adaptive intrusion detection method with dynamic feature fusion is proposed. Firstly, a convolutional neural network is used to extract spatial features, while a bidirectional long shortterm memory network is utilized for temporal feature extraction. This approach enables comprehensive extraction of multidimensional feature information from network traffic data. Secondly, the uncertainty is measured by calculating the information entropy of the two features, and different weights are assigned according to the entropy value, and the extracted features are weighted and fused according to the weights. Finally, during the training process, the proposed adaptive domain weight loss algorithm is used to dynamically adjust the contribution of the source domain and target domain data to improve the generalization ability of the model on the target domain data. Experiments are carried out using the NSLKDD and UNSWNB15 datasets. Compared with the existing mainstream methods, this method has higher detection accuracy, which is 0.8563 and 0.916 respectively.

Key words: feature extraction, dynamic feature fusion, domain adaptive, intrusion detection, source domain, target domain

摘要： 针对入侵检测研究中特征提取不全面、模型泛化能力差的问题，提出了一种动态特征融合的域自适应入侵检测方法：首先，通过卷积神经网络提取空间特征，利用双向长短期记忆网络提取时序特征，全面提取网络流量数据的多维特征信息；其次，通过计算2种特征的信息熵衡量不确定性，根据熵值分配不同的权重，并根据权重将提取的特征加权融合；最后，在训练过程中使用提出的自适应域权重损失算法动态调节源域和目标域数据的贡献比例，以提高模型在目标域数据上的泛化能力.在NSLKDD和UNSWNB15数据集上的实验表明，与现有的主流方法相比该方法具有更高的检测准确率，分别达到0.8563和0.916.

关键词: 特征提取, 动态特征融合, 域自适应, 入侵检测, 源域, 目标域