A deep learning-based network intrusion detection method

Abstract

The application belongs to the technical field of computer network security, and discloses a network intrusion detection method based on deep learning; first, multi-dimensional behavior features are extracted from network traffic, and the correlation between retransmission packet timestamps and protocol anomaly time windows is analyzed; a baseline distribution manifold of normal traffic is constructed by using a time series convolution autoencoder, and a regularization Mahalanobis distance is used to calculate and identify candidate abnormal sessions; a dynamic traffic correlation graph is constructed for the candidate abnormal sessions, a graph attention network is used to extract topological neighborhood features, and a flow entropy asymmetry degree is used to identify hidden communication paths; and according to the time sequence change trend of the attack type probability distribution, the current attack progress is judged, and the detection strategy is adjusted; the application improves the detection precision and the intelligent level, and can generate accurate protection strategies.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and more specifically, to a network intrusion detection method based on deep learning. Background Technology

[0002] Existing network intrusion detection technologies exhibit serious limitations in adaptability to increasingly complex cyberattack environments. First, traditional feature extraction methods lack a deep understanding of the semantics of network behavior. For example, when packet retransmissions occur on an enterprise intranet, existing systems often cannot accurately distinguish whether this is due to normal factors such as network congestion or equipment failure, or to deliberately constructed abnormal traffic by attackers. This leads to a large number of legitimate business operations being misjudged as intrusions, severely impacting business continuity. Second, current anomaly detection mechanisms generally employ fixed thresholds and static baselines, which are inadequate against the incremental penetration strategies employed by attackers. Attackers often maintain low-intensity probing activity initially to evade detection, and then rapidly expand laterally after gaining a foothold. Traditional systems struggle to capture these dynamic patterns of attack intensity. More critically, existing technologies lack a holistic understanding of the attack's temporal evolution. They cannot comprehend the logical connections between different stages of an attacker's attack, from reconnaissance, weaponization, and delivery to installation and command and control. They often can only make isolated judgments on single attack events, missing the optimal opportunity for effective interception in the early stages of the attack chain. Furthermore, traditional rule-based and signature-based detection methods are helpless in the face of the ever-emerging zero-day attacks and variant attacks. They lack the ability to learn autonomously and update models, which leads to the gradual degradation of the detection system's performance after deployment. This makes it unable to adapt to the ever-evolving threat landscape and ultimately creates a passive situation where the offensive and defensive capabilities are unequal.

[0003] In view of this, the present invention proposes a network intrusion detection method based on deep learning to solve the above problems. Summary of the Invention

[0004] To overcome the aforementioned shortcomings of the prior art and to achieve the above objectives, the present invention provides the following technical solution: a network intrusion detection method based on deep learning, comprising: Real-time traffic data of each node in the target network is collected, and multi-dimensional behavioral feature vectors of each network session are extracted from the real-time traffic data. The multi-dimensional behavioral feature vectors include connection duration, load entropy value, protocol anomaly rate and retransmission ratio. The multidimensional behavioral feature vectors are input into a pre-trained temporal convolutional autoencoder to calculate the reconstruction error of each network session, and a baseline distribution manifold of normal traffic is constructed based on the reconstruction error. Calculate the Mahalanobis distance of real-time traffic sessions that deviate from the baseline distribution manifold, and mark sessions whose Mahalanobis distance exceeds a dynamic threshold as candidate anomalous sessions; A dynamic traffic association graph is constructed for candidate abnormal sessions. The topological neighborhood aggregation features of the dynamic traffic association graph are extracted using a graph attention network. The topological neighborhood aggregation features are then fused with multidimensional behavioral feature vectors and input into a classification network to output the probability distribution of attack types. Identify the current attack chain stage based on the temporal variation trend of the attack type probability distribution, and dynamically adjust the node weights of the graph attention network according to the threat level corresponding to the attack chain stage. High-threat propagation paths are identified based on the adjusted node weights, targeted traffic blocking strategies are generated, and new attack samples are synchronously written into the incremental learning buffer. When the number of samples in the incremental learning buffer reaches the trigger threshold, the model fine-tuning process is initiated, and the parameters of the temporal convolutional autoencoder and the graph attention network are jointly updated to achieve continuous adaptive detection of unknown intrusion patterns.

[0005] The technical effects and advantages of the deep learning-based network intrusion detection method of this invention are as follows: This invention effectively distinguishes between normal network fluctuations and malicious attacks, significantly reducing false alarm rates and ensuring that enterprise network operations personnel are no longer troubled by massive amounts of false alerts, thus allowing them to concentrate limited security resources on addressing genuine threats. This invention possesses dynamic adaptive capabilities, automatically adjusting detection strategies as the network environment and attack methods evolve, maintaining optimal detection status without manual intervention. This is particularly important for small and medium-sized enterprises lacking dedicated security teams. This invention achieves continuous monitoring and prediction throughout the entire attack lifecycle, identifying potential threats and predicting their subsequent development trends in the early stages of an attack, providing ample time for protection decisions and transforming passive defense into proactive prevention. This invention can autonomously identify and adapt to new attack patterns, avoiding the detection blind spots of traditional systems facing unknown threats and ensuring that protection capabilities are always synchronized with the latest threat landscape. Attached Figure Description

[0006] Figure 1 This is a schematic diagram of a deep learning-based network intrusion detection method according to the present invention; Figure 2 This is a structural diagram of the temporal convolutional autoencoder of the present invention. Detailed Implementation

[0007] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0008] Please see Figure 1 The deep learning-based network intrusion detection method provided in this application embodiment can be executed by a network security device, and the method may include: Step 1: Collect real-time traffic data of each node in the target network, and extract multi-dimensional behavioral feature vectors for each network session from the real-time traffic data. The multi-dimensional behavioral feature vectors include connection duration, load entropy value, protocol anomaly rate, and retransmission ratio. In this embodiment, the target network is a computer network environment requiring intrusion detection and protection, such as an enterprise intranet, data center network, or cloud computing platform network, possessing multiple network nodes and complex traffic transmission patterns. Real-time traffic data is the stream of network data packets being transmitted between nodes in the target network, containing detailed information such as packet header information, payload content, and transmission timestamps, reflecting the real-time communication status of the network. A network session refers to the complete communication process established between two network nodes based on a specific protocol, encompassing the entire sequence of interactions from connection establishment to connection termination, and is the basic unit of network traffic analysis.

[0009] The multidimensional behavioral feature vector is a set of numerical features extracted from a network session to describe the session's behavioral patterns. In this embodiment, it includes four dimensions: connection duration, which represents the total duration of the network session from establishment to termination, reflecting the session's temporal characteristics; payload entropy, which represents the degree of randomness of data transmission in the session, obtained by calculating the information entropy of the data payload, reflecting the encryption or compression characteristics of the data; protocol anomaly rate, which represents the proportion of data packets that violate standard protocol specifications in the session, reflecting the degree of anomalies at the protocol level; and retransmission rate, which represents the proportion of repeatedly transmitted data packets in the session, reflecting network quality and abnormal retransmission behavior.

[0010] In this embodiment, network security devices are deployed at critical locations in the target network, such as core switch bypass and gateway entry / exit points, to collect network traffic in real time via network probes or mirrored ports. The collection process employs deep packet inspection technology, which not only obtains packet header information but also parses the payload content to ensure the completeness of feature extraction.

[0011] For connection duration calculation, the SYN packet timestamp of each session is recorded as the start time, and the FIN or RST packet timestamp as the end time; the difference between the two is the connection duration. The load entropy value is calculated by statistically analyzing the frequency distribution of byte values ​​in the load and applying the Shannon entropy formula. Calculations show that higher values ​​indicate more random data. Byte value The probability of occurrence in the load, For the first load Each byte value, ranging from [0, 255], represents all possible values ​​for an 8-bit byte. The protocol anomaly rate is calculated by using a deep packet inspection engine to analyze whether data packets conform to RFC standards and to determine the ratio of anomaly packets to the total number of packets. The retransmission ratio is calculated by analyzing TCP sequence numbers to identify retransmitted packets and determining the percentage of retransmitted packets.

[0012] Step 2: Input the multidimensional behavioral feature vector into the pre-trained temporal convolutional autoencoder, calculate the reconstruction error of each network session, and construct the baseline distribution manifold of normal traffic based on the reconstruction error; In this embodiment, the temporal convolutional autoencoder is an unsupervised learning model based on a convolutional neural network architecture, specifically designed for processing temporal feature data. It consists of an encoder and a decoder. The encoder is responsible for compressing the input multidimensional behavioral feature vector into a low-dimensional latent space, while the decoder is responsible for reconstructing the original input from the latent representation. During the training phase, the model is pre-trained using a large amount of normal network traffic data to learn the inherent patterns and distribution characteristics of normal traffic.

[0013] Reconstruction error is a measure of the difference between the input and output of a temporal convolutional autoencoder, typically calculated using mean squared error (MSE). ,in It is the raw input. This is the reconstructed output. The reconstructed error reflects the degree to which the current session deviates from the normal traffic pattern; the larger the error, the higher the probability of an anomaly.

[0014] The baseline distribution manifold is a multidimensional probability distribution model constructed based on the reconstruction errors of a large number of normal network sessions, describing the distribution characteristics of normal traffic in the error space. In this embodiment, a Gaussian mixture model (GMM) is used to model the reconstruction error, and the parameters are estimated through the expectation-maximization algorithm to form a mathematical manifold describing the boundary of normal traffic.

[0015] like Figure 2 (Temporal Convolutional Autoencoder Structure Diagram) illustrates the network structure and reconstruction error calculation process of the temporal convolutional autoencoder in this embodiment. The temporal convolutional autoencoder consists of two parts: an encoder and a decoder. The encoder sequentially includes a one-dimensional causal convolutional layer, multiple dilated convolutional layers, and pooling dimensionality reduction layers, converting the input multi-dimensional behavioral feature vector sequence into a decoder. The latent representation Z is compressed into a low-dimensional latent representation. The decoder consists of an upsampling layer, multiple deconvolutional layers, and an output reconstruction layer, which reconstruct the feature vector sequence from the latent representation Z. By calculating the original input With reconstruction output The mean square error between them yields the reconstruction error. Then, the baseline distribution manifold is constructed by fitting a Gaussian mixture model with the reconstruction error of a large number of normal flow samples.

[0016] In this embodiment, the multidimensional behavioral feature vectors extracted in real time are organized into a sequence according to a time window and input into a pre-trained temporal convolutional autoencoder. The model first extracts temporal features through a one-dimensional convolutional layer, then reduces the dimensionality through a pooling layer, and the encoder outputs a latent representation of fixed dimensions. The decoder reconstructs the original sequence through deconvolution operations and calculates the reconstruction error.

[0017] In constructing the baseline distribution manifold, a large number of labeled normal traffic sessions are collected, their reconstruction errors are calculated, and a Gaussian mixture model is used to fit the error distribution. The model parameters include mixture weights, mean vector, and covariance matrix, which are iteratively optimized using the EM algorithm. The resulting manifold can describe the multimodal distribution characteristics of normal traffic, providing a benchmark for anomaly detection.

[0018] Step 3: Calculate the Mahalanobis distance of real-time traffic sessions deviating from the baseline distribution manifold, and mark sessions whose Mahalanobis distance exceeds the dynamic threshold as candidate abnormal sessions; In this embodiment, Mahalanobis distance is a distance metric that considers the characteristics of data distribution and can eliminate the influence of correlation between variables. The formula is as follows: ,in It is the reconstruction error vector of the current session. It is the mean vector of the baseline distribution. It is the covariance matrix. Mahalanobis distance is more suitable for handling multidimensional correlated data than Euclidean distance, and can accurately measure the degree to which data points deviate from the distribution center.

[0019] Dynamic thresholds are anomaly detection criteria that adaptively adjust based on changes in the network environment. Unlike fixed thresholds, dynamic thresholds can adapt to the time-varying characteristics of network traffic. This embodiment employs a dynamic adjustment mechanism based on historical statistics, and the threshold calculation formula is as follows: ,in This is the confidence level coefficient, typically ranging from 2 to 3, corresponding to a confidence interval of 95% to 99.7%. A larger k value results in a higher threshold, a lower false alarm rate, but may increase the false negative rate. The mean of the baseline Mahalanobis distance is calculated using the Mahalanobis distance of historical normal flow rates and serves as the basis for the threshold. It is the standard deviation of the baseline distribution. This is the time decay factor, with a value range of [0.5, 2.0]. It is dynamically adjusted according to network conditions, especially during periods of network congestion. When the network is idle .

[0020] Candidate anomalous sessions are network sessions whose Mahalanobis distance exceeds a dynamic threshold, indicating that the session's behavior pattern significantly deviates from normal traffic characteristics and poses a potential security threat. These sessions need to proceed to the subsequent deep analysis process, where graph attention networks are used for further threat identification and classification.

[0021] In this embodiment, for each real-time network session, the reconstruction error is first calculated using a temporal convolutional autoencoder, and then the Mahalanobis distance is calculated based on a pre-built baseline distribution manifold. During the calculation, the multidimensional correlation of the reconstruction error vector is considered, and a standardized deviation measure is obtained using the Mahalanobis distance formula.

[0022] The dynamic threshold calculation takes into account time factors and changes in network status. A sliding time window is maintained, and the Mahalanobis distance distribution of recent normal sessions is statistically analyzed to dynamically update the threshold parameters. When the network environment changes, such as during peak traffic periods or network upgrades, the threshold can adaptively adjust to avoid false alarms and missed alarms.

[0023] Step 4: Construct a dynamic traffic association graph for candidate abnormal sessions, extract the topological neighborhood aggregation features of the dynamic traffic association graph using a graph attention network, and then input the topological neighborhood aggregation features and multidimensional behavioral feature vectors into a classification network to output the attack type probability distribution. In this embodiment, the dynamic traffic association graph is a graph structure data constructed with candidate abnormal sessions as nodes and network interaction relationships between sessions as edges. It can reflect the association patterns and propagation paths between abnormal sessions. Each node in the graph represents a candidate abnormal session, containing the multi-dimensional behavioral characteristics of that session; each edge represents the network interaction relationship between two sessions, such as the same source and destination IP, overlapping time windows, etc., and the edge is accompanied by an interaction strength weight.

[0024] Graph Attention Networks (GAT) are deep learning models specifically designed for processing graph-structured data. They dynamically learn importance weights between nodes through an attention mechanism, enabling the aggregation of features from neighboring nodes to form richer node representations. Topological neighborhood aggregation features are node feature representations obtained through multi-layer attention computation in the Graph Attention Network, integrating the node's own features with the influence of neighboring nodes.

[0025] Classification networks are multilayer perceptron networks used to identify attack types. They take fused feature vectors as input and output probability distributions for various attack types. The attack type probability distribution is a probability vector, where each element represents the probability that the current session belongs to a specific attack type (such as DDoS, port scanning, malware propagation, etc.).

[0026] In this embodiment, the construction process of the dynamic traffic association graph includes two stages: node creation and edge relationship determination. During node creation, a unique identifier is assigned to each candidate abnormal session, and its multi-dimensional behavioral feature vector is used as a node attribute. During edge relationship determination, various association relationships between sessions are analyzed: temporal association (relationships within a time window), spatial association (same source IP or destination IP), protocol association (using the same protocol stack), etc., and edge connections are created for session pairs that meet the association conditions.

[0027] The graph attention network process employs a multi-head attention mechanism. For each node, its attention weights with its neighboring nodes are calculated: ,in and It is a node feature. It is a weight matrix. This is the attention parameter vector. By weighted aggregation of neighbor features, a new representation of the node is obtained: ; For nodes The set of neighboring nodes, It is a non-linear activation function, usually ReLU or ELU, used to enhance the non-linear expressive power of the model.

[0028] In the feature fusion stage, the topological neighborhood aggregation features output by the graph attention network are concatenated with the original multidimensional behavioral feature vector to form a higher-dimensional comprehensive feature representation. The fused features include both the behavioral patterns of the session itself and its position and influence information in the abnormal session network.

[0029] Step 5: Identify the current attack chain stage based on the temporal change trend of the attack type probability distribution, and dynamically adjust the node weights of the graph attention network according to the threat level corresponding to the attack chain stage. In this embodiment, the attack chain refers to the complete attack sequence from initial reconnaissance to the achievement of the final target in a network attack. It typically includes multiple stages such as reconnaissance scanning, privilege acquisition, lateral movement, privilege escalation, and data theft. Each stage has different attack characteristics and threat levels. By analyzing the temporal variation patterns of the probability distribution of attack types, the current attack stage can be accurately identified.

[0030] The temporal trend refers to the changing pattern of the probability distribution of attack types within a continuous time window, reflecting the evolution of attack behavior. Threat level is the severity of security threats classified according to the stages of the attack chain, typically divided into reconnaissance level, penetration level, proliferation level, and damage level from low to high, used to guide the dynamic allocation of protection resources.

[0031] Node weight adjustment is a process of dynamically modifying the importance of nodes in a graph attention network based on the threat level. Higher threat levels correspond to higher node weights, making the model pay more attention to key attack nodes and improving threat identification accuracy.

[0032] In this embodiment, a fixed-size sliding window is maintained to collect attack type probability distribution sequences in real time. By analyzing the changing patterns of different attack type probabilities in the sequence, the evolution trend of the attack chain is identified. For example, initially, a high probability of port scanning indicates the reconnaissance stage; subsequently, an increase in the probability of vulnerability exploitation indicates the privilege acquisition stage; and finally, an increase in the probability of data leakage indicates the data theft stage.

[0033] Attack chain stage identification employs a state transition identification algorithm based on a Hidden Markov Model. A probability distribution feature template for each attack stage is predefined. Maximum likelihood estimation is used to match the similarity between the current observed sequence and each stage template, and the stage corresponding to the highest likelihood is selected as the current attack chain state.

[0034] Threat level mapping is based on a predefined attack severity assessment matrix, with different threat level coefficients corresponding to different attack stages. The node weight adjustment formula is as follows: ,in It is a node Original weights For the adjusted nodes Weights, dimensionless, are used for subsequent path searching and defense strategy formulation. This is the threat level coefficient, with a value range of [0,1]. 0 indicates no threat, and 1 indicates the highest threat, determined according to the attack chain stage. ad is the adjustment strength parameter, with a value range of [0.1,1.0]. It controls the degree of influence of the threat level on the weight adjustment and is configurable.

[0035] Step 6: Identify high-threat propagation paths based on the adjusted node weights, generate targeted traffic blocking strategies, and synchronously write new attack samples into the incremental learning buffer. In this embodiment, high-threat propagation paths are propagation links connecting multiple high-weight anomalous nodes in the dynamic traffic association graph, reflecting the spread path and key propagation nodes of the attack in the network. These paths typically correspond to the attacker's main penetration routes and are key targets for protection. Targeted traffic blocking strategies are precise traffic control measures formulated based on the characteristics of high-threat propagation paths, including specific protective actions such as IP blacklisting, port blocking, and traffic rate limiting.

[0036] The incremental learning buffer is a data structure used to store newly discovered unknown attack samples, supporting the continuous learning and adaptive improvement of the model. Novel attack samples refer to anomalous sessions where the maximum value in the probability distribution output by the classification network is lower than the confidence threshold, representing potential new attack patterns that existing models cannot accurately identify.

[0037] In this embodiment, the high-threat propagation path identification employs an improved version of the shortest path algorithm based on graph theory. Using the adjusted node weights as the cost function, a variant of Dijkstra's algorithm is used to identify the optimal path connecting multiple high-weight nodes. The algorithm prioritizes the propagation link that passes through high-threat nodes and has the lowest total path cost as the high-threat propagation path.

[0038] The process of generating targeted traffic blocking strategies includes two stages: path analysis and strategy formulation. In the path analysis stage, network characteristics of each node along the high-threat propagation path are extracted, such as source and destination IP addresses, ports used, and transmission protocols. In the strategy formulation stage, corresponding blocking rules are generated based on the path characteristics: for paths concentrated in specific IP ranges, IP range blocking rules are generated; for paths using specific ports, port access restriction rules are generated; and for high-frequency transmission paths, traffic rate limiting rules are generated.

[0039] The identification of novel attack samples employs an uncertainty quantification method. When the maximum probability value in the attack type probability distribution output by the classification network is lower than a preset confidence threshold, the sample is determined to be a novel attack. These samples, along with their feature vectors, timestamps, and other information, are written into the incremental learning buffer, awaiting processing in subsequent model update procedures.

[0040] Step 7: When the number of samples in the incremental learning buffer reaches the trigger threshold, start the model fine-tuning process, and jointly update the parameters of the temporal convolutional autoencoder and the graph attention network to achieve continuous adaptive detection of unknown intrusion patterns.

[0041] In this embodiment, the trigger threshold is a critical number of samples required to initiate the model fine-tuning process, determined based on a balance between model capacity and learning efficiency. The model fine-tuning process is an incremental update of the pre-trained model, using novel attack samples to make minor adjustments to the model parameters, learning new attack patterns while maintaining existing knowledge.

[0042] Joint parameter update refers to the process of simultaneously optimizing the parameters of a temporal convolutional autoencoder and a graph attention network. End-to-end gradient backpropagation ensures that the two network modules work in coordination, improving overall detection performance. Continuous adaptive detection refers to the model's ability to continuously learn new attack patterns, automatically update its detection capabilities, and respond to evolving cybersecurity threats.

[0043] In this embodiment, when the number of novel attack samples accumulated in the incremental learning buffer reaches the trigger threshold, the model fine-tuning process is automatically initiated. The fine-tuning process uses a small learning rate to update parameters, avoiding damage to the stability of the original model.

[0044] The joint parameter update employs a multi-task learning framework, simultaneously optimizing both the reconstruction loss and classification loss objective functions. The total loss function is: ,in and These are weighting coefficients. The reconstruction loss is typically expressed as mean squared error, which measures the reconstruction quality of an autoencoder. For classification loss, cross-entropy loss is typically used to measure the accuracy of attack type classification. Through backpropagation, gradient information is simultaneously passed to both the temporal convolutional autoencoder and the graph attention network, achieving joint optimization.

[0045] During model updates, an experience replay mechanism is employed to mix new samples with a subset of historical samples during training, preventing catastrophic forgetting. Simultaneously, an early stopping mechanism is used to monitor validation set performance and avoid overfitting. After the update is complete, the baseline distribution manifold and dynamic threshold parameters are automatically updated to ensure the overall consistency of the detection system.

[0046] In a preferred embodiment of the present invention, the extraction of the multi-dimensional behavioral feature vector for each network session from real-time traffic data includes: Step 1.1: When extracting the retransmission rate, obtain the timestamp sequence of retransmitted data packets and extract the abnormal time window where the protocol anomaly rate suddenly increases. Specifically, during the traffic collection process of the target network, for each network session, identify data packets belonging to the retransmission nature using deep packet inspection technology. These retransmitted data packets usually have the same sequence number or a specific combination of TCP flag bits. Extract the precise timestamp information carried by each retransmitted data packet to construct the timestamp sequence of retransmitted data packets for that network session. This sequence is arranged in chronological order, recording the complete time trajectory of the retransmission event. At the same time, monitor the protocol anomaly rate index of the network session. This index reflects the proportion of abnormal behaviors at the protocol level, such as protocol field violations and abnormal protocol state transitions. Analyze the changing trend of the protocol anomaly rate through a sliding time window. When a significant increase in the protocol anomaly rate is detected in a short period of time, exceeding a preset multiple (e.g., 3 standard deviations) of the historical average, mark this time period as the abnormal time window where the protocol anomaly rate suddenly increases. Record the start and end timestamps of this abnormal time window to provide a time reference benchmark for subsequent determination of the cause of retransmission.

[0047] Step 1.2: In response to the presence of a target timestamp falling within an abnormal time window in the timestamp sequence of retransmitted data packets, it is determined that the retransmission ratio is caused by a protocol anomaly. The original value of the retransmission ratio in the multidimensional behavioral feature vector is retained. Specifically, this includes: performing a time range matching comparison between the acquired timestamp sequence of retransmitted data packets and the identified abnormal time window. Each timestamp in the timestamp sequence of retransmitted data packets is checked one by one to determine whether it falls within the time range defined by the start and end timestamps of the abnormal time window. If at least one timestamp in the timestamp sequence of retransmitted data packets falls within the abnormal time window, this timestamp is marked as the target timestamp, indicating that the retransmission event and the protocol anomaly have a temporal overlap. Based on the existence of the target timestamp, it is determined that the retransmission behavior of this network session is caused by a protocol-level anomaly, rather than a network transmission quality problem. In this case, the retransmission ratio, as an important feature reflecting protocol attack behavior, has significant detection value. Therefore, the original calculated value of the retransmission ratio in the multidimensional behavioral feature vector is retained to ensure that this feature can effectively participate in the subsequent anomaly detection process.

[0048] Step 1.3: In response to the fact that the timestamp sequence of retransmitted data packets does not fall within the abnormal time window, and the retransmitted data packets are concentrated in the tail interval of the network session's connection duration, it is determined that the retransmission ratio is caused by network jitter. The retransmission ratio in the multidimensional behavioral feature vector is set to zero. Specifically, this includes: when checking the timestamp sequence of retransmitted data packets and finding that all timestamps do not fall within the abnormal time window, it is initially determined that the retransmission behavior is unrelated to protocol anomalies. Further analysis is then conducted on the distribution characteristics of retransmitted data packets on the session timeline. The total connection duration of the network session is obtained, and the connection duration is divided into a header interval, a middle interval, and a tail interval in chronological order, for example, according to a ratio of 20%-60%-20%, where the tail interval corresponds to the time period when the network session is nearing its end. The distribution density of retransmitted data packets in each time interval is statistically analyzed, and the proportion of retransmitted data packets falling into the tail interval to the total number of retransmitted data packets is calculated. If this proportion exceeds a preset concentration threshold (e.g., 80%), it is determined that the retransmitted data packets are concentrated in the tail interval of the network session's connection duration. This distribution pattern aligns with the retransmission characteristics caused by network jitter or congestion during the normal TCP connection termination phase, rather than the behavior of malicious attacks. Based on this judgment, the retransmission rate is considered to be caused by network jitter and does not possess characteristic value for intrusion detection. To avoid normal network fluctuations interfering with the detection results, the retransmission rate in the multidimensional behavioral feature vector is set to zero, eliminating the impact of this noise feature on anomaly detection.

[0049] In this embodiment of the invention, by employing the technique of obtaining the timestamp sequence of retransmitted data packets and identifying abnormal time windows where the protocol anomaly rate suddenly increases when extracting the retransmission ratio, the method determines that the retransmission timestamp falls into the abnormal window as a protocol anomaly and retains the original retransmission ratio. When the retransmission timestamp does not fall into the abnormal window and is concentrated in the connection tail interval, it determines that the retransmission ratio is caused by network jitter and sets the retransmission ratio to zero. Therefore, this method overcomes the technical problems of existing traffic feature extraction methods that treat all retransmission behaviors the same, cannot distinguish between retransmissions caused by attacks and retransmissions caused by network quality problems, and simply retain retransmission features, which leads to normal network jitter being misjudged as abnormal. Thus, it achieves the technical effect of intelligently determining the cause of retransmission based on time correlation analysis and spatial distribution features, accurately identifying attack features through the temporal coupling relationship between protocol anomalies and retransmissions, and filtering out noisy retransmission features introduced by network jitter, effectively improving the detection effectiveness and anti-interference capability of multi-dimensional behavioral feature vectors.

[0050] In a preferred embodiment of the present invention, the above-mentioned inputting multi-dimensional behavioral feature vectors into a pre-trained temporal convolutional autoencoder to calculate the reconstruction error of each network session includes: Step 2.1: Obtain the minimum receptive field length of the temporal convolutional autoencoder (TCE) and compare the sequence length of the network session with the minimum receptive field length. Specifically, the pre-trained TCE employs a multi-layer causal convolutional structure, using dilated convolutions to achieve hierarchical extraction of temporal features. This TCE has specific network architecture parameters, including kernel size, dilation rate sequence, and number of network layers. These parameters collectively determine the minimum receptive field length. The minimum receptive field length refers to the minimum input sequence length that the TCE can effectively process. When the input sequence length is less than this value, the convolution operation cannot cover the complete temporal dependencies, resulting in incomplete feature extraction. The minimum receptive field length parameter value is read from the TCE configuration file, for example, set to 32 time steps. For the network session to be processed, the number of data packets or sampling time steps in the session are counted to determine the sequence length of the network session. The sequence length value of the network session is compared with the minimum receptive field length value to determine whether it meets the input length requirement of the TCE, providing a decision-making basis for subsequent possible sequence padding operations.

[0051] Step 2.2: In response to a sequence length less than the minimum receptive field length, the difference between the minimum receptive field length and the sequence length is determined as the padding deficit. Specifically, when the comparison result shows that the sequence length of the network session is less than the minimum receptive field length, it is determined that the sequence data of the network session is insufficient to be directly input into the temporal convolutional autoencoder for effective processing, and a sequence padding mechanism needs to be initiated. The difference between the minimum receptive field length and the sequence length of the network session is calculated. This difference represents the additional sequence data length required to meet the minimum input requirement of the temporal convolutional autoencoder, and this difference is determined as the padding deficit. For example, if the minimum receptive field length is 32 time steps, but the sequence length of the network session is only 20 time steps, then the padding deficit is 12 time steps. Determining the padding deficit provides a precise quantitative indicator for subsequently selecting appropriate padding data, ensuring that the length of the padded sequence exactly meets the minimum receptive field requirement of the temporal convolutional autoencoder.

[0052] Step 2.3: Extract historical normal data packet sequences with a length equal to the padding gap from the historical traffic records of the network session, which are located before the start time of the network session. Specifically, this includes: accessing the target network's historical traffic database, which stores historical communication records of each node in the network in chronological order; locating the source IP address and destination IP address combination corresponding to the network session and obtaining the historical traffic records between this communication pair; using the start time of the network session as a time reference point and tracing back along the timeline to extract historical data packet sequences located before the start time of the network session; performing security screening on the extracted historical data packet sequences by verifying them using a known normal traffic tag library or historical detection records to ensure that the selected data packets belong to normal communication behavior and excluding historical data packets containing attack characteristics; and selecting data packet sequences with a length equal to the padding gap from the filtered historical normal data packet sequences in reverse chronological order as historical normal data packet sequences. For example, if the padding gap is 12 time steps, then the 12 normal data packets immediately preceding the start time of the network session are selected. The selected historical normal data packet sequences are continuous with the current network session in time and similar in communication pattern to the current session, providing a suitable data source for high-quality sequence padding.

[0053] Step 2.4 involves concatenating the historical normal data packet sequence to the header of the network session using a loop-loop padding method. The padded network session is then input into a temporal convolutional autoencoder to calculate the reconstruction error. Specifically, this includes receiving the original sequence data of the network session and the extracted historical normal data packet sequence, and performing a sequence concatenation operation. The historical normal data packet sequence is arranged chronologically and used as a padding prefix, concatenated to the header of the network session to form the expanded sequence. The concatenation operation maintains the continuity of the temporal order, ensuring a smooth transition from the historical normal data packet sequence to the current network session sequence, avoiding feature jumps caused by temporal discontinuities. The loop-loop padding method utilizes the temporal continuity of the communication's historical normal behavior, ensuring consistency between the padding part and the actual session part in the feature space. Compared to zero-padding or random padding methods, it more realistically reflects the temporal evolution of the communication pattern. The length of the padded network session sequence reaches or exceeds the minimum receptive field length, satisfying the input requirements of the temporal convolutional autoencoder. The padded network session is input into a temporal convolutional autoencoder. Temporal features are extracted through multiple layers of causal convolution in the encoder, and then the original input sequence is reconstructed by the decoder. The reconstruction error between the reconstructed output and the original input is calculated. This reconstruction error reflects the degree to which the network session deviates from the normal traffic pattern, providing a key deviation metric for subsequent anomaly detection.

[0054] In this embodiment of the invention, by employing the technique of obtaining the minimum receptive field length of the temporal convolutional autoencoder and comparing it with the length of the network session sequence, calculating padding when the sequence length is insufficient, extracting historical normal data packet sequences of equal length from historical traffic records before the start time of the network session, splicing them into the session header for loop-loop padding, and then inputting them into the temporal convolutional autoencoder to calculate the reconstruction error, the technical problems of existing deep learning detection methods being unable to effectively handle short sequence traffic, simple zero padding or random padding destroying the continuity of temporal features leading to reconstruction error distortion, and lacking an intelligent padding mechanism for short sessions affecting detection accuracy are overcome. Thus, the technical effect of achieving effective processing of short sequence traffic through loop-loop padding of historical normal data, maintaining the continuity and authenticity of temporal features, ensuring uniform high-quality processing of network sessions of different lengths by the temporal convolutional autoencoder, and effectively improving the anomaly detection accuracy and model applicability of short session traffic is achieved.

[0055] In a preferred embodiment of the present invention, the calculation of the Mahalanobis distance of the real-time traffic session deviation from the baseline distribution manifold includes: Step 3.1: Obtain the covariance matrix of normal traffic samples used to construct the baseline distribution manifold, and construct a Gram matrix composed of multi-dimensional behavioral feature vectors based on the dimensions of the multi-dimensional behavioral feature vectors. Specifically, this includes: during the model training phase, training a temporal convolutional autoencoder using a large number of labeled normal traffic samples, and constructing a statistical distribution model based on the multi-dimensional behavioral feature vectors of these normal traffic samples. Calculate the covariance matrix of normal traffic samples in the multi-dimensional feature space. This normal traffic sample covariance matrix describes the statistical correlation between the various feature dimensions of normal traffic and the variance distribution of the features, and is the core statistical parameter for constructing the baseline distribution manifold. Read the normal traffic sample covariance matrix from the model parameter storage; its dimension is d×d, where d is the number of dimensions of the multi-dimensional behavioral feature vectors (e.g., d=4, corresponding to four features: connection duration, load entropy, protocol anomaly rate, and retransmission ratio). During the real-time detection phase, obtain the multi-dimensional behavioral feature vectors of multiple real-time traffic sessions to be detected in the current batch, and arrange these feature vectors by rows to form a feature matrix. Based on the dimension of the multidimensional behavioral feature vector, the product of the feature matrix and its transpose is calculated to construct a Gram matrix composed of the multidimensional behavioral feature vector. The elements of the Gram matrix reflect the inner product relationship between different feature vectors and are used for subsequent collinearity testing.

[0056] Step 3.2 involves calculating the condition number of the Gram matrix and comparing it with a preset collinearity threshold. Specifically, this includes performing numerical stability analysis on the constructed Gram matrix and calculating its condition number. The condition number is defined as the ratio of the maximum singular value to the minimum singular value of the matrix, and is an important indicator of the matrix's numerical stability. Using a singular value decomposition algorithm, all singular values ​​of the Gram matrix are obtained, and the maximum and minimum singular values ​​are calculated. Dividing these two values ​​yields the condition number of the Gram matrix. The size of the condition number reflects the degree of linear correlation between multidimensional behavioral feature vectors: a larger condition number indicates a more severe collinearity problem between feature vectors, suggesting high correlation between feature dimensions, which may lead to a near-singular covariance matrix, affecting the numerical stability of Mahalanobis distance calculation. A preset collinearity threshold is set, determined based on numerical calculation stability requirements, for example, 1000. When the condition number exceeds this threshold, a significant collinearity problem is considered to exist. The calculated condition number of the Gram matrix is ​​then numerically compared with the preset collinearity threshold to determine whether the current feature data exhibits high collinearity, providing a decision-making basis for subsequently selecting a suitable Mahalanobis distance calculation method.

[0057] Step 3.3: In response to the condition number exceeding a preset collinearity threshold, it is determined that there is high collinearity among the multidimensional behavioral feature vectors. A damping coefficient positively correlated with the condition number is applied to the diagonal elements of the covariance matrix for regularization. The Mahalanobis distance is calculated based on the regularized covariance matrix. Specifically, when the condition number of the Gram matrix exceeds the preset collinearity threshold, it is confirmed that there is high collinearity among the multidimensional behavioral feature vectors. Directly using the original normal flow sample covariance matrix to calculate the Mahalanobis distance may lead to numerical instability or calculation failure. The covariance matrix regularization mechanism is activated, and a damping coefficient calculation function positively correlated with the condition number is designed. This function ensures that the larger the condition number, the larger the applied damping coefficient, and the stronger the regularization. For example, the damping coefficient can be designed as: λ = α × log(condition number / preset collinearity threshold), where α is a preset regularization strength parameter. The normal flow sample covariance matrix is ​​obtained, and its diagonal elements are identified. The diagonal elements represent the variance of each feature dimension. The calculated damping coefficient is applied to each diagonal element of the covariance matrix. Specifically, the regularized diagonal element = original diagonal element + λ × I, where I is the element at the corresponding position in the identity matrix. This regularization operation increases the value of the diagonal elements of the covariance matrix, improves the condition number of the matrix, and enhances the numerical stability of matrix inversion. Based on the regularized covariance matrix, the Mahalanobis distance is calculated using the Mahalanobis distance formula. This distance accurately reflects the degree to which real-time traffic sessions deviate from the baseline distribution manifold.

[0058] Step 3.4: In response to the condition number being less than or equal to a preset collinearity threshold, the Mahalanobis distance is calculated based on the original covariance matrix. Specifically, when the condition number of the Gram matrix is ​​less than or equal to the preset collinearity threshold, it is determined that the degree of collinearity among the multidimensional behavioral feature vectors is within an acceptable range. The original normal traffic sample covariance matrix has good numerical stability and can be directly used for Mahalanobis distance calculation. The original normal traffic sample covariance matrix is ​​obtained without any regularization modifications, maintaining the original statistical properties of the covariance matrix. Using the standard Mahalanobis distance calculation formula, the multidimensional behavioral feature vectors of the real-time traffic session to be detected, the mean vector of the normal traffic samples, and the original covariance matrix are substituted into the calculation to obtain an accurate Mahalanobis distance value. This Mahalanobis distance comprehensively considers the variance differences of multidimensional features and the correlation between features. Compared with simple distance metrics such as Euclidean distance, it can more accurately reflect the true deviation of the sample in the statistical distribution space. The calculated Mahalanobis distance serves as the core indicator for subsequent anomaly detection and is compared with a dynamic threshold to identify candidate abnormal sessions.

[0059] In this embodiment of the invention, the technical approach of obtaining the covariance matrix of normal traffic samples and constructing a Gram matrix of multidimensional behavioral feature vectors, calculating the condition number of the Gram matrix and comparing it with a preset collinearity threshold, and applying a damping coefficient positively correlated with the condition number to the diagonal elements of the covariance matrix for regularization when the condition number exceeds the threshold before calculating the Mahalanobis distance, and directly calculating the Mahalanobis distance based on the original covariance matrix when the condition number does not exceed the threshold, overcomes the technical problems of existing anomaly detection methods, such as the covariance matrix approaching singularity when features are highly collinear, leading to unstable or failed Mahalanobis distance calculation, the inability to adaptively adjust the fixed regularization parameter according to the degree of collinearity when simply using a fixed regularization parameter, and the lack of a collinearity detection mechanism leading to inaccurate distance measurement. This achieves the technical effect of quantifying the degree of feature collinearity through conditions and adaptively adjusting the regularization strength, preserving statistical characteristics to the maximum extent while ensuring the stability of numerical calculation, realizing robust Mahalanobis distance calculation for data with different degrees of collinearity, and effectively improving the accuracy and applicability of anomaly traffic identification.

[0060] In a preferred embodiment of the present invention, the above-mentioned construction of a dynamic traffic correlation graph for candidate abnormal sessions includes: Step 4.1: Using candidate abnormal sessions as nodes and the network interaction relationships between candidate abnormal sessions as edges, construct an initial association graph. Specifically, this includes: obtaining a set of all sessions marked as candidate abnormal sessions from real-time traffic sessions whose Mahalanobis distance exceeds a dynamic threshold. This set contains potential abnormal communication behaviors detected within the current time window. For each candidate abnormal session, extract its key identification information, including a five-tuple of source IP address, destination IP address, source port, destination port, protocol type, and session start time. Abstract each candidate abnormal session into a node in the graph structure. The node attributes include the session's multi-dimensional behavioral feature vector, Mahalanobis distance value, and session identification information. Analyze the network interaction relationships between candidate abnormal sessions to determine if two sessions have a logical connection: if the source IP address and destination IP address of two sessions overlap (e.g., the destination IP of session A is the source IP of session B), or if the two sessions are temporally adjacent and involve the same host node, then a network interaction relationship exists between these two sessions. For candidate abnormal session pairs with network interaction relationships, establish connecting edges between the corresponding graph nodes. The direction of the edges is determined by the temporal order of the sessions or the data flow direction. By constructing the nodes and edges described above, an initial association graph is formed. The topology of this graph reflects the association patterns of candidate abnormal sessions in the network space and time dimensions, providing a basic graph structure for subsequent topology feature extraction.

[0061] Step 4.2: For each edge in the initial association graph, obtain the source payload entropy value sent by the source node and the destination payload entropy value returned by the destination node. Specifically, this includes: traversing all edges in the initial association graph, and for each edge, identifying the source node and destination node connected to it. The source node corresponds to the initiating communication or an earlier candidate abnormal session, while the destination node corresponds to the receiving communication or a later candidate abnormal session. Extract the payload entropy value feature from the multidimensional behavioral feature vector of the candidate abnormal session corresponding to the source node. This payload entropy value is calculated from the data payload sent by that session, reflecting the randomness and complexity of the sent data, and is marked as the source payload entropy value. Similarly, extract the payload entropy value feature from the multidimensional behavioral feature vector of the candidate abnormal session corresponding to the destination node. This payload entropy value is calculated from the data payload returned by that session (if the session includes bidirectional communication), reflecting the randomness and complexity of the returned data, and is marked as the destination payload entropy value. The payload entropy value is the application of information entropy to the data payload. The payload entropy value of normal communication is usually within a specific range, while encrypted covert communication, data penetration, and other attack behaviors often exhibit abnormal payload entropy value characteristics.

[0062] Step 4.3: Calculate the absolute value of the difference between the source load entropy value and the destination load entropy value, and determine the absolute value of the difference as the flow entropy asymmetry of the edge. Add the flow entropy asymmetry as an edge attribute to the initial association graph to generate a dynamic flow association graph. Specifically, this includes: for each edge, obtaining the corresponding source load entropy value and destination load entropy value, and then calculating the difference. The absolute value of the difference is taken to eliminate directional influence. The obtained absolute value reflects the degree of asymmetry in load entropy values ​​between the two sessions connected by the edge, and this value is determined as the flow entropy asymmetry of the edge. Entropy asymmetry is an important indicator for characterizing the bidirectional nature of communication. In normal bidirectional communication, the entropy values ​​of the request and response payloads usually exhibit a certain degree of symmetry or predictable relationship. However, in attack scenarios such as one-way covert communication, command and control channels, and data leakage, significant entropy asymmetry often occurs. For example, an attacker sends a high-entropy encrypted command while the victim host sends back a low-entropy confirmation message, or during data leakage, a large amount of high-entropy data is transmitted unidirectionally while very little data is returned. The calculated entropy asymmetry is used as an edge attribute and stored in the edge attribute dictionary along with other edge attributes (such as time interval and flow rate) and added to the edge data structure of the initial association graph. After calculating the entropy asymmetry and adding attributes for all edges, the initial association graph is upgraded to a dynamic flow association graph containing rich edge attributes. This graph not only contains topological connections but also carries entropy asymmetry information reflecting communication behavior characteristics, providing crucial edge-level semantic information for subsequent refined feature extraction by the graph attention network.

[0063] In this embodiment of the invention, because an initial association graph is constructed using candidate abnormal sessions as nodes and network interaction relationships as edges, and for each edge, the source payload entropy value sent by the source node and the destination payload entropy value returned by the destination node are obtained, the absolute value of the difference between the two is calculated to determine the flow entropy asymmetry, and this is added as an edge attribute to the initial association graph to generate a dynamic flow association graph, the technical means overcome the problems of existing graph structure modeling methods that only consider the topological connection relationship between nodes and edges, ignore the semantic attributes of edges leading to insufficient graph feature expression, and traditional methods that cannot characterize the bidirectional characteristics of communication and miss attack modes such as covert communication. Thus, it achieves the technical effect of quantifying the bidirectional characteristics of communication behavior through flow entropy asymmetry, integrating edge-level semantic information reflecting attack modes into the graph structure, providing richer feature inputs for graph attention networks, and effectively improving the ability to identify attack types such as one-way covert communication and command and control.

[0064] In a preferred embodiment of the present invention, the above-mentioned extraction of topological neighborhood aggregation features of dynamic traffic association graphs using graph attention networks includes: Step 5.1, in the process of calculating the attention coefficient in the graph attention network, obtain the flow entropy asymmetry of the target edge between the current neighbor node to be calculated and the center node. Specifically, the graph attention network uses an attention mechanism to perform neighborhood aggregation on the node features in the graph structure, assigning different attention weights to different neighbor nodes during the aggregation process. When performing neighborhood aggregation on a certain center node, all neighbor nodes of the center node are traversed, and for each current neighbor node to be calculated, the edge connecting the neighbor node and the center node is identified as the target edge. The flow entropy asymmetry value stored in the target edge is read from the edge attribute data of the dynamic flow association graph. As an important semantic attribute of the target edge, the flow entropy asymmetry reflects the degree of asymmetry in the communication behavior between the two sessions connected by the edge, providing edge-level semantic adjustment information for the calculation of the attention coefficient. Traditional graph attention networks only calculate the attention coefficient based on node features, while this invention, by introducing flow entropy asymmetry, enables the attention mechanism to perceive the semantic attributes of the edge, achieving more refined neighborhood feature aggregation.

[0065] Step 5.2: In response to the flow entropy asymmetry exceeding a preset asymmetry threshold, the target edge is determined to be a one-way covert communication edge. The initial attention coefficient of the graph attention network is multiplied by a covert amplification factor greater than 1 to obtain the target attention coefficient. Specifically, this includes comparing the obtained flow entropy asymmetry value with a preset asymmetry threshold. This preset asymmetry threshold is determined based on the statistical characteristics of the symmetry between the load entropy values ​​of normal communication and attack communication. For example, it is set to 2.0, indicating that a significant asymmetry exists when the difference between the source load entropy value and the destination load entropy value exceeds 2.0. When the flow entropy asymmetry exceeds the preset asymmetry threshold, it is determined that there are abnormal one-way communication characteristics between the two sessions connected by the target edge, which conforms to the typical characteristics of attack modes such as covert communication channels, command and control communication, and data leakage. The target edge is then marked as a one-way covert communication edge. Neighboring nodes connected to the one-way covert communication edge are considered to have higher importance in attack chain propagation or attack coordination and should receive higher attention in neighborhood aggregation. The initial attention coefficients, calculated based on node features, are obtained for the graph attention network. These coefficients reflect the correlation between the features of neighboring nodes and the features of the center node. These initial attention coefficients are then multiplied by a preset hidden amplification factor, which is set to a value greater than 1 (e.g., 1.5 or 2.0). The amplification factor can be dynamically adjusted according to the magnitude of the flow entropy asymmetry; the greater the asymmetry, the larger the amplification factor. The target attention coefficient obtained after multiplying by the hidden amplification factor is significantly higher than the initial value, ensuring that the features of the neighboring node receive greater weight during the aggregation process, thus enhancing the graph attention network's sensitivity to hidden communication patterns.

[0066] Step 5.3: In response to the flow entropy asymmetry being less than or equal to a preset asymmetry threshold, the initial attention coefficient is retained as the target attention coefficient. Specifically, when the flow entropy asymmetry is less than or equal to the preset asymmetry threshold, it is determined that the communication behavior symmetry between the two sessions connected by the target edge is within the normal range and does not possess significant characteristics of one-way covert communication. Therefore, this edge is not a high-risk edge requiring special attention. In this case, the initial attention coefficient calculated by the graph attention network based on node features remains unchanged, and this initial attention coefficient is directly used as the target attention coefficient. This processing method ensures that neighboring nodes with normal symmetry obtain reasonable attention weights according to the relevance of their node features, without being subject to additional adjustment by edge attributes, thus maintaining the effective modeling of conventional topological relationships by the attention mechanism.

[0067] Step 5.4 involves weighted aggregation of neighboring node features based on the target attention coefficient to obtain the topological neighborhood aggregation feature. Specifically, this includes: after calculating the target attention coefficients of all neighboring nodes of the central node, normalizing the target attention coefficients to ensure the sum of the attention coefficients of all neighboring nodes is 1, resulting in a normalized attention weight distribution. The node feature vector of each neighboring node is obtained, containing the multi-dimensional behavioral feature vector of the corresponding session and the hidden layer features after graph convolutional layer transformation. Each neighboring node's feature vector is multiplied by its corresponding normalized target attention coefficient to obtain the weighted neighbor features. The weighted features of all neighboring nodes are summed and aggregated to obtain the neighborhood aggregation feature vector of the central node. This neighborhood aggregation feature integrates the feature information of all neighbors of the central node, and through the weighting of the target attention coefficients, neighboring nodes connected by unidirectional hidden communication edges contribute more to the aggregation result, while neighboring nodes with normal symmetry contribute reasonably according to their feature relevance. Repeat the above process to calculate the neighborhood aggregation feature for each node in the dynamic traffic association graph, and finally obtain the topological neighborhood aggregation feature set of all nodes. This feature set contains both the topological structure information of the graph and the semantic information of the flow entropy asymmetry of the edges, providing a high-quality graph-level feature representation for subsequent attack type classification.

[0068] In a preferred embodiment of the present invention, the above-mentioned identification of the current attack chain stage based on the temporal change trend of the attack type probability distribution includes: Step 6.1 involves extracting the change sequence of attack type probability distribution within a continuous time sliding window and detecting silent intervals where attack type probabilities are at their lowest points in the change sequence. Specifically, this includes setting a fixed-length time sliding window, for example, a window length of 10 minutes and a sliding step of 1 minute, and continuously sliding this window during real-time monitoring of the target network. Within each time sliding window, all detected candidate abnormal sessions are collected. The attack activity time series for that time window is constructed by classifying the attack type probability distribution output by the network. The attack type probability distribution includes probability values ​​for multiple attack categories, such as DDoS attacks, port scanning, SQL injection, and malware propagation. The maximum value or weighted sum of all attack type probabilities is calculated as the overall attack activity index at that time point. As the time sliding window moves, attack activity indices at multiple consecutive time points are extracted, forming a change sequence of the attack type probability distribution. This sequence reflects the evolutionary trend of attack behavior over time. Temporal analysis is performed on the changing sequences to detect time periods where attack activity is significantly lower than the average level. Specifically, the mean and standard deviation of the changing sequences are calculated. When attack activity at several consecutive time points is lower than the mean minus one standard deviation, this time period is marked as a quiet interval where the attack type probability is at its lowest. Quiet intervals correspond to the latent phase, preparation phase, or phase transition period in the attack chain evolution process and are important temporal characteristics for identifying attack chain stages.

[0069] Step 6.2: Obtain the duration of the silent interval and calculate the ratio of this duration to a preset baseline active duration as the silent inflation ratio. Specifically, for each detected silent interval, extract the start and end timestamps, and calculate the difference between them to obtain the duration of the silent interval. This duration reflects the length of the low point in attack activity. Different types of attack chains exhibit significant differences in silent duration during phase transitions: the silent period of a fast attack chain may only be a few seconds to tens of seconds, while the silent period of an Advanced Persistent Threat (APT) may last for hours or even days. A preset baseline active duration is set, representing the typical duration of the active phase of a normal attack chain, for example, set to 5 minutes, based on historical attack chain analysis and statistics. The ratio of the duration of the silent interval to the preset baseline active duration is calculated to obtain the silent inflation ratio, which quantifies the degree of time inflation of the current silent interval relative to the normal active period. A quiescent expansion ratio greater than 1 indicates that the quiescent period lasts longer than the normal active period, potentially corresponding to a long-latent attack chain; a quiescent expansion ratio less than 1 indicates a short quiescent period, potentially corresponding to a fast attack chain. The quiescent expansion ratio provides a quantitative adjustment parameter for subsequent timeline compression.

[0070] Step 6.3: Before inputting the change sequence into the attack chain state decoding model, the scale of the silent interval on the time axis is compressed by the reciprocal of the silent expansion ratio. The current attack chain stage is identified based on the compressed time axis sequence. Specifically, this includes: to enable the attack chain state decoding model to uniformly handle attack chain evolution patterns at different time scales, a nonlinear time axis transformation is performed on the change sequence of the attack type probability distribution. The reciprocal of the silent expansion ratio is calculated as a time compression factor, which is inversely proportional to the duration of the silent interval: the longer the silent interval, the smaller the compression factor and the greater the compression; the shorter the silent interval, the larger the compression factor and the smaller the compression. For the silent interval portion in the change sequence, the scale of this interval on the time axis is compressed according to the time compression factor. Specifically, the time points within the silent interval are resampled according to the compression factor, reducing the number of time steps occupied by the silent interval in the sequence. For example, if the silent expansion ratio is 10, the compression factor is 0.1, and the silent interval, which originally occupied 100 time steps, is compressed to only 10 time steps. For active intervals in the changing sequence, the original timeline scale is kept unchanged without compression. After compression, the proportion of long silent intervals is reduced, while the proportion of active attack phases is relatively increased, making the sequence length of attack chains at different time scales more consistent, which facilitates unified temporal pattern recognition by the attack chain state decoding model. The compressed timeline sequence is input into a pre-trained attack chain state decoding model, which uses a recurrent neural network or Transformer architecture to learn the stage evolution patterns of typical attack chains, including the reconnaissance stage, weaponization stage, delivery stage, exploitation stage, installation stage, command and control stage, and target achievement stage. Based on the compressed timeline sequence, the model analyzes the current stage of the attack behavior and outputs the identification result of the current attack chain stage, such as determining that it is currently in the state of "transition from the exploitation stage to the installation stage".

[0071] In this embodiment of the invention, by employing the technique of extracting the change sequence of attack type probability distribution within a continuous time sliding window and detecting silent intervals, obtaining the duration of the silent interval and calculating the silent inflation ratio by comparing it with a preset benchmark active duration, and then compressing the time axis scale of the silent interval by the reciprocal of the silent inflation ratio before inputting it into the attack chain state decoding model to identify the current attack chain stage, this invention overcomes the technical problems of existing attack chain identification methods being unable to adapt to attack evolution patterns at different time scales, using a unified time scale for long-latency attacks and fast attacks resulting in low identification accuracy, and traditional time series models being sensitive to the uneven time distribution of the silent and active periods of the attack chain, leading to inaccurate stage determination. This achieves the technical effect of unifying the modeling of attack chains at different time scales through nonlinear compression of the time axis, eliminating the interference of silent period time inflation on stage identification, and enabling the attack chain state decoding model to accurately identify the current stage of various attack chains from fast attacks to APTs, effectively improving the accuracy and applicability of attack chain stage identification.

[0072] In a preferred embodiment of the present invention, the above-mentioned identification of high-threat propagation paths based on adjusted node weights and generation of targeted traffic blocking strategies includes: Step 7.1: In the dynamic traffic association graph, path search is performed based on the adjusted node weights to determine high-threat propagation paths. Specifically, this includes dynamically adjusting the weights of each node in the dynamic traffic association graph according to the threat level corresponding to the current attack chain stage. Nodes in high-threat stages of the attack chain (such as the exploitation stage or command and control stage) have their weights increased, while nodes in low-threat stages (such as the reconnaissance stage) have their weights decreased. Based on the adjusted node weights, a weighted path search algorithm is executed in the dynamic traffic association graph. This algorithm comprehensively considers the sum of the weights of nodes on the path and the topological length of the path. An improved Dijkstra algorithm or A* search algorithm is used to find high-weight paths from potential attack source nodes to critical asset nodes. The path score calculation formula is: Path Score = Σ(Node Weight) × Path Connectivity Coefficient, where the path connectivity coefficient reflects the topological density of the path. The Top-K paths with the highest path scores are selected as high-threat propagation paths. These paths represent the most likely propagation direction and the most dangerous diffusion channel of the attack in the network, and are the key focus of threat defense.

[0073] Step 7.2 involves obtaining the average packet arrival interval for each node along the high-threat propagation path within a historical time window. Specifically, for each identified high-threat propagation path, all nodes along that path are traversed, with each node corresponding to a candidate abnormal session. Detailed packet records for each node's corresponding session within a historical time window (e.g., the past 1 hour or 24 hours) are retrieved from the network traffic history database. The arrival timestamps of all packets for that session are extracted, arranged chronologically, and the time interval between adjacent packets is calculated to obtain a packet interval sequence. The arithmetic mean of the packet interval sequence is calculated to obtain the average packet arrival interval for that node within the historical time window. This metric reflects the normal communication frequency and traffic rate characteristics of the session. The historical average packet arrival interval provides a reference baseline based on real traffic behavior for setting parameters for subsequent rate limiting strategies, ensuring that rate limiting measures effectively block attack traffic without excessively impacting possible normal communication.

[0074] Step 7.3 calculates the token generation rate of the rate-limiting token bucket based on the average packet arrival interval. The token generation rate is negatively correlated with the average packet arrival interval. Specifically, this involves designing a targeted traffic blocking strategy using the token bucket algorithm. This algorithm limits traffic rate by controlling the token generation rate. A token generation rate calculation function is designed, establishing a negative correlation between the token generation rate and the average packet arrival interval: Token Generation Rate = α / (Average Packet Arrival Interval + β), where α is the rate scaling factor and β is a smoothing constant to prevent division by zero errors. This formula ensures that: when the average packet arrival interval is small (i.e., high historical communication frequency), the token generation rate is large, allowing a higher traffic throughput; when the average packet arrival interval is large (i.e., low historical communication frequency), the token generation rate is small, imposing stricter traffic restrictions. The rate scaling factor α can be dynamically adjusted according to the attack threat level, setting a smaller α value for high-threat propagation paths to strengthen rate limiting. The calculated token generation rate, as the core parameter of the token bucket, defines the maximum allowed traffic rate for that path node, providing a quantitative basis for refined traffic control.

[0075] Step 7.4 generates an asymmetric token bucket rate limiting policy for high-threat propagation paths based on the token generation rate. This serves as a targeted traffic blocking strategy, specifically including configuring an independent token bucket rate limiter for each node on the high-threat propagation path based on the calculated token generation rate. The parameters of the token bucket rate limiter include: token generation rate (calculated), bucket capacity (set to a multiple of the token generation rate to allow short-term burst traffic), and initial token count (initialized based on the current traffic status). The "asymmetric" characteristic of the asymmetric token bucket rate limiting policy is reflected in the fact that different nodes are configured with different token generation rates based on their historical communication behavior and current threat level, rather than using uniform rate limiting parameters; different nodes on the same path may have different rate limiting strengths, achieving fine-grained traffic control. The configured token bucket rate limiting policy is deployed to network traffic control devices or software-defined networking (SDN) controllers to perform real-time rate limiting for session traffic on high-threat propagation paths: when each data packet arrives, it attempts to obtain a token from the corresponding token bucket; if successful, the data packet is allowed to pass; if there are insufficient tokens, the data packet is discarded or delayed. This asymmetric token bucket rate limiting strategy effectively reduces the propagation rate of attack traffic without completely blocking communication, buying time for security response while minimizing the impact on potentially normal traffic, thus achieving a precise and targeted traffic blocking strategy.

[0076] In this embodiment of the invention, the technical means of using adjusted node weights to search and determine high-threat propagation paths in a dynamic traffic association graph, obtaining the historical average packet arrival interval of each node in the path, calculating the token generation rate which is negatively correlated with the average packet arrival interval, and generating an asymmetric token bucket rate limiting strategy for high-threat propagation paths as a targeted traffic blocking strategy overcomes the technical problems of existing traffic blocking methods, such as the inability to adapt to the communication characteristics of different sessions using uniform rate limiting parameters, the possibility of accidentally damaging normal traffic with simple and crude full blocking strategies, and the lack of a precise rate limiting mechanism based on attack propagation paths leading to poor defense effects. This achieves the technical effect of accurately identifying high-threat propagation paths based on attack chain stages and node weights, adaptively calculating rate limiting parameters through historical communication behavior to achieve differentiated traffic control, effectively curbing attack propagation while minimizing the impact on normal services, and significantly improving the accuracy and practicality of the traffic blocking strategy.

[0077] In a preferred embodiment of the present invention, the above-mentioned synchronous writing of novel attack samples into the incremental learning buffer includes: Step 8.1: For sessions marked as candidate anomalous sessions where the maximum attack type probability output by the classification network is lower than the confidence threshold, these sessions are identified as novel attack samples. Specifically, this involves: during real-time detection, collecting a set of all sessions marked as candidate anomalous sessions, which have deviated from the normal traffic baseline using Mahalanobis distance. For each candidate anomalous session, obtaining the attack type probability distribution output by the classification network, which contains probability values ​​for multiple known attack types. Extracting the maximum probability value from the attack type probability distribution, which represents the highest confidence level the classification network assigns to the attack type of that session. Setting a confidence threshold, such as 0.6 or 0.7, which represents the lower limit of the classification network's confidence level in judging the attack type. Comparing the maximum attack type probability with the confidence threshold: if the maximum attack type probability is lower than the confidence threshold, it indicates that the classification network's judgment of the attack type for that session is uncertain. Although the session exhibits anomalous characteristics (determined by Mahalanobis distance), it does not belong to any attack type known to the classification network, or it has mixed characteristics of multiple attack types, conforming to the characteristics of novel or variant attacks. Sessions that meet the above conditions are identified as novel attack samples. These samples represent intrusion patterns not covered by the model's current knowledge base and are an important data source for incremental learning.

[0078] Step 8.2 involves detecting whether the session containing the novel attack sample is subject to the asymmetric token bucket rate limiting policy. Specifically, for each identified novel attack sample, the corresponding session identifier information is obtained, including the source IP address, destination IP address, port number, and other five-tuple information. The coverage of the currently effective asymmetric token bucket rate limiting policy is queried; this policy configures traffic limiting rules for nodes on high-threat propagation paths. The five-tuple information of the session containing the novel attack sample is checked to see if it matches any rate limiting policy rule: if the communication endpoint (source or destination) of the session is located on a high-threat propagation path node subject to rate limiting, or if the session's traffic characteristics trigger a rate limiting rule, then the session containing the novel attack sample is determined to be subject to the asymmetric token bucket rate limiting policy; if the session is not covered by any rate limiting rule, then it is determined that the rate limiting policy is not applied. Novel attack samples that are subject to rate limiting have special characteristics: they are still detected as abnormal even under rate limiting conditions, potentially representing highly stealthy or highly adaptable attack variants that can remain active in restricted environments. These samples require special labeling to receive greater attention in incremental learning.

[0079] Step 8.3: In response to hitting the asymmetric token bucket rate limiting policy, a restricted degradation label is added to the novel attack sample, and the novel attack sample carrying the restricted degradation label is written into the incremental learning buffer. Specifically, when it is detected that the session containing the novel attack sample hits the asymmetric token bucket rate limiting policy, it is determined that the sample still exhibits abnormal behavior in a rate-limited environment, has strong environmental adaptability, or has adopted techniques to circumvent rate limiting, representing a more advanced attack variant. A special label is created for this novel attack sample, marking it as a restricted degradation label. This label indicates that the sample should receive a higher importance weight when training the incremental learning model. The restricted degradation label is a metadata attribute of the sample, encapsulated together with the sample's multidimensional behavioral feature vector, topological neighborhood aggregation features, and other data. The novel attack sample carrying the restricted degradation label is written into the incremental learning buffer, which is a first-in-first-out (FIFO) data queue specifically for storing novel attack samples used for incremental learning. For novel attack samples that do not hit the rate limiting policy, they are also written into the incremental learning buffer, but without a restricted degradation label, and are treated as regular novel attack samples. The incremental learning buffer continuously accumulates new attack samples, providing training data for subsequent model fine-tuning and enabling continuous learning of unknown attack patterns.

[0080] In this embodiment of the invention, by identifying sessions marked as candidate abnormal sessions with a probability of the largest attack type in the classification network below the confidence threshold as novel attack samples, detecting whether the session containing the novel attack sample hits the asymmetric token bucket rate limiting policy, and adding a restricted degradation label to the samples that hit the rate limiting policy before writing them into the incremental learning buffer, the technical means overcome the technical problems of existing intrusion detection systems lacking identification and learning mechanisms for unknown attack types, being unable to distinguish between regular unknown attacks and advanced variant attacks, resulting in poor incremental learning effects, and traditional incremental learning methods treating all new samples equally without distinction of importance. This achieves the technical effect of accurately identifying novel attack samples based on classification confidence, identifying highly adaptive attack variants through rate limiting policy detection and assigning special labels, providing higher quality training data with clearer distinction of importance for incremental learning, and effectively improving the learning efficiency and detection capability for unknown intrusion patterns.

[0081] In a preferred embodiment of the present invention, the above-mentioned joint parameter update of the temporal convolutional autoencoder and graph attention network includes: Step 9.1: In the gradient backpropagation phase of the model fine-tuning process, the label status of each sample in the incremental learning buffer is obtained. Specifically, this includes: when the number of samples in the incremental learning buffer reaches a trigger threshold (e.g., 100 or 500 samples), the model fine-tuning process is initiated. This process performs joint parameter updates on the temporal convolutional autoencoder and graph attention network to learn new attack patterns. New attack samples are read in batches from the incremental learning buffer to construct the incremental learning training set. In the forward propagation phase of model fine-tuning, samples from the incremental learning training set are input into the temporal convolutional autoencoder and graph attention network, and the loss function between the model output and the true label is calculated. In the gradient backpropagation phase, the gradient of the loss function with respect to the parameters of each layer of the model is calculated using the backpropagation algorithm to prepare for updating the model parameters. During gradient calculation, for each training sample, the label status of that sample is obtained, and it is checked whether the sample carries a restricted degradation label. The presence of the restricted degradation label determines the gradient weight of the sample in the parameter update, providing a basis for subsequent differentiated gradient adjustments.

[0082] Step 9.2: In response to the current sample carrying a restricted degradation label, multiply the gradient value of the current sample by a preset mutation sensitivity factor, where the mutation sensitivity factor is greater than 1. Specifically, when the current sample is detected to carry a restricted degradation label, it is determined that the sample belongs to a highly adaptive attack variant that still exhibits abnormal behavior under restricted traffic conditions, representing a more complex and covert attack pattern, and thus has higher learning value for the model. To enhance the model's learning strength for such high-value samples, the gradient value of the sample is amplified. Obtain the original gradient value calculated for the sample during gradient backpropagation; this gradient value reflects the sample's fundamental contribution to model parameter updates. Multiply the original gradient value by the preset mutation sensitivity factor, which is set to a value greater than 1, such as 1.5, 2.0, or higher. The specific value can be dynamically adjusted according to the scarcity and importance of the sample. After multiplying by the mutation sensitivity factor, the gradient value of the sample is amplified, gaining a greater influence weight in parameter updates, driving the model parameters to adjust more towards the feature patterns of the sample, and accelerating the model's learning convergence for highly adaptive attack variants.

[0083] Step 9.3, in response to the current sample not carrying a restricted degradation label, keeps the gradient value of the current sample unchanged. Specifically, when it is detected that the current sample does not carry a restricted degradation label, it is determined that the sample belongs to a conventional novel attack sample. Although it is also an unknown attack mode, it does not have the special characteristic of being active in a restricted environment, and is processed according to the standard incremental learning process. The original gradient value calculated by the sample in the gradient backpropagation remains unchanged, without any amplification or reduction adjustment, ensuring that the sample participates in the model parameter update with its true gradient contribution. This processing method not only ensures the effective learning of conventional novel attack samples, but also achieves the differentiation of sample importance in the incremental learning process through differentiated processing with samples carrying restricted degradation labels, thus optimizing the model's learning efficiency and effect.

[0084] Step 9.4 updates the parameters of the temporal convolutional autoencoder and the graph attention network based on the adjusted gradient values. Specifically, this includes: after adjusting the gradient values ​​of all training samples, summarizing the adjusted gradient values ​​of all samples, and calculating the gradient update amount of each layer's parameters. Optimization algorithms (such as Adam, SGD, etc.) are used to update the parameters of the temporal convolutional autoencoder and the graph attention network based on the adjusted gradient values. The parameter update process affects both networks simultaneously: the parameter update of the temporal convolutional autoencoder improves the reconstruction and recognition capabilities of the temporal features of novel attack traffic, enabling it to accurately identify reconstruction error patterns of novel attacks; the parameter update of the graph attention network optimizes the extraction capabilities of novel attack topology propagation features, enhancing the recognition of novel attack association patterns. Through joint parameter updates, the two networks collaboratively learn the multidimensional features of novel attacks, achieving continuous adaptive detection of unknown intrusion patterns. After the parameter update is completed, the incremental learning buffer is cleared or partially cleared to prepare storage space for the next round of incremental learning, while retaining the new parameters after model fine-tuning. This enables the detection system to recognize newly learned attack patterns, achieving continuous evolution of detection capabilities.

[0085] In this embodiment of the invention, by acquiring the label status of each sample in the incremental learning buffer during the gradient backpropagation stage of the model fine-tuning process, multiplying the gradient value of samples carrying restricted downgrade labels by a mutation sensitivity factor greater than 1, and keeping the gradient value unchanged for samples without labels, and jointly updating the parameters of the temporal convolutional autoencoder and graph attention network based on the adjusted gradient values, the technical problems of existing incremental learning methods—such as using uniform learning weights for all new samples, failing to highlight the learning of high-value samples leading to insufficient learning of complex attack variants, and the lack of a sample importance differentiation mechanism in traditional parameter update methods affecting the efficiency of incremental learning—are overcome. This achieves the technical effect of realizing sample importance-driven incremental learning through differentiated gradient adjustment, assigning higher learning weights to highly adaptive attack variants to accelerate the model's adaptation speed to complex unknown attacks, effectively improving the efficiency and quality of incremental learning, and realizing the technical effect of rapid and continuous adaptive detection capability for unknown intrusion patterns.

[0086] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

[0087] It should be noted that all formulas in this manual are calculated by removing dimensions and taking their numerical values. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0088] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

Claims

1. A network intrusion detection method based on deep learning, characterized in that, include: Real-time traffic data of each node in the target network is collected, and a multi-dimensional behavioral feature vector of each network session is extracted from the real-time traffic data. The multi-dimensional behavioral feature vector includes connection duration, load entropy value, protocol anomaly rate and retransmission ratio. The multidimensional behavioral feature vector is input into a pre-trained temporal convolutional autoencoder to calculate the reconstruction error of each network session, and a baseline distribution manifold of normal traffic is constructed based on the reconstruction error. Calculate the Mahalanobis distance of real-time traffic sessions that deviate from the baseline distribution manifold, and mark sessions whose Mahalanobis distance exceeds a dynamic threshold as candidate abnormal sessions; A dynamic traffic association graph is constructed for the candidate abnormal sessions. A graph attention network is used to extract the topological neighborhood aggregation features of the dynamic traffic association graph. The topological neighborhood aggregation features are then fused with the multidimensional behavior feature vector and input into a classification network to output the attack type probability distribution. The current attack chain stage is identified based on the temporal variation trend of the attack type probability distribution, and the node weights of the graph attention network are dynamically adjusted according to the threat level corresponding to the attack chain stage. High-threat propagation paths are identified based on the adjusted node weights, targeted traffic blocking strategies are generated, and new attack samples are synchronously written into the incremental learning buffer. When the number of samples in the incremental learning buffer reaches the trigger threshold, the model fine-tuning process is initiated to jointly update the parameters of the temporal convolutional autoencoder and the graph attention network, thereby achieving continuous adaptive detection of unknown intrusion patterns.

2. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The extraction of the multi-dimensional behavioral feature vector for each network session from the real-time traffic data includes: When extracting the retransmission ratio, the timestamp sequence of the retransmitted data packets is obtained, and the abnormal time window in which the protocol anomaly rate suddenly increases is extracted. In response to the presence of a target timestamp falling within the abnormal time window in the timestamp sequence of the retransmitted data packet, it is determined that the retransmission ratio is caused by a protocol anomaly, and the original value of the retransmission ratio in the multidimensional behavioral feature vector is retained. If the timestamp sequence of the retransmitted data packets does not fall within the abnormal time window, and the retransmitted data packets are concentrated in the tail interval of the connection duration of the network session, it is determined that the retransmission ratio is caused by network jitter, and the retransmission ratio in the multidimensional behavioral feature vector is set to zero.

3. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The step of inputting the multidimensional behavioral feature vector into a pre-trained temporal convolutional autoencoder and calculating the reconstruction error of each network session includes: Obtain the minimum receptive field length of the temporal convolutional autoencoder, and compare the sequence length of the network session with the minimum receptive field length; In response to the sequence length being less than the minimum receptive field length, the difference between the minimum receptive field length and the sequence length is determined as the padding missing amount; Extract a sequence of historical normal data packets that are located before the start time of the network session and have a length equal to the padding gap from the historical traffic records of the network session. The historical normal data packet sequence is concatenated into the header of the network session for loop-filling, and the filled network session is input into the temporal convolutional autoencoder to calculate the reconstruction error.

4. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The calculation of the Mahalanobis distance between the real-time traffic session and the baseline distribution manifold includes: Obtain the normal flow sample covariance matrix used to construct the baseline distribution manifold, and construct a Gram matrix composed of the multidimensional behavioral feature vectors based on the dimensions of the multidimensional behavioral feature vectors; Calculate the condition number of the Gram matrix and compare the condition number with a preset collinearity threshold; In response to the condition number being greater than the preset collinearity threshold, it is determined that there is high collinearity among the multidimensional behavioral feature vectors. A damping coefficient positively correlated with the condition number is applied to the diagonal elements of the covariance matrix for regularization. The Mahalanobis distance is calculated based on the regularized covariance matrix. In response to the condition number being less than or equal to the preset collinearity threshold, the Mahalanobis distance is calculated based on the original covariance matrix.

5. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The construction of a dynamic traffic correlation graph for the candidate abnormal sessions includes: Using the candidate abnormal sessions as nodes and the network interaction relationships between the candidate abnormal sessions as edges, an initial association graph is constructed. For each edge in the initial association graph, obtain the source payload entropy value emitted by the source node connected to the edge and the destination payload entropy value returned by the destination node; Calculate the absolute value of the difference between the source load entropy value and the destination load entropy value, and determine the absolute value of the difference as the flow entropy asymmetry of the edge. Add the flow entropy asymmetry as the edge attribute of the edge to the initial association graph to generate the dynamic flow association graph.

6. The network intrusion detection method based on deep learning as described in claim 5, characterized in that, The extraction of topological neighborhood aggregation features of the dynamic traffic association graph using a graph attention network includes: During the calculation of the attention coefficients in the graph attention network, the flow entropy asymmetry of the target edge between the current neighbor node to be calculated and the center node is obtained; In response to the flow entropy asymmetry being greater than a preset asymmetry threshold, the target edge is determined to be a one-way covert communication edge. The initial attention coefficient of the graph attention network is multiplied by a covert amplification factor greater than 1 to obtain the target attention coefficient. In response to the flow entropy asymmetry being less than or equal to the preset asymmetry threshold, the initial attention coefficient is retained as the target attention coefficient; The topological neighborhood aggregation features are obtained by weighting and aggregating the features of neighboring nodes based on the target attention coefficient.

7. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The step of identifying the current attack chain stage based on the temporal variation trend of the attack type probability distribution includes: Extract the change sequence of the attack type probability distribution within a continuous time sliding window, and detect the silent interval where the attack type probability is at a low point in the change sequence; The duration of the silent interval is obtained, and the ratio of the duration to the preset baseline active duration is calculated as the silent expansion ratio. Before inputting the change sequence into the attack chain state decoding model, the scale of the silent interval on the time axis is compressed according to the reciprocal of the silent expansion ratio, and the current attack chain stage is identified based on the compressed time axis sequence.

8. The network intrusion detection method based on deep learning as described in claim 1, characterized in that, The process of identifying high-threat propagation paths based on adjusted node weights and generating targeted traffic blocking strategies includes: In the dynamic traffic association graph, path search is performed based on the adjusted node weights to determine the high-threat propagation path; Obtain the average packet arrival interval of each node on the high-threat propagation path within a historical time window; The token generation rate of the rate-limiting token bucket is calculated based on the average packet arrival interval, wherein the token generation rate is negatively correlated with the average packet arrival interval; An asymmetric token bucket rate limiting strategy is generated based on the token generation rate to target the high-threat propagation path, serving as the targeted traffic blocking strategy.

9. The network intrusion detection method based on deep learning as described in claim 8, characterized in that, The step of synchronously writing new attack samples into the incremental learning buffer includes: For sessions that are marked as candidate anomalous sessions and whose maximum attack type probability output by the classification network is lower than the confidence threshold, they are identified as novel attack samples. Detect whether the session containing the novel attack sample is subject to the asymmetric token bucket rate limiting policy; In response to the hit of the asymmetric token bucket rate limiting policy, a restricted degradation label is added to the novel attack sample, and the novel attack sample carrying the restricted degradation label is written into the incremental learning buffer.

10. A network intrusion detection method based on deep learning as described in claim 9, characterized in that, The joint parameter update of the temporal convolutional autoencoder and the graph attention network includes: During the gradient backpropagation stage of the model fine-tuning process, the label state of each sample in the incremental learning buffer is obtained. In response to the current sample carrying the restricted degradation label, the gradient value of the current sample is multiplied by a preset mutation sensitivity factor; In response to the current sample not carrying the restricted degradation label, the gradient value of the current sample remains unchanged; The parameters of the temporal convolutional autoencoder and the graph attention network are updated based on the adjusted gradient values.

Images