Computer network security intrusion detection device and method

Abstract

The invention discloses a computer network security intrusion detection device and method, and the device comprises a distributed detection node module, an edge preprocessing module, a central control module, a feature library updating module, an intrusion tracing module and an early warning response module, and all modules achieve the data interaction through an encrypted communication link. The distributed detection node module comprises a plurality of detection units, and each detection unit is provided with a flow acquisition module, a protocol analysis module, a preliminary detection module and a local cache module; the flow collection module is used for collecting network data in a full-flow manner and filtering invalid data packets, and the protocol analysis module is used for carrying out hierarchical analysis on the collected data packets. According to the method, a framework combining distributed preliminary detection and center depth detection is adopted, and triple mechanisms of feature matching, lightweight anomaly detection and deep learning detection based on Transform are integrated, so that accurate recognition of known intrusion behaviors is ensured, and unknown intrusion and variant intrusion behaviors can be effectively recognized.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, specifically to a computer network security intrusion detection device and method. Background Technology

[0002] With the rapid development of information technology, computer networks have permeated all aspects of social production and life, becoming the core infrastructure supporting the efficient operation of various industries. However, the openness and complexity of networks also make them face increasingly severe security threats. Hacking attacks, malicious code injection, data theft, and distributed denial-of-service (DDoS) attacks occur frequently, which can not only lead to network paralysis and data leakage, but also cause huge economic losses and reputational risks to enterprises and individuals.

[0003] Intrusion detection technology, as a crucial component of network security protection systems, can monitor abnormal network behavior in real time, promptly detect intrusion signs, and issue early warnings, providing critical support for network security protection. Existing intrusion detection devices and methods are mainly divided into two categories: feature-matching-based intrusion detection and anomaly detection-based intrusion detection. Feature-matching-based intrusion detection methods compare and analyze network data using a pre-defined feature database of known intrusion behaviors. When behavior matching the features in the database is detected, it is considered an intrusion. This method boasts high accuracy and a low false positive rate, but it has significant limitations: it cannot identify unknown intrusion behaviors and is highly dependent on updating the feature database, making it difficult to cope with constantly evolving intrusion methods.

[0004] Intrusion detection methods based on anomaly detection establish a normal network behavior model and compare the actual network behavior with the normal model. When the deviation exceeds a preset threshold, it is judged as an anomaly. This method can identify unknown intrusion behaviors, but it suffers from high false alarm rates and insufficient detection accuracy. Furthermore, the establishment of the normal behavior model is greatly affected by dynamic changes in the network environment, resulting in poor adaptability.

[0005] Furthermore, most existing intrusion detection devices employ a centralized detection architecture, where all network data is transmitted to a central detection node for processing. This not only easily creates data transmission bottlenecks, leading to increased detection latency, but also poses a single point of failure risk at the central node. If the central node is attacked or fails, the entire intrusion detection system will be paralyzed. Simultaneously, existing devices lack sufficient depth in analyzing network traffic, often only performing surface-level protocol analysis. They struggle to identify deep intrusion behaviors hidden within normal traffic and lack the ability to trace the source of intrusions, hindering subsequent security measures and attack prevention.

[0006] In view of the shortcomings of the existing technologies, there is an urgent need for a computer network security intrusion detection device and method with high detection accuracy, low false alarm rate, ability to identify unknown intrusion behaviors, distributed architecture and intrusion tracing capabilities, so as to improve the overall level of network security protection. Summary of the Invention

[0007] The purpose of this invention is to provide a computer network security intrusion detection device and method to solve the problems mentioned in the background art.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a computer network security intrusion detection device, comprising a distributed detection node module, an edge preprocessing module, a central control module, a signature database update module, an intrusion tracing module, and an early warning response module, wherein each module achieves data interaction through an encrypted communication link; The distributed detection node module includes multiple detection units, each equipped with a traffic acquisition module, a protocol parsing module, a preliminary detection module, and a local caching module. The traffic acquisition module is used to collect network data across the entire network and filter invalid data packets. The protocol parsing module is used to perform layered parsing on the collected data packets, extract key information, and standardize them. The preliminary detection module employs a dual mechanism of feature matching and lightweight anomaly detection, outputting three types of detection results: "normal," "suspected intrusion," and "confirmed intrusion." The local caching module is used to cache the original data packets, parsing results, and detection results. The edge preprocessing module includes a data aggregation module, a feature extraction module, a noise filtering module, and a data encryption module. The data aggregation module is used to classify and aggregate data uploaded by distributed detection nodes. The feature extraction module uses a CNN-RNN fusion model to extract deep features. The noise filtering module filters noisy data based on confidence scores. The data encryption module uses the AES-256 algorithm to encrypt data. The central control module includes a deep learning detection module, a feature library management module, a node scheduling module, and a status monitoring module. The deep learning detection module uses the Transformer model for deep detection to identify known, unknown, and mutated intrusion behaviors. The feature library management module manages the basic feature library and dynamically updates the feature library. The node scheduling module dynamically adjusts the resource allocation of detection nodes. The status monitoring module monitors the operating status of each module. The feature library update module is used to collect, verify, update, and distribute intrusion features, thereby enabling collaborative updates of the feature library across the entire system. The intrusion tracing module includes a data packet tracing unit, an attack path restoration unit, an attack source location unit, and a tracing report generation unit, which are used to locate the attack source, restore the attack path, and generate a tracing report. The early warning response module is equipped with an early warning classification unit, an early warning notification unit, and an emergency response unit, which are used for classified early warning, multi-channel notification, and automatic emergency response.

[0009] Furthermore, the traffic acquisition module uses PF_RING technology to achieve high-speed data packet capture, supports acquisition rates of over 10Gbps, and can filter invalid data packets such as empty packets and duplicate packets; the local cache module uses SSD storage medium, supports LZ4 compression algorithm, and has a default cache time of 72 hours.

[0010] Furthermore, the lightweight anomaly detection mechanism of the preliminary detection module adopts an improved K-means clustering algorithm, and the Transformer model of the deep learning detection module is trained through the PyTorch framework, which has the function of adaptive model optimization.

[0011] Furthermore, the attack source location unit, combined with IP address tracking, port analysis, and device fingerprinting technology, can crack IP spoofing and locate the real attack source and device information.

[0012] Furthermore, the early warning classification unit divides the early warning level into four levels, corresponding to different early warning symbols and response strategies; the emergency response unit supports a combination of automatic operation and manual intervention, and can perform operations such as restricting access, isolating connections, cutting off links, and emergency shutdown.

[0013] A computer network security intrusion detection method, based on a computer network security intrusion detection device, includes the following steps: S1: Distributed traffic collection and preliminary detection: Each detection unit collects network traffic, parses it, and performs preliminary classification through a dual detection mechanism. Suspected and confirmed intrusion data are then uploaded to the edge preprocessing module. S2: Edge data preprocessing: After aggregating, extracting deep features, filtering noise, and encrypting the uploaded data, it is transmitted to the central control module; S3: Central Deep Detection and Feature Library Update: Through deep detection using the Transformer model, the feature library is updated and distributed to each module in a coordinated manner, and detection node resources are dynamically scheduled; S4: Intrusion Source Analysis: Track intrusion data packets, reconstruct attack paths, locate attack sources, and generate source analysis reports; S5: Early Warning and Emergency Response: Tiered early warning, multi-channel notification, and automatic execution of emergency operations based on the early warning level; S6: System Status Monitoring and Maintenance: Monitor the operating status of each module, perform regular self-checks and maintenance, and clean up expired cached data.

[0014] Furthermore, in step S1, the preliminary detection module stores "normal" data only in the local cache module, while "suspected intrusion" and "confirmed intrusion" data are uploaded along with the original data packets.

[0015] Furthermore, in step S2, the credibility score of the noise filtering module is calculated based on the reliability of the data source, the feature matching degree, and the abnormal deviation value, with the threshold set to 0.3 by default.

[0016] Furthermore, in step S3, the feature library update module synchronizes the latest features from the authoritative CVE database every 2 hours, while adding newly identified intrusion features locally.

[0017] Furthermore, in step S5, a level 3 or higher warning will automatically dial the emergency contact number, and a level 4 warning will trigger the network emergency shutdown plan.

[0018] Compared with the prior art, the beneficial effects of the present invention are: This invention adopts an architecture that combines distributed preliminary detection with central deep detection, integrating a triple mechanism of feature matching, lightweight anomaly detection, and Transformer-based deep learning detection. This ensures accurate identification of known intrusion behaviors, effectively identifies unknown and mutated intrusion behaviors, and significantly reduces the false alarm rate through edge noise filtering.

[0019] This invention uses distributed detection nodes located near the network edge to achieve local preliminary detection and preprocessing of traffic, reducing the amount of data uploaded to the center and lowering detection latency. The distributed architecture avoids the risk of single point of failure of the central node, and the node scheduling module can dynamically adjust resource allocation to ensure stable system operation.

[0020] This invention, by calling the original data packets cached by each node and combining multi-dimensional tracing technology, can accurately locate the attack source, reconstruct the attack path, and generate a detailed tracing report, providing strong support for security handling and subsequent attack prevention. It adopts a hierarchical early warning mechanism, combined with multiple early warning notification methods and automatic emergency response operations, and can quickly take targeted measures according to the degree of intrusion harm, effectively curbing the spread of intrusion and reducing the losses caused by intrusion.

[0021] The feature library of this invention supports automatic collaborative updates, enabling rapid adaptation to new intrusion methods; the distributed detection nodes can be flexibly added or removed according to the network size, and the system architecture has good scalability, making it suitable for network environments of different sizes. Attached Figure Description

[0022] Figure 1 This is a system diagram of the computer network security intrusion detection device of the present invention; Figure 2 This is a schematic diagram of the intrusion tracing module structure of the present invention; Figure 3 This is a schematic diagram of the early warning response module structure of the present invention; Figure 4 This is a schematic diagram of the computer network security intrusion detection method of the present invention.

[0023] In the diagram: 100, Distributed Detection Node Module; 101, Traffic Acquisition Module; 102, Protocol Parsing Module; 103, Preliminary Detection Module; 104, Local Cache Module; 110, Edge Preprocessing Module; 111, Data Aggregation Module; 112, Feature Extraction Module; 113, Noise Filtering Module; 114, Data Encryption Module; 120, Central Control Module; 121, Deep Learning Detection Module; 122, Feature Library Management Module; 123, Node Scheduling Module; 124, Status Monitoring Module; 130, Feature Library Update Module; 140, Intrusion Source Tracing Module; 141, Data Packet Source Tracing Unit; 142, Attack Path Reconstruction Unit; 143, Attack Source Location Unit; 144, Source Tracing Report Generation Unit; 150, Early Warning Response Module; 151, Early Warning Classification Unit; 152, Early Warning Notification Unit; 153, Emergency Response Unit. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Please see Figure 1-4 The present invention provides a technical solution: a computer network security intrusion detection device, comprising a distributed detection node module 100, an edge preprocessing module 110, a central control module 120, a feature database update module 130, an intrusion tracing module 140, and an early warning response module 150, wherein each module realizes data interaction through an encrypted communication link; The distributed detection node module 100 includes multiple detection units deployed at network edge nodes. Each detection unit monitors a network link or a terminal device, enabling distributed collection and preliminary detection of network traffic. Each detection unit includes a traffic collection module 101, a protocol parsing module 102, a preliminary detection module 103, and a local caching module 104.

[0026] The traffic acquisition module 101 employs high-speed packet capture technology, supporting full traffic acquisition for wired and wireless networks, including packets from various protocols such as TCP, UDP, and ICMP. The acquisition rate can reach over 10Gbps, ensuring no network data is missed. Simultaneously, the traffic acquisition module 101 features traffic filtering capabilities, filtering out invalid packets according to preset rules to reduce the amount of data processed subsequently.

[0027] The protocol parsing module 102 is used to perform layered parsing of the collected data packets, extracting protocol field information from the data link layer, network layer, transport layer to application layer, including key information such as source IP address, destination IP address, source port, destination port, protocol type, and data payload, and standardizing the parsing results to form network behavior data in a unified format.

[0028] The preliminary detection module 103 integrates a dual detection mechanism based on feature matching and anomaly detection. The feature matching detection unit has a built-in basic intrusion feature library, which quickly compares the parsed network behavior data to identify known intrusion behaviors. The anomaly detection unit uses a lightweight machine learning model to build a local simplified normal behavior model and performs real-time anomaly judgment on network behavior. The preliminary detection module 103 classifies the detection results into three categories: "normal," "suspected intrusion," and "confirmed intrusion." It uploads the "suspected intrusion" and "confirmed intrusion" data and the corresponding raw data packets to the edge preprocessing module 110, while caching the detection results in the local cache module 104.

[0029] The local cache module 104 uses a high-speed solid-state drive as the storage medium to cache the collected raw data packets, parsing results, and preliminary detection results. The caching time can be configured according to actual needs, providing data support for subsequent intrusion tracing. Simultaneously, the local cache module 104 has a data compression function, using the LZ4 compression algorithm to compress the cached data, saving storage space.

[0030] The edge preprocessing module 110 is deployed at the network edge gateway and connected to each distributed detection node module 100 via a local area network. It is used to centrally preprocess the "suspected intrusion" and "confirmed intrusion" data uploaded by each detection unit, reducing the processing pressure on the central control module 120 and reducing detection latency. The edge preprocessing module 110 includes a data aggregation module 111, a feature extraction module 112, a noise filtering module 113, and a data encryption module 114.

[0031] The data aggregation module 111 classifies and aggregates data uploaded by multiple detection units according to dimensions such as timestamp, IP address, and intrusion type, eliminating data redundancy and forming a structured data set for easy subsequent processing.

[0032] The feature extraction module 112 uses deep learning algorithms to perform deep feature extraction on the aggregated data. It not only extracts traditional network behavior features, but also mines deep features such as semantic features and temporal features hidden in the data payload, thereby improving the ability to identify unknown intrusion behaviors.

[0033] The noise filtering module 113 is used to remove noise data and false alarm data introduced during the preprocessing process. By calculating the confidence score of the data, it filters out data with a confidence score lower than a preset threshold, thereby reducing the false alarm rate of subsequent center detection. The confidence score is calculated based on multiple dimensions of parameters, including the reliability of the data source, feature matching degree, and abnormal deviation value.

[0034] The data encryption module 114 uses the AES-256 encryption algorithm to encrypt the pre-processed data, ensuring the security of the data during transmission to the central control module 120 and preventing the data from being stolen or tampered with.

[0035] The central control module 120, as the core control unit of the entire device, is deployed in the network center computer room and is used to perform deep detection, analysis, and decision-making on the data uploaded by the edge preprocessing module 110. The central control module 120 includes a deep learning detection module 121, a feature library management module 122, a node scheduling module 123, and a status monitoring module 124.

[0036] The deep learning detection module 121 employs a Transformer-based deep learning model, which possesses powerful feature learning and temporal analysis capabilities. This model can accurately analyze the deep features extracted by the edge preprocessing module 110, enabling efficient identification of known intrusions, unknown intrusions, and mutated intrusion behaviors. Furthermore, this module features adaptive model optimization, continuously adjusting model parameters based on actual detection results to improve detection accuracy and adaptability.

[0037] The feature library management module 122 manages the intrusion feature library, including a basic feature library and a dynamically updated feature library. The basic feature library stores standard features of known intrusion behaviors, while the dynamically updated feature library stores features of unknown intrusion behaviors and variant intrusion behaviors identified by the deep learning detection module 121. The feature library management module 122 has an automatic update function, periodically synchronizing the latest intrusion features from authoritative network security databases and adding newly identified features locally to the dynamically updated feature library. Simultaneously, it distributes new features to the basic intrusion feature libraries of each distributed detection node module 100, achieving collaborative updates of the feature library across the entire system.

[0038] The node scheduling module 123 is used to dynamically schedule each distributed detection node module 100. Based on parameters such as network traffic load and detection node status, it adjusts the detection strategy and resource allocation of each detection unit. When the load of a certain detection unit is too high, some detection tasks are diverted to adjacent idle detection units to ensure the detection efficiency and stability of the entire system.

[0039] The status monitoring module 124 is used to monitor the operating status of each distributed detection node module 100 and edge preprocessing module 110 in real time, including hardware status, network connection status, and detection task execution status. When a module failure or abnormality is detected, a fault alarm is issued in a timely manner, and a backup module is started to replace the faulty module to ensure the continuous operation of the system.

[0040] The feature database update module 130 works in conjunction with the feature database management module 122 of the central control module 120 to manage the entire lifecycle of the intrusion feature database, including feature collection, feature verification, feature updates, and feature distribution. The feature database update module 130 periodically crawls the latest intrusion features and vulnerability information published by authoritative cybersecurity platforms and vulnerability databases using web crawling technology. This information is combined with new features identified by the central control module 120 to form a candidate feature set. Subsequently, the feature verification unit verifies the validity of the features in the candidate feature set, eliminating invalid and duplicate features to ensure accuracy. Verified features are updated to the central feature database and distributed to each distributed detection node and edge preprocessing module 110 via an encrypted link, achieving real-time synchronous updates of the feature database. Simultaneously, the feature database update module 130 has a feature version management function, recording information such as feature update time, source, and applicable scenarios for easy feature backtracking and management.

[0041] The intrusion tracing module 140 is used to perform source analysis on detected intrusion behaviors, determine the intrusion source, attack path, attack methods, and impact, and provide a basis for security handling and attack prevention. The intrusion tracing module 140 includes a data packet tracing unit 141, an attack path reconstruction unit 142, an attack source location unit 143, and a tracing report generation unit 144.

[0042] The data packet tracing unit 141 calls the original data packets locally cached by the distributed detection node module 100, and combines the detection data of the edge preprocessing module 110 and the central control module 120 to perform full-link tracing of intrusion-related data packets, and extract the transmission trajectory, time sequence and correlation of the data packets.

[0043] The attack path reconstruction unit 142 uses a path mining algorithm based on the packet tracing results to reconstruct the complete attack path of the intrusion behavior, including the entry point of the attack source into the network, the network nodes it passes through, the attack target and intermediate attack steps, clearly presenting the propagation process of the intrusion behavior.

[0044] The attack source location unit 143 combines technologies such as IP address tracing, port analysis, and device fingerprinting to accurately locate the attack source. It can not only locate the IP address of the attack source but also identify information such as the device type, operating system version, and network environment used by the attack source, providing support for tracing the attacker. For attacks using spoofed IP addresses, it uses traffic correlation analysis and reverse tracing technology to crack the IP spoofing and find the real attack source.

[0045] The source tracing report generation unit 144 organizes the source tracing analysis results into a standardized source tracing report. The report includes basic information about the intrusion event, attack source information, attack path, attack methods, impact, and handling suggestions. It supports exporting to PDF, Word and other formats for easy viewing and archiving by administrators.

[0046] The early warning response module 150 is used to issue corresponding early warning information and execute emergency response operations based on the detection results of the central control module 120 and the analysis results of the intrusion tracing module 140. The early warning response module 150 includes an early warning classification unit 151, an early warning notification unit 152, and an emergency response unit 153.

[0047] The early warning classification unit 151 classifies the early warning level into four levels based on parameters such as the severity of the intrusion behavior, the attack range, and the spread speed: Level 1, Level 2, Level 3, and Level 4. Different levels correspond to different early warning signs and response strategies to ensure that managers can quickly grasp the urgency of the intrusion incident.

[0048] The early warning notification unit 152 issues early warning information through various means, including local audible and visual alarms, SMS notifications, email notifications, and WeChat / DingTalk push notifications. Simultaneously, it displays the early warning information in real-time on the central control platform's visual interface, ensuring that management personnel receive the warnings immediately. For level three and above warnings, it will automatically dial the preset emergency contact number for a voice reminder.

[0049] Emergency Response Unit 153 automatically executes corresponding emergency operations based on the warning level, including: Level 1 warning, issuing only a warning message without affecting normal network operation; Level 2 warning, restricting network access permissions for the attack source and isolating suspicious connections; Level 3 warning, cutting off the connection between the attack source and the target network and activating the enhanced network protection strategy mode; Level 4 warning, triggering the network emergency shutdown plan, shutting down the affected network area to prevent the intrusion from spreading. Simultaneously, Emergency Response Unit 153 supports manual intervention, allowing administrators to adjust the emergency response strategy according to the actual situation. A computer network security intrusion detection method includes the following steps: S1: Distributed Traffic Acquisition and Preliminary Detection: The traffic acquisition module 101 of each distributed detection node module 100 performs full traffic acquisition on the network traffic of the corresponding monitoring area. After filtering invalid data packets, the protocol parsing module 102 performs layered parsing on the data packets, extracts key network behavior information, and standardizes it. The preliminary detection module 103 performs preliminary detection on the standardized network behavior data through a dual mechanism of feature matching and lightweight anomaly detection, and divides the detection results into three categories: "normal", "suspected intrusion", and "confirmed intrusion". "Normal" data is only stored in the local cache module 104, while "suspected intrusion" and "confirmed intrusion" data and the corresponding original data packets are uploaded to the edge preprocessing module 110 and cached locally. S2: Edge Data Preprocessing: The data aggregation module 111 of the edge preprocessing module 110 classifies and aggregates the data uploaded by each distributed detection node according to preset dimensions to eliminate redundancy; the feature extraction module 112 uses a CNN-RNN fusion model to perform deep feature extraction on the aggregated data; the noise filtering module 113 calculates the data credibility score and filters out data with credibility below the threshold; the data encryption module 114 encrypts the preprocessed data with AES-256 and then transmits it to the central control module 120. S3: Central Deep Detection and Feature Library Update: The deep learning detection module 121 of the central control module 120 uses the Transformer model to decrypt the encrypted data, performs deep analysis on the extracted deep features, accurately identifies known intrusions, unknown intrusions, and mutated intrusion behaviors, and outputs the final detection results. The feature library management module 122 adds newly identified intrusion features to the dynamically updated feature library based on the detection results, and completes the collaborative update of the feature library across the entire system through the feature library update module 130. Simultaneously, the node scheduling module 123 dynamically adjusts the resource allocation and detection strategies of each detection node according to the system's operating status. S4: Intrusion Source Tracing Analysis: The packet tracing unit 141 of the intrusion source tracing module 140 calls the original data packets cached by each distributed detection node and the detection data of each module to perform full-link tracing of intrusion-related data packets; the attack path reconstruction unit 142 reconstructs the complete attack path based on the tracing results; the attack source location unit 143 locates the real attack source and related information through multi-technology fusion; the source tracing report generation unit 144 organizes and analyzes the results to generate a standardized source tracing report; S5: Early Warning and Emergency Response: The early warning grading unit 151 of the early warning response module 150 determines the early warning level based on the severity of the intrusion event; the early warning notification unit 152 sends early warning information to management personnel through multiple channels; the emergency response unit 153 automatically executes the corresponding emergency operation according to the early warning level, while also supporting manual intervention by management personnel to ensure that the intrusion behavior is controlled and dealt with in a timely manner. S6: System Status Monitoring and Maintenance: The status monitoring module 124 of the central control module 120 monitors the operating status of each module in real time. When a fault or abnormality is detected, a fault alarm is issued in a timely manner and the backup module is activated. Each module performs self-checks and maintenance regularly to ensure the stable operation of hardware devices and software systems. The local cache module 104 regularly cleans up expired data and releases storage space.

[0050] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0051] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A computer network security intrusion detection device, characterized in that, It includes a distributed detection node module (100), an edge preprocessing module (110), a central control module (120), a feature database update module (130), an intrusion tracing module (140), and an early warning response module (150). Each module interacts with data through an encrypted communication link. The distributed detection node module (100) includes multiple detection units. Each detection unit is equipped with a traffic acquisition module (101), a protocol parsing module (102), a preliminary detection module (103), and a local cache module (104). The traffic acquisition module (101) is used to collect network data in full traffic and filter invalid data packets. The protocol parsing module (102) is used to perform layered parsing on the collected data packets, extract key information, and standardize them. The preliminary detection module (103) adopts a dual mechanism of feature matching and lightweight anomaly detection to output three types of detection results: "normal", "suspected intrusion", and "confirmed intrusion". The local cache module (104) is used to cache the original data packets, parsing results, and detection results. The edge preprocessing module (110) includes a data aggregation module (111), a feature extraction module (112), a noise filtering module (113), and a data encryption module (114). The data aggregation module (111) is used to classify and aggregate the data uploaded by the distributed detection nodes. The feature extraction module (112) uses a CNN-RNN fusion model to extract deep features. The noise filtering module (113) filters noisy data based on the confidence score. The data encryption module (114) uses the AES-256 algorithm to encrypt the data. The central control module (120) is equipped with a deep learning detection module (121), a feature library management module (122), a node scheduling module (123), and a status monitoring module (124). The deep learning detection module (121) uses the Transformer model to perform deep detection and identify known, unknown, and mutated intrusion behaviors. The feature library management module (122) manages the basic feature library and dynamically updates the feature library. The node scheduling module (123) dynamically adjusts the resource allocation of detection nodes. The status monitoring module (124) monitors the operating status of each module. The feature library update module (130) is used to collect, verify, update and distribute intrusion features to achieve collaborative updates of the feature library across the entire system. The intrusion tracing module (140) includes a data packet tracing unit (141), an attack path restoration unit (142), an attack source location unit (143), and a tracing report generation unit (144), which are used to locate the attack source, restore the attack path, and generate a tracing report. The early warning response module (150) is equipped with an early warning classification unit (151), an early warning notification unit (152), and an emergency response unit (153) for graded early warning, multi-channel notification, and automatic emergency response.

2. The computer network security intrusion detection device according to claim 1, characterized in that: The traffic acquisition module (101) uses PF_RING technology to achieve high-speed data packet capture and supports acquisition at a rate of 10Gbps or higher. The local cache module (104) uses SSD storage medium.

3. The computer network security intrusion detection device according to claim 1, characterized in that: The lightweight anomaly detection mechanism of the preliminary detection module (103) adopts the improved K-means clustering algorithm, and the Transformer model of the deep learning detection module (121) is trained by the PyTorch framework.

4. The computer network security intrusion detection device according to claim 1, characterized in that: The attack source location unit (143) combines IP address tracking, port analysis, and device fingerprinting technology.

5. The computer network security intrusion detection device according to claim 1, characterized in that: The warning classification unit (151) divides the warning level into four levels, corresponding to different warning signs and response strategies. The emergency response unit (153) supports a combination of automatic operation and manual intervention.

6. A computer network security intrusion detection method, based on the apparatus according to any one of claims 1-5, characterized in that, Includes the following steps: S1: Distributed traffic collection and preliminary detection: Each detection unit collects network traffic, parses it, performs preliminary classification through a dual detection mechanism, and uploads suspected and confirmed intrusion data to the edge preprocessing module (110). S2: Edge data preprocessing: After aggregating, extracting deep features, filtering noise and encrypting the uploaded data, it is transmitted to the central control module (120). S3: Central Deep Detection and Feature Library Update: Through deep detection using the Transformer model, the feature library is updated and distributed to each module in a coordinated manner, and detection node resources are dynamically scheduled; S4: Intrusion Source Analysis: Track intrusion data packets, reconstruct attack paths, locate attack sources, and generate source analysis reports; S5: Early Warning and Emergency Response: Tiered early warning, multi-channel notification, and automatic execution of emergency operations based on the early warning level; S6: System Status Monitoring and Maintenance: Monitor the operating status of each module, perform regular self-checks and maintenance, and clean up expired cached data.

7. The computer network security intrusion detection method according to claim 6, characterized in that: In step S1, the preliminary detection module (103) stores "normal" data only in the local cache module (104), while "suspected intrusion" and "confirmed intrusion" data are uploaded along with the original data packets.

8. The computer network security intrusion detection method according to claim 6, characterized in that: In step S2, the noise filtering module (113) calculates the threshold based on the reliability of the data source, the feature matching degree, and the abnormal deviation value. The threshold is set to 0.3 by default.

9. The computer network security intrusion detection method according to claim 6, characterized in that: In step S3, the feature library update module (130) synchronizes the latest features from the authoritative CVE database every 2 hours, and adds new intrusion features identified locally.

10. The computer network security intrusion detection method according to claim 6, characterized in that: In step S5, a Level 3 or higher warning will automatically dial the emergency contact number, while a Level 4 warning will trigger the network emergency shutdown plan.

Images