Mass Estimation and Protection of Network Security Using Inception‐<scp>LSTM</scp> and Bayesian Attack Behavior Correlation

ABSTRACT The purpose of this study is to design an efficient network flow collection system and propose an intelligent model for network traffic anomaly detection, aimed at improving the accuracy of network attack detection and enhancing the security situation assessment in complex network environments. We developed a high‐concurrency large‐flow data collection architecture using a thread pool approach, which addresses issues such as user state memory depletion and packet loss during high‐traffic packet capture. Network traffic anomaly detection and security status assessment are critical aspects of securing modern communication systems, particularly as cyber threats continue to evolve in complexity and scale. This study aims to provide a comprehensive framework that not only identifies anomalies in network traffic but also correlates these anomalies with potential security breaches using a combination of Inception‐Long Short‐Term Memory (LSTM) and Bayesian models, further enhancing the detection and protection mechanisms within the domain of network security. The proposed model demonstrated superior performance in terms of accuracy, precision, recall, and F1 score compared with existing models. Specifically, it achieved a 9.2% higher accuracy than the Convolutional Neural Network (CNN) model, a 10% improvement over the LSTM model, and a 3.3% increase over the CNN + LSTM model. Furthermore, the security situation assessment model, based on Hidden Markov and scalable SSIPN, accurately reflects the influence of network topology and node vulnerabilities, providing a more comprehensive view of security threats. This research introduces novel techniques for network traffic anomaly detection and security situation assessment, combining Inception‐LSTM networks with Bayesian correlation modeling. It also proposes a scalable SSIPN for evaluating security dynamics, integrating network topology and node vulnerabilities into a unified assessment framework, which significantly enhances the overall accuracy and reliability of the system.