Communication network intrusion detection method and system based on artificial intelligence
By employing an AI-based communication network intrusion detection method, this approach utilizes gradient descent and correlation coefficients to calculate feature metrics. By combining CNN and RNN learners, a dynamic sample library is constructed, and a reinforcement learning strategy is adopted. This solves the problems of singleness and real-time performance of traditional detection methods, achieving high-precision intrusion detection with low false alarms.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- 应急管理部大数据中心
- Filing Date
- 2026-01-09
- Publication Date
- 2026-04-28
AI Technical Summary
Traditional intrusion detection methods are relatively limited in their effectiveness in detecting network intrusions and cannot detect them in real time, which affects network security. Furthermore, machine learning algorithms lack sufficient accuracy in complex environments.
An AI-based communication network intrusion detection method is adopted. Through data preprocessing, feature optimization, multimodal detection, adaptive optimization and decision output, the gradient descent algorithm, Pearson correlation matrix and distance correlation coefficient are used to calculate the feature comprehensive metric value. The feature is extracted by combining CNN and RNN base learners, a dynamic sample library is constructed and an intrusion alarm is generated by using a reinforcement learning agent update strategy.
It achieves high-precision, low-false-prone, and fast-response intrusion detection in dynamic network environments, enhances the model's adaptability and generalization ability, reduces feature redundancy, and improves the real-time performance and accuracy of detection.
Smart Images
Figure CN121940171A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of communication network security technology, and in particular to an artificial intelligence-based communication network intrusion detection method and system. Background Technology
[0002] As an indispensable part of modern society, communication networks face pressing security challenges due to network intrusion issues. With the continuous increase in network security incidents and the diversification of network data transmission, network intrusion behaviors have also undergone diverse changes. Traditional intrusion detection methods primarily rely on anomaly behavior identification, which can usually detect intrusions promptly. However, limited by the specific intrusion events, this method has a relatively singular detection effect and cannot detect intrusions in real time, impacting network security. Machine learning algorithms, which extract complex knowledge from large amounts of data, continuously improve their learning ability during the knowledge learning and deduction process, playing a crucial role in intrusion detection. Therefore, there is an urgent need to utilize machine learning algorithms to design communication network intrusion behavior detection methods to maximize the accuracy of network intrusion detection. Summary of the Invention
[0003] In view of this, in order to achieve communication network intrusion detection, the purpose of this invention is to provide an artificial intelligence-based communication network intrusion detection method and system. Through data preprocessing, feature optimization, multimodal detection, adaptive optimization and decision output, high-precision intrusion detection is achieved, significantly improving the real-time performance and adaptability in dynamic network environments.
[0004] To achieve the above objectives, the present invention provides the following technical solution:
[0005] In a first aspect, the present invention provides an artificial intelligence-based method for detecting intrusions into communication networks, comprising the following steps:
[0006] Acquire raw data from the communication network and normalize the intrusion behavior data;
[0007] The global optimal solution for the features of intrusion data is obtained iteratively based on the gradient descent algorithm, and the comprehensive feature metric is calculated using the Pearson correlation matrix and the distance correlation coefficient.
[0008] Samples based on spatiotemporal traces are constructed, and spatial and temporal features are extracted using CNN spatial basis learners and RNN temporal basis learners, respectively. Cross-data domain feature transfer is achieved through transfer learning, and six types of base detectors are integrated to output detection results.
[0009] A dynamic sample library is established, real-time communication data is input into the adaptive module, a reinforcement learning agent is used to update the action strategy, and an intrusion alarm is generated based on the detection results and fed back to the adaptive module to optimize the model parameters.
[0010] As a further aspect of the present invention, the intrusion behavior data is normalized, and the formula for processing the intrusion behavior data is as follows:
[0011] ;
[0012] in, For normalized intrusion behavior data, These are the initial data feature values. and These represent the minimum and maximum values of the data transformation, respectively.
[0013] As a further aspect of the present invention, the normalized intrusion behavior data is unified to the same numerical range, and the intrusion data processing principle is defined as follows:
[0014] ;
[0015] In the formula, As a principle for intrusion data processing, A collection of abnormal attributes; This is the set of hidden conditions for intrusion. The range of the set of labels is 0-1, where 0 represents the hidden conditions of the intrusion event and l represents the session containing the attack nature in the intrusion event. These are characteristic categories of normal network behavior; These are characteristic categories of abnormal network behavior; and These represent characteristic categories of normal and abnormal network behavior, respectively.
[0016] As a further aspect of the present invention, the formula for calculating the comprehensive feature metric value using the Pearson correlation matrix and the distance correlation coefficient is as follows:
[0017] ;
[0018] In the formula, For the first A comprehensive importance score for dimensional features; These are weighting coefficients. ; For the first Distance correlation between dimensional features and labels; For the first The Pearson correlation between dimensional features and labels; For the first Redundancy between dimensional features and other features.
[0019] As a further aspect of the present invention, when calculating the comprehensive feature metric using the Pearson correlation matrix and the distance correlation coefficient, the total number of samples in the dataset is set to... The feature dimension is The Pearson correlation coefficients between features are calculated by iterating through them:
[0020] ;
[0021] In the formula, Features and The degree of linear correlation between them; and For the first Two feature values for each sample; and The sample mean of the two features; The total number of samples;
[0022] The distance correlation coefficient is:
[0023] ;
[0024] In the formula, Features and The degree of nonlinear correlation; The distance covariance; Let be the distance variance.
[0025] As a further aspect of the present invention, a reinforcement learning agent is employed to update the action strategy, and the action state function update formula is as follows:
[0026] ;
[0027] In the formula, For state Next action The long-term expected return; Discount factor; For instant reward functions; The maximum expected return for the next state.
[0028] As a further aspect of the present invention, the specific parameter configuration for the adaptive optimization stage is as follows: number of hidden elements 60, number of explicit elements 51, learning rate 0.0001, decay factor 0.001, sparsity penalty 6, maximum number of iterations 600; the action strategy of the reinforcement learning agent adopts an ε-greedy strategy.
[0029] As a further aspect of the present invention, the dynamic sample library update mechanism is as follows: 20% of the real-time detection data is randomly selected in each round of training to replace the historical data, so as to ensure the dynamic balance of the sample library.
[0030] As a further aspect of the present invention, the communication network intrusion detection method also includes sparse coding processing, which decomposes the input sample set into a linear combination of primitives:
[0031] ;
[0032] In the formula, For the input sample vector, For the first The coefficients of each element; For the first Each element; The number of primitives.
[0033] Secondly, the present invention also provides an artificial intelligence-based communication network intrusion detection system, comprising:
[0034] The data acquisition module is used to acquire raw data from the communication network and normalize intrusion behavior data.
[0035] The feature optimization module is used to iteratively solve the global optimal solution of intrusion data features based on the gradient descent algorithm, and calculate the comprehensive feature metric value through the Pearson correlation matrix and distance correlation coefficient.
[0036] The multi-class attack detection module is used to construct samples based on spatiotemporal traces. It uses CNN spatial base learners and RNN temporal base learners to extract spatial and temporal features, respectively. It achieves cross-data domain feature transfer through transfer learning and integrates six base detectors to output detection results.
[0037] The adaptive detection module is used to build a dynamic sample library. Real-time communication data is input into the adaptive module, and a reinforcement learning agent is used to update the action strategy. Based on the detection results, intrusion alarms are generated and fed back to the adaptive module to optimize model parameters.
[0038] As a further aspect of the present invention, the communication network intrusion detection system further includes a sparse coding module for sparse coding processing, which decomposes the input sample set into a linear combination of primitives.
[0039] Compared with existing technologies, the artificial intelligence-based communication network intrusion detection method and system provided in this invention have the following advantages:
[0040] This invention employs parallel extraction of spatial and temporal features using CNN and RNN base learners. It integrates six types of base detectors to achieve multi-class attack detection, combining spatiotemporal trace sample construction with transfer learning to achieve cross-data domain feature transfer and enhance model generalization ability. A comprehensive feature metric is calculated using the Pearson correlation matrix and distance correlation coefficient, and key features are selected by importance to reduce feature redundancy and minimize interference from irrelevant features. A dynamic sample library is constructed and combined with a reinforcement learning agent's real-time update strategy, reducing false alarm rates and shortening detection response time to milliseconds in mutating network environments. The agent uses an ε-greedy strategy to balance exploration and utilization, avoiding getting trapped in local optima, thus achieving high-precision, low-false-alarm, and highly adaptive communication network intrusion detection.
[0041] These or other aspects of the invention will become more apparent from the following description of embodiments. It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only, and are not intended to limit the invention. Attached Figure Description
[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. In the drawings:
[0043] Figure 1 This is a flowchart of an artificial intelligence-based communication network intrusion detection method according to the present invention.
[0044] Figure 2 This is a schematic diagram illustrating the optimal feature values of communication network intrusion data in an artificial intelligence-based communication network intrusion detection method according to the present invention.
[0045] Figure 3 This is a schematic diagram of gradient descent optimization features in an artificial intelligence-based communication network intrusion detection method of the present invention.
[0046] Figure 4 This is a schematic diagram illustrating multi-category attack detection in a communication network intrusion detection method based on artificial intelligence according to the present invention.
[0047] Figure 5 This is a schematic diagram of an adaptive artificial intelligence communication network intrusion architecture in an artificial intelligence-based communication network intrusion detection method of the present invention.
[0048] Figure 6 This is a flowchart illustrating the adaptive artificial intelligence communication network intrusion process in an artificial intelligence-based communication network intrusion detection method of the present invention.
[0049] Figure 7This is a flowchart of an adaptive intrusion detection method for communication networks based on artificial intelligence, according to the present invention.
[0050] Figure 8 This is a schematic diagram of the adaptive intrusion detection implementation framework in an artificial intelligence-based communication network intrusion detection method of the present invention. Detailed Implementation
[0051] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but it should be understood that the scope of protection of the present invention is not limited to the specific embodiments.
[0052] Unless otherwise expressly stated, throughout the specification and claims, the term "comprising" or its variations such as "including" or "comprises" shall be understood to include the stated elements or components without excluding other elements or other components.
[0053] like Figures 1 to 8 As shown, one embodiment of the present invention provides a communication network intrusion detection method based on artificial intelligence, including the following steps:
[0054] Step S10: Obtain raw data from the communication network and normalize the intrusion behavior data;
[0055] Step S20: Iteratively solve the global optimal solution of the intrusion data features based on the gradient descent algorithm, and calculate the comprehensive feature metric value through the Pearson correlation matrix and distance correlation coefficient;
[0056] Step S30: Construct samples based on spatiotemporal traces, extract spatial and temporal features using CNN spatial base learner and RNN temporal base learner respectively, achieve cross-data domain feature transfer through transfer learning, and integrate six types of base detectors to output detection results;
[0057] Step S40: Establish a dynamic sample library, input real-time communication data into the adaptive module, use reinforcement learning agent to update action strategy, generate intrusion alarm based on detection results, and feed it back to the adaptive module to optimize model parameters.
[0058] The process of extracting intrusion data features involves dividing the data into features within a feasible area and assigning fixed-point values to all features to ensure accuracy. Considering the specific data segmentation methods for communication network intrusion behavior, this embodiment uses fewer data types, resulting in more random data extraction and making it difficult to effectively extract the optimal data. Therefore, this embodiment departs from the extraction method based on local optima and employs multiple calculations and iterations to derive the optimal feature values for the communication network intrusion data. Figure 2 and Figure 3 As shown, Figure 3In the equation, a, b, and c are local optima for the intrusion data features, while d is the global optima for the intrusion data features. By iterating through ad, local optima, b, and c at different times are found. Then, based on the feature values of a, b, and c, the global optima is extracted, thus revealing the characteristics of network intrusion behavior at different times.
[0059] With the core objective of achieving accurate identification of multiple types of attacks in ETCN intrusion detection, the process of the communication network intrusion detection algorithm for multiple types of attacks is as follows: Figure 2 As shown, firstly, a sample construction method based on spatiotemporal traces is designed to represent the spatiotemporal traces contained in the ETCN intrusion dataset in both spatial and temporal series forms. Secondly, based on LeNet, AlexNet, and VGGNet in CNNs, and Vanilla RNN, LSTM, and GRU in RNNs, three spatial base learners and one temporal base learner are designed to capture the spatial and temporal traces of network attacks. Simultaneously, a transfer learning-based transfer strategy is designed and applied to the spatial base learner to transfer sample spatial information across data domains. Thirdly, an ensemble structure and algorithm are designed to integrate the learning results of six base detectors to achieve high-accuracy detection. Finally, the method is fully evaluated and validated through multi-faceted experiments. During data processing, inconsistent data is addressed by integrating multiple datasets into a single dataset and re-extracting and processing data features to reduce data conflicts and redundancy. Since there are seven types of intrusion behavior features, the differences in the values of numerical variables directly lead to the drawback of behavioral data being dominated by feature data. Therefore, this embodiment uses a normalization method to process intrusion behavior data. In this embodiment, the intrusion behavior data is normalized using the following formula:
[0060] ;
[0061] in, For normalized intrusion behavior data, These are the initial data feature values. and These represent the minimum and maximum values of the data transformation, respectively.
[0062] After normalizing intrusion behavior data, correlations exist between different data sets. This embodiment unifies the normalized data into the same numerical range, shortening data processing time. For intrusion detection events, this embodiment defines them as an abnormal attribute set A. Based on the randomness of intrusion event data, this embodiment defines the intrusion hidden condition label set as B, with a label set range of 0-1. Here, 0 represents the hidden condition of the intrusion event, and 1 represents a session containing attack characteristics within the intrusion event. The normalized intrusion behavior data is unified into the same numerical range. The intrusion data processing principle is defined as follows:
[0063] ;
[0064] In the formula, As a principle for intrusion data processing, A collection of abnormal attributes; This is the set of hidden conditions for intrusion. The range of the set of labels is 0-1, where 0 represents the hidden conditions of the intrusion event and l represents the session containing the attack nature in the intrusion event. These are characteristic categories of normal network behavior; These are characteristic categories of abnormal network behavior; and These represent feature categories of normal and abnormal network behavior, respectively. Following data processing principles, the above data is simplified to improve processing efficiency while minimizing data loss. Specifically, B corresponds to feature vectors such as A. After processing the implicit vectors within these feature vectors, network security vulnerabilities can be analyzed.
[0065] Since numerical mathematical operations are required, before starting the calculation, the feature transformation method is first used to quantify and normalize all sample features; in addition, for the category labels, they are mapped to decimal values starting from 0 in sequence.
[0066] When calculating the comprehensive feature metric using the Pearson correlation matrix and distance correlation coefficient, the total number of samples in the dataset is set to... The feature dimension is The Pearson correlation coefficients between features are calculated by iterating through them:
[0067] ;
[0068] In the formula, Features and The degree of linear correlation between them; and For the first Two feature values for each sample; and The sample mean of the two features; The total number of samples.
[0069] After completing the traversal calculations, a Pearson correlation matrix R is obtained, which contains the Pearson correlation coefficients between any two features in the dataset. Then, the th feature is calculated. The degree of linear redundancy between the dimensional feature and other features:
[0070] ;
[0071] Calculate the Pearson correlation coefficient between all features and the category label; for non-linear correlations, iterate through and calculate the distance correlation coefficient between features. First, calculate... and First, calculate the distance matrix between each element. Then, calculate the center distance matrix and distance covariance, and finally calculate the distance correlation coefficient, which is:
[0072] ;
[0073] In the formula, Features and The degree of nonlinear correlation; The distance covariance; Let be the distance variance.
[0074] Then, the distance correlation coefficients between all features and category labels are calculated. Following the principle of "maximum correlation and minimum redundancy"—that is, maximizing the correlation between features and category labels in the ETON intrusion dataset while minimizing redundancy among features—a weighted formula is designed to combine the results of the linear and non-linear parts. In this embodiment, the formula for calculating the feature comprehensive metric using the Pearson correlation matrix and distance correlation coefficients is as follows:
[0075] ;
[0076] In the formula, For the first A comprehensive importance score for dimensional features; These are weighting coefficients. ; For the first Distance correlation between dimensional features and labels; For the first The Pearson correlation between dimensional features and labels; For the first Redundancy between dimensional features and other features.
[0077] The comprehensive metric coefficients of all features of the ETCN network data are sorted from largest to smallest. The larger the value, the more likely it is that the first... The more important the dimensional feature.
[0078] To enable the model to monitor intrusion behavior in dynamic environments and achieve unsupervised intrusion detection, an adaptive module was added. 20% of the real-time communication data collected in the information storage module is fed into the adaptive update module, which processes this data into labeled data and uses it to dynamically train the DBN network. The adaptive module's model is as follows: Figure 5 and Figure 6 As shown.
[0079] In this embodiment, the specific parameter configuration for the adaptive optimization phase is as follows: 60 hidden units, 51 explicit units, learning rate 0.0001, decay factor 0.001, sparsity penalty 6, and maximum number of iterations 600; the action strategy of the reinforcement learning agent adopts an ε-greedy strategy. The dynamic sample library update mechanism is as follows: in each round of training, 20% of the real-time detection data is randomly selected to replace historical data, ensuring the dynamic balance of the sample library.
[0080] In this embodiment, the communication network intrusion detection method further includes sparse coding processing, which decomposes the input sample set into a linear combination of primitives:
[0081] ;
[0082] In the formula, For the input sample vector, For the first The coefficients of each element; For the first Each element; The number of primitives.
[0083] like Figure 5 and Figure 6As shown, the key points of the improved model can be summarized as follows: Based on the negative gradient and antecedent distribution algorithm, the parameters and weights of the basic decision trees are iteratively fitted sequentially. As the fitting process progresses, the residual between the training data and the model's predicted values gradually decreases, and the model's discriminative ability gradually improves. The iteration is completed when the number of iterations reaches a preset upper limit M. Using an additive model, all basic decision trees are weighted and linearly combined to obtain the final improved model. In this process, the model establishes the boundary between normal and attack decision behaviors in the decision trees through binary splitting. Each new decision tree theoretically constructs a more accurate boundary for decision behaviors. After training is completed, when facing a sample to be tested, the model can determine its positive or negative attribute through this boundary. Thanks to this mode, even when facing unknown attacks that have not participated in training, the model can determine whether it is normal or an attack by determining which side of the boundary the sample's mapping position in the feature space is on. First, all samples are randomly shuffled. Then, for the th... The first sample Each categorical feature, before calculation The average value of the sample labels of each sample is used as the statistical value of the target variable for this feature. At the same time, prior knowledge is incorporated into the calculation to smooth it out in order to avoid overfitting.
[0084] The implementation framework of the adaptive online monitoring method for communication network intrusion proposed in this embodiment is as follows: Figure 7 and Figure 8 As shown, the core idea is to construct a dynamic sample database, update the data in the database based on the latest communication network transmission data, and train a reinforcement learning agent to maintain adaptability to changes in communication network transmission. The main implementation steps of this method include:
[0085] Construct a reinforcement learning agent and determine its environmental state, action space, and reward function based on the actual intrusion detection problem;
[0086] The reinforcement learning agent is trained based on a dynamic sample library. The dynamic sample library is initially composed of historical data samples transmitted over a communication network. After actual detection, a portion of the actual detection data is randomly selected to supplement the sample library, while an equal amount of historical data is removed, thereby achieving dynamic updating and adjustment of the sample library.
[0087] The trained agent will be continuously used for intrusion detection of data transmitted on the latest communication networks.
[0088] The training phase refers to the process of training the agent using historical data of the problem to be solved, in order to obtain a mature agent. The essence of training is to optimize and improve the agent's action strategy, mainly through updating the action state function. In the reward calculation phase, the agent calculates the reward value according to a preset reward function based on changes in the environmental state and updates the action state function value. In this embodiment, a reinforcement learning agent is used to update the action strategy, and the action state function update formula is:
[0089] ;
[0090] In the formula, For state Next action The long-term expected return; Discount factor; For instant reward functions; The maximum expected reward for the next state. The parameters of the Adaptive communication network intrusion detection model are shown in Table 1.
[0091] Table 1 Parameter Table of Adaptive Communication Network Intrusion Detection Model
[0092] parameter value Number of hidden elements 60 Number of explicit elements 51 Learning rate 0.0001 Attenuation factor 0.001 Sparsity penalty 6 Maximum number of iterations 600
[0093] Another embodiment of the present invention provides an artificial intelligence-based communication network intrusion detection system, comprising:
[0094] The data acquisition module is used to acquire raw data from the communication network and normalize intrusion behavior data.
[0095] The feature optimization module is used to iteratively solve the global optimal solution of intrusion data features based on the gradient descent algorithm, and calculate the comprehensive feature metric value through the Pearson correlation matrix and distance correlation coefficient.
[0096] The multi-class attack detection module is used to construct samples based on spatiotemporal traces. It uses CNN spatial base learners and RNN temporal base learners to extract spatial and temporal features, respectively. It achieves cross-data domain feature transfer through transfer learning and integrates six base detectors to output detection results.
[0097] The adaptive detection module is used to build a dynamic sample library. Real-time communication data is input into the adaptive module, and a reinforcement learning agent is used to update the action strategy. Based on the detection results, intrusion alarms are generated and fed back to the adaptive module to optimize model parameters.
[0098] In this embodiment, the communication network intrusion detection system further includes a sparse coding module for sparse coding processing, which decomposes the input sample set into a linear combination of primitives.
[0099] This invention employs parallel extraction of spatial and temporal features using CNN and RNN base learners. It integrates six types of base detectors to achieve multi-class attack detection, combining spatiotemporal trace sample construction with transfer learning to achieve cross-data domain feature transfer and enhance model generalization ability. A comprehensive feature metric is calculated using the Pearson correlation matrix and distance correlation coefficient, and key features are selected by importance to reduce feature redundancy and minimize interference from irrelevant features. A dynamic sample library is constructed and combined with a reinforcement learning agent's real-time update strategy, reducing false alarm rates and shortening detection response time to milliseconds in mutating network environments. The agent uses an ε-greedy strategy to balance exploration and utilization, avoiding getting trapped in local optima, thus achieving high-precision, low-false-alarm, and highly adaptive communication network intrusion detection.
[0100] The foregoing description of specific exemplary embodiments of the invention is for illustrative and explanatory purposes. These descriptions are not intended to limit the invention to the precise forms disclosed, and it will be apparent that many changes and variations can be made in accordance with the foregoing teachings. The exemplary embodiments were chosen and described in order to explain the specific principles of the invention and its practical application, thereby enabling those skilled in the art to implement and utilize various different exemplary embodiments of the invention, as well as various different choices and variations. The scope of the invention is intended to be defined by the claims and their equivalents.
Claims
1. A communication network intrusion detection method based on artificial intelligence, characterized in that, Includes the following steps: Acquire raw data from the communication network and normalize the intrusion behavior data; The global optimal solution for the features of intrusion data is obtained iteratively based on the gradient descent algorithm, and the comprehensive feature metric is calculated using the Pearson correlation matrix and the distance correlation coefficient. Samples based on spatiotemporal traces are constructed, and spatial and temporal features are extracted using CNN spatial base learners and RNN temporal base learners, respectively. Cross-data domain feature transfer is achieved through transfer learning, and six types of base detectors are integrated to output detection results. A dynamic sample library is established, real-time communication data is input into the adaptive module, a reinforcement learning agent is used to update the action strategy, and an intrusion alarm is generated based on the detection results and fed back to the adaptive module to optimize the model parameters.
2. The artificial intelligence-based communication network intrusion detection method as described in claim 1, characterized in that, The intrusion behavior data is normalized using the following formula: ； in, For normalized intrusion behavior data, These are the initial data feature values. and These represent the minimum and maximum values of the data transformation, respectively.
3. The artificial intelligence-based communication network intrusion detection method as described in claim 2, characterized in that, After normalization, intrusion behavior data is unified to the same numerical range. The principle of intrusion data processing is defined as follows: ； In the formula, As a principle for intrusion data processing, A collection of abnormal attributes; This is the set of hidden conditions for intrusion. The range of the set of labels is 0-1, where 0 represents the hidden conditions of the intrusion event and l represents the session containing the attack nature in the intrusion event. These are characteristic categories of normal network behavior; These are characteristic categories of abnormal network behavior; and These represent characteristic categories of normal and abnormal network behavior, respectively.
4. The artificial intelligence-based communication network intrusion detection method as described in claim 1, characterized in that, The formula for calculating the comprehensive feature metric using the Pearson correlation matrix and distance correlation coefficient is as follows: ； In the formula, For the first A comprehensive importance score for dimensional features; These are weighting coefficients. ; For the first Distance correlation between dimensional features and labels; For the first The Pearson correlation between dimensional features and labels; For the first Redundancy between dimensional features and other features.
5. The artificial intelligence-based communication network intrusion detection method as described in claim 4, characterized in that, When calculating the comprehensive feature metric using the Pearson correlation matrix and distance correlation coefficient, let the total number of samples in the dataset be... The feature dimension is The Pearson correlation coefficients between features are calculated by iterating through them: ； In the formula, Features and The degree of linear correlation between them; and For the first Two feature values for each sample; and The sample mean of the two features; The total number of samples; The distance correlation coefficient is: ； In the formula, Features and The degree of nonlinear correlation; The distance covariance; Let be the distance variance.
6. The artificial intelligence-based communication network intrusion detection method as described in claim 1, characterized in that, The action state function update formula is as follows: (This is a simplified explanation of the action state update strategy using a reinforcement learning agent.) ； In the formula, For state Next action The long-term expected return; Discount factor; For instant reward functions; The maximum expected return for the next state.
7. The artificial intelligence-based communication network intrusion detection method as described in claim 6, characterized in that, The specific parameter configurations for the adaptive optimization phase are as follows: number of hidden units 60, number of explicit units 51, learning rate 0.0001, decay factor 0.001, sparsity penalty 6, and maximum number of iterations 600; the action strategy of the reinforcement learning agent adopts the ε-greedy strategy.
8. The artificial intelligence-based communication network intrusion detection method as described in claim 1, characterized in that, This communication network intrusion detection method also includes sparse coding processing, which decomposes the input sample set into a linear combination of primitives: ； In the formula, For the input sample vector, For the first The coefficients of each element; For the first Each element; The number of primitives.
9. An artificial intelligence-based communication network intrusion detection system, characterized in that, The communication network intrusion detection system is used to perform the steps of the artificial intelligence-based communication network intrusion detection method as described in any one of claims 1-8, wherein the communication network intrusion detection system comprises: The data acquisition module is used to acquire raw data from the communication network and normalize intrusion behavior data. The feature optimization module is used to iteratively solve the global optimal solution of intrusion data features based on the gradient descent algorithm, and calculate the comprehensive feature metric value through the Pearson correlation matrix and distance correlation coefficient. The multi-class attack detection module is used to construct samples based on spatiotemporal traces. It uses CNN spatial base learners and RNN temporal base learners to extract spatial and temporal features, respectively. It achieves cross-data domain feature transfer through transfer learning and integrates six base detectors to output detection results. The adaptive detection module is used to build a dynamic sample library. Real-time communication data is input into the adaptive module, and a reinforcement learning agent is used to update the action strategy. Based on the detection results, intrusion alarms are generated and fed back to the adaptive module to optimize model parameters.
10. The artificial intelligence-based communication network intrusion detection system as described in claim 9, characterized in that, It also includes a sparse coding module for sparse coding processing, which decomposes the input sample set into a linear combination of primitives.