Network intrusion detection method and device

The embodiment of the invention provides a network intrusion detection method and device, and the method comprises the steps: obtaining network flow, extracting session statistical characteristics and data packet characteristics from the network flow, inputting the session statistical characteristics into at least one pre-constructed first-class detection model, outputting a corresponding prediction result through each first-class detection model, and outputting a prediction result through the corresponding prediction result. And inputting the data packet features into at least one pre-constructed second-class detection model, outputting a corresponding prediction result by each second-class detection model, and obtaining a final prediction result through weighted voting based on the prediction result and the corresponding weight of each first-class detection model and the prediction result and the corresponding weight of each second-class detection model. By selecting a plurality of optimal models and relate