Multi-dimensional network intrusion behavior intelligent identification method based on deep learning

Abstract

The invention discloses a multi-dimensional network intrusion behavior intelligent identification method based on deep learning. The method comprises the following steps: collecting network multi-dimensional data and generating a standardized network event set and a network control path input set; establishing a neural controlled differential equation model, and generating a continuous time context representation set through hidden state evolution; establishing a neuro-hox process identification model, performing intensity function modeling, and generating an event intensity prediction sequence set and an identification intermediate representation set; forming an intrusion behavior decision rule set and a reasoning configuration set through joint training; new network multi-dimensional data are collected, the reasoning configuration set operation model is loaded, and a new event intensity prediction sequence set and a new candidate trigger time set are output; and generating a network intrusion behavior recognition result set in combination with the intrusion behavior decision rule set. According to the method, time modeling and logical reasoning are fused, and high-precision intrusion identification is realized.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection and prevention, and in particular to a multi-dimensional intelligent identification method for network intrusion behavior based on deep learning. Background Technology

[0002] As network scale and complexity continue to increase, network intrusion behaviors are becoming more diverse, covert, and multidimensional. Existing intrusion detection methods mainly rely on rule-based matching or statistical modeling methods based on shallow feature extraction. When facing large-scale dynamic network environments, these methods often struggle to balance detection accuracy and real-time performance. In particular, when intrusion behaviors involve complex scenarios spanning time, protocols, or sessions, traditional methods often fail to effectively capture the temporal dependencies and contextual relationships of the behaviors, leading to high false negative and false positive rates.

[0003] On the other hand, existing temporal modeling methods typically employ a discretization strategy, transforming continuously occurring network events into fixed time segments for analysis. This approach easily loses fine-grained temporal characteristics between events and struggles to handle uneven event temporal distribution. Furthermore, the fusion modeling of event semantics and network topology information remains insufficient, resulting in inadequate model performance when faced with multidimensional features.

[0004] Existing intrusion detection frameworks generally suffer from problems such as delayed parameter updates and reliance on human experience in model training and inference, making the system lack adaptability and robustness in the face of dynamically changing network attack methods.

[0005] Therefore, how to provide a deep learning-based multidimensional intelligent identification method for network intrusion behavior is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a deep learning-based intelligent method for multidimensional network intrusion behavior recognition. This invention constructs a neural controlled differential equation model and a neural Hawkes process recognition model, integrating continuous-time context representation, network event features, and control path inputs to achieve dynamic evolution modeling and intensity function-driven recognition of intrusion behavior. Intrusion behavior decision rules are generated through joint training and inference configuration, and finally, a set of intrusion behavior recognition results is output under new network data input. This invention effectively captures the temporal dependence, semantic features, and topological relationships of network events, solving the problems of feature loss due to temporal discretization, rule dependence on manual definition, and insufficient detection adaptability in existing methods. It possesses the advantages of high detection accuracy, strong real-time performance, and excellent adaptability.

[0007] A method for intelligent identification of multidimensional network intrusion behavior based on deep learning according to an embodiment of the present invention includes the following steps:

[0008] Collect multidimensional network data, perform data preprocessing, and generate a standardized set of network events, a set of network control path inputs, and a set of training labels.

[0009] A neural controlled differential equation model is established, using a standardized set of network events and a set of network control path inputs as inputs. The evolution of hidden states is driven by path integrals to generate a set of continuous-time context representations.

[0010] A neural Hawkes process recognition model is established, taking a continuous-time context representation set and a standardized network event set as inputs. The event arrival process is modeled through an intensity function to generate a set of event intensity prediction sequences and a set of intermediate recognition representations.

[0011] Based on the training label set, the event intensity prediction sequence set, and the recognition intermediate representation set, the neural Hawkes process recognition model and the neural controlled differential equation model are jointly trained to generate a set of intrusion behavior decision rules and a set of inference configurations.

[0012] Collect new network multidimensional data, perform data preprocessing, load the inference configuration set, run the neural controlled differential equation model and the neural Hawkes process recognition model, and output a new event intensity prediction sequence set and a new candidate trigger time set;

[0013] Based on the new event intensity prediction sequence set, the new candidate trigger time set, and the intrusion behavior decision rule set, a set of network intrusion behavior identification results is generated.

[0014] Optionally, the generation of the standardized network event set, network control path input set, and training label set includes:

[0015] Collect multi-dimensional network data, including packet-level data, flow-level statistics, host topology, protocol semantics, and system logs;

[0016] Perform denoising, time alignment, identification, and standardization on packet-level data, stream-level statistics, protocol semantics, and system logs;

[0017] Perform identifier and standardization on the host topology to generate a topology index;

[0018] Based on the processed packet-level data, flow-level statistics, host topology, protocol semantics, and system logs, a standardized set of network events and a set of network control path inputs are generated, and a set of training labels is generated based on the system logs.

[0019] Optionally, the generation of the continuous-time context representation set includes:

[0020] Establish and configure a neural controlled differential equation model, and set the time domain, evolution step size threshold, numerical error threshold, evolution depth and boundary handling strategy;

[0021] Receive a standardized set of network events and a set of network control path inputs, and complete timestamp sorting, session boundary marking, and data consistency verification;

[0022] A continuous processing and interpolation strategy is performed on the network control path input set to preserve the non-uniform characteristics of event time in order to form a continuous time evolution drive.

[0023] Hidden state initialization and parameter loading are performed based on a standardized set of network events. Continuous-time evolution is called as the control input, and the path integral mechanism is combined to drive the continuous evolution of the hidden state over time, generating a set of continuous-time hidden state sequences.

[0024] Apply steady-state constraints and numerical stability control to a set of continuous-time hidden state sequences;

[0025] The set of continuous time hidden state sequences is aligned at the session level according to the session association rules of the topology index, and a set of continuous time context representations is generated by using timestamp alignment and identifier consistency verification.

[0026] Optionally, the generation of the event intensity prediction sequence set and the identification intermediate representation set includes:

[0027] Establish and configure a neural Hawkes process recognition model, and set the time domain range, intensity function parameter range, and optimization boundary conditions;

[0028] Receive a set of continuous-time context representations and a set of normalized network events, perform time alignment and session boundary consistency processing to obtain a set of aligned input sequences;

[0029] Extract the context vector sequence according to the time index from the continuous time context representation set, calculate the time interval sequence of adjacent events based on the normalized network event set, and combine the context vector sequence and the time interval sequence to form the intensity input vector sequence;

[0030] Based on the aligned input sequence set, the intensity input vector sequence is called as the core input, and combined with protocol semantics and topology index, the intensity function modeling process is driven to generate an event intensity prediction sequence set;

[0031] The event intensity prediction sequence set is indexed and associated with the context vector sequence at the corresponding time point, and then concatenated to generate an intermediate representation set for recognition.

[0032] Optionally, the generation of the intrusion behavior decision rule set and the inference configuration set includes:

[0033] Receive the training label set, the event intensity prediction sequence set, and the recognition intermediate representation set, and obtain the continuous time context representation set to establish a joint training process for the neural Hawkes process recognition model and the neural controlled differential equation model;

[0034] Based on timestamp alignment and session boundary marking, the training label set is compared with the event intensity prediction sequence set, and the intermediate representation set is compared with the continuous time context representation set to generate evaluation results for parameter updates.

[0035] Based on the evaluation results, the trainable parameters of the neural Hawkes process recognition model and the neural controlled differential equation model are jointly updated, and the process is repeated until the parameter update stops, generating a set of candidate parameters.

[0036] The threshold and judgment conditions are determined based on the correspondence between the training label set and the event intensity prediction sequence set, and a set of candidate intrusion behavior decision rules is generated.

[0037] The consistency of the candidate parameter set and the candidate intrusion behavior decision rule set is verified using the training label set, and the training completed parameter set and intrusion behavior decision rule set that meet the consistency requirements are retained.

[0038] The set of intrusion behavior decision rules is combined with the set of trained parameters to form an inference configuration set.

[0039] Optionally, the generation of the new event intensity prediction sequence set and the new candidate trigger time set includes:

[0040] Collect new multidimensional network data, perform data preprocessing operations, and generate a new standardized set of network events and a new set of network control path inputs;

[0041] Load the inference configuration set and initialize the trained parameter set and intrusion behavior decision rule set into the inference runtime environment;

[0042] Using the new standardized set of network events and the new set of network control path inputs as inputs, a neural controlled differential equation model is run, continuous-time evolution and session-level alignment are performed, and a new set of continuous-time context representations is generated.

[0043] Taking the new continuous-time context representation set and the new standardized network event set as input, the neural Hawkes process recognition model is run, and the intensity function modeling process is invoked to generate a new event intensity prediction sequence set and a new candidate trigger time set.

[0044] Optionally, the generation of the network intrusion behavior identification result set includes:

[0045] Using the set of new event intensity prediction sequences as input, the set of intrusion behavior decision rules is applied in time stamp order to perform point-by-point judgment, and the intrusion behavior judgment results corresponding one-to-one with the time position are obtained.

[0046] The new candidate trigger time set and the intrusion behavior judgment result are marked according to the time index to generate trigger marking results;

[0047] The intrusion behavior determination result and the trigger mark result are correlated with the new event intensity prediction sequence set on the time index to generate an aggregate record;

[0048] All aggregated records are gathered to generate a set of network intrusion behavior identification results. The set of network intrusion behavior identification results includes a time index consistent with the set of new event intensity prediction sequences, intrusion behavior judgment results generated based on the set of intrusion behavior decision rules, trigger time markers consistent with the set of new candidate trigger times, and a mapping of correspondences between the set of new event intensity prediction sequences, the set of new candidate trigger times, and the set of intrusion behavior decision rules.

[0049] The beneficial effects of this invention are:

[0050] First, by introducing a neural controlled differential equation model and a neural Hawkes process recognition model, this invention achieves dynamic evolution modeling of network events over continuous time, overcoming the feature loss problem caused by the traditional method's reliance on discretization modeling, and can more accurately capture the temporal dependence of network events.

[0051] Secondly, this invention integrates a standardized set of network events, a set of network control path inputs, and a set of continuous time context representations during the identification process. By using an intensity function modeling mechanism, it unifies time features, protocol semantics, and topology information into the computational framework, thus solving the limitation of existing rule-based or shallow model-based methods that cannot simultaneously take into account multi-dimensional features.

[0052] Furthermore, this invention generates an inference configuration set through a joint training mechanism, combines the trained parameter set with the intrusion behavior decision rule set and performs consistency verification, enabling the system to have the ability to adaptively update and enhance robustness. Thus, it can maintain high accuracy and real-time performance when facing diverse and complex network environments, thereby improving the level of intelligence in intrusion detection. Attached Figure Description

[0053] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0054] Figure 1This is an overall flowchart of a deep learning-based intelligent identification method for multidimensional network intrusion behavior proposed in this invention.

[0055] Figure 2 This is a schematic diagram of the structure of the continuous-time context representation set generated based on the neural controlled differential equation model in this invention;

[0056] Figure 3 This is a schematic diagram illustrating the generation of intermediate representations for event intensity modeling and recognition based on the neural Hawkes process recognition model in this invention. Detailed Implementation

[0057] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0058] refer to Figure 1-3 A deep learning-based intelligent identification method for multidimensional network intrusion behavior includes the following steps:

[0059] Collect multidimensional network data, including packet-level data, flow-level statistics, host topology, protocol semantics and system logs, perform data preprocessing, including denoising, time alignment, identifier and standardization, and generate a standardized set of network events, a set of network control path inputs, a set of training labels and a topology index;

[0060] A neural controlled differential equation model is established, with a standardized set of network events and a set of network control path inputs as inputs. The evolution of hidden states is driven by path integrals, and a set of continuous-time hidden state sequences is output. The set of continuous-time hidden state sequences is then aligned with the topology index at the session level to generate a set of continuous-time context representations.

[0061] A neural Hawkes process recognition model is established, taking a continuous-time context representation set and a standardized network event set as inputs. The event arrival process is modeled through an intensity function to generate a set of event intensity prediction sequences and a set of intermediate recognition representations.

[0062] Based on the training label set, the event intensity prediction sequence set, and the recognition intermediate representation set, the neural Hawkes process recognition model and the neural controlled differential equation model are jointly trained to generate the trained parameter set and the intrusion behavior decision rule set. The intrusion behavior decision rule set and the trained parameter set are then combined to form the inference configuration set.

[0063] Collect new multidimensional network data, perform data preprocessing, generate a new standardized set of network events and a new set of network control path inputs, load the inference configuration set, run the neural controlled differential equation model to obtain a new set of continuous time context representations, input the new set of continuous time context representations into the neural Hawkes process recognition model, and output a new set of event intensity prediction sequences and a new set of candidate trigger times.

[0064] Based on the new event intensity prediction sequence set, the new candidate trigger time set, and the intrusion behavior decision rule set, a set of network intrusion behavior identification results is generated.

[0065] This invention proposes a deep learning-based intelligent identification method for multidimensional network intrusion behavior, constructing a complete technical process from data acquisition, context representation generation, event intensity modeling to intrusion identification. By introducing a neural controlled differential equation model and a neural Hawkes process identification model, and combining multidimensional features such as time series, semantics, and network structure, a unified intelligent identification framework is formed, which has the ability to perform high-precision modeling and prediction of complex dynamic intrusion behaviors.

[0066] In this embodiment, the generation of the standardized network event set, the network control path input set, and the training label set includes:

[0067] Collect multi-dimensional network data, including packet-level data, flow-level statistics, host topology, protocol semantics, and system logs;

[0068] Denoising, time alignment, identification, and standardization are performed on packet-level data, stream-level statistics, protocol semantics, and system logs. Identification includes uniform encoding of field names, protocol fields, and log keywords. Standardization includes normalization of numerical features, uniform time format processing of timestamps, and uniform formatting of text fields.

[0069] The host topology is characterized and normalized to generate a topology index. Characterization includes assigning unique node identifiers to host nodes and uniformly numbering connecting edges. Normalization includes mapping the relationship between nodes and edges to a uniform structure of adjacency matrix or index table for generating the topology index.

[0070] Based on the processed packet-level data, flow-level statistics, host topology, protocol semantics, and system logs, a standardized set of network events and a set of network control path inputs are generated. A training label set is also generated based on the system logs, and a topology index is output. The process of generating the standardized set of network events and the set of network control path inputs includes aligning the temporal features of packet-level data and flow-level statistics with timestamps, and mapping the structural features of host topology and protocol semantics to a unified index space to establish the association between event sequences and control paths. The process of generating the training label set based on the system logs includes labeling security alarms, access control records, and abnormal operations in the logs, and mapping them to the standardized set of network events according to time and session identifiers to form classification labels or status labels corresponding to the events.

[0071] In this embodiment, the generation of the continuous-time context representation set includes:

[0072] A neural controlled differential equation model was established and configured, setting the time domain, evolution step size threshold, numerical error threshold, evolution depth, and boundary handling strategy. The time domain not only limits the start and end intervals of model operation but also dynamically adapts to the time span of network events to ensure alignment consistency between different sessions. The evolution step size threshold, based on limiting the minimum and maximum step sizes, is adaptively adjusted in conjunction with the time distribution of the network control path input set to avoid redundant advancements in low-density intervals. The numerical error threshold not only constrains the upper limit of local errors but also calibrates the error tolerance range in conjunction with the training label set to ensure the correspondence between the evolution process and the labels of real intrusion behaviors. The evolution depth, while controlling the number of iteration layers, is dynamically set with reference to the complexity of session links in the topology index. In addition to conventional pruning and imputation, the boundary handling strategy utilizes the node relationships in the topology index to complete boundary data, ensuring that the evolution start and end points remain consistent with the actual network structure.

[0073] The system receives a standardized set of network events and a set of network control path inputs, and performs timestamp sorting, session boundary marking, and data consistency verification. The timestamp sorting not only arranges events chronologically but also uses link delay information from the topology index to perform secondary correction, reducing out-of-order errors caused by asynchronous events. In addition to regular connection opening and termination rules, session boundary marking incorporates handshake signals from protocol semantics for enhanced boundary marking, thus accurately locating the start and end range of intrusion sessions. Data consistency verification checks time monotonicity and identifier consistency while cross-referencing abnormal events with the training label set, retaining potential intrusion behaviors as training samples rather than simply discarding them, thereby improving data utilization.

[0074] A continuous processing and interpolation strategy is applied to the network control path input set to preserve the non-uniformity of event time and form a continuous-time evolution driver. The continuous processing not only maps discrete events to continuous driving signals, but also maintains the temporal consistency between multi-dimensional inputs by aligning with the timestamps of the standardized network event set. When generating smooth segments, the interpolation strategy uses protocol semantics and behavioral features extracted from system logs as constraints to avoid false transitions that do not match the actual intrusion pattern. The preservation of non-uniformity not only ensures the authenticity of the evolution driver, but also serves as a variable weighting factor for the subsequent path integration mechanism, making the driving force of high-frequency intrusion events on the evolution process stronger, thereby highlighting the impact of attack behavior in continuous-time evolution.

[0075] Hidden state initialization and parameter loading are performed based on a standardized network event set. Continuous-time evolution is used as the control input, and a path integral mechanism is combined to drive the continuous evolution of the hidden state over time, generating a continuous-time hidden state sequence set. During hidden state initialization and parameter loading, the event types and protocol semantics embedded in the standardized network event set are used as initial features, making the hidden state sensitive to attack patterns from the very beginning of its evolution. The path integral mechanism introduces dynamic weight correction based on the training label set on top of conventional numerical integration, giving control inputs related to attack events a higher proportion in the integration calculation. When the hidden state evolves continuously over time using the path integral mechanism, the hidden state not only reflects the cumulative effect over time but also maintains consistency among multiple nodes within the session through structural constraints aligned with the topology index, thereby generating a continuous-time hidden state sequence set that better matches the characteristics of intrusion behavior.

[0076] Steady-state constraints and numerical stability control are applied to a continuous-time hidden state sequence set, including adaptive step size, error threshold control, and a truncation strategy. A traceable time index is preserved. Adaptive step size no longer relies solely on local error adjustment but dynamically scales based on network event density, allowing finer step sizes for high-frequency event intervals to capture rapidly evolving characteristics. Error threshold control compares the error distribution with the training label set while evaluating local errors, making the tolerance for dense training data areas lower to ensure the numerical accuracy of key intrusion behaviors. The truncation strategy not only constrains the amplitude of hidden states but also sets dynamic thresholds based on the temporal duration characteristics of intrusion behaviors to prevent the infinite expansion of abnormal states. Preserving the traceable time index, combined with a topology index, allows each hidden state to be traced back to a specific time point and correspond to a specific network node and session, thereby enhancing the ability to locate intrusion behaviors.

[0077] The set of continuous temporal hidden state sequences is aligned at the session level according to the session association rules of the topology index. A set of continuous temporal context representations is generated by using timestamp alignment and identifier consistency verification. Session-level alignment not only ensures the temporal consistency within the same session, but also unifies multi-source events to a shared timeline through cross-node mapping relationships in the topology index. Timestamp alignment introduces protocol semantic constraints when handling deviations to ensure that the aligned time series can accurately reflect the communication interaction process. Identifier consistency verification maintains the correctness of connection identifiers and directions, and uses user identity information from system logs for secondary confirmation to prevent intruders from bypassing detection by identifier forgery. This generates a set of continuous temporal context representations with complete temporal sequence, topology structure, and behavioral semantics.

[0078] In this embodiment, the generation of the event intensity prediction sequence set and the identification intermediate representation set includes:

[0079] A neural Hawkes process recognition model was established and configured, defining the time domain range, the intensity function parameter range, and optimization boundary conditions. The time domain range is used to limit the start and end times of network intrusion event modeling, ensuring that all input data are modeled in the same time coordinate system. The intensity function parameter range is used to control the upper and lower limits of the event intensity, avoiding over-amplification or over-smoothing of intrusion events. The optimization boundary conditions are used to constrain the parameter search space during training and recognition, ensuring that the model converges to a solution that conforms to the laws of network intrusion behavior.

[0080] The system receives a set of continuous time context representations and a set of standardized network events, performs time alignment and session boundary consistency processing to obtain a set of aligned input sequences. The session boundary consistency processing refers to the process of correcting the consistency of network session start and end points based on connection opening and closing signals and log records, so that the context representation and event sequence of the same session are strictly corresponded and the intrusion behavior identification process is not deviated due to the inconsistency of session boundaries.

[0081] The system extracts a sequence of context vectors by time index from a continuous temporal context representation set, and calculates the time interval sequence of adjacent events based on a standardized set of network events. The context vector sequence and the time interval sequence are then combined to form an intensity input vector sequence. Extracting the context vector sequence by time index means obtaining context feature vectors one by one according to the event timestamp order, maintaining the temporal correspondence between the context and the event sequence. Calculating the time interval sequence of adjacent events means subtracting the event occurrence times one by one to obtain time interval features that reflect the frequency and suddenness of intrusion behavior. The intensity input vector sequence formed by combining these two sequences provides a unified input for the model to capture the temporal patterns and contextual dependencies of intrusion events.

[0082] Based on the aligned input sequence set, the intensity input vector sequence is used as the core input. Combined with protocol semantics and topology index, the intensity function modeling process is jointly driven to generate an event intensity prediction sequence set. The joint driving of the intensity function modeling process refers to fusing time interval features and context features to form a basic input vector. Protocol semantics is used to distinguish the interaction patterns of events at different protocol layers, and topology index is used to reflect the structural dependencies between network nodes. The three are mapped as dynamic influence factors in the same intensity function. The intensity function models the event arrival probability in the time dimension, so that the event intensity can change continuously over time and be jointly modulated by the input factors.

[0083] The specific process for generating the event intensity prediction sequence set is as follows: First, the instantaneous event intensity is calculated based on the intensity input vector sequence at each time point; second, the event intensity of different communication types is weighted and adjusted in combination with protocol semantics to conform to the behavioral characteristics of their respective protocols; then, the intensity relationship between different sessions is constrained by the topology index to ensure that the event intensity prediction results under the same network structure remain consistent; finally, the predicted intensity values ​​at each time point are arranged in order to form an event intensity prediction sequence set covering the entire session process, which is used for subsequent identification and classification tasks.

[0084] The event intensity prediction sequence set is indexed, associated, and concatenated with the context vector sequence at the corresponding time point to generate an intermediate representation set for recognition. The event intensity prediction sequence set and the intermediate representation set for recognition are then output. The indexing, association, and concatenation refers to matching the event intensity prediction sequence set with the corresponding context vector sequence one by one based on the time index and performing a concatenation operation on the feature dimension. This allows the event intensity and context information to be jointly expressed in the same representation, thereby generating an intermediate representation set for recognition that includes both dynamic features of intrusion intensity and semantic features of context, thus improving the ability to identify intrusion behavior.

[0085] In this embodiment, the generation of the inference configuration set includes:

[0086] The system receives a set of training labels, a set of event intensity prediction sequences, and a set of intermediate representations for recognition, and obtains a set of continuous-time context representations. It then establishes a joint training process for the neural Hawkes process recognition model and the neural controlled differential equation model. The joint training process refers to simultaneously optimizing the parameters of the two models under the same training framework. The neural Hawkes process recognition model is responsible for event intensity modeling, while the neural controlled differential equation model is responsible for continuous-time evolution representation. The two models achieve mutual constraints and collaborative optimization of parameter updates by sharing input and output objectives.

[0087] Based on timestamp alignment and session boundary marking, the training label set and the event intensity prediction sequence set are compared for correspondence. Simultaneously, the intermediate representation set and the continuous temporal context representation set are compared for consistency. This generates evaluation results for parameter updates. Correspondence comparison refers to comparing the outputs of the training label set and the event intensity prediction sequence set one by one according to the same time index position, ensuring that the prediction results strictly correspond to the real labels on the time axis. Consistency comparison refers to checking the structural and index consistency of the intermediate representation set and the continuous temporal context representation set within the same session boundary, ensuring that the behavioral semantics and temporal dependencies expressed by the two are consistent. Generating evaluation results for parameter updates means obtaining a difference metric between the model predictions and the real labels through the above comparison process, which serves as the input for subsequent parameter updates.

[0088] Based on the evaluation results, the trainable parameters of the neural Hawkes process recognition model and the neural controlled differential equation model are jointly updated. This process is repeated until the parameter updates stop, generating a set of candidate parameters. The joint update of the trainable parameters of the neural Hawkes process recognition model and the neural controlled differential equation model refers to the synchronous adjustment of the parameter values ​​of the two models in the same iteration. The parameter update of the neural Hawkes process recognition model depends on the difference between the event intensity prediction and the training label set, while the parameter update of the neural controlled differential equation model depends on the consistency between the context representation and the intermediate recognition representation. The two influence each other in the iteration to obtain the overall optimal set of parameters.

[0089] Based on the correspondence between the training label set and the event intensity prediction sequence set, the threshold and judgment conditions are determined, and a set of candidate intrusion behavior decision rules is generated. The determination of the threshold and judgment conditions refers to determining the boundary value that distinguishes normal behavior from intrusion behavior by the distribution pattern of the labeled events in the event intensity prediction sequence set and the training label set, and setting the condition rules for triggering the judgment, so that the generated set of candidate intrusion behavior decision rules can be directly used for behavior classification and discrimination in the subsequent reasoning process.

[0090] The consistency of the candidate parameter set and the candidate intrusion behavior decision rule set is verified using the training label set. The trained parameter set and intrusion behavior decision rule set that meet the consistency requirements are retained. The consistency verification refers to checking the fit between the candidate parameter set and the candidate intrusion behavior decision rule set within the training label set. The candidate parameter set is required to maintain consistency with the time dependency of the training label set in terms of prediction output, and the candidate intrusion behavior decision rule set is required to maintain consistency with the event category of the training label set in terms of classification judgment. Only when both of them meet the consistency conditions are they retained as the final version.

[0091] The set of intrusion behavior decision rules is combined with the set of trained parameters to form an inference configuration set, and the inference configuration set is output for subsequent steps.

[0092] In this embodiment, the generation of the new event intensity prediction sequence set and the new candidate trigger time set includes:

[0093] Collect new multidimensional network data, perform data preprocessing operations, including denoising, time alignment, identification and standardization, and generate a new standardized set of network events and a new set of network control path inputs;

[0094] The inference configuration set is loaded, and the trained parameter set and intrusion behavior decision rule set are initialized as the inference runtime environment. Initialization as the inference runtime environment means mapping the trained parameter set to the internal structure of the neural controlled differential equation model and the neural Hawkes process recognition model. This is used to limit the numerical boundaries and update conditions of continuous time evolution and intensity function modeling. At the same time, the intrusion behavior decision rule set is embedded into the judgment module of the recognition process. This makes the model output not only dependent on the temporal pattern and contextual dependency of historical events, but also consistent with the behavior judgment conditions extracted in the training stage. Thus, it has both dynamic evolution driving capability and rule-based decision capability in the inference process, realizing the organic combination of parameter-driven and rule-driven, and improving the accuracy and interpretability of intrusion behavior recognition.

[0095] Using the new standardized set of network events and the new set of network control path inputs as inputs, a neural controlled differential equation model is run, continuous-time evolution and session-level alignment are performed, and a new set of continuous-time context representations is generated.

[0096] Taking the new continuous-time context representation set and the new standardized network event set as input, the neural Hawkes process recognition model is run, and the intensity function modeling process is invoked to generate a new event intensity prediction sequence set and a new candidate trigger time set.

[0097] In this embodiment, the generation of the network intrusion behavior identification result set includes:

[0098] Using a set of new event intensity prediction sequences as input, the set of intrusion behavior decision rules is applied in time stamp order to perform point-by-point judgment, resulting in intrusion behavior judgment results corresponding to time positions. Point-by-point judgment means reading the intensity values ​​of the set of new event intensity prediction sequences one by one in the time series, and calling the condition threshold and rule set in the set of intrusion behavior decision rules at the same time position to make a judgment. The intensity value of each time point is compared with the corresponding threshold to generate a judgment result corresponding to each time point. This judgment process ensures the accuracy of intrusion behavior recognition at the time granularity.

[0099] The new candidate trigger time set and the intrusion behavior judgment result are marked according to the time index to generate the trigger mark result. The corresponding mark according to the time index means that the timestamps in the new candidate trigger time set are matched one by one with the timestamps in the intrusion behavior judgment result. When the two are aligned under the same time index, the trigger point mark in the trigger time set is attached to the intrusion behavior judgment result to form a judgment entry with trigger mark, thereby realizing the mapping between the trigger event and the judgment result.

[0100] The intrusion behavior determination result and the trigger mark result are correlated with the new event intensity prediction sequence set on the time index to generate an aggregate record. Correspondence means that the intrusion behavior determination result, the trigger mark result and the intensity value of the new event intensity prediction sequence set are aligned in three directions with the time index as a unified reference, and an aggregate record is generated at the same time position. The aggregate record completely saves the correspondence between the intensity value, the determination result and the trigger mark, ensuring that the results of different dimensions are traceable and consistent in the time dimension.

[0101] All aggregated records are gathered to generate a network intrusion behavior identification result set. This set includes a time index consistent with the new event intensity prediction sequence set, intrusion behavior judgment results generated based on the intrusion behavior decision rule set, trigger timestamps consistent with the new candidate trigger time set, and a mapping of correspondences between the new event intensity prediction sequence set, the new candidate trigger time set, and the intrusion behavior decision rule set. The time index is a timestamp identifier used uniformly throughout all steps to maintain time alignment between different sets. The intrusion behavior judgment results are intrusion behavior categories or status labels generated based on point-by-point judgments, reflecting whether an intrusion behavior occurred at a specific time point. The trigger timestamps are time point markers inherited from the new candidate trigger time set and mapped to the judgment results, used to indicate potential intrusion trigger times. The mapping of correspondences refers to storing a multi-dimensional comparison between intensity prediction values, judgment results, and trigger timestamps in the identification result set, enabling each result to be traced back to its source input in the time dimension, thereby ensuring the integrity and verifiability of the identification results.

[0102] Example 1:

[0103] To verify the feasibility of this invention in practice, it was applied to an intrusion behavior identification and detection experiment in a large enterprise-level network environment. This network environment includes office terminals, database servers, external internet interfaces, and multiple internal application systems, frequently experiencing a large volume of normal business traffic and periodic system calls. Under these complex conditions, traditional intrusion detection methods based on rule matching or shallow features often fail to accurately distinguish between normal operations and abnormal intrusion behaviors, especially in high-concurrency, multi-protocol, and cross-time-dimension attack scenarios, easily leading to false negatives and false negatives. For example, when encountering distributed denial-of-service attacks or cross-session penetration attacks, traditional detection methods cannot capture the continuous characteristics of the attack over time, nor can they comprehensively utilize contextual information for reasoning, resulting in insufficient detection accuracy.

[0104] In application, the data acquisition and preprocessing module of this invention first transforms data packet information, protocol fields, session markers, and context features in network traffic into a standardized set of network events, while simultaneously generating a network control path input set for constructing a continuous-time context representation. Based on this, a neural controlled differential equation model is used to model network events in a continuous time manner, generating context representations through temporal evolution to capture long-term dependencies between events. Subsequently, an event intensity model is built based on a neural Hawkes process recognition model, using the fusion of context vectors, time intervals, and protocol semantics to form an event intensity prediction sequence, which is further combined with intermediate recognition representations to generate candidate judgment criteria. During joint training, the model continuously optimizes by comparing the differences between training labels and predicted intensity, obtaining a trained parameter set and an intrusion behavior decision rule set, ultimately forming an inference configuration set. After loading the inference configuration set, with real-time input of new data, the system can quickly output a set of intrusion behavior recognition results, including intrusion behavior judgment results, trigger time markers, and mappings between these results and the inputs, achieving automated and intelligent intrusion behavior recognition.

[0105] During the experimental phase, we selected network traffic data exceeding 12 million event records, covering normal business traffic and mixed traffic containing multiple attack methods. In the detection task, our method was compared with traditional rule-matching-based IDS methods and shallow machine learning-based intrusion detection methods. The comparison metrics included intrusion identification accuracy, false positive rate, false negative rate, average detection latency, and system resource utilization. The data results are shown in Table 1 below:

[0106] Table 1. Performance comparison results between the method of the present invention and the traditional method

[0107] index Traditional rule matching methods Shallow machine learning methods Method of the present invention Intrusion detection accuracy 84.7% 89.2% 94.8% False alarm rate 6.5% 4.8% 2.1% underreporting rate 8.8% 6.0% 2.9% Average detection latency (ms) 145 110 68 System resource utilization (%) 42 38 36

[0108] As shown in Table 1, the method of this invention significantly outperforms traditional methods in terms of intrusion identification accuracy, reaching 94.8%, which is 10.1 percentage points higher than rule matching methods and 5.6 percentage points higher than shallow machine learning methods. This improvement is due to the fact that this invention not only introduces dynamic evolution modeling of time series data but also combines protocol semantics and contextual information, enabling the model to achieve higher discrimination capabilities in complex attack scenarios. Regarding the false positive rate, the method of this invention reduces it to 2.1%, far lower than the 6.5% of rule matching methods and the 4.8% of shallow learning methods, effectively reducing the number of cases where normal operations are incorrectly marked as intrusions. This is mainly due to the fact that the present invention integrates multi-dimensional contextual features into the intermediate representation set, making the judgment more robust. In terms of false negative rate, the method of the present invention is controlled at 2.9%, which is significantly lower than the 8.8% of the rule matching method and the 6.0% of the shallow learning method, indicating that the attack behavior is more difficult to evade detection. This reflects the coverage advantage of the event intensity prediction and context association mechanism. In terms of detection latency, the average detection latency of the method of the present invention is only 68 milliseconds, which is significantly lower than the 145 milliseconds of the rule matching method and the 110 milliseconds of the shallow method, which fully demonstrates that it can meet the real-time requirements while ensuring high accuracy. In terms of system resource utilization, the method of the present invention is maintained at 36%, which is lower than the 42% of the rule matching method and the 38% of the shallow method, which maintains high resource utilization efficiency while significantly improving accuracy.

[0109] The performance improvement is mainly due to the following aspects: The continuous-time context representation mechanism, based on the evolutionary capability of the neural controlled differential equation model, fully preserves the dynamic characteristics of the event sequence in the time dimension, enabling the recognition results to more accurately reflect the evolutionary laws of network intrusion behavior; Event intensity modeling introduces a fusion mechanism of protocol semantics and context vector sequences into the neural Hawkes process recognition model, so that event prediction not only depends on time intervals but also utilizes protocol logic and topological information, thereby improving the accuracy of intensity prediction; The joint training mechanism ensures collaborative optimization between the models at the discrimination and evolution levels by synchronously updating the parameters of the neural Hawkes process recognition model and the neural controlled differential equation model, effectively reducing the false positive rate and false negative rate; The inference configuration set combines the trained parameter set with the intrusion behavior decision rule set, making online inference both efficient and ensuring the consistency between the recognition results and historical training logic; The introduction of multi-level correspondence between trigger time markers and judgment results in the result generation process ensures that the output network intrusion behavior recognition result set is doubly guaranteed in terms of temporal accuracy and logical consistency.

[0110] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A deep learning based multi-dimensional network intrusion behavior intelligent identification method, characterized in that, The method comprises the following steps: Collecting network multidimensional data, performing data preprocessing, generating a standardized network event set, a network control path input set, and a training label set; Establishing a neural controlled differential equation model, taking the standardized network event set and the network control path input set as inputs, driving the evolution of hidden states through path integration, and generating a continuous-time context representation set; Establishing a neural Hawkes process identification model, taking the continuous-time context representation set and the standardized network event set as inputs, modeling the event arrival process through an intensity function, generating an event intensity prediction sequence set and an identification intermediate representation set; Based on the training label set, the event intensity prediction sequence set, and the identification intermediate representation set, jointly training the neural Hawkes process identification model and the neural controlled differential equation model to generate an intrusion behavior decision rule set and a reasoning configuration set; Collecting new network multidimensional data, performing data preprocessing, loading the reasoning configuration set, running the neural controlled differential equation model and the neural Hawkes process identification model, and outputting a new event intensity prediction sequence set and a new candidate trigger time set; Based on the new event intensity prediction sequence set, the new candidate trigger time set, and the intrusion behavior decision rule set, generating a network intrusion behavior identification result set. 2.The deep learning based multi-dimensional network intrusion behavior intelligent identification method of claim 1, wherein, The generation of the standardized network event set, the network control path input set, and the training label set comprises: Collecting network multidimensional data, including packet-level data, flow-level statistics, host topology, protocol semantics, and system logs; Performing denoising, time alignment, identification, and standardization on the packet-level data, flow-level statistics, protocol semantics, and system logs in the network multidimensional data; Performing identification and standardization on the host topology in the network multidimensional data to generate a topology index; Based on the processed packet-level data, flow-level statistics, host topology, protocol semantics, and system logs, merging to generate the standardized network event set and the network control path input set, and generating the training label set based on the system logs. 3.The deep learning based multi-dimensional network intrusion behavior intelligent identification method of claim 1, wherein, The generation of the continuous-time context representation set comprises: Establishing and configuring the neural controlled differential equation model, setting the time domain, evolution step threshold, numerical error threshold, evolution depth, and boundary processing strategy; Receiving the standardized network event set and the network control path input set, completing timestamp sorting, session boundary marking, and data consistency checking; Performing continuous processing and interpolation strategy on the network control path input set, preserving the event time unevenness to form continuous-time evolution driving; Based on the standardized network event set, initializing and loading the hidden state parameters, calling the continuous-time evolution driving as the control input, combining the path integration mechanism to drive the continuous evolution of the hidden state over time, and generating a continuous-time hidden state sequence set; Performing steady-state constraint and numerical stability control on the continuous-time hidden state sequence set; Aligning the continuous-time hidden state sequence set at the session level according to the session association rules of the topology index, and generating the continuous-time context representation set through timestamp alignment and identification consistency checking.

4. The method of claim 1, wherein the method comprises: The generation of the event intensity prediction sequence set and the identification intermediate representation set comprises: Establish and configure the neural Hawkes process identification model, set the time domain range, intensity function parameter range and optimization boundary condition; Receive the continuous time context representation set and the standardized network event set, perform time alignment and session boundary consistency processing to obtain an aligned input sequence set; Extract context vector sequences from the continuous time context representation set according to the time index, and calculate the time interval sequence of adjacent events based on the standardized network event set, to combine the context vector sequence and the time interval sequence to form an intensity input vector sequence; Based on the aligned input sequence set, call the intensity input vector sequence as the core input, and combine the protocol semantics and the topology index to jointly drive the intensity function modeling process to generate an event intensity prediction sequence set; Index and associate the event intensity prediction sequence set with the context vector sequence at the corresponding time point, and splice them to generate an identification intermediate representation set.

5. The method of claim 1, wherein the method further comprises: The generation of the intrusion behavior decision rule set and the reasoning configuration set includes: Receive the training label set, the event intensity prediction sequence set and the identification intermediate representation set, and obtain the continuous time context representation set, establish the joint training process of the neural Hawkes process identification model and the neural controlled differential equation model; Based on the timestamp alignment and session boundary marking, compare the training label set and the event intensity prediction sequence set, and at the same time, compare the identification intermediate representation set and the continuous time context representation set for consistency, to generate evaluation results for parameter updating; Based on the evaluation results, jointly update the trainable parameters of the neural Hawkes process identification model and the neural controlled differential equation model, and repeat the execution until the parameter updating stops, to generate a candidate parameter set; Determine the threshold and the judgment condition based on the corresponding relationship between the training label set and the event intensity prediction sequence set, to generate a candidate intrusion behavior decision rule set; Use the training label set to perform consistency verification on the candidate parameter set and the candidate intrusion behavior decision rule set, and retain the trained parameter set and the intrusion behavior decision rule set that meet the consistency requirements; Combine the intrusion behavior decision rule set and the trained parameter set to form the reasoning configuration set.

6. The method of claim 1, wherein the method is characterized by, The generation of the new event intensity prediction sequence set and the new candidate trigger time set includes: Collect new network multidimensional data, perform data preprocessing operations, generate a new standardized network event set and a new network control path input set; Load the reasoning configuration set, initialize the trained parameter set and the intrusion behavior decision rule set to the reasoning running environment; Take the new standardized network event set and the new network control path input set as input, run the neural controlled differential equation model, perform continuous time evolution and session-level alignment, and generate a new continuous time context representation set; Take the new continuous time context representation set and the new standardized network event set as input, run the neural Hawkes process identification model, call the intensity function modeling process, and generate a new event intensity prediction sequence set and a new candidate trigger time set.

7. The method of claim 1, wherein the method further comprises: The generation of the network intrusion behavior identification result set includes: The new event intensity prediction sequence set is input, and point-by-point judgment is performed according to the time stamp order by applying the intrusion behavior decision rule set to obtain an intrusion behavior judgment result corresponding to a time position; The new candidate trigger time set and the intrusion behavior judgment result are marked according to the time index to generate a trigger marking result; The intrusion behavior judgment result and the trigger marking result are associated with the new event intensity prediction sequence set according to the time index to generate an aggregation record; All the aggregation records are collected to generate a network intrusion behavior recognition result set, which includes the time index consistent with the new event intensity prediction sequence set, the intrusion behavior judgment result generated based on the intrusion behavior decision rule set, the trigger time marking consistent with the new candidate trigger time set, and the corresponding relationship mapping between the new event intensity prediction sequence set, the new candidate trigger time set and the intrusion behavior decision rule set.

Images