Real-time intrusion detection system and method based on deep learning

Abstract

The invention discloses a real-time intrusion detection system and method based on deep learning, and aims to solve the problem that when the existing deep learning intrusion detection technology processes high-dimensional network flow data, the information fidelity and the real-time processing efficiency are difficult to consider at the same time. According to the system and the method, a heterogeneous feature decoupling and fusion network architecture is adopted, high-dimensional feature vectors are losslessly decomposed into feature subsets of static state, time sequence, graph topology association and the like, deep learning is carried out by a parallel coding subsystem, cross-modal fusion attention self-adaptive aggregation is carried out, and finally classification judgment is realized. According to the scheme, on the basis of keeping the integrity of high-dimensional data, the detection capability and the real-time processing efficiency of unknown attacks are remarkably improved, and the self-adaptability and the robustness are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, and particularly relates to a real-time intrusion detection system and method based on deep learning. BACKGROUND

[0002] Under the background of the current digital deep transformation era, network information security has become the core cornerstone of maintaining the normal operation of society, ensuring the safety of national critical information infrastructure, and promoting the healthy development of the digital economy. With the continuous escalation of network attack and defense confrontation, attack means are increasingly showing the characteristics of concealment, intelligence and persistence, which makes the intrusion detection system (Intrusion Detection System, IDS) as the first key line of network security face unprecedented severe challenges. Traditional intrusion detection technologies, such as rule matching methods based on specific attack signatures or statistical analysis methods based on traffic behavior baselines, although have certain effectiveness in dealing with known attacks, but their technical paradigm inherently determines that their recognition ability for unknown attack patterns such as zero-day attacks (Zero-day Attack) and advanced persistent threats (Advanced Persistent Threat, APT) has a congenital deficiency, and it is difficult to meet the urgent needs of modern network environment for high-precision and low-delay detection capability.

[0003] To overcome the aforementioned limitations, those skilled in the art have conducted extensive and in-depth research and proposed a series of intelligent intrusion detection schemes based on machine learning and deep learning. Among them, Chinese patent document CN114448599B discloses an intrusion detection method and system based on Bayesian deep learning. This scheme creatively introduces an architecture that combines edge computing and cloud computing, deploying lightweight detection nodes at the network edge and linking them with a global model in the cloud, aiming to balance detection performance and system resource overhead. Specifically, this technology uses a Bayesian deep learning model to quantify the uncertainty of network data and adaptively adjust the data sampling strategy accordingly, which theoretically provides an effective way to improve the robustness of the model in complex network environments. The design idea of ​​this scheme is to address the challenges of data heterogeneity and dynamism in large-scale networks through distributed collaboration and probabilistic modeling, representing an important attempt to promote the intelligent and distributed development of intrusion detection technology. Furthermore, another Chinese patent document, CN112437053B, approaches the issue from the perspective of data preprocessing, proposing a method to optimize the performance of intrusion detection models through feature dimensionality reduction. The core of this solution lies in addressing the high dimensionality and redundancy inherent in network traffic data. By employing dimensionality reduction techniques such as Principal Component Analysis (PCA), the complexity of the input to subsequent deep learning models is effectively reduced while preserving key information. This approach not only significantly shortens model training time and improves convergence efficiency but also alleviates overfitting caused by the "curse of dimensionality" to some extent, thereby enhancing the detection accuracy for known attack types in specific scenarios.

[0004] However, with the continuous development of related technologies and the increasingly stringent performance requirements of application scenarios, some inherent characteristics of the aforementioned technical solutions at the principle level have gradually revealed their limitations in addressing new challenges. At its root, existing technical approaches generally fall into a deep-seated technical contradiction: the inherent conflict between the fidelity of high-dimensional data information and the real-time processing efficiency of the model. Specifically, the dimensionality reduction processing path represented by CN112437053B is essentially a strategy of "trading information for efficiency." While reducing data dimensionality can accelerate model processing, the dimensionality reduction process itself is a lossy compression, inevitably discarding some feature information deemed secondary by the algorithm. In modern advanced attacks, attackers often conceal their actions by creating small, coordinated perturbations on multiple seemingly unrelated network traffic parameters. These crucial attack fingerprints are precisely contained within the complex nonlinear correlations of the high-dimensional feature space. Once dimensionality reduction is performed, these weak but critical signals are highly likely to be filtered out as noise, causing the model to "blind" such carefully designed complex or unknown attacks, resulting in fatal false negatives.

[0005] In contrast, another technical approach, represented by CN114448599B, ​​attempts to directly process high-dimensional raw data by constructing more complex and sophisticated models (such as Bayesian deep learning), striving to preserve information fidelity to the maximum extent. However, this choice pushes the system to another extreme: the complexity of the model itself becomes a performance bottleneck. To perform uncertain inference, the parameter space and computational process of Bayesian deep learning models are far more complex than standard deep learning models, resulting in slower training convergence and higher inference latency on high-dimensional data. In real-time intrusion detection scenarios requiring millisecond-level responses, this computationally heavy burden makes it difficult for the system to keep up with the processing requirements of high-speed network data streams. Furthermore, the edge-cloud collaborative architecture it relies on, when facing high-load attacks such as large-scale distributed denial-of-service (DDoS) attacks, can cause significant communication latency and network congestion due to frequent model parameter interactions and data uploads. This not only fails to improve real-time performance but may also become a new attack point, leading to a decrease in the responsiveness of the entire detection system or even paralysis.

[0006] In summary, current mainstream deep learning intrusion detection technologies essentially involve a difficult trade-off between two core metrics: data fidelity and model real-time performance. This often involves sacrificing data integrity for model processing speed, or pursuing model completeness at the expense of real-time system responsiveness. This either-or technical dilemma makes it consistently difficult for existing systems to simultaneously meet the two critical requirements of high generalization capability against unknown attacks and high real-time processing of massive data streams.

[0007] Therefore, how to construct a novel deep learning detection framework that can achieve efficient model training and rapid convergence without significantly sacrificing the fidelity of the original high-dimensional data, and possess strong generalization ability to unknown attack patterns and millisecond-level real-time response capability, thereby fundamentally breaking through the inherent contradiction between data fidelity and real-time processing in existing technologies, has become a key challenge and an urgent technical problem for those skilled in the art. Summary of the Invention

[0008] The technical problem this invention aims to solve is that existing deep learning-based intrusion detection technologies generally face an inherent conflict between the fidelity of high-dimensional data information and the real-time processing performance of models when processing high-dimensional network traffic data. Specifically, the approach of using dimensionality reduction preprocessing sacrifices data integrity for processing speed, resulting in insufficient detection capability for complex, unknown attacks that exploit weak correlations between high-dimensional features; while the approach of directly processing high-dimensional data with complex models preserves information fidelity, the huge computational overhead and inference latency make it difficult to meet the stringent requirements of real-time detection. This either-or technical dilemma limits existing systems from simultaneously achieving high generalization capability against unknown attacks and high real-time processing capability for massive data streams.

[0009] To achieve the above-mentioned objectives, this invention provides a real-time intrusion detection system and method based on deep learning. By constructing a heterogeneous spatiotemporal feature decoupling and fusion attention network architecture, it fully preserves the integrity of the original high-dimensional data information, performs efficient feature extraction through a parallelized dedicated encoder targeting the characteristics of the feature subspace, and utilizes a cross-modal fusion attention mechanism for adaptive deep feature aggregation, thereby fundamentally breaking through the technical barrier between data fidelity and real-time processing.

[0010] According to one aspect of the present invention, a real-time intrusion detection system based on deep learning is provided, the system comprising: A data acquisition and preprocessing module, which is set in the network infrastructure, is used to capture network data streams in real time, parse the network data streams into a series of standardized session records, and deterministically extract a high-dimensional feature vector containing multiple original network traffic parameters from each session record. A heterogeneous feature decoupling module, whose data input end is connected to the output end of the data acquisition and preprocessing module, is used to receive the high-dimensional feature vector and decompose the high-dimensional feature vector into at least three mutually independent feature subsets without loss according to the preset feature attribute partitioning rules. The feature subsets specifically include: a static attribute feature subset, a time series feature subset, and a graph topological association feature subset. A parallel coding subsystem includes at least three parallel and structurally different feature encoders. Each feature encoder corresponds to and is connected to a feature subset output of the heterogeneous feature decoupling module. The subsystem is used to perform deep feature learning on its respective received feature subset in parallel and output the corresponding high-dimensional feature embedding representation. A cross-modal fusion attention module establishes a data connection between its data input end and the output ends of all feature encoders in the parallel coding subsystem. It is used to receive the multiple high-dimensional feature embedding representations and generate a single fusion feature vector that can characterize the global attack mode through an attention weight calculation and weighted fusion process. It also includes a classification output module, whose data input is connected to the output of the cross-modal fusion attention module. This module receives the fused feature vector and, through a feedforward neural network classifier, calculates the probability distribution of whether the current network session belongs to a predefined attack category or a normal category, and outputs the final intrusion detection decision.

[0011] Furthermore, the data acquisition and preprocessing module physically connects to the network link to be monitored via a network splitter (TAP) or switch port mirroring (SPAN) function. Internally, the data acquisition and preprocessing module integrates a packet capture unit and a session reconstruction unit. The packet capture unit employs zero-copy kernel bypass technology, directly capturing raw data packets from the network interface controller's (NIC) receive ring buffer to avoid processing overhead introduced by the operating system protocol stack. The session reconstruction unit aggregates the captured data packets based on the five-tuple information of the packet's source IP address, destination IP address, source port number, destination port number, and transport layer protocol, forming a logical network session flow. The data acquisition and preprocessing module further includes a feature extraction unit, which calculates and extracts a fixed-length high-dimensional feature vector for each constructed network session, consisting of K numerical and categorical features, where K is a preset positive integer greater than 100. The features include, but are not limited to: session duration, protocol type encoding, service type encoding, connection status flags, number of bytes from source to destination, number of bytes from destination to source, total number of packets, source IP address, destination IP address, source port number, destination port number, and the mean, variance, minimum, and maximum of the inter-arrival time calculated based on the packet timestamps within the session.

[0012] Furthermore, the heterogeneous feature decoupling module internally embeds a set of deterministic feature indexing and mapping rules. These rules uniquely map each dimension of the K-dimensional high-dimensional feature vector to one of the static attribute feature subset, the time-series feature subset, or the graph topology association feature subset. Specifically, features such as protocol type encoding, service type encoding, and connection status flags, which remain unchanged or change very infrequently within a single session's lifecycle, are assigned to the static attribute feature subset. Features such as continuous packet arrival time interval sequences and packet size sequences, which reflect the dynamic evolution of session behavior, are organized into a time series and assigned to the time-series feature subset. Identifier-type features such as source IP address, destination IP address, source port number, and destination port number, which characterize the communication relationship between network entities, are assigned to the graph topology association feature subset, serving as the basis for subsequent graph structure construction of nodes and edges. This decoupling process is purely data reassembly, without involving any information transformation or discarding, ensuring zero information loss.

[0013] Furthermore, the three feature encoders in the parallel coding subsystem are: a static attribute encoder, a time series encoder, and a graph topology encoder.

[0014] The static attribute encoder is a multilayer perceptron (MLP) network specifically designed to process the subset of static attribute features. The MLP network consists of an input layer, L hidden layers, and an output layer, where L is a preset integer, such as 3. Each hidden layer comprises multiple neurons and uses a Rectified Linear Unit (ReLU) as the activation function. A Layer Normalization layer is connected after the activation function of each hidden layer to accelerate model convergence and improve training stability. The final output of the static attribute encoder is a fixed-dimensional (e.g., 64-dimensional) static feature embedding vector. .

[0015] The time series encoder is a bidirectional gated recurrent unit (Bi-GRU) network specifically designed to process the time series feature subset. The Bi-GRU network consists of a stacked forward GRU layer and a backward GRU layer. This structure can simultaneously capture historical and future information from the time series data, thus providing a more comprehensive understanding of the sequence's contextual dependencies. The hidden state dimension of the GRU unit is set to a preset value, such as 128. The time series encoder concatenates the hidden state vectors from the last time step in both directions to generate a fixed-dimensional (e.g., 256-dimensional) time series feature embedding vector. .

[0016] The graph topology encoder is a graph attention network (GAT) specifically designed to process the graph topology association feature subset. Within each preset time window (e.g., 1 second), the system first dynamically constructs a communication relationship graph G=(V,E) using the graph topology association feature subset of all sessions within that window. Here, the node set V represents all unique IP addresses appearing within the time window, and the edge set E represents the communication sessions established between these IP addresses. The graph attention network receives this communication relationship graph as input and learns the neighborhood information of nodes in the graph by stacking multiple graph attention layers. Each graph attention layer employs a multi-head attention mechanism, enabling the model to learn the importance of neighboring nodes from different representation subspaces. The graph topology encoder generates an embedding representation for each node in the graph and, through a graph-level readout function (such as averaging or summing all node embedding vectors), finally generates a fixed-dimensional (e.g., 128-dimensional) graph topology feature embedding vector. .

[0017] Furthermore, the core of the cross-modal fusion attention module is an attention mechanism based on the query-key-value paradigm, used to compute three feature embedding vectors. , and The dynamic fusion weights are calculated as follows: First, the high-dimensional features of the three inputs are embedded into the representation. , and The features are concatenated to form an aggregated intermediate representation. =[ ].

[0018] Secondly, the intermediate representation of the aggregation is derived through an independent, learnable linear transformation. Generate a global context query vector Q: in It is a learnable weight matrix.

[0019] Then, the three independent features are embedded into the representation. , and These serve as the sources of keys and values, respectively, and generate their respective key vectors and value vectors through two additional sets of learnable linear transformations: in and These are all learnable weight matrices within this module.

[0020] Next, the query vector Q is calculated in relation to each key vector. The attention score between them is calculated, and a scaling dot product operation is used to prevent the gradient from becoming too small. in It is the dimension of the key vector.

[0021] Then, all attention scores were passed through a The function is normalized to obtain the final attention weights for each feature mode. : Finally, the calculated attention weights are used to match the corresponding value vectors. A weighted summation is performed to generate the final, highly condensed fusion feature vector. : This process enables the system to adaptively determine, based on the specific patterns of the input data, which information—static attributes, time-series dynamics, or network topology correlations—is more critical for the current intrusion decision and assigns it higher weight.

[0022] Furthermore, the classification output module is a standard feedforward neural network. This network receives the... As input, it contains at least one hidden layer, and with The function serves as the activation function for the output layer. The number of neurons in the output layer equals the total number of predefined categories (e.g., normal, DoS attack, probe attack, R2L attack, U2R attack, etc.). The category with the highest probability value in the output probability vector is used as the final decision for this detection. The system also includes a model training and update unit that stores the neural network model parameters for the entire system. During the offline phase, this unit trains the entire end-to-end system using a large-scale dataset with precise labels (such as CIC-IDS2017 or NSL-KDD), adjusting all learnable weight matrices by minimizing the cross-entropy loss function using the backpropagation algorithm and the Adam optimizer. After system deployment, this unit supports periodic incremental updates, fine-tuning the model using manually verified real attack samples to continuously adapt to new attack patterns emerging in the network environment.

[0023] According to another aspect of the present invention, a real-time intrusion detection method based on deep learning is also provided, the method being executed on the hardware and software architecture of the aforementioned system, and comprising at least the following steps: S100: Data Acquisition and Feature Extraction. Raw network data packets are captured in real-time via the network interface, session reconstruction is performed on the data packets, and a pre-defined K-dimensional high-dimensional feature vector is extracted for each network session.

[0024] S200: Heterogeneous Feature Decoupling. The K-dimensional high-dimensional feature vector is received and, according to the fixed feature index mapping rules, it is losslessly decomposed into a static attribute feature subset, a time series feature subset, and a graph topological association feature subset.

[0025] S300: Parallelized deep encoding. The three decomposed feature subsets are fed into their respective dedicated encoders for parallel processing. S310: Encode the static attribute feature subset using a multilayer perceptron network to generate a static feature embedding vector. .

[0026] S320: Encode the time series feature subset using a bidirectional gated recurrent unit network to generate a time series feature embedding vector. .

[0027] S330: Based on a subset of graph topological association features from all sessions within a time window, a communication relationship graph is dynamically constructed, and a graph attention network is used to encode the graph to generate graph topological feature embedding vectors. .

[0028] S400: Cross-modal attention fusion. It embeds three feature vectors generated through parallel encoding into a single vector. , and The input is fed into the cross-modal fusion attention module. Based on the aforementioned attention mechanism based on the query-key-value paradigm, dynamic attention weights are calculated and the value vectors of each modality are weighted and summed to generate a single fusion feature vector. .

[0029] S500: Classification and Decision. The fused feature vector... The input is fed into a feedforward neural network classifier, which calculates and outputs the probability distribution of the category to which the current network session belongs, and takes the category with the highest probability as the final intrusion detection result.

[0030] The beneficial effects of this invention are: 1. This invention fundamentally resolves the contradiction between high-dimensional data fidelity and real-time model processing efficiency. Instead of employing any form of lossy dimensionality reduction or feature selection, it decomposes the massive computational task previously undertaken by a single complex model into parallel processing by multiple simpler and more computationally efficient dedicated encoders, while fully preserving all original feature information. This approach significantly reduces the overall model's computational complexity and inference latency while maintaining information fidelity, achieving a balance between high accuracy and high real-time performance.

[0031] 2. Significantly improved detection capability for advanced unknown attacks. This invention innovatively introduces a graph topology encoder, specifically designed to mine deep, non-linear topological relationships between entities from network traffic. This enables the system to effectively capture complex attack patterns such as advanced persistent threats (APTs) and distributed cooperative attacks that conceal themselves by creating small, coordinated perturbations on multiple network parameters. These attack fingerprints are easily overlooked in traditional methods, while the graph attention network of this invention can accurately identify such key evidence hidden in high-dimensional relationships, thereby significantly improving the generalization ability to identify unknown and covert attacks.

[0032] 3. High Adaptability and Robustness. The cross-modal fusion attention module designed in this invention endows the system with the ability to dynamically evaluate the importance of different feature dimensions. Faced with different types of network attacks, their attack characteristics may mainly manifest in different feature subspaces. For example, DoS attacks may mainly manifest as anomalies in time series features, while network scanning mainly manifests as changes in static attributes and topology. The attention mechanism of this invention can automatically assign the most reasonable feature weights to specific input data, making the model decision-making process more interpretable and enabling the system to exhibit stronger adaptability and detection robustness in complex and ever-changing network environments.

[0033] 4. The system architecture boasts superior engineering scalability and feasibility. The modular design proposed in this invention, including data acquisition, feature decoupling, parallel encoding, fusion, and classification, features a clear structure and rigorous logic. Each module is functionally independent, facilitating step-by-step implementation, testing, and optimization. In particular, the design of the parallel encoding subsystem is naturally suited for deployment on parallel computing hardware such as multi-core CPUs or GPUs, fully leveraging the parallel processing capabilities of modern computing platforms. This further ensures the system's real-time response capability when processing ultra-high-speed network (e.g., 40Gbps / 100Gbps) data streams, demonstrating extremely high engineering application value. Attached Figure Description

[0034] Figure 1 This is a block diagram illustrating the system structure principle of the present invention.

[0035] The attached figures are labeled as follows: 10, Data acquisition and preprocessing module; 20, Heterogeneous feature decoupling module; 30, Parallel coding subsystem; 31, Static attribute encoder; 32, Time series encoder; 33, Graph topology encoder; 40, Cross-modal fusion attention module; 50, Classification output module. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it.

[0037] Reference Figure 1 This invention provides a specific implementation scheme for a real-time intrusion detection system and method based on deep learning. The system's overall architecture is precisely divided into a series of highly cohesive functional and tightly coupled data modules, aiming to systematically resolve the core conflict between fidelity and real-time performance in existing high-dimensional network traffic data processing technologies. The system mainly includes a data acquisition and preprocessing module 10, a heterogeneous feature decoupling module 20, a parallel coding subsystem 30, a cross-modal fusion attention module 40, and a classification output module 50. These modules work collaboratively to form a complete and efficient processing pipeline from raw packet capture to final attack determination.

[0038] In a specific application scenario, the system described in this invention is deployed at the network core switching node of an enterprise-level data center to monitor all network traffic entering and leaving the data center. The data acquisition and preprocessing module 10, as the front end of the system, has its physical interface connected to a 40Gbps backbone fiber optic link in a passive and non-intrusive manner via an optical network splitter (TAP). The internal hardware core of module 10 is a high-performance server equipped with a dedicated network processing chip (NP) and configured with a network interface controller (NIC) supporting kernel bypass technology. The software implementation within the module includes a packet capture unit and a session reconstruction unit. The packet capture unit utilizes the DPDK (DataPlane Development Kit) framework to implement a zero-copy packet capture mechanism. This mechanism allows applications to directly capture raw Ethernet frames from the NIC's hardware receive ring buffer (RxRingBuffer), completely bypassing the operating system kernel's TCP / IP protocol stack, thereby eliminating the significant overhead of context switching, memory copying, and protocol processing, ensuring no packet loss occurs at 40Gbps line speed.

[0039] Next, the session reconstruction unit parses and aggregates the captured data packet stream in real time. This unit maintains a dynamic hash table, using the five-tuple information of the data packet's source IP address, destination IP address, source port number, destination port number, and transport layer protocol (TCP / UDP / ICMP, etc.) as keys, and session state information (such as TCP connection state, sequence number, number of bytes transmitted, etc.) as values. All data packets with the same five-tuple are grouped into the same logical network session. This unit also sets a session timeout mechanism; for example, a TCP session is considered terminated if there is no data packet activity within 120 seconds or if a FIN / RST flag is received; a UDP session is considered terminated if there is no activity within 60 seconds.

[0040] When a network session is determined to have ended, all statistical information of that session is passed to the feature extraction unit. This unit is the final processing step in the data acquisition and preprocessing module 10, and its core function is to calculate and generate a standardized, fixed-length high-dimensional feature vector for each independent network session. In this embodiment, the dimension K of this feature vector is set to 128 dimensions. These 128 features are carefully designed to comprehensively characterize the behavioral patterns of the session from multiple dimensions. They can be categorized as follows: First, there are 22 basic session statistics. These include: session duration (seconds), transport layer protocol type (using one-hot encoding, such as [1,0,0] for TCP, [0,1,0] for UDP, and [0,0,1] for ICMP), network service type (such as HTTP, FTP, SSH, etc., encoded as integers using a predefined dictionary), TCP connection status flags (such as SF, S0, REJ, etc., also encoded as integers), total number of bytes from source to destination, total number of bytes from destination to source, total number of data packets from source to destination, total number of data packets from destination to source, and total number of data packets, total number of bytes, average packet size, number of data packets containing the Urgent (URG) flag, and number of data packets containing the Push (PSH) flag.

[0041] Secondly, there are 60 dynamic time-series features. These features aim to capture the dynamic evolution of intra-session behavior over time. The feature extraction unit records the inter-arrival time (IAT) and packet size of the first 30 packets in the session. For short sessions with fewer than 30 packets, zero values ​​are used for post-padding; for long sessions with more than 30 packets, the information from the first 30 packets is extracted. Thus, each session generates two time series of length 30. These two series constitute the 60 original time-series feature values.

[0042] Then there are the content and host behavior characteristics, totaling 46. These include, but are not limited to: source and destination IP addresses (which are anonymized before being fed into the model and are only used to build the graph structure), source and destination port numbers, the average TCP window size in source-to-destination packets, the average TCP window size in destination-to-source packets, and some behavioral characteristics related to the current session host based on sliding time windows (e.g., within the last 2 seconds), such as "the number of connections with the same destination host as the current session," "the number of connections with the same destination host and the same service as the current session," and "the proportion of connections with the same service as the current host in the past 100 connections." These characteristics are introduced to characterize the short-term behavior patterns of the host.

[0043] At this point, the data acquisition and preprocessing module 10 has completed its mission and will output the generated 128-dimensional high-dimensional feature vector to the next module.

[0044] The data input of the heterogeneous feature decoupling module 20 is directly connected to the output of module 10. The internal logic of this module is extremely clear and efficient; essentially, it is a pure software component that solidifies deterministic feature index mapping rules. These rules are based on a deep understanding of the intrinsic attributes of different features, aiming to decompose the comprehensive 128-dimensional feature vector losslessly and orthogonally into three subspaces with different physical or logical meanings. This process does not involve any mathematical transformations or information reduction; it is merely a reorganization and reinterpretation of the data.

[0045] Specifically, the mapping rule is as follows: Among the 128-dimensional feature vectors mentioned above, the basic session statistical features with indices 1 to 22 are classified as static attributes because they remain unchanged once determined within the lifecycle of a single session, or their changes do not have temporal dependencies. These features are extracted to form a 22-dimensional subset of static attribute features.

[0046] The time-series dynamic features indexed from 23 to 82, namely 30 packet arrival time values ​​and 30 packet size values, inherently contain the evolution of session behavior and are typical time-series data. These 60 feature values ​​are organized into a 2×30 two-dimensional array or two independent one-dimensional sequences of length 30, together forming a subset of time-series features.

[0047] The remaining indices, numbers 83 to 128, contain features, particularly source / destination IP addresses and port numbers, as well as statistical features describing inter-host connectivity. Their core value lies in characterizing the communication topology relationships between different entities (IP addresses) within the network. These features are extracted to form a subset of graph topology association features. This subset will serve as the raw material for the subsequent dynamic construction of the communication relationship graph.

[0048] Through the processing of the heterogeneous feature decoupling module 20, a single, hybrid high-dimensional vector is clearly decomposed into three independent and distinctive feature sets. This step forms the logical basis for subsequent parallel and specialized processing, ensuring that each type of feature can be processed by an encoder best suited to its data structure.

[0049] Next, these three feature subsets are fed into the parallel encoding subsystem 30 in parallel. This subsystem is the core of the present invention to achieve a balance between high performance and high accuracy. It consists of three deep learning encoders with different structures and deployed in parallel: a static attribute encoder 31, a time series encoder 32, and a graph topology encoder 33.

[0050] The static attribute encoder 31, as a multilayer perceptron (MLP) network, is specifically responsible for processing a 22-dimensional subset of static attribute features. In this embodiment, its network structure is precisely designed as follows: an input layer containing 22 neurons; three hidden layers with 128, 96, and 64 neurons respectively; and a 64-dimensional output layer that produces the final embedded representation. Each hidden layer uses a rectified linear unit (ReLU) as a non-linear activation function. To accelerate the model's layer normalization, the outputs of the neurons in this layer are normalized. This normalization operation helps alleviate the internal covariate shift problem, making the model training process more stable and convergent faster. After the static attribute feature subset passes through the forward propagation of this MLP network, it finally outputs a highly condensed static feature embedding vector with a dimension of 64, denoted as . .

[0051] Meanwhile, the time-series encoder 32 receives a subset of time-series features for processing. This encoder employs a bidirectional gated recurrent unit (Bi-GRU) network structure. The input data consists of two sequences of length 30 (inter-packet arrival time and packet size). Before entering the network, these two sequences are concatenated or otherwise combined into an input format suitable for GRU processing, such as a sequence of length 30 with a feature dimension of 2 at each time step. The Bi-GRU network consists of a forward GRU layer and a backward GRU layer, with the hidden state dimension of each GRU unit set to 128. The forward GRU layer processes the sequence sequentially from time step 1 to 30, capturing the influence of historical information on the current state; the backward GRU layer processes the sequence in reverse order from time step 30 to 1, capturing the influence of future information on the current state. This bidirectional structure allows the model to comprehensively consider past and future contextual information at any time step. After processing the entire sequence, the time series encoder 32 concatenates the 128-dimensional hidden state vector of the last time step of the forward GRU with the 128-dimensional hidden state vector of the last time step of the backward GRU (i.e., time step 1). This generates a static feature embedding vector of dimension 256 that integrates bidirectional temporal dependency information, denoted as [vector name missing]. .

[0052] In parallel, the graph topology encoder 33 processes a subset of graph topology association features. Its processing method differs significantly from the previous two; it does not encode individual sessions independently, but rather focuses on a macroscopic time window. In this embodiment, the system sets a 1-second time window. The graph topology encoder 33 first aggregates the subset of graph topology association features for all network sessions generated within this 1-second window. Based on this information, it dynamically constructs a communication relationship graph G=(V,E). Here, the node set V represents all unique IP addresses that appear as communication sources or destinations within this 1-second window. Each node can be assigned an initial feature vector, for example, a simple one-hot encoding representing its role in the network (such as server, client), or a learnable embedding vector. The edge set E represents the actual network sessions that occurred between these IP addresses. Each edge can also have attributes, such as the protocol type of the session, the total number of bytes, etc., which are also derived from the graph topology association feature subset.

[0053] The constructed communication graph G is then fed into a Graph Attention Network (GAT) for encoding. In this embodiment, the GAT consists of three stacked graph attention layers. Each layer employs a multi-head attention mechanism, specifically four attention heads. This means that at each layer, for each node in the graph, the model learns the importance of its neighboring nodes in parallel from four different representation subspaces and aggregates neighborhood information. The multi-head mechanism greatly enhances the model's expressive power, enabling it to capture rich and complex dependencies between nodes. After propagation and updating through the three graph attention layers, each node in the graph obtains an information-rich embedding representation that integrates its initial features and the topological structure information of its multi-order neighborhood. Finally, to obtain a global embedding vector that represents the entire graph state, the system employs a graph readout function. In this embodiment, this function performs mean pooling on the final embedding vectors of all nodes in the graph. This operation generates a 128-dimensional graph topological feature embedding vector, denoted as . This vector macroscopically represents the patterns and anomalies in the entire network communication topology over the past second. It is worth noting that, although... It is calculated based on a time window, but when making a decision about a specific session, the time window corresponding to that session is used. vector.

[0054] At this point, the parallel coding subsystem 30 has completed its mission, transforming the original, high-dimensional, heterogeneous feature information into three independent, semantically clear, fixed-dimensional deep feature embedding vectors: (64-dimensional) (256 dimensions) and (128 dimensions).

[0055] These three feature embedding vectors are then fed together into the cross-modal fusion attention module 40. This module is key to achieving adaptive decision-making for different attack patterns. Its core is a sophisticated attention mechanism based on the query-key-value paradigm, whose goal is to dynamically compute... , and The relative importance of these three information sources in the current decision-making process is determined, and a weighted fusion is performed accordingly.

[0056] Its internal computational process is rigorous and precise. First, in order to generate a query vector that is aware of the global context, the module embeds the features of the three inputs into a vector. , and By concatenating along the feature dimensions, an aggregated intermediate representation is formed. Its dimensions are 64 + 256 + 128 = 448. Then, it undergoes a learnable linear transformation matrix. (dimension is) x448, of which For the query vector dimension, e.g., 128), from Generate global context query vector ,Right now .

[0057] Secondly, embed the three independent feature vectors , and These serve as the sources of keys and values, respectively. Six independent, learnable linear transformation matrices are used. , , , , and This generates their respective key vectors and value vectors. For example, = * , = * Here, the dimensions of all key vectors... Set as a query vector Dimensions Equal, i.e., 128 dimensions, while the dimensions of all value vectors are equal. It can be set independently, for example, it can also be set to 128 dimensions.

[0058] Next, calculate the query vector. With each key vector The similarity between them is the attention score. This process is accomplished using ScaledDot-ProductAttention to ensure that... The stability of the gradient at higher dimensions. The calculation formula is: in T This indicates the transpose operation. It is the scaling factor. and It is calculated in the same way. These three scalar scores intuitively reflect the global context. The degree of attention paid to each feature modality.

[0059] Then, these three attention scores are combined into a vector. , , ], and input it into a In the function. The function normalizes these scores, converting them into a probability distribution that sums to 1, which is the final attention weight for each feature modality. For example, if the calculated weights are [0.1, 0.8, 0.1], it means that for the current network session, the system determines that the attack indication information contained in its time series features is the most critical.

[0060] Finally, using these dynamically calculated attention weights, the corresponding value vectors are... A weighted summation is performed to generate a final, highly condensed, and adaptive fusion feature vector. The calculation formula is as follows: Because each The dimension is 128, so The dimension is also 128. A vector is an intelligent condensation of all information about the current network session in three dimensions: static, temporal, and topological.

[0061] Ultimately, this 128-dimensional fused feature vector The data is passed to the classification output module 50. This module is structurally a standard feed-forward neural network, also known as a multilayer perceptron. In this embodiment, it contains a 128-dimensional input layer, two hidden layers (64 and 32 neurons respectively, both using the ReLU activation function), and an output layer. The number of neurons in the output layer is equal to the total number of predefined network traffic categories. Assuming the system needs to distinguish between normal traffic and five common attack types (DoS, Probe, R2L, U2R, DDoS), the output layer contains 1 + 5 = 6 neurons. The output layer uses... As an activation function, its output is a 6-dimensional probability vector, where each value represents the probability that the current session belongs to the corresponding category. For example, the output might be [0.01, 0.95, 0.01, 0.01, 0.01, 0.01], clearly indicating that the system determines the current session as a DoS attack with a 95% confidence level. The system uses the category with the highest probability value as the final judgment result for this detection and can generate corresponding security alerts based on preset thresholds.

[0062] Furthermore, the system described in this invention also includes a background model training and update unit. Before the system's initial deployment, this unit performs offline training on the entire end-to-end model (from the parallel encoder to the classifier, including all learnable weight matrices in the attention module) using a large-scale, precisely labeled public dataset (such as CIC-IDS2017). The training process employs the backpropagation algorithm, aiming to minimize the cross-entropy loss function between the predicted class distribution and the true label, and uses the Adam optimizer to dynamically adjust the learning rate and update all model parameters. After the system goes live, this unit also supports periodic incremental learning or online fine-tuning. Security operations personnel can input manually verified real attack samples (especially novel attacks) into this unit to fine-tune the existing model, enabling the system to continuously learn and adapt to the evolving network threat environment, maintaining long-term detection effectiveness.

[0063] Corresponding to the above system embodiments, the present invention also provides a real-time intrusion detection method based on deep learning. This method is executed on the aforementioned system hardware and software platform, and its specific execution flow is completely consistent with the system's data flow process, including the following steps: S100, Data Acquisition and Feature Extraction. The data acquisition and preprocessing module 10, deployed on the network link, captures raw network data packets in real time using zero-copy kernel bypass technology. Subsequently, session reconstruction is performed on the data packets based on quintuple information. After each network session ends, a pre-defined 128-dimensional high-dimensional feature vector is calculated and extracted.

[0064] S200, Heterogeneous Feature Decoupling. The 128-dimensional high-dimensional feature vector generated in the previous step is received and decomposed without information loss by the heterogeneous feature decoupling module 20 according to the internally fixed feature index mapping rules into a 22-dimensional static attribute feature subset, a 2×30 time series feature subset, and a graph topology association feature subset containing host identifiers and connection relationships.

[0065] S300, Parallelized Deep Encoding. The three feature subsets after decomposition are fed concurrently into the corresponding dedicated encoders in the parallel encoding subsystem 30 for processing. This step is specifically decomposed into three parallel sub-steps: S310 uses a multilayer perceptron network with three hidden layers (i.e., static attribute encoder 31) to encode the subset of static attribute features, deeply mining their inherent nonlinear relationships, and finally generating a 64-dimensional static feature embedding vector. .

[0066] S320 uses a bidirectional gated recurrent unit network (i.e., time series encoder 32) consisting of forward and backward GRU layers to encode a subset of time series features, comprehensively capturing the bidirectional contextual dependencies in the sequence data, and generating a 256-dimensional time series feature embedding vector. .

[0067] S330, within a preset 1-second time window, gathers a subset of graph topological association features from all sessions to dynamically construct a communication relationship graph. Then, it encodes this graph using a graph attention network (i.e., graph topology encoder 33) containing a three-layer multi-head graph attention network, learning deep topological associations between network entities, and finally generating a 128-dimensional graph topological feature embedding vector through graph-level readout operations. .

[0068] S400, cross-modal attention fusion. It embeds the three major features generated in the parallel encoding step into a vector. , and These are input together into the cross-modal fusion attention module 40. This module, based on the query-key-value paradigm-based attention mechanism described in detail above, calculates the attention scores between the global context query vector and the key vectors of each modality, and then... Normalization yields dynamic attention weights, which are then used to weight and sum the value vectors of each modality, ultimately generating a single, adaptive, 128-dimensional fusion feature vector. .

[0069] S500, Classification and Decision. This fused feature vector... The input is fed into a feedforward neural network classifier (i.e., classification output module 50) consisting of two hidden layers. The classifier calculates and outputs the probability distribution of the current network session belonging to six predefined categories, including the normal category, and uses the category with the highest probability as the final intrusion detection decision, thus completing the entire detection process.

[0070] To further verify the effectiveness and advancement of the technical solution of the present invention, a specific embodiment and comparative example are given below, and the test results are compared.

[0071] Example: This embodiment fully follows the technical solutions described in the above specific embodiments.

[0072] Hardware environment: A server equipped with an Intel Xeon Gold 6248R CPU (24 cores, 3.0GHz), 256GB DDR4 RAM, an NVIDIA A100 40GB HBM2 GPU, and a Mellanox ConnectX-6Dx100GbE network card.

[0073] Software environment: The operating system is Ubuntu 20.04LTS, the deep learning framework is PyTorch 1.10, along with CUDA 11.2 and cuDNN 8.1. Packet capture and processing are based on DPDK 20.11.

[0074] Dataset: The publicly available and authoritative CIC-IDS2017 dataset was used. This dataset contains a large amount of modern attack traffic and normal traffic. It was divided into 80% training set and 20% test set.

[0075] Model parameter configuration: Feature vector dimension K=128. The static attribute encoder MLP structure is 22-128-96-64. The time series encoder Bi-GRU has a hidden layer dimension of 128 and processes sequences of length 30. The graph topology encoder GAT contains 3 graph attention layers, each with 4 attention heads, and a graph construction time window of 1 second. In the cross-modal fusion attention module, the Q and K vector dimensions are 128, and the V vector dimension is 128. The classifier FFN structure is 128-64-32-7 (corresponding to normal and 6 attack categories).

[0076] Training parameters: The Adam optimizer was used with an initial learning rate of 1e-4, and cosine annealing was used to adjust the learning rate. The batch size was 256, and the training lasted for 100 epochs.

[0077] Comparative example: This comparative example aims to simulate a traditional technical approach that does not employ feature decoupling and parallel dedicated encoders, but instead uses a single complex model to directly process high-dimensional features.

[0078] The hardware environment, software environment, and dataset are exactly the same as in the example to ensure a fair comparison.

[0079] Model Scheme: The data acquisition and preprocessing stages also generate 128-dimensional feature vectors. However, instead of decoupling the features, the 128-dimensional feature vectors are directly flattened and input into a single, large-depth, large-width multilayer perceptron (MLP) for classification. The network structure of this MLP is designed as 128-1024-1024-512-256-7, aiming to learn complex patterns in high-dimensional features through its large model capacity.

[0080] The training parameters remain consistent with those in the example.

[0081] Comparison of experimental results: The implementation and comparative schemes were evaluated on the same test set, primarily examining their detection accuracy and processing performance. Evaluation metrics included: overall accuracy, precision, recall, F1 score, average inference latency per session, and system throughput. The test results are summarized in the table below: The data comparison in the table above clearly shows that the technical solution proposed in this invention exhibits significant superiority in all key indicators. Regarding detection accuracy, the accuracy, precision, recall, and F1 score of the embodiment are all significantly higher than those of the comparative embodiment. This demonstrates that through heterogeneous feature decoupling and the design of a dedicated encoder (especially a graph topology encoder), this invention can more deeply and accurately capture complex attack patterns hidden in different feature modalities, especially those covert attacks that rely on weak correlations of multi-dimensional features.

[0082] In terms of processing performance, the difference is even more significant. The average inference latency per session in the embodiment is only 0.045 milliseconds, nearly 8.5 times faster than the comparison model. This is thanks to the parallelized encoder design, which decomposes the computational tasks originally undertaken by a single large model into multiple smaller, more efficient parallel units, and the total number of model parameters is also much smaller than that of the comparison model. The extremely low latency directly translates into extremely high system throughput. The embodiment's processing capacity reaches over 22,000 sessions per second, fully meeting the stringent requirements for real-time detection on high-speed network links. In contrast, the comparison model, due to its massive single-model structure, incurs huge computational overhead, resulting in throughput far from meeting real-time requirements.

[0083] In summary, the specific embodiments of this invention, through their innovative heterogeneous spatiotemporal feature decoupling and fusion attention network architecture, successfully overcome the technical bottleneck of achieving both accuracy and efficiency in high-dimensional data detection without sacrificing any original information fidelity. This is achieved through parallelized dedicated coding and adaptive attention fusion, demonstrating its significant technical advantages and engineering application value as a next-generation real-time intrusion detection system. The described embodiments and data fully demonstrate the non-obviousness and beneficial effects of this invention compared to existing technologies.

[0084] The technical solutions of the present invention are not limited to the specific embodiments described above. Any technical modifications made in accordance with the technical solutions of the present invention fall within the protection scope of the present invention.

Claims

1. A real-time intrusion detection system based on deep learning, characterized in that, include: A data acquisition and preprocessing module (10) is configured to capture network data streams in real time, parse the network data streams into a series of network session records, and extract a high-dimensional feature vector containing multiple original network traffic parameters from each of the network session records. A heterogeneous feature decoupling module (20) has its data input end connected to the output end of the data acquisition and preprocessing module (10). It is configured to receive the high-dimensional feature vector and, according to a preset feature attribute partitioning rule, decompose the high-dimensional feature vector into at least three mutually independent feature subsets without loss. The feature subsets include a static attribute feature subset, a time series feature subset, and a graph topological association feature subset. A parallel coding subsystem (30) includes at least three parallel and structurally different feature encoders, each of which corresponds to and is connected to a feature subset output of the heterogeneous feature decoupling module (20), and is configured to perform deep feature learning on the respective received feature subsets in parallel and output the corresponding high-dimensional feature embedding representation. A cross-modal fusion attention module (40) has its data input end connected to the output end of all feature encoders in the parallel coding subsystem (30). It is configured to receive the multiple high-dimensional feature embedding representations and generate a single fusion feature vector that can characterize the global attack mode through an attention weight calculation and weighted fusion process. And a classification output module (50), whose data input end is connected to the output end of the cross-modal fusion attention module (40), is configured to receive the fused feature vector, and through a feedforward neural network classifier, calculate the probability distribution of the predefined attack category or normal category to which the current network session belongs, and output the final intrusion detection decision result.

2. The real-time intrusion detection system based on deep learning according to claim 1, characterized in that, The three feature encoders in the parallel coding subsystem (30) are specifically: A static attribute encoder (31), which is a multilayer perceptron network, is configured to encode the subset of static attribute features to generate a static feature embedding vector; A time series encoder (32), which is a bidirectional gated recurrent unit network, is configured to encode the time series feature subset to generate a time series feature embedding vector; And a graph topology encoder (33), which is a graph attention network, is configured to encode the subset of graph topology associated features to generate a graph topology feature embedding vector.

3. The real-time intrusion detection system based on deep learning according to claim 2, characterized in that, The multilayer perceptron network of the static attribute encoder (31) consists of an input layer, at least one hidden layer and an output layer; wherein each hidden layer consists of multiple neurons and uses a linear rectifier unit as the activation function; and after the activation function of the at least one hidden layer, a layer normalization layer is connected, which is configured to normalize the output of the hidden layer neurons.

4. The real-time intrusion detection system based on deep learning according to claim 2, characterized in that, The bidirectional gated recurrent unit network of the time series encoder (32) is composed of a forward gated recurrent unit layer and a backward gated recurrent unit layer stacked together; the time series encoder (32) is configured to concatenate the hidden state vector of the forward-forward gated recurrent unit layer at the last time step with the hidden state vector of the backward-forward gated recurrent unit layer at the last time step to generate the time series feature embedding vector.

5. The real-time intrusion detection system based on deep learning according to claim 2, characterized in that, The graph topology encoder (33) is configured to dynamically construct a communication relationship graph within a preset time window by first utilizing a subset of graph topology association features of all network sessions within that time window; wherein, the set of nodes in the communication relationship graph represents the unique network address appearing within the time window, and the set of edges represents the communication sessions established between the network addresses; subsequently, the graph attention network receives the communication relationship graph as input, learns the neighborhood information of the nodes in the graph through stacked graph attention layers employing a multi-head attention mechanism, and finally aggregates all node embedding vectors through a graph-level readout function to generate the graph topology feature embedding vector.

6. The real-time intrusion detection system based on deep learning according to claim 1, characterized in that, The cross-modal fusion attention module (40) is configured to execute an attention mechanism based on the query-key-value paradigm, and its specific execution process includes: First, the received multiple high-dimensional feature embeddings are concatenated along the feature dimension to form an aggregated intermediate representation; Secondly, a global context query vector is generated from the intermediate representation of the aggregation through a first learnable linear transformation; Then, taking each independent high-dimensional feature embedding representation as a source, key vectors and value vectors are generated for each of the high-dimensional feature embedding representations through the second and third sets of learnable linear transformations, respectively. Next, the attention score between the global context query vector and each of the key vectors is calculated by scaling the dot product operation; Subsequently, all calculated attention scores are normalized using a function to obtain the final attention weights corresponding to each high-dimensional feature embedding representation. Finally, the calculated final attention weights are used to perform a weighted summation of the corresponding value vectors to generate the single fused feature vector.

7. The real-time intrusion detection system based on deep learning according to claim 1, characterized in that, The data acquisition and preprocessing module (10) integrates a packet capture unit and a session reconstruction unit. The packet capture unit is configured to use zero-copy kernel bypass technology to directly capture raw data packets from the receive ring buffer of the network interface controller. The session reconstruction unit is configured to aggregate the captured raw data packets based on the source IP address, destination IP address, source port number, destination port number and the five-tuple information of the transport layer protocol to form a logical network session flow.

8. The real-time intrusion detection system based on deep learning according to claim 7, characterized in that, The data acquisition and preprocessing module (10) further includes a feature extraction unit, which is configured to calculate and extract the high-dimensional feature vector for each completed network session; the original network traffic parameters contained in the high-dimensional feature vector include at least: session duration, protocol type encoding, service type encoding, connection status flag, number of bytes from source to destination, number of bytes from destination to source, and the mean, variance, minimum and maximum of the inter-packet arrival time interval calculated based on the packet timestamp within the session.

9. The real-time intrusion detection system based on deep learning according to claim 1, characterized in that, The heterogeneous feature decoupling module (20) has a set of deterministic feature index mapping rules embedded inside; the rules are configured to uniquely map each dimension index of the high-dimensional feature vector to one of the static attribute feature subset, the time series feature subset, or the graph topology association feature subset; wherein, features that remain unchanged or change very infrequently within a single session lifecycle are assigned to the static attribute feature subset; continuous sequence features that can reflect the dynamic evolution of session behavior are assigned to the time series feature subset; and identifier-type features that can characterize the communication relationship between network entities are assigned to the graph topology association feature subset.

10. A real-time intrusion detection method based on deep learning, characterized in that, The method includes the following steps: S100: Data acquisition and feature extraction: capture raw network data packets in real time through the network interface, reconstruct the sessions from the raw network data packets, and extract a high-dimensional feature vector containing multiple raw network traffic parameters for each network session with a preset dimension. S200: Heterogeneous feature decoupling: Receive the high-dimensional feature vector and decompose it losslessly into a static attribute feature subset, a time series feature subset, and a graph topological association feature subset according to the fixed feature index mapping rules; S300: Parallelized Deep Encoding: The three decomposed feature subsets are fed into their respective dedicated encoders for parallel processing, specifically including: S310: Encode the static attribute feature subset using a multilayer perceptron network to generate a static feature embedding vector; S320: Encode the time series feature subset using a bidirectional gated recurrent unit network to generate a time series feature embedding vector; and S330: Based on the subset of graph topology association features of all sessions within a time window, a communication relationship graph is dynamically constructed, and a graph attention network is used to encode the graph to generate graph topology feature embedding vectors. S400: Cross-modal attention fusion: The three feature embedding vectors generated by parallel encoding are input into the cross-modal fusion attention module. Based on the attention mechanism of query-key-value paradigm, dynamic attention weights are calculated and the value vectors of each modality are weighted and summed to generate a single fusion feature vector. S500: and classification and decision: input the fused feature vector into a feedforward neural network classifier, calculate and output the probability distribution of the category to which the current network session belongs, and take the category with the highest probability as the final intrusion detection result.

Images