Network intrusion detection method, system and device based on variational auto-encoder and multi-segment reputation evaluation, and storage medium

Abstract

The invention relates to the technical field of network security, in particular to a network intrusion detection method, system and device based on a variational auto-encoder and multi-segment reputation evaluation and a storage medium. The method comprises the following steps: acquiring network flow data and extracting multi-dimensional features, and performing unsupervised learning by using a variational auto-encoder to calculate a reconstruction error; setting a dynamic threshold value based on a sliding window to carry out anomaly detection, carrying out statistics on anomaly, risk and robot category samples, and converting the anomaly, risk and robot category samples into confidence scores; constructing a four-segment reputation mapping function to calculate an abnormal score, a normal score, a risk score and a robot score; and performing two-stage judgment according to a scoring result, outputting a behavior label, triggering a corresponding security policy, and executing the security policy through a network access control interface. The technical problems that fixed threshold judgment of a traditional intrusion detection system is prone to false alarm, a historical risk accumulation mechanism is lacked, and detection and protection are disjointed are solved, and dynamic self-adaptive anomaly detection, continuous and smooth reputation evaluation and automatic safety response closed loop are achieved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network intrusion detection method, system and device based on variational autoencoder and multi-section reputation evaluation, and a storage medium. BACKGROUND

[0002] With the rapid development of cloud computing, Internet of Things and big data technology, network security threats are becoming more complex, concealed and intelligent. Traditional intrusion detection systems based on signature matching and fixed rules still have certain effects in dealing with known attacks, but their detection capabilities are obviously insufficient in the face of zero-day attacks, advanced persistent threats (APTs) and variant attacks. These traditional methods rely on a pre-defined attack feature library and cannot effectively identify unknown attack patterns, and the update lag results in limited detection coverage.

[0003] In recent years, deep learning technology has been widely applied in network anomaly detection, and variational autoencoder (VAE) as a generative model can learn the latent distribution features of normal network traffic in an unsupervised environment. Through the calculation of reconstruction error, VAE can effectively identify abnormal behavior deviating from the normal pattern. However, existing VAE-based intrusion detection schemes generally have the following shortcomings: most schemes only focus on the reconstruction judgment of a single sample, lacking tracking and evaluation of the long-term behavior trend of the detected object; fixed threshold is used for anomaly judgment, which is easy to produce false alarms or omissions when the network environment changes; the detection results are disconnected with the subsequent security policy execution, and cannot form an automated protection closed loop.

[0004] In the current technology development, some research attempts to introduce dynamic threshold or confidence evaluation mechanism, but these schemes still face challenges in practical application. On the one hand, the dynamic threshold adjustment strategy is often too simple and difficult to adapt to complex and variable network environments; on the other hand, there is a lack of effective historical reputation management mechanism, which cannot accumulate risk assessment for repeatedly abnormal detected objects. In addition, existing systems can only provide alarm information after detecting anomalies, and manual intervention is needed to take corresponding protective measures, which has a long response time and is prone to operational errors. SUMMARY

[0005] In view of the problems existing in the prior art, the present application is proposed.

[0006] Therefore, the main technical problems solved by this invention are as follows: This invention aims to solve three core problems existing in network intrusion detection technology: First, the lack of historical risk accumulation and dynamic adjustment mechanism makes it impossible to adaptively adjust the detection sensitivity according to the long-term behavior pattern of the detected object; Second, fixed thresholds or single mapping functions lack smoothness and are prone to detection jitter and false alarms in critical areas; Third, detection and security policy execution are disconnected, making it impossible to achieve an automated closed-loop response from discovery to handling.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0008] In a first aspect, embodiments of the present invention provide a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment, which includes: acquiring network traffic data and extracting protocol features, statistical features and temporal features to form a standardized feature vector; encoding the standardized feature vector through a variational autoencoder to obtain potential distribution parameters; and reconstructing the original input through decoding and calculating the reconstruction error.

[0009] Based on the reconstruction error distribution within the sliding window, a dynamic threshold is set, and the reconstruction error is compared with the dynamic threshold to perform anomaly detection, thereby obtaining the detection accuracy index. The sample counts of anomaly category, risk category, and robot category are counted, and a risk amplification coefficient is introduced to adjust the anomaly weight. The count values ​​are then converted into confidence scores through nonlinear mapping.

[0010] Based on the confidence scores, a four-segment reputation mapping function is constructed to calculate the anomaly score, normal score, risk score, and robot score, respectively.

[0011] The primary reputation status is determined based on the comparison results of the four scores. A two-stage judgment is performed in combination with the confidence threshold to output a behavior label. Based on the behavior label and the reputation score, the corresponding security policy is triggered, and a security control command is issued through the network access control interface.

[0012] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the step of setting a dynamic threshold based on the reconstruction error distribution within a sliding window includes: maintaining a sliding window containing a preset number of recent samples; calculating a preset quantile of the reconstruction error value within the sliding window as the current dynamic threshold; and correcting the dynamic threshold according to historical reputation values, reducing the threshold to improve detection sensitivity when the historical reputation value is low.

[0013] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the four-segment reputation mapping function includes: anomaly score in the form of a logistic function, which rises rapidly when the confidence level is below the anomaly threshold; normal score in the form of a reverse logistic function, which outputs stably when the confidence level is above the normal threshold; risk score in the form of a Gaussian function, which reaches its peak at the midpoint between the anomaly threshold and the normal threshold; and robot score based on robot confidence level using an independent logistic function mapping.

[0014] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the two-stage determination output behavior label includes: when the overall confidence level is not higher than the abnormal threshold, determining whether the robot confidence level exceeds a preset value; if it exceeds, it is marked as an abnormal category; otherwise, it is marked as a robot category; when the overall confidence level is not lower than the normal threshold, it is marked as a normal category; when the overall confidence level is between the abnormal threshold and the normal threshold, it is marked as a risk category.

[0015] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the behavior tags and reputation scores trigger corresponding security policies including setting different levels of security measures according to the reputation score range; for abnormal categories and robot categories, triggering isolation and blocking or rate limiting measures; for risk categories, triggering observation and monitoring measures; and for normal categories, implementing a normal access policy.

[0016] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the method further includes: maintaining a historical reputation file for each monitored object and recording the reputation values ​​of the most recent N detections; weighting and accumulating the detection results using a time window method to calculate the historical reputation value; and dynamically updating the historical reputation value based on the number of abnormal alarms, the number of missed alarms, and the number of normal passes.

[0017] As a preferred embodiment of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described in this invention, the method further includes: monitoring the execution status of security control commands and obtaining execution feedback results; retrying or initiating a downgraded security scheme when the command execution fails; and feeding the execution results back to the reputation assessment stage to update the historical files of the corresponding monitored objects.

[0018] Secondly, embodiments of the present invention provide a network intrusion detection system based on variational autoencoder and multi-segment reputation assessment, comprising,

[0019] The acquisition module acquires network traffic data and extracts protocol features, statistical features, and temporal features to form a standardized feature vector. The standardized feature vector is encoded by a variational autoencoder to obtain the latent distribution parameters. The original input is then reconstructed by decoding, and the reconstruction error is calculated.

[0020] The threshold comparison module sets a dynamic threshold based on the reconstruction error distribution within a sliding window, compares the reconstruction error with the dynamic threshold to perform anomaly detection, obtains the detection accuracy index, counts the sample counts of anomaly category, risk category, and robot category, introduces a risk amplification coefficient to adjust the anomaly weight, and converts the count value into a confidence score through nonlinear mapping.

[0021] The calculation module constructs a four-segment reputation mapping function based on the confidence score to calculate the anomaly score, normal score, risk score, and robot score respectively.

[0022] The results output module determines the main reputation status based on the comparison results of the four scores, performs a two-stage judgment based on the confidence threshold, outputs a behavior label, triggers the corresponding security policy based on the behavior label and reputation score, and issues security control instructions through the network access control interface.

[0023] Thirdly, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, they implement the steps of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in the first aspect of the present invention.

[0024] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, they implement the steps of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in the first aspect of the present invention.

[0025] The beneficial effects of this invention are as follows: Through variational autoencoder feature learning and dynamic threshold setting in the first few steps, this invention achieves unsupervised detection capabilities for unknown attack patterns, overcoming the limitation of traditional signature matching methods that rely on known threats. The construction of a four-segment reputation mapping function in the middle step transforms discrete detection results into continuous and smooth risk scores, solving the jitter problem of fixed threshold judgment in the critical region and improving the system's tolerance to edge anomalies. The automated policy execution and feedback mechanism in the final step achieves a closed-loop response throughout the entire process from threat discovery to security handling, eliminating the problem of detection and protection being disconnected in traditional systems. Overall, this scheme maintains high detection accuracy while significantly reducing the false alarm rate and enhances the ability to identify persistent attacks through a historical reputation accumulation mechanism. Attached Figure Description

[0026] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0027] Figure 1 The flowchart shows a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment.

[0028] Figure 2 A computer device diagram for a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment;

[0029] Figure 3 This is another flowchart of a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment. Detailed Implementation

[0030] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0031] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0032] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0033] Example 1

[0034] Reference Figure 1 - Figure 2 This is the first embodiment of the present invention, which provides a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment, including:

[0035] S100: Acquire network traffic data and extract protocol features, statistical features and temporal features to form a standardized feature vector. Encode the standardized feature vector through a variational autoencoder to obtain the latent distribution parameters, and reconstruct the original input by decoding to calculate the reconstruction error.

[0036] S200: Based on the reconstruction error distribution within the sliding window, a dynamic threshold is set, and the reconstruction error is compared with the dynamic threshold to perform anomaly detection, thereby obtaining the detection accuracy index. The sample counts of anomaly category, risk category, and robot category are counted, a risk amplification coefficient is introduced to adjust the anomaly weight, and the count value is converted into a confidence score through nonlinear mapping.

[0037] S300: Construct a four-segment reputation mapping function based on confidence scores to calculate the anomaly score, normal score, risk score, and robot score respectively;

[0038] S400: Determines the primary reputation status based on the comparison results of four scores, performs a two-stage judgment based on the confidence threshold, outputs a behavior label, triggers the corresponding security policy based on the behavior label and reputation score, and issues security control instructions through the network access control interface.

[0039] It should be noted that network intrusion detection technology faces multiple challenges in complex network environments. Traditional detection methods rely on fixed thresholds, which can easily lead to a large number of false positives or false negatives when network traffic baselines shift. Furthermore, they lack mechanisms to track long-term behavioral patterns of the detected targets, making it difficult to effectively identify persistent low-intensity attacks or repeated probing behaviors. In addition, detection results are disconnected from security policy implementation, requiring manual intervention to take protective measures, resulting in delayed responses and a high risk of operational errors.

[0040] Therefore, to address the aforementioned issues of insufficient detection sensitivity, lack of cumulative evaluation of historical behavior, and inadequate automated response capabilities, this paper constructs an unsupervised anomaly detection model based on a variational autoencoder through steps S100-S400. This model enables automatic learning and anomaly identification of high-dimensional network traffic characteristics. A dynamic threshold adjustment mechanism and a multi-dimensional reputation evaluation system are established to transform single detection results into continuously adjustable reputation scores, enabling quantitative management of the long-term risk status of detected targets. A four-segment smooth mapping function and an automated policy execution mechanism are designed to form a complete closed loop from anomaly detection to security handling, significantly improving the system's adaptive detection capability and overall protection effectiveness against complex network threats.

[0041] Example 2

[0042] Reference Figure 2 - Figure 3 This is the second embodiment of the present invention.

[0043] In this embodiment, step S100 involves acquiring network traffic data and extracting protocol features, statistical features, and time-series features to form a standardized feature vector, including the following steps A1-A2:

[0044] A1: Obtain network traffic data and extract protocol features, statistical features, and time-series features to form a standardized feature vector.

[0045] Specifically, protocol layer features (such as IP address, port number, TCP flags, etc.), statistical features (such as packet length, traffic rate, connection duration, etc.), and time-series features (such as traffic bursts, time intervals between adjacent sessions, etc.) are extracted from each traffic record to form a preliminary feature vector. Subsequently, different types of features are uniformly quantized and encoded: continuous numerical features are normalized to a reasonable range (e.g., [0,1]) using Min-Max normalization or Z-score standardization; categorical discrete features (e.g., protocol type, service, flags, etc.) are encoded using one-hot encoding or trained into learnable embedding vectors, converting them into sparse binary vectors or dense vector representations. All processed sub-features are then concatenated into a standardized feature vector of uniform length. Through this process, numerical, categorical, and time-series related features are integrated into the same vector space, preparing the input for the VAE model. This preprocessing and encoding strategy ensures the fusion and comparability of high-dimensional heterogeneous features: all features are converted into numerical form and normalized to similar magnitudes, which avoids model bias caused by inconsistent dimensions on the one hand, and preserves the discrete information of categorical features and the behavioral patterns of temporal features on the other hand, enabling the model to capture both the static attributes and dynamic changes of traffic.

[0046] A2: The latent distribution parameters are obtained by encoding the standardized feature vector through a variational autoencoder, and the original input is reconstructed by decoding to calculate the reconstruction error.

[0047] Specifically, following this is the VAE feature extraction unit, represented by a large box in the architecture, which includes an encoder and a decoder. The standardized feature vectors are input into the variational autoencoder model to learn normal traffic patterns and identify anomalies. Regarding the VAE network structure, this invention uses a convolutional neural network (CNN) architecture to construct the encoder and decoder, improving the efficiency of modeling high-dimensional sparse inputs. Specifically, the VAE encoder includes multiple layers of convolutional and fully connected networks: for example, in one embodiment, the encoder stacks three one-dimensional convolutional layers sequentially to progressively abstract and extract the input feature vector (considered as a one-dimensional "signal" of length N or a 1×N matrix). The first convolutional layer uses a kernel size of 5 and a stride of 2, setting 16 convolutional filters (16 output channels) to downsample the input and perform preliminary feature extraction; ReLU activation is used to introduce nonlinearity. The second convolutional layer uses a kernel size of 3 and a stride of 2, with 32 output channels, to further extract local patterns and continue downsampling; ReLU activation is also used. The third convolutional layer uses a kernel size of 3, a stride of 1, and 64 output channels. By maintaining a stride of 1, it increases the number of feature channels without changing the length, thus enriching the feature representation. After the above convolutional layers, a feature map of approximately 64×(N / 4) is obtained (assuming the total stride of the three convolutional downsampling layers is about 4 times). This is flattened into a one-dimensional vector, and then mapped onto the parameters of the VAE latent space through one or more fully connected layers. The encoder finally outputs the parameters of the latent distribution (mean vector μ and variance / log-variance vector σ), representing the probability distribution of the input data in the latent space. Subsequently, a reparameterization technique is used to sample the latent vector z (e.g., z = +σ⊙∈, where ∈ is standard normal noise) from this distribution.

[0048] In VAE, the encoder q is used. φ (z|x) maps the input sample x to a random variable z in the latent space. The encoder outputs the parameters of a distribution, typically assuming the latent variable follows a Gaussian distribution. Specifically, The mean and variance of the distribution. In practice, reparameterization techniques are often used to sample z from this distribution to ensure that the model can be trained end-to-end.

[0049] Subsequently, decoder p θ (x|z) Generate reconstructed samples based on the latent variable z. It is generally assumed that the reconstructed output also follows some parameterized distribution. For example, for real-valued data, it can be assumed that the decoder output has a Gaussian distribution mean, and thus:

[0050]

[0051] Here, θ represents the model parameters of the decoder. By inputting the latent vector z, the decoder attempts to reconstruct an image that is similar to the original input x in all dimensions. The training objective of VAE is to maximize the Evidence Lower Bound (ELBO) of the observed data. For a single sample x, the ELBO is defined as:

[0052]

[0053] The first term is the expected value of the reconstructed log-likelihood, measuring the decoder's ability to reconstruct the original sample given the latent variables; the second term is the Kullback-Leibler divergence, measuring the posterior distribution q generated by the encoder. φ The difference between (z|x) and the prior distribution p(z). Typically, the prior p(z) follows a standard normal distribution. By maximizing ELBO, VAE simultaneously minimizes reconstruction error and makes the latent representation approximate the prior distribution, thereby learning the underlying generation mechanism of the data. During the training phase, φ and θ are iteratively updated on a large number of historical samples (mainly normal behavior data), enabling the model to accurately reconstruct data with normal patterns.

[0054] The decoder structure of VAE is roughly symmetrical to the encoder. The decoder first maps the sampled latent vector z to the initial shape of the convolutional feature map through a fully connected layer, for example, mapping z back to a hidden representation of 64×(N / 4) dimensions. Then, through multiple transposed convolutional layers (deconvolution), the hidden representation is gradually reconstructed into an output vector of the same dimension as the original input. In this corresponding embodiment, three transposed convolutional layers symmetrical to the encoder can be used: the first layer uses a kernel size of 3 and a stride of 1, reducing the number of channels from 64 to 32 (ReLU activation); the second layer uses a kernel size of 3 and a stride of 2, increasing the length by 2 times and reducing the number of channels from 32 to 16 (ReLU); the third layer uses a kernel size of 5 and a stride of 2, increasing the feature length back to N and reducing the number of channels to 1, reconstructing the feature vector of the original dimension. The final layer output of the decoder in this invention employs an activation function corresponding to the input preprocessing: for numerical features normalized by Min-Max, the Sigmoid activation function can be used to limit the output to the [0,1] interval; for discrete features encoded by one-hot encoding, a real-valued vector of the same dimension can be output (approximating discrete values ​​using Sigmoid), or softmax classification can be applied to these dimensions in the implementation to reconstruct discrete categories. In this way, the decoded output maintains a semantic correspondence with the original input. Through the above convolutional encoder-decoder structure design, the model utilizes the local connectivity and parameter sharing characteristics of convolutional kernels to capture local correlations between features in the high-dimensional feature space (e.g., certain protocol and port combinations, time-related burst patterns, etc.), while significantly reducing the number of parameters compared to a purely fully connected structure, alleviating the sparsity problem of high-dimensional inputs and improving training efficiency. Furthermore, the hierarchical features extracted by convolution help the model learn multi-scale patterns in traffic data, exhibiting stronger expressive power for potential temporal patterns and local correlation patterns in network data.

[0055] In this embodiment, step S200 sets a dynamic threshold based on the reconstruction error distribution within the sliding window, and compares the reconstruction error with the dynamic threshold for anomaly detection, including the following steps B1-B3:

[0056] B1: Maintain a sliding window containing the most recent preset number of samples;

[0057] For model training, this invention employs an unsupervised approach to train the VAE. First, the VAE is trained offline using a historical traffic dataset containing only normal behavior (or unsupervised training is performed using the normal portion of a labeled dataset), minimizing the loss function comprised of reconstruction error and a regularization term. The VAE's loss function consists of two parts: reconstruction error, which measures the difference between the decoder output and the original input (e.g., using mean squared error (MSE) for continuous features, or cross-entropy for discrete feature reconstruction); and KL divergence, which measures the difference between the latent distribution of the encoder output and the prior distribution (usually a standard normal distribution). The two are weighted and summed to form the total loss: L = L recon +λ·D KL

[0058] Here, λ is a weighting coefficient used to balance reconstruction accuracy and latent space regularization. When λ is small, the model focuses more on reconstructing the input data, which may improve reconstruction accuracy but the latent space may be disordered. When λ is large, the model emphasizes the regularity of the latent distribution, which is beneficial for generation and generalization, but excessive λ will sacrifice reconstruction ability. To balance detection accuracy and generalization ability to anomaly patterns, this invention does not use a fixed value of λ, but dynamically adjusts this hyperparameter according to the actual detection effect. Specifically, the following strategy can be adopted: During the model training and tuning phase, a small portion of labeled validation data (containing normal and attack samples) is introduced to evaluate the model's anomaly detection performance (such as F1 score). The optimal value of λ is found by using a grid search hyperparameter search method, with the detection F1 score or accuracy on the validation set as the target. This ensures that the selected λ weight maximizes the model's sensitivity to anomalies while maintaining good reconstruction ability, reducing missed detections. When the model is found to be overly conservative (high false negatives, lower F1 score), the regularization λ is gradually increased to improve the model's ability to distinguish abnormal patterns. Conversely, if there are too many false positives, λ is appropriately decreased to make the model more rigorously reconstruct the input. Through the above dynamic adjustment strategy, the VAE model is kept at a relatively optimal operating point. This invention preferably achieves sensitive anomaly detection through the above dynamic λ strategy and threshold adjustment without significantly modifying the unsupervised training objective of the VAE, thereby maintaining the stability of the model.

[0059] B2: Calculate the preset quantile of the reconstruction error value within the sliding window as the current dynamic threshold;

[0060] Specifically, the reconstruction results output from the VAE unit and the input features are simultaneously sent to the anomaly detection and reputation value calculation unit. Regarding anomaly detection, once the VAE model training converges, it enters the online detection phase. For each newly entered traffic feature vector, the system calculates its reconstruction error E using the trained VAE model. The reconstruction error reflects the degree of deviation of the sample from the normal pattern learned by the model: the larger the error, the more difficult it is to reconstruct the sample using the normal pattern, and the more likely it is to be an anomaly. To determine whether to consider a sample as an anomaly, this invention uses a dynamic threshold setting unit instead of a fixed threshold. That is, instead of comparing E with a fixed constant threshold, the threshold τ is adaptively adjusted based on recent data. Initially, an initial threshold τ0 can be set based on the reconstruction error distribution of the offline training data, for example, taking the 95th percentile of the reconstruction error distribution of the normal training set as τ0 (meaning that approximately 5% of the tail samples in the training data may be judged as anomalies). During online detection, the dynamic threshold setting unit maintains a sliding window (the window size is the most recent 1000 input samples, which can be adjusted according to actual traffic conditions), continuously collects the reconstruction error values ​​of these samples, and calculates a new threshold τ based on the error distribution within the sliding window. Preferably, the p = 0.95 quantile of the reconstruction error values ​​within the window can be taken as the current threshold τ, ensuring that approximately 5% of the samples are currently judged as anomalous. Simultaneously, the sliding window allows the threshold to be updated over time, gradually reflecting changes in the traffic baseline. If the network environment changes (e.g., overall traffic decreases at night, and the reconstruction error of normal traffic may increase), the threshold will be gradually increased to avoid false alarms; conversely, when a new attack occurs causing the overall error level to rise, the threshold will be dynamically adjusted upwards or downwards to maintain appropriate detection sensitivity. Subsequently, it uses a small number of labeled samples or an adaptive validation set retained in the system to evaluate the accuracy of the current classification results, obtaining the predicted probability index for the current detection. This accuracy is not only an important reference for measuring the current performance of the model but also serves as a core input for subsequent reputation evaluation.

[0061] After model training is complete, VAE is applied to the newly collected N test samples x during the inference phase. (i) i=1 N Anomalies are identified by reconstructing error or reconstructing probability. Specifically, for each test sample x... (i) First, the corresponding latent vector z is obtained through the encoder. (i) ~qφ(z∣∣x (i) Then the decoder generates the reconstructed data. Next, the reconstruction error of the sample is calculated; for example, mean squared error can be used as a metric.

[0062]

[0063] Or equivalently calculate the reconstruction probability (i.e., x). (i)Log-likelihood logp under the model generation distribution θ (x (i) ∣∣z (i) For normal samples, VAEs can usually reconstruct them accurately because they have learned their patterns, resulting in smaller reconstruction errors; however, for abnormal samples, the reconstruction errors tend to increase significantly because they deviate greatly from the training patterns.

[0064] B3: Adjust the dynamic threshold based on historical reputation values. When the historical reputation value is low, lower the threshold to improve detection sensitivity.

[0065] In the process of dynamically adjusting the threshold, a balance needs to be struck between sensitivity and stability. This invention balances these two aspects through multiple means: Firstly, the choice of sliding window length ensures that the threshold is not overly sensitive to short-term fluctuations (a larger window enhances stability, while a smaller window increases sensitivity). The window size can be adjusted as needed, or an exponentially weighted moving average method can be used to update the threshold, thereby smoothing out drastic short-term changes. Secondly, a historical reputation value P is introduced. m The threshold is adjusted. When the system detects multiple consecutive suspicious events, the reputation value P... m If the threshold τ gradually decreases, it indicates that the current environment may be facing a persistent threat. In this case, the system can proactively reduce the threshold τ by an appropriate amount to improve detection sensitivity and promptly capture potential subsequent attacks. Similarly, if no anomaly is detected for a long time (P... m If the threshold approaches 1), then the threshold can be appropriately increased to reduce false alarms caused by occasional fluctuations. Since P... m It is a reputation score accumulated based on detection results over a period of time, which includes the system's "degree of trust" in its recent security status. Therefore, it utilizes P m Adjusting the threshold enables an adaptive feedback mechanism: the system becomes more vigilant when reputation decreases (threshold tightens), and relaxes its vigilance when reputation increases (threshold widens), thus dynamically maintaining sensitive and stable detection performance. The specific adjustment logic can be linear or non-linear: let τ new =τ base ×f(P m ), where f(P) m f(P) is a monotonically increasing function (if the reputation decreases, then f(P) is a monotonically increasing function). m (decrease); f(P) m ) can take αP m (when P) m After normalization in the range of 0 to 1, the threshold is made to vary with P. m The threshold decreases linearly, with α acting as an adjustment coefficient to control the magnitude of the decrease, typically set to 0.8. To avoid excessive fluctuations in the threshold, f(P) can be limited. m Within a certain range (e.g., not less than 0.8), ensure that the threshold variation has an upper limit.

[0066] When calculating historical reputation scores, the first focus is on the number of violations committed by the entity. Each violation directly impacts reputation, and its severity determines its contribution to the final reputation score. Therefore, in N test samples, the frequency of occurrence of anomaly and bot categories is counted separately. The risk category represents intermediate behavior between normal and clearly abnormal, potentially manifesting as frequent but not high-risk access patterns, suspicious request characteristics, or mildly abnormal traffic. This type of behavior has the potential to escalate into a high-risk attack. Anomaly categories refer to several predefined high-risk attack types, such as SQL injection, cross-site scripting (XSS), and denial-of-service (DoS) attacks. The bot category specifically refers to abnormal interactive behaviors performed through automated programs or malicious scripts, such as malicious web crawlers, brute-force tools, or distributed attack botnet nodes. These two types of behavior are counted separately because they differ significantly in attack characteristics, harm patterns, and handling strategies: anomaly categories typically exhibit one-time, centralized high-risk destructive characteristics; while bot categories often manifest as high-frequency, long-term, and sustainable automated attacks, accompanied by a degree of concealment and distribution. Separate processing not only facilitates assigning different weights in credit assessments, but also provides targeted decision-making basis for subsequent security protection strategies (such as blocking, rate limiting, CAPTCHA verification, etc.), thereby achieving refined and differentiated risk management.

[0067] Risk sample base count s1:

[0068] Abnormal sample base count s0:

[0069] Bot sample count s2:

[0070] Next, to emphasize the impact of risk labels on the overall anomaly assessment, an amplification factor I is introduced. r ≥1, the sensitivity of the threshold is adjusted by increasing the weight of risky samples in the anomaly count. Specifically, the adjusted anomaly count s0 is defined as:

[0071]

[0072] in This represents the floor function. The above calculation is equivalent to multiplying the number of risk samples s1 by the coefficient I. r After rounding, the result is added to the number of outlier samples s′0. If I r If the value is greater than 1, then each risk sample increases proportionally by an amount equivalent to I. r The impact of individual outlier samples is considered, thereby improving the sensitivity of the overall outlier score in subsequent calculations. When I r When = 1, s0 = s0 + s′1, meaning that risk samples are equivalently included in the outlier count.

[0073] With the adjusted outlier count s0 and robot count s′2, they are mapped to continuous confidence scores over the interval [0,1], denoted as P and P2, to characterize the overall normality. The mapping uses the formula for the chord length of a quarter-circle arc with radius N:

[0074]

[0075] Through the above nonlinear transformation, when there are no anomalies (s0 = 0), we obtain P = 1, representing a confidence level of complete normality; when all samples are anomalies (s0 = N), we have P = 0, representing an extreme anomaly. (Difference function) As s0 increases, the curvature increases, and this mapping penalizes the increase in the number of outlier samples: that is, as the number of outliers s0 increases, P will decrease at an increasingly faster rate, thus sensitively reflecting the occurrence of large-scale anomalies. Similarly, for the robot detection confidence P2, P2 = 1 when there are no robot samples, and P2 approaches 0 when a large number of samples are identified as robots.

[0076] Following the steps described above, the original discrete anomaly count information is transformed into continuous trust metrics P and P2. Next, a four-segment reputation scoring function will be defined based on this, providing smooth scores for different behavioral patterns.

[0077] In this embodiment, step S300, which constructs a four-segment reputation mapping function based on the confidence score, includes the following steps C1-C2:

[0078] C1: The outlier score is expressed as a logistic function and rises rapidly when the confidence level is below the outlier threshold.

[0079] Normal scores are output using the inverse logistic function, and are stably output when the confidence level is higher than the normal threshold.

[0080] The risk score is expressed as a Gaussian function, reaching its peak at the midpoint between the abnormal and normal thresholds; the robot score is based on the robot confidence level and is mapped using an independent logistic function.

[0081] After obtaining the error rate detected, the process proceeds to the dynamic reputation calculation module. First, the historical reputation value P needs to be defined. mThe calculation method of this invention is as follows: The reputation value of multiple detections is accumulated over time to form a historical reputation value, which is used to quantify the long-term reputation value of a user or host. The implementation includes: maintaining a record of the reputation value of each monitored object (such as an IP address or user account) for the most recent N VAE detections, where each record can be marked as normal, abnormal, etc., and assigned different weights; and using a time window or exponential decay method to weighted accumulate these results. A time window can be set (e.g., the most recent 100 accesses). Within the window, each "abnormal alarm" (the model determines it to be abnormal, which can be regarded as a possible intrusion event) reduces the reputation value by a certain amount; each "missed alarm" (it is determined after the fact that an alarm should have been triggered but was not) reduces the reputation value by more; and each "normal pass" slightly increases the reputation value. Using exponential decay, instead of setting a fixed window, the contribution of older events gradually decreases exponentially, achieving a similar effect. In this way, the system maintains a dynamically updated P for each object. m When a host repeatedly experiences anomalies (regardless of whether it exceeds the threshold each time), P m It will gradually decrease; conversely, if behavior remains normal for a long period, P will decrease. m It will decrease towards 1. This historical reputation value is not only used for the aforementioned threshold adjustment, but will also play a role in reputation assessment.

[0082] Next, the dynamic reputation assessment unit will compare the current detection result Q with the historical reputation value P. m This is mapped to a comprehensive user score. First, the predicted probability q of traffic belonging to a certain category needs to be obtained. In this invention, the detection prediction probability index q can be defined based on the reconstruction error relative to a threshold: for example, comparing the current sample reconstruction error E with the current threshold τ, constructing an index q in the range of 0 to 1, where q = 1 indicates that the model judges the sample as completely normal (very confidently believing there is no abnormality), and q = 0 indicates that the model is very certain that the sample is abnormal. A linear definition of q can be used, such as q = max(0,,1-E / τ) truncated in [0,1], meaning that when the error equals the threshold, q = 0 (critically suspicious), when the error is much higher than the threshold, q approaches 0, and when the error is much lower than the threshold, q approaches 1. The larger this q value, the more the detection result tends to be a certain type of traffic, such as normal or abnormal traffic. After obtaining Q and P... m This is then incorporated into the reputation mapping function. This involves a continuously differentiable four-segment reputation mapping function that maps the aforementioned detection metrics and historical reputation values ​​to the final user score R. score The four functions correspond to different users, enabling differentiated processing for different situations.

[0083] In this embodiment, step S400 determines the primary reputation status based on the comparison results of the four scores, and performs a two-stage judgment to output the behavior label in combination with the confidence threshold, including the following steps D1-D2:

[0084] D1: The two-stage judgment output behavior label includes: when the overall confidence level is not higher than the abnormal threshold, it is determined whether the robot confidence level exceeds the preset value. If it exceeds the preset value, it is marked as an abnormal category; otherwise, it is marked as a robot category. When the overall confidence level is not lower than the normal threshold, it is marked as a normal category.

[0085] When the overall confidence level is between the abnormal threshold and the normal threshold, it is marked as a risk category.

[0086] Specifically, user scores and historical reputation values ​​are sent to the policy execution unit located on the far right. This unit automatically triggers corresponding security defense policies based on the historical reputation values ​​and user scores output by the reputation assessment unit, restricting or warning the subsequent behavior of the target host or user. Unlike traditional systems that require manual intervention after viewing alarms, this invention directly maps historical reputation values ​​to security policies, forming a closed loop from detection results to control commands. In designing the policy mapping, this invention does not use a fixed, rigid hierarchical table, but rather provides a dynamic mapping strategy: the system can flexibly map historical reputation values ​​within a certain range to specific measures based on the distribution of historical reputation values ​​during operation and security requirements. Several policy levels can be pre-set from high to low (e.g., "normal access," "observation and monitoring," "rate limiting and flow reduction," "isolation and blocking," etc.), but the reputation thresholds corresponding to each level are not static, but can be adaptively adjusted by the system based on the overall security situation or dynamically configured by the administrator when issuing policies. In principle, the lower the historical reputation value (the higher the risk), the more severe the triggered response measures; the higher the reputation value, the more inclined to grant normal access permissions or not trigger any action. The lower a user's score, the higher the risk of system misjudgment, requiring manual review; the higher a user's score, the more likely the system is to automatically execute policy units.

[0087] To avoid the scoring discontinuity caused by directly using hard thresholds to determine normal / abnormal behavior, four continuous and smooth scoring functions S were designed for different behavioral patterns (abnormal, normal, risky, and robotic). abn (P), S nor (P), S risk (P) and S bot (P2). These functions use the previously calculated confidence level P or P2 as independent variables, generating a rating between 0 and 1 to characterize the significance of the corresponding behavioral pattern. The parameter k>0 controls the steepness of the curve transition, and the risk amplification factor I. r A value ≥1 will affect the range of abnormal and normal scores. The definitions and properties of these four scoring functions are given below.

[0088] 4.1. Abnormal score S abn The scoring function uses an anomaly threshold p. minThe center is sensitive to areas with low confidence (i.e., high anomaly proportion). When the overall confidence P is below the threshold p... min Abnormal scores will rise rapidly and approach 1; conversely, when P is much higher than p... min Constant fractions will decay close to zero. Formally, outlier fractions can be defined as a logistic (S-shaped) function:

[0089]

[0090] P = p min The value of the function is the inflection point. When $P << p min When the value is below the abnormal threshold (indicating a highly abnormal situation), the exponential term exp[k(Pp)] min )]→0, therefore S abn →1, highlighting extreme anomalies; when P >> p min When (far above the threshold, close to the normal range), exp[k(Pp)] min As the term approaches infinity, S abn →0 indicates a very low degree of abnormality.

[0091] 4.2. Normal Score S nor Normal scores take larger values ​​in the high confidence region (close to normal), and are within the normal threshold p. max Rapid changes in the vicinity. Hopefully, its curve shape will correlate with the outlier score at p. min The curves in the vicinity are roughly symmetrical. The normal score is defined as:

[0092]

[0093] P = p max This function also takes the inflection point value. When P exceeds the normal threshold p max (leaning towards normal) The exponent approaches 0, causing S to... nor →1 indicates that everything is perfectly normal; while when P< <p max (Far below the normal threshold, belonging to the abnormal region), S nor It will decay to near 0. By introducing the α coefficient, it can be ensured that S... nor In p max Slope and S abn In p min The slope is matched to achieve symmetry in the curve shape.

[0094] Specific implementation mechanisms may include the following scenarios:

[0095] When an object's historical reputation score falls to the lowest range (e.g., below 20 points, the specific value can be automatically adjusted by the system statistics) and the user's score is higher than H (the minimum tolerance value, which can be set to 0.7), it is determined to pose a significant risk. The system will take the most severe measures, such as immediately blocking the object's network connection or isolating it from the protected network area. Blocking can be done by issuing blocking commands through Network Access Control (NAC) devices or by blocking all traffic from its IP address through firewall policies. Since a low reputation score indicates multiple recent anomalies and a high accumulation of risk, this measure can effectively prevent continuous attacks.

[0096] When a user's historical reputation score is in the lower-middle range (e.g., between 20 and 50 points) and their score is higher than H, the system considers the target significantly suspicious but not to the point of requiring complete blocking. Mitigation measures such as rate limiting and service degradation can be implemented. For example, a bandwidth limiting command can be issued to reduce the target's allowed traffic rate to a certain percentage of normal levels, thereby reducing potential attack risks (e.g., mitigating DDoS attack traffic). Simultaneously, the system can send warning notifications to security personnel or the user to whom the target belongs, indicating that the relevant host may have exhibited abnormal behavior and requires attention. This approach limits potential attacks while providing room for further observation.

[0097] When a user's historical reputation score is in the medium or slightly high range (e.g., 50-80 points) and their score is higher than H, the system considers the user generally normal but with a history of suspicious activity. It only implements enhanced monitoring strategies without directly intervening in the connection. More granular checks can be performed on their traffic (e.g., increasing the sensitivity of IPS detection rules) or their evaluation cycle can be shortened. However, rate limiting and blocking measures are not immediately implemented; the system only maintains a vigilant stance in the background. If the user continues to behave normally under these conditions, their reputation will gradually recover to a high score; however, if anomalies reappear, their reputation will rapidly decline, triggering stricter measures.

[0098] When a user's historical reputation score is in a high range (e.g., above 80 points, even approaching 100 points) and their score is higher than H, the system determines that the user is highly trustworthy and belongs to a normal behavioral entity. Therefore, no restrictions are imposed on them, allowing them to use network resources according to normal policies. Simultaneously, for users who consistently maintain high reputation scores, a "whitelist" treatment could be considered: for example, a minor anomaly occurring in a short period would not immediately trigger severe measures to avoid mistakenly harming normal users. This reward mechanism is already reflected in the saturation range of the reputation mapping function.

[0099] Normal score S nor Normal scores take larger values ​​in the high confidence region (close to normal), and are within the normal threshold p. max Rapid changes in the vicinity. Hopefully, its curve shape will correlate with the outlier score at p. min The curves in the vicinity are roughly symmetrical. The normal score is defined as:

[0100]

[0101] P = p max This function also takes the inflection point value. When P exceeds the normal threshold p max (biased towards normal), exp0-kα(Pp) max The exponent of 1 approaches 0, causing S to... nor →1 indicates that everything is perfectly normal; while when P< <p max (Far below the normal threshold, belonging to the abnormal region), S nor It will decay to near 0. By introducing the α coefficient, it can be ensured that S... nor In p max Slope and S abn In p min The slope is matched to achieve symmetry in the curve shape.

[0102] 4.3. Risk Score S risk Risk scores are used to emphasize intermediate risk situations. When the overall confidence level P is neither particularly low (abnormal) nor particularly high (normal), some risk attention should be given. Hopefully, S... risk (P) reaches its peak between the abnormal and normal thresholds and decreases symmetrically on both sides. Let the midpoint between the abnormal and normal thresholds be:

[0103]

[0104] The interval length is:

[0105]

[0106] The dimensionless bias variable d represents the normalized offset of the current confidence level relative to the midpoint:

[0107]

[0108] The risk score can then be constructed using a bell curve (Gaussian function):

[0109]

[0110] Where β∈[0,1] is a baseline coefficient used to control the minimum value of the curve at both ends (when P is far from the midpoint). Under the above definition, when P=m (i.e. d=0, P is located exactly in the middle of the two thresholds), exp(-d 2 When S = 1, the numerator becomes 1 - exp(-1), which is the same as the denominator. Therefore, S risk (m)=β+(1-β)*1=1, meaning the risk score reaches its peak value of 1 at the midpoint of the interval. When P=p min Or P = pmax When |d|=1, we have exp(-d) 2 ) = exp(-1), at which point the numerator is 0, and we obtain S risk =β, meaning that when the confidence level is at or outside the threshold, the risk score decreases to a baseline value β (typically β can be taken as a value close to 0, so that the risk score is almost 0 in extreme abnormal or extreme normal situations). This symmetric risk scoring function ensures that the highest risk attention is given at moderate levels of abnormality (between the normal and abnormal thresholds), while the risk score decreases at more extreme levels.

[0111] Bot score S bot Finally, for the confidence score of robot behavior, a P2-based logistic function is used to distinguish between "likely a robot" (low P2) and "non-robot" (high P2). Since robot detection scoring does not require considering a risk amplification factor like anomaly / normal scoring, the standard unamplified sigmoid function is used here, and the inflection point is set at P2 = p... min (Use the same location as the anomaly threshold as the boundary):

[0112]

[0113] When P2 = p min At that time, S bot =0.5, indicating uncertainty; if P2 < <p min (Far below the threshold, highly suspicious of being a robot), then exp[k(P2-p min )]→0, therefore S bot →1 indicates a high suspicion that it is a robot; conversely, when P2>>p min When (confidence level far above the threshold, almost no suspicion of bots), S bot →0. Based on this score, the system can further determine whether there is any abnormal behavior involving a robot when the overall anomaly level is high.

[0114] D2: Behavioral tags and reputation scores trigger corresponding security policies, including setting different levels of security measures based on the reputation score range;

[0115] For abnormal and robot categories, isolation, blocking, or speed limiting / flow reduction measures will be triggered; for risk categories, observation and monitoring measures will be triggered.

[0116] For normal categories, the normal release policy is implemented.

[0117] Based on the above calculations, four smooth scores reflecting different dimensions of behavioral characteristics were obtained: anomaly score S abn Normal score S nor Risk score S riskAnd robot rating S bot In the strategic decision-making phase, the first step is to compare the scores of the first three items to determine which dimension the current behavior is most significant on:

[0118] j {*}； =arg max {j∈{abn,,nor,risk}} S(P),

[0119] That is, by S abn S nor S risk The highest score is used to indicate the primary credit status (abnormal, normal, or risky). However, the final classification decision depends not only on the highest score but also on an absolute confidence threshold to ensure clear labeling for extreme cases. A two-stage decision rule is used to give the final label:

[0120] The above decision-making logic means the following: when the overall confidence level P is very low (not higher than the outlier threshold p), min When P2 is high (above 0.5), the system considers the current behavior significantly abnormal. If the robot confidence score P2 is still high at this time (above 0.5), it means that although there are many anomalies, there are no strong robot signs, so it is labeled as "Abnormal," suggesting possible abnormal human behavior. If P2 is also very low (not exceeding 0.5), it tends to indicate robot activity, and is labeled as "Bot." When P is very high (not lower than the normal threshold p), the system considers the current behavior significantly abnormal. max Indicating a state with virtually no abnormal signs, it is labeled as "Normal." The remaining intermediate states (neither reaching a clear abnormality threshold nor completely normal) are uniformly labeled as "Risk," indicating a certain tendency towards abnormality but insufficient to be considered significant. After determining the final label, the system will implement corresponding strategies based on the label category: for cases judged as abnormal or involving bots, a safety response (e.g., alerts, further review, or restrictions on the relevant entity's behavior) may be triggered; for the Risk category, enhanced monitoring or alerts will be implemented; for the Normal category, no additional measures will be taken, and only routine monitoring will continue. This two-stage decision-making scheme combines the advantages of continuous scoring and hard thresholds, smoothly capturing significant abnormalities and clearly normal situations, and providing reasonable risk warnings for intermediate states. When the overall abnormality level is high, the rules also introduce bot scoring to specifically distinguish possible automated abnormal behavior. This dynamic reputation assessment system can also generate a feedback mechanism during execution: for example, system administrators can adjust the threshold p based on the scores and labels provided by the model. min p max or magnification factor I rTo adapt to new environmental conditions, the model can also feed back labeled anomaly / robot samples into the training phase, continuously updating the VAE model to learn the latest normal patterns, thereby gradually improving the accuracy of anomaly detection.

[0121] The specific values ​​and corresponding measures mentioned above are merely illustrative examples. In actual systems, the determination of policy thresholds and the selection of measures can be automatically optimized by the system based on the security policy model. Furthermore, a higher user score—for example, a high score for a user in the abnormal user category—proves that the system has no misjudgments; conversely, a low user score suggests the system may misjudge. This invention envisions dynamically adjusting thresholds at various levels by analyzing the distribution of reputation scores and the consequences of security incidents over a period of time. For instance, if the system detects a large number of objects triggering rate limiting due to reputation scores falling below 50, but many are later confirmed to be false alarms because user scores are too low, there is a risk of misjudgment. User scores distill the "multi-source, instantaneous, and noisy" detection signals into a "continuous, interpretable, and decision-making" risk scale; it is both the key to policy triggering and the crucial factor in mitigating the risk of misjudgment. User scores prevent the system from repeatedly oscillating between policy execution and empirical thresholds, making interpretability and adaptability difficult. This forms a self-learning policy mapping table that continuously calibrates as the environment changes. This dynamic mapping strategy differs from traditional static rules and is better suited to complex and ever-changing attack scenarios.

[0122] D3: Also includes maintaining a historical reputation profile for each monitored object, recording the reputation values ​​of the most recent N detections;

[0123] The test results are weighted and accumulated using a time window method to calculate the historical reputation value;

[0124] Historical reputation values ​​are dynamically updated based on the number of abnormal alarms, missed alarms, and normal passes.

[0125] The execution of a strategy also involves handling strategy conflicts and establishing fault tolerance mechanisms. Conflicts may occur in the following situations:

[0126] When a user's score is low but their reputation score remains high, there is still a risk of misjudgment. This is because the user's score is too close to the threshold of the range. For example, a user might be classified as a "normal user" by the system, but their score is only 50%. This indicates that the system cannot sufficiently determine whether the user is indeed normal. In such cases, the system's automatic policy execution authority is exceeded, and the result needs to be submitted for manual review. Manual review can use methods such as investigation, interviews, and verification of information from multiple sources, combined with professional experience, to provide a final decision instruction, effectively preventing misjudgment. When a user's score is high but their reputation score remains low, it means that the system is highly confident at the feature level that the user belongs to a specific category (e.g., an abnormal or high-risk user). In this case, the system will autonomously execute the corresponding measures according to the established security policy without human intervention, ensuring timely response and efficient policy execution.

[0127] D4: Also includes monitoring the execution status of security control commands and obtaining execution feedback results;

[0128] When an instruction fails to execute, a retry or a degraded security scheme is initiated.

[0129] The results of the execution will be fed back to the credit assessment stage to update the historical records of the corresponding monitored objects.

[0130] Furthermore, considering that security policy issuance may fail due to network or equipment issues (e.g., NAC device malfunction causing blocking commands to fail), the system will monitor the receipt of each executed command or confirm the execution result by querying the device status. If a security command fails to take effect as expected, this unit will take corresponding remedial measures: First, immediately retry executing the same command several times (e.g., retry 3 times, with a few seconds between each retry); if multiple retries still fail, the system will activate a fallback plan, taking a secondary but as close defensive measure as possible. For example, if a direct blocking command cannot be implemented, a strict traffic limiting rule will be added to the egress router, or the suspicious host will be added to a soft-isolated VLAN to temporarily control the risk. At the same time, the system will log the execution anomaly and alert the operations and maintenance personnel for manual intervention to check for equipment problems. Through this mechanism, it is ensured that even if individual policies fail to execute, the system can still minimize the risk of attacks to the greatest extent possible and will not be completely compromised due to a single point of failure.

[0131] Ultimately, the strategy execution unit feeds back each action and its results to the system's logs and archives, sharing this information with the reputation assessment module for subsequent risk measurement updates and model optimization. For example, if a blocking measure is taken during an execution, the event record will be added to the target object's risk profile; conversely, if an object has no policy triggers for a long period, its good reputation record will be strengthened. This information loop further improves the detection-assessment-response-feedback chain, providing data support for the system's continuous learning and adjustment.

[0132] In a network intrusion detection model based on a variational autoencoder (VAE) and a dynamic reputation function, a series of key parameters are defined to control the model's sensitivity to anomalies and the strategy for updating reputation values. All parameters typically take values ​​within the range [0,1] and can be tuned offline using methods such as grid search. The meaning, adjustable range, and impact on detection results of each parameter are explained below:

[0133] P min (Minimum Risk Credit Score): This represents the minimum credit score required to determine if data still constitutes a risk. When the credit score P is lower than P... min At that time, the sample is considered an anomaly or a bot. min A larger value makes the model more lenient towards minor anomalies (more samples are considered at risk), resulting in a lower false positive rate but an increased risk of missed detections. A smaller value makes the model more stringent (triggers alerts even for very small risk probabilities), increasing the detection rate but potentially increasing false positives. The value is generally selected based on fault tolerance requirements; for example, in open networks, P can be appropriately increased. min Threshold, while in high-security scenarios, P is reduced. min To catch exceptions earlier.

[0134] P max (Highest Risk Reputation Value): Represents the highest reputation value for determining a clear anomaly. When P is higher than P... max At that time, the sample was almost certainly normal. max The lower the value, the stronger the model's sensitivity, classifying samples as normal earlier and reducing false negatives, but this may be too aggressive; the higher the value, the more conservative the model, classifying only very high-sounding normal samples as malicious, reducing false positives but potentially missing some attacks. max Usually with P min Correspondingly: Ensure P max >P min An uncertain interval is formed between the two to store suspicious samples.

[0135] I r (Reputation Impact Factor): A coefficient used to dynamically update node reputation values ​​or risk scores, reflecting the intensity of the impact of a single anomaly on overall reputation. rThe larger the value, the stronger the penalty for a single anomaly, and the more sensitive the system is to abnormal events (a larger value is preferable in high-security scenarios to quickly reduce the reputation of suspicious nodes); I r The smaller the value, the weaker the penalty, and the more forgiving the system (it can reduce I in fault-tolerant scenarios). r To avoid a minor anomaly severely damaging your reputation. By adjusting I r It can control the rate at which reputation value decreases with cumulative anomalies, thus achieving cumulative punishment for persistent suspicious behavior.

[0136] k (curve steepness coefficient): Controls the steepness of the dynamic reputation mapping curve, especially the slope of the Sigmoid segment function. A larger k results in a steeper transition of the Sigmoid curve, with a more rapid change in output from normal to anomalous, effectively increasing threshold sensitivity. A smaller k results in a smoother transition, with a more gradual change in output, increasing tolerance for samples approaching the threshold. In high-security environments, a larger k is typically used to ensure that the reputation value drops rapidly when the anomaly probability approaches the threshold, allowing for timely threat response. In general environments, a smaller k can be used to enhance smoothness and reduce false alarms caused by minor fluctuations.

[0137] α and β (curve shape parameters): These two parameters are used to refine the shape and offset of each segment of the control mapping function. A common interpretation is to draw an analogy to the error tolerance rate in traditional hypothesis testing: α corresponds to the confidence level of the acceptance region (the tolerance for false positives), and β corresponds to the confidence requirement of the rejection region (the tolerance for false negatives). In the confidence function of , α is related to the decrease in the normal segment mapping, while β affects the lead time of the abnormal segment mapping. For example, α can be used to control the curve shape at P close to P'. min The degree to which the reputation value decreases (thus reflecting tolerance for minor anomalies) is controlled by β to keep P close to P. max How low should the reputation score be reduced (reflecting sensitivity to high anomalies)? α and β are generally also taken as [0,1], and grid search can be used to select the combination that achieves the optimal trade-off between false positives and false negatives on the validation set.

[0138] The parameters mentioned above are typically determined offline using hyperparameter optimization strategies such as grid search or Bayesian optimization. This involves first selecting several candidate value combinations within a predetermined range, then running the detection model one by one to evaluate metrics such as accuracy, detection rate, false alarm rate, and F1-score.

[0139] Comparative analysis with other functional forms

[0140] To highlight the advantages of the above four-segment mapping functions, we will conduct mathematical derivations and property comparisons with other possible threshold mapping function forms, including step functions, linear functions, polynomial mappings, and exponential functions.

[0141] The heaviside step function is the simplest threshold function, H(P) = 1 (normal) or 0 (abnormal), jumping at a certain threshold. Its advantage is its simplicity, but its disadvantages are significant: it is discontinuous and non-differentiable, and the output changes abruptly at the threshold, meaning that even small changes can lead to drastically different judgments. This makes the model extremely sensitive to data near the threshold, intolerant of any noise or measurement error. For example, if the anomalous probability of a sample slightly increases from 0.49 to 0.51 (assuming a threshold of 0.5), the heaviside step function output will jump from 0 to 1, triggering an alarm. This zero-margin characteristic easily leads to a large number of false alarms, which is extremely detrimental to practical systems. Furthermore, the heaviside step function has no derivative at the threshold, making it impossible to measure the output change trend when approaching the threshold. In contrast, the four-segment smoothing function provides a continuous transition region near the threshold; small input changes only result in small output changes, improving tolerance for edge samples and reducing the false alarm rate.

[0142] Linear function: Mapping P to a linear risk score, such as S lin (P) = 1 – P (assuming P = 1 corresponds to a reputation of 0). Linear mapping is continuous and differentiable, but its adjustment flexibility is poor. First, the slope of a linear function is fixed, meaning that input changes across the entire interval result in the same output change, making it impossible to differentiate for different risk levels. For example, increasing P from 0.1 to 0.2 and from 0.8 to 0.9 results in the same 0.1 decrease in the linear function, but the latter might actually be more alarming. Linear mapping lacks an "inflection point," unlike an S-curve which increases sensitivity in the middle and saturates at both ends. Furthermore, the output of a linear function continues to change as P approaches 1 (and the maximum linear rate of change remains constant), which doesn't meet practical needs—ideally, when P is extremely high, the reputation should be close to 0 and change slowly (because both 0.9 and 0.95 are highly suspicious and don't require strict differentiation). The four-segment function solves these problems through nonlinear segments: the slope increases in the middle risk region (increasing sensitivity), and the output flattens at the high-risk end (facilitating stability). Therefore, the four-segment mapping possesses curve adjustability and state differentiation capabilities that linear functions lack.

[0143] Polynomial mapping: This involves fitting a low-order polynomial (such as a quadratic or cubic function) to an S-shaped curve with a smooth transition at both ends. A commonly used example is the cubic smooth step function f(x) = 3x. 2 -2x 3Defined in x∈[0,1], with f(0)=0, f(1)=1 and derivatives of 0 at 0 and 1, it can be used as a smooth substitute for a step. However, polynomial approximation also has limitations: (1) Model risk: High-order polynomials are prone to oscillations (Runge phenomenon), and may produce anomalous outputs outside the interval, so they must be restricted to a fixed interval and pruned; (2) Difficulty in parameter tuning: The relationship between the coefficients of the polynomial and the curve shape is not direct, and manual adjustment is not intuitive. For example, to change the steepness of the transition, it is necessary to increase the order of the polynomial and adjust multiple coefficients at the same time, lacking the convenience of single-parameter control of steepness like Sigmoid; (3) A single curve is difficult to meet the needs of multiple segments: If a single polynomial is to achieve the effect of a four-segment function, it may need a higher degree to show different slope characteristics in different intervals, which will make the polynomial too complex and unstable. In contrast, a piecewise approach allows for targeted design of functions in each segment: the lower segments use low-order functions (even constant or quadratic) to ensure flatness, the higher segments use exponential functions to ensure rapid descent, and the middle segments use sigmoid functions to ensure adjustable slopes. This approach, where each function fulfills its specific purpose, is more reliable than attempting a "one-size-fits-all" approach using a complex polynomial. Furthermore, the sigmoid / Gaussian function is theoretically approximated infinitely by Taylor series; directly using them ensures monotonicity and boundedness, properties that are difficult to rigorously guarantee with finite-order polynomials.

[0144] Exponential functions: Another type of optional mapping is the exponential type, such as S. exp (P) = exp(-cP) or its linear transformation. The exponential function is monotonically continuous and its rate of decrease can be controlled by the parameter c, but its properties are between linear and Sigmoid. It has two problems: (1) lack of inflection point: the exponential function is always concave (or convex, depending on the form), without the S-shaped inflection point of Sigmoid, which means that the sensitivity improvement in the middle region is limited. (2) not flat enough tail: exp(-cP) gradually approaches 0 as P increases but never becomes 0, and its derivative is always -c exp(-cP), which is small but not zero when P is large. Compared with the Gaussian tail, which is centrally symmetric and flat at the far end, the monotonically decreasing exponential function may not be "decisive" enough for extreme anomalies, that is, there is still some change when P is very large, which is not conducive to stabilizing the output completely at the lowest reputation. In addition, the single parameter of the exponential function may be insufficient to match the derivative at a specific threshold point: such as if you want to match the derivative at P min Smoothness, in P max If it is rapid, then the value of c is unlikely to simultaneously satisfy both requirements. The four-segment function is then implemented piecewise: in P... min The smooth transition is ensured by the Sigmoid near P. max Nearby, a fast and smooth approximation to 0 is achieved by adjusting the Sigmoid / Gaussian transition. Therefore, the four-segment mapping outperforms the simple exponential function in terms of local curvature control.

[0145] In summary, the four-segment dynamic reputation mapping function combines the advantages of various functions: it can distinguish between normal and abnormal states like a step function, but avoids discontinuities and zero gradient problems; it has the simple interval distribution of a linear function, and can achieve nonlinear amplification through nonlinear segments; it borrows from polynomial and smooth interpolation methods to ensure smooth transitions between segments; and it possesses monotonically decreasing characteristics similar to an exponential function, but achieves more flexible curve shape adjustment by combining Sigmoid and Gaussian. Specific advantages are reflected in:

[0146] Curve adjustment capability: The slope and shape of each segment (normal, risk, abnormal) can be adjusted separately, reducing false alarms in one segment without sacrificing the detection rate of another. For example, increasing k mainly affects the steepness of the middle segment, while adjusting α affects the fluctuations in the lower segment; these effects are independent of each other.

[0147] False Alarm Tolerance: The flat output of the normal segment and the slow-start effect of the sigmoid function prevent minor anomalies from immediately causing a drastic drop in reputation, achieving a certain degree of false alarm tolerance. The four-segment function can tolerate noise and benign anomalies by expanding the normal segment and reducing its slope, which is something that step / linear functions cannot do.

[0148] Adaptive sensitivity: As P increases, the function automatically enters a steep-slope region, increasing sensitivity to significant anomalies, and finally enters a saturation region near 1 to prevent excessive fluctuations. This piecewise increasing sensitivity meets the needs of security detection: it takes a cautious approach to suspicious but uncertain behavior (lowering some credibility without triggering a full response), while rapidly raising the alert level for highly suspected behavior and ultimately identifying it as malicious.

[0149] Network intrusion detection systems should employ different parameter configuration strategies in different security environments to balance security and availability. High-sensitivity scenarios require minimizing false negatives, while open environments need to control false positives to avoid interfering with normal business operations. The parameter settings are discussed below according to security level:

[0150] Highly security-sensitive scenarios (such as military, financial, and energy systems)

[0151] Such scenarios have zero tolerance for any abnormal behavior or require extremely high detection rates, preferring to accept false positives for normal operations rather than allowing attacks to slip through. Therefore, the parameter strategy is to improve the model's sensitivity and penalty strength:

[0152] P min The threshold is relatively high. This means that only traffic with an anomaly probability very close to 0 is considered absolutely safe, and any slight disturbance (such as P exceeding a few percentage points) triggers risk monitoring. While this conservative threshold may classify some borderline normal traffic as suspicious, it ensures that potential threats are detected as early as possible.

[0153] Lower P maxFor example, the range is tightened from the default 0.9 to 0.8. This means that once the traffic is determined to have a moderately high probability of being normal, the system will directly treat it as normal.

[0154] Increase I r and k: Using a larger reputation impact factor I r This means that once an anomaly is detected, the node's reputation is significantly reduced. This ensures that the trust level of suspicious entities is rapidly lowered in the early stages of an attack, allowing for immediate isolation if necessary. When consecutive anomalies occur, the reputation value drops more rapidly, helping to promptly break the attack chain. Simultaneously, a large curve steepness coefficient k is used to make S(P) change more steeply in the threshold region, highlighting the difference between anomalies and normal behavior. With a large k, the Sigmoid curve approaches the threshold almost like a step, causing high-risk behavior to be reflected instantly in the output.

[0155] Adjusting α and β to prioritize safety: for example, lowering α (meaning reducing tolerance for false positives) and increasing β (requiring a higher confidence level to be considered normal). This is equivalent to strictly limiting the normal range, and proceeding to further review as soon as there is a certain probability of suspicion.

[0156] Open and fault-tolerant scenarios (such as campus networks and home broadband): These scenarios place greater emphasis on service continuity and user experience. Various unconventional but harmless traffic patterns may exist in the network. Excessive sensitivity could lead to numerous false alarms, negatively impacting system availability. Therefore, parameter strategies tend to relax thresholds, providing a certain degree of fault tolerance.

[0157] Lower P max The normal range is appropriately expanded. This means that minor anomalies are more likely to be classified as normal. Many occasional abnormal patterns will still be considered normal, significantly reducing the false alarm rate.

[0158] Appropriately reduce P min This narrows down the scope of abnormal activity. This allows the system to remain on the sidelines (e.g., mark as risk rather than immediately isolate) even if the detection model deems it 90% likely to be abnormal, thus avoiding the mistaken blocking of legitimate behavior before confirmation. In environments like campus networks, some abnormal traffic (such as P2P and game data packets) frequently occurs without malicious intent, reducing the risk of P... min This can prevent such traffic from being prematurely identified as an attack.

[0159] Decrease I r and k: using a smaller I rThis means that a single anomaly only causes a slight decrease in reputation. It requires a continuous accumulation of anomalous behavior to significantly reduce a node's reputation, thus triggering further measures. This allows nodes to avoid immediate penalties for occasional anomalies, improving system resilience. Similarly, reducing the curve slope k makes the S(P) change more smoothly. For traffic approaching the threshold, the output does not jump abruptly but changes slowly. This passivation reduces alarm jitter, preventing security managers from being overwhelmed by a massive number of minor alarms.

[0160] Increasing the α value (improving false alarm tolerance) and moderately decreasing β: This involves adopting a "wait and see" strategy for suspicious behavior. For example, allowing a certain percentage of suspicious events to not trigger alarms (corresponding to a larger normal range), only entering the abnormal range when the probability is very high. This is similar to the delayed decision-making idea in the "three-way decision" approach, reducing the probability of direct misjudgment by expanding the intermediate ambiguity zone.

[0161] With these settings, the model behaves more mildly in open environments: it remains vigilant about anomalies but doesn't over-intervene, focusing its main efforts on explicit attacks. The probability of normal users being bothered by false alarms is reduced, while genuine attacks, which often cause persistent and obvious anomalies, will still be gradually identified by the model. Once serious attack signs appear (very high and persistent P), the model can eventually mark and isolate the attack through a cumulative decline in reputation. However, before that, the system tries to avoid impacting the user experience due to short-term fluctuations.

[0162] In summary, the network architecture design and dynamic threshold adjustment strategy of the variational autoencoder are further refined based on the basic technical solution. A convolutional neural network structure is adopted to improve the modeling efficiency of high-dimensional sparse network traffic data, reducing the number of parameters and enhancing the ability to capture temporal features compared to traditional fully connected structures. The sliding window mechanism introduced in the dynamic threshold setting can adapt to changes in the network environment. When consecutive abnormal events are detected, the system actively lowers the threshold to increase sensitivity, while appropriately relaxing the threshold to reduce false alarms under long-term normal conditions. This adaptive feedback mechanism improves the stability of the system under different network environments. The detailed implementation of the four-segment reputation mapping function provides differentiated scoring strategies for four behavior modes—abnormal, normal, risky, and robotic—through different mathematical forms such as the logistic function and Gaussian function. Compared with a single mapping function, it has stronger expressive power and better smoothness. The design of failure retry and degradation schemes in the policy execution stage ensures that basic security protection capabilities can be maintained even in the event of partial network device failure.

[0163] Example 3

[0164] The above is an illustrative scheme of a network intrusion detection method based on variational autoencoder and multi-segment reputation assessment. It should be noted that the technical solution of this network intrusion detection system based on variational autoencoder and multi-segment reputation assessment belongs to the same concept as the technical solution of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment described above. Details not described in detail in this embodiment can be found in the description of the technical solution of the network intrusion detection system based on variational autoencoder and multi-segment reputation assessment described above.

[0165] This embodiment also provides a network intrusion detection system based on variational autoencoder and multi-segment reputation assessment, including:

[0166] The acquisition module acquires network traffic data and extracts protocol features, statistical features, and temporal features to form a standardized feature vector. The standardized feature vector is encoded by a variational autoencoder to obtain the latent distribution parameters. The original input is then reconstructed by decoding, and the reconstruction error is calculated.

[0167] The threshold comparison module sets a dynamic threshold based on the reconstruction error distribution within a sliding window, compares the reconstruction error with the dynamic threshold to perform anomaly detection, obtains the detection accuracy index, counts the sample counts of anomaly category, risk category, and robot category, introduces a risk amplification coefficient to adjust the anomaly weight, and converts the count value into a confidence score through nonlinear mapping.

[0168] The calculation module constructs a four-segment reputation mapping function based on the confidence score to calculate the anomaly score, normal score, risk score, and robot score respectively.

[0169] The results output module determines the main reputation status based on the comparison results of the four scores, performs a two-stage judgment based on the confidence threshold, outputs a behavior label, triggers the corresponding security policy based on the behavior label and reputation score, and issues security control instructions through the network access control interface.

[0170] This embodiment also provides an electronic device suitable for network intrusion detection based on variational autoencoder and multi-segment reputation assessment, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as proposed in the above embodiment.

[0171] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as proposed in the above embodiments.

[0172] The storage medium proposed in this embodiment belongs to the same inventive concept as the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment proposed in the above embodiments. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0173] Based on the above description of the implementation methods, those skilled in the art will clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0174] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A network intrusion detection method based on variational autoencoder and multi-segment reputation assessment, characterized in that: This includes acquiring network traffic data and extracting protocol features, statistical features, and temporal features to form a standardized feature vector; encoding the standardized feature vector using a variational autoencoder to obtain latent distribution parameters; and reconstructing the original input through decoding to calculate the reconstruction error. Based on the reconstruction error distribution within the sliding window, a dynamic threshold is set, and the reconstruction error is compared with the dynamic threshold to perform anomaly detection, thereby obtaining the detection accuracy index. The sample counts of anomaly category, risk category, and robot category are counted, and a risk amplification coefficient is introduced to adjust the anomaly weight. The count values ​​are then converted into confidence scores through nonlinear mapping. Based on the confidence scores, a four-segment reputation mapping function is constructed to calculate the anomaly score, normal score, risk score, and robot score, respectively. The primary reputation status is determined based on the comparison results of the four scores. A two-stage judgment is performed in combination with the confidence threshold to output a behavior label. Based on the behavior label and the reputation score, the corresponding security policy is triggered, and a security control command is issued through the network access control interface.

2. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 1, characterized in that: The method of setting a dynamic threshold based on the reconstruction error distribution within a sliding window includes: maintaining a sliding window containing a preset number of recent samples; calculating a preset quantile of the reconstruction error value within the sliding window as the current dynamic threshold; and correcting the dynamic threshold based on historical reputation values, reducing the threshold to improve detection sensitivity when the historical reputation value is low.

3. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 2, characterized in that: The four-segment reputation mapping function includes: the abnormal score adopts the form of a logistic function, which rises rapidly when the confidence level is below the abnormal threshold; the normal score adopts the form of a reverse logistic function, which outputs stably when the confidence level is above the normal threshold; the risk score adopts the form of a Gaussian function, which reaches its peak at the midpoint between the abnormal threshold and the normal threshold; and the robot score is mapped using an independent logistic function based on the robot's confidence level.

4. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 3, characterized in that: The two-stage judgment output behavior label includes: when the overall confidence level is not higher than the abnormal threshold, judging whether the robot confidence level exceeds a preset value; if it exceeds, it is marked as an abnormal category; otherwise, it is marked as a robot category; when the overall confidence level is not lower than the normal threshold, it is marked as a normal category. When the overall confidence level is between the abnormal threshold and the normal threshold, it is marked as a risk category.

5. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 4, characterized in that: The behavioral tags and reputation scores trigger corresponding security policies, including setting different levels of security measures based on the reputation score range; and triggering isolation, blocking, or rate limiting / flow reduction measures for abnormal categories and robot categories. For each risk category, trigger observation and monitoring measures; For normal categories, the normal release policy is implemented.

6. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 5, characterized in that: This also includes maintaining a historical reputation profile for each monitored object, recording the reputation values ​​from the most recent N tests; The test results are weighted and accumulated using a time window method to calculate the historical reputation value; Historical reputation values ​​are dynamically updated based on the number of abnormal alarms, missed alarms, and normal passes.

7. The network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in claim 6, characterized in that: It also includes monitoring the execution status of security control commands and obtaining execution feedback results; retrying or initiating a downgraded security scheme when the command execution fails; and feeding back the execution results to the reputation assessment stage to update the historical files of the corresponding monitored objects.

8. A network intrusion detection system based on variational autoencoder and multi-segment reputation assessment, based on the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in any one of claims 1 to 7, characterized in that: It also includes, The acquisition module acquires network traffic data and extracts protocol features, statistical features, and temporal features to form a standardized feature vector. The standardized feature vector is encoded by a variational autoencoder to obtain the latent distribution parameters. The original input is then reconstructed by decoding, and the reconstruction error is calculated. The threshold comparison module sets a dynamic threshold based on the reconstruction error distribution within a sliding window, compares the reconstruction error with the dynamic threshold to perform anomaly detection, obtains the detection accuracy index, counts the sample counts of anomaly category, risk category, and robot category, introduces a risk amplification coefficient to adjust the anomaly weight, and converts the count value into a confidence score through nonlinear mapping. The calculation module constructs a four-segment reputation mapping function based on the confidence score to calculate the anomaly score, normal score, risk score, and robot score respectively. The results output module determines the main reputation status based on the comparison results of the four scores, performs a two-stage judgment based on the confidence threshold, outputs a behavior label, triggers the corresponding security policy based on the behavior label and reputation score, and issues security control instructions through the network access control interface.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the network intrusion detection method based on variational autoencoder and multi-segment reputation assessment as described in any one of claims 1 to 7.

Images