Current network intrusion detection systems struggle with feature representation, unknown attack detection, and coordinated response. This paper proposes an intelligent system that fuses NetFlow and payload features, employs a three-level detection engine (deep autoencoder, Transformer, GNN), and integrates with softwaredefined networking for real-time mitigation and adaptive feedback-driven model improvement. Experiments on a mixed dataset combining the CIC-IDS2018 and UNSW-NB15 show a detection rate of 98.7%, a false positive rate of 0.86%, and an average detection rate of 87.04% for unknown attacks, with real-time interception success reaching 99%.
Huang Nana (Fri,) studied this question.