A network security situation awareness method based on artificial intelligence

Abstract

The present invention relates to the field of artificial intelligence technology, and discloses a network security situation awareness method based on artificial intelligence, including obtaining network security data; using a fully connected neural network based on dynamic population evolution optimization to extract features from network security data to obtain a first feature; using an autoencoder neural network based on contrast entropy to reduce the first feature to obtain a second feature; using a fractional-order neural network based on complexity perception to construct a classifier model, and using the second feature to train the classifier model; and using the trained classifier model to classify network security situation awareness. The present invention improves the ability to distinguish complex network security situations, can achieve more accurate classification effects, and enhances the applicability of the model in network security data and the accuracy of classification.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a network security situation awareness method based on artificial intelligence. Background Art

[0002] As network attacks become increasingly complex, network security situational awareness has become an important technical means to ensure the security of information systems. Traditional network security protection technologies, such as intrusion detection and firewalls, can detect and defend against known threats, but they often fail to provide comprehensive and effective protection when facing diverse and advanced network threats. Especially with the rapid growth of network data traffic and the variability of network attack patterns, how to accurately extract key features from massive data and timely perceive potential threats has become a core problem in the field of network security.

[0003] The Chinese invention patent with application number CN202410787133.1 proposes a network security threat analysis method based on machine learning, which relates to the field of network security technology. The network security threat analysis method based on machine learning improves data quality through comprehensive data collection and preprocessing; enhances the performance of the model through feature screening and dimensionality reduction; generates robust thresholds through multiple deductions and integrations, providing an accurate benchmark for threat detection in practical applications; improves the agility and accuracy of the method through real-time risk assessment and threat judgment, improves the prediction accuracy and robustness of the model through refined median calculation and center difference calculation, dynamic weight adjustment and data-driven threshold setting, and comprehensively considers the threshold calculation method of the center value and the degree of discreteness, so that this method can more accurately and efficiently identify and respond to various security threats when facing a complex and changeable network environment.

[0004] The Chinese invention patent with application number CN202410713620.3 proposes a network security assessment method based on machine learning, which involves the field of network security technology. It collects computer security data, constructs a traffic transformation curve based on the obtained security data, obtains abnormal traffic, decomposes the security data, and obtains abnormal communication protocols; issues security alerts for the obtained abnormal traffic and abnormal communication protocols, and performs security repairs on the obtained abnormal traffic and abnormal communication protocols based on the security alerts; obtains the repair completion degree based on the obtained security alerts and security repairs, and rates the repair completion degree to obtain the repair completion level; it can continuously improve network security, protect and upgrade network security weaknesses, help to identify malicious attacks in a timely manner, and take corresponding measures to repair malicious attacks, improve the security of network systems, and effectively respond to changing network risks.

[0005] The Chinese invention patent with application number CN202211125068.3 proposes a network security situation prediction system and method, which includes a data storage module, a virtual machine module, a virtual attack module, a situation prediction module, and a control center. The data storage module is connected to the virtual attack module, the situation prediction module is connected to the data storage module, the virtual attack module is connected to the virtual machine module, the virtual machine module is connected to the data storage module, and the data storage module, the virtual machine module, the virtual machine module, the virtual attack module, and the situation prediction module are respectively connected to the control center. The present application also discloses a network security situation prediction system and method. The network security situation prediction system and method of the present application can comprehensively obtain the current network security situation analysis results, and conduct a comprehensive analysis of various network attacks to ensure the reliability of the network security situation analysis and the availability of the analysis results.

[0006] The existing technology has the following problems that still need to be further solved:

[0007] 1. Existing technologies usually rely on traditional data enhancement methods for data expansion, which cannot effectively generate diversified and high-dimensional network security data, resulting in data scarcity and single sample distribution, which in turn affects the generalization ability of the model.

[0008] 2. In feature extraction, most methods use a fixed neural network structure and lack a dynamic optimization mechanism, which is prone to gradient vanishing or gradient exploding, affecting the stability and training efficiency of the model during training.

[0009] 3. Existing feature dimensionality reduction methods do not fully consider the nonlinear structure of high-dimensional data, resulting in the lack of real structural information of the data in the features after dimensionality reduction, resulting in poor dimensionality reduction effect and insufficient robustness.

[0010] 4. Most existing neural networks lack adaptive adjustment mechanisms, making it difficult to cope with complex and diverse network security data. They have low feature sensitivity and limited classification accuracy. Summary of the invention

[0011] In view of the above-mentioned deficiencies in the prior art, the present invention provides a network security situation awareness method based on artificial intelligence.

[0012] In order to achieve the above-mentioned object of the invention, the technical solution adopted by the present invention is:

[0013] A network security situation awareness method based on artificial intelligence includes the following steps:

[0014] Obtain cybersecurity data;

[0015] A fully connected neural network based on dynamic population evolution optimization is used to extract features from network security data to obtain the first feature;

[0016] The first feature is reduced in dimension by using an autoencoder neural network based on contrast entropy to obtain the second feature;

[0017] A complexity-aware fractional-order neural network is used to construct a classifier model, and the second feature is used to train the classifier model.

[0018] Use the trained classifier model to perform network security situation awareness classification.

[0019] Preferably, a fully connected neural network based on dynamic population evolution optimization is used to extract features from network security data to obtain a first feature, including:

[0020] Initialize the population;

[0021] For each individual in the population, calculate the loss of the corresponding neural network;

[0022] According to the loss of the neural network corresponding to the individual, the best individual is selected from the current population for retention;

[0023] Generate new individuals through crossover and mutation operations on the selected individuals; the crossover operation randomly selects two individuals for gene exchange, and the mutation operation randomly perturbs the weights of the newly generated individuals;

[0024] Repeat the above steps until the preset stop iteration condition is met.

[0025] Preferably, the best individual is selected from the current population for retention according to the loss of the neural network corresponding to the individual, specifically:

[0026]

[0027] in, For the The probability of an individual being selected; Parameters for controlling selected pressure; For the Each individual corresponds to the loss of the neural network; is the population size.

[0028] Preferably, an autoencoder neural network based on contrast entropy is used to perform feature dimension reduction on the first feature to obtain the second feature, including:

[0029] Initialize the parameters of the autoencoder network;

[0030] Forward propagation of the first feature through the encoding layer;

[0031] After the output features of the encoding layer are represented by dimensionality reduction through the hidden layer, the current dimensionality reduction effect is evaluated through a dynamic feedback mechanism, and the parameters of the decoding layer are adjusted according to the evaluation results;

[0032] The output features of the hidden layer are used to calculate the contrast entropy between the output features of the decoding layer and the input features of the encoding layer through the decoding layer;

[0033] According to the calculation results of contrast entropy and reconstruction error, the gradient descent method is used to update the network parameters;

[0034] Repeat the above steps until the preset stop iteration condition is met.

[0035] Preferably, the network parameters are updated using the gradient descent method according to the calculation results of the contrast entropy and the reconstruction error, specifically:

[0036]

[0037]

[0038]

[0039]

[0040] in, is the weight gradient of the encoder, is the encoder bias gradient, For the comparison entropy, is the weight of the encoder, is the regularization parameter of the encoder, is the reconstruction error of the autoencoder, is the L2 norm, is the encoder bias, is the learning rate of the encoder at the tth iteration, is the updated encoder weight, is the updated encoder offset.

[0041] Preferably, the network parameters are updated using a gradient descent method according to the calculation result of the contrast entropy and the reconstruction error, further comprising:

[0042] The dynamic learning rate adaptive adjustment mechanism is used to dynamically adjust the learning rate based on the reconstruction error of the network in each iteration, which is expressed as:

[0043]

[0044] in, is the error response function; is a positive parameter that controls the steepness of the response curve; is the set error threshold; is the reconstruction error of the autoencoder.

[0045] Preferably, a classifier model is constructed using a complexity-aware fractional-order neural network, and the classifier model is trained using the second feature, including:

[0046] Initialize the parameters of the fractional neural network;

[0047] Process the second feature through the fractional-order activation function of each layer in the fractional-order neural network;

[0048] Adopt adaptive feature weight adjustment mechanism to automatically adjust corresponding weights according to the importance of features;

[0049] The cross entropy loss function is used to evaluate the classification performance, and the regularization term is used to sparse the parameters of the fractional-order neural network;

[0050] According to the calculation results of the loss function, all parameters in the network are updated using the gradient descent method;

[0051] According to the gradient of the weight and bias of the fractional-order neural network, the network parameters of the fractional-order neural network are updated;

[0052] Repeat the above steps until the preset stop iteration condition is met.

[0053] Preferably, an adaptive feature weight adjustment mechanism is used to automatically adjust the corresponding weight according to the importance of the feature, which is expressed as:

[0054]

[0055] in, is the feature adaptive weight, is the learning rate parameter of the feature adaptive weight, is the loss function About input features The partial derivative of .

[0056] Preferably, obtaining network security data further includes:

[0057] A generative adversarial network based on high-dimensional manifold is used to augment network security data.

[0058] Preferably, using a generative adversarial network based on a self-repair strategy to expand the acquired data includes:

[0059] Initialize the parameters of the generative adversarial network;

[0060] The generator receives the random noise signal as input and generates a batch of simulated network security data samples according to the current network parameters;

[0061] The discriminator is used to simultaneously receive fake samples from the generator and actual real samples, identify real samples and generated samples, and calculate the loss function of the discriminator;

[0062] Adopting an adaptive adversarial regularization strategy to generate adversarial samples with perturbations during the training of generative adversarial networks;

[0063] Train the generator based on the feedback from the discriminator and calculate the loss function of the generator;

[0064] The encoder of the variational autoencoder is used to learn the conditional distribution of the potential representation from samples of real network security data to form the encoder of the conditional generative network variational autoencoder;

[0065] During each iteration, the parameters of the generator and discriminator are fine-tuned, and the momentum term is used to update the parameters of the generator and discriminator.

[0066] Repeat the above steps until the preset stop iteration condition is met.

[0067] The present invention has the following beneficial effects:

[0068] 1. The present invention increases the diversity of training data sets, alleviates the problem of data scarcity, and enhances the generalization ability of the model in dealing with diverse network security situations by generating a sample generation mechanism of the adversarial network.

[0069] 2. The dynamic population evolution optimization feature extraction model adopted in the present invention ensures the accurate extraction of network security data features, effectively reduces the gradient vanishing and overfitting problems in model training, and improves the stability and efficiency of the training process.

[0070] 3. The contrast entropy constrained autoencoder used in the present invention realizes the effective dimensionality reduction of high-dimensional network security data features, ensuring that the features after dimensionality reduction have higher robustness and high efficiency of model training while retaining the data structure.

[0071] 4. The fractional-order neural network classifier model adopted in the present invention improves the ability to distinguish complex network security situations, can achieve more accurate classification effects, and enhances the applicability of the model in network security data and the accuracy of classification. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 The figure is a flowchart of a network security situation awareness method based on artificial intelligence. DETAILED DESCRIPTION

[0073] The specific implementation modes of the present invention are described below so that those skilled in the art can understand the present invention. However, it should be clear that the present invention is not limited to the scope of the specific implementation modes. For those of ordinary skill in the art, as long as various changes are within the spirit and scope of the present invention as defined and determined by the attached claims, these changes are obvious, and all inventions and creations utilizing the concept of the present invention are protected.

[0074] like Figure 1 As shown, the embodiment of the present invention provides a network security situation awareness method based on artificial intelligence, comprising the following steps S1 to S5:

[0075] S1. Obtain network security data;

[0076] In an optional embodiment of the present invention, network security data collection is derived from multi-source network traffic and system logs, using real-time monitoring and batch import methods. The collected network traffic includes but is not limited to HTTP requests, DNS queries, and mail exchange records, and the system logs cover operating system events, application events, and security events.

[0077] All network security data is pre-processed and stored in a distributed file system in a structured format, formatted as JSON;

[0078] Attributes of cybersecurity data include:

[0079] Ra (request type), indicating the type of network request, such as GET or POST; Ba (byte size), representing the byte size of network security data transmission; Ca (connection status), showing the status of connection success or failure; Da (destination IP address), recording the destination IP address of the network security data request; Ea (source IP address), recording the source IP address of the request; Fa (session duration), the duration of the network session; Ga (response code), the response code of the HTTP request; Ha (protocol type), the network protocol used, such as TCP or UDP; Ia (port number), the network port number involved; Ja (payload characteristics), describing the characteristics of the network security data packet payload.

[0080] It should be noted that this embodiment only illustrates a network security data format and type of the present invention. In actual applications, the attributes of network security data are usually more than 10 attributes, and the number of network security data attributes may reach dozens or even hundreds.

[0081] Furthermore, the collected network security data is labeled. The labeling method of the present invention is manual labeling. In one embodiment, the labeled categories include: normal behavior, DDoS attack, intrusion attempt, malware propagation and network security data leakage.

[0082] It is understandable that in the task of the present invention, the collection, acquisition, labeling and preprocessing of network security training data are time-consuming and labor-intensive, and insufficient training samples can easily lead to poor generalization of the model and affect the accuracy of the model. The present invention uses a generative adversarial network algorithm based on high-dimensional manifolds to generate samples to effectively simulate and generate high-dimensional distribution of network security data.

[0083] The generative adversarial network includes a generator and a discriminator, wherein the generator is responsible for generating samples of network security data that are as realistic as possible, and the discriminator attempts to distinguish between real samples and generated samples;

[0084] Based on the traditional generative adversarial network, the present invention adopts a robust learning mechanism under quantization perturbation and enhances the generalization ability and robustness of the model by using noise interference.

[0085] Specifically, the training process of the generative adversarial network algorithm based on high-dimensional manifold is as follows:

[0086] S101, initializing the parameters of the generative adversarial network. The network parameters of the generator and the discriminator are initialized by small random numbers. In one embodiment, the initialization method is expressed as:

[0087]

[0088]

[0089] In the formula, Represents the parameters of the generator, including weights and bias parameters; Represents the parameters of the discriminator, including weights and bias parameters; Indicates compliance with a specific distribution; represents a normal distribution with a mean of 0 and a variance of 0.01; Represents a normal distribution.

[0090] S102, the generator receives the random noise signal as input, and generates a batch of simulated network security data samples according to the current network parameters, which are expressed as:

[0091]

[0092] In the formula, The noise input to the generator; is the generator network, represents a generator function; To generate samples.

[0093] S103, the discriminator receives the fake samples from the generator and the actual real samples at the same time. The task of the discriminator is to correctly identify the real samples and the generated samples. The present invention adopts gradient penalty to improve the training stability of the model and avoid overfitting, so as to enhance the sensitivity of the discriminator to small changes in input, thereby improving its ability to distinguish between real and generated samples. The calculation method of the loss function of the discriminator is expressed as:

[0094]

[0095] In the formula, is the discriminator network; is the discriminator function; is a real sample; To generate samples; express expectations; is the gradient penalty coefficient, Represents the gradient of the discriminator output with respect to the input; Represents the input of the discriminator, which may be a real sample or a generated sample; is the L2 norm; is the loss function of the discriminator. Preferably, Set to 0.3.

[0096] S104. Adopting an adaptive adversarial regularization strategy to automatically adjust the impact of adversarial samples during the training process of the generative adversarial network, the adaptability of the model to the changing network security data characteristics in the adversarial network attack is improved by dynamically adjusting the generation intensity of adversarial samples. The adversarial samples are generated by adding disturbances. The implementation method is expressed as:

[0097]

[0098] In the formula, is the fixed disturbance intensity, indicating the magnitude of the disturbance; Represents the gradient of the generated sample, which is used to generate adversarial perturbations; represents adversarial examples; represents the loss function of the discriminator whose input is the generated sample; is a symbolic function.

[0099] Furthermore, in order to enhance the robustness of the generated samples, the calculation method of the perturbation intensity is expressed as:

[0100]

[0101] In the formula, is the baseline value of the perturbation intensity; Indicates the current iteration number; is the total number of iterations of generative adversarial network training; is a constant that adjusts the growth rate of the perturbation intensity, so that the perturbation intensity gradually increases with the training process; is the hyperbolic tangent function.

[0102] S105. The training of the generator is carried out through the feedback of the discriminator. The generator attempts to deceive the discriminator so that it judges the generated fake samples as real samples. By adjusting the parameters of the generator, the fidelity of the samples of the network security data generated by it is enhanced. The present invention adopts a regularization term to improve the quality of the generated network security data, which not only helps to generate more realistic samples, but also prevents the generated network from converging to the local minimum too early. The calculation method of the loss function of the generator is expressed as:

[0103]

[0104] In the formula, is the regularization coefficient of the generator, which controls the model complexity by adding the weight decay term; is the loss function of the generator; represents the KL divergence function; Represents the prior distribution of the noise at the generator input; is the generator loss function considering adversarial examples. Preferably, Set to 0.2.

[0105] Furthermore, the calculation method of the generator loss function considering the adversarial sample is expressed as:

[0106]

[0107] In the formula, Represents adversarial examples.

[0108] S106. The conditional constraint strategy based on the variational autoencoder can not only generate high-quality network security data, but also ensure the diversity of the generated network security data and the relevance of the specific security situation through conditional constraints, thereby enhancing the training and adaptability of the model under specific network security threats. Specifically, the variational autoencoder allows the network security data generation process to be guided by conditional constraints, so that the generated network security data is not only diversified but also targeted. The encoder of the variational autoencoder is responsible for the conditional distribution of the potential representation learned from the sample of the real network security data, and the design method of the encoder of the conditional generation network variational autoencoder is expressed as:

[0109]

[0110] In the formula, represents the encoder parameters of the variational autoencoder; It is the mean function mapped from real network security data; It is the variance function mapped from real cybersecurity data, ensuring that the generated latent representation can accurately reflect the characteristics of the input cybersecurity data.

[0111] S107. In the iterative process, the parameters of the generator and the discriminator are fine-tuned in each round of iteration to gradually improve the quality of the generated network security data and the discriminant ability of the discriminator. The momentum term is used to update the parameters to avoid falling into the local minimum. The parameter update method of the generator and the discriminator is expressed as:

[0112]

[0113]

[0114] In the formula, and are the learning rates of the discriminator and the generator respectively; and Represent the gradients of the parameters of the discriminator and generator respectively; and are the parameters of the updated discriminator and generator respectively; and They are the momentum coefficients for updating the discriminator and generator parameters of the current iteration respectively; and are the momentum coefficients of the discriminator and generator parameter updates of the previous iteration respectively. Preferably, the momentum coefficient of the parameter update is set by a simulated annealing algorithm to achieve the purpose of gradually reducing it during the training process, avoiding large fluctuations in the later stage of model training, and accelerating the convergence speed. Preferably, Set to 0.001, Set to 0.005.

[0115] S108, repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations, preferably, the preset maximum number of iterations is set to 1000 times.

[0116] After the network security data expansion model training is completed, the trained network security data expansion model is used to increase the number of samples. In one embodiment, assuming that the original collected samples are 800, and the network security data expansion model expands and generates 200 samples, the expanded network security data set contains 1000 samples.

[0117] This embodiment uses a high-dimensional manifold generative adversarial network algorithm to expand network security data, effectively simulates and generates a high-dimensional distribution of network security data, improves the diversity and authenticity of model samples, and solves the problem that insufficient data affects the generalization ability of the model. Through the sample generation mechanism of the generative adversarial network, the diversity of the training data set is increased, the problem of data scarcity is alleviated, and the generalization ability of the model in dealing with diverse network security situations is enhanced.

[0118] S2. Using a fully connected neural network based on dynamic population evolution optimization to extract features from network security data to obtain the first feature;

[0119] In an optional embodiment of the present invention, the expanded network security data is input into the feature extraction model to train the feature extraction model. The present invention uses a 6-layer fully connected neural network for feature extraction. In the prior art, some schemes use neural networks for feature extraction. In some neural network structures, gradient vanishing, gradient explosion or falling into local optimal solutions may be encountered, affecting the stability of training and the performance of the model. The present invention uses a neural network algorithm based on dynamic population evolution optimization as a feature extraction model. In traditional population evolution algorithms, the evolution of all individuals is based on fixed rules. The present invention uses a self-correction mechanism to automatically adjust the evolution rules according to the characteristics of the current network security training data, and adjusts the probability of crossover and mutation according to the changing trend of the loss function, so that the algorithm can more flexibly adapt to different network security data distributions and improve the generalization ability and training efficiency of the model.

[0120] Specifically, the training process of the neural network algorithm based on dynamic population evolution optimization is as follows:

[0121] S201. According to the bionic algorithm initialization method, in the initialization stage, an initial population is generated, and each individual represents a configuration of network weights. Specifically, the population size is , for The individual initialization weights and biases are expressed as:

[0122]

[0123]

[0124] In the formula, For the The weight of the neural network corresponding to each individual, For the The bias of the neural network corresponding to each individual, Indicates The weight matrix of each individual in the initial state; Indicates The bias of each individual in the initial state; represents the initialization variance; It means the mean is 0 and the variance is Normal distribution of is a normal distribution. Preferably, Set to 0.01.

[0125] S202: For each individual in the population, use its corresponding neural network configuration to process the input network security training data, calculate the output of the model, and evaluate its performance according to a predetermined loss function. Specifically, for the first Individuals use their weights and biases to calculate the loss on the network security training dataset, expressed as:

[0126]

[0127] In the formula, For the The loss of the neural network corresponding to each individual; Indicates the number of samples input in the current batch; represents the composite loss function, Represents a neural network model function; Indicates Characteristics of the samples; Indicates The labels of samples.

[0128] In one embodiment, the composite loss function includes a regularization term, which can increase the generalization ability of the model. The calculation method is expressed as:

[0129]

[0130] In the formula, is the mean square error function, is the regularization term, is the regularization parameter.

[0131] Furthermore, the calculation method of the regularization term is expressed as:

[0132]

[0133] In the formula, For the first The neural network corresponding to each individual A weight.

[0134] S203. According to the fitness of the individual, the best performing individual is selected from the current population and retained as the candidate solution for the next generation. Specifically, based on the fitness of the individual, the excellent individual has a higher probability of being selected. The calculation method of the probability of the individual being selected is expressed as:

[0135]

[0136] In the formula, Indicates The probability of an individual being selected; is the parameter that controls the selection pressure; For the The loss of the neural network corresponding to each individual. Preferably, Set to 2.

[0137] S204. Generate new individuals through crossover and mutation operations. The crossover operation allows two excellent individuals to exchange some genes to generate new offspring; the mutation operation randomly changes some genes in an individual to increase the diversity of the population. Specifically, the crossover operation randomly selects two individuals for gene exchange, which is expressed as:

[0138]

[0139]

[0140] In the formula, is the crossover rate, is the weight of the neural network corresponding to the first individual selected, is the bias of the neural network corresponding to the first individual selected, is the weight of the neural network corresponding to the second individual selected, is the bias of the neural network corresponding to the second individual selected, is the weight of the neural network corresponding to the individual after the crossover operation, is the bias of the neural network corresponding to the individual after the crossover operation. Preferably, Set to 0.3.

[0141] Moreover, the mutation operation performs a small random perturbation on the newly generated individual weights, which can be expressed as:

[0142]

[0143]

[0144] In the formula, represents the variance of the variation, is the weight of the neural network corresponding to the individual after the mutation operation, is the bias of the neural network corresponding to the individual after the mutation operation. Preferably, Set to 0.04.

[0145] S205, repeat the above steps until the preset stop iteration condition is met, which means that the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations, preferably, the preset maximum number of iterations is set to 1000 times.

[0146] This embodiment uses a dynamic population evolution optimization neural network as a feature extraction model, dynamically adjusts individual evolution rules through a self-correction mechanism, improves the flexibility of the model to adapt to different data distributions, improves training efficiency, and avoids problems such as gradient vanishing, explosion, or local optimal solutions. The dynamic population evolution optimization feature extraction model ensures accurate extraction of network security data features, effectively reduces gradient vanishing and overfitting problems in model training, and improves the stability and efficiency of the training process.

[0147] S3, using an autoencoder neural network based on contrast entropy to reduce the dimension of the first feature to obtain a second feature;

[0148] In an optional embodiment of the present invention, the network security data after feature extraction is input into a feature dimension reduction model to train the feature dimension reduction model. The present invention adopts an autoencoder algorithm based on contrast entropy for feature dimension reduction;

[0149] The main structure of the autoencoder algorithm based on contrast entropy includes an input layer, an encoding layer, a hidden layer, a decoding layer and an output layer. On the basis of the traditional autoencoder algorithm, the present invention adopts contrast entropy as the main constraint condition in the dimensionality reduction process, which effectively improves the model's ability to capture the nonlinear structure of high-dimensional network security data, thereby optimizing the performance of the entire feature dimensionality reduction.

[0150] Specifically, the training process of the autoencoder algorithm based on contrast entropy is as follows:

[0151] S301, initialize the network parameters of the autoencoder. In one embodiment, the weight of the encoder of the autoencoder is , the bias of the encoder of the autoencoder is , the weights of the decoder of the autoencoder are , the bias of the decoder of the autoencoder is .

[0152] S302, the input network security data after feature extraction passes through the encoding layer, hidden layer to the decoding layer. Each layer uses a nonlinear activation function to process the network security data to adopt nonlinear mapping capabilities. The forward propagation of the encoding process is expressed as:

[0153]

[0154]

[0155]

[0156] In the formula, ReLU activation function. is the input feature vector of the encoder; is the input feature vector of the encoder after noise enhancement; is the output feature vector of the encoder; is from a mean of 0 and a variance of Noise drawn from a normal distribution; The mean is 0 and the variance is Normal distribution of is the identity matrix; is a normal distribution; Variance of the noise enhancement for the encoder; Standard deviation of the encoder enhancement noise.

[0157] In order to enhance the generalization ability of the autoencoder when processing network security situation network security data, dynamically adjusted noise is used to enhance the robustness of the model. The calculation of the standard deviation of the encoder-enhanced noise depends on the classification error rate of the model on the validation set. The validation set is a set of samples with a preset proportion obtained from the network security training data set. The calculation method of the standard deviation of the encoder-enhanced noise is expressed as follows:

[0158]

[0159] In the formula, is the basic noise level; is a noise adjustment factor used to control the speed at which the noise intensity increases with the increase of error rate. Preferably, Set to 0.01.

[0160] Furthermore, the decoding stage reconstructs the input through the decoder and outputs the reconstructed network security data after feature extraction, which is expressed as:

[0161]

[0162] In the formula, The reconstructed feature-extracted network security data output by the decoder; for Activation function.

[0163] S303, after the hidden layer performs dimensionality reduction on the network security data after feature extraction, the effect of the current dimensionality reduction is evaluated through a dynamic feedback mechanism, and the parameters of the decoding layer are adjusted according to the evaluation results, in order to achieve a better reconstruction effect, which is expressed as:

[0164]

[0165]

[0166]

[0167] In the formula, is the derivative of the Sigmoid activation function; is the L2 norm; is the reconstruction error of the autoencoder; is the learning rate of the decoder; Update the increment for the decoder weight parameters; is the transpose of the encoder’s output feature vector; Indicates parameter update operation; is the gradient of the loss function with respect to the decoder output. Preferably, Set to 0.01.

[0168] Furthermore, the gradient of the loss function with respect to the decoder output is calculated as:

[0169]

[0170] In the formula, Represents an elemental penalty.

[0171] S304, in the decoding output stage, the comparative entropy between the output and the original input is calculated to guide the network to learn the relative relationship between the sample points of the network security data. The calculation method of the comparative entropy is expressed as:

[0172]

[0173]

[0174]

[0175] In the formula, represents contrast entropy; It is The sample points of network security data before encoding and the The similarity probability between the sample points of network security data before encoding; It is The sample points of the decoded network security data and the The similarity probability between the sample points of the decoded network security data; represents the first input feature vector of the encoder elements; represents the first input feature vector of the encoder elements; represents the first input feature vector of the encoder elements; The first feature vector representing the reconstructed network security data output by the decoder elements; The first feature vector representing the reconstructed network security data output by the decoder elements; The first feature vector representing the reconstructed network security data output by the decoder elements; is a hyperparameter representing the smoothness of the distribution and affects the width of the probability density function. Preferably, Set to 0.01.

[0176] S305. According to the result of the comparative entropy and the reconstruction error, the gradient descent method is used to update the network parameters, optimize the encoding and decoding process, ensure that the error is gradually reduced during the iteration process, and improve the accuracy and efficiency of dimensionality reduction. The update process of the encoder is expressed as:

[0177]

[0178]

[0179]

[0180]

[0181] In the formula, is the regularization parameter of the encoder; It is The learning rate of the encoder for each iteration; and are the gradients with respect to the encoder weights and biases, respectively.

[0182] In order to enhance the training efficiency of the autoencoder and the generalization ability of the model, the present invention adopts a dynamic learning rate adaptive adjustment mechanism to dynamically adjust the learning rate based on the reconstruction error of the network in each iteration, so as to accelerate the convergence speed of the network and improve the adaptability of the model to network security data. Specifically, the learning rate is dynamically adjusted based on the reconstruction error calculated after each iteration, and the error response function is used to adjust the learning rate according to the error size to achieve a more accurate and stable training process. The implementation method of the error response function is expressed as:

[0183]

[0184] In the formula, is the error response function; is a positive parameter that controls the steepness of the response curve; is the set error threshold. When the actual error Greater than When , the learning rate increases, and vice versa.

[0185] Furthermore, the dynamic adjustment method of the learning rate is expressed as:

[0186]

[0187] In the formula, It is The learning rate of the encoder for each iteration; It is The learning rate of the encoder for each iteration; is the base learning rate of the encoder, It is The learning rate of the iteration, It is The reconstruction error is calculated by iteration. Preferably, Set to 0.01.

[0188] S306, repeat the above steps until the preset stop iteration condition is met, which means the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations, preferably, the preset maximum number of iterations is set to 1000 times.

[0189] This embodiment uses an autoencoder algorithm based on contrast entropy to achieve feature dimensionality reduction, and uses contrast entropy as the main constraint condition, so that the model can more accurately capture the nonlinear structure of high-dimensional data and improve the robustness and efficiency of the dimensionality reduction process. The autoencoder constrained by contrast entropy achieves effective dimensionality reduction of high-dimensional network security data features, ensuring that the features after dimensionality reduction have higher robustness and high efficiency of model training while retaining the data structure.

[0190] S4, using a fractional-order neural network based on complexity perception to build a classifier model, and using the second feature to train the classifier model;

[0191] In an optional embodiment of the present invention, the network security data after feature dimension reduction is input into a classifier for classifier training. The present invention adopts a complexity-aware fractional-order neural network algorithm as a classifier model. The last layer output of the fractional-order neural network implements category calculation through a preset Softmax function.

[0192] The fractional-order neural network structure consists of 1 input layer, 3 hidden layers, and 1 output layer. The neurons used in each layer have fractional-order activation function, and a dynamic self-adjustment mechanism is adopted to enable the model to adapt to different network security data changes more flexibly.

[0193] Specifically, the training process of the complexity-aware fractional-order neural network algorithm is as follows:

[0194] S401, initializing the parameters of the fractional-order neural network, including the weights and biases of the fractional-order neural network. In one embodiment, the initialization method is expressed as:

[0195]

[0196]

[0197] In the formula, is the standard deviation of the parameter initialization of the fractional neural network; Indicates compliance with a specific distribution; represents normal distribution; is the weight of the fractional-order neural network; is the bias of the fractional-order neural network. Preferably, Set to 0.1.

[0198] S402, the network security data after feature dimension reduction processing is input into the classifier. When the network security data passes through each layer of the fractional-order neural network, it will be processed by the fractional-order activation function, which is expressed as:

[0199]

[0200]

[0201] In the formula, Indicates fractional mapping operation. The upper right corner of the fractional mapping operation is represents the fractional order parameter; It is the output of the fractional activation function, that is, the intermediate feature vector of the fractional neural network; is the feature vector of network security data input to the fractional-order neural network, is a fractional order neural network function; is the output of the fractional-order neural network; is element-wise multiplication; It is the feature adaptive weight calculation function.

[0202] In one embodiment, the fractional-order mapping operation relies on fractional-order calculus to better adapt to nonlinear and complex network security data patterns, and the implementation is expressed as:

[0203]

[0204] In the formula, is a fractional derivative operation; is a parameter used to adjust the slope of the activation function.

[0205] Furthermore, the calculation method of fractional derivative operation is expressed as:

[0206]

[0207] In the formula, is the Gamma function; ( ) is a fractional order parameter adjusted to match the complexity of network security data; Indicates the current iteration number; represents the differentiation with respect to the number of iterations, represents the total number of training iterations of the fractional neural network; For the The output of the fractional activation function at iterations.

[0208] S403. Adopting an adaptive feature weight adjustment mechanism allows the model to automatically adjust its weight according to the importance of the feature during the training process, thereby improving the response sensitivity to key features. The feature adaptive weight calculation function depends on the contribution of each feature in the classification error, and the calculation method is expressed as:

[0209]

[0210] In the formula, is the learning rate parameter of the feature adaptive weight, which is used to control the speed of weight adjustment; It is the partial derivative of the loss function with respect to the input feature, reflecting the impact of each feature on the loss.

[0211] S404. After the network security data passes through the last output layer, the difference between the predicted result and the actual label is calculated. Specifically, the cross entropy loss function is used to evaluate the classification performance, and the regularization term is used to achieve the parameter sparsification of the fractional-order neural network. The loss function of the fractional-order neural network is expressed as:

[0212]

[0213] In the formula, is the loss function of the fractional-order neural network; It is The true labels of samples, It is The fractional-order neural network model predicts the output of samples; is the regularization coefficient of the fractional-order neural network; is the L2 norm.

[0214] S405. Based on the result of the loss function, all parameters in the network are updated using the gradient descent method. Specifically, the gradient of the weight and bias of the fractional-order neural network is calculated using the chain rule, which is expressed as:

[0215]

[0216]

[0217] In the formula, and Respectively represent the gradients of weights and biases of fractional-order neural networks; is the predicted output of the fractional-order neural network model.

[0218] S406. According to the gradient of the weight and bias of the fractional-order neural network, the network parameters of the fractional-order neural network are updated. The updating method is expressed as:

[0219]

[0220]

[0221] In the formula, It is the parameter update operation; represents the learning rate of the fractional-order neural network. Preferably, Set to 0.001.

[0222] S406, repeat the above steps until the preset stop iteration condition is met, which means the model training is completed. In one embodiment, the preset stop iteration condition is reaching a preset maximum number of iterations, preferably, the preset maximum number of iterations is set to 1000 times.

[0223] This embodiment uses a complexity-aware fractional-order neural network algorithm to construct a classifier model. Through the fractional-order activation function and the adaptive feature weight adjustment mechanism, the model is more adaptable to diverse network security situations and the classifier's sensitivity to different features is improved. The fractional-order neural network classifier model improves the ability to distinguish complex network security situations, can achieve more accurate classification effects, and enhances the applicability of the model in network security data and the accuracy of classification.

[0224] S5. Use the trained classifier model to classify network security situation awareness.

[0225] In an optional embodiment of the present invention, a trained model is used to process new network security data samples and generate a final situational awareness output. In one embodiment, the collected original network security data is input into the trained feature extraction and feature dimension reduction model for feature processing, and further, the processed features are input into the classifier model for classification to obtain classification results. In this embodiment, the classification categories include: normal behavior, DDoS attack, intrusion attempt, malware propagation, and network security data leakage.

[0226] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0227] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0228] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0229] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0230] Those skilled in the art will appreciate that the embodiments described herein are intended to help readers understand the principles of the present invention, and should be understood that the protection scope of the present invention is not limited to such specific statements and embodiments. Those skilled in the art can make various other specific variations and combinations that do not deviate from the essence of the present invention based on the technical revelations disclosed by the present invention, and these variations and combinations are still within the protection scope of the present invention.

Claims

1. A network security situation awareness method based on artificial intelligence, characterized in that: The following steps are involved: Obtain cybersecurity data; A fully connected neural network based on dynamic population evolution optimization is used to extract features from network security data to obtain the first feature; The first feature is reduced in dimension by using an autoencoder neural network based on contrast entropy to obtain the second feature; A fractional-order neural network based on complexity perception is used to build a classifier model, and the second feature is used to train the classifier model; the trained classifier model is used to classify network security situation awareness; The method uses a fully connected neural network based on dynamic population evolution optimization to extract features from network security data to obtain a first feature, including: Initialize the population; For each individual in the population, calculate the loss of the corresponding neural network; According to the loss of the neural network corresponding to the individual, the best individual is selected from the current population for retention; Generate new individuals through crossover and mutation operations on the selected individuals; the crossover operation randomly selects two individuals for gene exchange, and the mutation operation randomly perturbs the weights of the newly generated individuals; Repeat the above steps until the preset stop iteration condition is met; The step of using an autoencoder neural network based on contrast entropy to perform feature dimension reduction on the first feature to obtain the second feature includes: Initialize the parameters of the autoencoder network; Forward propagation of the first feature through the encoding layer; After the output features of the encoding layer are represented by dimensionality reduction through the hidden layer, the current dimensionality reduction effect is evaluated through a dynamic feedback mechanism, and the parameters of the decoding layer are adjusted according to the evaluation results; The output features of the hidden layer are used to calculate the contrast entropy between the output features of the decoding layer and the input features of the encoding layer through the decoding layer; according to the calculation results of the contrast entropy and the reconstruction error, the gradient descent method is used to update the network parameters; Repeat the above steps until the preset stop iteration condition is met; The method of constructing a classifier model using a fractional-order neural network based on complexity perception and training the classifier model using the second feature includes: Initialize the parameters of the fractional neural network; Process the second feature through the fractional-order activation function of each layer in the fractional-order neural network; Adopt adaptive feature weight adjustment mechanism to automatically adjust corresponding weights according to the importance of features; The cross entropy loss function is used to evaluate the classification performance, and the regularization term is used to sparse the parameters of the fractional-order neural network; According to the calculation results of the loss function, all parameters in the network are updated using the gradient descent method; the network parameters of the fractional-order neural network are updated according to the gradient of the weights and biases of the fractional-order neural network; Repeat the above steps until the preset stop iteration condition is met.

2. According to the artificial intelligence-based network security situation awareness method of claim 1, it is characterized in that: According to the loss of the neural network corresponding to the individual, the best individual is selected from the current population for retention, specifically: Among them, P select (i) is the probability of the i-th individual being selected; γ pse Parameter for controlling selected pressure; L pk is the loss of the neural network corresponding to the kth individual; N p is the population size, L pi is the loss of the neural network corresponding to the i-th individual.

3. The network security situation awareness method based on artificial intelligence according to claim 1 is characterized in that: According to the calculation results of contrast entropy and reconstruction error, the gradient descent method is used to update the network parameters, specifically: in, is the weight gradient of the encoder, is the bias gradient of the encoder, C r For the comparison entropy, is the weight of the encoder, λ rwe is the regularization parameter of the encoder, e r is the reconstruction error of the autoencoder, |||| is the L2 norm, is the encoder bias, is the learning rate of the encoder at the tth iteration, is the updated encoder weight, is the updated encoder offset.

4. The network security situation awareness method based on artificial intelligence according to claim 1 is characterized in that: According to the calculation results of the contrast entropy and the reconstruction error, the gradient descent method is used to update the network parameters, which also includes: The dynamic learning rate adaptive adjustment mechanism is used to dynamically adjust the learning rate based on the reconstruction error of the network in each iteration, which is expressed as: Among them, φ rs (e r ) is the error response function; κ rs is a positive parameter that controls the steepness of the response curve; θ rs is the set error threshold; e r is the reconstruction error of the autoencoder.

5. The network security situation awareness method based on artificial intelligence according to claim 1 is characterized in that: Adopting the adaptive feature weight adjustment mechanism, the corresponding weight is automatically adjusted according to the importance of the feature, which is expressed as: Among them, ω u (x u ) is the feature adaptive weight, η uyr is the learning rate parameter of the feature adaptive weight, is the loss function L u Regarding the input feature x u The partial derivative of .

6. The network security situation awareness method based on artificial intelligence according to claim 1 is characterized in that: Obtaining cybersecurity data also includes: A generative adversarial network based on high-dimensional manifold is used to augment network security data.

Images