The invention discloses a network penetration identification method based on interactive behavior analysis, and the method comprises the steps: employing a Seek 
client to collect the interactive behavior data of a 
honeypot machine as an analysis object, carrying out 
feature extraction and cleaning, feature classification and 
feature coding on collected data to form a feature sequence; according tothe characteristic that an interactive behavior 
characteristic sequence has uncertain length and 
time sequence, adopting an LSTM model as an 
attack recognition classifier, analyzing an 
activation function, a 
loss function and a 
gradient descent algorithm respectively, selecting an appropriate model to be used as the model, and then optimizing a training model through multiple times of hyper-parameter parameter adjustment. Modeling is carried out according to the 
time sequence of capturing behavior data features, the features are screened to reduce the 
feature dimension, and the training speedand precision of the model are improved through 
feature coding. Through repeated parameter tuning training, the penetration 
attack identification accuracy and the 
false alarm rate of the model are obviously superior to those of other models.