Network security policy AI autonomous defense method and system based on security ontology modeling

Abstract

The invention belongs to the technical field of network information security, and particularly relates to a network security policy AI autonomous defense method and system based on security ontology modeling, and the method comprises the steps: constructing a security ontology for attack early warning and defense policy selection through integrating multi-source heterogeneous knowledge; collecting network data traffic in real time, performing attack early-warning detection on the network data traffic based on the security ontology, and obtaining a corresponding defense strategy according to a security means required by the detected early-warning attack; in the limited rationality range of time, cognition and information, network security and protection candidate planning schemes are generated according to the defense strategy and by means of the search tree, the optimal planning scheme is selected from the candidate planning schemes, and autonomous defense is achieved through scheme execution. According to the method, under the conditions of high constraint of computing resources and dynamic asset environment, autonomous defense is realized by using bounded rationality and AI planning, and efficient early warning can be provided for active defense at the early stage of attack.

Description

technical field [0001] The invention belongs to the technical field of network information security, and in particular relates to a network security policy AI autonomous defense method and system based on security ontology modeling. Background technique [0002] Attacks in cyberspace pose a great threat to enterprises and organizations. The attack threshold is low, and the attack time is random and short. The key to reducing losses lies in efficient early warning and rapid implementation of targeted security defense measures. The traditional network security system is usually built simultaneously with the network information system, and it is difficult to adapt to the rapid evolution of attack methods and behaviors. When dealing with highly automated and intelligent attacks, the limitations of this relatively static security defense model are particularly obvious. The overall performance is passive defense and inefficient early warning. Under the limited time, cognition and ...

AI Technical Summary

Problems solved by technology

The traditional network security system is usually built simultaneously with the network information system, and it is difficult to adapt to the rapid evolution of attack methods and behaviors. When dealing with highly automated and intelligent attacks, the limitations of this relatively static security defense model are particularly obvious

The overall performance is passive defense and inefficient early warning. Under the limited time, cognition and information conditions of network security scenarios, the effectiveness of security defense is difficult to guarantee

Images