The invention discloses a network penetration identification method based on interactive behavior analysis, and the method comprises the steps: employing a Seek
client to collect the interactive behavior data of a
honeypot machine as an analysis object, carrying out
feature extraction and cleaning, feature classification and
feature coding on collected data to form a feature sequence; according tothe characteristic that an interactive behavior
characteristic sequence has uncertain length and
time sequence, adopting an LSTM model as an
attack recognition classifier, analyzing an
activation function, a
loss function and a
gradient descent algorithm respectively, selecting an appropriate model to be used as the model, and then optimizing a training model through multiple times of hyper-parameter parameter adjustment. Modeling is carried out according to the
time sequence of capturing behavior data features, the features are screened to reduce the
feature dimension, and the training speedand precision of the model are improved through
feature coding. Through repeated parameter tuning training, the penetration
attack identification accuracy and the
false alarm rate of the model are obviously superior to those of other models.