Intelligent network intrusion detection system based on deep learning

Abstract

The invention relates to the field of network intrusion, in particular to an intelligent network intrusion detection system based on deep learning. A current intelligent network intrusion system lacks time continuity, is prone to generating false alarms on normal traffic, is too rigid to identify network intrusion behaviors, and lacks active defense capability. Comprising a marking module, a monitoring module, a judgment module, an analysis module and a feedback module. When it is identified that the data exchanged between the host and the network contains the mark, data exchange is stopped, key information is efficiently prevented from being leaked to the network, and further intrusion behaviors are effectively prevented; the network intrusion behavior is simplified into a series of specific operations on the data, the network intrusion behavior is two-dimensionally performed on the time scale, and the recognition effect of the network intrusion behavior is improved.

Description

Technical Field

[0001] The present invention relates to the field of network intrusion, and in particular to an intelligent network intrusion detection system based on deep learning. Background Art

[0002] With the development of network and Internet of Things technology, various fields are increasingly dependent on computer networks, and more and more important data are stored in computers. It is particularly important to have a network protection system that can prevent network intrusion in computers to protect electronic assets and personal privacy. In the network protection system, the intelligent network intrusion detection system is the first to bear the brunt.

[0003] An intelligent network intrusion detection system refers to the use of artificial intelligence, deep learning and other information to enhance the performance and functions of traditional intrusion detection systems. It can detect intrusion behaviors from the network and the specific types of intrusion behaviors at the first time, and plays the role of an outpost in preventing network intrusions.

[0004] However, the current intelligent network intrusion system lacks temporal continuity, is prone to false alarms for normal traffic, and is too rigid in identifying network intrusion behavior and lacks the ability to actively defend.

[0005] Therefore, there is a need for an intelligent network intrusion detection system based on deep learning that can continuously monitor operations on the same network address over a time scale and identify network intrusion behaviors in real time by quantifying them. Summary of the invention

[0006] In order to achieve the above functions, the present invention provides an intelligent network intrusion detection system based on deep learning, characterized in that the intelligent network intrusion detection system includes a marking module, a monitoring module, a judgment module, an analysis module, and a feedback module;

[0007] Marking module: receives the key information that needs to be protected selected by the user, marks the key information to obtain key data, records the location of the key data, and calls the rest of the data in the host as regular data;

[0008] Monitoring module: monitors the data exchange between the host and the network, and records the operation data generated by the operation of regular data from requests from different network IP addresses, and sends the recorded operation data to the judgment module; if the mark generated by the marking module is detected during the data exchange, the data exchange is terminated and all the operation data of the network IP addresses participating in the data exchange are sent to the analysis module as data to be analyzed;

[0009] Judgment module: Analyze the received operation data, extract and sort out the operation data belonging to the same network IP address according to different sources, and set different sensitivities for different types of operation data; if the judgment module has the same network IP address, when the accumulated sensitivity reaches the threshold within the specified time, all the operation data belonging to the network IP address will be sent to the analysis module as the data to be analyzed;

[0010] Analysis module: Check the data to be analyzed sent by the judgment module, obtain the intrusion behavior curve reflecting the typical intrusion behavior through deep learning, compare the intrusion behavior curve with the data to be analyzed, and determine the data operation as an intrusion behavior after confirming the existence of an intrusion behavior curve similar to the data operation curve, and take corresponding treatment measures according to the type of intrusion behavior;

[0011] Feedback module: According to the results of the analysis module's processing measures, the analysis module's judgment on the behavior to be analyzed and the intrusion behavior deep learning model are corrected, and the data to be analyzed that is judged as intrusion behavior is added to the data set for training the intrusion behavior deep learning model.

[0012] Furthermore, the step of the marking module marking the key information is as follows:

[0013] S1. The marking module generates corresponding codes for different key information, and generates a random string corresponding to the key information according to the code and the digital characteristics of the key information. The user obtains the code corresponding to the key information through the marking module;

[0014] S2. inserting the random string into the key information in order according to the encoding to obtain the marked key data;

[0015] S3. When the user needs to obtain the key information, the code corresponding to the key information is input into the marking module. The marking module decodes the key data corresponding to the input code according to the code input by the user, and sends the decoded key information to the user in a read-only form. The code cannot be restored through the key information, and the host does not need to restore the key data to the key information when performing transmission operations on the key data.

[0016] Furthermore, the regular data is regular readable data in the host except the key data. The monitoring module records and updates in real time the location of the regular data in the host and the frequency of use of the regular data by users. When the regular data is modified, it records the modification time and the object that modified the regular data.

[0017] Furthermore, the sensitivity setting method includes: the marking module determines the importance of the regular data according to the location of the regular data in the host, the format of the regular data, and the amount of information contained in the regular data. The specific steps of determining the sensitivity of the regular data include:

[0018] S1. Obtain the source of the request for operating on regular data and record the permission level of the source of the request;

[0019] S2. The location of the conventional data is divided into a system area and a storage area, and corresponding regional parameters are set for different areas;

[0020] S3. Obtain the amount of information carried by the conventional data according to the format, volume and frequency of use of the conventional data by the user, and calculate the sensitivity;

[0021] The sensitivity is calculated as follows:

[0022]

[0023] Wherein, M is the sensitivity corresponding to the regular data, b is the area parameter corresponding to the location of the regular data in the host, a represents the authority level of the source of the request to upload the regular data, and the authority level is inversely proportional to a, C represents the frequency of use of the regular data by the user, and P is the amount of information carried by the regular data, which is related to the format and size of the regular data;

[0024] During the operation of the host, the sensitivity of the regular data is accumulated when the regular data is uploaded to the network or when commands from different sources within the host operate on the regular data. When the accumulated sensitivity exceeds a threshold, the judgment module extracts feature information of the regular data and the operations performed as data to be analyzed.

[0025] Furthermore, the principle of the monitoring module identifying the mark is: the random character string corresponding to the mark generated by the marking module is distributed in the key data according to a specific pattern, and the detection module determines whether the data is marked by identifying whether there is a character string distributed in a specific pattern in the data exchanged between the host and the network, and then determines whether the data is the key data. The key data inside the host is only used inside the host and is not allowed to be uploaded to the network. Therefore, when the detection module recognizes the mark, it indicates that there is an intrusion in the network IP address that is currently exchanging data with the host.

[0026] Furthermore, the analysis module uses typical network intrusion behavior data as a data set, extracts the intrusion features of the intrusion behavior in the data set, trains a deep learning model that simulates the intrusion behavior, thereby obtaining intrusion behavior curves corresponding to different intrusion behaviors, and sends the trained intrusion behavior curves to the analysis module.

[0027] Furthermore, the intrusion feature is obtained by quantifying and feature extracting the operations performed on the regular data and the key data inside the host extracted from the intrusion behavior, and the intrusion feature is quantified by a deep learning model to generate an intrusion behavior sequence sorted by time, and then the intrusion behavior curve is generated according to the intrusion behavior sequence;

[0028] The formula of the invasion behavior curve is:

[0029]

[0030] Among them, Y is the integral of the intrusion behavior curve. When Y is equal to 1, it means the intrusion is complete. β is the quantified intrusion feature. t is the correction parameter of the effect of the operation represented by different intrusion features on the intrusion at different times. The product of the intrusion features at different times and the correction parameter forms an intrusion behavior curve. T is the preset time range of the read intrusion behavior.

[0031] The intrusion behavior curve formula is used to predict the completion progress of the intrusion behavior. By quantifying the intrusion behaviors represented by the operations on the conventional data and the key data at different times, various intrusion behaviors are converted into the intrusion behavior curve.

[0032] Further, the analysis module quantifies the data to be analyzed according to time and substitutes the data to be analyzed into the intrusion behavior curve for calculation, and determines whether the derivative and integral of the data to be analyzed calculated after the same time are the same as the standard form of the intrusion behavior curve. The formula for judging whether the data to be analyzed is the same as the standard form of the intrusion behavior curve is:

[0033]

[0034] Among them, C is the difference value, i is the relevant parameter, and when the difference value is less than 0.5, the analyzed data is judged to be the same as the standard intrusion behavior, and Y n Y is the time integral of the data to be analyzed after quantization at time n. 0n is the time integral of the standard form of the invasion behavior curve quantized at time n, d n is the time derivative of the data to be analyzed after quantization at time n, d 0nis the time derivative of the standard form of the invasion behavior curve quantized at time n;

[0035] The data to be analyzed used by the difference value is extracted in real time over time and used for calculating the difference value. When the difference value corresponding to a single data to be analyzed reaches 0.5 multiple times, the calculation of the difference value is stopped and the sensitivity corresponding to the data to be analyzed is recalculated.

[0036] Furthermore, the processing measures include: prohibiting the network IP address that has committed the intrusion from accessing the host, marking the source of the request that attempts to move or upload the critical data and reducing the authority of the request source, and isolating the source of the operations on the regular data whose cumulative sensitivity exceeds a threshold.

[0037] Furthermore, the feedback module reviews the data to be analyzed that is determined to be an intrusion behavior and the difference value analyzed by the analysis module is multiple times less than 0.5. If the determination is correct, the data features of the data to be analyzed and the corresponding conventional data are added to the training set used by the deep learning model; if the determination is that there is an error, the behavior parameters of the sensitivity calculation formula and the relevant parameters in the formula for determining whether the data to be analyzed is the same as the standard form of the intrusion behavior curve are negatively feedback adjusted, and the processing measures that have been taken are revoked.

[0038] Beneficial effects:

[0039] 1. Mark the key information that users need to protect, and block data exchange when the data exchanged between the host and the network contains the mark, effectively avoiding the leakage of key information to the network and effectively preventing further intrusion. At the same time, the key information is encrypted through the mark, which also improves the confidentiality of the key information inside the host;

[0040] 2. Simplify network intrusion behavior into a series of specific operations on data, and two-dimensionalize network intrusion behavior on a time scale, thereby improving the recognition effect of network intrusion behavior; fit network intrusion curves reflecting different network intrusion behaviors through deep learning, and use sensitivity to determine whether a specific behavior is suspected of intrusion behavior, so that network intrusion behavior can be detected at the beginning of the intrusion. Use network intrusion curves to determine whether a specific behavior is an intrusion behavior, which expands the number of features that reflect network intrusion behavior. Even if the specific behavior is complex or intrusion behavior, it can be identified, greatly improving the detection range of network intrusion. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is an architecture diagram of a network intrusion detection system of the present invention;

[0042] Figure 2The intrusion detection flow chart of the network intrusion detection system of the present invention. DETAILED DESCRIPTION

[0043] In order to achieve the above functions, the present invention provides an intelligent network intrusion detection system based on deep learning, such as Figure 1 As shown, the intelligent network intrusion detection system includes a marking module, a monitoring module, a judgment module, an analysis module, and a feedback module;

[0044] Marking module: receives the key information that needs to be protected selected by the user, marks the key information to obtain key data, records the location of the key data, and calls the rest of the data in the host as regular data;

[0045] The steps for the marking module to mark key information are as follows:

[0046] S1. The marking module generates corresponding codes for different key information, and generates a random string corresponding to the key information according to the digital characteristics of the code and the key information. The user obtains the code corresponding to the key information through the marking module;

[0047] S2. inserting the random string into the key information in order according to the encoding to obtain the marked key data;

[0048] S3. When the user needs to obtain key information, the code corresponding to the key information is input into the marking module. The marking module decodes the key data corresponding to the input code according to the code input by the user, and sends the decoded key information to the user in a read-only form. The code cannot be restored through the key information. When the host performs transmission operations on the key data, it is not necessary to restore the key data to the key information.

[0049] The marking module marks the key information: the code is octal, and the marking module contains fixed rules for using the code to generate random strings. Different codes correspond to different types and distribution patterns of characters in the random strings, and the random combinations generated in the random strings will not appear in the hosts used in daily life. At the same time, the information contained in the code itself determines the position where the random string is inserted into the key information;

[0050] The key data is obtained by inserting the random string into the key information according to the encoding. In the header file of each key information, there is a partial random character combination that reflects the character types and distribution rules in the random string. The partial random character combination and the random string distributed in the key data form a tag;

[0051] At the same time, the key data with random character combinations cannot be restored to the key information through decoding.

[0052] The formula for generating some random character combinations is:

[0053]

[0054] Where L i are characters at different positions in the partial random string, α is the ASCI code corresponding to all types of characters in the random string, and β is the number of character types in the random string;

[0055] Random character combinations themselves have no meaning. Due to the diversity of additive combinations, random character combinations cannot be restored to random character strings in a short time. Random character combinations are strongly related to random character strings and can be quickly identified.

[0056] Regular data refers to regular readable data in the host except for key data. The monitoring module records and updates the location of regular data in the host and the frequency of users using regular data in real time. When regular data is modified, it records the modification time and the object that modified the regular data.

[0057] Monitoring module: monitors the data exchange between the host and the network, and records the operation data generated by the operation of regular data from requests from different network IP addresses, and sends the recorded operation data to the judgment module; if the mark generated by the marking module is detected during the data exchange, the data exchange is terminated and all the operation data of the network IP addresses participating in the data exchange are sent to the analysis module as data to be analyzed;

[0058] The principle of the monitoring module identifying the tag is as follows: the random character string corresponding to the tag generated by the tag module is distributed in a specific pattern in the key data. The detection module determines whether the data is marked by identifying whether there is a character string distributed in a specific pattern in the data exchanged between the host and the network, and then determines whether the data is key data. The key data inside the host is only used inside the host and is not allowed to be uploaded to the network. Therefore, when the detection module recognizes the tag, it means that there is an intrusion in the network IP address that is currently exchanging data with the host.

[0059] Judgment module: Analyze the received operation data, extract and sort out the operation data belonging to the same network IP address according to different sources, and set different sensitivities for different types of operation data; if the judgment module reaches the threshold value for the same network IP address within a specified time, all the operation data belonging to the network IP address will be sent to the analysis module as data to be analyzed;

[0060] The sensitivity setting method includes: the marking module determines the importance of the regular data according to the location of the regular data in the host, the format of the regular data and the amount of information contained in the regular data. The specific steps of determining the sensitivity of the regular data include:

[0061] S1. Obtain the source of the request for operating on regular data and record the permission level of the source of the request;

[0062] S2. Divide the location of conventional data into a system area and a storage area, and set corresponding area parameters for different areas;

[0063] S3. Obtain the amount of information carried by regular data according to the format, volume and frequency of use of regular data, and calculate the sensitivity;

[0064] The sensitivity calculation formula is:

[0065]

[0066] Wherein, M is the sensitivity corresponding to the regular data, b is the area parameter corresponding to the location of the regular data in the host, a represents the authority level of the source of the request to upload the regular data, and the authority level is inversely proportional to a, C represents the frequency of use of the regular data by the user, and P is the amount of information carried by the regular data, which is related to the format and size of the regular data;

[0067] like Figure 2 As shown in the figure, the network intrusion detection process includes:

[0068] During the operation of the host, the sensitivity of the conventional data is accumulated when the conventional data is uploaded to the network or when commands from different sources in the host operate on the conventional data. When the accumulated sensitivity exceeds a threshold, the judgment module extracts the characteristic information of the conventional data and the operations performed as the data to be analyzed.

[0069] Analysis module: Check the data to be analyzed sent by the judgment module, obtain the intrusion behavior curve reflecting the typical intrusion behavior through deep learning, compare the intrusion behavior curve with the data to be analyzed, and determine the data operation as an intrusion behavior after confirming the existence of an intrusion behavior curve similar to the data operation curve, and take corresponding treatment measures according to the type of intrusion behavior;

[0070] The processing measures taken include: prohibiting the network IP address that has committed the intrusion from accessing the host, marking the source of the request that attempts to move or upload key data and reducing the authority of the request source, isolating the source of the cumulative sensitivity of the operation on regular data that exceeds the threshold, and for the data to be analyzed that is determined to be an intrusion that will infect the internal data of the host, scheduling antivirus software to perform antivirus inspection on the data inside the host; for the data to be analyzed that is determined to be an intrusion that can deceive the user of the host, freezing the relevant data to be analyzed and notifying the user of the host.

[0071] The analysis module uses typical network intrusion behavior data as a data set, extracts the intrusion features of the intrusion behavior in the data set, trains a deep learning model that simulates the intrusion behavior, and thus obtains intrusion behavior curves corresponding to different intrusion behaviors, and sends the trained intrusion behavior curves to the analysis module;

[0072] The intrusion features are obtained by quantifying and extracting the operations on the regular data and key data inside the host from the intrusion behavior. The intrusion features are quantified by the deep learning model to generate a time-ordered intrusion behavior sequence, and then the intrusion behavior curve is generated based on the intrusion behavior sequence;

[0073] The formula for the intrusion behavior curve is:

[0074]

[0075] Among them, Y is the integral of the intrusion behavior curve. When Y is equal to 1, it means the intrusion is complete. β is the quantified intrusion feature. t is the correction parameter of the effect of the operation represented by different intrusion features on the intrusion at different times. The product of the intrusion features at different times and the correction parameter forms an intrusion behavior curve. T is the preset time range of the read intrusion behavior.

[0076] The intrusion behavior curve formula is used to predict the completion progress of the intrusion behavior. By quantifying the intrusion behaviors represented by the operations on routine data and key data at different times, various intrusion behaviors are converted into intrusion behavior curves.

[0077] The analysis module quantifies the data to be analyzed by time and substitutes the data to be analyzed into the intrusion behavior curve for calculation. The calculation is based on whether the derivative and integral of the data to be analyzed calculated at the same time are the same as the standard form of the intrusion behavior curve. The formula for judging whether the data to be analyzed is the same as the standard form of the intrusion behavior curve is:

[0078]

[0079] Among them, C is the difference value, i is the relevant parameter, and when the difference value is less than 0.5, the analyzed data is judged to be the same as the standard intrusion behavior, and Y n Y is the time integral of the data to be analyzed after quantization at time n. 0n is the time integral of the standard form of the invasion behavior curve quantized at time n, d n is the time derivative of the data to be analyzed after quantization at time n, d 0n is the time derivative of the standard form of the invasion behavior curve quantized at time n;

[0080] The data to be analyzed used by the difference value is extracted in real time over time and used to calculate the difference value. When the difference value corresponding to a single data to be analyzed reaches 0.5 multiple times, the calculation of the difference value is stopped and the sensitivity corresponding to the data to be analyzed is recalculated.

[0081] Feedback module: According to the results of the analysis module's processing measures, the analysis module's judgment on the behavior to be analyzed and the intrusion behavior deep learning model are corrected, and the data to be analyzed that is judged as intrusion behavior is added to the data set for training the intrusion behavior deep learning model.

[0082] The feedback module reviews the data to be analyzed that is judged as an intrusion behavior and the difference value analyzed by the analysis module is less than 0.5 for multiple times. If the judgment is correct, the data features of the data to be analyzed and the corresponding conventional data are added to the training set used by the deep learning model; if it is judged that there is an error, the behavior parameters of the sensitivity calculation formula and the relevant parameters in the formula for judging whether the data to be analyzed is the same as the standard form of the intrusion behavior curve are adjusted by negative feedback, and the treatment measures that have been taken are revoked.

[0083] The above-mentioned embodiments only express the preferred implementation modes of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present invention. It should be pointed out that, for a person skilled in the art, several modifications, improvements and substitutions can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention patent shall be subject to the attached claims.

Claims

1. An intelligent network intrusion detection system based on deep learning, characterized in that , including marking module, monitoring module, judgment module, analysis module and feedback module; Marking module: receives the key information that needs to be protected selected by the user, marks the key information to obtain key data, records the location of the key data, and calls the rest of the data in the host as regular data; Monitoring module: monitors the data exchange between the host and the network, records the operation data generated by the operation of regular data from requests from different network IP addresses, and sends the recorded operation data to the judgment module; If a mark generated by the marking module is detected during data exchange, the data exchange is terminated and all operation data of the network IP addresses participating in the data exchange are sent to the analysis module as data to be analyzed; Judgment module: Analyze the received operation data, extract and sort out the operation data belonging to the same network IP address according to different sources, and set different sensitivities for different types of operation data; if the judgment module has the same network IP address, when the accumulated sensitivity reaches the threshold within the specified time, all the operation data belonging to the network IP address will be sent to the analysis module as the data to be analyzed; Analysis module: Check the data to be analyzed sent by the judgment module, obtain the intrusion behavior curve reflecting the typical intrusion behavior through deep learning, compare the intrusion behavior curve with the data to be analyzed, and determine the data operation as an intrusion behavior after confirming the existence of an intrusion behavior curve similar to the data operation curve, and take corresponding treatment measures according to the type of intrusion behavior; Feedback module: According to the results of the analysis module's processing measures, the analysis module's judgment on the behavior to be analyzed and the intrusion behavior deep learning model are corrected, and the data to be analyzed that is judged as intrusion behavior is added to the data set for training the intrusion behavior deep learning model.

2. The deep learning-based intelligent network intrusion detection system according to claim 1, characterized in that: The step of the marking module marking the key information is as follows: S1. The marking module generates corresponding codes for different key information, and generates a random string corresponding to the key information according to the code and the digital characteristics of the key information. The user obtains the code corresponding to the key information through the marking module; S2. inserting the random string into the key information in order according to the encoding to obtain the marked key data; S3. When the user needs to obtain the key information, the code corresponding to the key information is input into the marking module. The marking module decodes the key data corresponding to the input code according to the code input by the user, and sends the decoded key information to the user in a read-only form. The code cannot be restored through the key information, and the host does not need to restore the key data to the key information when performing transmission operations on the key data.

3. The deep learning-based intelligent network intrusion detection system according to claim 2, characterized in that: The regular data is regular readable data in the host except the key data. The monitoring module records and updates in real time the location of the regular data in the host and the frequency of use of the regular data by users. When the regular data is modified, the modification time and the object for which the regular data is modified are recorded.

4. The deep learning-based intelligent network intrusion detection system according to claim 3 is characterized in that: The sensitivity setting method includes: The marking module determines the importance of the regular data according to the location of the regular data in the host, the format of the regular data, and the amount of information contained in the regular data. The specific steps of determining the sensitivity of the regular data include: S1. Obtain the source of the request for operating on regular data and record the permission level of the source of the request; S2. The location of the conventional data is divided into a system area and a storage area, and corresponding regional parameters are set for different areas; S3. Obtain the amount of information carried by the conventional data according to the format, volume and frequency of use of the conventional data by the user, and calculate the sensitivity; The sensitivity is calculated as follows: Wherein, M is the sensitivity corresponding to the regular data, b is the area parameter corresponding to the location of the regular data in the host, a represents the authority level of the source of the request to upload the regular data, and the authority level is inversely proportional to a, C represents the frequency of use of the regular data by the user, and P is the amount of information carried by the regular data, which is related to the format and size of the regular data; During the operation of the host, the sensitivity of the regular data is accumulated when the regular data is uploaded to the network or when commands from different sources within the host operate on the regular data. When the accumulated sensitivity exceeds a threshold, the judgment module extracts feature information of the regular data and the operations performed as data to be analyzed.

5. The deep learning-based intelligent network intrusion detection system according to claim 4 is characterized in that: The principle of the monitoring module identifying the mark is: the random character string corresponding to the mark generated by the marking module is distributed in the key data with a specific pattern, and the detection module determines whether the data is marked by identifying whether there is a character string distributed with a specific pattern in the data exchanged between the host and the network, and then determines whether the data is the key data. The key data inside the host is only used inside the host and is not allowed to be uploaded to the network. Therefore, when the detection module recognizes the mark, it indicates that there is an intrusion in the network IP address that is currently exchanging data with the host.

6. The deep learning-based intelligent network intrusion detection system according to claim 5, characterized in that: The analysis module uses typical network intrusion behavior data as a data set, extracts the intrusion features of the intrusion behavior in the data set, trains a deep learning model that simulates the intrusion behavior, thereby obtaining intrusion behavior curves corresponding to different intrusion behaviors, and sends the trained intrusion behavior curves to the analysis module.

7. The deep learning-based intelligent network intrusion detection system according to claim 6, characterized in that: The intrusion feature is obtained by quantifying and feature extracting the operations performed on the regular data and the key data inside the host extracted from the intrusion behavior. The intrusion feature is quantified by a deep learning model to generate an intrusion behavior sequence sorted by time, and then the intrusion behavior curve is generated according to the intrusion behavior sequence. The formula of the invasion behavior curve is: Among them, Y is the integral of the intrusion behavior curve. When Y is equal to 1, it means the intrusion is complete. β is the quantified intrusion feature. t is the correction parameter of the effect of the operation represented by different intrusion features on the intrusion at different times. The product of the intrusion features at different times and the correction parameter forms an intrusion behavior curve. T is the preset time range of the read intrusion behavior. The intrusion behavior curve formula is used to predict the completion progress of the intrusion behavior. By quantifying the intrusion behaviors represented by the operations on the conventional data and the key data at different times, various intrusion behaviors are converted into the intrusion behavior curve.

8. The deep learning-based intelligent network intrusion detection system according to claim 7, characterized in that: The analysis module quantifies the data to be analyzed according to time and substitutes the data to be analyzed into the intrusion behavior curve for calculation. It is determined whether the derivative and integral of the data to be analyzed calculated at the same time are the same as the standard form of the intrusion behavior curve. The formula for determining whether the data to be analyzed is the same as the standard form of the intrusion behavior curve is: Among them, C is the difference value, i is the relevant parameter, and when the difference value is less than 0.5, the analyzed data is judged to be the same as the standard intrusion behavior, and Y n Y is the time integral of the data to be analyzed after quantization at time n. 0n is the time integral of the standard form of the invasion behavior curve quantized at time n, d n is the time derivative of the data to be analyzed after quantization at time n, d 0n is the time derivative of the standard form of the invasion behavior curve quantized at time n; The data to be analyzed used by the difference value is extracted in real time over time and used for calculating the difference value. When the difference value corresponding to a single data to be analyzed reaches 0.5 multiple times, the calculation of the difference value is stopped and the sensitivity corresponding to the data to be analyzed is recalculated.

9. The deep learning-based intelligent network intrusion detection system according to claim 8, characterized in that: The processing measures include: prohibiting the network IP address that has committed the intrusion from accessing the host, marking the source of the request that attempts to move or upload the critical data and reducing the authority of the request source, and isolating the source of the operation on the regular data whose cumulative sensitivity exceeds a threshold.

10. The deep learning-based intelligent network intrusion detection system according to claim 9, characterized in that: The feedback module reviews the data to be analyzed that is determined to be an intrusion behavior and the difference value analyzed by the analysis module is less than 0.5 for multiple times. If the determination is correct, the data features of the data to be analyzed and the corresponding conventional data are added to the training set used by the deep learning model; If it is determined that there is an error, negative feedback adjustment is performed on the behavior parameters of the sensitivity calculation formula and the relevant parameters in the formula for determining whether the data to be analyzed is the same as the standard form of the intrusion behavior curve, and the processing measures that have been taken are revoked.

Images