Multi-level network intrusion detection method, system and medium based on explanatory analysis and experience knowledge optimization

Abstract

The present invention discloses a multi-level network intrusion detection method, system and medium based on explanatory analysis and empirical knowledge optimization. The multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization of the present invention realizes comprehensive perception and nonlinear mapping processing of timing dependence and inherent characteristics in network traffic through a multi-level and structured intrusion detection framework, and combines the SHapley additive interpretation (SHAP) method with empirical knowledge to form a decision paradigm of an iterative feedback error correction mechanism optimization framework, which can improve the expression ability, generalization and stability of the model and strengthen the detection effect of the intrusion detection model.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a multi-level network intrusion detection method, system and medium based on explanatory analysis and experience knowledge optimization. Background Art

[0002] As a key aspect of information security, network intrusion detection focuses on real-time monitoring and analysis of network traffic data to quickly detect and respond to potential security threats and unauthorized access. In previous studies, machine learning-based intrusion detection techniques have received widespread attention. These techniques use training models to capture the unique pattern characteristics between normal and malicious network traffic. In practical applications, they can efficiently detect data flows that deviate from established normal patterns and thus assess potential network threats. However, network traffic is multidimensional and dynamic, and the structure of traditional machine learning algorithms is relatively simple, which often makes it difficult to effectively capture the key information inherent in high-dimensional and nonlinear network data.

[0003] Existing intrusion detection technologies have significant limitations, mainly reflected in the single modeling of temporal dependencies or inherent features in network traffic, which makes it difficult to fully capture key information in complex network traffic. This single modeling limits the model's ability to perceive hidden deep information when facing complex network attacks, thereby reducing its generalization ability. In addition, existing models fail to fully utilize the complex interactive relationships between features and ignore the association between the temporal dependency of data and the inherent feature structure. This makes it impossible for the model to effectively identify key feature combinations or interaction patterns, and lacks the necessary nonlinear mapping capabilities when dealing with dynamic and diverse attacks, resulting in low detection rates, high false alarm rates, and insufficient generalization and robustness in different scenarios and data sets.

[0004] Current technologies are also insufficient in terms of model interpretation and analysis. Many methods fail to explore the decision-making mechanism within the model and lack a comprehensive analysis of the output results. This lack of in-depth explanation makes it difficult for researchers and engineers to understand the basis for the model's judgment in a specific situation, further limiting the identification and correction of potential wrong decisions. When processing complex network traffic, existing technologies fail to effectively combine external empirical knowledge for analysis and feedback, and are unable to actively identify and correct the model's wrong decision-making paradigm. This defect not only reduces the credibility of the model, but also makes it lack the adaptability and flexibility it should have when dealing with evolving attack patterns. Summary of the invention

[0005] The main purpose of the present invention is to propose a multi-level network intrusion detection method, system and medium based on explanatory analysis and empirical knowledge optimization, aiming to reduce the false alarm rate and missed alarm rate of network intrusion detection, improve the accuracy and efficiency of network intrusion detection, and its adaptability in dynamic and complex attack environments.

[0006] To achieve the above object, the present invention provides a multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization, the method comprising the following steps:

[0007] Step S101, deploying a GRU module in the first layer of the multi-level network intrusion detection framework to map the original network traffic data to the first layer high-dimensional hidden space;

[0008] Step S102, deploying a KAN network at the edge of the first layer of high-dimensional hidden space, extracting and mining more valuable knowledge from the rich temporal dependencies in the hidden space through the nonlinear mapping of the KAN network, generating a preliminary decision paradigm of the first layer, and realizing complex nonlinear mapping to obtain output;

[0009] Step S103, deploying a BiLSTM module in the second layer to map the original network traffic data to the second layer high-dimensional hidden space;

[0010] Step S104, deploying a KAN network in the second-layer high-dimensional hidden space to perform complex nonlinear mapping on the bidirectional temporal features extracted by the BiLSTM module, extracting and mining more valuable knowledge from the rich temporal dependencies in the second-layer high-dimensional hidden space, and generating a preliminary decision paradigm for the second layer after nonlinear mapping, so as to achieve complex nonlinear mapping and obtain output;

[0011] Step S105, directly deploying a KAN network on the third layer to mine the inherent characteristics of the original network traffic and obtain output;

[0012] Step S106, flattening the output of the third layer, and fusing it with a fully connected layer neural network to generate a final decision paradigm for output;

[0013] Step S107, training the intrusion detection framework using the training set, and verifying the training effect using the verification set;

[0014] Step S108, using the SHAP explanatory analysis method to interpret and analyze the decision-making process of the model;

[0015] Step S109, combining empirical knowledge to identify the wrong decision-making paradigm in the model decision-making process;

[0016] Step S110, deleting the first feature corresponding to the wrong decision paradigm to correct the wrong paradigm and re-execute step S107 to form an iterative feedback error correction mechanism;

[0017] Step S111, deploying the optimized intrusion detection framework to an actual application scenario to perform real-time intrusion detection.

[0018] To achieve the above-mentioned objectives, the present invention also proposes a multi-level network intrusion detection system based on explanatory analysis and empirical knowledge optimization, the system comprising a memory, a processor, and a multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization stored on the processor, the multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization when run by the processor executes the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization as described above.

[0019] To achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, which stores a multi-level network intrusion detection program optimized based on explanatory analysis and empirical knowledge. When the multi-level network intrusion detection program optimized based on explanatory analysis and empirical knowledge is executed by a processor, the multi-level network intrusion detection method optimized based on explanatory analysis and empirical knowledge as described above is executed.

[0020] The beneficial effects of the multi-level network intrusion detection method, system and medium based on explanatory analysis and empirical knowledge optimization of the present invention are:

[0021] (1) The present invention adopts a hierarchical structure design to simultaneously model the timing dependency and inherent feature interaction in network traffic, which can improve the expressiveness, generalization and stability of the model;

[0022] (2) The present invention combines fine-grained explanatory analysis with empirical knowledge iterative feedback to correct erroneous decision-making patterns in the model, thereby enhancing the detection effect of the intrusion detection model. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the structures shown in these drawings without paying creative work.

[0024] Figure 1 It is a schematic diagram of the overall process of a preferred embodiment of a multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization of the present invention;

[0025] Figure 2It is the SHAP explanation analysis diagram in the present invention.

[0026] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Considering that the existing intrusion detection system cannot simultaneously model the temporal dependency and the inherent feature interaction when dealing with complex network traffic, the model has significant deficiencies in generalization, robustness and nonlinear mapping capabilities. At the same time, the existing technology lacks fine-grained explanatory analysis of the model decision mechanism, or does not form a feedback optimization mechanism based on the explanatory analysis results combined with empirical knowledge to identify and correct potential erroneous decision paradigms, thereby enhancing the intrusion detection effect of the model. The present invention solves the limitations of the existing technology in feature extraction, temporal dependency modeling and deep feature interaction perception by designing a new intrusion detection framework, and improves the detection accuracy and adaptability of the model in different complex scenarios.

[0029] The present invention, through a new intrusion detection framework, can simultaneously model the temporal dependency and inherent feature interaction in network traffic, thereby breaking through the limitations of existing methods in generalization, robustness and nonlinear mapping capabilities. Through structured hierarchical design, the present invention can effectively capture the complex temporal dependency in network traffic, and deeply explore the nonlinear interaction between inherent features, solving the problem of insufficient extraction of key information in the existing technology when modeling complex network traffic. The framework comprehensively perceives the temporal features and inherent features at different abstract levels, significantly improving the generalization and robustness of the model in the face of complex network attacks. At the same time, the present invention combines advanced interpretation methods to transparently analyze the decision-making mechanism of the model, ensuring that researchers can clearly understand the judgment basis of the model, and can combine empirical knowledge to analyze and correct potential erroneous decision paradigms, especially in the fine-grained analysis of each feature. The present invention not only significantly reduces the false alarm rate and missed alarm rate, but also improves the detection accuracy and efficiency of the model by strengthening nonlinear mapping and feature perception capabilities, especially showing high adaptability in dynamic and complex attack environments. This provides a highly interpretable and reliable solution for the field of intrusion detection, which can show excellent performance in different scenarios and datasets.

[0030] Specifically, the present invention proposes a multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization. The present invention realizes comprehensive perception and nonlinear mapping processing of timing dependencies and inherent characteristics in network traffic through a multi-level and structured intrusion detection framework, and combines the SHapley additive interpretation (SHAP) method with empirical knowledge to form a decision paradigm of the iterative feedback error correction mechanism optimization framework.

[0031] Please refer to Figure 1 The preferred embodiment of the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization of the present invention includes the following steps:

[0032] Step S101, deploying a GRU module in the first layer to map the original network traffic data to the first layer high-dimensional hidden space.

[0033] The GRU (Gated Recurrent Unit) module is used to capture the temporal dependencies in the raw network traffic data. GRU is an effective recurrent neural network (RNN) variant that is suitable for processing sequence data. It can effectively avoid the gradient vanishing problem by introducing reset gates and update gates. After the raw network traffic data is processed by the GRU module, it is mapped to a high-dimensional latent space that has rich temporal dependency feature relationships.

[0034] Step S102, deploying the KAN network at the edge of the first layer of high-dimensional hidden space, extracting and mining more valuable knowledge from the rich temporal dependencies in the hidden space through the nonlinear mapping of the KAN network, generating the preliminary decision paradigm of the first layer, and realizing complex nonlinear mapping to obtain output.

[0035] In step S102 of this embodiment, a KAN (Kolmogorov-Arnold network) network is deployed at the edge of the first layer of hidden space. The KAN network is a new type of neural network architecture that can perform complex nonlinear calculations. Through the nonlinear mapping of the KAN network, the present invention can extract and mine more valuable knowledge from the rich temporal dependencies in the hidden space. After nonlinear mapping, this knowledge can generate a preliminary decision paradigm for the first layer.

[0036] Step S103, deploying a BiLSTM module in the second layer to map the original network traffic data to the second layer high-dimensional hidden space.

[0037] The BiLSTM (Bidirectional Long Short-Term Memory) module can fully perceive the global context information of time series data through bidirectional information transmission, ensuring that key information is not missed. Similar to GRU, BiLSTM also maps the original traffic data to another new high-dimensional hidden space.

[0038] Step S104, deploying the KAN network in the second-layer high-dimensional hidden space to perform complex nonlinear mapping on the bidirectional temporal features extracted by the BiLSTM module, extracting and mining more valuable knowledge from the rich temporal dependencies in the second-layer high-dimensional hidden space. After nonlinear mapping, the preliminary decision paradigm of the second layer can be generated to achieve complex nonlinear mapping and obtain output.

[0039] At the edge of the hidden space generated by the second-layer BiLSTM module, the KAN network is deployed again to perform complex nonlinear mapping on the bidirectional temporal features extracted by BiLSTM. By introducing the KAN network at this layer, more valuable knowledge can be extracted and mined from the rich temporal dependencies in the hidden space. After nonlinear mapping, this knowledge can generate the preliminary decision paradigm of the second layer.

[0040] Step S105, directly deploying the KAN network alone on the third layer, mining the inherent characteristics of the original network traffic to obtain output.

[0041] In this embodiment, the KAN network is deployed directly and separately in the third layer. This layer no longer relies on the GRU or BiLSTM modules, but directly performs deep mining on the inherent features in the original network traffic. The KAN network further extracts the high-order nonlinear features hidden in the data in the third layer and generates the third-layer decision paradigm to support the stability and generalization ability of the model.

[0042] Step S106, flattening the output of the third layer, and fusing it with a fully connected layer neural network to generate a final decision paradigm for output.

[0043] This embodiment flattens the output of the three layers and fuses them using a fully connected layer neural network. The flattened features are fused through a fully connected layer to generate the final decision paradigm. The fully connected layer plays the role of fusing multi-level features into a stable, high-level decision paradigm, ensuring that the model can accurately judge network traffic in different scenarios, that is, it can be widely compatible with different network scenarios and dynamic changes in the network environment.

[0044] Step S107: train the intrusion detection framework using the training set, and verify the training effect using the verification set.

[0045] This embodiment uses a training set to train the intrusion detection framework of the above structure. During the training process, the back propagation algorithm is used to optimize the parameters of the framework to ensure that the model can effectively learn the optimal decision paradigm from the network traffic data. At the same time, the validation set is used to verify the training effect to ensure the generalization ability and robustness of the model.

[0046] Step S108, using the SHAP explanatory analysis method to interpret and analyze the decision-making process of the model.

[0047] This example uses the SHAP (SHapley Additive Explanations) method to interpret and analyze the decision-making process of the model. SHAP can quantify the contribution of each feature to the final decision, helping researchers understand the internal working mechanism of the model. Through the shap_summary diagram of the SHAP analysis, it is possible to clearly identify the importance of features to the model decision, and see the impact of the high and low feature values ​​on the classification results. Figure 2 As shown in the figure, the above framework performs intrusion detection on remote to local (R2L) attacks and uses the SHAP method to interpret the intrusion detection process. Figure 2 The importance ranking of features can be directly obtained in the figure, that is, the higher the importance, the higher the importance. And we can see the specific judgment basis of the model for each feature. For example, for the first feature "frequency of connection to a specific service" (dst_host_srv_count), a large number of yellow points appear between the red and blue data points, concentrated at the position where the SHAP value is 0. This observation indicates that potential attackers may use covert means to evade detection mechanisms.

[0048] Step S109, combining empirical knowledge to identify incorrect decision patterns in the model decision process.

[0049] This embodiment combines empirical knowledge to identify the wrong decision patterns in the model decision process. When the model makes an incorrect judgment on a specific feature, these wrong decision patterns are identified based on empirical knowledge. For example Figure 2 The first feature of the shap_summary graph in Figure 1 shows that, based on empirical knowledge, for R2L attacks, attackers usually gain local system privileges from a remote location by exploiting vulnerabilities or misconfigurations. The small number of connections to a specific service indicates that access is infrequent, which may suggest that the attacker did not specifically target these services. However, a large number of connections may originate from normal business activities or from attackers attempting to exploit service vulnerabilities. Therefore, it can be seen that the introduction of such features misleads and confuses the attack detection process of the intrusion detection framework formed above.

[0050] Step S110, deleting the first feature corresponding to the wrong decision paradigm to correct the wrong paradigm and re-execute step S107 to form an iterative feedback error correction mechanism.

[0051] This embodiment deletes the features corresponding to the wrong decision paradigm, and in order to maintain the stability of the model and avoid large fluctuations in the effect, this step only deletes the first feature that has an error, so as to readjust the decision-making mechanism of the model and verify whether it is effective after deleting the feature, thereby improving the overall performance of the model. Re-execute step S107 to form an iterative feedback optimization mechanism to achieve optimal feature screening of network traffic and eliminate interference and confusion features.

[0052] Step S111, deploying the optimized intrusion detection framework to an actual application scenario to perform real-time intrusion detection.

[0053] This embodiment deploys the optimized intrusion detection framework to actual application scenarios for real-time intrusion detection. The intrusion detection framework after the above training, optimization and adjustment is deployed in the actual network environment to monitor potential attack behaviors in network traffic in real time. The framework can detect complex and diverse attack patterns in a timely and accurate manner, and exhibits high adaptability and robustness.

[0054] The present embodiment is further described in detail below.

[0055] 1. This embodiment adopts a hierarchical structure design to simultaneously model the timing dependency and inherent feature interaction in network traffic, thereby improving the expressiveness, generalization and stability of the model.

[0056] Most of the existing intrusion detection technologies are limited to capturing temporal dependencies or modeling static features of network traffic, and fail to fully consider the combination of the two. These methods usually use a single type of neural network, such as RNN, LSTM, or traditional deep learning frameworks, and process data only in a certain dimension. Because the complex interactive relationships in the data are ignored, the model has a weak ability to perceive features and is difficult to adapt to diverse network attack scenarios, resulting in reduced detection performance.

[0057] This embodiment proposes a novel three-layer network architecture, which can capture the time dependency and feature interaction in network traffic while using the Kolmogorov-Arnold network (KAN) to enhance the nonlinear feature extraction capability of the model. Specifically, GRU and BiLSTM neural networks are deployed in the first two layers to fully explore the temporal dependency between network traffic samples, and the extracted key information is mapped to high-dimensional hidden spaces. Secondly, KAN networks are deployed in the high-dimensional hidden spaces in the first two layers for complex nonlinear mapping to generate decision paradigms. In order to enhance the generalization and robustness of the framework, the KAN network is deployed separately in the third layer architecture to directly mine and perceive the inherent features in the original network data and generate corresponding decision paradigms. Finally, the output of the three-layer architecture is flattened and fused through a fully connected layer to obtain the final stable and advanced decision paradigm. Compared with the prior art, this embodiment significantly improves the generalization and robustness of the model when modeling complex traffic, especially when dealing with dynamically changing attack modes, showing higher adaptability.

[0058] 2. This embodiment combines fine-grained explanatory analysis with iterative feedback of empirical knowledge to correct erroneous decision-making patterns in the model, thereby enhancing the detection effect of the intrusion detection model.

[0059] Most existing intrusion detection technologies lack transparent analysis of the model's decision-making mechanism, and the model's judgment process is difficult to explain and understand, resulting in researchers and engineers being unable to identify potential wrong decisions. Although some methods have begun to apply explanatory techniques, such as LIME or SHAP, most of them only stay at a shallow level of analysis and cannot combine actual experience knowledge for feedback optimization and error correction, which makes it difficult for the model to correct unreasonable judgments, affecting the accuracy and reliability of detection.

[0060] This embodiment uses the SHapley Additive Interpretation (SHAP) method to perform fine-grained model interpretability analysis, and combines empirical knowledge to form iterative feedback to identify and correct the wrong decision-making paradigm in the model. For example, when the model makes an error in judging certain feature values, this embodiment can guide the model to optimize features by deleting the first feature that guides the model to make an incorrect judgment and forming an iterative feedback optimization mechanism, thereby successfully correcting potential errors from a data perspective. Compared with the prior art, this embodiment not only provides a higher level of interpretability, but also strengthens the intrusion detection effect through a correction mechanism for the wrong decision paradigm, reduces the false alarm rate and missed alarm rate, and improves the credibility of the detection results.

[0061] In summary, the beneficial effects brought by the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization of the present invention are mainly reflected in the deep modeling ability of the interaction between timing dependency and inherent features in network traffic, which significantly improves the generalization, robustness and detection effect of the model. Compared with the prior art, the present invention has achieved technological breakthroughs at multiple levels, adopting a new multi-layer network architecture, combined with explanatory analysis and feedback correction mechanism based on empirical knowledge, bringing an all-round improvement to intrusion detection technology.

[0062] First, the present invention achieves detailed capture of the timing dependencies and time characteristics in network traffic by introducing GRU and BiLSTM networks as the first two layers. In the prior art, many intrusion detection models are limited to modeling static features or a single time dimension, and cannot fully capture the complex dynamic changes in network data. In contrast, the present invention combines the timing processing advantages of GRU and BiLSTM to map the time dependencies of the original network traffic to a high-dimensional hidden space, greatly enhancing the adaptability to complex attack patterns. This ability to model deep timing features enables the model to show higher stability and accuracy when facing a dynamically changing network environment.

[0063] Secondly, the present invention innovatively integrates the Kolmogorov-Arnold network (KAN) at the edge of the high-dimensional hidden space, enhancing the model's nonlinear feature perception ability. The introduction of KAN effectively solves the problem of insufficient nonlinear mapping in the prior art. Traditional neural networks can only extract features through static nonlinear transformations, resulting in insufficient perception of complex feature interactions, while KAN can perform complex parameterized nonlinear calculations at the edge, greatly improving the feature extraction and perception capabilities of the framework. This enables the present invention to more accurately capture hidden deep-level information when dealing with diverse attack scenarios, thereby improving the generalization and robustness of the model.

[0064] Thirdly, the KAN network deployed separately in the third-layer architecture deeply mines the inherent characteristics of network traffic. In the prior art, the model generally ignores the full modeling of the complex interactive relationship between inherent characteristics. However, the present invention uses KAN's complex mapping capabilities to deeply perceive the key information in the inherent characteristics, further enhancing the robustness of the architecture. This level of design ensures the comprehensive perception of multi-dimensional features, allowing the model to demonstrate high adaptability when processing both static and dynamic attack features.

[0065] In addition, the present invention combines the SHapley Additive Explanation (SHAP) method to provide fine-grained model interpretation analysis. Compared with the lack of transparent analysis in the prior art, the explanatory method of the present invention can reveal the decision-making mechanism within the model and help researchers better understand the judgment basis of the model. Through this detailed explanation mechanism, the present invention not only enhances the credibility of the test results, but also provides an important basis for subsequent model optimization.

[0066] Finally, the present invention adopts an iterative feedback correction method based on explanatory analysis and empirical knowledge, which can effectively identify and correct the wrong decision paradigm in the model. For example, when the model makes mistakes in judging certain features, the present invention can correct these wrong judgments by reversing the feature values. This feedback correction mechanism is an innovation that is lacking in the existing technology, and further improves the detection accuracy and reliability of the model in different network environments.

[0067] To achieve the above-mentioned purpose, the present invention also proposes a multi-level network intrusion detection system based on explanatory analysis and empirical knowledge optimization, the system includes a memory, a processor, and a multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization stored on the processor, the multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization is executed by the processor when it is run. The multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization as described above is executed, which will not be repeated here.

[0068] To achieve the above-mentioned purpose, the present invention also proposes a computer-readable storage medium, which stores a multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization. When the multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization is executed by the processor, the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization as described above is executed, which will not be repeated here.

[0069] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization, characterized in that: The method comprises the following steps: Step S101, deploying a GRU module in the first layer of the multi-level network intrusion detection framework to map the original network traffic data to the first layer high-dimensional hidden space; Step S102, deploying a KAN network at the edge of the first layer of high-dimensional hidden space, extracting and mining more valuable knowledge from the rich temporal dependencies in the hidden space through the nonlinear mapping of the KAN network, generating a preliminary decision paradigm of the first layer, and realizing complex nonlinear mapping to obtain output; Step S103, deploying a BiLSTM module in the second layer to map the original network traffic data to the second layer high-dimensional hidden space; Step S104, deploying a KAN network in the second-layer high-dimensional hidden space to perform complex nonlinear mapping on the bidirectional temporal features extracted by the BiLSTM module, extracting and mining more valuable knowledge from the rich temporal dependencies in the second-layer high-dimensional hidden space, and generating a preliminary decision paradigm for the second layer after nonlinear mapping, so as to achieve complex nonlinear mapping and obtain output; Step S105, directly deploying a KAN network on the third layer to mine the inherent characteristics of the original network traffic and obtain output; Step S106, flattening the output of the third layer, and fusing it with a fully connected layer neural network to generate a final decision paradigm for output; Step S107, training the intrusion detection framework using the training set, and verifying the training effect using the verification set; Step S108, using the SHAP explanatory analysis method to interpret and analyze the decision-making process of the model; Step S109, combining empirical knowledge to identify the wrong decision-making paradigm in the model decision-making process; Step S110, deleting the first feature corresponding to the wrong decision paradigm to correct the wrong paradigm and re-execute step S107 to form an iterative feedback error correction mechanism; Step S111, deploying the optimized intrusion detection framework to an actual application scenario to perform real-time intrusion detection.

2. A multi-level network intrusion detection system based on explanatory analysis and empirical knowledge optimization, characterized in that: The system includes a memory, a processor, and a multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization stored on the processor. When the multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization is executed by the processor, the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization as claimed in claim 1 is executed.

3. A computer-readable storage medium, wherein the computer-readable storage medium stores a multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization, wherein the multi-level network intrusion detection program based on explanatory analysis and empirical knowledge optimization is executed by a processor when the multi-level network intrusion detection method based on explanatory analysis and empirical knowledge optimization is described in claim 1.

Images