Network intrusion detection system based on knowledge graph

Abstract

The invention relates to the technical field of knowledge graph construction, in particular to a network intrusion detection system based on a knowledge graph, which comprises a knowledge graph construction module, an anomaly detection and attack traceability module and an edge strength data processing module, respectively calculating a binding relationship and an access relationship as the strength of the edges between the entities; when the edge strength is calculated, the weight between the corresponding entities is set according to the calculated proportion between the entities, and then the edge strength between the entities is calculated; the anomaly detection and attack traceability module calculates the deviation degree and judges whether the entities are abnormal or not, and if yes, an early warning signal is output; and the edge strength data processing module calculates deviation degrees in different knowledge maps, judges abnormal deviation degrees, removes corresponding edge strength, supplements the removed edge strength, adjusts a judgment result in the anomaly detection and attack traceability module, and does not adjust the knowledge maps constructed by the knowledge map construction module.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph construction technology, and more specifically, to a network intrusion detection system based on knowledge graphs. Background Technology

[0002] In the wave of digitalization, the internet has become the nerve center of modern society. Whether it's business operations, government management, or personal life, the reliance on the internet continues to deepen. However, as the complexity of the internet continues to rise, cybersecurity issues are becoming increasingly serious. Cyber ​​intrusion incidents are showing an explosive growth trend, posing unprecedented challenges to personal privacy, corporate assets, and even national security.

[0003] Traditional network intrusion detection technologies rely on rule-based matching databases, which struggle to cope with constantly evolving attack methods (such as covert APT attacks), resulting in high false negative rates. Furthermore, overly broad rules can lead to a proliferation of false positives, consuming significant manpower for verification. While machine learning-based methods offer some improvement, their models are affected by the dynamic nature of the network environment, lacking adaptability and generalization capabilities. They also struggle to understand data semantics, leading to low accuracy in detecting spoofed attacks or complex scenarios. Knowledge graph technology, however, graphically presents entities and relationships in the network security field, integrates multi-source heterogeneous data, and mines semantic relationships. This allows the system to analyze the interactions between factors from a global perspective, effectively improving the accuracy and recall rate of complex attack identification, reducing the risk of false positives and false negatives, and providing more intelligent support for network security protection. Currently, knowledge graph construction typically involves batch importing historical data, manually defining entity and relationship rules, or relying on incremental updates at fixed intervals. However, in network scenarios, the highly dynamic nature of the network environment—employees frequently switch login terminals due to work scheduling and temporary tasks; terminal devices may be connected or taken offline in real time due to hardware upgrades and fault replacements; servers may continuously change their access scope due to business expansion and permission adjustments; new network attack methods (such as variant viruses and unknown vulnerability exploits) are constantly emerging; threat intelligence (such as attack source identifiers and attack signatures) iterates dynamically over time; and multi-source heterogeneous data (such as real-time traffic logs, security device alarms, and third-party threat reports) continuously floods in in fragmented form, with varying formats and credibility—will exhibit periodic fluctuations in entity attributes and relationship links. For example, weekday morning rush hours show a high-frequency interaction characteristic of employees logging into office terminals, while nighttime is dominated by low-frequency access for server background data synchronization; and specific terminals may appear during major project implementation. The frequent, phased access to the core database, coupled with attack behavior that may exhibit alternating patterns of short-term probing scans and long-term latent penetration, necessitates dynamic updates to the knowledge graph. This ensures the knowledge graph can capture the latest state of entities in the network in real time (e.g., access information of newly added terminals, temporary changes in employee permissions), promptly correct relationship links (e.g., terminating invalid access relationships and establishing newly generated interaction associations), and effectively filter noisy data (e.g., false alarm logs, duplicate access records). This guarantees that the entities and relationships in the graph always reflect the actual operating state of the network, providing an accurate and up-to-date analytical foundation for a knowledge graph-based network intrusion detection system. It also prevents the inaccurate or false positives of new attacks and abnormal behaviors due to graph lag. Therefore, we propose a knowledge graph-based network intrusion detection system. Summary of the Invention

[0004] The purpose of this invention is to solve the problem that existing knowledge graph construction is often completed by batch importing historical data, manually defining rules, or updating at fixed intervals. However, the network environment is highly dynamic, employees frequently change terminals, equipment changes in real time, servers are continuously adjusted, new attacks and threat intelligence are dynamically iterated, and fragmented data from multiple sources floods in, resulting in the periodic fluctuations in entity attributes and relationship links.

[0005] To achieve the above objectives, this invention provides a knowledge graph-based network intrusion detection system, comprising a knowledge graph construction module, an anomaly detection and attack tracing module, and an edge strength data processing module, wherein: The knowledge graph construction module is used to dynamically construct a knowledge graph. It extracts employees, terminals, and servers from terminal login logs and server access logs as entities in the knowledge graph, and calculates the binding relationship and access relationship as the edge strength between each entity. When calculating the edge strength, it calculates the ratio between each entity, and then sets the weight between the corresponding entities according to the time interval and consecutive number between the entity's historical timestamp and the current timestamp, and then calculates the edge strength between the entities. The anomaly detection and attack tracing module receives a dynamically constructed knowledge graph, calculates the deviation between each entity in the current knowledge graph and each entity in the historical knowledge graph, and determines whether there is an anomaly between entities. If there is an anomaly, an early warning signal is output. The edge strength data processing module calculates the deviation of the same edge in different knowledge graphs of the knowledge graph construction module, judges abnormal deviations and removes the corresponding edge strengths, and then replenishes the removed edge strengths to adjust the judgment results in the anomaly detection and attack tracing module, without adjusting the knowledge graph constructed by the knowledge graph construction module.

[0006] As a further improvement to this technical solution, in the knowledge graph construction module, the employee is a unique identifier extracted from the terminal login log, the terminal is a device identifier extracted from the terminal login log and the server access log, and the server is a service identifier extracted from the server access log.

[0007] As a further improvement to this technical solution, the knowledge graph construction module calculates the binding relationship between employees and terminals, and the access relationship between terminals and servers, respectively. Binding thresholds and access thresholds are set sequentially, and the binding relationship, access relationship and binding threshold, access threshold are compared respectively. Employees, terminals and servers whose binding relationship > binding threshold and access relationship > access threshold are defined as entities in the knowledge graph. The binding relationship and access relationship are the edge strength between entities in the knowledge graph. If the terminal login log and server access log change, the knowledge graph will dynamically change with the log changes.

[0008] The beneficial effects of the above-mentioned further solutions are that by clearly defining the identifiers extracted from the corresponding logs for employees, terminals, and servers, and by calculating employee-terminal binding relationships and terminal-server access relationships, and by setting thresholds to filter key entities and edge strengths, the knowledge graph entities and relationships are accurately anchored to log data. By using thresholds to filter redundant information, the focus is on core interactions. At the same time, the graph is dynamically updated with the logs, ensuring that the knowledge graph can reflect changes in network behavior in real time. This provides fresh and accurate basic data for subsequent anomaly detection, improving the accuracy and timeliness of intrusion detection from the source, and ensuring that the detection basis is aligned with actual network dynamics, effectively identifying potential threats.

[0009] Based on the above technical solution, the present invention can also be improved as follows: the knowledge graph construction module retrieves the number of times each entity appears in the terminal login log and server access log, and calculates the corresponding ratio by dividing the number of times of each entity by the total number of times; sets entity weights, and obtains the corresponding relationship, i.e., the edge strength, by multiplying the ratio by the corresponding entity weight.

[0010] As a further improvement to this technical solution, the knowledge graph construction module sets an enhancement coefficient, which is multiplied by the number of consecutive times from one entity to another and then incremented by one, as part of the edge strength; it sets an attenuation coefficient, which is multiplied by the time interval between the entity's historical timestamp and the current timestamp, and the attenuation coefficient is calculated using an exponential function, as another part of the edge strength calculation; finally, the product of the two parts is the edge strength between entities.

[0011] The beneficial effects of the above-mentioned further scheme are that by amplifying the impact of continuous interaction through the enhancement coefficient combined with the number of consecutive interactions of entities, and by associating the time interval with the decay coefficient and reflecting the decay effect of time on the interaction intensity through an exponential function, the final edge strength is obtained by multiplying the two parts. This makes the edge strength calculation of the knowledge graph consider not only the long-term proportion of interaction frequency, but also highlight the reinforcement effect of continuous interaction, and accurately characterize the impact of time decay on relationships. This makes the edge strength between entities more in line with the dynamic changes of network behavior (such as high weight for frequent consecutive logins and weak impact for long-term interactions), injects more delicate behavioral semantics into the knowledge graph, improves the recognition accuracy of real interaction patterns in subsequent anomaly detection, reduces false positives and false negatives caused by simple frequency statistics or static weights, and makes intrusion detection more accurately adapted to the complexity of the network environment.

[0012] Based on the above technical solution, the present invention can be further improved as follows: the anomaly detection and attack tracing module retrieves the edge strength between two entities in the current knowledge graph and multiple edge strengths between the same two entities in multiple historical knowledge graphs; calculates the mean and standard deviation of the corresponding edge strengths in multiple historical knowledge graphs respectively, and then obtains the deviation by subtracting the mean from the absolute value of the edge strength between two entities in the current knowledge graph and dividing by the standard deviation.

[0013] As a further improvement to this technical solution, the anomaly detection and attack tracing module sets a deviation threshold. If the deviation is greater than the deviation threshold, the entity is determined to be abnormal; if the deviation is less than or equal to the deviation threshold, the entity is determined to be normal.

[0014] As a further improvement to this technical solution, when the two abnormal entities in the anomaly detection and attack tracing module are a terminal and a server, multiple employees corresponding to the terminal are retrieved according to the knowledge graph, and multiple attack chains are generated in order of the degree of deviation between each terminal and multiple employees. Then, a warning signal including the attack chains is output.

[0015] The beneficial effects of the above-mentioned further solutions are that by using historical data to construct a "normal baseline" of entity relationships, and using deviation to accurately identify current anomalies, the limitations of traditional detection relying solely on real-time features are solved. Threshold determination provides clear standards for anomaly identification, avoiding subjective misjudgments. Attack chain generation extends from single-point anomalies to source tracing and correlation, opening up a closed loop of "detection-source tracing-early warning," enabling security personnel to quickly locate threat paths and lock down suspicious personnel, significantly improving the depth and response efficiency of network intrusion detection. From identifying anomalies to reconstructing the attack chain, a more comprehensive defense system is built for network security protection.

[0016] Based on the above technical solution, the present invention can also be improved as follows: the edge strength data processing module receives the edge strength of each edge in each knowledge graph in the knowledge graph construction module, and outputs it to the anomaly detection and attack tracing module to calculate the deviation of the same edge in different knowledge graphs; a filtering threshold is set to remove edge strengths with deviation greater than the filtering threshold; As a further improvement to this technical solution, the edge strength data processing module receives the edge strength at the next moment and the edge strength at the previous moment corresponding to the edge strength to be removed, adds the edge strength at the next moment and the edge strength at the previous moment together and then divides by two to obtain the supplemented edge strength.

[0017] The beneficial effects of the above-mentioned further solutions are that, by leveraging cross-graph deviation to identify abnormal fluctuations in edge strength (such as strength mutations caused by log errors or transient attacks), the filtering threshold accurately removes interfering data; interpolation supplementation ensures the continuity of the edge strength sequence, avoiding misjudgments by the anomaly detection and attack tracing module due to data gaps; thus making the edge strength data of the knowledge graph "cleaner" and "continuous", providing high-quality input for anomaly detection and attack tracing module, solving the problem of abnormal data interference within a single graph, and compensating for data gaps, improving the robustness and accuracy of the entire intrusion detection system from the data preprocessing level, making the detection results more reliable.

[0018] In addition to the objectives, features, and advantages described above, the present invention has other objectives, features, and advantages. The invention will now be described in further detail with reference to the figures. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the overall module of the present invention; Figure 2 This is a schematic diagram illustrating the working principle of rule-matching intrusion detection in the anomaly detection and attack tracing module of this invention. Figure 3 This is a flowchart of the intrusion detection process of the present invention. The meanings of the labels in the diagram are as follows: 100. Knowledge graph construction module; 200. Anomaly detection and attack tracing module; 300. Edge strength data processing module. Detailed Implementation

[0020] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] refer to Figures 1 to 3 As shown, the knowledge graph-based network intrusion detection system includes a knowledge graph construction module 100, an anomaly detection and attack tracing module 200, and an edge strength data processing module 300, wherein: To dynamically construct a knowledge graph, the knowledge graph construction module 100 analyzes and extracts information about employees, terminals, and servers from terminal login logs and server access logs to build the knowledge graph. Here, the employee is a unique identifier extracted from the terminal login logs (such as employee ID or domain account), denoted as... ,in For the first Each employee; the terminal is the device identifier (such as hostname, MAC address, IP address) extracted from the terminal login log and server access log, denoted as... ,in For the first Each terminal; the server is the service identifier extracted from the server access log (such as server name, IP address, service port), denoted as... ,in For the first One server; Establish employee login logs With terminal binding relationship between Establish a terminal through server access logs With server Access relationships between Set the binding thresholds sequentially. Access threshold Compare the binding relationships respectively Access Relationship and binding threshold Access threshold : Retrieve binding relationship > Binding threshold Access Relationship >Access threshold employees ,terminal and server Define it as an entity in a knowledge graph; binding relationship Access Relationship This refers to the edge strength between entities (employees, terminals, servers) in the knowledge graph. Furthermore, if terminal login logs or server access logs change, the knowledge graph will dynamically adapt to these changes. The specific working principle is as follows: Calculate employees Log in to each terminal Number of logins and total logins across all terminals Login frequency ratio: ,in For employees Login Terminal Total number of times For employees The collection of all logged-in terminals; Transferred employees Log in to each terminal The login timestamp is set for each terminal based on the time interval between each login timestamp and the current timestamp (the shortest time interval from the current timestamp) and the number of consecutive logins. Login weight Then, the login ratio is used. Multiply by the corresponding login weight Obtain binding relationship ; Login weight ,in For login enhancement coefficient, For employees Continuous login terminal The number of times; For time weights, where The time interval between the login timestamp and the current time. This is the login attenuation coefficient; terminal With server The access relationship is as follows: match the corresponding record of "Terminal Identifier - Server Identifier" in the server access log, and retrieve the computing terminal. Access server The number of times, and then calculate the terminal Access server The number of visits accounted for a percentage of its total visits. Access ratio: ,in For the terminal The collection of all servers visited; And bring up the terminal Access each server The access timestamp is determined based on the time interval between each access timestamp and the current timestamp (the shortest time interval from the current timestamp) and the number of consecutive accesses. Configure each server Access weight , The access enhancement factor is used first, followed by the access ratio. Multiply by the corresponding access weight Access relationship obtained: ; Access weight In For time weights, where The time interval between the accessed timestamp and the current timestamp. This is the access attenuation coefficient.

[0022] During network environment testing, employee operating habits change with work adjustments, and business systems are constantly updated due to functional upgrades. The interaction mode between terminals and servers is always dynamically changing, and logs are kept in real-time during this process. The knowledge graph construction module 100, based on the continuous updating of log data and the dynamic changes in entity interaction behavior, iteratively calculates the strength of relationships between entities, thereby dynamically constructing a knowledge graph that can reflect employee behavior in real time. Login Terminal ,terminal Access server The evolution of interaction patterns between them is precisely adapted to changes in behavior and habits in the actual network environment, as well as upgrades to business systems.

[0023] When the knowledge graph construction module 100 dynamically constructs the knowledge graph, the anomaly detection and attack tracing module 200 receives the dynamically constructed knowledge graph from the knowledge graph construction module 100 and calculates the knowledge graph for each employee. Login Terminal Deviation in binding strength: ,in For current employees Login Terminal The knowledge graph construction module 100 constructs the binding relationships in the knowledge graph. The average binding relationship in the knowledge graph constructed for history. The standard deviation of historical binding relationships; If the binding strength deviates > Binding deviation threshold Then determine the employee Login Terminal If an anomaly occurs, an early warning signal will be output. Therefore, calculate each terminal Access server Access intensity deviation: ,in For the current terminal Access server The knowledge graph construction module 100 constructs access relationships in the knowledge graph. The average number of access relationships in the knowledge graph constructed for history. The standard deviation of historical visit relationships; If the access intensity deviates > Access deviation threshold Then determine the terminal Access server An anomaly occurred, and the currently constructed knowledge graph was traced back to the terminal via the knowledge graph construction module 100. corresponding employees And recalculate each terminal Access server Access intensity deviation According to the deviation of access intensity Multiple attack chains are generated in descending order: Employees →Server →Terminal Then, it outputs warning signals including the attack chain, which can accurately locate specific personnel and clearly sort out the attack path. This allows security personnel to quickly grasp the whole picture of the intrusion, warn of potential risks in advance, effectively improve the accuracy and response efficiency of network intrusion detection, extend from single point of anomaly identification to attack chain tracing, build a more comprehensive security protection system, and reduce the losses caused by intrusion.

[0024] This invention further considers that although the knowledge graph construction module 100 can dynamically construct knowledge graphs, enabling the current knowledge graph to fully reflect the employees'... Login Terminal ,terminal Access server The relationship between them, but due to the employees Login Terminal ,terminal Access server The phases between these phases mean that in real-world scenarios, there may be a specific point in time where employees... Frequent terminal logins However, a sharp drop in login frequency occurs in the next node; as time goes on, when the knowledge graph construction module 100 dynamically constructs the knowledge graph, employees... With terminal binding relationship between The frequency of behavior gradually decreases due to factors such as large fluctuations and time decay—because the knowledge graph's binding relationship calculation incorporates consecutive counts (consecutive login counts). Consecutive visits (A sudden drop in the number of consecutive logins directly reduces the edge strength) and time decay (the lack of subsequent continuous logins causes the time weight to decrease with increasing intervals), resulting in the binding relationship, which should reflect long-term stable interaction, being dominated by short-term fluctuations; at this time, when the anomaly detection and attack tracing module 200 judges whether the login is abnormal based on the historical knowledge graph, it will cause the binding relationship in the current knowledge graph to be affected. Unable to reflect the employees and terminal The true binding relationship between them This interference with the logic for determining anomalies ultimately affects the accuracy of the judgment, making it impossible to accurately identify genuine abnormal logins or miss intrusion risks hidden due to baseline distortion. Similarly, this applies not only to employees... With terminal binding relationship between ,terminal Access server Access relationships between Similarly, to avoid errors in abnormal judgment, this invention receives edge strength data from each edge in each knowledge graph in the knowledge graph construction module 100 through the edge strength data processing module 300. (in (For the number of knowledge graph versions), calculate the deviation of the same edge in different knowledge graphs for knowledge graph building module 100. , This represents the long-term mean of the same relation across knowledge graphs. The standard deviation of the edge strength across the knowledge graph is used; a filtering threshold is set to remove deviations. >Filter the edge strength of the threshold and supplement it: ,in To remove the edge strength from the previous moment, The edge strength is output at the moment after the edge strength is removed; then the replenished edge strengths are output again. The anomaly detection and attack tracing module 200 adjusts the anomaly judgment results, thereby correcting the relationship distortion problem in the knowledge graph caused by stage-based behavior and data errors. This allows the anomaly detection and attack tracing module 200 to base its anomaly judgments on edge strength that is cleaned and supplemented to better reflect real interaction patterns. Effectively reduce edge strength The risk of misjudgment and missed judgment caused by abnormal fluctuations should be addressed by improving the accuracy and reliability of abnormal behavior identification in network intrusion detection, and providing more solid data support and judgment basis for ensuring network security.

[0025] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network intrusion detection system based on knowledge graphs, characterized in that, It includes a knowledge graph construction module (100), an anomaly detection and attack tracing module (200), and an edge strength data processing module (300), wherein: The knowledge graph construction module (100) is used to dynamically construct a knowledge graph, extract employees, terminals, and servers from terminal login logs and server access logs as entities in the knowledge graph, and calculate the binding relationship and access relationship as the edge strength between each entity. When calculating the edge strength, the weight between the corresponding entities is set according to the ratio between each entity, and then the weight between the corresponding entities is set according to the time interval and consecutive number between the entity's historical timestamp and the current timestamp, and then the edge strength between the entities is calculated. The anomaly detection and attack tracing module (200) receives the dynamically constructed knowledge graph, calculates the deviation between each entity in the current knowledge graph and each entity in the historical knowledge graph, and determines whether there is an anomaly between the entities. If there is an anomaly, it outputs a warning signal. The edge strength data processing module (300) calculates the deviation of the same edge in different knowledge graphs of the knowledge graph construction module (100), judges the abnormal deviation and removes the corresponding edge strength, and then supplements the removed edge strength, adjusts the judgment result in the anomaly detection and attack tracing module (200), and does not adjust the knowledge graph constructed by the knowledge graph construction module (100).

2. The knowledge graph-based network intrusion detection system according to claim 1, characterized in that: In the knowledge graph construction module (100), the employee is a unique identifier extracted from the terminal login log, the terminal is a device identifier extracted from the terminal login log and the server access log, and the server is a service identifier extracted from the server access log.

3. The knowledge graph-based network intrusion detection system according to claim 2, characterized in that: The knowledge graph construction module (100) calculates the binding relationship between employees and terminals, and the access relationship between terminals and servers. It sets binding thresholds and access thresholds in sequence, and compares the binding relationship, access relationship and binding threshold, access threshold respectively. Employees, terminals and servers whose binding relationship is greater than the binding threshold and whose access relationship is greater than the access threshold are defined as entities in the knowledge graph. The binding relationship and access relationship are the edge strength between entities in the knowledge graph. If the terminal login log and server access log change, the knowledge graph will change dynamically with the change of the log.

4. The knowledge graph-based network intrusion detection system according to claim 3, characterized in that: The knowledge graph construction module (100) retrieves the number of times each entity appears in the terminal login log and server access log, and calculates the corresponding ratio by dividing the number of times each entity appears by the total number of times. Set entity weights, and obtain the corresponding relationship, i.e., the edge strength, by multiplying the corresponding entity weight by the ratio.

5. The knowledge graph-based network intrusion detection system according to claim 4, characterized in that: The knowledge graph construction module (100) sets an enhancement coefficient, which is multiplied by the number of consecutive steps from one entity to another and then incremented by one, as part of the edge strength; Set an attenuation coefficient, multiply the attenuation coefficient by the time interval between the entity's historical timestamp and the current timestamp, and calculate the attenuation coefficient using an exponential function. This attenuation coefficient is then used as another part of the edge strength calculation. Finally, multiply the two parts together to obtain the edge strength between entities.

6. The knowledge graph-based network intrusion detection system according to claim 1, characterized in that: The anomaly detection and attack tracing module (200) retrieves the edge strength between two entities in the current knowledge graph and the edge strength between the same two entities in multiple historical knowledge graphs; calculates the mean and standard deviation of the corresponding edge strength in multiple historical knowledge graphs respectively, and then obtains the deviation by subtracting the mean from the absolute value of the edge strength between two entities in the current knowledge graph and dividing by the standard deviation.

7. The knowledge graph-based network intrusion detection system according to claim 6, characterized in that: The anomaly detection and attack tracing module (200) sets a deviation threshold. If the deviation is greater than the deviation threshold, the entity is determined to be abnormal; if the deviation is less than or equal to the deviation threshold, the entity is determined to be normal.

8. The knowledge graph-based network intrusion detection system according to claim 7, characterized in that: When the two abnormal entities in the anomaly detection and attack tracing module (200) are a terminal and a server, multiple employees corresponding to the terminal are retrieved according to the knowledge graph, and multiple attack chains are generated in order of the degree of deviation between each terminal and multiple employees. Then, a warning signal including the attack chains is output.

9. The knowledge graph-based network intrusion detection system according to claim 8, characterized in that: The edge strength data processing module (300) receives the edge strength of each edge in each knowledge graph in the knowledge graph construction module (100) and outputs it to the anomaly detection and attack tracing module (200) to calculate the deviation of the same edge in different knowledge graphs; Set a filtering threshold to remove edge strengths with a deviation greater than the filtering threshold.

10. The knowledge graph-based network intrusion detection system according to claim 9, characterized in that: The edge strength data processing module (300) receives the edge strength at the next moment and the edge strength at the previous moment corresponding to the edge strength to be removed, adds the edge strength at the next moment and the edge strength at the previous moment together and then divides by two to obtain the supplemented edge strength.

Images