Research on Anomaly Detection in Massive Multimedia Data Transmission Network Based on Improved PSO Algorithm

With the development of computer network technology and the expansion of network system, sensitive data is facing the threat of hacker attack. Intrusion detection is an active network security defense measure, which is an attempt to invade, an ongoing intrusion or an intrusion that has occurred to identify the process. At present, the detection rate of intrusion detection method is low, the false alarm rate and false alarm rate is high, and the real-time performance is poor. It needs a large number of or complete data to achieve better detection performance. In this paper, the concept, characteristics, classification, research contents and difficulties of traditional intrusion detection for mass multimedia data transmission network are described. Then, the basic principle of neural network and particle swarm optimization (PSO) algorithm and the basic idea of particle swarm optimization algorithm with quantum (QPSO) behaviour are introduced. It is emphasized that QPSO has better convergence performance than PSO algorithm in global optimization problems. In this paper, the concept, characteristics and structure of neural network are described, and the algorithm and classification of wavelet neural network are introduced. Then taking wavelet neural network (WNN) as the object, using the QPSO algorithm as the training algorithm, the concrete operation process is given. The research work in this paper shows that the performance of neural network trained by QPSO algorithm and improved QPSO algorithm is better than that of other intelligent algorithms such as PSO algorithm and genetic algorithm, and the convergence speed is faster than that of PSO algorithm or GA algorithm. QPSO is a high performance neural network training algorithm, which can play a good role in neural network anomaly detection.

geographical location will help to expand the application scope of multimedia data management system, spread the load of data processing, and improve the data processing ability of the system [7]. It can increase the ability of parallel computing and improve the effectiveness and stability of the system. Distributed multimedia mass data management system model but in the distributed environment, the design of the system will have to consider the key issues such as data compression and decompression, network load balancing, information synchronization and effective management of multimedia information [8].
Packet transmission rates are getting faster and faster. This requires that the response speed of intrusion detection system must be improved, and the accuracy should be improved accordingly [8]. But due to the misuse or abnormal intrusion detection technology, it is necessary to compare each data with a large number of patterns in the signature database, so the efficiency of both is not high. Therefore, how to distinguish the abnormal state from the normal state and improve the accuracy and rapid response of intrusion detection system has become a practical problem [9].

II. IMPROVED PSO ALGORITHM A. PARTICLE SWARM OPTIMIZATION
Particle swarm optimization(PSO) was proposed by American social psychologist James Kennedy and electrical engineer Russell Eberhart in 1995 [10]. The basic idea was inspired by their early findings on the behavior of bird populations and the use of biologist Frank Heppner's biological population model. PSO is another swarm intelligence algorithm in the field of computational intelligence besides ant colony optimization. It is similar to genetic algorithms [11]. Global search is realized by cooperation and competition of individual questions [12]. The system is initialized as a set of random solutions called particles. Through the particle flight in the search house, it does not have the crossover and mutation operator of genetic algorithm, but the particle in the solution space to follow the optimal particle search [13].
Since PSO was put forward, due to its computational speed and easy realization of the algorithm itself, it has attracted the attention and research of many scholars in the related fields in the world. The research can be divided into three parts: algorithm itself, parameter selection, topology, fusion with other evolutionary techniques and applications [14]. Initially, PSO was designed for real value problems. Later, the algorithm is extended to binary PSO and discrete problem, which provides a useful way to compare the performance of PSO algorithm and genetic algorithm. This method can be used in the structure optimization of neural network [15].
PSO algorithm is derived from the simulation of predation behaviour of birds. Imagine a situation where a group of birds are randomly searching for food, and there is only one food in this area, and all birds don't know where the food is, but they know how far away they are from the food [22]. So what is the best strategy for finding food? The simplest and most effective is to search the surrounding area of the bird that is currently closest to the food [23]. PSO draws inspiration from this model and uses it to solve optimization problems.
In the PSO model, the solution of each optimization problem is the state of a ''particle'' in the search space. Each particle has a fitness value (fitness value), determined by the optimized function and a velocity that determines the direction and distance of their flight [24]. Particles can be dynamically adjusted according to their own flight experience and that of their peers, which can be said to update themselves by tracking two positions [25]. One is the optimal solution p-best found by the particle itself. That is, the best position of the individual; the other is the optimal solution ghost, which is the global best position, which is found by the whole population [26].
Particle swarm optimization (PSO) is a general heuristic search technique. The basic idea of PSO is to find the optimal solution through cooperation and information sharing among individuals in the population [27]. The search process of PSO is to initialize a group of random particles first. Each particle has its own position and initial velocity (which determines the direction and distance of flight), assuming that in a D-dimensional target search space, m particles are randomly generated to form a community. Then the position of the f particle in the D dimensional search space is vector [28].
In which, T is the number of iterations, and its individual extremum is recorded as follows, The global extremum is recorded as the following expression, During the reception, the t particle flies in the search space with a velocity V i , and the velocity and position of each particle are modified according to the following formula [29]: VOLUME 8, 2020 FIGURE 2. Flow chart of particle swarm optimization algorithm.
In which, v t denotes the velocity after the t-th iteration, c 1 and c 2 are two constants, r 1 and r 2 are random numbers between [0, 1] and r 2 , w is the inertial factor, and generally between 0.1 and 0.9. Flow chart of particle swarm optimization algorithm is given in Figure 2 [30].

B. APPLICATION OF PARTICLE SWARM OPTIMIZATION IN INTRUSION DETECTION
In recent years, although the intrusion detection system (IDS) has been a relatively large development, the overall situation is not satisfactory [16]. The biggest problem is that the current intrusion detection product detection accuracy is relatively low, false positives and false reports are more [17]. In order to improve the monitoring accuracy and speed of IDS, some other concepts and methods have been introduced into the IDS. Anomaly detection based on intelligent algorithm has become a hot research topic in the near future [18], [19]. Some intelligent detection techniques such as neural network (ANN), support vector machine (SVM), artificial genetic, multi-agent, hidden Markov chain model (HMM) and so on have been developed. Optimization theory and method with high convergence and stability has become a new research field and development direction [20]. In this case, some scholars consider the shortcomings of these algorithms, such as complex computation, slow convergence and so on, and consider using particle swarm optimization to overcome these shortcomings. Not only is it getting more and more attention. And it has begun to play a key role in different environments [21].

C. IMPROVED PSO ALGORITHM DESIGN
Differential evolution algorithm (DEA) is a stochastic parallel direct search algorithm. Its basic idea is that starting from a random initial population, we can get the intermediate population by using the difference between the individuals of the current population [31]. Then a generation of population is obtained by the competition of fitness value between father and son, and the global search of the solution space is realized. There are three operations running through the whole process of the algorithm, namely, mutation, crossover and selection. The differential mutation operation can generate a new individual from the parent population to the intermediate generation by the following formula [32]: In which, subscript I represents the first individual, subscript t represents the algebra of evolution. x r1 , x r2 , x r3 is a random selection of three different individuals from the evolutionary population, and F is a scaling factor [33]. It is used to control the influence of the difference vector F ∈ [0, 1].
Differential crossover operations are designed to increase the diversity of new populations by exchanging parts of code between old and new individuals according to the crossover strategy, thus forming new individuals. There are usually two crossover operators. The first is the binomial crossover operator, the second is the exponential crossover operator. In this paper, the binomial crossover operator is chosen. The crossover strategy can be expressed by the following formula: In which, subscript i represents the first individual, and subscript j represents the j dimensional rand m(j) ∈ 0 of the intermediate generation vector v (or population vector x) as a uniformly distributed random number, randn i ∈ [0, 0]. D (where D is the dimension of vector) is a random selection exponent, which ensures that n can obtain at least one parameter from v, and C r ∈ 0 is a crossover probability.
In the basic differential evolution algorithm, the selection operation adopts greedy strategy, that is, only when the pregenerational individual is better than the parent individual, otherwise the parent individual will be retained to the next generation. Differential evolution algorithm flow chart is shown in Figure 3.
The mathematical model of the improved PSO algorithm is expressed as follows: Elementary particle: Fitness function: Constraint condition: In the previous formula, P i represents the first particle, m represents the size of the particle swarm, that is, the number of particles in the swarm, V (t) represents the storage capacity of the t scheduling period, t is the dimension of the solution vector, that is, the scheduling period (12 months). N denotes the number of network nodes). A represents the throughput coefficient of the network node, Q (t) represents the network traffic in the t scheduling period, H (t) represents the network data, Q (t) for the t scheduling period and represents the network traffic for the t scheduling period. S (t) represents the network capacity of the t scheduling period, F(t), Q (t) , and S (t) respectively representing the number of uploads, downloads and the number of packets lost in the network during the t period. Q (t) represents the traffic, Vmin (t) of the fth-scheduled network. V max(t) , Q min(t) , Q max(t) , N min(t) and N max(t) represent the lower upper limit of the storage capacity, download and network capacity of the network in the t-th scheduling period, respectively.

III. ANOMALY DETECTION IN MASSIVE MULTIMEDIA DATA TRANSMISSION NETWORK A. REQUIREMENTS FOR MULTIMEDIA DATA
Mass multimedia data processing includes the analysis, conversion, calculation, storage, fast downloading and accessing of massive multimedia data. Usually, the data scale can reach TB or even PB level. The main contents are as follows: (1) high resource consumption, (2) high cost of system construction, (3) high requirement of QOS, (4) read-only multimedia data. (4) once media such as image, audio, video and animation enter the storage system, they are seldom modified.
Due to the large amount of information, unstructured and dynamic characteristics of multimedia data itself, traditional database systems (including relational, hierarchical, network) cannot meet the requirements of effective management of multimedia data. There are two important development directions in multimedia data management. The security and transaction integrity of relational database is the basis of multimedia extension. Security is expressed in the form of domain-level, table-level and database-level access control; transactional integrity refers to the synchronization of the affected parts of the database when the transaction is backed back when the transaction is updated. Relational database not only stores multimedia data in database, but also defines types, which makes multimedia data also affected by concurrency and transaction control.
Cloud storage system has the characteristics of massive storage and computing resources, high reliability, high expansibility and low cost. It consists of hundreds or thousands of cheap storage machines. Continuous monitoring, error detection, fault tolerance and automatic recovery are essential components of the system. Each storage machine is an independent storage node, and the addition and separation of nodes do not affect the normal operation of the system. The amount of data in the file is very large in the traditional sense, most of the file changes are the operation of adding new data instead of overwriting the existing data. These characteristics show that cloud storage system has a unique advantage in processing massive multimedia data.
In the distributed file system of Google, the data file is divided into blocks of fixed size. Each block is marked by a globally unique and invariant block handle. The block handle is allocated by the system when the block is created. The block of files is stored in the local disk of each data node. Read and write blocks through block handles and byte ranges. To ensure the reliability of the data, each block is stored on different data nodes in the form of multiple replicas. Table 1 is an architecture of a distributed file system in a Google cloud storage system. This storage feature of files is very suitable for large-scale parallelization of massive multimedia data. The task of data processing is assigned to the node where the data is stored, and the advantage of transferring computing to storage in cloud computing is brought into play. If we want to process multimedia data files in parallel on a large scale, we need to store the files in a specific format to eliminate the dependencies between them, so that we can process the data in a file block. There is no need to read another file block of data. The development of cloud computing brings both opportunities and challenges to large-scale parallel processing of massive multimedia data. And each file block and its copy are stored in different nodes in the cloud system, so the optimal scheduling of tasks is required on a large number of nodes. In order to achieve the goal of load balancing and increasing the utilization rate of system resources, the current mechanism of task scheduling and resource allocation in cloud systems is a static local scheduling mechanism. Considering only the current resource state of the nearest node to the data, although it has the advantage of transferring computation to storage, the optimal allocation of resources has not been made from the global point of view of the system. Dynamo use technology and benefits are given in Table 2.

B. JOB MODEL FOR MASSIVE MULTIMEDIA DATA PROCESSING
User requirements in multimedia applications are submitted in the form of job description files to the client of the cloud storage system. When a job is submitted, the client splits the job into several tasks for parallel execution based on the file block information. Each task is associated with a file block, so that different tasks in the same job can be distributed to different nodes for execution. It can avoid the bottleneck caused by resource competition among tasks and adapt to the characteristics of high resource consumption in the process of massive multimedia data processing. The file block information is described as follows.
T tree = (C, R) (18) In which, C is a collection of data elements where the elements represent a block of files; R is a binary relational set in which the elements represent whether the contents of the two chunks are the same. The element ci in the data element set C can be described as a binary group vector: In which, chunk_id represents the number of block I and a i indicates the number of nodes where block I. The job stream submitted to the client can be described as a random time when the job is submitted to the client of the cloud storage system In which, J i can be described by a six-tuple vector: In which, job_id is the job number, dec_id is the job description file number, file_id is the multimedia data file number that the job needs to process, level is the priority of the job, and rcv_t is the job submission time. end_t is the deadline for completing the job. The submitted job J i is split into several tasks by the client. The split task can be described as a directed acyclic graph DAG: For CPU resource consumption, multiple computationally intensive tasks run on one CPU core at the same time, resulting in a sharp reduction in execution speed. Therefore, you need to limit the number of computation-intensive tasks on a processor. Therefore, CPU resources are also abstracted into quantities to measure, Abstract a processor into four CPU resources. Chink_id is the file block number to be processed by the task. Each element in the edge set E represents a dependency between the two tasks. E i indicates that the task vi is the precursor of the task v j . Task v j is the successor of task v i . Each task can only be executed if all precursor tasks have been completed.

C. TASK SCHEDULING AND RESOURCE ALLOCATION MODEL FOR MASSIVE MULTIMEDIA DATA PROCESSING
Combined with the characteristics of the job model of massive multimedia data processing. In our proposed task scheduling and resource allocation model, each data node has a scheduling process. These scheduling processes know the current state of the virtual machine of the data node in which they are located, and the scheduling processes of different nodes are able to communicate with the client's scheduling process. The client scheduling process divides the job into tasks according to the queried multimedia file block information Ttree, then clusters the data nodes according to the binary relation set R, the clustering rules are as follows: All the data nodes that store the same file block m form a cluster set, D m which is the set of all nodes in the system. A i is a node in the cluster set D m . The scheduling process of the client selects one of the best nodes in D m to perform the task from the point of view of improving resource utilization and load balancing. The scheduling process is only within a limited range of local nodes. Within a task for resource allocation and task scheduling, it is the goal of clustering scheduling algorithm to reduce the selection range of resources and improve the efficiency of task scheduling. The whole framework of trust routing algorithm based on QoS is given in Figure 4.

IV. EXPERIMENTAL SIMULATION
In the intrusion detection based on network behaviour, the data set collected by DARPA in 2018 for Mr Linco ln Labs intrusion detection evaluation is used as experimental data. The data was also used in the third International Competition on knowledge Discovery and data mining tools, which was co-sponsored by the Fifth International Conference on knowledge Discovery and data mining. Therefore, these data are also referred to as KDDCUP99 data in many literatures. The data was collected nine weeks after MIT Lincoln Labs imitated the Air Force LAN. The original data is transformed into an attribute set suitable for intrusion detection after the pre-processing and feature extraction of the network connection information. The steps and methods of the pre-processing and feature extraction of the network connection information in the original data are given as follows.

A. PREPROCESSING OF NETWORK CONNECTION INFORMATION IN RAW DATA
The data collection and data processing of KDDCUP99 are mainly completed by Lee et al. They designed an intrusion detection model for network connection information. This model reconstructs the packets that the system listens to through the network interface to form a network connection information set. Then the intrusion detection model is built directly on the network connection information set according to the method of machine learning. The original audit records, such as the network packets collected by Tcpdump, are first converted into packet information in the form of ASCII characters, and such packet information is then processed to recover the connection session records contained therein. Finally, the feature set and classification model suitable for intrusion detection are established on the connected session set.
The data obtained from the network interface is the network traffic recorded by network listening software such as Tcpdump. The traditional intrusion detection method uses rule-based pattern matching to detect attacks directly on this data. Lee et al. restored network traffic data to network connection session information through network connection information pre-processing. This process is divided into three steps, which can be represented by graph: Step 1: collect all network traffic data at network interface with Tcpdump and other tools.
Step 2: the binary data collected by Tcpdump is transformed into packet level information represented by ASCII characters, each line of which represents the information of one packet.
Step 3: processing the packet information and generating the connection record set. In this method, each TCP session is treated as a connection, and each UDP packet is treated as a session, in which the records of each connection contain the following basic properties: time stamp, duration, source address, destination address, service, etc. These basic properties represent the basic information for each session.
The software used in the first and second steps of connection information pre-processing is Tcpdump. The third step is a segment of processing program written by Bro, the script language of intrusion detection system. This program scans the record set in the form of characters and reorganizes the session information. And statistics some statistics, such as the number of rejected connections, the number of repeated ACK packets, error packet size ratio, and so on. The resulting connection information has some basic properties such as duration, service, and connection flag and so on.

B. DATA SET DESCRIPTION
The training data in KDDCUP99 contains seven weeks of network traffic and about 40 gigabytes of compressed binary data. After processing, the data is restored to about 500000 connection records, each of which is a network packet at a certain time. A transmission drama 551 via some protocol from the source IP address to the target IP address. In the experiment, 10% KDDCUP99 is used as the data set. The dataset contains 22 different attack methods, 494021 connection records, including 97278 normal connection records, each connection record has 41 different attributes. Among them, 34 are digital and 7 are character types. The specific intrusion data are described in the table 3 as follows. The test sample data contains 311029 connection records and 37 different attack methods, 17 of which have no specific  intrusion data description in the training sample as shown in table 4 below. These attacks can be classified into four categories: Dos: denial-of-service attacks, such as smurf, teardrop attacks; R2L: access to remote permissions, such as password guessing; U2R: privilege escalation, such as various buffer overflow attacks; PROBE:IP address, port and vulnerability scan.

C. EXPERIMENTAL DATA PREPROCESSING
In the application of neural networks, variables must be scaled to the range allowed by the transfer function of the processing unit, so the training sample data and the test data of the input network must be converted in the same proportion.  3] respectively. Therefore, it is necessary to normalize all the values of data on the same attribute before the wavelet neural network is input. The most commonly used linear conversion method is generally used. If the maximum and minimum values of variables are X max and X min , respectively. And the actual limits of the network are A max and A min , the variables X can be transformed by the following formula: In which, For the output value A of the network, the following can be converted to a variable X: In this experiment, genetic algorithm, QPSO algorithm and standard PSO algorithm are used as the training algorithms of wavelet neural network respectively. Finally, the established model is used to detect the network anomalies. Now the parameters of each model are set: set the crossover probability P c = 0.75, mutation probability of GA, such as the acceleration constant C(1) C(2) of the GA algorithm, and the inertial weight CO decreases linearly from 0.8 to 0.4. The contraction expansion coefficient of QPSO algorithm decreases linearly from 0.7 to 0.2. The population size of GA, PSO algorithm and QPSO algorithm are all 50, the iterations are all 1500, the weight value of vjk is defined in the range of (−1, 0), and the range of scaling coefficient Q and translation coefficient is (1, 100). Statistical results of PSO algorithm performance are given in Table 5.
The range of the scaling factor Q and translation coefficient of the data is the statistical result shown in Figure 5.
In addition, the performance and computation time of different methods for detecting anomalies in massive network data are shown in Table 6.
It can been seen from Figure 5 that as the cost increases, the performance of the three anomaly detection algorithms will become better and better. The improved PSO algorithm proposed in this paper has achieved the best results in anomaly detection in mass multimedia data transmission networks. This is because this paper designs an effective algorithm for abnormal phenomena in mass multimedia data transmission network, and improves the PSO algorithm to further improve the detection accuracy. Finally, the improved PSO algorithm proposed in this paper achieves the best performance.
In order to test the application performance of this method in information security risk assessment, the simulation   experiment is carried out, and the algorithm is designed and implemented based on Matlab Simulink simulation software. In the information security risk assessment algorithm, the information security risk collection is first carried out. There are 30 data acquisition nodes in the data acquisition server, the number of neural network nodes for information security assessment is 200, and the number of access nodes is 10 clusters. Each cluster has 5 nodes with a central frequency of 15 KHZ and a time parameter. According to the above   simulation and parameter setting, the information security evaluation party is analyzed, and the information collection results are shown in Figure 7.
Evaluate the information security of the information collection sample in figure 4, the correlation compensation and the adaptive control are taken according to the information security risk data spectrum characteristic extraction result, the gray neural network is used to carry on the adaptive learning, the information security evaluation is obtained. The convergence curve of the safety assessment is shown in Figure 8. Figure 8 shows that the proposed method can converge to zero in a short time, and test the accuracy of different VOLUME 8, 2020 methods for information security evaluation. The comparison results are shown in Figure 9. It concludes that the accuracy of information security assessment by this method is high.

V. CONCLUSION
As an important part of network security research, intrusion detection has attracted the attention of scholars. At present, the detection rate of intrusion detection method is low, the false alarm rate and false alarm rate is high, and the realtime performance is poor. It needs a large number of or complete data to achieve better detection performance. In this paper, the concept, characteristics, classification, research contents and difficulties of traditional intrusion detection for mass multimedia data transmission network are described. Then, the basic principle of neural network and particle swarm optimization algorithm and the basic idea of particle swarm optimization algorithm with quantum behaviour are introduced. It is emphasized that QPSO has better convergence performance than PSO algorithm in global optimization problems. In this paper, the concept, characteristics and structure of neural network are described, and the algorithm and classification of wavelet neural network are introduced. Then taking wavelet neural network as the object, using the QPSO algorithm as the training algorithm, the concrete operation process is given. The research work in this paper shows that the performance of neural network trained by QPSO algorithm and improved QPSO algorithm is better than that of other intelligent algorithms such as PSO algorithm and genetic algorithm, and the convergence speed is faster than that of PSO algorithm or GA algorithm. QPSO is a high performance neural network training algorithm, which can play a good role in neural network anomaly detection.
LIQIANG GUO was born in May 1981. He received the master's degree in computer application technology from Henan University. He is currently working as an Associate Professor with the School of Educational Science, Luoyang Normal University. His research interests focus on information technology and computer algorithms research. VOLUME 8, 2020