Intrusion detection method and system based on artificial intelligence

Abstract

The invention discloses an intrusion detection method and system based on artificial intelligence, and belongs to the technical field of network security, and the method comprises the steps: firstly extracting the features of network flow data, and carrying out the standardization and dimension reduction processing of the extracted features, and obtaining a feature data set; constructing a joint machine learning model which comprises a plurality of parallel learning models, performing batch training on all the learning models by adopting the data set and combining transfer learning, and fusing prediction results of a plurality of pre-trained learning models by adopting an integrated learning method to obtain a trained joint machine learning model; inputting real-time network flow data into the trained combined machine learning model, and performing intrusion monitoring on the network flow data by the combined machine learning model; according to the method, efficient and real-time intrusion detection is carried out on the network traffic, and the detection accuracy and adaptability are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an intrusion detection method and system based on artificial intelligence. Background Art

[0002] With the rapid development and widespread penetration of Internet technology, network security issues have become increasingly prominent and the situation is becoming increasingly severe. Traditional intrusion detection systems (IDS) mainly rely on two technical means, feature matching and behavior analysis, to identify potential threats. However, in the face of evolving and increasingly complex new network attack methods, these traditional methods are often difficult to effectively respond to and seem to be powerless. In recent years, machine learning and deep learning technologies have brought new hope and solutions to the field of intrusion detection with their outstanding capabilities in data analysis and pattern recognition. These technologies can automatically extract features from massive data and build models that can identify abnormal behaviors, thereby improving the accuracy and efficiency of intrusion detection.

[0003] However, although machine learning-based intrusion detection systems have improved detection capabilities to a certain extent, they still face many challenges. First, network data often has high-dimensional characteristics and contains a lot of redundant information and noise, which brings great difficulties to the training and optimization of the model. Secondly, in a network environment with extremely high real-time requirements, existing detection systems often find it difficult to achieve rapid response while ensuring accuracy. Finally, the lack of generalization ability of the model is also a problem that needs to be solved urgently, that is, the model may not be able to effectively identify and defend against unknown or new attacks.

[0004] Therefore, how to design and implement a system that can efficiently and accurately detect and defend against various types of network intrusions in a complex and ever-changing network environment has become a key technical problem that needs to be solved. This requires not only in-depth research on the latest advances in machine learning and deep learning technologies, but also the exploration of more intelligent and adaptive detection methods in combination with the actual needs of network security. Summary of the invention

[0005] In view of the problems existing in the prior art, the present invention provides an intrusion detection method and system based on artificial intelligence, which combines deep learning with traditional machine learning models to efficiently perform real-time intrusion detection on network traffic and enhance the detection accuracy and adaptability of the system.

[0006] The present invention is achieved through the following technical solutions: In a first aspect, the present application provides an intrusion detection method based on artificial intelligence, comprising the following steps: Step 1: extract the features of network traffic data, and perform standardization and dimensionality reduction on the extracted features to obtain a feature data set; Step 2: Build a joint machine learning model, which includes multiple parallel learning models, use the data set and combine transfer learning to batch train all learning models, and use an ensemble learning method to fuse the prediction results of multiple pre-trained learning models to obtain a trained joint machine learning model; Step 3: Input the real-time network traffic data into the trained joint machine learning model, and use the joint machine learning model to perform intrusion monitoring on the network traffic data.

[0007] Preferably, in step 1, network traffic data is collected based on sensors on network nodes.

[0008] Preferably, in step 1, the network traffic data is first preprocessed, and then features are extracted from the preprocessed network traffic data, wherein the network traffic data preprocessing includes: The network traffic data is processed by various methods including data cleaning, noise reduction, filtering, filling missing values, and normalization.

[0009] Preferably, the dimensionality reduction processing includes PCA and t-SNE, which reduce the dimensionality of high-dimensional feature data to obtain a reduced-dimensional feature data set.

[0010] Preferably, the joint machine learning model described in step 3 includes a deep learning model, a time series model, a combined model based on a generative adversarial network and an autoencoder, and an integrated learning model.

[0011] Preferably, the CNN model is used for in-depth analysis of high-dimensional features and capture of abnormal patterns; The random forest model is used for real-time detection of abnormal traffic and accurate classification of attack methods; The LSTM model is based on time dependency and sequence patterns and is used to predict and judge the consistency of dynamic attack behaviors in network traffic; The deep learning model fused with the GAN and the autoencoder is used to generate simulated attack data and encode and decode normal traffic; The integrated learning model is used to fuse the prediction results of each model to obtain the final monitoring result.

[0012] Preferably, in step 3, real-time network traffic data is collected based on a streaming data processing method, and the collected network traffic data is transmitted to the joint machine learning model.

[0013] Preferably, the method further comprises the following steps: Step 4: Generate an attack report based on the monitoring results of the joint machine learning model. The attack report includes the attack path, attack method, affected devices and defense strategy.

[0014] In a second aspect, the present application provides a system for executing the artificial intelligence-based intrusion detection method, comprising: The feature engineering module is used to extract the features of network traffic data, and standardize and reduce the dimensionality of the extracted features to obtain a feature data set; The machine learning model module is used to build a joint machine learning model, which includes multiple parallel learning models. The data set is used in combination with transfer learning to batch train all learning models. The prediction results of multiple pre-trained learning models are integrated using an ensemble learning method to obtain a trained joint machine learning model. The real-time monitoring and early warning module is used to input real-time network traffic data into the trained joint machine learning model, and the joint machine learning model performs intrusion monitoring on the network traffic data.

[0015] Preferably, it also includes: A data collection module, used for collecting network traffic data from the network environment; A report generation module, used to generate attack reports based on the monitoring results of the joint machine learning model; Visualization interface module, used to visualize network traffic data and attack reports.

[0016] Compared with the prior art, the present invention has the following beneficial technical effects: The artificial intelligence-based intrusion detection method of the present application can ensure that different features are numerically comparable and reduce the deviation during model training by standardizing the features of network traffic data. Dimensionality reduction processing helps to remove redundant information, reduce computational complexity, and may improve the generalization ability of the model; secondly, multiple parallel learning models are used to build a joint model, and this design increases the diversity and flexibility of the model. Different learning models may be good at capturing different types of features or patterns in the data, thereby improving the overall detection performance. In addition, transfer learning allows the model to use the knowledge learned in related fields or tasks to accelerate the training process of new tasks, which helps to achieve better performance on limited data sets while reducing training time and cost. Finally, by integrating the prediction results of multiple pre-trained models, the accuracy and stability of detection can be further improved. Ensemble learning can reduce the risk of overfitting of a single model and enhance the overall performance by leveraging the complementarity of different models. During the monitoring process, real-time network traffic data is input into the trained joint machine learning model for intrusion monitoring, which can achieve a rapid response to network attacks. Since the joint model has been optimized through transfer learning and ensemble learning during the training phase, it can maintain a high accuracy and efficiency during the real-time monitoring phase. This AI-based intrusion detection method provides a powerful and effective means for network security protection by optimizing feature processing, building a flexible joint machine learning model, achieving efficient real-time monitoring, and providing adaptability and scalability.

[0017] This application also proposes an artificial intelligence-based intrusion detection system, an electronic device and a computer storage medium, which have all the advantages of the above-mentioned artificial intelligence-based intrusion detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of the intrusion detection method based on artificial intelligence of the present invention; Figure 2 It is a structural block diagram of the data acquisition module of the present invention; Figure 3 It is a structural block diagram of the feature engineering module of the present invention; Figure 4 is a structural diagram of the machine learning model of the present invention; Figure 5It is a structural block diagram of the real-time monitoring and early warning module of the present invention; Figure 6 It is a structural block diagram of the report generation module of the present invention; Figure 7 is a schematic diagram of a visualization interface of the present invention; Figure 8 It is a structural block diagram of the intrusion detection system based on artificial intelligence of the present invention. DETAILED DESCRIPTION

[0020] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations.

[0021] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the present application for which protection is sought, but merely represents selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present application.

[0022] See also Figure 1-7 , an artificial intelligence-based intrusion detection method, comprising the following steps: S11. Deploy a variety of sensors in the network environment to capture different types of network traffic data and store the network traffic data in the server.

[0023] The sensors include but are not limited to HTTP sensors, FTP sensors, SMTP sensors and DNS sensors. Each sensor is configured on its corresponding network node to capture data flow in real time.

[0024] The data acquisition module operates through a distributed architecture, where multiple sensor nodes transmit the collected data to a central data storage server through a high-speed network. On the central data storage server, the data is received and saved in real time for subsequent processing.

[0025] S12. Preprocess the collected network traffic data to improve the data quality of the network traffic data, extract features of the preprocessed network traffic data, and standardize and reduce the dimension of the extracted features to obtain a feature data set.

[0026] After the data acquired by the data acquisition module is saved in the central data storage, the feature engineering module begins to process the data. First, data cleaning techniques are used to ensure data quality, such as removing noise data and filling missing values. Then, data standardization is performed to make different types of data comparable.

[0027] Next, feature extraction algorithms, such as content-based feature extraction and statistics-based feature extraction, are used to convert complex traffic data into feature matrices that can be used for machine learning. At the same time, dimensionality reduction techniques (such as PCA and t-SNE) are used to reduce the dimensionality of high-dimensional feature data, reduce computational complexity, and improve the efficiency of model training and prediction.

[0028] The protocol type (such as TCP, UDP) can use a coding variable (such as 0 for TCP, 1 for UDP, etc.). The source IP address and the destination IP address can use hash coding to map the IP address to a numerical feature. The port number is directly represented by a numerical value. By using a vector to represent the basic information of each data packet in the network traffic, the characteristics of a network data packet can be represented as the following vector:

[0029] After feature extraction is completed, a feature matrix X can be constructed, where each row represents a sample (i.e. a section of traffic data) and each column represents a feature:

[0030] Here, n represents the number of samples (the number of traffic data segments), and m represents the number of features.

[0031] After the feature matrix X is constructed, principal component analysis PCA is used to reduce the dimension and select the principal components that have the greatest impact on the results: Standardize the data, standardize each column feature of the data matrix X, and get the standardized matrix Z:

[0032] in, and Representative The mean and standard deviation of the features.

[0033] Calculate the covariance matrix C:

[0034] Perform eigenvalue decomposition on the covariance matrix C and find the eigenvalue and the eigenvector :

[0035] Select principal components: Select the eigenvectors corresponding to the first k largest eigenvalues ​​as new basis vectors to form the reduced-dimensional data set Y (i.e., training set).

[0036]

[0037] in, is a matrix containing the first k eigenvectors.

[0038] S13. Construct a joint machine learning model, which includes multiple parallel learning models, use the data set and combine it with transfer learning to batch train all learning models, and use an integrated learning method to fuse the prediction results of multiple pre-trained learning models to obtain a trained joint machine learning model. In this embodiment, the machine learning model module includes deep learning models (such as CNN and LSTM), traditional machine learning models (such as random forest), autoencoders and generative adversarial network combination models.

[0039] CNN is used to capture local features and patterns in network traffic data, learn some data features of abnormal traffic, and thus identify complex traffic patterns and spatial relationships; LSTM processes time series data and effectively learns the time dependencies and sequence patterns in network traffic, thereby making consistent judgments on dynamic attack behaviors.

[0040] The random forest model improves classification accuracy by building multiple decision trees and integrating their results, which can avoid the high specificity caused by a single model. For intrusion detection, random forests effectively classify network traffic into "normal" or "abnormal" categories. It can quickly classify known attack patterns and is suitable for processing structured network feature data.

[0041] In addition, the system also uses autoencoders and generative adversarial networks (GANs) to generate simulated attack data to further enhance the generalization and robustness of the model. Finally, an ensemble learning method is used to fuse the results of multiple models to improve the final detection accuracy.

[0042] Autoencoders and Generative Adversarial Networks (GANs) coordinate to simulate and identify attacks on small samples. GANs, as a deep learning model, consist of two networks: a generator and a discriminator. The generator is responsible for generating realistic data samples, while the discriminator tries to distinguish between these generated samples and real samples. The two compete with each other, and through this adversarial training, the generator is able to generate more and more realistic data samples. Autoencoders are unsupervised neural network models, usually used for data dimensionality reduction and feature learning. Autoencoders consist of an encoder and a decoder. The encoder compresses the input data into a low-dimensional representation, while the decoder tries to reconstruct the input data from the low-dimensional representation. When real data is scarce or difficult to obtain, GAN generates more and more realistic samples by deeply learning the features of small samples, and these samples are transmitted to the autoencoder. The autoencoder learns the features of normal traffic and then forms a set of encoding and decoding systems. When detecting, normal traffic can be encoded and decoded normally, but abnormal traffic cannot be decoded, so an error will be reported, thereby completing the detection of small sample attacks.

[0043] The random forest model efficiently detects known attacks, the autoencoder reconstructs data to detect attacks with small samples, and the CNN detects complex traffic through a trained deep model. The first two are comparison tasks that take a long time and cost a little, while the deep learning model has a low efficiency and large deviation. After the first two tests, all the traffic is normal, and then the CNN model is used to detect whether it is complex abnormal traffic.

[0044] During the system initialization phase, all models are trained in batches. During the training of deep learning models, historical network traffic data is used for supervised learning, and hyperparameter optimization (such as optimizing learning rate and batch size) is used to improve model performance.

[0045] In addition, during the model training process of the machine learning model module, transfer learning technology is used to obtain features from the pre-trained model to improve training efficiency and parameter adaptability. Transfer learning first omits the learning process of low-level features. For example, CNN learned textures in the early days. By loading these features from pre-training, the learning time is reduced. At the same time, it can help migrate basic features on large data sets to small data sets, reducing the amount of data training without causing too much drop in accuracy, thereby accelerating training efficiency. Transfer learning can also limit parameters to a reasonable parameter space during pre-training, which makes our selection more adaptable. And because the parameters are trained on large data sets, they have better generalization ability and can be well adapted when migrated to small data sets.

[0046] S14. Input the real-time network traffic data into the trained joint machine learning model. The joint machine learning model monitors the network traffic data and outputs warning information when the monitoring result is abnormal.

[0047] Based on streaming data processing methods (such as Apache Kafka and Apache Flink), low-latency real-time network traffic data processing is achieved, and the collected network traffic data is transmitted to the joint machine learning model, which analyzes the data in real time and generates warning information.

[0048] Using Apache Kafka as a message queue system, it is responsible for receiving and storing real-time data from different data sources, and transmitting this data to downstream processing systems (such as Flink) in an efficient and reliable manner. At this stage, network traffic data, log data, or other monitoring data is collected and pushed to Kafka topics. Using Apache Flink as a stream processing engine, Flink uses the Kafka Consumer API to consume real-time data from Kafka topics and enter the data processing stage. Flink has powerful real-time data processing capabilities and can perform complex calculations, analysis, and pattern recognition on streaming data. Define the logic of data stream processing in Flink, such as feature extraction, aggregation, filtering, window operations (such as sliding windows or rolling windows), machine learning model predictions, etc.

[0049] Monitor and warn based on Flink's output results. The real-time processed data is output to the monitoring and warning module to detect abnormal behavior based on predefined rules or machine learning models. CNN detection uses trained deep models to detect complex abnormal traffic, random forests efficiently detect known attacks, and autoencoders reconstruct data to detect attacks with small samples. If an anomaly is detected, the system will immediately trigger an alarm mechanism (such as sending a notification, triggering an automated response, etc.).

[0050] A rule engine (such as Drools) can be used to perform logical judgment and rule matching based on the data stream processed by Flink to identify potential security threats or abnormal behaviors. When an anomaly is detected, the system triggers an early warning mechanism to send an alarm notification (such as email, SMS, Webhook call, etc.), or perform an automated response (such as isolating network nodes, blocking traffic, etc.).

[0051] The real-time detection and early warning module will drive the machine learning model to optimize hyperparameters. Hyperparameter optimization can improve the accuracy of detection, have better pan-fitting capabilities for a wide range of samples, and also control the complexity of the model, shortening the time spent in detection and early warning. Hyperparameters can also improve training efficiency.

[0052] The methods for optimizing hyperparameters of the three models in this application are as follows: CNN: Change the size and number of convolution kernels to learn different data, change the type and size of pooling layers to balance feature accuracy and computational efficiency, adjust the learning rate to speed up training, and finally regularize parameters to prevent overfitting. Specific methods include: grid search, Bayesian optimization, etc. (lottery to find the best combination).

[0053] Random Forest: Change the number of trees to improve the variety and accuracy of classification, control the depth of the tree to avoid overfitting, and also optimize the feature distinction to reduce the number of trees we need to train, as described above.

[0054] Autoencoder: Change the number of hidden layers to optimize the performance of reconstruction. Fewer layers lead to underfitting, while more layers lead to overfitting. Then change the activation function to learn the nonlinear part of the data to help the reconstruction better. The module also includes an automatic model evaluation and update mechanism, where the system regularly evaluates the performance of the current model. If a degradation in model performance is detected, the system will initiate a retraining mechanism to update the model using the latest data to adapt to new attack methods.

[0055] S15. Generate an attack report based on the monitoring results of the joint machine learning model.

[0056] Automatically generate detailed attack reports based on the monitoring results of the joint machine learning model. The report includes attack paths, attack methods, affected devices, and defense recommendations. Use templates to generate easy-to-understand reports, and system administrators can directly view the report content to quickly take defensive measures.

[0057] S16. Visualize network traffic data and attack reports.

[0058] Implementation of the visualization interface module: The visualization interface module provides a real-time monitoring interface, including network status display, attack type and attack source real-time visualization. The interface uses graphics, tables and charts to present the current network security status, which is convenient for system administrators to intuitively understand. By clicking on a specific attack event, the administrator can view detailed information and make a timely response.

[0059] The following is an in-depth discussion and analysis of how the present invention can effectively support intrusion detection on resource-constrained IoT devices: In the IoT environment, devices usually have the following characteristics: Limited computing power, memory and storage space, a wide variety of devices, large differences in computing power, multiple data types, the need for low latency and low energy consumption. In the IoT environment, these three models can work together to provide powerful intrusion detection and anomaly detection capabilities: Multi-layer protection: CNN is responsible for extracting and analyzing network traffic features in real time, autoencoders learn normal operation modes and detect abnormal behaviors, and GAN generates simulated attack data to strengthen the model. This multi-layer protection system can significantly improve the security of IoT systems.

[0060] Flexibility and scalability: These models can be customized and optimized according to different IoT devices and application scenarios, supporting the heterogeneity and diversity of various devices, thereby enhancing the adaptability and scalability of the system.

[0061] Efficient energy management: By using lightweight deep learning models and optimization algorithms, these models can run on resource-constrained IoT devices, providing efficient intrusion detection and anomaly detection services without significantly increasing energy consumption.

[0062] Example 2 Based on the artificial intelligence-based intrusion detection method of embodiment 1, correspondingly, refer to Figure 8 , the present application also provides an artificial intelligence-based intrusion detection system, which may include: A data collection module, used for collecting network traffic data from the network environment; The feature engineering module is used to preprocess the collected network traffic data, improve the data quality of the network traffic data, extract the features of the preprocessed network traffic data, and standardize and reduce the dimensionality of the extracted features to obtain a feature data set.

[0063] The machine learning model module is used to build a joint machine learning model, which includes multiple parallel learning models. It uses data sets and combines transfer learning to batch train all learning models. It uses an integrated learning method to fuse the prediction results of multiple pre-trained learning models to obtain a trained joint machine learning model.

[0064] The real-time monitoring and early warning module is used to input real-time network traffic data into the trained joint machine learning model, which monitors the network traffic data and outputs early warning information when the monitoring results are abnormal.

[0065] The report generation module is used to generate attack reports based on the monitoring results of the joint machine learning model.

[0066] Visualization interface module, used to visualize network traffic data and attack reports.

[0067] It should be noted that in the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of each module is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules can be combined or integrated into another device, or some features can be ignored or not executed. The module described as a separate component may or may not be physically separated. The component displayed as a module may be a physical unit or multiple physical units, that is, it may be located in one place, or it may be distributed in multiple different places. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0068] In addition, each module in each embodiment of the present invention may be integrated into a processing unit, each module may exist physically separately, or two or more modules may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of a software functional unit.

[0069] An electronic device provided in an embodiment of the present application includes a memory and a processor. A computer program is stored in the memory. When the processor executes the computer program, the steps of the artificial intelligence-based intrusion detection method described in any of the above embodiments are implemented.

[0070] Another electronic device provided in the embodiment of the present application may also include: an input port connected to the processor, used to transmit multimodal data collected by an external acquisition device to the processor; and a display unit connected to the processor, used to display the processing results of the processor to the outside world; a communication module connected to the processor, used to realize the communication between the electronic device and the outside world. The display unit can be a display panel, a laser scanning display, etc.; the communication mode adopted by the communication module includes but is not limited to mobile high-definition link technology (HML), universal serial bus (USB), high-definition multimedia interface (HDMI), wireless connection (including wireless fidelity technology (WiFi), Bluetooth communication technology, low-power Bluetooth communication technology, and communication technology based on IEEE802.11s).

[0071] An embodiment of the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps of the artificial intelligence-based intrusion detection method described in any of the above embodiments are implemented.

[0072] The computer-readable storage medium involved in the present application includes random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the technical field.

[0073] For the description of the relevant parts of the artificial intelligence-based intrusion detection system, electronic device, and computer-readable storage medium provided in the embodiments of the present application, please refer to the detailed description of the corresponding parts in the artificial intelligence-based intrusion detection method provided in the embodiments of the present application, which will not be repeated here. In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive elaboration.

[0074] The above contents are only for explaining the technical idea of ​​the present invention and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution in accordance with the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. An intrusion detection method based on artificial intelligence, characterized in that: The following steps are involved: Step 1: extract the features of network traffic data, and perform standardization and dimensionality reduction on the extracted features to obtain a feature data set; Step 2: Build a joint machine learning model, which includes multiple parallel learning models, use the data set and combine transfer learning to batch train all learning models, and use an ensemble learning method to fuse the prediction results of multiple pre-trained learning models to obtain a trained joint machine learning model; Step 3: Input the real-time network traffic data into the trained joint machine learning model, and use the joint machine learning model to perform intrusion monitoring on the network traffic data.

2. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: In step 1, network traffic data is collected based on sensors on network nodes.

3. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: In step 1, the network traffic data is first preprocessed, and then features are extracted from the preprocessed network traffic data. The network traffic data preprocessing includes: The network traffic data is processed by various methods including data cleaning, noise reduction, filtering, filling missing values, and normalization.

4. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: The dimensionality reduction processing includes PCA and t-SNE, which reduce the dimensionality of high-dimensional feature data to obtain a reduced-dimensional feature data set.

5. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: The joint machine learning model described in step 3 includes a deep learning model, a time series model, a combined model based on a generative adversarial network and an autoencoder, and an integrated learning model.

6. The artificial intelligence-based intrusion detection method according to claim 5, characterized in that: The CNN model is used for deep analysis of high-dimensional features and capture of abnormal patterns; The random forest model is used for real-time detection of abnormal traffic and accurate classification of attack methods; The LSTM model is based on time dependency and sequence patterns and is used to predict and judge the consistency of dynamic attack behaviors in network traffic; The deep learning model fused with the GAN and the autoencoder is used to generate simulated attack data and encode and decode normal traffic; The integrated learning model is used to fuse the prediction results of each model to obtain the final monitoring result.

7. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: In step 3, real-time network traffic data is collected based on the streaming data processing method, and the collected network traffic data is transmitted to the joint machine learning model.

8. The artificial intelligence-based intrusion detection method according to claim 1, characterized in that: The following steps are also included: Step 4: Generate an attack report based on the monitoring results of the joint machine learning model. The attack report includes the attack path, attack method, affected devices and defense strategy.

9. A system for executing the artificial intelligence-based intrusion detection method according to any one of claims 1 to 8, characterized in that: include: The feature engineering module is used to extract the features of network traffic data, and standardize and reduce the dimensionality of the extracted features to obtain a feature data set; The machine learning model module is used to build a joint machine learning model, which includes multiple parallel learning models. The data set is used in combination with transfer learning to batch train all learning models. The prediction results of multiple pre-trained learning models are integrated using an ensemble learning method to obtain a trained joint machine learning model. The real-time monitoring and early warning module is used to input real-time network traffic data into the trained joint machine learning model, and the joint machine learning model performs intrusion monitoring on the network traffic data.

10. The system of the intrusion detection method based on artificial intelligence according to claim 9, characterized in that: Also includes: A data collection module, used for collecting network traffic data from the network environment; A report generation module, used to generate attack reports based on the monitoring results of the joint machine learning model; Visualization interface module, used to visualize network traffic data and attack reports.

Images