A deep learning-based network intrusion detection method, system, device and medium

Abstract

The application relates to the technical field of network intrusion detection. A network intrusion detection method, system, device and medium based on deep learning are provided, wherein the method comprises the following steps: verifying and evaluating the effectiveness of a candidate defense rule through sandboxing rehearsal, and generating a rule safety index; when the rule safety index reaches a preset deployment threshold, deploying the candidate defense rule to an online defense system; collecting interception logs and associated traffic generated by the online defense system, and generating purified training samples through a multi-source feedback credible mechanism; performing anti-degradation incremental learning based on the purified training samples to obtain updated model parameters; deploying the detection model containing the updated model parameters as an updated detection system; continuously monitoring the health status of active rules in the updated detection system, and recycling rules according to the monitoring results, so that the technical effects of improving unknown threat identification accuracy, reducing defense rule deployment risk and maintaining model continuous evolution capability are achieved.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and in particular to a network intrusion detection method, system, device and medium based on deep learning. Background Technology

[0002] With the continuous upgrading of cyberattack methods, deep learning-based intrusion detection systems are playing an increasingly important defensive role in critical sectors such as finance, government affairs, and industrial control. Efficient intrusion detection technology needs to identify unknown threats in real time, dynamically update defense rules, and maintain the model's continuous evolution capability; its performance directly impacts the security protection level of critical infrastructure.

[0003] However, traditional technologies use a single detection channel for rule matching and static model inference of network traffic, which is difficult to deal with new and unknown attack variants and has significant threat identification blind spots. Directly deploying candidate defense rules online for verification without building a pre-play isolation mechanism can easily lead to false interception and rule conflicts in the defense system. Training models directly based on raw interception logs and using traditional incremental learning algorithms is susceptible to adversarial noise samples, which can cause catastrophic degradation of the model, and there is a lack of corresponding anti-interference mechanisms. Summary of the Invention

[0004] Therefore, it is necessary to provide a network intrusion detection method, system, device, and medium based on deep learning to address the above-mentioned technical problems, so as to improve the accuracy of unknown threat identification, reduce the risk of defense rule deployment, and maintain the model's continuous evolution capability.

[0005] Firstly, this application provides a deep learning-based network intrusion detection method, which includes:

[0006] A multi-channel parallel detection mechanism is used to analyze real-time network traffic and generate preliminary detection data including threat determination results and confidence scores. Based on the unidentified threats in the preliminary detection data, dynamic defense rules are generated to obtain candidate defense rules.

[0007] The effectiveness of candidate defense rules is evaluated through sandbox-based pre-testing, and a rule security index is generated. When the rule security index reaches a preset deployment threshold, the candidate defense rules are deployed to the online defense system.

[0008] The system collects interception logs and related traffic generated by the online defense system, and generates purified training samples through a multi-source feedback trust mechanism. Based on the purified training samples, it performs anti-degradation incremental learning to obtain updated model parameters.

[0009] Deploy the detection model containing the updated model parameters as the updated detection system; continuously monitor the health status of active rules in the updated detection system, and reclaim rules based on the monitoring results.

[0010] In one embodiment, the effectiveness of candidate defense rules is evaluated through sandboxed pre-testing to generate a rule security index, including:

[0011] The protocol characteristics and behavioral constraints of candidate defense rules are analyzed to generate rule scope definitions;

[0012] Based on the rule scope definition, retrieve the historical adversarial sample library and filter the set of related attack patterns;

[0013] Inject a set of associated attack patterns into an isolated sandbox environment, conduct multiple rounds of rule stress testing, monitor the rule triggering status and attack escape events during the testing process, and generate a set of security performance indicators.

[0014] The rule-based security index is calculated by integrating interception rate, false alarm rate, and escape rate from a set of security performance indicators.

[0015] In one embodiment, a set of associated attack patterns is injected into an isolated sandbox environment, and multiple rounds of rule-based stress testing are conducted. The rule triggering status and attack escape events during the testing process are monitored to generate a set of security performance indicators, including:

[0016] Dynamically recombine the associated attack pattern set to obtain a variant attack sequence set;

[0017] Variant attack sequence sets are injected into an isolated sandbox environment to simulate real network fluctuations. The rule trigger timestamps and attack payload escape states during the execution of each attack sequence are monitored to obtain the original monitoring event stream.

[0018] Analyze the rule response patterns in the original monitoring event stream, and calculate the rule coverage and response latency metrics;

[0019] Detect escape feature patterns in the original monitoring event stream and generate an escape event classification set;

[0020] The threat level distribution of the escape event classification set is quantified, and the escape risk coefficient is calculated.

[0021] By integrating rule coverage, response latency metrics, and escape risk coefficients, a set of security performance metrics is generated.

[0022] In one embodiment, the health status of active rules is continuously monitored in the post-update detection system, and rule recycling is performed based on the monitoring results, including:

[0023] Multi-dimensional metrics are collected from active rules to generate a real-time operational metric set, which includes false alarm rate, trigger frequency, and intelligence matching degree.

[0024] A health status prediction vector is obtained by performing trend correlation analysis based on the real-time operational indicator set.

[0025] The health status prediction vector is compared with the dynamically adjusted health threshold to generate rule-based health assessment results.

[0026] When the rule health assessment results meet the preset recycling conditions, the rule recycling operation is triggered.

[0027] In one embodiment, degradation-resistant incremental learning is performed based on the purified training samples to obtain updated model parameters, including:

[0028] Dynamic adversarial perturbations are applied to the purified training samples to generate a perturbation-enhanced sample set.

[0029] Load the parameters of the historical stable version model, and build a knowledge distillation constraint framework based on the parameters;

[0030] Under the knowledge distillation constraint framework, the feature encoding of the current model for the perturbation-enhanced sample set is optimized to obtain consistent optimization parameters;

[0031] Regularization constraint parameters are generated by optimizing the update direction of parameters in a way that opposes the robust regularization term constraint.

[0032] Iteratively adjust the regularization constraint parameters until convergence, and output the updated model parameters.

[0033] In one embodiment, under the knowledge distillation constraint framework, the feature encoding of the current model for the perturbation-enhanced sample set is optimized to obtain consistent optimization parameters, including:

[0034] Input the perturbation-enhanced sample set into the historical stable version model, extract the multi-layer intermediate feature representation of the perturbation-enhanced sample set, and obtain the baseline feature tensor;

[0035] Calculate the multi-scale feature differences between the current model and the baseline feature tensor, and generate a feature consistency loss map;

[0036] Channel dimension importance analysis was performed on the feature consistency loss map to obtain the channel importance weight distribution;

[0037] Based on the differences in the weighted fusion features of the channel importance weight distribution, a channel-weighted loss is generated;

[0038] Construct topological constraints for the feature space manifold and generate a topological continuity loss;

[0039] By fusing the channel-weighted loss and the topological continuity loss, a joint optimization objective is obtained;

[0040] Gradient backpropagation updates are performed based on the joint optimization objective to generate consistent optimization parameters.

[0041] Secondly, this application also provides a deep learning-based network intrusion detection system, which includes:

[0042] The multi-channel detection module is used to analyze real-time network traffic using a multi-channel parallel detection mechanism, and generate preliminary detection data including threat determination results and confidence scores; based on the unidentified threats in the preliminary detection data, dynamic defense rules are generated to obtain candidate defense rules;

[0043] The rule verification module is used to evaluate the effectiveness of candidate defense rules through sandboxed pre-testing and generate a rule security index. When the rule security index reaches a preset deployment threshold, the candidate defense rules are deployed to the online defense system.

[0044] The feedback learning module is used to collect interception logs and related traffic generated by the online defense system, and generate purified training samples through a multi-source feedback trust mechanism; based on the purified training samples, anti-degradation incremental learning is performed to obtain updated model parameters.

[0045] The rule management module is used to deploy the detection model containing the updated model parameters as the updated detection system; continuously monitor the health status of active rules in the updated detection system, and reclaim rules based on the monitoring results.

[0046] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the methods in the first aspect of this application.

[0047] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the steps of any of the methods in the first aspect of this application.

[0048] This application provides a deep learning-based network intrusion detection method, system, device, and medium. The method employs a multi-channel parallel detection mechanism to analyze real-time network traffic, generating preliminary detection data containing threat assessment results and confidence scores. It then dynamically constructs candidate defense rules for unidentified potential threats, which helps broaden the coverage dimensions of threat identification and thus steadily improves the accuracy of identifying unknown threats. A sandboxed pre-launch verification system is used to systematically evaluate the effectiveness of candidate defense rules. A rule security index is constructed as the core deployment basis. The online deployment process is initiated only when this index meets a preset threshold, effectively avoiding potential risks such as false blocking and rule conflicts that may arise from directly deploying rules online, and significantly reducing operational risks during the defense rule deployment phase.

[0049] Interception logs and associated traffic data generated during the operation of the online defense system are collected. The raw data is then filtered, purified, and verified using a multi-source feedback reliability mechanism to obtain highly reliable purified training samples. Based on these samples, anti-degradation incremental learning is performed, continuously iteratively optimizing model parameters and deploying them as an updated detection system. Simultaneously, a routine monitoring mechanism for the health status of active rules is established, and a rule retrieval process is dynamically executed based on the monitoring results. This closed-loop design provides solid support for the continuous iteration of model performance, effectively ensuring the model's continuous evolution capability. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart of a deep learning-based network intrusion detection method according to one embodiment of the present invention;

[0052] Figure 2 This is a flowchart illustrating how to continuously monitor the health status of active rules in a post-update detection system and recycle rules based on the monitoring results, according to one embodiment of the present invention.

[0053] Figure 3 This is a structural diagram of a deep learning-based network intrusion detection system according to one embodiment of the present invention. Detailed Implementation

[0054] To make the above-mentioned objects, features, and advantages of this application more apparent and understandable, the specific embodiments of this application will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0055] First, the application scenarios of the embodiments of this application are described. In the embodiments of this application, a deep learning-based network intrusion detection method, system, device, and medium are provided, applicable to scenarios such as network security protection in the financial sector, intrusion monitoring of government networks, network defense of industrial control systems, security management of enterprise intranets, and traffic security detection in cloud computing centers.

[0056] In illustrative purposes, the deep learning-based network intrusion detection method, system, device, and medium provided in this application embodiment can also be applied to other critical information infrastructure network security protection, IoT terminal network intrusion monitoring, operator backbone network traffic security management, education and scientific research network security defense, and other application scenarios. This is only an example and does not limit the specific application scenarios.

[0057] like Figure 1 As shown, this application provides a network intrusion detection method based on deep learning, the method comprising:

[0058] S101: Employs a multi-channel parallel detection mechanism to analyze real-time network traffic and generate primary detection data including threat assessment results and confidence scores; generates dynamic defense rules based on unidentified threats in the primary detection data, thus obtaining candidate defense rules.

[0059] For example, the network intrusion detection terminal captures raw network traffic data in the network environment in real time. Relying on a preset multi-channel parallel detection architecture, it performs multi-dimensional feature analysis and threat identification on this data, while defining a unique detection dimension for each detection channel. Each detection channel sequentially performs feature extraction, pattern matching, and preliminary threat determination operations based on the protocol structure characteristics, data transmission timing characteristics, and payload content characteristics of the network traffic.

[0060] During the process of completing the detection in each dimension, the network intrusion detection terminal will simultaneously calculate the threat confidence component corresponding to each detection channel, providing a quantifiable reference for the subsequent fusion of multi-dimensional detection results.

[0061] To achieve effective aggregation of multi-channel detection results, the network intrusion detection terminal integrates all threat confidence components using a weighted fusion algorithm to obtain the final confidence score corresponding to the original network traffic. The specific calculation formula is as follows:

[0062]

[0063] In the formula, This represents the final confidence score corresponding to the original network traffic. This represents the total number of detection channels in a multi-channel parallel detection architecture. Indicates the first The weighting coefficients for each detection channel are pre-configured based on the security importance level of the corresponding detection dimension and historical detection accuracy. Indicates the first The threat confidence component output by each detection channel has a value range of [0,1]. The value is positively correlated with the confidence level of the detection channel in determining that the corresponding network traffic is a threat.

[0064] The network intrusion detection terminal integrates the preliminary threat assessment results output from each detection channel with the final confidence score calculated using a formula, thereby generating primary detection data that includes both the threat assessment results and the confidence score. This terminal then comprehensively filters the primary detection data, identifying network traffic with an unidentified status and defining this traffic as an unidentified threat.

[0065] For identified unidentified threats, the network intrusion detection terminal extracts corresponding protocol feature parameters, behavioral pattern features, and traffic statistics features, and then transforms these features into standardized rule descriptor factors. The terminal uses a preset rule generation algorithm to logically associate and combine these rule descriptor factors, thereby constructing dynamic defense rules and obtaining candidate defense rules.

[0066] S102: Verify the effectiveness of candidate defense rules through sandbox pre-testing and generate a rule security index; when the rule security index reaches the preset deployment threshold, deploy the candidate defense rules to the online defense system.

[0067] For example, the network intrusion detection terminal performs structured parsing on candidate defense rules, extracts the protocol feature parameters, behavioral constraints and trigger logic thresholds of the candidate defense rules, clarifies the scope of action and execution boundaries of the candidate defense rules, creates an isolated sandbox environment that simulates a real network operation scenario, and retrieves a set of matching attack patterns from a historical adversarial sample library and injects them into the isolated sandbox environment.

[0068] The execution status of candidate defense rules is continuously monitored in the isolated sandbox environment. The number of times the candidate defense rules are triggered, the number of times they are effectively intercepted, the number of times they are falsely triggered, and the number of times they escape from attack modes are recorded. Based on this, three core performance indicators, namely interception rate, false alarm rate, and escape rate, are calculated, providing quantitative data support for the calculation of the rule security index.

[0069] The network intrusion detection terminal calculates the rule security index using a weighted comprehensive algorithm. The specific calculation formula is as follows:

[0070]

[0071] In the formula, This represents the rule security index of the candidate defense rule. This represents the interception rate weighting coefficient. This represents the false alarm rate weighting coefficient. This represents the escape rate weighting coefficients. All three are non-negative coefficients pre-configured according to network security protection requirements and satisfy the following conditions: , This indicates the interception rate of the candidate defense rule. This represents the false positive rate of the candidate defense rule. This represents the escape rate of the candidate defense rule.

[0072] The network intrusion detection terminal retrieves preset deployment thresholds based on the security protection level of different application scenarios, compares the rule security index with the preset deployment threshold, and determines that the candidate defense rule meets the online deployment conditions when the rule security index reaches the preset deployment threshold, and then deploys the candidate defense rule to the online defense system.

[0073] S103: Collect interception logs and related traffic generated by the online defense system, and generate purified training samples through a multi-source feedback reliable mechanism; perform anti-degradation incremental learning based on the purified training samples to obtain updated model parameters.

[0074] For example, the network intrusion detection terminal collects interception logs generated during the operation of the online defense system, as well as the associated traffic data corresponding to the interception logs, to construct a raw multi-source data set containing the interception logs and associated traffic. The terminal relies on a multi-source feedback trust mechanism to perform layered processing on the raw multi-source data set, sequentially completing data deduplication, abnormal data removal, interference and noise filtering, and data trustworthiness verification. After filtering out invalid data, the valid data undergoes format unification and labeling standardization calibration to generate purified training samples.

[0075] To address the performance iteration requirements of network intrusion detection models, the network intrusion detection terminal performs anti-degradation incremental learning based on cleaned training samples. While retaining the original model's feature extraction capabilities, it optimizes model parameters by incorporating the data distribution characteristics of the cleaned training samples. The update gradient of the model parameters is calculated using an incremental loss function, with the specific calculation formula as follows:

[0076]

[0077] In the formula, This indicates the incremental update of model parameters. This represents the learning rate coefficient. Indicates the gradient operation identifier. Represents the incremental loss function. This represents the model parameters before the update. This represents the purified training samples.

[0078] The network intrusion detection terminal updates the incremental model parameters based on the calculated model parameters, iteratively corrects and adapts the model parameters before the update, and obtains the updated model parameters after the entire anti-degradation incremental learning process is completed.

[0079] S104: Deploy the detection model containing the updated model parameters as the updated detection system; continuously monitor the health status of active rules in the updated detection system, and reclaim rules based on the monitoring results.

[0080] For example, the network intrusion detection terminal integrates the updated model parameters into the original detection model architecture, completing the adaptation and fusion of the updated model parameters and the detection model structure. Then, it performs runtime environment compatibility testing, functional integrity verification, and performance benchmark testing on the integrated detection model to ensure that the detection model meets the operational requirements of the actual application scenario. The detection model that passes all testing stages is then deployed as the updated detection system.

[0081] During the official operation of the updated detection system, the network intrusion detection terminal activates an active rule health status monitoring mechanism. This mechanism collects real-time data on the interception effectiveness, false alarm rate, and system resource utilization of each active rule. A weighted comprehensive algorithm is then used to calculate the health status score of each active rule. The specific calculation formula is as follows:

[0082]

[0083] in, This represents the health status score of the active rule, with a value range of [0,1]. The larger the value, the better the running status of the active rule. The weighting coefficients represent the interception effectiveness metrics. This represents the weighting coefficient of the false alarm rate indicator. The weighting coefficients representing system resource utilization are all non-negative coefficients pre-configured according to network security operation requirements, and satisfy the following conditions: =1; This is an indicator of the effectiveness of active rule blocking, specifically the ratio of effective blocking counts to the total number of triggers. The false alarm rate metric for active rules is the ratio of the number of false triggers to the total number of triggers. The system resource utilization rate indicator for active rules is the ratio of the system resources used by the rule to the total available system resources.

[0084] The network intrusion detection terminal retrieves a preset health threshold, which is a critical health status score pre-set according to the updated detection system's operating standards. It then compares the health status score of each active rule with this preset health threshold. When the health status score of an active rule falls below the preset health threshold, the network intrusion detection terminal determines that the active rule is an inefficient or invalid operating rule and immediately performs a rule revoke operation, removing the active rule from the updated detection system, thus completing the corresponding active rule revoke process.

[0085] One embodiment of this application provides a deep learning-based network intrusion detection method. It employs a multi-channel parallel detection mechanism to analyze real-time network traffic, generating preliminary detection data containing threat assessment results and confidence scores. Candidate defense rules are dynamically constructed for unidentified potential threats. This design helps broaden the coverage dimensions of threat identification, thereby steadily improving the accuracy of identifying unknown threats. The effectiveness of candidate defense rules is systematically evaluated through a sandboxed pre-launch verification system. A rule security index is constructed as the core deployment basis. The online deployment process is initiated only when this index meets a preset threshold, effectively avoiding potential risks such as false blocking and rule conflicts that may arise from directly deploying rules online, significantly reducing operational risks during the defense rule deployment phase.

[0086] Interception logs and associated traffic data generated during the operation of the online defense system are collected. The raw data is then filtered, purified, and verified using a multi-source feedback reliability mechanism to obtain highly reliable purified training samples. Based on these samples, anti-degradation incremental learning is performed, continuously iteratively optimizing model parameters and deploying them as an updated detection system. Simultaneously, a routine monitoring mechanism for the health status of active rules is established, and a rule retrieval process is dynamically executed based on the monitoring results. This closed-loop design provides solid support for the continuous iteration of model performance, effectively ensuring the model's continuous evolution capability.

[0087] In one embodiment, the effectiveness of candidate defense rules is evaluated through sandboxed pre-testing to generate a rule security index, including:

[0088] (1) Analyze the protocol characteristics and behavioral constraints of the candidate defense rules and generate the rule scope definition.

[0089] For example, the network intrusion detection terminal performs deep structured analysis on candidate defense rules, extracts the protocol type features, protocol field features, and data transmission direction features contained in the candidate defense rules, and decomposes the trigger condition thresholds, data content matching rules, and time window constraints set by the candidate defense rules. Based on the extracted protocol features and decomposed behavioral constraints, it clarifies the network traffic type, attack behavior scope, and effective scenario boundary targeted by the candidate defense rules, and generates a rule scope definition that includes scenario adaptation range, attack type coverage dimension, and traffic feature matching standard.

[0090] To establish the basis for matching the quantification rule scope definition with the attack pattern, a model for calculating the fit between the rule scope feature vector and the attack pattern feature vector is introduced, with the specific formula as follows:

[0091]

[0092] in, This indicates the feature fit between the rule scope definition and the attack pattern. The value range is [0,1], and the larger the value, the higher the degree of matching between the two. The feature vector representing the scope of a rule consists of the quantized values ​​of protocol type features, protocol field features, data transmission direction features, and behavioral constraints. This represents the attack pattern feature vector, which consists of the quantified values ​​of the network traffic characteristics and behavioral characteristics corresponding to the attack pattern.

[0093] The protocol features include protocol type features, protocol field features, and data transmission direction features; the behavioral constraints include trigger condition thresholds, data content matching rules, and time window constraints; and the rule scope definition includes scenario adaptation range, attack type coverage dimension, and traffic feature matching standard.

[0094] (2) Based on the definition of rule scope, retrieve the historical adversarial sample library and filter the set of related attack patterns.

[0095] For example, the network intrusion detection terminal calls the historical adversarial sample library, uses the scenario adaptation range, attack type coverage dimension, and traffic feature matching standard in the rule scope definition as search keywords, traverses the attack pattern metadata stored in the historical adversarial sample library, compares the degree of fit between the attack pattern metadata and the rule scope definition, filters out attack patterns whose attack scenarios, attack types, and traffic features are highly matched with the rule scope definition, and integrates the above-filtered attack patterns to obtain a set of associated attack patterns.

[0096] Based on the above feature fit calculation results, a fit threshold is set to filter the associated attack patterns. The specific filtering formula is as follows:

[0097]

[0098] in, This represents the set of related attack patterns obtained through filtering; This represents a single attack pattern in the historical adversarial sample library; This represents the degree of fit between a single attack pattern and the features defined in the rule's scope, calculated using the formula for the degree of fit of preceding features. This indicates the definition of the rule scope, used to clarify the matching criteria for the fit calculation; This represents the preset feature matching threshold, which is pre-configured according to the retrieval accuracy requirements and has a value range of [0,1].

[0099] (3) Inject a set of associated attack patterns into an isolated sandbox environment, conduct multiple rounds of rule stress testing, monitor the rule triggering status and attack escape events during the testing process, and generate a set of security performance indicators.

[0100] For example, the network intrusion detection terminal creates an isolated sandbox environment with an architecture consistent with the real network environment. This environment replicates the protocol interaction mechanism, device communication links, resource configuration specifications, and traffic transmission characteristics of the real network. The associated attack pattern set is injected into the isolated sandbox environment according to a preset test sequence, and multiple rounds of rule stress testing are initiated. In each round of testing, attack behaviors with different intensities and triggering sequences are continuously simulated. The triggering time, triggering frequency, and triggering condition fulfillment of candidate defense rules in each round of testing are monitored in real time. At the same time, the trajectory of attack behaviors that are not intercepted by candidate defense rules and the successful penetration path of attacks are tracked. The rule triggering data and attack escape data of each round of testing are recorded. Based on the cumulative data of multiple rounds of testing, basic data such as the number of effective interceptions, the number of false triggers, and the number of attack escapes are calculated. The basic data are integrated to obtain a set of security performance indicators including interception rate, false alarm rate, and escape rate.

[0101] The isolated sandbox environment includes replicated protocol interaction mechanisms, device communication links, resource configuration specifications, and traffic transmission characteristics; multi-round rule stress testing includes simulations of attack behaviors of different intensities and attack behaviors of different triggering sequences; rule triggering status includes triggering time points, triggering frequency, and triggering condition fulfillment; attack escape events include uninterrupted attack behavior trajectories and successful attack penetration paths; and the security performance indicator set includes interception rate, false alarm rate, and escape rate.

[0102] (4) Calculate the rule-based security index by integrating the interception rate, false alarm rate and escape rate of the integrated security performance indicators.

[0103] For example, the network intrusion detection terminal uses a weighted balancing algorithm to perform a fusion calculation on the interception rate, false alarm rate and escape rate in the set of security performance indicators, so as to quantify the comprehensive effectiveness of candidate defense rules.

[0104] Among them, the weighted balancing algorithm achieves a comprehensive quantitative evaluation of the interception effect, false alarm control, and anti-escape capability of candidate defense rules by assigning weight coefficients to different security performance indicators.

[0105] In one embodiment, a set of associated attack patterns is injected into an isolated sandbox environment, and multiple rounds of rule-based stress testing are conducted. The rule triggering status and attack escape events during the testing process are monitored to generate a set of security performance indicators, including:

[0106] (1) Dynamically reassemble the associated attack pattern set to obtain a variant attack sequence set.

[0107] For example, the network intrusion detection terminal obtains a set of associated attack patterns, extracts the triggering conditions, execution flow, payload characteristics and dependencies of each attack pattern in the set of associated attack patterns, and dynamically reassembles the attack patterns based on the logical correlation of attack behavior and the randomness of execution order. By adjusting the execution order of the attack patterns, adding or removing attack links, mutating payload parameters and combining the core modules of different attack patterns, a set of variant attack sequences containing multiple attack scenario adaptation forms is generated.

[0108] The associated attack pattern set contains multiple attack patterns with independent attack logic; the variant attack sequence set contains attack sequences with different execution forms after adjustment, and each attack sequence retains the core threat attributes of the original attack pattern.

[0109] (2) Inject variant attack sequence sets into the isolated sandbox environment to simulate the real network fluctuation environment, monitor the rule trigger timestamp and attack payload escape status during the execution of each attack sequence, and obtain the original monitoring event stream.

[0110] For example, the network intrusion detection terminal enables the network environment simulation unit in the isolated sandbox environment to simulate network fluctuation characteristics such as bandwidth fluctuation, transmission delay, packet loss, and protocol interference in the real network environment, and builds a dynamic operating environment that closely resembles the actual application scenario. Then, the variant attack sequence set is injected into the isolated sandbox environment one by one to generate attack traffic according to the preset injection strategy.

[0111] The network intrusion detection terminal monitors the complete execution process of each variant attack sequence in real time, records the trigger timestamp of the candidate defense rule for each attack sequence (i.e. the time when the rule meets the trigger condition and starts the interception operation), and determines whether the attack payload of each attack sequence successfully bypasses the interception mechanism of the candidate defense rule, and clarifies the escape status of the attack payload (i.e., successfully escaped or not escaped). All monitoring data are integrated in chronological order to form the original monitoring event stream.

[0112] Among them, network fluctuation characteristics include bandwidth fluctuations, transmission delays, packet loss, and protocol interference; attack payload escape status includes successful escape and failure to escape; the raw monitoring event stream contains rule trigger timestamp data and attack payload escape status data ordered by time.

[0113] (3) Analyze the rule response patterns in the original monitoring event stream and calculate the rule coverage and response delay indicators.

[0114] For example, the network intrusion detection terminal performs time-series analysis on the original monitoring event stream to extract response pattern features of candidate defense rules, including trigger frequency, trigger interval, and the time-series correspondence between trigger and attack sequences. Based on these response pattern features, rule coverage and response latency metrics are calculated using the following formulas:

[0115]

[0116] In the formula, This represents the rule coverage rate, with a value range of [0,1]. The larger the value, the wider the coverage of the candidate defense rule for variant attack sequences. This indicates the number of variant attack sequences in the original monitoring event stream that were intercepted by candidate defense rules; This represents the total number of sequences in the variant attack sequence set injected into the isolated sandbox environment.

[0117]

[0118] In the formula, This represents the response latency metric; the smaller the value, the faster the response speed of the candidate defense rule. Indicates the first The rule trigger timestamp corresponding to each variant attack sequence that was triggered and intercepted; Indicates the first The variant attack sequence begins execution and triggers the start timestamp for generating attack traffic; This represents the total number of variant attack sequences that were intercepted by candidate defense rules in the original monitoring event.

[0119] Among them, the rule response mode features include trigger frequency, trigger interval, and the temporal correspondence between trigger and attack sequence; rule coverage reflects the ability of candidate defense rules to cover variant attack sequences; and response latency index reflects the interception response speed of candidate defense rules.

[0120] (4) Detect escape feature patterns in the original monitoring event stream and generate an escape event classification set.

[0121] For example, the network intrusion detection terminal filters out event data from the original monitoring event stream where the attack payload escape status is successful. It extracts the attack path features, payload variation features, evasion strategy features, and trigger rule failure features corresponding to the escape events, constructs an escape feature pattern library, matches each escape event with the feature patterns in the escape feature pattern library, and classifies the escape events according to escape path type, evasion strategy type, and threat carrier type based on the matching results. The classified escape events are then integrated to obtain an escape event classification set.

[0122] Among them, the escape feature patterns include attack path features, payload variation features, evasion strategy features, and trigger rule failure features; the escape event classification set includes groups of successful escape events classified according to different dimensions.

[0123] (5) Quantify the threat level distribution of the escape event classification set and calculate the escape risk coefficient.

[0124] For example, the network intrusion detection terminal predefines threat level classification criteria, classifies each escape event category in the escape event classification set as high threat, medium threat, or low threat level according to the threat level classification criteria, and calculates the proportion of escape events corresponding to each threat level to the total number of events in the escape event classification set, thus obtaining the threat level distribution proportion. Based on the threat level distribution proportion and the preset weight coefficients for each threat level, the escape risk coefficient is calculated.

[0125] Among them, the threat level classification standard is used to define the severity of the threat of escape incidents; the proportion of threat level distribution includes the proportion of high threat level, medium threat level, and low threat level; the escape risk coefficient comprehensively reflects the overall threat level of escape incidents.

[0126] (6) Integrate rule coverage, response delay index and escape risk coefficient to generate a set of security performance indicators.

[0127] For example, the network intrusion detection terminal uses a weighted fusion algorithm to integrate rule coverage, response latency, and escape risk coefficients to generate a set of security performance indicators. The specific calculation formula is as follows:

[0128]

[0129] In the formula, This represents a comprehensive security performance index, with a value range of [0,1], used to quantify the overall security performance of candidate defense rules; The weighting coefficients representing rule coverage. The weighting coefficients for the response latency metric are... The weighting coefficients representing the escape risk coefficients are all non-negative coefficients pre-configured according to the focus of the safety performance assessment, and satisfy the following conditions: ; Indicates rule coverage; This indicates the response latency metric; This represents the preset maximum acceptable response latency threshold, used for normalizing the response latency metric. This indicates the escape risk coefficient.

[0130] The network intrusion detection terminal integrates rule coverage, response latency, escape risk coefficient, and comprehensive security performance indicators to generate a set of security performance indicators that includes the above core indicators.

[0131] The security performance index set includes rule coverage, response latency index, escape risk coefficient, and comprehensive security performance index, which comprehensively reflects the security operation performance of candidate defense rules in multi-dimensional scenarios.

[0132] like Figure 2As shown, the health status of active rules is continuously monitored in the post-update detection system, and rules are reclaimed based on the monitoring results, including:

[0133] S201: Collect multi-dimensional indicators for active rules and generate a real-time operational indicator set, which includes false alarm rate, trigger frequency, and intelligence matching degree.

[0134] For example, the network intrusion detection terminal continuously collects multi-dimensional metrics for all active rules within the updated detection system. Regarding the false alarm rate metric, the network intrusion detection terminal calculates the real-time false alarm rate by comparing the number of false triggers by non-attack traffic and the total number of triggers for active rules within a preset time window. Regarding the trigger frequency metric, it performs standardized calibration by combining the number of triggers per unit time with the preset time window to obtain the standard trigger frequency.

[0135] For the intelligence matching degree indicator, the network intrusion detection terminal retrieves the latest attack characteristics, threat behaviors and risk identification data from the network security intelligence database, compares the interception characteristics, trigger conditions and database contents of active rules dimension by dimension, quantifies the intelligence matching degree, integrates the three types of indicators in a fixed dimension order, and generates a real-time running indicator set.

[0136] The real-time operational indicator set includes real-time false alarm rate, standard trigger frequency, and intelligence matching degree; the preset time window is a fixed time period for collecting multi-dimensional indicators; the network security intelligence database stores the latest attack feature data, threat behavior descriptions, and risk identification information; and the unit time is the time benchmark for standardized calculation of trigger frequency.

[0137] S202: Based on the real-time operating indicator set, perform trend correlation analysis to obtain the health status prediction vector.

[0138] For example, the network intrusion detection terminal performs time series analysis on various indicators in the real-time operation indicator set across multiple time windows, extracts the changing trend characteristics of each indicator through a trend fitting algorithm, and clarifies the correlation between real-time false alarm rate and standard trigger frequency, intelligence matching degree and standard trigger frequency, and real-time false alarm rate and intelligence matching degree through Pearson correlation coefficient.

[0139] Based on trend characteristics and correlation analysis results, the network intrusion detection terminal uses the exponential smoothing method to predict the future values ​​of real-time false alarm rate, standard trigger frequency and intelligence matching degree. The three types of predicted values ​​are combined according to the indicator dimensions to construct a health status prediction vector.

[0140] Among them, the trend characteristics include upward trend, downward trend, stable trend, and fluctuating trend; the Pearson correlation coefficient is used to quantify the correlation strength and direction between different indicators; the health status prediction vector is a multi-dimensional vector containing the predicted value of false alarm rate, the predicted value of standard trigger frequency, and the predicted value of intelligence matching degree.

[0141] S203: Compare the health status prediction vector with the dynamically adjusted health threshold to generate rule-based health assessment results.

[0142] For example, the network intrusion detection terminal combines the real-time operational load data of the updated detection system, the current network security threat level assessment results, and historical rule health operation statistics to adjust the threshold values ​​of each indicator through a dynamic threshold algorithm. The network intrusion detection terminal performs parameter calibration based on the principles of "lower threshold value for higher threat levels" for false alarm rate, "wider threshold value for higher system load" for standard trigger frequency, and "adaptation of intelligence update frequency to threat intensity" for intelligence matching degree, generating a dynamic health threshold vector containing three-dimensional threshold values.

[0143] The network intrusion detection terminal calculates the deviation of each dimension of the health status prediction vector from the corresponding dimension of the dynamic health threshold vector, and obtains a comprehensive deviation coefficient by weighted summation. Combining the deviation coefficient value and the dimension comparison results, a rule-based health assessment result containing three categories of conclusions: qualified, pending observation, and needing to be recovered is generated.

[0144] The dynamic health threshold vector includes a false alarm rate threshold, a standard trigger frequency threshold, and an intelligence matching degree threshold. The dynamic threshold algorithm dynamically adjusts the threshold values ​​according to the system's operating status and security requirements. The comprehensive deviation coefficient reflects the overall deviation between the prediction vector and the threshold vector.

[0145] S204: When the rule health assessment result meets the preset recycling conditions, the rule recycling operation is triggered.

[0146] For example, the network intrusion detection terminal pre-sets multiple quantitative rule reclamation conditions, and matches and verifies the rule health assessment results of active rules with each reclamation condition to confirm whether the triggering criteria are met.

[0147] If the rule health assessment result of an active rule meets any one of the rule recycling conditions, the network intrusion detection terminal immediately triggers a rule recycling operation: marking the active rule as pending recycling and suspending its execution permission in the updated detection system, removing the corresponding configuration parameters and feature data from the rule runtime library of the updated detection system, and recording the identification information, recycling time, recycling reason and assessment result of the active rule, and updating the rule recycling log.

[0148] Among them, the preset deviation threshold is the critical value for determining whether the comprehensive deviation exceeds the standard; the rule recycling condition is the criterion for triggering the rule recycling operation; the rule recycling operation includes marking the state to be recycled, suspending execution permissions, removing configuration data, and recording recycling information; the rule runtime library stores the configuration parameters and feature data of all active rules in the detection system after the update; the rule recycling log records the relevant detailed information of all recycled rules.

[0149] In one embodiment, degradation-resistant incremental learning is performed based on the purified training samples to obtain updated model parameters, including:

[0150] (1) Apply dynamic adversarial perturbation to the purified training samples to generate a perturbation-enhanced sample set.

[0151] For example, the network intrusion detection terminal performs feature distribution analysis on the cleaned training samples to identify the key feature dimensions, feature value ranges, and data distribution density of the samples. Based on the analysis results, it determines the type of dynamic adversarial perturbation. The network intrusion detection terminal dynamically adjusts the intensity of each perturbation according to the sensitivity of the sample features, ensuring that the perturbation does not destroy the core label information of the samples while simulating data variation in real-world scenarios. The adjusted dynamic adversarial perturbations are then substituted into the cleaned training samples one by one to generate a perturbation-enhanced sample set.

[0152] The dynamic adversarial perturbations include Gaussian noise perturbation, feature shift perturbation, and gradient ascent adversarial perturbation; the purified training samples are high-reliability training data processed by a multi-source feedback reliability mechanism; the perturbation enhancement sample set includes the original samples and the mutated samples after applying dynamic adversarial perturbations, which are used to improve the model's anti-interference ability.

[0153] (2) Load the parameters of the historical stable version model and construct a knowledge distillation constraint framework based on the parameters.

[0154] For example, the network intrusion detection terminal retrieves all parameters of a historical stable version model from the model version management library, including feature extraction layer parameters, fully connected layer weights, activation function parameters, and output layer biases. The network intrusion detection terminal sets the historical stable version model as the teacher model in the knowledge distillation constraint framework and sets the current model to be updated as the student model, constructing a knowledge distillation constraint framework that includes soft label constraints, feature mapping similarity constraints, and prediction distribution consistency constraints.

[0155] Among them, the historical stable version model refers to the model version that has shown low drift and high robustness in past applications; the model version management library stores model parameters and performance evaluation reports at different iteration stages; the knowledge distillation constraint framework includes teacher model, student model and various constraint terms, which are used to transfer the effective knowledge of the historical model.

[0156] (3) Under the knowledge distillation constraint framework, optimize the feature encoding of the current model for the perturbation-enhanced sample set to obtain the consistency optimization parameters.

[0157] For example, the network intrusion detection terminal inputs a perturbation-enhanced sample set into the student model to be updated, performs multi-dimensional feature encoding on the samples through a feature extraction layer, and obtains the feature encoding results of the student model; simultaneously, the same samples are input into the teacher model to obtain the feature encoding results of the teacher model. The network intrusion detection terminal calculates the Euclidean distance between the two types of feature encoding results, constructs a feature encoding consistency loss function, minimizes this loss function using a gradient descent algorithm, and optimizes the parameters of the feature extraction layer and encoding layer of the student model to obtain the consistency optimization parameters. The specific loss function formula is as follows:

[0158]

[0159] In the formula, This represents the feature encoding consistency loss value; the smaller the value, the higher the consistency of the feature encoding between the student model and the teacher model. This represents the consistency loss weighting coefficient, which is a non-negative coefficient pre-configured based on the knowledge distillation intensity requirement. This represents the total number of samples in the perturbation-enhanced sample set; Represents the student model for the first The feature encoding vector of each perturbation-enhanced sample; The teacher model represents the first The feature encoding vector of each perturbation-enhanced sample; This represents the square operation of Euclidean distance.

[0160] Feature encoding refers to the process of mapping the original features of a sample to high-dimensional abstract features, including operations such as feature extraction, dimensionality transformation, and nonlinear mapping; consistency optimization parameters refer to the student model parameters after optimization by feature encoding consistency loss, which retains the feature encoding capability of the teacher model.

[0161] (4) Generate regularization constraint parameters by controlling the update direction of the consistent optimization parameters against the robust regularization term.

[0162] For example, the network intrusion detection terminal designs an adversarial robustness regularization term. This regularization term is constructed based on the consistency of prediction results between perturbation-enhanced samples and original cleaned samples, and is used to constrain the sensitivity of the model parameters to perturbations during the update process. The network intrusion detection terminal incorporates the adversarial robustness regularization term into the total loss function. The total loss function is a weighted sum of feature encoding consistency loss, sample classification loss, and the adversarial robustness regularization term. The total loss function is optimized using a gradient descent algorithm to constrain the update direction of the consistency optimization parameters, generating regularization constraint parameters. The specific formula for the total loss function is as follows:

[0163]

[0164] In the formula, This represents the total loss function value, which is the objective function for optimizing the model parameters; This represents the sample classification loss value, used to measure the accuracy of the model's prediction of sample labels; This represents the feature encoding consistency loss value; The weight coefficients for the anti-robust regularization term are non-negative coefficients pre-configured according to robustness requirements. This represents the robustness loss value, calculated as the mean difference between the predicted probability distributions of the perturbation-enhanced sample and the original clean sample.

[0165] Among them, the adversarial robustness regularization term is used to enhance the model's adaptability to data disturbances and reduce prediction bias caused by disturbances; the regularization constraint parameter refers to the model parameters after adversarial robustness constraint, which has both knowledge inheritance and disturbance resistance capabilities.

[0166] (5) Iteratively adjust the regularization constraint parameters until convergence, and output the updated model parameters.

[0167] For example, the network intrusion detection terminal sets parameter convergence criteria, including the total loss function value remaining stable within a preset loss threshold for multiple consecutive iterations, the parameter update magnitude being less than a preset accuracy threshold, and the number of iterations reaching a preset maximum number of iterations. Based on the gradient information of the total loss function, the network intrusion detection terminal continuously iteratively adjusts the regularization constraint parameters. After each iteration, it calculates the total loss function value and the parameter update magnitude, comparing them with the convergence criteria. When any one of the convergence criteria is met, the network intrusion detection terminal stops iterative parameter adjustment and outputs the final updated model parameters.

[0168] The convergence criteria include loss stability, parameter update magnitude, and iteration count, which are used to determine whether parameter optimization has achieved the expected results. The updated model parameters are model parameters that integrate historical model knowledge and new sample information and have the ability to resist degradation and disturbances, and are used to update the core configuration of the detection model.

[0169] In one embodiment, under the knowledge distillation constraint framework, the feature encoding of the current model for the perturbation-enhanced sample set is optimized to obtain consistent optimization parameters, including:

[0170] (1) Input the perturbation enhancement sample set into the historical stable version model, extract the multi-layer intermediate feature representation of the perturbation enhancement sample set, and obtain the baseline feature tensor.

[0171] For example, the network intrusion detection terminal inputs the perturbation enhancement sample set into the historical stable version model. The historical stable version model performs forward propagation operations layer by layer. At the output node of each layer of the network structure, it extracts the multi-layer intermediate feature representation of the perturbation enhancement sample set. The extracted intermediate features of each layer are dimensionally aligned and size normalized to ensure that the spatial dimension and channel dimension of the features of different layers are consistent. The intermediate features of all layers are integrated to obtain the benchmark feature tensor containing multi-scale feature information.

[0172] Among them, the multi-layer intermediate feature representation includes the feature mapping results output by different network layers of the historical stable version model; the baseline feature tensor is a high-dimensional tensor that integrates multi-scale intermediate features and stores the spatial and channel dimension information of each layer feature; the historical stable version model is a low-drift, high-robust model version verified in past applications.

[0173] (2) Calculate the multi-scale feature difference between the current model and the baseline feature tensor, and generate a feature consistency loss map.

[0174] For example, the network intrusion detection terminal performs multi-scale feature alignment on the feature encoding results of the current model to be updated for the perturbation enhancement sample set and the baseline feature tensor, determines the feature mapping position of the corresponding scale, calculates the feature difference between the two for the feature mapping of each scale, integrates the feature difference results of each scale according to the spatial location and channel dimension, and generates a feature consistency loss map.

[0175] The multi-scale feature difference is calculated using the following formula:

[0176]

[0177] In the formula, Indicates the first Feature difference values ​​at each scale; The weighting coefficient represents the absolute difference in each element. The weighting coefficients representing the cosine similarity differences. express The weighting coefficients for divergence differences are all non-negative coefficients pre-configured based on the importance of the difference type and satisfy the following conditions: ; This indicates that the model to be updated is for the first... The feature encoding vector of each scale perturbation enhances the sample; This indicates that the historical stable version model is for the first... The baseline feature vector of each scale-perturbation enhanced sample; Cosine similarity between two feature vectors; Representing two characteristic distributions Divergence.

[0178] Among them, the multi-scale feature difference integrates three types of indicators: element-wise absolute difference, cosine similarity difference, and KL divergence difference; the feature consistency loss map is a visual map generated by integrating multi-scale feature differences according to spatial location and channel dimension, which intuitively reflects the feature consistency loss distribution at different scales and channels.

[0179] (3) Perform channel dimension importance analysis on the feature consistency loss map to obtain the channel importance weight distribution.

[0180] For example, the network intrusion detection terminal decomposes the feature importance of the feature consistency loss map at the channel dimension, determines the loss contribution of each channel, calculates the total loss response value of each channel in the feature consistency loss map by combining global average pooling and global max pooling, and normalizes the loss response values ​​of all channels to obtain the channel importance weight distribution.

[0181] Among them, the channel dimension importance analysis quantifies the loss contribution of each channel through pooling operations; the channel importance weight distribution is the normalized weight result, which sums to 1 and is used to differentiate the weighted feature differences.

[0182] (4) Based on the differences in the weighted fusion features of the channel importance weight distribution, generate channel weighted loss.

[0183] For example, based on the channel importance weight distribution, the network intrusion detection terminal performs weighted calculations on the feature difference values ​​of each channel in the feature consistency loss map, highlighting the loss contribution of key channels and weakening the influence of non-key channels. The weighted feature difference values ​​of each channel are then summed globally to obtain the total feature difference loss after single-channel fusion, i.e., the channel weighted loss.

[0184] Among them, the channel-weighted loss strengthens the optimization priority of key channels through weight allocation; the total feature difference loss after single-channel fusion comprehensively reflects the consistency of multi-scale features in the channel dimension.

[0185] (5) Construct topological constraints for the feature space manifold and generate topological continuity loss.

[0186] For example, the network intrusion detection terminal constructs a manifold topology of the feature space based on the baseline feature tensor, characterizes the spatial proximity and topological connectivity between different feature points, constructs the manifold topological adjacency matrix by calculating the local neighborhood connectivity of the sample feature vectors in the feature space, designs the topological continuity loss, and measures the difference in continuity between the current model feature encoding results and the baseline feature tensor in the manifold topology.

[0187] Among them, the feature space manifold topology constraint describes the spatial topological relationship of feature points through the adjacency matrix; the topological continuity loss ensures that the feature encoding of the model is consistent with the historical stable version model at the spatial topology level.

[0188] (6) By combining the channel weighted loss and the topological continuity loss, a joint optimization objective is obtained.

[0189] For example, the network intrusion detection terminal performs weighted fusion of channel weighted loss and topology continuity loss, and generates a joint optimization objective by combining preset weight coefficients. This objective simultaneously takes into account channel dimension optimization for feature consistency and continuity optimization of feature space topology.

[0190] The joint optimization objective integrates channel-weighted loss and topological continuity loss; the weight coefficients are dynamically configured according to the priority requirements of model optimization to ensure the synergy of multi-constraint optimization.

[0191] (7) Perform gradient backpropagation update based on joint optimization objective to generate consistent optimization parameters.

[0192] For example, based on the joint optimization objective, the network intrusion detection terminal calculates its gradient information on the current model parameters to be updated through the backpropagation algorithm, adjusts the feature extraction layer weights, encoding layer parameters, etc. of the current model according to the gradient information, and continuously performs gradient backpropagation and parameter update operations until the model parameters converge and output consistent optimized parameters.

[0193] Among them, gradient backpropagation update is used to transmit the error signal of the joint optimization objective and propagate it back to the parameters of each layer of the model to guide parameter adjustment; the consistent optimization parameters are the model parameters after iterative optimization by the joint optimization objective, which have high feature consistency, strong anti-disturbance ability and stable feature space topology.

[0194] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0195] In one embodiment, such as Figure 3As shown, this application also provides a deep learning-based network intrusion detection system 300, which includes:

[0196] The multi-channel detection module 301 is used to analyze real-time network traffic using a multi-channel parallel detection mechanism, generate primary detection data including threat determination results and confidence scores, and generate dynamic defense rules based on unidentified threats in the primary detection data to obtain candidate defense rules.

[0197] The rule verification module 302 is used to evaluate the effectiveness of candidate defense rules through sandbox pre-testing and generate a rule security index; when the rule security index reaches a preset deployment threshold, the candidate defense rules are deployed to the online defense system.

[0198] The feedback learning module 303 is used to collect interception logs and related traffic generated by the online defense system, and generate purified training samples through a multi-source feedback trust mechanism; based on the purified training samples, anti-degradation incremental learning is performed to obtain updated model parameters.

[0199] The rule management module 304 is used to deploy the detection model containing the updated model parameters as the updated detection system; continuously monitor the health status of active rules in the updated detection system, and reclaim rules based on the monitoring results.

[0200] Specifically, the network intrusion detection terminal includes a multi-channel detection module 301, a rule verification module 302, a feedback learning module 303, and a rule management module 304.

[0201] The multi-channel detection module uses a multi-channel parallel detection mechanism to analyze the packet content, transmission protocol characteristics, connection behavior patterns, and traffic distribution patterns in real-time network traffic. It combines a basic threat signature database with real-time updated threat intelligence to perform multi-dimensional threat matching. The multi-channel detection module clearly identifies the threat type and risk level, while simultaneously assessing the reliability of the judgment results, generating preliminary detection data that includes specific threat type, risk level, and confidence score.

[0202] The multi-channel detection module filters out unidentified threats from the initial detection data that are not covered by the basic threat feature library and have a confidence level below the threshold. It then extracts the core traffic features, behavioral trajectories, and triggering scenario information of these unidentified threats. Based on the characteristics and scenarios of these unidentified threats, the multi-channel detection module sets targeted interception conditions, feature matching logic, and response strategies to construct dynamic defense rules and obtain candidate defense rules.

[0203] Among them, the multi-channel parallel detection mechanism processes traffic characteristics of different dimensions synchronously through independent channels; the primary detection data includes threat determination results and confidence scores; and the candidate defense rules are defense rules to be verified that are customized for unidentified threats.

[0204] The rule verification module receives candidate defense rules, creates an isolated verification environment that replicates the real network architecture, protocol interaction, and resource configuration, and initiates a sandboxed pre-verification process. The rule verification module simulates various network scenarios and injects potential threat traffic adapted to the candidate defense rules, monitoring in real time the rule's trigger response speed, interception accuracy, anti-escape capability, and false triggering.

[0205] The rule verification module, based on monitoring data from sandboxed pre-testing, comprehensively evaluates the effectiveness of candidate defense rules from multiple dimensions and generates a quantified rule security index. The module compares the rule security index with a preset deployment threshold; if the threshold is met, the candidate defense rule is successfully adapted to the online defense system, and then deployed to the online defense system for real-time interception.

[0206] Among them, the sandbox pre-test verifies the performance of rules by simulating real-world scenarios; the rule security index quantifies multiple indicators such as interception effectiveness and false alarm rate; and the online defense system is used to perform real-time network threat defense and interception.

[0207] The feedback learning module continuously collects interception logs (including interception time, object, rule identifier, and threat description) and corresponding associated traffic data generated by the online defense system. It then performs layered processing of the data through a multi-source feedback trust mechanism. The module sequentially performs data deduplication, anomaly removal, interference filtering, and authenticity verification. Valid data undergoes format standardization and feature dimension calibration to generate purified training samples that meet the requirements for model training.

[0208] The feedback learning module performs anti-degradation incremental learning based on the purified training samples. While retaining the core feature extraction capabilities and threat identification logic of the original detection model, it incorporates effective threat information from the new samples. The feedback learning module optimizes the parameter configuration of the original detection model to avoid performance degradation due to updates, resulting in updated model parameters.

[0209] Among them, the multi-source feedback reliability mechanism ensures the reliability and integrity of the data; the purified training samples undergo rigorous screening and standardization; and the anti-degradation incremental learning balances model updates and performance stability.

[0210] The rule management module adapts and integrates the updated model parameters output by the feedback learning module with the detection model architecture, performing functional integrity testing and operational stability verification. By verifying the integrity of core functions such as threat identification and rule triggering, the rule management module tests performance fluctuations under continuous model operation. Once the requirements are met, the detection model is deployed as the updated detection system.

[0211] The rule management module initiates active rule health status monitoring in the post-update detection system, collecting data on rule triggering frequency, interception success rate, false trigger count, and resource consumption to assess the effectiveness and stability of active rules. The rule management module identifies abnormal, inefficient, or incompatible active rules, marks them as pending revocation, suspends their interception permissions, removes their corresponding configuration information from the post-update detection system, and records the revocation details, thus completing rule revocation.

[0212] Among them, the updated detection system integrates optimized model parameters and defense rules; the active rule health status monitoring covers all dimensions of rule operation; and rule recycling realizes the standardized cleanup and recording of invalid rules.

[0213] Rule validation module 302 is also used for:

[0214] The protocol characteristics and behavioral constraints of candidate defense rules are analyzed to generate rule scope definitions;

[0215] Based on the rule scope definition, retrieve the historical adversarial sample library and filter the set of related attack patterns;

[0216] Inject a set of associated attack patterns into an isolated sandbox environment, conduct multiple rounds of rule stress testing, monitor the rule triggering status and attack escape events during the testing process, and generate a set of security performance indicators.

[0217] The rule-based security index is calculated by integrating interception rate, false alarm rate, and escape rate from a set of security performance indicators.

[0218] Rule validation module 302 is also used for:

[0219] Dynamically recombine the associated attack pattern set to obtain a variant attack sequence set;

[0220] Variant attack sequence sets are injected into an isolated sandbox environment to simulate real network fluctuations. The rule trigger timestamps and attack payload escape states during the execution of each attack sequence are monitored to obtain the original monitoring event stream.

[0221] Analyze the rule response patterns in the original monitoring event stream, and calculate the rule coverage and response latency metrics;

[0222] Detect escape feature patterns in the original monitoring event stream and generate an escape event classification set;

[0223] The threat level distribution of the escape event classification set is quantified, and the escape risk coefficient is calculated.

[0224] By integrating rule coverage, response latency metrics, and escape risk coefficients, a set of security performance metrics is generated.

[0225] The rule management module 304 is also used for:

[0226] Multi-dimensional metrics are collected from active rules to generate a real-time operational metric set, which includes false alarm rate, trigger frequency, and intelligence matching degree.

[0227] A health status prediction vector is obtained by performing trend correlation analysis based on the real-time operational indicator set.

[0228] The health status prediction vector is compared with the dynamically adjusted health threshold to generate rule-based health assessment results.

[0229] When the rule health assessment results meet the preset recycling conditions, the rule recycling operation is triggered.

[0230] Feedback learning module 303 is also used for:

[0231] Dynamic adversarial perturbations are applied to the purified training samples to generate a perturbation-enhanced sample set.

[0232] Load the parameters of the historical stable version model, and build a knowledge distillation constraint framework based on the parameters;

[0233] Under the knowledge distillation constraint framework, the feature encoding of the current model for the perturbation-enhanced sample set is optimized to obtain consistent optimization parameters;

[0234] Regularization constraint parameters are generated by optimizing the update direction of parameters in a way that opposes the robust regularization term constraint.

[0235] Iteratively adjust the regularization constraint parameters until convergence, and output the updated model parameters.

[0236] Feedback learning module 303 is also used for:

[0237] Input the perturbation-enhanced sample set into the historical stable version model, extract the multi-layer intermediate feature representation of the perturbation-enhanced sample set, and obtain the baseline feature tensor;

[0238] Calculate the multi-scale feature differences between the current model and the baseline feature tensor, and generate a feature consistency loss map;

[0239] Channel dimension importance analysis was performed on the feature consistency loss map to obtain the channel importance weight distribution;

[0240] Based on the differences in the weighted fusion features of the channel importance weight distribution, a channel-weighted loss is generated;

[0241] Construct topological constraints for the feature space manifold and generate a topological continuity loss;

[0242] By fusing the channel-weighted loss and the topological continuity loss, a joint optimization objective is obtained;

[0243] Gradient backpropagation updates are performed based on the joint optimization objective to generate consistent optimization parameters.

[0244] In one embodiment, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0245] In one embodiment, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the above-described method embodiments.

[0246] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0247] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A network intrusion detection method based on deep learning, characterized in that, The method includes: A multi-channel parallel detection mechanism is used to analyze real-time network traffic and generate preliminary detection data including threat determination results and confidence scores. Based on the unidentified threats in the preliminary detection data, dynamic defense rules are generated to obtain candidate defense rules. The effectiveness of the candidate defense rules is evaluated through sandbox pre-testing, and a rule security index is generated. When the rule security index reaches a preset deployment threshold, the candidate defense rules are deployed to the online defense system. The interception logs and associated traffic generated by the online defense system are collected, and purified training samples are generated through a multi-source feedback trusted mechanism. Anti-degradation incremental learning is performed based on the purified training samples to obtain updated model parameters. The detection model containing the updated model parameters is deployed as an updated detection system; the health status of active rules is continuously monitored in the updated detection system, and rules are recycled based on the monitoring results.

2. The network intrusion detection method based on deep learning according to claim 1, characterized in that, The process of evaluating the effectiveness of the candidate defense rules through sandboxed pre-testing and generating a rule security index includes: The protocol characteristics and behavioral constraints of the candidate defense rules are analyzed to generate the rule scope definition; Based on the defined scope of the rules, a historical adversarial sample library is retrieved, and a set of related attack patterns is filtered. The associated attack pattern set is injected into an isolated sandbox environment, and multiple rounds of rule stress testing are conducted. The rule triggering status and attack escape events during the testing process are monitored to generate a set of security performance indicators. The rule security index is calculated by integrating the interception rate, false alarm rate, and escape rate from the set of security performance indicators.

3. The network intrusion detection method based on deep learning according to claim 2, characterized in that, The process involves injecting the associated attack pattern set into an isolated sandbox environment, conducting multiple rounds of rule-based stress testing, monitoring the rule triggering status and attack escape events during the testing process, and generating a set of security performance indicators, including: The set of associated attack patterns is dynamically recombined to obtain a set of variant attack sequences; The variant attack sequence set is injected into the isolated sandbox environment to simulate a real network fluctuation environment. The rule trigger timestamp and attack payload escape status during the execution of each attack sequence are monitored to obtain the original monitoring event stream. Analyze the rule response patterns in the original monitoring event stream, and calculate the rule coverage and response latency metrics; Detect escape feature patterns in the original monitoring event stream to generate an escape event classification set; The threat level distribution of the escape event classification set is quantified, and the escape risk coefficient is calculated; The security performance index set is generated by integrating the rule coverage rate, the response latency index, and the escape risk coefficient.

4. The network intrusion detection method based on deep learning according to claim 1, characterized in that, The continuous monitoring of the health status of active rules in the updated detection system, and the reclamation of rules based on the monitoring results, includes: Multi-dimensional indicators are collected from the active rules to generate a real-time operational indicator set, which includes false alarm rate, trigger frequency and intelligence matching degree. Based on the real-time operating indicator set, a trend correlation analysis is performed to obtain a health status prediction vector. The health status prediction vector is compared with the dynamically adjusted health threshold to generate a rule-based health assessment result. When the rule health assessment result meets the preset recycling conditions, the rule recycling operation is triggered.

5. The network intrusion detection method based on deep learning according to claim 1, characterized in that, The step of performing anti-degradation incremental learning based on the purified training samples to obtain updated model parameters includes: Dynamic adversarial perturbation is applied to the purified training samples to generate a perturbation-enhanced sample set; Load the parameters of the historical stable version model, and construct a knowledge distillation constraint framework based on the parameters; Under the knowledge distillation constraint framework, the feature encoding of the current model for the perturbation-enhanced sample set is optimized to obtain consistent optimization parameters; Regularization constraint parameters are generated by constraining the update direction of the consistency optimization parameters against the robust regularization term. The regularization constraint parameters are iteratively adjusted until convergence, and the updated model parameters are output.

6. The network intrusion detection method based on deep learning according to claim 5, characterized in that, Under the knowledge distillation constraint framework, the current model's feature encoding of the perturbation-enhanced sample set is optimized to obtain consistency optimization parameters, including: The perturbation-enhanced sample set is input into the historical stable version model, and the multi-layer intermediate feature representation of the perturbation-enhanced sample set is extracted to obtain the baseline feature tensor; Calculate the multi-scale feature difference between the current model and the baseline feature tensor, and generate a feature consistency loss map; Channel dimension importance analysis was performed on the feature consistency loss map to obtain the channel importance weight distribution; Based on the differences in the weighted fusion features of the channel importance weight distribution, a channel-weighted loss is generated; Construct topological constraints for the feature space manifold and generate a topological continuity loss; By fusing the channel-weighted loss and the topological continuity loss, a joint optimization objective is obtained; Gradient backpropagation update is performed based on the joint optimization objective to generate the consistent optimization parameters.

7. A network intrusion detection system based on deep learning, characterized in that, The system includes: The multi-channel detection module is used to analyze real-time network traffic using a multi-channel parallel detection mechanism, and generate primary detection data including threat determination results and confidence scores; based on the unidentified threats in the primary detection data, dynamic defense rules are generated to obtain candidate defense rules; The rule verification module is used to evaluate the effectiveness of the candidate defense rules through sandboxed pre-testing and generate a rule security index; when the rule security index reaches a preset deployment threshold, the candidate defense rules are deployed to the online defense system. The feedback learning module is used to collect the interception logs and related traffic generated by the online defense system, generate purified training samples through a multi-source feedback trust mechanism, and perform anti-degradation incremental learning based on the purified training samples to obtain updated model parameters. The rule management module is used to deploy the detection model containing the updated model parameters as the updated detection system; continuously monitor the health status of active rules in the updated detection system, and reclaim rules based on the monitoring results.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the deep learning-based network intrusion detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the deep learning-based network intrusion detection method according to any one of claims 1 to 6.

Images