Network transmission protocol intrusion detection method and system

Abstract

The application relates to the technical field of network security detection, and discloses a network transmission protocol intrusion detection method and system. The method comprises the following steps: collecting network transmission protocol data streams, extracting packet header features and payload features, and integrating to form an original feature set; classifying the original feature set according to protocol types, dividing different protocol clusters and marking corresponding identifiers; constructing a dynamic feature filter based on the protocol cluster identifiers, screening a feature subset associated with the current protocol cluster from the original feature set; inputting the feature subset into a protocol state analysis model, outputting a protocol state vector and an abnormal behavior probability distribution from the model; generating an intrusion detection result according to the two, and triggering a corresponding defense response instruction. Through protocol cluster classification and dynamic feature screening, the method adapts to different protocol characteristics, realizes accurate identification of protocol intrusion behaviors, and can be applied to various scenes relying on network transmission protocols.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security detection, in particular to a network transmission protocol intrusion detection method and system. BACKGROUND

[0002] Under the background of rapid development of current network technology, the running safety of network transmission protocol as the core carrier of data interaction is directly related to the stability of the entire network system. With the diversification of network application scenarios, the use frequency of TCP, UDP, HTTP and other types of protocols has increased significantly, and the intrusion behaviors targeting these protocols also show the characteristics of diversification and concealment. For example, some intrusion behaviors will disguise as normal protocol data packets, bypass traditional detection mechanisms by tampering with data packet payloads or forging header information; some intrusion behaviors will exploit vulnerabilities of specific protocols to launch targeted attacks, causing data leakage, service interruption and other problems.

[0003] The existing intrusion detection technology has many deficiencies in dealing with network transmission protocol related intrusions. Most technologies do not distinguish between different protocol types when extracting features, and directly process all data packet features uniformly. This approach will result in a large amount of redundant information in the feature set that is irrelevant to the current detection target, not only increasing the burden of subsequent data processing, but also possibly interfering with the detection model's identification of effective features, reducing detection accuracy; existing technologies mostly use static feature screening rules, which are difficult to dynamically adjust according to changes in protocol types or the emergence of new protocols once set. When faced with intrusion behaviors using new protocols or variant protocols, static screening rules cannot effectively screen out key features, causing the detection model to fail to accurately identify intrusion behaviors, resulting in high false positive or false negative rates.

[0004] Some intrusion detection technologies do not fully combine the running rules and features of protocols when analyzing protocol states. Different protocols have significant differences in data transmission, connection establishment, session management, etc., and their normal and abnormal state determination standards are also different. If a unified state analysis model is used to detect all protocols, it cannot accurately match the state characteristics of different protocols and cannot accurately determine whether there is an anomaly in the protocol running process. At the same time, after generating detection results, the triggering of defense response instructions often lacks pertinence and cannot develop differentiated defense strategies according to the type of intrusion behavior and the characteristics of protocol clusters, resulting in low defense response efficiency and difficulty in effectively preventing the further spread of intrusion behaviors. The existence of these problems limits the role of existing intrusion detection technology in ensuring the safety of network transmission protocols and cannot meet the current demand for protocol intrusion detection in complex network environments. SUMMARY

[0005] The application aims to provide a network transmission protocol intrusion detection method and system to solve the problems in the background.

[0006] To achieve the above-mentioned purpose, the application provides a network transmission protocol intrusion detection method, which comprises the following steps: collecting network transmission protocol data streams, extracting data packet header features and payload features, and generating an original feature set; performing protocol type classification on the original feature set, dividing different protocol clusters and marking protocol cluster identifiers; constructing a dynamic feature filter based on the protocol cluster identifiers, and screening a feature subset associated with the current protocol cluster from the original feature set; inputting the feature subset associated with the current protocol cluster into a protocol state analysis model, outputting a protocol state vector and an abnormal behavior probability distribution; generating an intrusion detection result according to the protocol state vector and the abnormal behavior probability distribution, and triggering a corresponding defense response instruction.

[0007] Preferably, the step of collecting network transmission protocol data streams, extracting data packet header features and payload features, and generating an original feature set comprises the following steps: listening to data packet capture events of network interfaces, recording the arrival time stamps and transmission directions of data packets; analyzing the header fields of data packets, extracting source addresses, target addresses, port numbers and protocol types; performing segmented hash processing on the payloads of data packets, generating payload feature fingerprints; and merging the header fields and the payload feature fingerprints into the original feature set in chronological order.

[0008] Preferably, the process of performing protocol type classification on the original feature set, dividing different protocol clusters and marking protocol cluster identifiers comprises the following steps: counting the occurrence frequencies of protocol types in the original feature set, generating a protocol frequency distribution table; constructing protocol cluster division rules based on the protocol frequency distribution table, dividing protocol types with occurrence frequencies higher than a protocol frequency threshold into independent protocol clusters; protocol types in the original feature set that are not divided into independent protocol clusters are residual protocol types; performing similarity clustering on the residual protocol types, merging protocol types with the same header field mode into mixed protocol clusters; assigning unique identifiers to each protocol cluster, obtaining protocol cluster identifiers, and recording the field feature templates corresponding to the protocol cluster identifiers.

[0009] Preferably, the process of constructing a dynamic feature filter based on the protocol cluster identifier to filter a feature subset associated with the current protocol cluster from the original feature set comprises: loading a field feature template corresponding to the protocol cluster identifier, extracting a key field index in the field feature template; matching associated features from the original feature set according to the key field index to generate a candidate feature subset; performing redundancy detection on the candidate feature subset to eliminate redundant features with a correlation to other features exceeding a feature correlation threshold, to obtain a filtered feature subset associated with the current protocol cluster; storing the filtered feature subset associated with the current protocol cluster in the feature cache area according to the protocol cluster identifier; and training a standard state vector of the protocol cluster based on the filtered feature subset associated with the current protocol cluster from the historical normal traffic data of the protocol cluster.

[0010] Preferably, the processing process of the protocol state analysis model comprises: receiving the filtered feature subset associated with the current protocol cluster, and dividing the feature subset according to a time window to generate a plurality of feature sequence segments; performing state coding on each feature sequence segment to output a current value and a historical change trend of the protocol state vector; calculating a matching degree of the feature sequence segment and a known attack mode to generate an abnormal behavior probability distribution; obtaining a deviation degree of the protocol state vector by calculating a Mahalanobis distance of the protocol state vector and the standard state vector of the protocol cluster in a multi-dimensional state space; and correcting the abnormal behavior probability distribution according to the deviation degree of the protocol state vector.

[0011] Preferably, the process of performing state coding on each feature sequence segment comprises: extracting a numerical field in the feature sequence segment to construct a multi-dimensional state space; calculating an Euclidean distance between a current feature value and a protocol standard state in the multi-dimensional state space; marking an abnormal level of the protocol state vector according to a fluctuation range of the Euclidean distance; generating a state transition path graph combining the historical state vector; and integrating the abnormal level of the protocol state vector and the state transition path graph information to complete the state coding of each feature sequence segment.

[0012] Preferably, the process of generating an intrusion detection result according to the protocol state vector and the abnormal behavior probability distribution comprises: comparing the abnormal behavior probability distribution with a preset risk threshold to mark a behavior with an abnormal behavior probability distribution value exceeding the preset risk threshold as a high-risk protocol behavior; extracting a protocol state vector corresponding to the high-risk protocol behavior, and locating an abnormal protocol cluster identifier by querying an identifier field in the protocol state vector; generating a detection report containing an attack type and a time range by backtracking the original feature set according to the abnormal protocol cluster identifier; and converting the detection report into a defense response instruction and delivering the defense response instruction to a protocol filtering engine.

[0013] Preferably, the generation process of the defense response instruction comprises: analyzing the attack type in the detection report, matching the pre-defined response strategy library; extracting the protocol filtering rule and the traffic limiting parameter from the response strategy library; determining the instruction effective period according to the time range; and encapsulating the filtering rule and the limiting parameter into an executable instruction sequence.

[0014] Preferably, the method further comprises: periodically updating the protocol cluster division rule and the field feature template; dynamically expanding the protocol cluster identifier according to the frequency of occurrence of the new protocol type; and retraining the protocol state analysis model to adapt to the updated protocol features.

[0015] Preferably, the application further comprises a network transmission protocol intrusion detection system, comprising a processor and a memory, the memory storing a computer program, when the computer program is executed by the processor, the steps of the network transmission protocol intrusion detection method are realized.

[0016] Compared with the prior art, the application has the following beneficial effects.

[0017] In the feature extraction and processing link, the method first collects network transmission protocol data streams, extracts packet header features and payload features respectively and generates an original feature set, then classifies the original feature set by protocol type, divides different protocol clusters and marks the protocol cluster identifiers. This approach breaks the pattern of not distinguishing protocol types and uniformly processing features in traditional technology, can associate features with corresponding protocol clusters according to the properties and characteristics of the protocol itself, reduce the interference of irrelevant features on the subsequent detection process, make the feature set more targeted, and help the subsequent detection model more efficiently capture key information related to intrusion behavior.

[0018] The dynamic feature filter constructed based on the protocol cluster identifier is one of the important advantages of the method. The dynamic feature filter can select the associated feature subset from the original feature set according to the current protocol cluster to be detected, rather than using fixed and unchanged filtering rules. This dynamic adjustment method can adapt to the feature differences of different protocol clusters, and when a new protocol appears or a protocol version is updated, the entire filtering mechanism does not need to be reconstructed, only the filtering logic needs to be adjusted according to the identifier of the new protocol cluster. This not only reduces the cost of technical maintenance, but also ensures that the filtered feature subset is always highly matched with the current detection target, avoiding the problem of missing key features or too many redundant features due to rigid filtering rules, and providing high-quality feature data for subsequent protocol state analysis.

[0019] In the aspect of protocol state analysis and intrusion identification, the method inputs the screened feature subset into the protocol state analysis model, and outputs the protocol state vector and the abnormal behavior probability distribution. The protocol state vector can clearly reflect the current running state of the protocol, including the connection state, data transmission rhythm, session integrity and other information, while the abnormal behavior probability distribution can quantify the possibility of different abnormal behaviors. This output method makes the detection result more hierarchical and accurate, which can not only determine whether the current running state of the protocol conforms to the normal rules, but also can make a probability assessment on the possible abnormal behaviors, helping the staff to better understand the protocol running situation and avoid misjudgment caused by a single judgment standard. At the same time, the protocol state analysis model can be adapted to the features of different protocol clusters, which can better match the normal running rules of different protocols, so as to more accurately identify abnormal behaviors that do not conform to the protocol characteristics and reduce the false negative or false positive situations caused by the mismatch between the model and the protocol.

[0020] In the aspect of applying the detection result to the defense response, the method generates the intrusion detection result according to the protocol state vector and the abnormal behavior probability distribution, and triggers the corresponding defense response instruction. Since the detection result is based on the feature and state analysis of a specific protocol cluster, the corresponding defense response instruction can also better fit the characteristics of the current intrusion behavior and the attributes of the protocol cluster. For example, for the connection hijacking intrusion of the TCP protocol, the defense instructions of disconnecting abnormal connection and verifying the connection identity can be triggered; for the malicious payload intrusion of the HTTP protocol, the defense instructions of filtering abnormal data packets and checking the legality of the payload can be triggered. This differentiated defense response method can avoid the problem of strong universality and weak pertinence of the defense response instruction in the traditional technology, improve the efficiency of the defense response, more quickly contain the spread of the intrusion behavior, and reduce the impact of the intrusion behavior on the network system.

[0021] The flow design of the whole method has good expansibility and adaptability, and can be applied to various network transmission protocol scenes. Whether it is the common TCP, UDP protocol or the customized protocol in the special network, the effective intrusion detection can be realized through protocol type classification and dynamic feature screening. At the same time, the logic of each link of the method is clear, and the operation process can be realized through the existing technical means without the need for complex hardware support, which reduces the threshold of technology landing and facilitates the popularization and application in network systems of different scales, providing protection for the security of network transmission protocols in more scenes. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 The working principle diagram of the network transmission protocol intrusion detection method described in the present application;

[0023] Figure 2 The flowchart for collecting network transmission protocol data flow;

[0024] Figure 3 Flowchart for constructing a dynamic feature filter. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work are within the scope of protection of the present application.

[0026] Please refer to Figure 1 The present application provides a network transmission protocol intrusion detection method, which comprises the following steps: collecting network transmission protocol data streams, extracting packet header features and payload features, and generating an original feature set; performing protocol type classification on the original feature set, dividing different protocol clusters and marking protocol cluster identifiers; constructing a dynamic feature filter based on the protocol cluster identifiers, and screening a feature subset associated with the current protocol cluster from the original feature set; inputting the feature subset associated with the current protocol cluster into a protocol state analysis model, outputting a protocol state vector and an abnormal behavior probability distribution; generating an intrusion detection result according to the protocol state vector and the abnormal behavior probability distribution, and triggering a corresponding defense response instruction. The whole scheme realizes efficient and adaptive intrusion detection by processing network data in layers, and can dynamically adapt to changes in multiple protocol types. The process of collecting network transmission protocol data streams involves listening to packet capture events of network interfaces, recording the arrival timestamps and transmission directions of the packets, analyzing the header fields of the packets to extract source addresses, target addresses, port numbers and protocol types, and performing segmented hash processing on the packet payloads to generate payload feature fingerprints. Finally, the header fields and the payload feature fingerprints are merged into the original feature set in timestamp order.

[0027] The protocol type classification generates a protocol frequency distribution table based on the occurrence frequency of the protocol types in the original feature set, constructs protocol cluster division rules using the protocol frequency distribution table, divides protocol types with an occurrence frequency higher than a protocol frequency threshold into independent protocol clusters, performs similarity clustering on the remaining protocol types to merge protocol types with the same header field mode into mixed protocol clusters, and assigns a unique identifier to each protocol cluster to obtain a protocol cluster identifier and record the field feature template corresponding to the protocol cluster identifier. The construction of the dynamic feature filter loads the field feature template corresponding to the protocol cluster identifier, extracts the key field index in the field feature template, matches the associated features from the original feature set according to the key field index to generate a candidate feature subset, performs redundancy detection on the candidate feature subset to remove redundant features with a correlation to other features exceeding a feature correlation threshold, and obtains a feature subset associated with the current protocol cluster after screening. The feature subset associated with the current protocol cluster after screening is stored in the feature cache area according to the protocol cluster identifier.

[0028] The protocol state analysis model processes the feature subset associated with the current protocol cluster after screening and generates multiple feature sequence segments according to a time window. When integrating the abnormal level of the protocol state vector and the state transition path graph information, the abnormal level of the protocol state vector is used as a basis for identification to determine the protocol state risk degree corresponding to the current feature sequence segment. Then, the historical state change trajectory reflected by the state transition path graph is associated with the abnormal level, so that the encoding result contains not only the abnormal properties of the current state but also the process information of state evolution. Through the above association processing, the two types of information are fused into a unified encoding form to form an encoding result that can be used for subsequent anomaly analysis, and the state coding of each feature sequence segment is finally completed. The state coding of each feature sequence segment is performed to output the current value and historical change trend of the protocol state vector, and the matching degree of the feature sequence segment and the known attack mode is calculated to generate an abnormal behavior probability distribution. The deviation degree of the protocol state vector is obtained by calculating the Mahalanobis distance of the protocol state vector and the standard state vector of the protocol cluster in the multi-dimensional state space. The abnormal behavior probability distribution is corrected according to the deviation degree of the protocol state vector. The specific calculation of the matching degree of the feature sequence segment and the known attack mode includes two core formulas: initialization and recursion. The initialization formula is specifically: . Wherein, represents the initial cumulative distance of the starting data point of the feature sequence segment and the starting data point of the known attack mode, represents the initial cumulative distance of the starting data point of the feature sequence segment and the starting data point of the known attack mode, represents the starting data point of the feature sequence segment, represents the starting data point of the known attack mode.

[0029] The recursion formula is specifically: . Wherein, data point index representing the feature sequence segment ), data point index representing the known attack pattern ), the first data point of the feature sequence segment the first data point of the known attack pattern Euclidean distance between the minimum cumulative distance between and , the dynamic programming of the optimal alignment path is achieved by taking the minimum value of the previous stage cumulative distance , , . the minimum cumulative distance between the first data point of the feature sequence segment and the first data point of the known attack pattern up to this time. the minimum cumulative distance between the first data point of the feature sequence segment and the first data point of the known attack pattern up to this time. the minimum cumulative distance between the first data point of the feature sequence segment and the first data point of the known attack pattern up to this time.

[0030] Finally, take as the matching degree index, the higher the matching degree, the higher the probability of abnormal behavior, and then generate the abnormal behavior probability distribution.

[0031] The generation of intrusion detection results compares the abnormal behavior probability distribution with the preset risk threshold to identify high-risk protocol behaviors, extracts the protocol state vector corresponding to the high-risk protocol behaviors to locate the abnormal protocol cluster identifier, and traces back to the original feature set according to the abnormal protocol cluster identifier to generate a detection report containing the attack type and time range. The detection report is converted into a defense response instruction and issued to the protocol filtering engine. The generation of the defense response instruction parses the attack type in the detection report to match the predefined response strategy library, extracts the protocol filtering rules and traffic speed limit parameters from the response strategy library, determines the instruction effective period according to the time range, and encapsulates the filtering rules and speed limit parameters into an executable instruction sequence. In addition, the method also includes periodically updating the protocol cluster division rules and field feature templates, dynamically expanding the protocol cluster identifier according to the frequency of new protocol types, and retraining the protocol state analysis model to adapt to the updated protocol features.

[0032] Embodiment 1: refer to​​​Figure 2 The collection of network traffic protocol data is achieved by listening to the packet capture event of the network interface. The network interface card driver generates a hardware interrupt when a packet arrives. The interrupt handling routine of the operating system kernel calls the packet capture library function, such as the function of the library, to record the arrival timestamp and transmission direction of the packet. The timestamp is obtained from the system high-precision clock source, and the transmission direction is determined by comparing the destination IP address of the packet with the configuration address of the network interface. The packet header field parsing process involves parsing the network layer and transport layer protocol headers. After the Ethernet frame header is stripped, the IP header version field indicates the IPv4 or IPv6 format. The source and destination addresses are extracted in 32-bit or 128-bit binary format. The transport layer header parsing distinguishes between TCP, UDP, or ICMP protocols. The TCP header extracts the sequence number, acknowledgement number, and flag bits. The UDP header extracts the length and checksum fields. The port number is stored in 16-bit unsigned integer format.

[0033] The packet payload is processed by segmenting and hashing to generate a payload feature fingerprint. The payload data is divided from the start of the transport layer payload. The segment size is dynamically adjusted according to the average network transmission unit. In a gigabit network environment, a 512-byte segment is used, and in a terabit network environment, a 1024-byte segment is used. Each segment is input into the SHA-256 hash algorithm to calculate the hash value. The hash values of all segments are combined into a complete payload feature fingerprint through concatenation. The header fields and payload feature fingerprints are merged into an original feature set in timestamp order. The timestamp sorting is implemented using a min-heap data structure. Each data packet corresponds to a feature record, which contains the timestamp, transmission direction, source address, destination address, port number, protocol type, and payload feature fingerprint fields. The original feature set is stored in a ring buffer structure. The buffer size is configured to be in the range of 1 GB to 10 GB according to the memory capacity.

[0034] The protocol type classification is based on the frequency of occurrence of the protocol type in the original feature set. The statistical process traverses all protocol type fields in the original feature set. The protocol type field values include TCP, UDP, ICMP, and other custom types. The number of occurrences of each protocol type is accumulated in the frequency counter. A protocol frequency distribution table is generated. The protocol frequency distribution table is stored in a hash table structure, with the key being the protocol type string and the value being the occurrence integer value. The protocol frequency distribution table constructs the protocol cluster division rule. The protocol cluster division rule sets the protocol frequency threshold calculation method. The protocol frequency threshold is dynamically adjusted according to the historical traffic baseline. The baseline data comes from the past 24 hours of protocol type distribution statistics. The protocol frequency threshold calculation formula is the average frequency multiplied by the sensitivity coefficient. The default value of the sensitivity coefficient is 2.0. The protocol type with an occurrence frequency higher than the protocol frequency threshold is divided into an independent protocol cluster.

[0035] The similarity clustering of the remaining protocol types merges the protocol types with the same header field mode into a mixed protocol cluster. The similarity calculation uses the Jaccard similarity coefficient algorithm to compare the intersection and union proportion of the header field set between the protocol types. The header field set includes the source port range, target port range, and protocol flag combination. The protocol types with a similarity coefficient greater than 0.8 are merged into the same mixed protocol cluster. Each protocol cluster is assigned a unique identifier generated using the incremental number algorithm with an initial value of 1. The field characteristic template of the protocol cluster records the typical field values of all protocol types in the protocol cluster. The field characteristic template is stored in XML format and includes the field name, value type, and value range attributes.

[0036] The protocol frequency distribution table update mechanism uses a sliding time window algorithm with a window size of 5 minutes and a window sliding interval of 1 minute. Each time the window slides, the protocol statistics records in the earliest time interval are removed, and the protocol statistics records in the current time interval are added. The protocol frequency distribution table recalculates the frequency distribution. The independent protocol cluster creation process checks the frequency of newly appearing protocol types. When the frequency of a protocol type exceeds the protocol frequency threshold in three consecutive time windows, a new independent protocol cluster is automatically created. The field characteristic template of the independent protocol cluster extracts typical field values from the historical data of the protocol type.

[0037] The mixed protocol cluster maintenance process periodically checks the similarity of the protocol types in the cluster. The intra-cluster protocol type re-clustering is performed once a week. The Jaccard similarity coefficient algorithm recalculates the similarity between all protocol types. The protocol types with a similarity less than 0.6 are split into new mixed protocol clusters, and the protocol types with a similarity higher than 0.9 are merged into existing mixed protocol clusters. The field characteristic template update mechanism monitors the distribution changes of the field values in the protocol cluster. When the log analysis finds that the field value distribution deviates by more than 10%, the field characteristic template is regenerated. The new template is generated based on the protocol data statistics of the last 7 days.

[0038] The data packet capture event processing optimization uses the zero-copy technology. The network interface card DMA engine directly transmits the data packets to the kernel pre-allocated memory area, which is mapped to the user space program, reducing the number of data copies between the kernel space and the user space. The payload characteristic fingerprint calculation process uses hardware acceleration. The CPU supporting the SHA-256 instruction set directly performs hash calculation. The hash calculation throughput reaches multiple data blocks per cycle. The protocol type classification execution process uses multi-thread parallel processing. The original feature set is divided into multiple subsets, each subset is assigned to an independent working thread, and the working threads concurrently calculate the protocol type frequency. The statistical results are merged into the global protocol frequency distribution table. The protocol cluster division rule application process introduces machine learning algorithms. The K-means clustering algorithm is used to automatically identify protocol type grouping. The clustering feature vector includes the protocol type frequency, port number distribution, and payload length statistics.

[0039] The dynamic feature filter construction process and the protocol type classification process are pipelined, the feature filtering operation is triggered immediately after the protocol cluster identifier is generated, the feature filtering operation accesses the original feature set in the shared memory, the feature filtering operation uses index acceleration technology, a B+ tree index is established for the key field, the index key is the protocol cluster identifier, and the index value is the offset of the feature in the original feature set. The input feature subset of the protocol state analysis model uses a compressed format, the feature value uses a differential encoding compression algorithm, and the feature value difference of the continuous timestamp is stored, so that the transmission bandwidth occupation of the feature subset is reduced. The intrusion detection result generation process integrates a real-time alarm function, an alarm event is triggered immediately when a high-risk protocol behavior is detected, the alarm event is sent to the network management system through the SNMP protocol, and the alarm message includes the protocol cluster identifier, the risk level and the timestamp information. The defense response instruction execution process supports a rollback mechanism, the network traffic is monitored after the instruction is issued, and when the abnormal traffic index exceeds the safety threshold, the issued instruction is automatically revoked and rolled back to the previous safe state.

[0040] The protocol cluster division rule and the field feature template are updated periodically, the update is implemented through a timing task, the update job is performed at dawn every day, the update job reads the latest protocol statistical information from the network traffic database, the protocol statistical information includes detailed data of all protocol types in the past 24 hours, the update job recalculates the protocol frequency threshold and rebuilds the protocol cluster division rule. The frequency monitoring of the new protocol type uses an exponential weighted moving average algorithm, the weight of the new protocol type decays exponentially over time, the recently appeared protocol type obtains a higher weight, and the frequency calculation reflects the current network state. The protocol state analysis model retraining process uses an offline training mode, the training data comes from the historical feature subset database, the training period is once a week, the training process uses the TensorFlow framework to build a deep learning model, the model structure is a long short-term memory network, the number of input layer nodes corresponds to the dimension of the feature subset, and the number of output layer nodes corresponds to the dimension of the abnormal behavior probability distribution. After the model training is completed, the effect is verified through A / B testing, the new model and the old model run in parallel for 1 hour, the false positive rate and the false negative rate indicators of the two models are compared, and the model with better performance is deployed to the production environment.

[0041] Embodiment 2: see Figure 3The construction of the dynamic feature filter starts an operation process based on a protocol cluster identifier, the protocol cluster identifier is passed to the feature filtering module as an input parameter, the feature filtering module accesses the field feature template storage area corresponding to the protocol cluster identifier, the field feature template storage area is implemented by using a distributed key-value database, database nodes are deployed in an in-memory storage cluster, and each protocol cluster identifier is mapped to a specific field feature template data block. The process of extracting the key field index of the field feature template involves a template parsing engine, the template parsing engine reads XML format data of the field feature template, parses the field name, data type and storage location information, and a key field index generation algorithm traverses all field definitions in the template to create an index record for each field, the index record including the offset address and length value of the field in the original feature set.

[0042] The generation of the candidate feature subset matches the associated features from the original feature set according to the key field index, the matching operation is performed by a feature comparator, the feature comparator loads the original feature data segment pointed to by the key field index, and performs a field-by-field comparison between the original feature data segment and the standard feature value in the field feature template, the feature comparator uses a parallel processing architecture to simultaneously process the matching tasks of multiple key fields. The similarity calculation uses an improved edit distance algorithm, and different comparison strategies are used for different data types, the absolute difference percentage is calculated for numerical fields, and the Levenshtein distance algorithm is applied to character fields, the matched features are added to the candidate feature subset container, and the candidate feature subset container uses a dynamic array structure to support fast element insertion. The redundancy detection performs multiple rounds of screening processing on the candidate feature subset, the first round of detection calculates the Pearson correlation coefficient matrix between the features, the Pearson correlation coefficient matrix generation algorithm traverses all feature pairs in the candidate feature subset, calculates the covariance and standard deviation ratio of each feature pair, and the feature pairs with a correlation coefficient exceeding a set feature correlation threshold are entered into a redundant feature list. The second round of detection applies principal component analysis technology, the principal component analysis algorithm projects the candidate feature subset into an orthogonal feature space, calculates the loading coefficient of each feature on the main component, and the features with a loading coefficient lower than a minimum contribution degree are marked as inefficient features. The third round of detection uses a mutual information evaluation method, the mutual information calculation uses a probability density function to estimate the statistical dependence between features, and one feature is retained in a feature pair with a high mutual information value.

[0043] The screened feature subsets are stored in a feature cache area according to the protocol cluster identifiers. The feature cache area is designed as a multi-layer storage structure. The first layer is a high-speed flash cache for storing feature data of active protocol clusters. The second layer is a mechanical hard disk array for storing historical feature subsets. A feature cache area management algorithm implements an LRU replacement strategy. The LRU replacement strategy maintains a timestamp queue of the feature subsets. When the cache space is insufficient, the least recently used feature subset is removed. The feature subset storage format adopts a columnar storage layout. The same type of feature values are stored continuously to improve data reading efficiency.

[0044] The field feature template update mechanism is synchronized with the protocol cluster changes. When the protocol cluster division rules change, the feature screening module receives a protocol cluster change event. The protocol cluster change event includes a list of added, modified, or deleted protocol cluster identifiers. The feature screening module reloads the field feature template according to the change event. The field feature template reloading process first backs up the existing template data, then downloads the latest version of the field feature template from the template database, and finally verifies the integrity and consistency of the template data. The index reconstruction operation of the key fields is automatically triggered after the template is updated. The index reconstruction process scans all field definitions in the new template and recalculates the storage location mapping of each field in the original feature set. The candidate feature subset generation process introduces a quality monitoring link. The quality monitor evaluates the quality indicators of the generated feature subsets in real time. The quality indicators include feature coverage, feature freshness, and feature discrimination. The feature coverage calculates the matching proportion of the candidate feature subset and the original feature set. The feature freshness calculates the difference between the feature value collection time and the current time. The feature discrimination evaluates the coefficient of variation of the feature values between different protocol clusters. When the quality indicators are lower than the preset standard, the quality monitor triggers the feature subset regeneration process. The regeneration process adjusts the matching threshold parameters of the key field indexes.

[0045] The redundancy detection algorithm adopts an adaptive threshold adjustment mechanism. The threshold adjustment mechanism dynamically optimizes the detection parameters according to the changes in the network environment. The network environment monitor collects real-time traffic features, including packet size distribution, protocol type proportion, and traffic peak fluctuation. The Pearson correlation coefficient threshold is automatically adjusted according to the network load. In a high-load network environment, the threshold is relaxed to reduce computational overhead. In a low-load network environment, the threshold is tightened to improve detection accuracy. The minimum contribution parameter of principal component analysis is dynamically calculated according to the feature dimension. When the feature dimension increases, the minimum contribution is correspondingly increased to ensure the feature screening effect. The feature cache area implements a data compression function. The data compression module applies the LZ4 compression algorithm to the stored feature subsets. The LZ4 compression algorithm analyzes the data patterns of the feature values to find repeated sequences. The compressed feature subsets reduce storage space occupation while maintaining fast decompression capability. The feature cache area also integrates a data encryption mechanism. The data encryption mechanism uses the AES-256 algorithm to encrypt and store the feature subsets. The encryption key is periodically rotated by a secure key management system to ensure data security.

[0046] The real-time monitoring of the running state of the dynamic feature filter is achieved through a health check module. The health check module periodically detects the running state of each component of the feature filter, and the detection items include memory usage, CPU occupancy, and processing delay indicators. When an abnormal state is detected, the health check module automatically restarts the faulty component or switches to a backup node, and records the state monitoring data to the system log for performance analysis and troubleshooting. The performance optimization of the feature filter is achieved through a pipeline processing architecture, multiple feature screening stages are executed in parallel, and the output of the previous stage is directly used as the input of the next stage, reducing data transfer delay and improving overall processing efficiency. The mapping relationship between the protocol cluster identifier and the feature cache area is maintained in a distributed hash table, which maps the protocol cluster identifier hash value to the physical storage node. When the system is expanded to add new nodes, the consistent hashing algorithm ensures that the data migration amount is minimized. The feature subset retrieval operation locates the data storage location by querying the distributed hash table, and the retrieval request is distributed to the corresponding storage node through the load balancer. When the storage node returns the feature subset data, the data checksum information is attached to ensure data transmission integrity.

[0047] The interface between the dynamic feature filter and the protocol state analysis model uses a standardized data exchange format, which defines the data structure, metadata information, and version control fields of the feature subset. The interface data transmission is optimized through zero-copy technology, and the feature cache area and the protocol state analysis model share the memory area. The feature subset data is directly mapped to the address space of the protocol state analysis model, avoiding data copy operations and reducing system throughput. The interface also implements a flow control mechanism, which dynamically adjusts the feature subset transmission rate according to the processing capacity of the protocol state analysis model to prevent data congestion or loss.

[0048] Embodiment 3: The processing process of the protocol state analysis model starts from receiving the feature subset, which is transmitted to the model input buffer through a high-speed data bus. The input buffer uses a double-buffer structure to ensure continuous data supply. The time window division module reads the timestamp sequence of the feature subset, with a fixed interval of 100 milliseconds as the time window size, and divides the feature data into continuous feature sequence fragments. Each feature sequence fragment contains 80 feature data points, corresponding to the complete protocol interaction process within the time window.

[0049] The feature sequence segment enters a state encoding pipeline for processing. The state encoder first extracts numerical fields including protocol port number, packet length, transmission time interval, and other continuous variables. The numerical fields are processed by a standardization algorithm using a Z-score normalization method to convert the original feature values into a standard distribution with a mean of 0 and a variance of 1. The standardized feature values are input into a multi-dimensional state space construction module, which has a dimension number consistent with the number of features, i.e., 128 dimensions. Each dimension corresponds to a standardized feature vector. The protocol state vector is calculated by measuring the deviation of the current state from the standard state. The standard state vector is trained from historical normal traffic data and stored in a model parameter database. The deviation is measured using the Mahalanobis distance calculation method, which considers the correlation structure between features. The protocol state vector includes two components: the current state value reflects the instantaneous protocol behavior characteristics, and the historical trend is obtained by comparing the state vectors of the last 10 time windows.

[0050] The abnormal behavior probability distribution generation module receives the protocol state vector as input. The probability distribution calculation is based on a Bayesian inference framework. The prior probability comes from the statistical distribution of known attack patterns, and the likelihood function is constructed by a kernel density estimation method. The matching degree between the feature sequence segment and the attack pattern is calculated using the dynamic time warping algorithm, which can handle time series comparison of different lengths by constructing a cost matrix to find the optimal alignment path. The deviation degree modification module of the protocol state vector calibrates the initial probability distribution. The calibration algorithm constructs a correction function based on the statistical characteristics of the state vector. The correction function considers the volatility and continuity of the state vector, and improves the reliability of the probability distribution by weighted fusion of the current observation value and the historical trend value. The final output of the abnormal behavior probability distribution includes the probability values of 20 attack types, with a range of 0 to 1.

[0051] The multi-dimensional state space construction of the state encoding process uses principal component analysis dimension reduction technology to compress the 128-dimensional feature space to a 32-dimensional principal component space. Principal component analysis achieves dimension compression by calculating the eigenvector of the covariance matrix of the feature values, retaining the principal components with a variance of more than 95%. Euclidean distance calculation is performed in the reduced space to reduce computational complexity while maintaining measurement accuracy. The abnormal level labeling of the protocol state vector is based on the statistical quantile of the distance value, which maps the Euclidean distance value to three abnormal levels. Distance values less than the 25th quantile of the historical distribution are labeled as normal, 25th to 75th quantile interval as observation, and more than 75th quantile as abnormal. The state transition path graph is constructed by recording the change trajectory of the state vector in consecutive time windows. The path graph uses a directed graph structure to represent the state transition rules.

[0052] The numerical field extraction module of the state encoder supports multiple data type processing, including integer, floating point, and enumeration fields. For discrete enumeration fields, a one-hot encoding technique is used to convert to a continuous numerical representation, creating a binary feature dimension equal to the number of enumeration values. The processing of time series fields uses a sliding window statistical method to calculate statistical features within the window, including mean, variance, and autocorrelation coefficients. The storage of protocol state vectors uses a circular buffer structure, maintaining a history of the last 1000 state vectors. The retrieval of historical records is accelerated by indexing, with the index key being the hash value of the state vector and the index value being the timestamp sequence. The similarity calculation of state vectors uses the cosine similarity algorithm to detect repeated protocol state patterns. The generation process of abnormal behavior probability distribution integrates uncertainty estimation, with each probability value accompanied by a confidence indicator. Confidence calculation is based on the coverage and freshness of training data, combining the prediction results of multiple base models through ensemble learning methods. The smoothing of probability distribution uses an exponentially weighted moving average to reduce the impact of transient fluctuations on detection results.

[0053] The state encoding process implements a real-time incremental update mechanism, requiring only local updates to affected state dimensions when new feature sequence segments arrive. The incremental update algorithm avoids full recalculation of historical data by maintaining running statistics of feature values. Version management of state vectors ensures data consistency, generating a new state vector version each time an update is made, with historical versions preserved for rollback analysis. The running monitoring system of the protocol state analysis model tracks processing delays and resource usage, automatically enabling a simplified calculation mode when processing delays exceed a threshold. The simplified calculation mode uses approximation algorithms to accelerate the state encoding process, improving processing throughput while ensuring accuracy. Model performance optimization is achieved through instruction-level parallelism and memory access optimization, using modern processor SIMD instruction sets to accelerate vector calculations. The output interface of the entire protocol state analysis model uses standardized data formats, with protocol state vectors and abnormal behavior probability distributions transmitted to subsequent processing modules through message queues. The message format includes complete metadata information, including timestamp, data version, and checksum fields. The interface implements traffic shaping and backpressure control to ensure that data transmission rates are automatically adjusted when downstream modules have insufficient processing capacity, maintaining stable system operation.

[0054] The formula for the deviation degree of the protocol state vector is: where represents the protocol state vector deviation degree at time t, represents the feature vector at time t, represents the protocol standard state vector, represents the covariance matrix of the feature vector, represents the transpose operator of the matrix, The inverse matrix of the covariance matrix. This formula is dimension-consistent, the left side is a dimensionless scalar, and the right side terms are dimension-consistent after the inverse transformation of the covariance matrix.

[0055] In the embodiment 4, the generation process of the intrusion detection result starts from receiving the protocol state vector and the abnormal behavior probability distribution, the protocol state vector contains 128-dimensional feature data, and the abnormal behavior probability distribution covers risk values of 20 attack types. The risk threshold comparison module loads a preset risk threshold configuration, the preset risk threshold is dynamically adjusted according to a network security policy, the identification of high-risk protocol behaviors is based on the item-by-item comparison between the probability distribution values and the threshold, and the behaviors with the probability distribution values exceeding the preset risk threshold are high-risk protocol behaviors. The positioning of the abnormal protocol cluster identifier is implemented by querying the identifier field in the protocol state vector, and a multi-index lookup technology is used in the positioning algorithm to accelerate the query process.

[0056] The generation of the detection report needs to backtrack the original feature set, the original feature set is stored in a distributed file system, and the retrieval key value is the protocol cluster identifier and the time range. The attack type classification engine analyzes the peak data in the abnormal behavior probability distribution, and identifies the attack characteristics in combination with the time sequence pattern. The conversion process of the defense response instruction involves instruction encoding and protocol packaging, and the instruction sequence is issued to the protocol filtering engine through a network management protocol. The risk threshold configuration adopts a hierarchical structure design, different threshold parameters are used for different protocol types. The threshold parameters are stored in a configuration database, and the database synchronizes the latest policy information every 5 minutes. The identification algorithm of the high-risk protocol behavior traverses all the probability values in the abnormal behavior probability distribution, and marks the probability items exceeding the threshold 0.9 as high-risk behaviors.

[0057] Referring to Table 1, the positioning process of the abnormal protocol cluster identifier uses the inverted index technology, the index key is the hash value of the protocol state vector, and the index value contains the protocol cluster identifier and the storage location information. The positioning algorithm supports fuzzy matching and can handle the case of partial identifier damage. The detection report generator assembles information of multiple data sources, and the report format uses a standardized template. The generation of the defense response instruction needs to parse the structured data in the detection report, and the instruction template library stores the response modes corresponding to various attack types. The protocol filtering rule generator dynamically creates filtering conditions according to the attack characteristics, and the traffic limiting parameter calculation is based on historical traffic pattern analysis. The instruction effective period calculation considers the network load condition to avoid executing strict restrictions during the business peak period. The encapsulation of the instruction sequence uses the ASN.1 encoding rule, and the encoded instruction contains a digital signature to ensure the integrity. The protocol filtering engine takes effect immediately after receiving the instruction, and the execution result is returned through a callback interface to confirm the information. The whole intrusion detection result generation process realizes closed-loop control, and real-time monitors the effect of the defense measures.

[0058] Table 1 shows the risk threshold configuration table

[0059]

[0060] The risk threshold configuration table includes fields such as protocol type, risk level, probability threshold, etc. Each configuration item defines the detection parameters of a specific protocol type. The probability threshold field represents the minimum probability value that triggers a response, the response level field specifies the type of measures to be taken, and the effective period field controls the time range of the defense measures. The probability threshold is an abnormal behavior probability threshold value set for different protocol types and corresponding risk levels to determine whether to trigger a defense response. This probability threshold needs to be determined in combination with network security policies, protocol characteristics, and historical attack data. For example, the probability threshold for HTTP protocol (high risk) is 0.95, the probability threshold for FTP protocol (medium risk) is 0.85, the probability threshold for DNS protocol (low risk) is 0.75, the probability threshold for SMTP protocol (high risk) is 0.92, and the probability threshold for SSH protocol (medium risk) is 0.88. The identification process of high-risk protocol behavior starts a multi-round verification mechanism. The first round of verification checks the persistence of the probability value, requiring a high-risk probability value to persist for 3 detection periods. The second round of verification analyzes the stability of the protocol state vector to exclude false positives caused by transient fluctuations. The third round of verification associates alarm information from other security devices to form a comprehensive judgment result.

[0061] The positioning algorithm of the abnormal protocol cluster identifier implements distributed query, and the query request is broadcast to all storage nodes for parallel processing. Each storage node maintains a local index, and the index update adopts the eventual consistency model. The positioning result merging module aggregates the return data of multiple nodes and uses a voting mechanism to solve conflicting data.

[0062] The generation of the detection report includes attack time range calculation, and the time range is determined based on the change curve of the probability distribution of abnormal behavior. The starting time point is located at the timestamp when the probability value first exceeds the threshold, and the ending time point is located at the timestamp when the probability value falls back to the normal level. The attack type identification uses a multi-classifier integration scheme, combining rule matching and machine learning classification results. The generation process of the defense response instruction includes a policy matching stage, and the policy matching engine calculates the similarity between the attack features in the detection report and the policy library. The matching algorithm uses an improved nearest neighbor search, considering the weight distribution of attack features. The protocol filtering rule generator creates filtering conditions based on five-tuple, supporting CIDR format IP address range matching.

[0063] The traffic limiting parameter calculation is based on a baseline traffic model that learns historical traffic patterns and predicts normal traffic ranges. The limiting value is set to 120% of the baseline traffic, ensuring normal traffic while limiting abnormal traffic. The instruction effective period calculation considers business cycle characteristics, with different period settings for weekdays and holidays. The instruction sequence packaging process includes compression and encryption steps, with LZ4 compression and AES-256-GCM encryption. The instruction header contains version information and timestamps, and the instruction body contains specific operation parameters. The digital signature uses RSA-2048 algorithm, with private keys stored in hardware security modules. The protocol filtering engine execution process implements atomic operations, ensuring transaction consistency for rule delivery and activation. The execution result verification mechanism checks if rules are loaded correctly, and traffic statistics feedback the rule execution effect. The exception handling module captures errors during execution and automatically rolls back failed rule changes. The intrusion detection result generation system implements a gray release mechanism, with new detection algorithms first running on a portion of network nodes. The running effect evaluation is based on false positive and false negative rates, with full implementation after evaluation. The system supports rule hot updates without the need to restart services to change detection strategies.

[0064] The entire intrusion detection result generation process records detailed operation logs, including input data, processing process, and output results. The log analysis system monitors the performance indicators of the processing link and automatically optimizes resource allocation when bottlenecks are found. The audit tracking function meets compliance requirements and records the processing trajectory of security events in detail.

[0065] The defense response instruction execution effect evaluation system continuously monitors network state changes, with evaluation indicators including attack traffic suppression rate and business impact degree. The evaluation results are fed back to the detection strategy optimization module, forming a closed-loop system for continuous improvement. The instruction adjustment mechanism dynamically optimizes response parameters based on evaluation results, achieving adaptive defense.

[0066] Embodiment 5: The process of periodically updating protocol cluster division rules and field feature templates starts with the data collection phase, where network traffic probes continuously monitor communication data from each network node, with a 24-hour collection cycle. Raw traffic data is preprocessed and stored in a distributed database, which uses a sharding architecture to store protocol feature information for different time periods. The frequency monitoring of new protocol types is achieved through a real-time stream processing platform that consumes protocol type events from a Kafka message queue. The frequency calculation algorithm uses a sliding time window model with a 1-hour window size and a 5-minute sliding interval. The frequency threshold is dynamically calculated based on historical baseline data from the past 30 days of protocol type distribution statistics. When the frequency of a certain protocol type exceeds the threshold for three consecutive time windows, the system triggers the protocol cluster expansion process.

[0067] The dynamic expansion mechanism of the protocol cluster identifier maintains an identifier allocation pool, which manages the available identifier range in a bitmap structure. The generation of new protocol cluster identifiers follows the self-increment sequence rule while checking the uniqueness of the identifier. The expansion process updates the protocol cluster mapping table, which records the correspondence between the protocol type and the protocol cluster identifier. The retraining process of the protocol state analysis model uses an offline training mode, and the training data comes from the feature data warehouse. The feature data warehouse stores the protocol feature subset of the last 90 days, and the data format is columnar storage. The training task is triggered by the workflow scheduler, and the model training job is executed at 2:00 am every Sunday. The training algorithm uses a deep neural network architecture, which includes an input layer, a hidden layer, and an output layer.

[0068] The feature standardization and data augmentation operations are performed in the training data preprocessing stage. The standardization method uses the min-max scaling to map the feature values to the [0, 1] interval. Data augmentation expands the training samples by adding noise and time warping to improve the robustness of the model. The training process uses the stochastic gradient descent optimization algorithm, and the learning rate is dynamically decayed according to the training progress. The reserved test data set containing the latest 7 days of new protocol data is used for model validation. The validation indicators include accuracy, recall rate, and F1 score, and the model can be deployed only when the performance reaches the threshold. The blue-green deployment strategy is used for model deployment, and the new model runs in shadow mode for 24 hours to compare the prediction results with the old model.

[0069] The update of the protocol cluster division rule is based on the re-computation of the clustering algorithm, and the clustering feature vector includes the protocol type frequency, port distribution, and load characteristics. The clustering algorithm uses a hierarchical clustering method to generate a tree diagram to show the similarity relationship between protocol types. The division threshold is automatically optimized according to the silhouette coefficient to ensure the quality of the clustering results. The update process of the field feature template analyzes the typical features of the new protocol cluster, and the template generator extracts the statistical features of the protocol fields, including mean, variance, and distribution shape. The template version management system maintains the change history of the template, supporting quick rollback to the previous version. Template verification is performed through syntax checking and instance testing to ensure the correctness of the template. Transaction consistency is guaranteed during system update, and all related component update operations are encapsulated in a distributed transaction. The transaction manager coordinates the update order of each component and performs rollback operations in case of failure. The update progress is monitored in real-time, and the monitoring dashboard displays the completion status of each stage.

[0070] The version control mechanism manages the evolution history of system configurations, with each update generating a new configuration version. Configuration versions are stored in a version repository, supporting configuration difference comparison and selective rollback. Configuration releases adopt a gradual strategy, first deploying in one availability zone, and promoting to all zones after verification. The exception handling mechanism monitors resource usage during system updates, pausing update operations when memory or CPU usage exceeds thresholds. The exception detector analyzes error patterns in logs, identifying common issues during updates. The automatic fixer attempts to resolve recoverable errors, reducing the need for manual intervention.

[0071] Performance optimization measures include training data sampling and feature selection, with sampling algorithms preserving class distribution balance and feature selection removing redundant dimensions. Parallel processing architecture accelerates model training and validation processes, with computation tasks distributed to multiple worker nodes. Cache mechanisms store intermediate results, reducing repeated computation overhead. Post-update validation tests include functional tests verifying correctness of individual components and performance tests evaluating system processing capacity. Test cases cover typical scenarios and boundary conditions, ensuring update reliability. Test reports generate detailed result analysis, providing basis for deployment decisions. Monitoring alarm systems track post-update system running states, with key indicators including detection accuracy, processing latency, and resource utilization. Alarm rules set multi-level thresholds, with different severity events triggering different response processes. Log analysis platforms aggregate running logs from individual components, supporting fault diagnosis and performance optimization.

[0072] Periodic updates of protocol cluster division rules and field feature templates enable the system to adapt to changes in network environments, dynamic expansion of new protocol types guarantees detection completeness, and retraining of protocol state analysis models maintains detection accuracy. These mechanisms collectively ensure the continuous effectiveness of the intrusion detection system.

[0073] It should be noted that the relational terms herein such as first and second and the like are used solely to distinguish one from another entity or action without necessarily requiring or implying that any such entity or action are in fact prior or posterior to one another. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0074] While the embodiments of the present application have been illustrated and described, it will be clear to those skilled in the art that various changes, modifications, substitutions and alterations can be made thereto without departing from the principles and spirit of the application, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for detecting network transmission protocol intrusion, characterized in that, Includes the following steps: Collect network transmission protocol data streams, extract packet header and payload features, and generate an original feature set; The original feature set is classified by protocol type, divided into different protocol clusters, and labeled with protocol cluster identifiers; A dynamic feature filter is constructed based on the protocol cluster identifier to filter out a subset of features associated with the current protocol cluster from the original feature set; Input the feature subset associated with the current protocol cluster into the protocol state analysis model, and output the protocol state vector and the probability distribution of abnormal behavior. Intrusion detection results are generated based on the protocol state vector and the probability distribution of abnormal behavior, and corresponding defense response commands are triggered. The process of constructing a dynamic feature filter based on protocol cluster identifiers to filter out a subset of features associated with the current protocol cluster from the original feature set includes: Load the field feature template corresponding to the protocol cluster identifier, and extract the key field index from the field feature template; Based on the key field index, match related features from the original feature set to generate a subset of candidate features; Redundancy detection is performed on the candidate feature subset, and redundant features that are more than the feature correlation threshold with other features are removed to obtain the filtered feature subset associated with the current protocol cluster. Store the filtered feature subset associated with the current protocol cluster into the feature cache area according to the protocol cluster identifier; Based on the filtered feature subset associated with the current protocol cluster, the standard state vector of the protocol cluster is trained from the historical normal traffic data of the protocol cluster. The processing steps of the protocol state analysis model include: Receive the filtered feature subset associated with the current protocol cluster, and divide it according to a time window to generate multiple feature sequence fragments; Each feature sequence segment is state-encoded to obtain a protocol state vector containing the current state value and historical change trends; Calculate the matching degree between feature sequence fragments and known attack patterns to generate anomaly behavior probability distribution; The degree of deviation of the protocol state vector is obtained by calculating the Mahalanobis distance between the protocol state vector and the standard state vector of the protocol family in the multidimensional state space. The probability distribution of abnormal behavior is corrected based on the degree of deviation from the protocol state vector; The process of state encoding for each feature sequence segment includes: Extract numerical fields from feature sequence fragments to construct a multidimensional state space; Calculate the Euclidean distance between the current eigenvalue and the protocol standard state in the multidimensional state space; The anomaly level of the protocol state vector is marked according to the fluctuation range of the Euclidean distance; Generate a state transition path diagram by combining historical state vectors; By integrating the anomaly level and state transition path graph information of the protocol state vector, the state encoding of each feature sequence segment is completed.

2. The network transmission protocol intrusion detection method according to claim 1, characterized in that, The data stream of the collected network transmission protocol is used to extract the header and payload features of the data packets. Generate the original feature set, including: Listen for packet capture events on the network interface and record the arrival timestamp and transmission direction of the packets; Parse the header fields of the data packet to extract the source address, destination address, port number, and protocol type; Segmented hashing is performed on the data packet payload to generate payload feature fingerprints; The header field and payload feature fingerprint are merged into the original feature set in timestamp order.

3. The network transmission protocol intrusion detection method according to claim 1, characterized in that, The process of classifying the original feature set by protocol type, dividing it into different protocol clusters, and labeling the protocol clusters with identifiers includes: Calculate the frequency of protocol types in the original feature set and generate a protocol frequency distribution table; Based on the protocol frequency distribution table, a protocol clustering rule is constructed, and protocol types that appear more frequently than the protocol frequency threshold are classified into independent protocol clusters. Protocol types in the original feature set that were not assigned to an independent protocol cluster are the remaining protocol types; The remaining protocol types are clustered based on similarity, and protocol types with the same header field pattern are merged into a hybrid protocol cluster; Assign a unique identifier to each protocol cluster, obtain the protocol cluster identifier, and record the field feature template corresponding to the protocol cluster identifier.

4. The network transmission protocol intrusion detection method according to claim 1, characterized in that, The process of generating intrusion detection results based on the protocol state vector and the probability distribution of abnormal behavior includes: Compare the probability distribution of abnormal behavior with a preset risk threshold, and mark behaviors whose probability distribution value of abnormal behavior exceeds the preset risk threshold as high-risk protocol behaviors; Extract the protocol state vector corresponding to high-risk protocol behavior, and locate the abnormal protocol cluster identifier by querying the identifier field in the protocol state vector; Based on the abnormal protocol cluster identifier, the original feature set is traced back to generate a detection report containing the attack type and time range; The detection report is converted into a defense response command and sent to the protocol filtering engine.

5. The network transmission protocol intrusion detection method according to claim 4, characterized in that, The process of generating the defense response command includes: Parse the attack types in the detection report and match them against a predefined response strategy library; Extract protocol filtering rules and traffic rate limiting parameters from the response policy library; The effective period of the instruction is determined based on the time range; The filtering rules and rate limiting parameters are encapsulated into an executable instruction sequence.

6. The network transmission protocol intrusion detection method according to claim 1, characterized in that, Also includes: Regularly update protocol cluster partitioning rules and field feature templates; The protocol cluster identifier is dynamically expanded based on the frequency of occurrence of new protocol types; The protocol state analysis model was retrained to adapt to the updated protocol features.

7. A network transmission protocol intrusion detection system, characterized in that, It includes a processor and a memory, the memory storing a computer program that, when executed by the processor, implements the steps of the network transmission protocol intrusion detection method according to any one of claims 1 to 6.

Images