Network intrusion real-time detection system based on deep learning
The real-time network intrusion detection system based on deep learning encodes and inserts data packets and performs verification processing to identify and remove abnormal data packets. This solves the problem of increased server load and risk associated with traditional intrusion detection, and achieves secure encryption of data packets and real-time removal of abnormal data packets.
Patent Information
- Application Number
- CN202511685415.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-18
- Publication Date
- 2026-02-17
- Estimated Expiration
- Not applicable · inactive patent
AI Technical Summary
Traditional intrusion detection relies primarily on server firewalls to identify data signatures, which can lead to unidentified risky data directly entering the server, increasing the risk of server intrusion and increasing the server load.
A deep learning-based real-time network intrusion detection system is adopted. Through a packet disassembly module, an encoding insertion and location module, a packet transmission path identification module, an encoding verification module, a decoding response module, and a model training module, the system performs packet encoding insertion and verification processing, identifies and eliminates abnormal packets, and reduces the server detection burden and risk.
Verification is performed on data packets before they enter the server to eliminate abnormal data packets, reduce the server's detection burden and risk, lower the risk of network intrusion, and improve the security of data packet encryption.
Smart Images
Figure CN121547232A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The application relates to the technical field of network intrusion detection, in particular to a network intrusion real-time detection system based on deep learning. BACKGROUND
[0002] In today's digital age, network security has become a key area for protecting information systems from malicious attacks. With the increasing complexity and frequency of cyber attacks, intrusion detection technology has become a core component of the defense system.
[0003] Early network security mainly relied on passive defense tools such as firewalls, but firewalls can only filter traffic based on predefined rules and cannot respond to new attacks. With the diversification of cyber attacks, intrusion detection systems have emerged to monitor network traffic and system behavior in real time and identify abnormal patterns.
[0004] Especially for industrial data network transmission, the data transmission path is constant, and the transmission object is also basically fixed, that is, a fixed number of servers are used to receive remote real-time data. Traditional intrusion detection mainly uses the firewall of the server to identify data characteristics. This processing method not only increases the risk of server intrusion, that is, unidentifiable risk data will directly enter the server, but also increases the load of the server.
[0005] In order to solve the above problems, there is an urgent need for a network intrusion real-time detection system based on deep learning that can intercept and identify. SUMMARY
[0006] The purpose of the present application is to provide a network intrusion real-time detection system based on deep learning. By inserting the encoding positioning module to obtain the verification code item in the uploaded data packet, the encoded data packet is inserted in sequence after being disassembled, and the encrypted data packet is regenerated. The encoding and inspection module is used to identify the code positioning according to the verification code item, and the response decryption data packet and the abnormal data packet are divided. The data packet uploaded before entering the server is subjected to verification code processing, and the abnormal data packet with intrusion risk is removed, reducing the server detection burden and risk. At the same time, during the data packet encryption process, the verification code item is used for random encryption processing, so that the encryption risk of the encrypted data packet is reduced, thereby solving the problems in the above background technology, that is: Traditional intrusion detection mainly uses the firewall of the server to identify data characteristics. This processing method not only increases the risk of server intrusion, that is, unidentifiable risk data will directly enter the server, but also increases the load of the server.
[0007] In order to achieve the above object, the network intrusion real-time detection system based on deep learning is provided, comprising a data packet disassembly module, an encoding insertion positioning module, a data packet transmission path identification module, an encoding inspection module, a decoding response module and a model training module.
[0008] The data packet uploaded to the server is disassembled by the data packet disassembly module to obtain the character arrangement order in the data packet, thereby providing a basis for subsequent encoding insertion; In order to ensure the subsequent encoding identification and decoding work, the data packet transmission path identification module is required to monitor the data packet transmission path, obtain the number of the uploading server, and feed back to the encoding insertion positioning module, so as to mark the verification code item in combination with the number of the uploading server and the uploading time, insert the encoding order, regenerate the encrypted data packet, that is, perform data packet encryption processing by using BASE64 encoding, insert the inserted encoding according to the uploading time and the number of the uploading server, wherein the number of the uploading server is used to position the cyclic bit range of the encoding insertion, and the uploading time is used to position the specific position in the cyclic bit range of the encoding insertion, after the encoding insertion is completed, the data packet is converted into a byte sequence, 8-bit byte division is performed, the byte sequence is divided into 3-byte groups, each group is further divided into 4 6-bit groups, if the input byte number is not a multiple of 3, a padding byte needs to be added, the value of the padding byte is 0, and 4 6-bit groups are mapped to a BASE64 character set, each 6-bit group is converted into a decimal value, and the character group after data packet encryption is obtained; In the decryption process, the encrypted data packet is received by the encoding inspection module, and the encoding is positioned and identified according to the verification code item, the response decryption data packet and the abnormal data packet are divided, the character group is mapped into 8-bit bytes, and the encoding is positioned and inserted in the 8-bit bytes according to the verification code item; When the inserted encoding exists in the corresponding position of the segmented 8-bit bytes, the response decryption data packet is marked; Conversely, if the inserted encoding does not exist in the corresponding position of the segmented 8-bit bytes or the inserted encoding is wrong, the abnormal data packet is marked, and needs to be returned to the input location for verification.
[0009] Finally, the model training module learns the encoding order insertion and decoding strategy, and automatically processes the encryption and decryption process of the data packet.
[0010] Compared with the prior art, the network intrusion real-time detection system based on deep learning has the following beneficial effects: In the deep learning-based network intrusion real-time detection system, the code item in the uploaded data packet is obtained through the code insertion positioning module, the coded data packet is inserted in sequence after being disassembled, and the encrypted data packet is regenerated. The code inspection module is used for code positioning and identification according to the code item, and the response decryption data packet and the abnormal data packet are divided. The code of the uploaded data packet is processed before entering the server, and the abnormal data packet with invasion risk is removed, thereby reducing the detection burden and risk of the server. Meanwhile, in the data packet encryption process, the code item is used for random encryption processing, so that the encryption risk of the encrypted data packet is reduced, and the network intrusion risk is further reduced. BRIEF DESCRIPTION OF DRAWINGS
[0011] Figure 1 It is a whole structure diagram of the present application; Figure 2 It is a code insertion schematic diagram of the present application.
[0012] The meanings of various numbers in the figure are as follows: 10, data packet disassembly module; 20, code insertion positioning module; 30, data packet transmission path identification module; 40, code inspection module; 50, decoding response module; 60, model training module. DETAILED DESCRIPTION
[0013] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.
[0014] Please refer to Figure 1 As shown in the figure, a deep learning-based network intrusion real-time detection system is provided, which includes a data transmission end, an intermediate node, a plurality of servers and a model training module 60; The data transmission end includes a data packet disassembly module 10, a code insertion positioning module 20 and a data packet transmission path identification module 30; The data packet disassembly module 10 is used for data disassembly of the data packet uploaded to the server, and the character arrangement order in the data packet is obtained; The data packet transmission path identification module 30 is used for monitoring the data packet transmission path, obtaining the number of the uploaded server, and feeding back to the code insertion positioning module 20; The encoding insertion positioning module 20 obtains the verification code item in the uploaded data packet, performs encoding order insertion on the disassembled data packet, and regenerates an encrypted data packet; The intermediate node includes an encoding verification module 40 and a decoding response module 50; The encoding verification module 40 is used for receiving an encrypted data packet, and performing encoding positioning identification according to the verification code item, dividing a response decryption data packet and an abnormal data packet; The decoding response module 50 is used for identifying a response decryption data packet, and performing decoding processing according to the corresponding verification code item, obtaining an original data packet, and uploading to the corresponding encoded server; The model training module 60 deeply learns the encoding order insertion and decoding strategy, and automatically processes the encryption and decryption process of the data packet.
[0015] The specific content is as follows: The data transmission end is used for receiving each item of uploaded data, and performing data disassembly on the data packet of the uploaded server through the data packet disassembly module 10, obtaining the character arrangement order in the data packet, and the obtaining method is as follows: First, the character composition of the entire data packet is obtained, in order to prevent subsequent encoding insertion from damaging the data packet, in this scheme, the character segment is marked as an integral character, for example, the head character segment HTTP, the arrangement order of each character and the integral character is marked, the first character is marked according to the base-24, that is, every 24 characters or integral characters are a cycle, as shown in the following formula: Figure 2 The character group is It is the first cycle position, that is, the insertion range corresponding to server 1, when the entire data packet needs to be uploaded to server 1, the encoding insertion position is selected from the first cycle position, and the character group is It is the second cycle position, that is, the insertion range corresponding to server 2, when the entire data packet needs to be uploaded to server 2, the encoding insertion position is selected from the second cycle position.
[0016] After completing the character disassembly of the data packet, in order to ensure the subsequent encoding identification and decoding work, the data packet transmission path identification module 30 needs to monitor the data packet transmission path, obtain the number of the uploaded server, and feed back to the encoding insertion positioning module 20, cooperate with the encoding insertion positioning module 20 to combine the number of the uploaded server and the upload time, mark as a verification code item, perform encoding order insertion on the disassembled data packet, and regenerate an encrypted data packet, and the encryption method is as follows: This scheme uses BASE64 encoding to perform data packet encryption processing, in the encryption process, first identify the verification code item of the current uploaded data packet, that is, the upload time and the number of the uploaded server, wherein the number of the uploaded server is used to position the cycle position range of the encoding insertion, and the upload time is used to position the specific position in the cycle position range of the encoding insertion, for example,Figure 2 As shown, when the data packet is uploaded to server 1 at 22:24, the inserted cyclic bit is the first cyclic bit, and the specific insertion position is between the 22nd and 23rd sequence positions in the first cyclic bit, i.e., between characters A and C for encoding insertion. When the data packet is uploaded to server 2 at 2:30, the inserted cyclic bit is the second cyclic bit, and the specific insertion position is between the 2nd and 3rd sequence positions in the second cyclic bit, i.e., between characters G and V for encoding insertion. After the encoding insertion is completed, the inserted data packet is BASE64 encoded, and the data packet is converted into a byte sequence (ASCII value). Each byte occupies 8 bits. For example, "M" The byte sequence is divided into 3-byte groups 24 bits, and each group is further divided into 4 6-bit groups. If the number of input bytes is not a multiple of 3, a padding byte with a value of 0 needs to be added. For example, the input "A" " is 3 bytes, the corresponding byte 1 is (M), byte 2 is ), and byte 3 is (n). The combination of 24 bits is: , which is divided into 4 6-bit groups: , , , . Then, the 4 6-bit groups are mapped to the BASE64 character set. Each 6-bit group is converted into a decimal value (range 0-63), where , , , , i.e., "A" " is encoded as "TWFu". If the number of input bytes is not a multiple of 3, 1 or 2 padding characters "=" are added at the end. For example, the input "A" is 1 byte, and 2 padding bytes with a value of 0 need to be added. The division into 6-bit groups is: , , , , and the mapping result is "QQ==" (because the last two groups are all 0, corresponding to index , but padding is required).
[0017] It is worth noting that the encoding for BASE64 encoding insertion is determined by the corresponding user. Although the insertion rule is fixed, the encoding and insertion position for insertion are not fixed, thereby ensuring the randomness of the encoding and improving the security effect.
[0018] The completed encrypted data packet will be intercepted by the intermediate node, which includes both the data packet uploaded from the data transmission end and the intruded network data packet. At the intermediate node, the coded inspection module 40 is used to receive the encrypted data packet and identify the coding position according to the code inspection item, divide the response decryption data packet and the abnormal data packet, and the division process is as follows: First, the received data packet (including the intruded network data packet and the data packet uploaded from the data transmission end) is filtered, and the non-BASE64 characters in the data packet are filtered to retain valid characters such as "A-Z", "0-9", "+" and " / ". -z", "0-9", "+" and " / " etc. Also, the padding bytes, i.e. "QQ==", will be removed "==", and "TWFu" will be directly processed without filtering. After completing the data packet filtering, the remaining characters in the data packet are mapped back to the index value of 0-63, i.e. "TWFu" , , , , and then a corresponding number of 6-bit combinations are combined into a corresponding number of 8-bit bytes, where , , , will be combined into , and byte segmentation will be performed, for example will be segmented into , , , and the inserted coding position is identified according to the code inspection item. It is worth noting that the inserted coding is identified in the form of 8-bit bytes, and the corresponding position is determined by the upload time and the upload server coding. If the inserted coding exists in the segmented 8-bit bytes at the corresponding position, it will be marked as a response decryption data packet, otherwise if the inserted coding does not exist or is incorrect in the segmented 8-bit bytes at the corresponding position, it will be marked as an abnormal data packet and returned to the transmission end for verification. For example, the inserted coding is in the first loop position, which means that the current uploaded data packet needs to be transmitted to server 1, and the transmission character group is , where is the inserted coding, and the upload time of the uploaded data packet is between 22:00 and 23:00. At this time, if is obtained in the 23rd position of the segmented 8-bit bytes, it means that the current uploaded data packet is a response decryption data packet uploaded from the data transmission end, otherwise it is marked as an abnormal data packet.
[0019] Further, the response decryption data packet is identified by the decoding response module 50, and decoding processing is performed according to the corresponding code item to obtain the original data packet and upload it to the corresponding encoded server. During the decoding process, since the code checking module 40 checks the code, the original data packet will be disassembled into corresponding 8-bit bytes, and the inserted 8-bit byte position has been positioned. Therefore, during subsequent decoding, the inserted 8-bit byte position will be directly positioned, and the inserted 8-bit byte will be removed from the 8-bit byte combination. The 8-bit byte is mapped back to the corresponding character, that is , , , identify the 0 value byte in the 8-bit byte, that is , and remove the 0 value byte, and combine it into the original upload data packet in sequence. Finally, the original upload data packet is sent to the corresponding server according to the code item.
[0020] It is worth noting that in order to realize automatic encryption and decryption, the model training module 60 learns the encoding order insertion and decoding strategy in depth, automatically processes the encryption and decryption process of the data packet, and uses a CNN-LSTM hybrid model for analysis and processing. The CNN layer: uses BASE64 encoding to train the data packet from character conversion to byte sequence. The character composition of the data packet in the experimental group is disassembled, and character and overall character labels are sequentially performed. The first character is labeled in base 24, that is, every 24 characters or overall characters are a cycle. The inserted code position in the code item is extracted, combined with the upload time and upload server number for automatic code insertion, and the decoding process in the intermediate node is trained, that is, the byte sequence is mapped to characters, and the inserted code in the corresponding position is identified. The response decryption data packet and the abnormal data packet are identified, and finally the inserted code and 0 value byte in the response decryption data packet are removed, and the original data packet is retained; The corresponding LSTM layer is used to collect the encryption and decryption success rate in the sample set and the abnormal data packet identification success rate in the process of inserting the code and verifying the code, determine whether the inserted code position is successful, when the corresponding position in the segmented 8-bit byte exists the inserted code, it will be marked as a response decryption data packet, the amount of sample data packet decrypted successfully in the sample set is counted, the encryption and decryption success rate is calculated, otherwise if the corresponding position in the segmented 8-bit byte does not exist the inserted code or the inserted code is wrong, it will be marked as an abnormal data packet, which needs to be returned to the transmission place for verification, the amount of returned abnormal data packets is collected, the abnormal data packet identification success rate is calculated, the encryption state is fed back through the encryption and decryption success rate and the abnormal data packet identification success rate, that is, the uploaded data packet in the server is traced back, whether the upload content and upload location of the uploaded data packet meet the current server receiving range is compared, and through long-term deep learning, the data packet automatic disassembly, code automatic insertion, automatic code verification, automatic code deletion and character mapping recovery data packet whole process are realized, so as to be applied to the actual network data transmission process, and the network intrusion real-time detection work is carried out.
[0021] The application obtains the code verification item in the uploaded data packet through the code insertion positioning module 20, inserts the code in sequence for the disassembled data packet, regenerates the encrypted data packet, cooperates with the code verification module 40 to perform code positioning identification according to the code verification item, divides the response decryption data packet and the abnormal data packet, performs code verification on the uploaded data packet before entering the server, removes the abnormal data packet with intrusion risk, reduces the server detection burden and risk, and at the same time, in the data packet encryption process, the code verification item is used for random encryption processing, so that the encryption risk of the encrypted data packet is reduced, and the network intrusion risk is further reduced.
[0022] The basic principles, main features and advantages of the application are shown and described above. It should be understood by those skilled in the art that the application is not limited by the above examples, the above examples and descriptions in the specification are only preferred examples of the application, and are not used to limit the application, various changes and improvements of the application can be made without departing from the spirit and scope of the application, and these changes and improvements all fall within the scope of the claimed application. The scope of protection of the application is defined by the appended claims and their equivalents.
Claims
1. A deep learning-based network intrusion real-time detection system, characterized in that: The data transmission terminal, the intermediate node, a plurality of servers and a model training module (60) are included. The data transmission terminal includes a data packet disassembling module (10), an encoding insertion positioning module (20) and a data packet transmission path identification module (30). The data packet disassembling module (10) is used for disassembling data packets uploaded to a server to obtain the character arrangement order in the data packets. The data packet transmission path identification module (30) is used for monitoring the data packet transmission path, obtaining the number of the uploading server and feeding back to the encoding insertion positioning module (20). The encoding insertion positioning module (20) obtains the check code item in the uploaded data packet, inserts the encoding order into the disassembled data packet and regenerates an encrypted data packet. The intermediate node includes an encoding checking module (40) and a decoding response module (50). The encoding checking module (40) is used for receiving the encrypted data packet, performing encoding positioning identification according to the check code item, dividing the response decryption data packet and the abnormal data packet. The decoding response module (50) is used for identifying the response decryption data packet, performing decoding processing according to the corresponding check code item, obtaining the original data packet and uploading to the corresponding encoded server. The model training module (60) learns the encoding order insertion and decoding strategy in depth and automatically processes the encryption and decryption process of the data packet. 2.The deep learning based network intrusion real-time detection system of claim 1, wherein: The method for obtaining the character arrangement order in the data packet in the data packet disassembling module (10) includes the following steps. S101, obtaining the character composition of the entire data packet; S102, performing label processing on the arrangement order of each character and the overall character; S103, marking the first character of the divided character and dividing the circular position according to the first character mark. 3.The deep learning based network intrusion real-time detection system of claim 2, wherein: The overall character in S102 is a character segment. 4.The deep learning based network intrusion real-time detection system of claim 2, wherein: The first character mark in S103 is marked in base 24.
5. The deep learning based network intrusion real-time detection system of claim 1, wherein: The check code item in the encoding insertion positioning module (20) includes the data packet uploading time and the number of the data packet uploading server. 6.The deep learning based network intrusion real-time detection system of claim 5, wherein: The number of the data packet uploading server is used for positioning the circular position range of the encoding insertion, and the uploading time is used for positioning the specific position in the circular position range of the encoding insertion. 7.The deep learning based network intrusion real-time detection system of claim 6, wherein: The method for inserting the encoding order into the disassembled data packet in the encoding insertion positioning module (20) includes the following steps. S201, identifying the check code item of the current uploaded data packet and inserting the encoding into the corresponding character position in the data packet according to the check code item; S202, performing BASE64 encoding on the inserted data packet to convert the data packet into a byte sequence; S203, dividing the byte sequence into 3-byte groups, and further dividing each group into 4 groups of 6 bits; S204, mapping the 4 groups of 6 bits in each group to the BASE64 character set, and converting each group of 6 bits to a decimal value; S205, if the input byte number is not a multiple of 3, a padding byte needs to be added, and the value of the padding byte is 0. 8.The deep learning based network intrusion real-time detection system of claim 1, wherein: The method for dividing the response decryption data packet and the abnormal data packet in the encoding checking module (40) includes the following steps. S401, performing filtering processing on the received data packet to filter the non-BASE64 characters in the data packet and retain the valid characters; S402, mapping the remaining characters in the data packet back to index values from 0 to 63; S403, mapping the corresponding number of 6-bit combinations to the corresponding number of 8-bit bytes, and performing byte segmentation; S404, identifying the insertion coding position according to the code checking item; When there is an insertion coding in the corresponding position of the segmented 8-bit byte, it will be marked as a response decryption data packet; When there is no insertion coding or the insertion coding is incorrect in the corresponding position of the segmented 8-bit byte, it will be marked as an abnormal data packet. 9.The deep learning based network intrusion real-time detection system of claim 1, wherein: The method for obtaining the original data packet in the decoding response module (50) includes the following steps: S501, locate the 8-bit byte position of the insertion coding, and remove the 8-bit byte with the insertion coding from the 8-bit byte combination; S502, map the 8-bit byte back to the corresponding character; S503, identify the 0-value byte in the 8-bit byte, remove the 0-value byte, and combine it in order to form the original upload data packet. 10.The deep learning based network intrusion real-time detection system of claim 1, wherein: The model training module (60) uses a CNN-LSTM hybrid model for deep learning, where the CNN layer: uses BASE64 encoding training data packet to convert characters to byte sequence, extracts the insertion coding position in the code checking item, combines the upload time and upload server number for automatic coding insertion, and trains the decoding process in the intermediate node; The LSTM layer: is used to collect the encryption and decryption success rate and abnormal data packet recognition success rate in the sample set during each insertion coding and code checking process, and to trace the data packet uploaded to the server, compare the upload content and upload location of the uploaded data packet with the current server receiving range.