Network security situation assessment based on dual attention mechanism and HHO-ResNeXt

Figures & data

Figure 1. The equivalent blocks of ResNeXt.

Figure 2. The efficient channel attention module.

Figure 3. The contextual transformer (CoT) block.

Figure 4. The ECA-ResNeXt block.

Figure 5. The CoTNeXt block.

Figure 6. The complete structure of our model.

Table 1. Details of this model.

Stage	Output	Structure
res1	14 × 14	$[\text{Conv}2\text{d},3\times 3,32,1]\times 1$
res2	14 × 14	$\left[\begin{array}{r}\text{Conv}2\text{d},1\times 1,32,1\\ \text{CoT},32,2\\ \text{Conv}2\text{d},1\times 1,64,1\end{array}\right]\times 1$$[\text{CoT},64,1]\times 2$
res3	14 × 14	$\left[\begin{array}{c}\text{Conv}2\text{d},1\times 1,64,1\\ \text{Conv}2\text{d},3\times 3,64,4\\ \text{Conv}2\text{d},1\times 1,128,1\end{array}\right]\times 1$$[\text{Conv}2\text{d},3\times 3,128,1]\times 2$
res4	14 × 14	$\left[\begin{array}{r}\text{Conv}2\text{d},1\times 1,128,1\\ \text{Conv}2\text{d},3\times 3,128,4\\ \text{Conv}2\text{d},1\times 1,256,1\\ \text{Conv}1\text{d},5,1,1\end{array}\right]\times 1$$[\text{Conv}2\text{d},3\times 3,256,1]\times 2$
res5	14 × 14	$\left[\begin{array}{c}\text{Conv}2\text{d},1\times 1,256,1\\ \text{Conv}2\text{d},3\times 3,256,4\\ \text{Conv}2\text{d},1\times 1,512,1\end{array}\right]\times 1$
	1 × 1	GAP,10-d, FC, Softmax

Figure 7. The flow chart of the network security situation assessment model.

Table 2. Impact of attacks in the NSL-KDD dataset.

Type of attack	Attack impact
Benign	0
Dos	1
U2R	2
R2L	3
Probe	4

Table 3. Impact of attacks in the UNSW-NB15 dataset.

Type of attack	Attack impact	Type of attack	Attack impact
Normal	0	Generic	5
Fuzzers	1	Reconnaissance	6
Analysis	2	Backdoor	7
DOS	3	Shellcode	8
Exploits	4	Worm	9

Figure 8. Actual network security situation values for NSL-KDD dataset.

Figure 9. Actual network security situation values for UNSW-NB15 dataset.

Table 4. Experiment results of different models.

	NSL-KDD dataset			UNSW-NB15 dataset
Model	Accuracy%	Precision%	F-scores%	Accuracy%	Precision%	F-scores%
Improved CNN	78.54	80.88	77.77	80.15	78.52	76.80
DT-ANN	79.19	78.36	77.15	79.29	73.44	75.66
RF	78.84	81.24	77.80	80.23	82.37	76.48
DCNN	79.01	79.43	78.87	78.04	74.89	74.53
ResNet	80.00	79.51	78.09	82.44	82.08	80.09
ResNeXt	78.20	81.86	75.66	82.35	81.98	80.38
Ours	81.95	82.08	81.67	82.77	82.40	80.83

Figure 10. Situation assessment results on the NSL-KDD dataset.

Figure 11. Situation assessment results on the UNSW-NB15 dataset.

Table 5. Network security situation assessment results of each model.

	NSL-KDD dataset			UNSW-NB15 dataset
Model	MAE	MSE	MAPE	MAE	MSE	MAPE
Improved CNN	0.1347	1.894e-02	20.03	1.052e-02	1.415e-04	1.246
DT-ANN	0.1149	1.403e-02	17.05	6.256e-03	5.742e-05	0.7393
RF	0.1446	2.152e-02	21.52	6.908e-03	6.019e-05	0.8169
DCNN	3.571e-02	1.563e-03	5.257	2.464e-02	6.492e-04	2.917
ResNet	0.1357	1.921e-02	20.19	5.288e-03	3.958e-05	0.6228
ResNeXt	0.2216	4.968e-02	33.03	8.828e-03	1.083e-04	1.043
Ours	1.868e-02	5.087e-04	2.762	4.712e-03	2.800e-05	0.5553