Network security risk identification and management and control system based on AI

Abstract

The invention discloses an AI-based network security risk identification and management and control system, which is characterized by comprising network security equipment and a server, the network security equipment is used for monitoring flow data flowing into / out of the server, and the AI-based network security risk identification and management and control system also comprises an interface conversion module which is used for connecting different network security equipment, original operation logs of different network security devices are collected; data collection: collecting multi-source data from multiple channels of network traffic, server logs, application program logs and user behavior records; preprocessing the data; preprocessing the data, removing noise data, filling missing values, and extracting useful features from the original data; simulation training: training the model to identify normal and abnormal behaviors through machine learning by utilizing supervised learning, unsupervised learning or semi-supervised learning methods; the deep neural network is used for modeling a complex data mode, and the detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an AI-based network security risk identification and management system. Background Art

[0002] Communication networks play an important role in the construction and development of modern information society. People can communicate across space through communication networks, making information sharing and interaction more convenient and improving the efficiency of information transmission. However, with the continuous increase in the amount of communication tasks, higher requirements are placed on the communication capabilities of communication networks. In the face of this situation, new nodes are connected to the network in a heterogeneous form and integrated with the network to achieve the purpose of expanding the coverage of the communication network and improving the reliability and stability of communication. However, at the same time, with the access of a large number of new nodes, communication network security issues are becoming more and more prominent, which greatly increases network security risks. Because, with the access of a large number of nodes, the network environment is becoming more and more complex, and illegal persons can easily steal the legitimate identity of the node, and then use the access rights they have to steal services or resources. Such malicious behavior poses a great threat to network security. In the face of this situation, in order to ensure the security of the communication network, it is necessary to automatically identify the security risks of the communication network after access.

[0003] Therefore, it is necessary to provide an AI-based network security risk identification and management system to solve the above technical problems. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] To solve the above technical problems, the present invention provides the following technical solutions: an AI-based network security risk identification and management system, characterized in that: it includes a network security device and a server, the network security device is used to monitor the flow data flowing into / out of the server, and also includes: an interface conversion module, which is used to connect different network security devices and collect the original operation logs of different network security devices; data collection, collecting data from multiple sources such as network traffic, server logs, application logs, and user behavior records; data preprocessing; data preprocessing, removing noise data, filling missing values, and extracting useful features from the original data; simulation training, through machine learning using supervised learning, unsupervised learning or semi-supervised learning methods, training models to identify normal and abnormal behaviors; using deep neural networks to model complex data patterns to improve detection accuracy; risk assessment, analyzing real-time data through models for anomaly detection, and identifying abnormal activities that are inconsistent with normal behaviors; threat classification further classifies the detected abnormal activities and determines the specific threat type; assigning a risk score to each detected event based on the severity and potential impact of the threat to help prioritize high-risk events;

[0006] After potential security threats are identified, a series of measures are taken to mitigate or eliminate these threats, including the following steps: automatic response, alarm notification, dynamic adjustment and security policy management.

[0007] As a preferred solution of the AI-based network security risk identification and management system of the present invention, the interface conversion module includes an application interface layer, a management server and a device connection layer;

[0008] The application interface layer is used for users to access the management server, thereby realizing the configuration and setting of network security devices and uploading the original operation logs of network security devices;

[0009] The device connection layer is used to connect a variety of network security devices and convert the data formats of a variety of network security devices into a unified XML format;

[0010] The management server is used to collect original operation logs of different network security devices through the device connection layer and store them in the memory corresponding to the management server.

[0011] As a preferred solution of the AI-based network security risk identification and management system described in the present invention, the supervised learning trains the model through a labeled data set so that it can identify specific types of threats, including malware and DDoS attacks; the unsupervised learning trains the model through an unlabeled data set to discover abnormal patterns in the data; the semi-supervised learning is a combination of a small amount of labeled data and a large amount of unlabeled data for training to improve the generalization ability of the model.

[0012] As a preferred solution of the AI-based network security risk identification and management system described in the present invention, the risk assessment includes anomaly detection, threat classification and risk scoring.

[0013] As a preferred solution of the AI-based network security risk identification and control system described in the present invention, the automatic response includes isolating infected hosts, blocking malicious IP addresses and starting honeypots; the alarm notification includes real-time alarms and visual display screens; the dynamic adjustment includes adaptive learning and feedback mechanisms; the security policy management includes policy formulation, policy execution and policy auditing.

[0014] As a preferred solution of the AI-based network security risk identification and management system described in the present invention, after classifying and processing network information, the risk identification model is established by using an improved fuzzy clustering algorithm; including asset identification, information vulnerability identification and threat identification; based on the three aspects, the calculation formula of the network information security risk value is obtained:

[0015] D(B,K,M)=D(R(K,M))C(P n ,R n )

[0016] In the formula, D represents the network information security risk function; B represents the total amount of information assets contained in the network environment; K represents the amount of information data in the risk threat state in the network environment; M represents the quantitative value of the vulnerability degree of the network environment; R represents the probability of security risk caused by the vulnerability of information assets; C represents the amount of loss caused by the security risk of network information; P n The asset value assessment result representing the security risk; R n Indicates the degree of vulnerability of the network; constructs a security risk model and divides it into four security levels, from the highest level to the lowest level: Q1, Q2, Q3, and Q4.

[0017] As a preferred solution of the AI-based network security risk identification and management system described in the present invention, the decision tree is used for pruning, the effectiveness of the fuzzy clustering algorithm is tested and verified, and the entropy value is used to evaluate the nodes. The entropy value calculation formula is:

[0018]

[0019] In the formula, A(U) represents the entropy value; t n Represents decision behavior data.

[0020] The beneficial effects of the present invention are as follows: by connecting different network security devices, after classifying and processing network information, the improved fuzzy clustering algorithm is used to complete the establishment of the risk identification model, and then the decision tree is used for evaluation, and dynamic adjustments are made according to security control to provide security policy management. In the process of maintaining network security and resisting network security risks, big data technology must use big data analysis and mining technology to achieve in-depth analysis of massive data and effectively identify potential risks. At the same time, it is necessary to rely on a complete network security database, risk assessment module and cloud security detection platform, give full play to the advantages of big data to enhance network security risk mining and response capabilities, and continuously improve the level of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0022] in:

[0023] Figure 1 A weight calculation flow chart of an AI-based network security risk identification and management system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, but not all of the embodiments.

[0025] Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without making any creative work should fall within the scope of protection of the present invention.

[0026] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0027] Example 1

[0028] Reference Figure 1As shown, an AI-based network security risk identification and management system is characterized by: including network security devices and servers, the network security devices are used to monitor the flow data flowing into / out of the server, and also include: an interface conversion module, which is used to connect different network security devices and collect the original operation logs of different network security devices; data collection, collecting data from multiple sources such as network traffic, server logs, application logs, and user behavior records; data preprocessing; data preprocessing, removing noise data, filling missing values, and extracting useful features from raw data; simulation training, using machine learning to use supervised learning, unsupervised learning or semi-supervised learning methods to train models to identify normal and abnormal behaviors; using deep neural networks to model complex data patterns to improve detection accuracy; risk assessment, analyzing real-time data through models for anomaly detection to identify abnormal activities that are inconsistent with normal behaviors; threat classification further classifies detected abnormal activities to determine specific threat types; risk assessment, assigning a risk score to each detected event based on the severity and potential impact of the threat to help prioritize high-risk events;

[0029] After potential security threats are identified, a series of measures are taken to mitigate or eliminate these threats, including the following steps: automatic response, alarm notification, dynamic adjustment and security policy.

[0030]

Data collection

[0031] Data collection usually collects data from multiple sources, including but not limited to network traffic, log files, user behavior records, etc. Assume that there are the following data sources:

[0032] L: Network traffic data

[0033] R: Log file data

[0034] Z: User behavior data

[0035] Data collection collects raw data from these data sources. This data can be represented by a set: A = {A 1 ,A 2 ,...,A n}

[0036] Among them, each A i Represents a data point collected from a data source, for example:

[0037] A 1 It may be detailed information of a network request

[0038] A 2 Maybe a log record

[0039] A nIt may be a user's login behavior

[0040]

Data preprocessing

[0041] Data preprocessing includes steps such as data cleaning, noise removal, missing value filling, feature extraction, etc. Suppose there is a preprocessing function y, which converts the original data A into preprocessed data A':

[0042] A'=y(A)

[0043] Extract useful features from the preprocessed data. Assume there is a feature extraction function t that converts the preprocessed data A' into a feature vector Z:

[0044] Z=t(A')

[0045] The eigenvector Z can be expressed as a vector:

[0046] Z=[z 1 ,z 2 ,...,z m ]

[0047] Among them, each z i Represents a feature, for example:

[0048] z 1 It may be the size of the network traffic

[0049] z 2 Probably the timestamp of the log record

[0050] z m It may be the user's login frequency

[0051] For example, suppose there is a data set D containing n samples, each sample has m features, and a label y indicating whether the sample is abnormal (1 for abnormality and 0 for normal).

[0052] D={(x 1 ,y 1 ),(x 2 ,y 2 ),...,(x n ,y n )}

[0053] Here, each sample χ is an m-preserving feature vector:

[0054] x i =[x i1 ,x i2 ,...,x im ]

[0055] For example, let's assume that a classifier M is used to train the data. Common supervised learning models include logistic regression, support vector machine (SVM), and decision tree. The mathematical expression of the training process is:

[0056] M=train(X,Y)

[0057] Among them, X is the feature matrix, each row represents the feature vector of a sample; Y is the label vector, each label indicates whether the sample is abnormal.

[0058] For example, for unsupervised learning, suppose there is a data set D, which contains n samples, each sample has m features.

[0059] D = {x 1 ,x 2 ,...,x n}

[0060] Model training example: Use Gradient Descent or other optimization algorithms (such as Adam, RMSprop) to minimize the loss function. The mathematical expression of the training process is:

[0061] θ=argmin θ L(X,Y;θ)

[0062] Among them, θ is the parameter of the model, including all weight matrices T i and the bias vector f i .

[0063] Use logistic regression for supervised learning, K-means for unsupervised learning, self-training for semi-supervised learning, and deep neural networks for complex pattern modeling.

[0064] For supervised learning, commonly used loss functions include cross entropy loss and mean square error loss. Assume that the mathematical expression of cross entropy loss is used:

[0065]

[0066] Taking semi-supervised learning as an example, suppose there is a data set D containing n samples, some of which have labels and some do not.

[0067] D={(x 1 ,y 1 ),(x 2 ,y 2 ),...,(x l ,y l ),x l+1 ,...,x n}

[0068] Among them, the first l samples have labels, and the last nl samples have no labels.

[0069] The severity and potential impact of the threat are used to assign a risk score to each detected event. Assume that there is a risk score function R, which calculates the risk score based on the threat type and feature value. Its mathematical expression is:

[0070]

[0071] The risk scoring function R is a complex function that takes into account multiple factors, such as threat type, historical data, network topology, etc. Its mathematical expression formula is:

[0072] r i =w 1 ·f 1 (x ti )+w 2 ·f 2 (x ti )+…+w k ·f k (x ti )+b

[0073] Among them, w 1 , w 2 , ..., w k is the weight, indicating the importance of each factor;

[0074] f 1 ,f 2 ,...,f k is the characteristic function, which represents the influence of different factors.

[0075] b is the bias term.

[0076] Risk scoring example: Assume there are two main factors: threat type and traffic size. The mathematical expression is:

[0077]

[0078] in,

[0079] is an indicator function, if but Otherwise 0.

[0080] x t,traffic,i is the sample x ti The flow size characteristics.

[0081] w 1 ,w 2 ,...,w K ,w trafficis the weight, indicating the importance of each factor.

[0082] b is the bias term.

[0083] The interface conversion module includes an application interface layer, a management server and a device connection layer; the application interface layer is used for users to access the management server, thereby realizing the configuration settings of network security devices and uploading the original operation logs of network security devices; the device connection layer is used to connect a variety of different network security devices and convert the data formats of a variety of different network security devices into a unified XML format; the management server is used to collect the original operation logs of different network security devices through the device connection layer and store them in the memory corresponding to the management server. The supervised learning trains the model through labeled data sets so that it can identify specific types of threats, including malware and DDoS attacks; the unsupervised learning trains the model through unlabeled data sets to discover abnormal patterns in the data; the semi-supervised learning is a combination of a small amount of labeled data and a large amount of unlabeled data for training to improve the generalization ability of the model. The risk assessment includes anomaly detection, threat classification and risk scoring. It is worth noting that the "number of bytes sent from source to destination" sub-feature in the basic features of TCP connections has a 100% accuracy rate for identifying DOS attacks. This is because the message features of DOS attacks based on massive invalid requests are homogeneous, and the byte length, content, etc. are significantly different from normal access traffic. Although considering the randomness of the selected test set, this sub-feature can still be used to perform preliminary and rapid identification of DOS attacks. Similarly, the three single traffic features with the highest identification accuracy for the three types of attacks, R2L, U2R, and Probing, are "number of connections with the same target and service" and "ratio of different access targets for the same service."

[0084] The ratio of the same access target to different sources can be used to quickly determine the type of attack.

[0085] Network information attack path prediction and risk identification, after completing the construction of the risk identification model, the network information attack path is predicted and the specific risk type is identified. Through the prediction of network information, H can be used to express the front-end attack intention on network information, and the corresponding calculation formula is given:

[0086] H=F+τ+d 0 +d b

[0087] In the formula, F represents the attack behavior in the network environment; τ represents the quantitative value of the attack idea; d 0 Indicates the quantitative value of the attack attitude; d 0It represents the quantitative value of the vulnerability of the attack node. Assuming that after the attack, the security risk impact on the network environment is X, then X should meet the threshold verification requirements to ensure the accuracy of the predicted attack path. In this process, the effective threshold for identifying X is set according to the coverage of the network environment in a specific area. When the value of X is within the set threshold range, it means that the network information is threatened at this time and there is a security risk; conversely, when the value of X is not within the set threshold range, it means that the network information is not threatened at this time and there is no security risk. Extract the state data of the network information under specific conditions, and input its state value into the risk identification model constructed above to predict the probability of attack behavior. When the value of the output result is infinitely close to 1, it means that the path of the predicted result has been traced back and the source of the network information security threat has been determined. At this time, according to the output result of the model, the network source end where the path is located is predicted, and it is used as the final identification result, so as to realize the identification of network information security risks according to the above discussion.

[0088] Based on the access security risk factors of validity and reliability data, there are two main categories of factors that bring risks to the communication network security: access node type and communication network type. Together, they constitute the risk factor set of trusted access security of heterogeneous converged communication networks. Since there are many risk factors, they are screened by calculating validity and reliability. First, determine the candidate set of trusted access security risk factors of heterogeneous converged communication networks, and then calculate the validity coefficient of the risk factor, that is,

[0089]

[0090] in,

[0091]

[0092] In the formula, A i represents the validity coefficient of the ith safety risk factor; a i represents the average score of the ith security risk factor; a ij represents the score given by expert j for the i-th safety risk factor; represents the optimal score of the i-th safety risk factor scoring set; b represents the number of people participating in the assessment;

[0093] Then the reliability coefficient of the risk factor is calculated, that is,

[0094]

[0095] in,

[0096]

[0097] In the formula, C irepresents the reliability coefficient of the ith safety risk factor; c i represents the variance of the score of the ith safety risk factor;

[0098] After the node is connected to the communication network, while the communication capability is improved, it also brings certain risks. The identification model construction process is as follows: Step 1: According to Table 1, a set of trusted access security risk factors for heterogeneous converged communication networks is established, denoted as D = {D 1 ,D 2 ,...,D i ,...,D n}, n = 7; D i Represents the first risk factor.

[0099] Step 2: Establish a classification level of security risk for trusted access to heterogeneous converged communication networks, as shown in Table 1

[0100] Table 1 Trusted access security risk levels

[0101]

[0102] Thus, a risk level set is established, denoted as F = {F 1 ,F 2 ,F 3 ,F 4, F 5}.

[0103] Step 2: Identify the risk factors i The membership degree of each level in F is obtained, and the membership matrix P is established.

[0104]

[0105] Where, P ij Representative risk factor D i Belongs to the jth level of membership in L; β represents the risk factor D i The number of experts who rated it as the jth level in L; δ represents the number of experts.

[0106]

[0107] Step 3: Calculate the security risk factor D for each trusted access i The weight is calculated by using the hierarchical analysis method, and the calculated weight is recorded as

[0108] W={W 1 ,W 2 ,...,W i ,...,W n},n=7,W i Represents the weight of the ith risk factor.

[0109] Step 4: Calculate the probability value of security risk occurrence and construct a security risk identification result set, namely

[0110]

[0111] Where Z represents the security risk identification result set; 1 , z 2 , z 3 , z 4 , z 5} represents the five risk levels {F 1, F 2, F 3, F 4, F 5}, that is, the risk value.

[0112] Step 5: According to the maximum membership principle, {z 1 , z 2 , z 3 , z 4 , z 5 The risk level corresponding to the maximum value among} is taken as the identification result.

[0113] After the above process, the research on automatic identification of trusted access security risks in heterogeneous converged communication networks based on big data is completed.

[0114] After classifying and processing network information, the improved fuzzy clustering algorithm is used to complete the establishment of the risk identification model, including asset identification, information vulnerability identification and threat identification. Based on the three aspects, the calculation formula of network information security risk value is obtained:

[0115] D(B,K,M)=D(R(K,M))C(P n ,R n )

[0116] In the formula, D represents the network information security risk function; B represents the total amount of information assets contained in the network environment; K represents the amount of information data in the risk threat state in the network environment; M represents the quantitative value of the vulnerability degree of the network environment; R represents the probability of security risk caused by the vulnerability of information assets; C represents the amount of loss caused by the security risk of network information; P n The asset value assessment result representing the security risk; R n Indicates the degree of vulnerability of the network; constructs a security risk model and divides it into four security levels, from the highest level to the lowest level: Q1, Q2, Q3, and Q4.

[0117] The decision tree is used for pruning, the effectiveness of the fuzzy clustering algorithm is tested and verified, and the entropy value is used to evaluate the nodes. The entropy value calculation formula is:

[0118]

[0119] In the formula, A(U) represents the entropy value; t n Represents decision behavior data.

[0120] Network security risk management: The automatic response includes isolating infected hosts, blocking malicious IP addresses and launching honeypots; the alarm notification includes real-time alarms and visual display screens; the dynamic adjustment includes adaptive learning and feedback mechanisms; the security policy management includes policy formulation, policy execution and policy auditing.

[0121] Isolate affected systems: Isolate infected or suspicious hosts from the network to prevent the threat from spreading.

[0122] Block malicious traffic: Block traffic from specific IP addresses or ports with a firewall or intrusion prevention system (IPS).

[0123] Terminate malicious processes: Automatically terminate malicious processes running on the infected host.

[0124] Repair damaged systems: Automatically restore tampered files or system configurations.

[0125] Record events: Record response actions and related logs for subsequent analysis and auditing. Dynamically adjust security policies based on detected threats:

[0126] Update firewall rules: Update firewall rules based on new threat information to block known malicious IP addresses or ports.

[0127] Adjust IDS / IPS rules: Update the rules of intrusion detection systems (IDS) and intrusion prevention systems (IPS) to detect and block new attack patterns.

[0128] Enhanced authentication: Strengthen authentication mechanisms, such as enabling multi-factor authentication (MFA). Develop a comprehensive security strategy that covers all aspects:

[0129] Access control: Defines who can access which resources.

[0130] Data protection: Ensure encryption and backup of sensitive data.

[0131] Network isolation: Divide different network areas to limit lateral movement.

[0132] Emergency response: Develop a detailed emergency response plan that clearly defines responsibilities and processes.

[0133] Update security policies regularly based on new threats and business needs:

[0134] Threat intelligence: Keep an eye on the latest threat intelligence and adjust strategies in a timely manner.

[0135] Business changes: Adjust security policies to adapt to new needs based on business changes.

[0136] Feedback mechanism: Establish a feedback mechanism to collect feedback on security incidents and continuously optimize security strategies. Automatic response: Detect potential security threats.

[0137] Trigger automatic response mechanisms to perform actions such as isolation, blocking, termination, and repair.

[0138] Record response actions and related logs.

[0139] Dynamic adjustment: Dynamically adjust security policies based on threat information, such as updating firewall rules, adjusting IDS / IPS rules, and enhancing identity authentication.

[0140] Adjust system configuration, such as shutting down unnecessary services, updating patches, enhancing logging, etc.

[0141] Additionally, in order to provide a concise description of exemplary embodiments, all features of an actual embodiment (ie, those features that are not relevant to the best mode presently contemplated for carrying out the invention or those that are not relevant to implementing the invention) may not be described.

[0142] It will be appreciated that in the development of any actual implementation, as in any engineering or design project, numerous implementation-specific decisions may be made. Such a development effort may be complex and time-consuming, but will be a routine task of design, fabrication, and production for those of ordinary skill having the benefit of this disclosure without undue experimentation.

[0143] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An AI-based network security risk identification and management system, characterized by: It includes a network security device and a server, wherein the network security device is used to monitor the flow data flowing into / out of the server, and also includes: an interface conversion module, which is used to connect different network security devices and collect the original operation logs of different network security devices; data collection, which collects data from multiple sources such as network traffic, server logs, application logs, and user behavior records; data preprocessing; data preprocessing, removes noise data, fills missing values, and extracts useful features from the original data; simulation training, through machine learning using supervised learning, unsupervised learning or semi-supervised learning methods, trains the model to identify normal and abnormal behaviors; uses deep neural networks to model complex data patterns to improve detection accuracy; risk assessment, for anomaly detection, analyzes real-time data through a model to identify abnormal activities that are inconsistent with normal behavior; threat classification further classifies the detected abnormal activities to determine the specific threat type; risk assessment, assigns a risk score to each detected event based on the severity and potential impact of the threat, to help prioritize high-risk events; after identifying potential security threats, takes measures to mitigate or eliminate these threats, including automatic response, alarm notification, dynamic adjustment and security policy management.

2. The AI-based network security risk identification and management system according to claim 1 is characterized by: The interface conversion module includes an application interface layer, a management server and a device connection layer; The application interface layer is used for users to access the management server, thereby realizing the configuration and setting of network security devices and uploading the original operation logs of network security devices; The device connection layer is used to connect a variety of network security devices and convert the data formats of a variety of network security devices into a unified XML format; The management server is used to collect original operation logs of different network security devices through the device connection layer and store them in the memory corresponding to the management server.

3. The AI-based network security risk identification and management system according to claim 1 is characterized by: The supervised learning trains the model through labeled data sets so that it can identify specific types of threats, including malware and DDoS attacks; the unsupervised learning trains the model through unlabeled data sets to discover abnormal patterns in the data; the semi-supervised learning combines a small amount of labeled data with a large amount of unlabeled data for training to improve the generalization ability of the model.

4. The AI-based network security risk identification and management system according to claim 1 is characterized by: The risk assessment includes anomaly detection, threat classification and risk scoring.

5. The AI-based network security risk identification and management system according to claim 1 is characterized by: The automatic response includes isolating infected hosts, blocking malicious IP addresses and launching honeypots; the alarm notification includes real-time alarms and visual display screens; the dynamic adjustment includes adaptive learning and feedback mechanisms; the security policy management includes policy formulation, policy execution and policy auditing.

6. The AI-based network security risk identification and management system according to claim 1 is characterized by: After classifying and processing network information, the improved fuzzy clustering algorithm is used to complete the establishment of the risk identification model, including asset identification, information vulnerability identification and threat identification. Based on the three aspects, the calculation formula of network information security risk value is obtained: D(B,K,M)=D(R(K,M))C(P n ,R n ) In the formula, D represents the network information security risk function; B represents the total amount of information assets contained in the network environment; K represents the amount of information data in the risk threat state in the network environment; M represents the quantitative value of the vulnerability degree of the network environment; R represents the probability of security risk caused by the vulnerability of information assets; C represents the amount of loss caused by the security risk of network information; P n The asset value assessment result representing the security risk; R n Indicates the degree of vulnerability of the network; constructs a security risk model and divides it into four security levels, from the highest level to the lowest level: Q1, Q2, Q3, and Q4.

7. The AI-based network security risk identification and management system according to claim 6 is characterized by: The decision tree is used for pruning, the effectiveness of the fuzzy clustering algorithm is tested and verified, and the entropy value is used to evaluate the nodes. The entropy value calculation formula is: In the formula, A(U) represents the entropy value; t n Represents decision behavior data.

Images