A Dynamic Hidden State Correction and Feedback-Driven Online Adaptation Framework for Network Intrusion Detection

This paper proposes a novel intrusion detection system based on human-machine collaboration, employing Long Short-Term Memory (LSTM) networks to address the issues of delayed rule updates in traditional methods and the poor interpretability of deep learning models. We introduce two innovative methods: Expert-Guided Latent State Adjustment (ELSA) and Feedback-Driven Online Threshold Adaptation and Memory Reconstruction (OTAR). ELSA leverages an expert-constructed rule base, using similarity measures to trigger targeted corrections to the hidden states of the LSTM model, enhancing the model's ability to recognize known threat patterns. OTAR dynamically adjusts the decision threshold and fine-tunes the internal memory parameters of the LSTM model through an online learning mechanism based on real-time feedback from human experts, enabling rapid adaptation to new threats. Experimental results on the CICIDS2017 dataset show that the proposed method achieves significant improvements in detection accuracy and F1-score compared to existing methods, demonstrating stronger robustness, especially in detecting new types of attacks.