Network link security management method based on artificial intelligence

Abstract

The invention discloses a network link security management method based on artificial intelligence, which relates to the technical field of network security management, and comprises the following steps: when a network receiving link receives a data file of a sending end, obtaining first parameter data of the sending end to generate a sending feature and a fingerprint mark, and performing security verification on the fingerprint mark; and after verification, the data file and the fingerprint mark are packaged to generate a to-be-transmitted file. And when the to-be-transmitted file passes through an intermediate node of the network transmission link, recording second parameter data of the intermediate node, gradually generating a dynamic path mark and inputting the dynamic path mark. And when the file is transmitted to a receiving end, obtaining a complete dynamic path mark, carrying out anomaly analysis on the path mark according to a preset anomaly analysis algorithm, and if an anomaly is detected, generating an anomaly signal and giving an alarm. By sending the fingerprint mark in combination with the dynamic path mark and real-time monitoring, the adaptability of the network environment is improved, and the abnormality in the transmission path is accurately detected.

Description

Technical Field

[0001] The present invention relates to the technical field of network security management, and in particular to a network link security management method based on artificial intelligence. Background Art

[0002] With the rapid development of the Internet and the Internet of Things, the security and reliability of network data transmission have become increasingly prominent. Especially in scenarios involving the transmission of sensitive information, it is crucial to ensure the security and stability of the data transmission path. Existing network security management methods mainly rely on fixed paths or static security detection mechanisms. These methods usually detect anomalies by simply monitoring nodes and paths, but they are obviously insufficient in the face of dynamic changes in modern network environments. Specifically, traditional methods have problems in the following aspects: Lack of dynamism: Most existing methods are based on static path marking and security detection, and cannot respond to dynamic changes in transmission paths in real time. When the network node load or transmission delay fluctuates, existing methods often cannot accurately identify potential risks, resulting in security risks; Insufficient accuracy of path anomaly detection: Existing path marking technology fails to fully consider the real-time state changes of network nodes, resulting in insufficient accuracy of anomaly detection. In a complex network environment, subtle changes in node status may accumulate into significant risks, but traditional methods cannot accurately capture and identify this; Delayed security response: Due to the lack of real-time monitoring and analysis of transmission nodes, traditional security management methods often cannot respond in time after detecting potential security threats, which may lead to serious consequences such as data leakage or transmission interruption. Summary of the invention

[0003] Based on the above-mentioned shortcomings of the prior art, the purpose of the present invention is to provide a network link security management method based on artificial intelligence to solve the above-mentioned technical problems.

[0004] To achieve the above object, the present invention provides the following technical solution: a network link security management method based on artificial intelligence, comprising:

[0005] When the network receiving link receives the data file sent by the sending end, the first parameter data of the sending end is obtained, a sending feature is constructed according to the first parameter data, and a sending fingerprint mark is generated according to the sending feature;

[0006] Performing a security check on the fingerprint mark, and after passing the security check, packaging the data file and the fingerprint mark to generate a file to be transmitted;

[0007] When the network transmission link receives the file to be transmitted, a blank dynamic path mark is generated, and whenever the file to be transmitted passes through an intermediate transmission node, the second parameter data of the intermediate transmission node is recorded, a dynamic path mark is generated according to the second parameter data, and the dynamic path mark is input;

[0008] When the file to be transmitted is transmitted to the receiving end, the dynamic path mark is obtained, and the dynamic path mark is analyzed for abnormalities according to a preset abnormality analysis algorithm. When an abnormality exists, an abnormality signal is generated and an alarm is issued.

[0009] The present invention is further configured such that the first parameter data of the sending end includes a sending end identification number, a geographical location, a sending frequency, a sending time interval, a sending speed and a network delay, wherein the geographical location includes longitude and latitude.

[0010] The present invention is further configured to construct a sending feature according to the first parameter data, including: calculating a location change feature according to the current geographical location and the geographical location of the last sending, and when there is no last sending, the location change feature is zero; calculating a sending behavior feature according to the sending frequency and the sending time interval; calculating a sending environment feature according to the sending speed and the network delay;

[0011] Taking the location change feature, the sending behavior feature and the sending environment feature as three dimensions, a spatial feature vector is constructed, a sending fingerprint value is calculated, and the spatial feature vector and the sending fingerprint value are transformed into a sending fingerprint tag through a hash transformation.

[0012] The present invention is further configured such that the calculation logic of the position change feature is: Among them, CLo is the position change feature, Lat current and Lat prev The latitude of the current geographic location and the last sent geographic location, Lon current -Lon prev It is the longitude of the current geographic location and the last sent geographic location; the calculation logic of the sending behavior characteristics is: Among them, CBe is the sending behavior characteristic, F send is the sending frequency, T interval is the sending time interval; the calculation logic of the sending environment characteristics is: Among them, CEn is the sending environment characteristic, V send is the sending speed, D delay For network delay.

[0013] The present invention is further configured to normalize the sending behavior characteristics and the sending environment characteristics, and construct a spatial feature vector with the position change characteristics, the sending behavior characteristics and the sending environment characteristics as three dimensions. The spatial feature vector is expressed as: V send =[CLo,CBe,CEn],V send is a spatial feature vector, and the calculation logic of sending the fingerprint value is: Among them, Ssend is the fingerprint value to be sent, ∥·∥ is the modulus length of the vector, m is the dimension of the vector, V send [j] is the eigenvalue of the jth dimension, φ j is the adjustment parameter of the j-th dimension, and ∏ is the cumulative product symbol.

[0014] The present invention is further configured to perform security verification on the fingerprint mark, including: performing hash decryption on the sending fingerprint mark to obtain a spatial feature vector and a sending fingerprint value, calculating a verification sending fingerprint value based on the spatial feature vector, generating a verification sending fingerprint mark by hashing the spatial feature vector and the verification sending fingerprint value, and comparing whether the sending fingerprint mark and the verification sending fingerprint mark are consistent. When they are consistent, the security verification passes.

[0015] The present invention is further configured that the second parameter data of the intermediate transmission node includes the intermediate transmission node identification number, node load, network bandwidth occupancy rate and transmission time interval;

[0016] Generate a dynamic path label according to the second parameter data, including: using the intermediate transmission node identification number as a unique identifier, node load, network bandwidth occupancy rate and transmission time interval as attributes, constructing a dynamic path set, and setting the dynamic path set as a dynamic path label.

[0017] The present invention is further configured to perform an abnormality analysis on the dynamic path mark according to a preset abnormality analysis algorithm, and when an abnormality exists, an abnormality signal is generated to issue an alarm, including:

[0018] Generate a transmission chain list according to the intermediate transmission node identification number in the order of transmission, wherein the previous intermediate transmission node identification number points to the next intermediate transmission node identification number;

[0019] Check whether there is a ring link in the transmission chain table. If there is, generate an abnormal signal and issue an alarm;

[0020] Calculate the path consistency index based on node load, network bandwidth occupancy, and transmission time interval;

[0021] The path abnormality feature is calculated according to the path consistency index. When the path abnormality feature is greater than the preset threshold, an abnormal signal is generated and an alarm is issued.

[0022] The present invention is further configured such that the calculation logic of the path consistency index is: Among them, C path is the path consistency index, n is the number of intermediate transmission nodes, L i is the node load of the i-th intermediate transmission node, B iis the network bandwidth occupancy rate of the i-th intermediate transmission node, D i is the transmission time interval between the i-1th and ith intermediate transmission nodes, and D1 is zero.

[0023] The present invention is further configured such that the calculation logic of the path abnormality feature is: Among them, E path It is the path abnormality feature.

[0024] The present invention provides a network link security management method based on artificial intelligence. The method obtains first parameter data of a sending end when a network receiving link receives a data file sent by a sending end, constructs a sending feature according to the first parameter data, and generates a sending fingerprint mark according to the sending feature; performs security verification on the fingerprint mark, and after passing the security verification, packages the data file and the fingerprint mark to generate a file to be transmitted; when a network transmission link receives the file to be transmitted, a blank dynamic path mark is generated, and whenever the file to be transmitted passes through an intermediate transmission node, the second parameter data of the intermediate transmission node is recorded, a dynamic path mark is generated according to the second parameter data, and the dynamic path mark is input; when the file to be transmitted is transmitted to the receiving end, the dynamic path mark is obtained, and an abnormality analysis is performed on the dynamic path mark according to a preset abnormality analysis algorithm. When an abnormality exists, an abnormality signal is generated and an alarm is issued, and the beneficial effects produced include:

[0025] 1. Improve the uniqueness and security of data transmission: By generating unique sending features and further generating sending fingerprints, the sending fingerprints are used as the unique identifier of the sender, which can effectively prevent data files from being tampered with or forged, thereby improving the uniqueness and security of data transmission;

[0026] 2. Dynamic path marking and real-time monitoring: By generating dynamic path markings based on the first parameter data such as the geographical location of the transmission node, transmission frequency, transmission speed and network delay, real-time monitoring of the network transmission path is achieved. Compared with the traditional static path marking method, the present invention can more flexibly adapt to the dynamic changes of the network environment, timely discover potential anomalies in the path, and improve the security of network transmission;

[0027] 3. Accurate anomaly detection and alarm: The present invention uses intelligent path marking and calculation logic to achieve accurate detection of transmission path anomalies. By comparing the real-time status of the transmission node and the path consistency index, an abnormal signal can be quickly generated and an alarm can be issued when an anomaly is detected. Compared with traditional methods, the anomaly detection accuracy of the present invention is higher, which effectively reduces the risk of data leakage or transmission interruption caused by delayed security detection.

[0028] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. In the drawings:

[0030] Figure 1 The present invention is a flowchart of a network link security management method based on artificial intelligence, which is an exemplary embodiment of the present invention. DETAILED DESCRIPTION

[0031] The following will describe the embodiments of the present invention with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention, not for limiting the scope of protection of the present invention.

[0032] It should be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present invention, and thus the drawings only show components related to the present invention rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0033] In the following description, numerous details are discussed to provide a more thorough explanation of the embodiments of the present invention. However, it is obvious to those skilled in the art that the embodiments of the present invention can be implemented without these specific details. In other embodiments, well-known structures and devices are shown in the form of block diagrams rather than in detail to avoid making the embodiments of the present invention difficult to understand.

[0034] A network link security management method based on artificial intelligence, such as Figure 1 As shown, including:

[0035] When the network receiving link receives the data file sent by the sending end, the first parameter data of the sending end is obtained, a sending feature is constructed according to the first parameter data, and a sending fingerprint mark is generated according to the sending feature;

[0036] Performing a security check on the fingerprint mark, and after passing the security check, packaging the data file and the fingerprint mark to generate a file to be transmitted;

[0037] When the network transmission link receives the file to be transmitted, a blank dynamic path mark is generated, and whenever the file to be transmitted passes through an intermediate transmission node, the second parameter data of the intermediate transmission node is recorded, a dynamic path mark is generated according to the second parameter data, and the dynamic path mark is input;

[0038] When the file to be transmitted is transmitted to the receiving end, the dynamic path mark is obtained, and the dynamic path mark is analyzed for abnormalities according to a preset abnormality analysis algorithm. When an abnormality exists, an abnormality signal is generated and an alarm is issued.

[0039] The present invention is further configured that the first parameter data of the sender includes a sender identification number, a geographic location, a sending frequency, a sending time interval, a sending speed, and a network delay, wherein the geographic location includes longitude and latitude. Specifically, the sender identification number is a code or mark that uniquely identifies the sender device, which is used to distinguish different senders. It is a unique ID or serial number of the sender device, ensuring that each sender has a unique identity in the network, which helps to track and verify the legitimacy of the data source; the geographic location includes longitude and latitude information, which is used to accurately locate the geographic coordinates of the sender; the sending frequency refers to the number of times the sender sends data within a certain period of time, which is used to describe the frequency of sending data; the sending time interval refers to the time interval between each data transmission, which is used to measure the time regularity of data transmission; the sending speed refers to the speed at which the data file is transmitted on the network, reflecting the real-time rate at which the sender transmits data; the network delay refers to the time delay spent in the process of transmitting data from the sender to the receiver, reflecting the speed of the network response.

[0040] The present invention is further configured to construct a sending feature according to the first parameter data, including: calculating a location change feature according to the current geographical location and the geographical location of the last sending, when there is no last sending, the location change feature is zero; calculating a sending behavior feature according to the sending frequency and the sending time interval; calculating a sending environment feature according to the sending speed and the network delay; the present invention is further configured that the calculation logic of the location change feature is: Among them, CLo is the position change feature, Lat current and Lat prev The latitude of the current geographic location and the last sent geographic location, Loncurrent -Lon prev It is the longitude of the current geographic location and the last geographic location sent; specifically, the location change feature is used to measure the change of the current sender's geographic location compared to the last geographic location sent. By calculating the distance change between the two geographic locations and then reducing the change result to less than 1 through arctan, an effective method is provided to track the change of the sender's geographic location. It can detect the location offset or geographic anomaly of the sender in real time during data transmission, thereby improving the accuracy of path tracking.

[0041] The calculation logic of sending behavior characteristics is: Among them, CBe is the sending behavior characteristic, F send is the sending frequency, T interval is the sending time interval; specifically, the sending behavior feature uses the relationship between the sending frequency and the time interval to quantify the behavioral characteristics of the sender, and describes the volatility and regularity of the sending behavior by combining the sine function and the logarithmic function. By combining the relationship between the sending frequency and the time interval, it can be better identified whether the sender has abnormal behavior in the transmission process, such as too frequent data sending or abnormal time interval, which helps to timely discover abnormal transmission behavior.

[0042] The calculation logic for sending environmental characteristics is: Among them, CEn is the sending environment characteristic, V send is the sending speed, D delay is the network delay. Specifically, the sending environment feature measures the environmental status of data transmission by comparing and analyzing the network delay with the sending speed. By performing logarithmic processing on the ratio of delay and speed, it can reflect the impact of changes in the network environment on the stability of data transmission.

[0043] The spatial feature vector is constructed with the position change feature, the sending behavior feature and the sending environment feature as three dimensions, the sending fingerprint value is calculated, and the spatial feature vector and the sending fingerprint value are transformed into a sending fingerprint tag through hash transformation. The present invention is further configured to normalize the sending behavior feature and the sending environment feature, and construct the spatial feature vector with the position change feature, the sending behavior feature and the sending environment feature as three dimensions. The spatial feature vector is expressed as: V send =[CLo,CBe,CEn],V send is a spatial feature vector, and the calculation logic of sending the fingerprint value is: Among them, S send is the fingerprint value to be sent, ∥·∥ is the modulus length of the vector, m is the dimension of the vector, V send [j] is the eigenvalue of the jth dimension, φ jis the adjustment parameter of the jth dimension, and ∏ is the cumulative product symbol. Specifically, the adjustment parameter is used to adjust the feature contribution of the dimension to enhance the flexibility of calculation. The value access is [0,1], and the sum of all adjustment parameters is 1. The features of the three dimensions are combined to construct a spatial feature vector, and the spatial feature vector is used to calculate and generate the sending fingerprint value. Through the comprehensive integration of spatial features, the multi-dimensional feature characterization of the sender is achieved, making the feature information of the sender more comprehensive and accurate.

[0044] The present invention is further configured to perform security verification on the fingerprint tag, including: performing hash decryption on the sending fingerprint tag to obtain a spatial feature vector and a sending fingerprint value, calculating a verification sending fingerprint value according to the spatial feature vector, generating a verification sending fingerprint tag by performing hash transformation on the spatial feature vector and the verification sending fingerprint value, and comparing whether the sending fingerprint tag and the verification sending fingerprint tag are consistent. When they are consistent, the security verification passes. Specifically, first, the sending fingerprint tag is hash decrypted to obtain the spatial feature vector and the sending fingerprint value constructed by the sending end, the spatial feature vector represents the characteristics of the sending end in three dimensions, and the sending fingerprint value is a unique identifier calculated based on these characteristics. Based on the decrypted spatial feature vector, the verification sending fingerprint value is recalculated. The calculation formula is the same as the logic of the original construction of the sending fingerprint value, that is, the verification sending fingerprint value is calculated by using the cumulative effect of the feature modulus and the characteristics of each dimension. The recalculated spatial feature vector and the verification sending fingerprint value are transformed into a verification sending fingerprint tag, the purpose of which is to generate a unique verification tag through the same hash algorithm. The original sending fingerprint tag is compared with the regenerated verification sending fingerprint tag. If the two are consistent, it means that the spatial characteristics of the data and the sent fingerprint value have not changed during the transmission process, and the security check has passed.

[0045] The present invention is further configured such that the second parameter data of the intermediate transmission node includes the intermediate transmission node identification number, node load, network bandwidth occupancy rate and transmission time interval; specifically, the intermediate transmission node identification number is a code or mark used to uniquely identify the intermediate transmission node. Each intermediate transmission node has a unique identification number, including the node's MAC address, device ID or other unique network identification, which is used to identify and track the location and identity of each intermediate node in the transmission path; the node load refers to the processing load currently borne by the intermediate transmission node, reflecting the resource usage of the node; the network bandwidth occupancy rate refers to the ratio between the network bandwidth used by the intermediate transmission node and its total bandwidth, which is used to reflect the degree of use of network resources by the node during data transmission; the transmission time interval refers to the time interval for the intermediate transmission node to process and forward data packets, indicating the waiting time of the data at the node. The shorter the transmission time interval, the higher the processing efficiency of the node and the faster the data transmission speed; conversely, if the transmission time interval is longer, it may indicate that the node processing speed is slow or there is a queue waiting.

[0046] Generate a dynamic path mark according to the second parameter data, including: using the intermediate transmission node identification number as a unique identifier, using the node load, network bandwidth occupancy rate and transmission time interval as attributes, constructing a dynamic path set, and setting the dynamic path set as a dynamic path mark. Specifically, the dynamic path mark can accurately record all node information through which the data passes by combining the unique identification number and state attribute of the intermediate node. The dynamic path mark not only records the nodes in the path, but also includes the state information of the nodes, so as to fully reflect the real-time situation in the network transmission process. By constructing a dynamic path set, the state changes of each node can be monitored in real time, abnormal situations in the transmission process can be discovered in time, and the transparency of the transmission path and the security of data transmission can be improved.

[0047] The present invention is further configured to perform an abnormality analysis on the dynamic path mark according to a preset abnormality analysis algorithm, and when an abnormality exists, an abnormality signal is generated to issue an alarm, including:

[0048] Generate a transmission chain list according to the intermediate transmission node identification number in the order of transmission, wherein the previous intermediate transmission node identification number points to the next intermediate transmission node identification number;

[0049] Check whether there is a loop link in the transmission linked list. If there is, generate an abnormal signal and alarm. Specifically, by constructing a transmission linked list and detecting the loop link therein, cyclic redundancy and dead loop problems of data in the process of network transmission can be effectively prevented. By traversing the transmission linked list, detect whether there is a loop link pointing to a loop in the linked list, that is, a node points to a node that already existed before. Detection is performed through the following steps: Fast and slow pointer method: set two pointers, a fast pointer and a slow pointer. The fast pointer moves two nodes at a time, and the slow pointer moves one node at a time. If there is a loop in the linked list, the fast pointer will meet the slow pointer at a certain moment. When a loop link is detected in the transmission linked list, an abnormal signal is immediately generated and an alarm is triggered. The purpose of generating an abnormal signal is to notify the system that there may be a dead loop or wrong routing during the data transmission process, so as to avoid data from circulating infinitely in the network, resulting in waste of network resources or system crash.

[0050] The path consistency index is calculated according to the node load, the network bandwidth occupancy rate and the transmission time interval; the present invention is further configured that the calculation logic of the path consistency index is: Among them, C path is the path consistency index, n is the number of intermediate transmission nodes, L i is the node load of the i-th intermediate transmission node, B i is the network bandwidth occupancy rate of the i-th intermediate transmission node, D iis the transmission time interval between the i-1th and ith intermediate transmission nodes, and D1 is zero. Specifically, the path consistency index is used to measure the state consistency of each intermediate transmission node during the data transmission process. By combining the load of each node, the network bandwidth occupancy rate, and the transmission time interval, a comprehensive path consistency index is generated to reflect the stability and consistency of the transmission path; multi-dimensional node characteristics are comprehensively considered to ensure the integrity of the characteristics. Furthermore, nodes with higher node loads may cause increased data transmission delays or data loss; the higher the bandwidth occupancy rate, the slower the data transmission speed may be, thereby affecting the transmission efficiency of the entire path. Bandwidth occupancy rate reflects the network resource usage of the node; transmission delay directly affects the time it takes for data to be transmitted from one node to another. Through the comprehensive analysis of these three dimensions, the network status of each node in the path can be fully reflected to ensure that the path consistency feature does not depend on a single factor. In the calculation logic, a nonlinear function is used for the combination of node load, bandwidth occupancy and transmission delay, which enhances the sensitivity and uniqueness of the path consistency feature: in the calculation logic, the nonlinear relationship between the ratio of node load and bandwidth occupancy and delay makes the path consistency feature not just a simple combination of the characteristics of each node, but a comprehensive characteristic value is generated through the mutual influence of these node characteristics. For example, when a node has a high load and a low bandwidth occupancy, the ratio of load to bandwidth will be larger, causing the output of the sine function to approach the limit value.

[0051] The path abnormality feature is calculated according to the path consistency index. When the path abnormality feature is greater than a preset threshold, an abnormality signal is generated and an alarm is issued. The present invention is further configured such that the calculation logic of the path abnormality feature is: Among them, E path It is the path anomaly feature. Specifically, the path anomaly feature is used to quantify the degree of deviation of each intermediate transmission node from the expected state, so as to judge the stability of the transmission path. The purpose is to identify and quantify the anomalies in the path so that the system can generate abnormal signals and issue alarms in time. The path anomaly feature is generated by the difference in the complex ratio of the path consistency feature and the delay and load of each node. This feature measures the degree of deviation of the state of each node in the path from the overall consistency, ensuring that under different node states, the abnormal feature value can sensitively reflect the path inconsistency.

[0052] The above embodiments can be implemented in whole or in part by software, hardware, firmware or any other combination. When implemented by software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0053] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0054] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0055] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0056] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0057] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0058] In the several embodiments provided in the present application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0059] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0060] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0061] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0062] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network link security management method based on artificial intelligence, characterized in that: include: When the network receiving link receives the data file sent by the sending end, the first parameter data of the sending end is obtained, a sending feature is constructed according to the first parameter data, and a sending fingerprint mark is generated according to the sending feature; Performing a security check on the fingerprint mark, and after passing the security check, packaging the data file and the fingerprint mark to generate a file to be transmitted; When the network transmission link receives the file to be transmitted, a blank dynamic path mark is generated, and whenever the file to be transmitted passes through an intermediate transmission node, the second parameter data of the intermediate transmission node is recorded, a dynamic path mark is generated according to the second parameter data, and the dynamic path mark is input; When the file to be transmitted is transmitted to the receiving end, the dynamic path mark is obtained, and the dynamic path mark is analyzed for abnormalities according to a preset abnormality analysis algorithm. When an abnormality exists, an abnormality signal is generated and an alarm is issued.

2. According to the artificial intelligence-based network link security management method of claim 1, it is characterized in that: The first parameter data of the sender includes a sender identification number, a geographic location, a sending frequency, a sending time interval, a sending speed and a network delay, wherein the geographic location includes longitude and latitude.

3. According to the artificial intelligence-based network link security management method of claim 2, it is characterized in that: Constructing the sending feature according to the first parameter data includes: calculating the location change feature according to the current geographical location and the geographical location of the last sending, when there is no last sending, the location change feature is zero; calculating the sending behavior feature according to the sending frequency and the sending time interval; calculating the sending environment feature according to the sending speed and the network delay; Taking the location change feature, the sending behavior feature and the sending environment feature as three dimensions, a spatial feature vector is constructed, a sending fingerprint value is calculated, and the spatial feature vector and the sending fingerprint value are transformed into a sending fingerprint tag through a hash transformation.

4. According to the artificial intelligence-based network link security management method of claim 3, it is characterized in that: The calculation logic of the position change feature is: Among them, CLo is the position change feature, Lat current and Lat prev The latitude of the current geographic location and the last sent geographic location, Lon current -Lon prev It is the longitude of the current geographic location and the last sent geographic location; the calculation logic of the sending behavior characteristics is: Among them, CBe is the sending behavior characteristic, F send is the sending frequency, T interval is the sending time interval; the calculation logic of the sending environment characteristics is: Among them, CEn is the sending environment characteristic, V send is the sending speed, D delay For network delay.

5. According to the artificial intelligence-based network link security management method of claim 4, it is characterized in that: The sending behavior characteristics and sending environment characteristics are normalized, and the spatial feature vector is constructed with the position change characteristics, sending behavior characteristics and sending environment characteristics as three dimensions. The spatial feature vector is expressed as: V send =[CLo,CBe,CEn],V send is a spatial feature vector, and the calculation logic of sending the fingerprint value is: Among them, S send is the fingerprint value to be sent, ∥·∥ is the modulus length of the vector, m is the dimension of the vector, V send [j] is the eigenvalue of the jth dimension, φ j is the adjustment parameter of the j-th dimension, and ∏ is the cumulative product symbol.

6. The method for network link security management based on artificial intelligence according to claim 1 is characterized in that: The fingerprint mark is subjected to security verification, including: performing hash decryption on the sending fingerprint mark to obtain a spatial feature vector and a sending fingerprint value, calculating a verification sending fingerprint value according to the spatial feature vector, performing a hash transformation on the spatial feature vector and the verification sending fingerprint value to generate a verification sending fingerprint mark, and comparing whether the sending fingerprint mark and the verification sending fingerprint mark are consistent. If they are consistent, the security verification is passed.

7. The method for network link security management based on artificial intelligence according to claim 1 is characterized in that: Second parameter data of the intermediate transmission node, including the intermediate transmission node identification number, node load, network bandwidth occupancy rate and transmission time interval; Generate a dynamic path label according to the second parameter data, including: using the intermediate transmission node identification number as a unique identifier, node load, network bandwidth occupancy rate and transmission time interval as attributes, constructing a dynamic path set, and setting the dynamic path set as a dynamic path label.

8. The method for network link security management based on artificial intelligence according to claim 7 is characterized in that: The dynamic path mark is analyzed for abnormality according to a preset abnormality analysis algorithm, and when an abnormality exists, an abnormality signal is generated to give an alarm, including: Generate a transmission chain list according to the intermediate transmission node identification number in the order of transmission, wherein the previous intermediate transmission node identification number points to the next intermediate transmission node identification number; Check whether there is a ring link in the transmission chain table. If there is, generate an abnormal signal and issue an alarm; Calculate the path consistency index based on node load, network bandwidth occupancy, and transmission time interval; The path abnormality feature is calculated according to the path consistency index. When the path abnormality feature is greater than the preset threshold, an abnormal signal is generated and an alarm is issued.

9. The method for network link security management based on artificial intelligence according to claim 8, characterized in that: The calculation logic of the path consistency index is: Among them, C path is the path consistency index, n is the number of intermediate transmission nodes, L i is the node load of the i-th intermediate transmission node, B i is the network bandwidth occupancy rate of the i-th intermediate transmission node, D i is the transmission time interval between the i-1th and ith intermediate transmission nodes, and D1 is zero.

10. The method for network link security management based on artificial intelligence according to claim 9 is characterized in that: The calculation logic of the path anomaly feature is: Among them, E path It is the path abnormality feature.

Images