Network intrusion detection method and system based on deep learning

Abstract

The invention relates to the technical field of network intrusion detection, in particular to a network intrusion detection method and system based on deep learning, which can efficiently identify and adapt to a novel attack mode by learning and training a large amount of network traffic data and log information through a deep learning model. The defect that a traditional detection method is insufficient in recognition capability when facing novel attacks is effectively overcome. The whole process from data acquisition and processing to intrusion detection and response disposal is highly automatic, manual intervention is reduced, and the detection efficiency is improved. The system has an intelligent decision-making capability, can automatically take blocking measures according to a detection result, and traces an attack source. Network data can be collected and processed in real time, a deep learning model is used for rapid detection, and the real-time performance of detection is ensured. Therefore, the problem that an existing network intrusion detection mode cannot effectively identify novel attacks is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to a network intrusion detection method and system based on deep learning. Background Art

[0002] Over the past 20 years, network technology has developed rapidly, gaining widespread and in-depth application in areas such as the economy and education, profoundly impacting social development. At the same time, attacks against network systems have become increasingly severe and widespread, with a constant stream of new attack tools and methods emerging, causing not only economic losses but also threats to national security. Therefore, effective network intrusion detection (NID) solutions are ultimately crucial to modern society. An intrusion detection system (IDS) is a widely used network security device that monitors network activity and detects threats in real time. A NIDS is an IDS deployed on network nodes that detects attacks by directly analyzing network traffic.

[0003] At present, attackers can exploit inherent vulnerabilities in communication protocols, operating systems or facility configurations (based on covert channels, Trojan viruses, virtual networks, physical manipulation and other technologies) to remotely interfere and cause serious consequences such as data leakage, which in turn leads to the disclosure of personal privacy information, harassment and fraud of users, and seriously affects personal life and safety. Summary of the Invention

[0004] The purpose of the present invention is to provide a network intrusion detection method and system based on deep learning, aiming to solve the problem that existing network intrusion detection methods cannot effectively identify new types of attacks.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a network intrusion detection system based on deep learning, comprising a data acquisition module, a data processing module, an intrusion detection module, a response and disposal module, an interactive warning module, and a data tag backup module, wherein the data acquisition module, the data processing module, the intrusion detection module, the response and disposal module, the interactive warning module, and the data tag backup module are connected in sequence;

[0006] The data acquisition module is used to collect traffic data and log information of each node in the network in real time;

[0007] The data processing module cleans, normalizes, and extracts features from the collected traffic data and log information to obtain data suitable for deep learning model processing;

[0008] The intrusion detection module uses an intrusion detection model to detect real-time network data and determine whether there is intrusion behavior;

[0009] The response and disposal module automatically takes blocking measures when an intrusion is detected to prevent the attack from spreading, and traces the attack to find the source and path of the attack;

[0010] The interactive warning module immediately issues warning information to notify security management personnel when an intrusion is detected, and displays the detection results and warning information in real time to configure and manage the detection system;

[0011] The data tagging backup module is used to tag detected intrusion data and normal data, provide labeled data for subsequent model training and analysis, and regularly back up collected network data, processed feature data, and detection results.

[0012] Wherein, the data collection module includes a network flow collection unit, a log data collection unit and a communication unit, and the network flow collection unit and the log data collection unit are respectively connected to the communication unit;

[0013] The network traffic collection unit obtains network data through a network interface card or switch port mirroring or the like;

[0014] The log data collection unit is responsible for collecting log information of network devices and servers;

[0015] The communication unit is used to send the network data and log summary to the data processing module.

[0016] The data processing module includes a de-redundancy unit, a normalization unit and a feature extraction unit, and the de-redundancy unit and the normalization unit are respectively connected to the feature extraction unit;

[0017] The de-duplication unit removes duplicate, erroneous and invalid data from the original data;

[0018] The normalization processing unit is used to normalize data from different sources and in different formats;

[0019] The feature extraction unit is used to extract valuable features from the cleaned and normalized data.

[0020] Wherein, the intrusion detection module includes a deep learning model training unit and a real-time detection unit, and the deep learning model training unit and the real-time detection unit are connected;

[0021] The deep learning model training unit trains the processed data using a deep learning algorithm to obtain a monitoring model;

[0022] The real-time detection unit uses a trained deep learning model to detect real-time network data.

[0023] The response and handling module includes an automatic blocking unit and an attack tracing unit, and the automatic blocking unit and the attack tracing unit are connected;

[0024] The automatic blocking unit automatically takes blocking measures to close the attacked port and cut off the connection with the attack source;

[0025] The attack tracing unit is used to trace the attack behavior and find the source and path of the attack.

[0026] Wherein, the interactive warning module includes a real-time warning unit and a human-computer interaction unit;

[0027] The real-time warning unit is used to issue warning information to notify relevant security management personnel when an intrusion behavior is detected;

[0028] The human-computer interaction unit checks the real-time detection results and warning information through the interactive interface and configures and manages the detection system.

[0029] In a second aspect, a network intrusion detection method based on deep learning is used in the network intrusion detection system based on deep learning according to the first aspect, comprising the following steps:

[0030] Collect network traffic data and device log information through the network traffic collection unit and the log data collection unit;

[0031] The collected data is cleaned, normalized, and feature extracted by the data cleaning unit, data normalization unit, and feature extraction unit in sequence to obtain data suitable for deep learning model processing;

[0032] The processed data is trained using a deep learning model training unit to obtain an intrusion detection model. The real-time network data is then input into the model through a real-time detection unit for detection to determine whether there is intrusion behavior.

[0033] If an intrusion is detected, the automatic blocking unit will immediately take blocking measures, while the attack tracing unit will trace the source of the attack;

[0034] The real-time warning unit sends warning information to notify the security management personnel, who can interact with the system through the human-computer interaction unit to manage and intervene in the detection system;

[0035] The data labeling unit labels the detected data, and the data backup unit regularly backs up relevant data to provide support for subsequent analysis and model training.

[0036] The present invention provides a network intrusion detection system based on deep learning, comprising a data acquisition module, a data processing module, an intrusion detection module, a response and disposal module, an interactive warning module and a data tag backup module, wherein the data acquisition module, the data processing module, the intrusion detection module, the response and disposal module, the interactive warning module and the data tag backup module are connected in sequence; the data acquisition module is used to collect the flow data and log information of each node in the network in real time; the data processing module cleans, normalizes and extracts features of the collected flow data and log information to obtain data suitable for deep learning model processing; the intrusion detection module uses the intrusion detection module ... data processing module cleans, normalizes and extracts features of the collected flow data and log information to obtain data suitable for deep learning model processing; the data processing module cleans, normalizes and extracts features of the collected flow data and log information to obtain data suitable for deep learning model processing; the data processing module uses the intrusion detection module to collect the flow data and log information of each node in the network in real time; the data processing module cleans, normalizes and extracts features of the collected flow data and log information to obtain data suitable for deep learning model processing; the data processing module uses the intrusion detection module to collect the flow data and log information of each node in the network in real time; the data processing module cleans, normalizes and extracts features of the collected flow data and log information The model detects real-time network data to determine whether an intrusion is present. When an intrusion is detected, the response and disposal module automatically implements blocking measures to prevent the attack from spreading and traces the attack to identify its source and path. The interactive warning module immediately issues a warning message to security management personnel upon detecting an intrusion, displays the detection results and warning information in real time, and configures and manages the detection system. The data tagging and backup module labels detected intrusion data and normal data, providing labeled data for subsequent model training and analysis, and regularly backs up collected network data, processed feature data, and detection results. By training and learning large amounts of network traffic data and log information using a deep learning model, the present invention enables the system to efficiently identify and adapt to new attack patterns, effectively overcoming the shortcomings of traditional detection methods in identifying new attacks. From data collection and processing to intrusion detection and response, the entire process is highly automated, reducing manual intervention and improving detection efficiency. Furthermore, the system possesses intelligent decision-making capabilities, automatically implementing blocking measures based on detection results and tracing the source of the attack. It can collect and process network data in real time, utilizing a deep learning model for rapid detection, ensuring real-time detection. At the same time, the powerful analytical capabilities of deep learning models ensure detection accuracy and reduce false positive and false negative rates, thereby resolving the problem that existing network intrusion detection methods are unable to effectively identify new attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 This is a schematic diagram of a network intrusion detection system based on deep learning provided by the present invention.

[0039] Figure 2It is a schematic diagram of the data acquisition module.

[0040] Figure 3 It is a schematic diagram of the data processing module.

[0041] Figure 4 It is a schematic diagram of the intrusion detection module.

[0042] Figure 5 is a schematic diagram of the response handling module.

[0043] Figure 6 It is a schematic diagram of the interactive early warning module.

[0044] Figure 7 It is a schematic diagram of the data tag backup module.

[0045] Figure 8 This is a flow chart of a network intrusion detection method based on deep learning provided by the present invention.

[0046] In the figure: 1-data acquisition module, 2-data processing module, 3-intrusion detection module, 4-response and disposal module, 5-interactive warning module, 6-data labeling and backup module, 11-network traffic acquisition unit, 12-log data acquisition unit, 13-communication unit, 21-de-redundancy removal unit, 22-normalization processing unit, 23-feature extraction unit, 31-deep learning model training unit, 32-real-time detection unit, 41-automatic blocking unit, 42-attack tracing unit, 51-real-time warning unit, 52-human-computer interaction unit, 61-data labeling unit, 62-data backup unit. DETAILED DESCRIPTION

[0047] The following describes embodiments of the present invention in detail, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present invention, and are not to be construed as limiting the present invention.

[0048] See also Figures 1 to 7 The present invention provides a network intrusion detection method and system based on deep learning, including a data acquisition module 1, a data processing module 2, an intrusion detection module 3, a response and disposal module 4, an interactive warning module 5 and a data tag backup module 6, wherein the data acquisition module 1, the data processing module 2, the intrusion detection module 3, the response and disposal module 4, the interactive warning module 5 and the data tag backup module 6 are connected in sequence;

[0049] The data acquisition module 1 is used to collect the flow data and log information of each node in the network in real time;

[0050] The data processing module 2 cleans, normalizes and extracts features from the collected traffic data and log information to obtain data suitable for deep learning model processing;

[0051] The intrusion detection module 3 uses an intrusion detection model to detect real-time network data and determine whether there is intrusion behavior;

[0052] The response and handling module 4 automatically takes blocking measures when an intrusion is detected to prevent the attack from spreading, and traces the attack to find the source and path of the attack;

[0053] The interactive warning module 5 immediately issues warning information to notify security management personnel when an intrusion is detected, and displays the detection results and warning information in real time to configure and manage the detection system;

[0054] The data labeling backup module 6 is used to label the detected intrusion data and normal data, provide labeled data for subsequent model training and analysis, and regularly back up the collected network data, processed feature data, and detection results.

[0055] In this embodiment, the present invention utilizes a deep learning model to learn and train large amounts of network traffic data and log information. This system can efficiently identify and adapt to new attack patterns, effectively overcoming the shortcomings of traditional detection methods in identifying new attacks. From data collection and processing to intrusion detection and response, the entire process is highly automated, reducing manual intervention and improving detection efficiency. Furthermore, the system possesses intelligent decision-making capabilities, automatically implementing blocking measures based on detection results and tracing the source of attacks. The system collects and processes network data in real time, utilizing deep learning models for rapid detection, ensuring real-time detection. Furthermore, the powerful analytical capabilities of deep learning models ensure detection accuracy, reducing false positive and false negative rates. The system architecture of the present invention is flexible, with loosely coupled modules, facilitating expansion and upgrades based on actual needs. For example, more advanced deep learning algorithms can be introduced or new feature extraction methods can be added to enhance the system's detection performance. The interactive warning module 5 provides an intuitive and easy-to-use interface, allowing security managers to conveniently view detection results, warning information, and configure and manage the detection system. This user-friendly interactive experience lowers the barrier to entry for system use and enhances its practicality. The data tag backup module 6 regularly backs up the collected network data, processed feature data, and detection results, providing rich data support for subsequent analysis and model training. The implementation of this invention can significantly enhance the security protection capabilities of the network system, effectively resist various network attacks, protect personal privacy information from being leaked, and prevent users from being harassed, defrauded, and other security issues, providing a solid guarantee for network security.

[0056] Furthermore, the data collection module 1 includes a network traffic collection unit 11, a log data collection unit 12 and a communication unit 13, and the network traffic collection unit 11 and the log data collection unit 12 are respectively connected to the communication unit 13;

[0057] The network traffic collection unit 11 obtains network data through a network interface card or switch port mirroring;

[0058] The log data collection unit 12 is responsible for collecting log information of network devices and servers;

[0059] The communication unit 13 is used to send the network data and log summary to the data processing module 2.

[0060] In this embodiment, the network traffic collection unit 11 acquires network data through methods such as network interface cards or switch port mirroring, providing raw material for subsequent analysis. The log data collection unit 12 is responsible for collecting log information from network devices (such as routers, firewalls, etc.) and servers. These logs record the operating status of the devices, user login information, operation records, etc., which help to detect abnormal behavior and potential signs of attacks. The communication unit 13 summarizes the network data and logs and sends them to the data processing module 2.

[0061] Furthermore, the data processing module 2 includes a de-redundancy unit 21, a normalization unit 22 and a feature extraction unit 23, and the de-redundancy unit 21 and the normalization unit 22 are respectively connected to the feature extraction unit 23;

[0062] The de-duplication unit 21 removes duplicate, erroneous and invalid data from the original data;

[0063] The normalization processing unit 22 is used to normalize data from different sources and in different formats;

[0064] The feature extraction unit 23 is used to extract valuable features from the cleaned and normalized data.

[0065] In this embodiment, the de-duplication unit 21 removes duplicate, erroneous, and invalid data, and the normalization unit 22 normalizes data from different sources and formats to uniformly measure and scale the data. Normalization formulas include linear normalization and Z-score normalization.

[0066] Linear normalization formula: X_norm = (X-X_min) / (X_max-X_min)

[0067] Z-score normalization formula: Z = (X-μ) / σ

[0068] Where X is the original data, X_norm is the normalized data, X_min and X_max are the minimum and maximum values ​​of the data respectively, μ is the mean of the data, and σ is the standard deviation of the data.

[0069] The feature extraction unit 23 extracts valuable features from the cleaned and normalized data.

[0070] Furthermore, the intrusion detection module 3 includes a deep learning model training unit 31 and a real-time detection unit 32, and the deep learning model training unit 31 and the real-time detection unit 32 are connected;

[0071] The deep learning model training unit 31 trains the processed data using a deep learning algorithm to obtain a monitoring model;

[0072] The real-time detection unit 32 detects real-time network data using a trained deep learning model.

[0073] In this embodiment, the deep learning model training unit 31 trains the processed data using a deep learning algorithm (such as a CNN, RNN, or support vector machine (SVM)) to generate an intrusion detection model. The training process may involve optimization algorithms such as backpropagation and gradient descent. The real-time detection unit 32 uses the trained deep learning model to detect real-time network data and determine whether there is intrusion.

[0074] Furthermore, the response and handling module 4 includes an automatic blocking unit 41 and an attack tracing unit 42, and the automatic blocking unit 41 and the attack tracing unit 42 are connected;

[0075] The automatic blocking unit 41 automatically takes blocking measures to close the attacked port and cut off the connection with the attack source;

[0076] The attack tracing unit 42 is used to trace the attack behavior and find the source and path of the attack.

[0077] In this embodiment, when the automatic blocking unit 41 detects an intrusion, it automatically takes blocking measures, such as closing the attacked port and severing the connection to the attack source, to prevent the attack from spreading further. The attack tracing unit 42 traces the attack to its source and path. By analyzing network traffic and log information, it can determine the attacker's IP address, the attack tools used, and other information, providing a basis for subsequent security measures.

[0078] Furthermore, the interactive warning module 5 includes a real-time warning unit 51 and a human-computer interaction unit 52;

[0079] The real-time warning unit 51 is used to issue a warning message to notify relevant security management personnel when an intrusion behavior is detected;

[0080] The human-computer interaction unit 52 is used to view real-time detection results and warning information through an interactive interface, and to configure and manage the detection system.

[0081] In this embodiment, once the real-time warning unit 51 detects an intrusion, it immediately issues a warning message, notifying relevant security management personnel via SMS, email, system pop-up windows, and other means. The warning information includes detailed information such as the type of attack, time of occurrence, and affected devices. The human-computer interaction unit 52 provides a human-computer interface through which security management personnel can view real-time detection results and warning information, configure and manage the detection system, and interact with the system, such as manually intervening in response measures.

[0082] Furthermore, the data marking backup module 6 includes a data marking unit 61 and a data backup unit 62;

[0083] The data labeling unit 61 is used to label the detected intrusion data and normal data, and provide labeled data for subsequent model training and analysis.

[0084] The data backup unit 62 is used to regularly back up the collected network data, processed feature data, detection results, etc. to prevent data loss.

[0085] In this embodiment, the data labeling unit 61 labels detected intrusion data and normal data, providing labeled data for subsequent model training and analysis. Labeling information includes attack type and severity, helping to improve the model's recognition accuracy. The data backup unit 62 regularly backs up collected network data, processed feature data, and detection results to prevent data loss. This backup data can be used for subsequent auditing, analysis, and model retraining.

[0086] See also Figure 8 In a second aspect, a network intrusion detection method based on deep learning is used in the network intrusion detection system based on deep learning according to the first aspect, comprising the following steps:

[0087] S1 collects network traffic data and device log information through the network traffic collection unit 11 and the log data collection unit 12;

[0088] Specifically, the network traffic collection unit 11 acquires network data through network interface cards or switch port mirroring, providing raw material for subsequent analysis. The log data collection unit 12 is responsible for collecting log information from network devices (such as routers, firewalls, etc.) and servers. These logs record the operating status of the devices, user login information, operation records, etc., which help to detect abnormal behavior and potential signs of attacks.

[0089] S2 sequentially passes through the data cleaning unit, data normalization unit and feature extraction unit 23 to clean, normalize and extract features from the collected data to obtain data suitable for deep learning model processing;

[0090] Specifically, the de-duplication unit 21 removes duplicate, erroneous, and invalid data, and the normalization unit 22 normalizes data from different sources and formats to uniformly measure and scale the data. Normalization formulas include linear normalization and Z-score normalization.

[0091] Linear normalization formula: X_norm = (X-X_min) / (X_max-X_min)

[0092] Z-score normalization formula: Z = (X-μ) / σ

[0093] Where X is the original data, X_norm is the normalized data, X_min and X_max are the minimum and maximum values ​​of the data respectively, μ is the mean of the data, and σ is the standard deviation of the data.

[0094] The feature extraction unit 23 extracts valuable features from the cleaned and normalized data.

[0095] S3 uses the deep learning model training unit 31 to train the processed data to obtain an intrusion detection model; then the real-time network data is input into the model through the real-time detection unit 32 for detection to determine whether there is intrusion behavior;

[0096] Specifically, the deep learning model training unit 31 trains the processed data using a deep learning algorithm (such as CNN, RNN, support vector machine (SVM), etc.) to obtain an intrusion detection model. The training process may involve optimization algorithms such as backpropagation and gradient descent. The real-time detection unit 32 uses the trained deep learning model to detect real-time network data and determine whether intrusion behavior exists.

[0097] If S4 detects an intrusion, the automatic blocking unit 41 will immediately take blocking measures, while the attack tracing unit 42 will trace the attack;

[0098] Specifically, when the automatic blocking unit 41 detects an intrusion, it automatically takes blocking measures, such as closing the attacked port and severing the connection to the attack source, to prevent the attack from spreading further. The attack tracing unit 42 traces the attack to its source and path. By analyzing network traffic and log information, it can determine the attacker's IP address, the attack tools used, and other information, providing a basis for subsequent security prevention.

[0099] S5 Real-time warning unit 51 sends warning information to notify the security management personnel, who can interact with the system through the human-computer interaction unit 52 to manage and intervene in the detection system;

[0100] Specifically, once the real-time warning unit 51 detects an intrusion, it immediately issues a warning message, notifying relevant security management personnel via SMS, email, system pop-up windows, and other means. The warning information includes detailed information such as the type of attack, time of occurrence, and affected devices. The human-computer interaction unit 52 provides a human-computer interface through which security management personnel can view real-time detection results and warning information, configure and manage the detection system, and interact with the system, such as manually intervening in response measures.

[0101] S6 The data marking unit 61 marks the detected data, and the data backup unit 62 regularly backs up the relevant data to provide support for subsequent analysis and model training.

[0102] Specifically, the data labeling unit 61 labels detected intrusion data and normal data, providing labeled data for subsequent model training and analysis. Labeling information includes attack type and severity, helping to improve the model's recognition accuracy. The data backup unit 62 regularly backs up collected network data, processed feature data, and detection results to prevent data loss. This backup data can be used for subsequent auditing, analysis, and model retraining.

[0103] Beneficial effects:

[0104] 1. Through deep learning technology, rapid and accurate detection of network attacks can be achieved, improving the efficiency of network security protection.

[0105] 2. Automatically learn and adapt to new attack patterns to improve the system's adaptability and robustness.

[0106] 3. Integrate multiple functional modules to form a complete security protection chain from data collection to response and disposal.

[0107] 4. Provide a friendly user interface and interactive method to reduce the threshold and complexity of network security management.

[0108] 5. Integrating technologies such as multimodal feature detection, incremental learning mechanism, explainability enhancement and resource optimization design can effectively improve detection accuracy, reduce false alarm rate, support online learning capabilities for zero-day attacks, and effectively deal with new threats such as APT attacks and encrypted channel penetration.

[0109] The above disclosure is only a preferred embodiment of a network intrusion detection method and system based on deep learning of the present invention. Of course, this cannot be used to limit the scope of rights of the present invention. Ordinary technicians in this field can understand that all or part of the processes of the above embodiments and equivalent changes made in accordance with the claims of the present invention are still within the scope of the invention.

Claims

1. A network intrusion detection system based on deep learning, characterized in that: It includes a data acquisition module, a data processing module, an intrusion detection module, a response and disposal module, an interactive warning module and a data mark backup module, wherein the data acquisition module, the data processing module, the intrusion detection module, the response and disposal module, the interactive warning module and the data mark backup module are connected in sequence; The data acquisition module is used to collect traffic data and log information of each node in the network in real time; The data processing module cleans, normalizes, and extracts features from the collected traffic data and log information to obtain data suitable for deep learning model processing; The intrusion detection module uses an intrusion detection model to detect real-time network data and determine whether there is intrusion behavior; The response and disposal module automatically takes blocking measures when an intrusion is detected to prevent the attack from spreading, and traces the attack to find the source and path of the attack; The interactive warning module immediately issues warning information to notify security management personnel when an intrusion is detected, and displays the detection results and warning information in real time to configure and manage the detection system; The data tagging backup module is used to tag detected intrusion data and normal data, provide labeled data for subsequent model training and analysis, and regularly back up collected network data, processed feature data, and detection results.

2. The network intrusion detection system based on deep learning according to claim 1, characterized in that The data acquisition module includes a network flow acquisition unit, a log data acquisition unit and a communication unit, wherein the network flow acquisition unit and the log data acquisition unit are respectively connected to the communication unit; The network traffic collection unit obtains network data through a network interface card or switch port mirroring or the like; The log data collection unit is responsible for collecting log information of network devices and servers; The communication unit is used to send the network data and log summary to the data processing module.

3. The network intrusion detection system based on deep learning according to claim 1, characterized in that The data processing module includes a de-redundancy unit, a normalization processing unit and a feature extraction unit, wherein the de-redundancy unit and the normalization processing unit are respectively connected to the feature extraction unit; The de-duplication unit removes duplicate, erroneous and invalid data from the original data; The normalization processing unit is used to normalize data from different sources and in different formats; The feature extraction unit is used to extract valuable features from the cleaned and normalized data.

4. The network intrusion detection system based on deep learning according to claim 1, characterized in that The intrusion detection module includes a deep learning model training unit and a real-time detection unit, and the deep learning model training unit and the real-time detection unit are connected; The deep learning model training unit trains the processed data using a deep learning algorithm to obtain a monitoring model; The real-time detection unit uses a trained deep learning model to detect real-time network data.

5. The network intrusion detection system based on deep learning according to claim 1, characterized in that: The response and handling module includes an automatic blocking unit and an attack tracing unit, and the automatic blocking unit and the attack tracing unit are connected; The automatic blocking unit automatically takes blocking measures to close the attacked port and cut off the connection with the attack source; The attack tracing unit is used to trace the attack behavior and find the source and path of the attack.

6. The network intrusion detection system based on deep learning according to claim 1, characterized in that: The interactive warning module includes a real-time warning unit and a human-computer interaction unit; The real-time warning unit is used to issue warning information to notify relevant security management personnel when an intrusion behavior is detected; The human-computer interaction unit checks the real-time detection results and warning information through the interactive interface and configures and manages the detection system.

7. A network intrusion detection method based on deep learning, used in the network intrusion detection system based on deep learning according to any one of claims 1 to 6, characterized in that: The following steps are included Collect network traffic data and device log information through the network traffic collection unit and the log data collection unit; The collected data is cleaned, normalized, and feature extracted by the data cleaning unit, data normalization unit, and feature extraction unit in sequence to obtain data suitable for deep learning model processing; The processed data is trained using a deep learning model training unit to obtain an intrusion detection model. The real-time network data is then input into the model through a real-time detection unit for detection to determine whether there is intrusion behavior. If an intrusion is detected, the automatic blocking unit will immediately take blocking measures, while the attack tracing unit will trace the source of the attack; The real-time warning unit sends warning information to notify the security management personnel, who can interact with the system through the human-computer interaction unit to manage and intervene in the detection system; The data labeling unit labels the detected data, and the data backup unit regularly backs up relevant data to provide support for subsequent analysis and model training.

Images