The invention belongs to the technical field of
network security, and particularly relates to a continuous
learning network intrusion detection method and
system based on
gradient projection and
concept drift detection. The problems of serious
concept drift, disastrous forgetting, new and old knowledge gradient interference and the like of an existing
intrusion detection system in a dynamic network environment are solved, network flow data flow is monitored in real time, variance fluctuation of feature dimensions is monitored through a
drift detection module based on
principal component analysis (PCA), and unsupervised identification of distribution offset is achieved; a strategic
sample selection and forgetting mechanism is adopted, a memory buffer area is optimized based on KL
divergence, and balanced learning of normal traffic and an evolution abnormal mode is achieved under
limited resources; a
gradient projection mechanism (GPM) is introduced in a model
fine tuning stage, and a parameter updating direction of a new task is limited in an
orthogonal complement space of historical knowledge by constructing an
orthogonal basis of a historical feature subspace, so that destructive interference between tasks is eliminated on a gradient level.