The application relates to the technical field of
network security detection, and discloses a network
transmission protocol intrusion detection method and
system. The method comprises the following steps: collecting network
transmission protocol data streams, extracting packet header features and
payload features, and integrating to form an original
feature set; classifying the original
feature set according to protocol types, dividing different protocol clusters and marking corresponding identifiers; constructing a
dynamic feature filter based on the protocol cluster identifiers, screening a feature subset associated with the current protocol cluster from the original
feature set; inputting the feature subset into a protocol state analysis model, outputting a protocol
state vector and an abnormal behavior probability distribution from the model; generating an intrusion detection result according to the two, and triggering a corresponding defense response instruction. Through protocol cluster classification and
dynamic feature screening, the method adapts to different protocol characteristics, realizes accurate identification of protocol intrusion behaviors, and can be applied to various scenes relying on network transmission protocols.