Artificial intelligence-based network intrusion detection method and device, and storage medium

Abstract

The application discloses a network intrusion detection method and device based on artificial intelligence and a storage medium, and comprises the following steps: step one, generating session communication metadata; step two, generating echo mode data; step three, generating a causal driving behavior sequence; step four, inputting the causal driving behavior sequence into a behavior residual matching network to generate behavior residual features through a main branch; step five, generating historical behavior residual features through a shadow branch; step six, inputting the behavior residual features and the historical behavior residual features into a residual attention matching layer to generate a residual matching result; and step seven, recording the residual matching result into a distributed time axis, introducing a time inertia flame mechanism based on an improved moth flame optimization algorithm, performing a spiral update operation, and generating a network intrusion detection result. The application realizes accurate detection of network intrusion behaviors in an encrypted communication scene through a behavior residual matching network and an improved moth flame optimization algorithm.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to network intrusion detection methods, devices, and storage media based on artificial intelligence. Background Technology

[0002] With the widespread deployment of encrypted communication protocols in internet infrastructure and the continuous development of cloud computing, the Internet of Things, and remote work scenarios, network attacks are increasingly exhibiting characteristics of concealment, phased evolution, and cross-temporal development. Intelligent detection technologies for network intrusions in encrypted communication environments have attracted widespread attention. Existing network intrusion detection methods mainly rely on rule-based feature matching or machine learning models based on traffic statistics, which have some detection effectiveness against plaintext communication or attacks that occur in concentrated bursts within a short period. However, in practical applications, the following problems are still prevalent: In encrypted communication scenarios, communication content cannot be directly parsed. Existing methods can only analyze a limited number of message statistical features, making it difficult to effectively characterize the fine-grained behavioral differences of attack behavior at different stages of scanning, connection control, and data extraction, resulting in insufficient stage identification capabilities. The arrival time sequence of communication events in the network is easily affected by network jitter, path changes, and adversarial traffic interference. Analysis methods based solely on timestamps cannot accurately reflect the true causal relationship of communication interactions, thus obscuring the evolutionary logic of attack behavior. For attacks that occur across time periods and at low frequencies, existing detection models typically lack the ability to continuously model historical behavioral trends, making it easy to misjudge local abnormal fluctuations and difficult to reliably identify complete attack chains. Furthermore, most methods use static similarity or single classification decision-making methods, which cannot continuously characterize the transitional state of communication behavior between different attack stages, limiting the overall perception capability of covert intrusion behavior.

[0003] Therefore, how to provide AI-based network intrusion detection methods, devices, and storage media is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] One objective of this invention is to propose a network intrusion detection method, device, and storage medium based on artificial intelligence. This invention generates afterimage matching results by constructing a behavioral afterimage matching network including a main branch, shadow branch, and afterimage attention matching layer, and integrates an improved moth flame optimization algorithm that incorporates a time-inertial flame mechanism. Based on a distributed time axis, it models and optimizes the evolution trajectory of attack behavior, effectively identifying network attack behaviors with strong concealment and obvious stages under encrypted communication, and has the advantages of strong robustness, low false positive rate, and good adaptability.

[0005] The artificial intelligence-based network intrusion detection method according to embodiments of the present invention includes the following steps: Step 1: Collect network communication data at network boundary nodes. For communication connections using encryption protocols, extract communication metadata and perform session-level aggregation to generate session communication metadata. Step 2: Extract the timing information corresponding to the acknowledgment message, retransmission message, connection establishment message and connection release message from the session communication metadata, and encode the timing information in a unified format to generate echo mode data; Step 3: Perform pseudo-time warp processing on the echo pattern data, reconstruct the sequence according to the direct interaction dependencies between the intra-session communication event records, and generate a causal-driven behavior sequence; Step 4: Input the causal-driven behavior sequence into the behavior afterimage matching network. The behavior afterimage matching network includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch extracts features from the causal-driven behavior sequence to generate behavior afterimage features corresponding to the current communication session. Step 5: Extract features from the historical behavior afterimage data through the shadow branch to generate historical behavior afterimage features. The historical behavior afterimage data correspond to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. Step 6: Input the behavioral afterimage features and historical behavioral afterimage features into the afterimage attention matching layer, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively; Step 7: Record the afterimage matching results into the distributed time axis. Based on the improved moth flame optimization algorithm, introduce the time inertial flame mechanism. During the iteration process, perform spiral update operation on individual moths based on the joint constraints of the current flame state and the inertial flame state to generate network intrusion detection results.

[0006] Optionally, step one specifically includes: The network communication data passing through the network boundary nodes is continuously collected. The network communication data includes the arrival timestamp, source address, destination address, source port, destination port and protocol type of each data packet. Based on the protocol type, the network communication data is classified according to the protocol, and communication connections using encryption protocols are marked. Only for communication connections marked as using encryption protocols, the arrival timestamp, source address, destination address, source port, destination port, and protocol type are extracted as communication metadata. A session identifier is constructed using the source address, destination address, source port, destination port, and protocol type, and communication metadata with the same session identifier is grouped into the same communication session; The arrival timestamp of the first communication metadata in the same communication session is used as the start time of the communication session, and the arrival timestamps of communication metadata belonging to the same communication session are continuously recorded. When the time interval between the arrival timestamps of two adjacent communication metadata belonging to the same communication session is greater than the set session interval threshold, the communication session is determined to end. All communication metadata that arrives between the start and end times of a communication session and is marked as using an encryption protocol are combined in order of arrival timestamps to generate session communication metadata.

[0007] Optionally, step two specifically includes: Based on the session communication metadata, the message type is determined sequentially for each piece of communication metadata. When the communication metadata contains an acknowledgment flag, the communication metadata is marked as an acknowledgment message. When communication metadata with the same sequence number but different arrival timestamps are detected under the same session identifier, the later-arriving communication metadata is marked as a retransmission message. When the connection status corresponding to the communication metadata changes from not established to established, the communication metadata is marked as a connection establishment message. When the connection status corresponding to the communication metadata changes from established to released, the communication metadata is marked as a connection release message. For each tagged communication metadata, read the corresponding arrival timestamp and subtract it from the arrival timestamp of the previous communication metadata tagged with the same message type to obtain the time difference value; if the current communication metadata is the first record of the corresponding message type, then set the time difference value to 0. Using the minimum time resolution of the arrival timestamp as the time counting unit, the time difference is divided by the time counting unit, and the calculation result is rounded down to obtain an integer time interval count value. The integer time interval count value and the corresponding message type identifier are combined to form a binary coding unit. Multiple binary coding units are then written into the sequential coding sequence according to the time order of the communication metadata to generate echo pattern data.

[0008] Optionally, step three specifically includes: Based on the echo pattern data, each binary coding unit is read sequentially, and a corresponding communication event record is generated for each binary coding unit. The communication event record includes an event number, a message type identifier, and a time interval count value. Within the same communication session, each communication event record is written into the event list according to the reading order of the sequential encoding sequence, and an initial event sequence number is assigned to each communication event record; For each communication event record in the event list, sequentially check whether there is a preceding dependent communication event record that has a direct interactive dependency relationship with the current communication event record. When the message type corresponding to the current communication event record is an acknowledgment message or a retransmission message, locate the corresponding connection establishment message communication event record in the event list. When the message type corresponding to the current communication event record is a retransmission message, further locate the corresponding acknowledgment message communication event record in the event list. When the message type corresponding to the current communication event record is a connection release message, locate the corresponding connection establishment message communication event record in the event list. When any located preceding dependent communication event record is located after the current communication event record in the event list, the position of the preceding dependent communication event record in the event list is adjusted to be before the current communication event record, and the event sequence number of each communication event record in the event list is updated synchronously. For communication event records that do not have a direct interaction dependency in the event list, their relative positions in the event list remain unchanged; After completing the traversal of the event list and adjusting the position of the communication event records, a causal-driven behavior sequence is generated according to the final event sequence number of the communication event records in the event list.

[0009] Optionally, the step of extracting features from the causal-driven behavior sequence through the main branch to generate behavioral afterimage features corresponding to the current communication session specifically involves: Using the causal-driven behavior sequence as input, the communication event records are read sequentially according to the order of the communication events in the causal-driven behavior sequence; For each communication event record, the corresponding message type identifier and time interval count value are read, and the message type identifier is mapped to a message type encoding vector of a set length. The time interval count value is used as a time feature component and concatenated with the message type encoding vector to form an event feature vector. According to the order of communication events in the causal driving behavior sequence, multiple event feature vectors are written into the event feature matrix in sequence, where each row corresponds to a communication event; In the main branch, along the row direction of the event feature matrix, the time feature components between adjacent event feature vectors are differentially calculated to obtain the time variation characteristics between adjacent communication events; The time variation features are used as new numerical components and sequentially concatenated into the corresponding event feature vectors to form an enhanced event feature vector that includes message type encoding, time interval count value and time variation features. The enhanced event feature matrix is ​​composed of multiple enhanced event feature vectors. The enhanced event feature matrix is ​​traversed column by column along the order of communication events. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate the behavioral afterimage feature corresponding to the current communication session.

[0010] Optionally, step five specifically includes: Using historical behavior afterimage data as input, the historical behavior afterimage data corresponds to the first scanning behavior, the second connection control behavior, and the data extraction behavior, and each type of historical behavior afterimage data consists of a causal driving behavior sequence belonging to the same behavior stage in multiple different times and different communication sessions. For multiple causal-driven behavior sequences under the same behavior stage, message type identifiers and time interval counts are extracted according to the order of communication events. The message type identifiers are mapped to message type encoding vectors of a set length, and the time interval counts are used as time feature components and concatenated with the message type encoding vectors to form a stage event feature vector. According to the order of communication events, multiple stage event feature vectors are written into a stage event feature matrix. The stage event feature matrix includes event feature vectors from different communication sessions. The order in which the event feature vectors are written is arranged according to the order of their respective causal driving behavior sequences. In the shadow branch, along the row direction of the stage event feature matrix, the time feature components between adjacent stage event feature vectors are differentially calculated to obtain the stage time change features. The stage time change features are then used as new numerical components and concatenated to the corresponding stage event feature vectors to form the stage enhanced event feature matrix. The enhanced event feature matrix of the stage is traversed column by column. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior and the data extraction behavior, respectively.

[0011] Optionally, step six specifically includes: The behavioral afterimage features corresponding to the current communication session generated by the main branch are used as the query feature vector, and the historical behavioral afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior generated by the shadow branches are used as the reference feature vector set. The query feature vector is aligned dimension by dimension with each historical behavior afterimage feature, and the feature values ​​of the corresponding dimensions are combined into feature pairs. For each feature pair, calculate the difference between the query feature vector and the corresponding historical behavior afterimage feature, and take the absolute value of the difference to obtain the dimension-wise afterimage difference vector; Each dimension of the difference value in the dimension-by-dimensional afterimage difference vector is assigned a weight coefficient. The cumulative sum of the corresponding dimension in the corresponding historical behavior afterimage feature is read. The ratio of the cumulative sum to the sum of all dimensions in the historical behavior afterimage feature is calculated to obtain the weight coefficient of the corresponding dimension. The weighted, dimension-wise afterimage difference vectors are summed according to their dimensions to obtain the afterimage matching distance between the afterimage features of the current communication session behavior and the corresponding historical behavior afterimage features. Calculate the afterimage matching distance between the query feature vector and the afterimage features of the corresponding first scanning behavior, second connection control behavior, and data extraction behavior, and use the afterimage matching distance as the afterimage matching result of the corresponding behavior stage.

[0012] Optionally, step seven specifically includes: The afterimage matching results generated at different time points are recorded in the distributed time axis in the order of generation time. Each afterimage matching result includes the afterimage matching distance corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, as well as the corresponding time identifier. Using the afterimage matching results corresponding to multiple non-continuous time points within a preset time span in the distributed time axis as input samples, each afterimage matching result is mapped to a moth individual position, and the moth individual position is composed of the afterimage matching distance in each behavioral stage dimension; The improved moth flame optimization algorithm introduces a time-inertia flame mechanism during the optimization iteration process. Based on the flame state that has converged in the previous time axis, a time-inertia weight is assigned to obtain the inertial flame state. The time-inertia weight gradually decreases as the time axis progresses. In each optimization iteration, for each individual moth, the first distance between the position of the individual moth and the current flame state, and the second distance between the position of the individual moth and the inertial flame state are calculated. Both the first distance and the second distance are calculated using the Euclidean distance method. The first constraint coefficient is obtained by calculating the ratio of the second distance to the sum of the two distances; the second constraint coefficient is obtained by calculating the ratio of the first distance to the sum of the two distances. Based on the first constraint coefficient and the second constraint coefficient, a spiral update operation is performed on the position of the individual moth. The spiral update operation takes the current flame state as the rotation center, multiplies the spiral update displacement component pointing from the current flame state to the position of the individual moth by the first constraint coefficient, multiplies the displacement offset component pointing from the inertial flame state to the current flame state by the second constraint coefficient, and adds them together to obtain the update displacement of the individual moth position, thus completing the update of the position of the individual moth. After completing the preset maximum number of iterations, the average value of the individual moth positions at the same time point is calculated according to the behavioral stage dimension, based on the final position of the individual moths at each time point in the distributed time axis. The stage evolution vectors corresponding to each time point are then connected in chronological order to generate a global evolution trajectory. Based on the global evolution trajectory, it is detected whether there are at least three consecutive time points in the distributed time axis such that the stage matching distance corresponding to the first scanning behavior satisfies a monotonically non-increasing relationship at consecutive time points, and the stage matching distance corresponding to the second connection control behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter, and further, the stage matching distance corresponding to the data extraction behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter. When the conditions are met, it is determined that there is a network intrusion behavior, and the determination result is output as the network intrusion detection result.

[0013] The artificial intelligence-based network intrusion detection device according to an embodiment of the present invention includes the following modules: The data acquisition module is used to collect network communication data at network boundary nodes, extract communication metadata for communication connections using encryption protocols, and perform session-level aggregation based on the communication metadata to generate session communication metadata. The echo mode generation module is used to identify acknowledgment messages, retransmission messages, connection establishment messages and connection release messages from the session communication metadata, extract the corresponding timing information and encode it in a unified format to generate echo mode data. The causal behavior reconstruction module is used to perform pseudo-time warping on echo pattern data, reconstruct the sequence based on the direct interaction dependencies between communication event records in the session, and generate a causal-driven behavior sequence. The behavior afterimage matching network module includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch is used to extract features from the causal-driven behavior sequence and generate behavior afterimage features corresponding to the current communication session. The shadow branch is used to extract features from historical behavior afterimage data and generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The afterimage attention matching layer is used to receive the behavior afterimage features and historical behavior afterimage features, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The temporal evolution reconstruction and detection module is used to record the afterimage matching results into a distributed time axis. Based on the improved moth flame optimization algorithm, a temporal inertial flame mechanism is introduced. During the iteration process, a spiral update operation is performed on the individual moth based on the joint constraints of the current flame state and the inertial flame state to generate network intrusion detection results.

[0014] According to an embodiment of the present invention, a storage medium stores a computer program that, when executed by a processor, enables the processor to perform an artificial intelligence-based network intrusion detection method.

[0015] The beneficial effects of this invention are: This invention addresses the semantic sparsity, temporal misordering, and concealed stage evolution features of causal-driven behavior sequences in encrypted communication scenarios by integrating a behavior afterimage matching network with an improved moth flame optimization algorithm. It proposes a behavior afterimage modeling method that uses parallel main branch and shadow branch modeling, extracting feature representations of the current communication session and historical attack stages respectively. Afterimage matching distance calculation is performed through an afterimage attention matching layer to generate afterimage matching results for multiple behavior stages. In the temporal evolution reconstruction and detection module, a distributed time axis and a temporal inertial flame mechanism are introduced. An inertial flame state is constructed by combining the previous flame state and controlled by time decay weights. The system controls the degree to which historical evolution trends guide the current individual position, thereby improving the modeling stability of stage transition behaviors. During the individual moth update process, a dual constraint coefficient based on distance ratio is used to dynamically adjust the convergence bias between the current flame state and the inertial flame state of the individual moth, and a spiral update operation is performed to ensure the accuracy of stage matching while maintaining the temporal continuity of the attack trajectory. Finally, in the global evolution trajectory, the detection of the afterimage matching distance of the behavior stage shows a continuous decreasing pattern from the first scanning behavior, the second connection control behavior to the data extraction behavior, thereby achieving accurate output of attack chain identification and network intrusion detection results across time points. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is an overall flowchart of the artificial intelligence-based network intrusion detection method proposed in this invention; Figure 2 This is a schematic diagram of the structure of the artificial intelligence-based network intrusion detection device proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figure 1 The artificial intelligence-based network intrusion detection method includes the following steps: Step 1: Collect network communication data at network boundary nodes. For communication connections using encryption protocols, extract communication metadata and perform session-level aggregation to generate session communication metadata. Step 2: Extract the timing information corresponding to the acknowledgment message, retransmission message, connection establishment message and connection release message from the session communication metadata, and encode the timing information in a unified format to generate echo mode data; Step 3: Perform pseudo-time warp processing on the echo pattern data, reconstruct the sequence according to the direct interaction dependencies between the intra-session communication event records, and generate a causal-driven behavior sequence; Step 4: Input the causal-driven behavior sequence into the behavior afterimage matching network. The behavior afterimage matching network includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch extracts features from the causal-driven behavior sequence to generate behavior afterimage features corresponding to the current communication session. Step 5: Extract features from the historical behavior afterimage data through the shadow branch to generate historical behavior afterimage features. The historical behavior afterimage data correspond to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. Step 6: Input the behavioral afterimage features and historical behavioral afterimage features into the afterimage attention matching layer, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively; Step 7: Record the afterimage matching results into the distributed time axis. Based on the improved moth flame optimization algorithm, introduce the time inertial flame mechanism. During the iteration process, perform spiral update operation on individual moths based on the joint constraints of the current flame state and the inertial flame state to generate network intrusion detection results.

[0019] In this embodiment, step one specifically includes: The network communication data passing through the network boundary nodes is continuously collected. The network communication data includes the arrival timestamp, source address, destination address, source port, destination port and protocol type of each data packet. Based on the protocol type, the network communication data is classified according to the protocol, and communication connections using encryption protocols are marked. Only for communication connections marked as using encryption protocols, the arrival timestamp, source address, destination address, source port, destination port, and protocol type are extracted as communication metadata. A session identifier is constructed using the source address, destination address, source port, destination port, and protocol type, and communication metadata with the same session identifier is grouped into the same communication session; The arrival timestamp of the first communication metadata in the same communication session is used as the start time of the communication session, and the arrival timestamps of communication metadata belonging to the same communication session are continuously recorded. When the time interval between the arrival timestamps of two adjacent communication metadata belonging to the same communication session is greater than the set session interval threshold, the communication session is determined to end. All communication metadata that arrives between the start time and end time of a communication session and is marked as using an encryption protocol are combined in order of arrival timestamps to generate session communication metadata. In this invention, network boundary nodes continuously collect network communication data in a mirror manner, with the collection granularity at the data packet level. The arrival timestamp is preferably timed to the millisecond level. The protocol type is used to distinguish between encrypted and unencrypted communication connections. The division of communication sessions uses a 5-tuple as the session identifier and is constrained by time continuity. The session interval threshold is preferably set to 60 seconds. When the arrival time interval between two adjacent communication metadata in the same session exceeds the session interval threshold, the current communication session is determined to have ended. The session communication metadata generated in the above manner can fully reflect the interaction characteristics of encrypted communication connections in the time dimension, providing a stable input basis for echo pattern analysis and behavioral afterimage modeling.

[0020] In this embodiment, step two specifically includes: Based on the session communication metadata, the message type is determined sequentially for each piece of communication metadata. When the communication metadata contains an acknowledgment flag, the communication metadata is marked as an acknowledgment message. When communication metadata with the same sequence number but different arrival timestamps are detected under the same session identifier, the later-arriving communication metadata is marked as a retransmission message. When the connection status corresponding to the communication metadata changes from not established to established, the communication metadata is marked as a connection establishment message. When the connection status corresponding to the communication metadata changes from established to released, the communication metadata is marked as a connection release message. For each tagged communication metadata, read the corresponding arrival timestamp and subtract it from the arrival timestamp of the previous communication metadata tagged with the same message type to obtain the time difference value; if the current communication metadata is the first record of the corresponding message type, then set the time difference value to 0. Using the minimum time resolution of the arrival timestamp as the time counting unit, the time difference is divided by the time counting unit, and the calculation result is rounded down to obtain an integer time interval count value. The integer time interval count value and the corresponding message type identifier are combined to form a binary coding unit. Multiple binary coding units are written into the sequential coding sequence according to the time order of the communication metadata to generate echo pattern data. Step two involves accurately identifying acknowledgment messages, retransmission messages, connection establishment messages, and connection release messages related to the communication interaction process in the session communication metadata. A unified time difference representation is constructed based on the arrival timestamp, enabling the temporal behavior of different message types to be expressed with a consistent data structure. The time difference is integerized using the minimum time resolution to avoid the uncertainty caused by floating-point calculations, thereby improving the stability and repeatability of the temporal coding results. By combining message type identifiers with time interval counts to form a sequential coding sequence, the rhythmic characteristics and behavioral evolution order of communication interactions can be completely preserved, providing structured input data for behavior pattern-based analysis. This enhances the accuracy and robustness of identifying and modeling abnormal interaction behaviors in encrypted communication scenarios.

[0021] In this embodiment, step three specifically includes: Based on the echo pattern data, each binary coding unit is read sequentially, and a corresponding communication event record is generated for each binary coding unit. The communication event record includes an event number, a message type identifier, and a time interval count value. Within the same communication session, each communication event record is written into the event list according to the reading order of the sequential encoding sequence, and an initial event sequence number is assigned to each communication event record; For each communication event record in the event list, sequentially check whether there is a preceding dependent communication event record that has a direct interactive dependency relationship with the current communication event record. When the message type corresponding to the current communication event record is an acknowledgment message or a retransmission message, locate the corresponding connection establishment message communication event record in the event list. When the message type corresponding to the current communication event record is a retransmission message, further locate the corresponding acknowledgment message communication event record in the event list. When the message type corresponding to the current communication event record is a connection release message, locate the corresponding connection establishment message communication event record in the event list. When any located preceding dependent communication event record is located after the current communication event record in the event list, the position of the preceding dependent communication event record in the event list is adjusted to be before the current communication event record, and the event sequence number of each communication event record in the event list is updated synchronously. For communication event records that do not have a direct interaction dependency in the event list, their relative positions in the event list remain unchanged; After completing the traversal of the event list and the adjustment of the position of the communication event records, a causal-driven behavior sequence is generated according to the final event sequence number of the communication event records in the event list. In this invention, step three uses pseudo-time distortion processing to distinguish and model the observation time sequence based on arrival timestamps from the causal time sequence inherent in the communication protocol. The observation time sequence reflects the order in which communication events are collected and recorded at network boundary nodes. This sequence is susceptible to network jitter, path asymmetry, and malicious traffic disturbances, and cannot stably reflect the true communication interaction logic. The causal time sequence, on the other hand, is determined based on the interaction dependencies between communication events. Its core constraint comes from the structural support role of connection establishment events for subsequent confirmation, retransmission, and connection release events. By converting echo pattern data into communication event records and explicitly maintaining event sequence numbers in the event list, this invention can rearrange event positions when a causal preceding event is detected to be lagging in the observation sequence, thereby achieving pseudo-distortion remapping of the time axis. This process does not modify the original timestamp values, but rather constructs a new causal consistent sequence by adjusting the event sequence numbers. This ensures that the final generated causal-driven behavior sequence retains both the original interaction rhythm information and the protocol-level causal structure, providing a stable and repeatable input basis for subsequent cross-time period behavior analysis.

[0022] In this embodiment, the step of extracting features from the causal-driven behavior sequence through the main branch to generate behavioral afterimage features corresponding to the current communication session specifically involves: Using the causal-driven behavior sequence as input, the communication event records are read sequentially according to the order of the communication events in the causal-driven behavior sequence; For each communication event record, the corresponding message type identifier and time interval count value are read, and the message type identifier is mapped to a message type encoding vector of a set length. The time interval count value is used as a time feature component and concatenated with the message type encoding vector to form an event feature vector. According to the order of communication events in the causal driving behavior sequence, multiple event feature vectors are written into the event feature matrix in sequence, where each row corresponds to a communication event; In the main branch, along the row direction of the event feature matrix, the time feature components between adjacent event feature vectors are differentially calculated to obtain the time variation characteristics between adjacent communication events; The time variation features are used as new numerical components and sequentially concatenated into the corresponding event feature vectors to form an enhanced event feature vector that includes message type encoding, time interval count value and time variation features. The enhanced event feature matrix is ​​composed of multiple enhanced event feature vectors. The enhanced event feature matrix is ​​traversed column by column along the order of communication events. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate the behavioral afterimage feature corresponding to the current communication session. In this invention, the main branch extracts structured features from the causal-driven behavior sequence to generate behavioral afterimage features that characterize the overall behavioral pattern of a single communication session. First, the communication events in the causal-driven behavior sequence are unfolded sequentially, and each communication event is represented as an event feature vector composed of message type encoding and time features. The message type identifier is mapped to an encoding vector of a set length, preferably a one-hot encoding vector of length 4. The time interval count is used as a numerical time feature component, thus ensuring that different types of communication events are represented within a unified feature space. Second, by performing differential calculations on the time feature components of adjacent communication events, time is introduced... The variation features are used to characterize the fluctuations of communication rhythm on the causal time axis. These time variation features are then concatenated with the original event feature vector to form an enhanced event feature matrix. Furthermore, statistical aggregation operations are performed on the enhanced event feature matrix column by column to calculate the maximum, minimum, average, and cumulative sum of each feature dimension. For example, the average value is used to reflect the intensity of typical behavior, and the cumulative sum is used to reflect the duration of behavior, thereby generating a fixed-length behavior afterimage feature. This behavior afterimage feature, while maintaining the semantic information of the communication event sequence, achieves a unified representation of communication sessions of different lengths, providing a stable input for cross-time period behavior matching and attack chain analysis.

[0023] In this embodiment, step five specifically includes: Using historical behavior afterimage data as input, the historical behavior afterimage data corresponds to the first scanning behavior, the second connection control behavior, and the data extraction behavior, and each type of historical behavior afterimage data consists of a causal driving behavior sequence belonging to the same behavior stage in multiple different times and different communication sessions. For multiple causal-driven behavior sequences under the same behavior stage, message type identifiers and time interval counts are extracted according to the order of communication events. The message type identifiers are mapped to message type encoding vectors of a set length, and the time interval counts are used as time feature components and concatenated with the message type encoding vectors to form a stage event feature vector. According to the order of communication events, multiple stage event feature vectors are written into a stage event feature matrix. The stage event feature matrix includes event feature vectors from different communication sessions. The order in which the event feature vectors are written is arranged according to the order of their respective causal driving behavior sequences. In the shadow branch, along the row direction of the stage event feature matrix, the time feature components between adjacent stage event feature vectors are differentially calculated to obtain the stage time change features. The stage time change features are then used as new numerical components and concatenated to the corresponding stage event feature vectors to form the stage enhanced event feature matrix. The stage-enhanced event feature matrix is ​​traversed column by column. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior and the data extraction behavior, respectively. In this invention, the shadow branch and the main branch together constitute a dual-branch behavior afterimage modeling structure. The two branches maintain consistency in feature construction operators and form a clear division of labor in terms of data source, temporal semantics, and operation mode. The main branch is used to process the causal-driven behavior sequence of the current communication session in real time to generate behavior afterimage features that reflect the instantaneous behavior characteristics of a single session. Its operation process is synchronized with the current network communication state. The shadow branch is used to process historical behavior afterimage data, which comes from causal-driven behavior sequences that have been confirmed to belong to the same behavior stage in multiple different time periods and different communication sessions. Stable stage-level behavior afterimage features are formed through cross-session aggregation and are not updated with changes in the current communication session after generation.

[0024] The shadow branch operates using an offline or low-frequency update mechanism, converging and modeling communication event features at different behavioral stages within a unified feature space. This compresses historical behaviors scattered across the timeline into fixed-length stage reference afterimages. By maintaining consistency in feature representation structures between the main branch and the shadow branch, the behavioral afterimage features generated by the current communication session can be directly aligned and compared with historical behavioral afterimage features in subsequent processing. This dual-branch structure avoids the limitations of relying solely on a single session or a single time window for judgment, enabling the system to identify the stage evolution trend of communication behavior in the time dimension under encrypted communication environments. This allows for early detection and staged identification of covert attack chains, resulting in a significant improvement in technical effectiveness.

[0025] In this embodiment, step six specifically includes: The behavioral afterimage features corresponding to the current communication session generated by the main branch are used as the query feature vector, and the historical behavioral afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior generated by the shadow branches are used as the reference feature vector set. The query feature vector is aligned dimension by dimension with each historical behavior afterimage feature, and the feature values ​​of the corresponding dimensions are combined into feature pairs. For each feature pair, calculate the difference between the query feature vector and the corresponding historical behavior afterimage feature, and take the absolute value of the difference to obtain the dimension-wise afterimage difference vector; Each dimension of the difference value in the dimension-by-dimensional afterimage difference vector is assigned a weight coefficient. The cumulative sum of the corresponding dimension in the corresponding historical behavior afterimage feature is read. The ratio of the cumulative sum to the sum of all dimensions in the historical behavior afterimage feature is calculated to obtain the weight coefficient of the corresponding dimension. The weighted, dimension-wise afterimage difference vectors are summed according to their dimensions to obtain the afterimage matching distance between the afterimage features of the current communication session behavior and the corresponding historical behavior afterimage features. Calculate the afterimage matching distance between the query feature vector and the afterimage features of the corresponding first scanning behavior, second connection control behavior, and data extraction behavior, and use the afterimage matching distance as the afterimage matching result of the corresponding behavior stage; By introducing a weighting calculation method based on the statistical results of historical behavior afterimages for the difference values ​​of each feature dimension, behavioral features with higher cumulative contribution in the historical stage occupy higher weights in the matching process, thereby highlighting the key feature dimensions that are significant in distinguishing stage behavior; furthermore, the weighted dimension afterimage differences are aggregated to form afterimage matching distances that can be used for cross-time point comparison, so that the degree of proximity between the same communication session and each historical behavior stage at different time segments can be continuously characterized. In this invention, the purpose of setting up the afterimage attention matching layer is not to make a single category judgment on the behavior of the current communication session, but to quantify the similarity distribution of the current behavior at different attack stages by performing parallel matching of the afterimage features of the behavior corresponding to the current communication session with the afterimage features of the behavior of multiple historical behavior stages. Since actual network attacks usually present a continuous process of evolution across time, there are often overlaps and transitions between the scanning, connection control and data extraction stages of attack behavior. The traditional single-label classification method is difficult to accurately reflect the stage change characteristics of attack behavior. By calculating the afterimage matching results between the afterimage features of the current behavior and the afterimage features of the behavior of each historical stage, this invention can characterize the relative position and stage proximity of the current communication behavior on the attack chain time axis without forcing a unique classification result. This provides a continuous and quantifiable input basis for cross-time period behavior recombination and covert attack cycle inference. This design avoids the risk of misjudgment caused by stage jumps and improves the accuracy and robustness of identifying and analyzing the attack evolution process in complex, low-frequency, distributed attack scenarios.

[0026] In this embodiment, step seven specifically includes: The afterimage matching results generated at different time points are recorded in the distributed time axis in the order of generation time. Each afterimage matching result includes the afterimage matching distance corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, as well as the corresponding time identifier. Using the afterimage matching results corresponding to multiple non-continuous time points within a preset time span in the distributed time axis as input samples, each afterimage matching result is mapped to a moth individual position, and the moth individual position is composed of the afterimage matching distance in each behavioral stage dimension; The improved moth flame optimization algorithm introduces a time-inertia flame mechanism during the optimization iteration process. Based on the flame states that have converged in the previous time axis, time-inertia weights are assigned to obtain inertial flame states. The time-inertia weights gradually decrease as the time axis progresses. Specifically, using the time marker corresponding to the current time point as the reference time, the time interval between each historical time point and the reference time is calculated. The time interval value is added to a preset time decay constant, and the reciprocal is taken to obtain the time-inertia weight of the corresponding historical time point. The larger the time interval, the smaller the obtained time-inertia weight. Subsequently, the time-inertia weights corresponding to each historical time point are normalized so that the sum of all time-inertia weights is 1. Finally, the normalized time-inertia weights are weighted and multiplied with the flame state vector of the corresponding historical time point, and all weighted results are accumulated to generate the inertial flame state. Through the above method, the quantitative control of the gradual decrease in the influence of the historical flame state as the time axis progresses is achieved. In each optimization iteration, for each individual moth, the first distance between the position of the individual moth and the current flame state, and the second distance between the position of the individual moth and the inertial flame state are calculated. Both the first distance and the second distance are calculated using the Euclidean distance method. The first constraint coefficient is obtained by calculating the ratio of the second distance to the sum of the two distances; the second constraint coefficient is obtained by calculating the ratio of the first distance to the sum of the two distances. In this invention, the first constraint coefficient and the second constraint coefficient are calculated based on distance ratio. This is to enable the moth individual to adaptively adjust its update direction according to its deviation from the current flame state and the inertial flame state during the update process. When the second distance between the moth individual and the inertial flame state increases, it indicates that the deviation between the current individual state and the historical evolution trajectory increases. At this time, the first constraint coefficient is obtained by calculating the ratio of the second distance to the sum of the two types of distances, which can correspondingly increase the update weight for convergence to the current flame state. Conversely, when the first distance between the moth individual and the current flame state increases, it indicates that the constraint effect of the optimal reference state at the current time point on the moth individual is weakened. The second constraint coefficient is obtained by calculating the ratio of the first distance to the sum of the two types of distances, which can correspondingly enhance the update bias along the direction of the inertial flame state. Through the above-mentioned dual constraint coefficient calculation method based on distance ratio, the moth individual position update process forms a dynamic balance between the optimal state at the current time point and the evolution trend of the historical time period, thereby achieving stable modeling of the evolution trajectory during the attack phase. Based on the first constraint coefficient and the second constraint coefficient, a spiral update operation is performed on the position of the individual moth. The spiral update operation takes the current flame state as the rotation center, multiplies the spiral update displacement component pointing from the current flame state to the position of the individual moth by the first constraint coefficient, and multiplies the displacement offset component pointing from the inertial flame state to the current flame state by the second constraint coefficient. The components are then added together to obtain the updated displacement of the individual moth position, thus completing the update of the individual moth position. The second constraint coefficient is used to adjust the influence of the historical evolution trend on the update of the individual moth. Therefore, the direction of action is selected as the direction from the inertial flame state to the current flame state, so as to ensure that the stage optimal reference state at the current time point is not deviated while introducing historical information, so that the individual moth can maintain the inheritance of the historical evolution trajectory while converging towards the current optimal solution. In this invention, the current flame state refers to the stage evolution reference state vector dynamically selected from the positions of all individual moths at a specific time point in the optimization iteration process corresponding to a specific time point in the distributed time axis. This current flame state is used to characterize the optimal matching trend of the attack behavior in each behavioral stage dimension at the current time point, and serves as the central reference for guiding individual moths to perform spiral update operations. The current flame state is updated with each iteration in the optimization iteration process and gradually converges into a stable state vector that can represent the evolutionary characteristics of the attack stage at the current time point.

[0027] When determining the current flame state, it is necessary to calculate the corresponding fitness value for each individual moth's position. The fitness value is used to measure the representativeness of the individual moth's position to the evolutionary trajectory of the attack phase. Specifically, for each individual moth's position, its afterimage matching distance is read in three dimensions: the first scanning behavior, the second connection control behavior, and the data extraction behavior. The afterimage matching distance is then weighted and summed, where the weights are determined by the normalized sum of the afterimage features of each dimension in the corresponding historical behavior. The weighted sum of the afterimage matching distances is used as the fitness value of the individual moth's position. The smaller the fitness value, the smaller the overall deviation between the individual moth's position and the evolutionary pattern of the attack phase. By selecting the individual moth's position with the smallest fitness value in the current iteration, the current flame state is determined, thereby ensuring that the flame state can reflect the overall optimal trend of the attack behavior in the phase evolution while maintaining the response to the observation data at the current time point. After completing the preset maximum number of iterations, the average value of the individual moth positions at the same time point is calculated according to the behavioral stage dimension, based on the final position of the individual moths at each time point in the distributed time axis. The stage evolution vectors corresponding to each time point are then connected in chronological order to generate a global evolution trajectory. Based on the global evolution trajectory, it is detected whether there are at least three consecutive time points in the distributed time axis such that the stage matching distance corresponding to the first scanning behavior satisfies a monotonically non-increasing relationship at consecutive time points, and the stage matching distance corresponding to the second connection control behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter, and further, the stage matching distance corresponding to the data extraction behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter. When the conditions are met, it is determined that there is a network intrusion behavior, and the determination result is output as the network intrusion detection result. This invention, based on the traditional moth-flame optimization algorithm, introduces a time-inertia flame mechanism to model and reconstruct the cross-time evolution characteristics of network attack behavior. Unlike traditional optimization methods that rely solely on the optimal solution at a single point in time, this invention introduces historical flame states through a distributed time axis and assigns time-inertia weights to these historical flame states based on time intervals, allowing the influence of historical information on the current optimization process to gradually decay over time. In specific implementation, the current time point is used as the reference time, the time interval between the historical time point and the reference time is calculated, the time interval is added to a preset time decay constant, the reciprocal is taken, and the resulting weights are normalized. This invention employs a process that avoids excessive interference from a single historical state in the optimization process. Furthermore, it introduces both the current flame state and the inertial flame state during the individual moth update process. By calculating the Euclidean distance between the individual moth and the two flame states, and constructing a first constraint coefficient and a second constraint coefficient based on the distance ratio, the update direction of the individual moth can be dynamically balanced between the optimal matching trend in the current stage and the evolution trend in the historical stage. Through these improvements, the optimization process is able to suppress short-term abnormal fluctuations while maintaining sensitivity to the continuous evolution characteristics of attack behavior stages, thereby improving the accuracy and stability of detecting covert and phased network intrusion behaviors.

[0028] refer to Figure 2 An AI-based network intrusion detection device includes the following modules: The data acquisition module is used to collect network communication data at network boundary nodes, extract communication metadata for communication connections using encryption protocols, and perform session-level aggregation based on the communication metadata to generate session communication metadata. The echo mode generation module is used to identify acknowledgment messages, retransmission messages, connection establishment messages and connection release messages from the session communication metadata, extract the corresponding timing information and encode it in a unified format to generate echo mode data. The causal behavior reconstruction module is used to perform pseudo-time warping on echo pattern data, reconstruct the sequence based on the direct interaction dependencies between communication event records in the session, and generate a causal-driven behavior sequence. The behavior afterimage matching network module includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch is used to extract features from the causal-driven behavior sequence and generate behavior afterimage features corresponding to the current communication session. The shadow branch is used to extract features from historical behavior afterimage data and generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The afterimage attention matching layer is used to receive the behavior afterimage features and historical behavior afterimage features, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The temporal evolution reconstruction and detection module is used to record the afterimage matching results into a distributed time axis. Based on the improved moth flame optimization algorithm, a temporal inertial flame mechanism is introduced. During the iteration process, a spiral update operation is performed on the individual moth based on the joint constraints of the current flame state and the inertial flame state to generate network intrusion detection results.

[0029] A storage medium storing a computer program that, when executed by a processor, enables the processor to perform an artificial intelligence-based network intrusion detection method.

[0030] Example 1: To verify the feasibility of this invention in practice, it was applied to the boundary protection system of an enterprise's office network. This enterprise has long faced the problem of security audit blind spots caused by encrypted communication when internal office terminals access sensitive systems. Since the network extensively uses the TLS encrypted communication protocol, traditional deep packet inspection methods are unable to obtain the effective payload content and cannot accurately identify potential intrusion behaviors such as scanning, remote control, and data theft. Therefore, the method of this invention, without decrypting the data content, utilizes communication metadata and time-series behavior modeling technology to mine potential attack stage evolution patterns from the causal driving behavior level.

[0031] In this system, after deploying the network intrusion detection device of this invention, the data acquisition module first continuously monitors the TLS connection communication data at the boundary of the office network, extracts the source / destination address, port, arrival timestamp, and protocol type of each data packet, and after being marked with an encryption protocol, only the data of the encrypted connection is retained as session communication metadata and input to the echo pattern generation module. The echo pattern generation module identifies acknowledgment messages, retransmission messages, connection establishment messages, and connection release messages, extracts the corresponding timing information, and performs unified format encoding to generate echo pattern data. Furthermore, through the causal behavior reconstruction module, the timing is rearranged and a causal driving behavior sequence is generated.

[0032] Next, the causal-driven behavior sequence is input into the behavior afterimage matching network module. The behavior afterimage features of the current communication are extracted through the main branch, and the historical behavior afterimage features of the three attack stages (i.e., the first scanning behavior, the second connection control behavior, and the data extraction behavior) are extracted in the shadow branch. The afterimage attention matching layer calculates the afterimage matching distance dimension by dimension and generates the afterimage matching results for each behavior stage. The afterimage matching results are written into the distributed time axis and used as input to initialize the position of individual moths. The improved moth flame optimization algorithm is input for stage evolution modeling. The time inertia flame mechanism is introduced. During the optimization iteration process, the joint constraints of the current flame state and the inertia flame state guide the individual moths to perform spiral update operations, and finally output the global evolution trajectory.

[0033] In an office network communication data environment, TLS encrypted traffic data from seven consecutive days was selected for testing, covering approximately 20 million communication records and involving about 480,000 encrypted connection communication sessions. 326 samples containing three known attack behaviors were manually labeled, and a large number of normal communication sessions were mixed in as controls to test the ability of the method of this invention to identify intrusion behaviors in unknown encrypted traffic.

[0034] During the testing period, the detection performance of the traditional isolation forest method based on statistical anomaly detection, the LSTM model, and the method of this invention were statistically analyzed on the same dataset, as shown in Table 1 below.

[0035] Table 1 Comparison of Encrypted Communication Intrusion Detection Performance

[0036] As can be seen from the data in Table 1 above, the method of this invention outperforms existing LSTM models and isolated forest methods in four key indicators: average accuracy, average recall, average F1 score, and average detection latency. In terms of average accuracy, the method of this invention achieves 97.77%, an improvement of 8.27 percentage points compared to the LSTM model and 12.07 percentage points compared to the isolated forest, indicating its higher discrimination ability in identifying intrusion behavior. In terms of average recall, the method of this invention achieves 94.20%, significantly higher than LSTM's 80.30% and the isolated forest's 78.10%, demonstrating a stronger ability to capture genuine intrusion behavior and a lower false negative rate. In terms of average F1 score, the method of this invention also leads with 95.90%, indicating a good balance between accuracy and completeness. Simultaneously, the method of this invention exhibits stronger real-time performance in terms of average detection latency, at only 2.73 seconds, far lower than LSTM's 4.50 seconds and the isolated forest's 5.00 seconds, verifying its advantages in achieving fast response and high-precision detection in encrypted communication environments.

[0037] Furthermore, to further verify the role of the time-inertial flame mechanism in modeling the evolutionary trend of the behavior stage, the impact of introducing the inertial flame state on the final detection results was compared in the test. In the control group without using the inertial flame state, the position of individual moths was easily affected by the fluctuation of the current sample, resulting in oscillations and unstable convergence of the optimization process. However, after introducing the time-inertial flame mechanism, the moth position update process can maintain coupling with the historical evolutionary trend, thereby forming a stable stage evolutionary trajectory and significantly improving the overall detection accuracy.

[0038] Table 2. Analysis of the impact of time-inertia flame mechanism on detection stability.

[0039] As can be seen from the data in Table 2 above, the introduction of the time-inertial flame mechanism significantly improves the stability and overall performance of network intrusion detection. Specifically, the mean variance of the global evolution trajectory decreased from 0.089 to 0.021 after the introduction of the time-inertial flame mechanism, indicating a significant reduction in variance. This suggests that individual moths tend to converge more during the optimization process, resulting in a smoother and more stable evolution trajectory. Regarding the standard deviation of detection accuracy, the standard deviation was 4.2% without the time-inertial flame mechanism, while it decreased to 1.5% after its introduction, indicating a significant reduction in detection performance fluctuations and higher stability and robustness. Furthermore, the minimum detection accuracy also increased from 86.8% to 93.2%, reflecting that even under the most unfavorable conditions, the introduction of the time-inertial flame mechanism can maintain a high detection effect and effectively reduce the risk of missed detections. Overall analysis shows that the time-inertia flame mechanism, by guiding individuals to achieve a dynamic balance between the current optimal solution and historical evolution trends, not only enhances the ability to model attack evolution patterns but also improves the continuity and reliability of the detection process, thus verifying the practical value of the time-inertia flame mechanism in intelligent network security detection.

[0040] In this embodiment, by introducing a behavioral afterimage matching network and an improved moth flame optimization algorithm, the problem of lacking an effective feature extraction path for encrypted communication is effectively solved, achieving accurate identification and dynamic evolution modeling of attack behavior stages. The introduced time-inertia flame mechanism integrates historical evolution trends and the current optimal state during the optimization process, guiding individual positions to converge towards a stable direction, thereby improving stability and robustness. The overall solution ensures detection accuracy without relying on plaintext data, and has good practicality and promotional value.

[0041] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network intrusion detection method based on artificial intelligence, characterized in that, Includes the following steps: Step 1: Collect network communication data at network boundary nodes. For communication connections using encryption protocols, extract communication metadata and perform session-level aggregation to generate session communication metadata. Step 2: Extract the timing information corresponding to the acknowledgment message, retransmission message, connection establishment message and connection release message from the session communication metadata, and encode the timing information in a unified format to generate echo mode data; Step 3: Perform pseudo-time warp processing on the echo pattern data, reconstruct the sequence according to the direct interaction dependencies between the intra-session communication event records, and generate a causal-driven behavior sequence; Step 4: Input the causal-driven behavior sequence into the behavior afterimage matching network. The behavior afterimage matching network includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch extracts features from the causal-driven behavior sequence to generate behavior afterimage features corresponding to the current communication session. Step 5: Extract features from the historical behavior afterimage data through the shadow branch to generate historical behavior afterimage features. The historical behavior afterimage data correspond to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. Step 6: Input the behavioral afterimage features and historical behavioral afterimage features into the afterimage attention matching layer, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively; Step 7: Record the afterimage matching results into the distributed time axis. Based on the improved moth flame optimization algorithm, introduce the time inertia flame mechanism. Based on the flame states that have converged in the previous time axis, allocate time inertia weights to obtain the inertia flame states. The time inertia weights gradually decay as the time axis progresses. During the iteration process, perform a spiral update operation on the individual moth position based on the joint constraints of the current flame state and the inertia flame state to generate network intrusion detection results.

2. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, Step one specifically involves: The network communication data passing through the network boundary nodes is continuously collected. The network communication data includes the arrival timestamp, source address, destination address, source port, destination port and protocol type of each data packet. Based on the protocol type, the network communication data is classified according to the protocol, and communication connections using encryption protocols are marked. Only for communication connections marked as using encryption protocols, the arrival timestamp, source address, destination address, source port, destination port, and protocol type are extracted as communication metadata. A session identifier is constructed using the source address, destination address, source port, destination port, and protocol type, and communication metadata with the same session identifier is grouped into the same communication session; The arrival timestamp of the first communication metadata in the same communication session is used as the start time of the communication session, and the arrival timestamps of communication metadata belonging to the same communication session are continuously recorded. When the time interval between the arrival timestamps of two adjacent communication metadata belonging to the same communication session is greater than the set session interval threshold, the communication session is determined to end. All communication metadata that arrives between the start and end times of a communication session and is marked as using an encryption protocol are combined in order of arrival timestamps to generate session communication metadata.

3. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, Step two specifically involves: Based on the session communication metadata, the message type is determined sequentially for each piece of communication metadata. When the communication metadata contains an acknowledgment flag, the communication metadata is marked as an acknowledgment message. When communication metadata with the same sequence number but different arrival timestamps are detected under the same session identifier, the later-arriving communication metadata is marked as a retransmission message. When the connection status corresponding to the communication metadata changes from not established to established, the communication metadata is marked as a connection establishment message; When the connection status corresponding to the communication metadata changes from established to released, the communication metadata is marked as a connection release message; For each tagged communication metadata, read the corresponding arrival timestamp and subtract it from the arrival timestamp of the previous communication metadata tagged with the same message type to obtain the time difference. If the current communication metadata is the first record of the corresponding message type, then set the time difference value to 0; Using the minimum time resolution of the arrival timestamp as the time counting unit, the time difference is divided by the time counting unit, and the calculation result is rounded down to obtain an integer time interval count value. The integer time interval count value and the corresponding message type identifier are combined to form a binary coding unit. Multiple binary coding units are then written into the sequential coding sequence according to the time order of the communication metadata to generate echo pattern data.

4. The network intrusion detection method based on artificial intelligence according to claim 3, characterized in that, Step three specifically involves: Based on the echo pattern data, each binary coding unit is read sequentially, and a corresponding communication event record is generated for each binary coding unit. The communication event record includes an event number, a message type identifier, and a time interval count value. Within the same communication session, each communication event record is written into the event list according to the reading order of the sequential encoding sequence, and an initial event sequence number is assigned to each communication event record; For each communication event record in the event list, sequentially check whether there is a preceding dependent communication event record that has a direct interactive dependency relationship with the current communication event record. When the message type corresponding to the current communication event record is an acknowledgment message or a retransmission message, locate the corresponding connection establishment message communication event record in the event list. When the message type corresponding to the current communication event record is a retransmission message, further locate the corresponding acknowledgment message communication event record in the event list. When the message type corresponding to the current communication event record is a connection release message, locate the corresponding connection establishment message communication event record in the event list. When any located preceding dependent communication event record is located after the current communication event record in the event list, the position of the preceding dependent communication event record in the event list is adjusted to be before the current communication event record, and the event sequence number of each communication event record in the event list is updated synchronously. For communication event records that do not have a direct interaction dependency in the event list, their relative positions in the event list remain unchanged; After completing the traversal of the event list and adjusting the position of the communication event records, a causal-driven behavior sequence is generated according to the final event sequence number of the communication event records in the event list.

5. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, The step of extracting features from the causal-driven behavior sequence through the main branch to generate behavioral afterimage features corresponding to the current communication session is specifically as follows: Using the causal-driven behavior sequence as input, the communication event records are read sequentially according to the order of the communication events in the causal-driven behavior sequence; For each communication event record, the corresponding message type identifier and time interval count value are read, and the message type identifier is mapped to a message type encoding vector of a set length. The time interval count value is used as a time feature component and concatenated with the message type encoding vector to form an event feature vector. According to the order of communication events in the causal driving behavior sequence, multiple event feature vectors are sequentially written into the event feature matrix, where each row corresponds to a communication event; In the main branch, along the row direction of the event feature matrix, the time feature components between adjacent event feature vectors are differentially calculated to obtain the time variation characteristics between adjacent communication events; The time variation features are used as new numerical components and sequentially concatenated into the corresponding event feature vectors to form an enhanced event feature vector that includes message type encoding, time interval count value and time variation features. The enhanced event feature matrix is ​​composed of multiple enhanced event feature vectors. The enhanced event feature matrix is ​​traversed column by column along the order of communication events. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate the behavioral afterimage feature corresponding to the current communication session.

6. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, Step five specifically involves: Using historical behavior afterimage data as input, the historical behavior afterimage data corresponds to the first scanning behavior, the second connection control behavior, and the data extraction behavior, and each type of historical behavior afterimage data consists of a causal driving behavior sequence belonging to the same behavior stage in multiple different times and different communication sessions. For multiple causal-driven behavior sequences under the same behavior stage, message type identifiers and time interval counts are extracted according to the order of communication events. The message type identifiers are mapped to message type encoding vectors of a set length, and the time interval counts are used as time feature components and concatenated with the message type encoding vectors to form a stage event feature vector. According to the order of communication events, multiple stage event feature vectors are written into a stage event feature matrix. The stage event feature matrix includes event feature vectors from different communication sessions. The order in which the event feature vectors are written is arranged according to the order of their respective causal driving behavior sequences. In the shadow branch, along the row direction of the stage event feature matrix, the time feature components between adjacent stage event feature vectors are differentially calculated to obtain the stage time change features. The stage time change features are then used as new numerical components and concatenated to the corresponding stage event feature vectors to form the stage enhanced event feature matrix. The enhanced event feature matrix of the stage is traversed column by column. For each column of feature values, the maximum value, minimum value, average value and cumulative sum are calculated. The statistical results corresponding to each column are then concatenated in column order to generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior and the data extraction behavior, respectively.

7. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, Step six specifically involves: The behavioral afterimage features corresponding to the current communication session generated by the main branch are used as the query feature vector, and the historical behavioral afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior generated by the shadow branches are used as the reference feature vector set. The query feature vector is aligned dimension by dimension with each historical behavior afterimage feature, and the feature values ​​of the corresponding dimensions are combined into feature pairs. For each feature pair, calculate the difference between the query feature vector and the corresponding historical behavior afterimage feature, and take the absolute value of the difference to obtain the dimension-wise afterimage difference vector; Each dimension of the difference value in the dimension-by-dimensional afterimage difference vector is assigned a weight coefficient. The cumulative sum of the corresponding dimension in the corresponding historical behavior afterimage feature is read. The ratio of the cumulative sum to the sum of all dimensions in the historical behavior afterimage feature is calculated to obtain the weight coefficient of the corresponding dimension. The weighted, dimension-wise afterimage difference vectors are summed according to their dimensions to obtain the afterimage matching distance between the afterimage features of the current communication session behavior and the corresponding historical behavior afterimage features. Calculate the afterimage matching distance between the query feature vector and the afterimage features of the corresponding first scanning behavior, second connection control behavior, and data extraction behavior, and use the afterimage matching distance as the afterimage matching result of the corresponding behavior stage.

8. The network intrusion detection method based on artificial intelligence according to claim 1, characterized in that, Step seven specifically involves: The afterimage matching results generated at different time points are recorded in the distributed time axis in the order of generation time. Each afterimage matching result includes the afterimage matching distance corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, as well as the corresponding time identifier. Using the afterimage matching results corresponding to multiple non-continuous time points within a preset time span in the distributed time axis as input samples, each afterimage matching result is mapped to a moth individual position, and the moth individual position is composed of the afterimage matching distance in each behavioral stage dimension; The improved moth flame optimization algorithm introduces a time-inertia flame mechanism during the optimization iteration process. Based on the flame state that has converged in the previous time axis, a time-inertia weight is assigned to obtain the inertial flame state. The time-inertia weight gradually decreases as the time axis progresses. In each optimization iteration, for each individual moth, the first distance between the position of the individual moth and the current flame state, and the second distance between the position of the individual moth and the inertial flame state are calculated. Both the first distance and the second distance are calculated using the Euclidean distance method. The first constraint coefficient is obtained by calculating the ratio of the second distance to the sum of the two distances; the second constraint coefficient is obtained by calculating the ratio of the first distance to the sum of the two distances. Based on the first constraint coefficient and the second constraint coefficient, a spiral update operation is performed on the position of the individual moth. The spiral update operation takes the current flame state as the rotation center, multiplies the spiral update displacement component pointing from the current flame state to the position of the individual moth by the first constraint coefficient, multiplies the displacement offset component pointing from the inertial flame state to the current flame state by the second constraint coefficient, and adds them together to obtain the update displacement of the individual moth position, thus completing the update of the position of the individual moth. After completing the preset maximum number of iterations, the average value of the individual moth positions at the same time point is calculated according to the behavioral stage dimension, based on the final position of the individual moths at each time point in the distributed time axis. The stage evolution vectors corresponding to each time point are then connected in chronological order to generate a global evolution trajectory. Based on the global evolution trajectory, it is detected whether there are at least three consecutive time points in the distributed time axis such that the stage matching distance corresponding to the first scanning behavior satisfies a monotonically non-increasing relationship at consecutive time points, and the stage matching distance corresponding to the second connection control behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter, and further, the stage matching distance corresponding to the data extraction behavior satisfies a monotonically non-increasing relationship at at least three consecutive time points thereafter. When the conditions are met, it is determined that there is a network intrusion behavior, and the determination result is output as the network intrusion detection result.

9. An artificial intelligence-based network intrusion detection device, executing the artificial intelligence-based network intrusion detection method according to any one of claims 1 to 8, characterized in that, Includes the following modules: The data acquisition module is used to collect network communication data at network boundary nodes, extract communication metadata for communication connections using encryption protocols, and perform session-level aggregation based on the communication metadata to generate session communication metadata. The echo mode generation module is used to identify acknowledgment messages, retransmission messages, connection establishment messages and connection release messages from the session communication metadata, extract the corresponding timing information and encode it in a unified format to generate echo mode data. The causal behavior reconstruction module is used to perform pseudo-time warping on echo pattern data, reconstruct the sequence based on the direct interaction dependencies between communication event records in the session, and generate a causal-driven behavior sequence. The behavior afterimage matching network module includes a main branch, a shadow branch, and an afterimage attention matching layer. The main branch is used to extract features from the causal-driven behavior sequence and generate behavior afterimage features corresponding to the current communication session. The shadow branch is used to extract features from historical behavior afterimage data and generate historical behavior afterimage features corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The afterimage attention matching layer is used to receive the behavior afterimage features and historical behavior afterimage features, perform afterimage matching distance calculation, and generate afterimage matching results corresponding to the first scanning behavior, the second connection control behavior, and the data extraction behavior, respectively. The temporal evolution reconstruction and detection module is used to record the afterimage matching results into a distributed time axis. Based on the improved moth flame optimization algorithm, a temporal inertial flame mechanism is introduced. During the iteration process, the individual position of the moth is spirally updated based on the joint constraints of the current flame state and the inertial flame state to generate network intrusion detection results.

10. A storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, enables the processor to perform the artificial intelligence-based network intrusion detection method according to any one of claims 1 to 8.

Images