Industrial internet network security big data state evaluation method based on AI mode recognition

Abstract

The invention relates to the technical field of network security assessment, in particular to an industrial internet network security big data state assessment method based on AI mode recognition, which comprises the following steps: S1, acquiring original network data from a plurality of network nodes, terminal equipment and a server in an industrial internet; s2, based on a deep learning feature extraction framework, respectively extracting time sequence features, spatial features and behavior features in the structured data set, and constructing a comprehensive feature vector; and S3, threat mode recognition model construction: constructing a network threat mode recognition model based on the training data by using a multi-classification deep learning network. According to the method, the comprehensive coverage of potential threats in a complex network environment is realized, and the accuracy and comprehensiveness of threat mode recognition are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security assessment, and particularly to an industrial Internet network security big data status assessment method based on AI pattern recognition. Background Art

[0002] With the rapid development of industrial Internet technology, a large number of industrial devices and production systems are connected through the network to form a complex industrial Internet of Things ecosystem. While this ecosystem improves production efficiency, optimizes resource allocation, and enhances the level of intelligence, it also exposes many network security problems. The industrial Internet system involves various device types, protocol standards, and data formats, and its operating environment usually includes a large number of heterogeneous data sources and a highly complex network topology structure, making it difficult for traditional security monitoring methods to comprehensively cover the threat surface.

[0003] Currently, common threats to industrial Internet network security include malicious attacks (such as distributed denial-of-service attacks, malware propagation), data leakage (such as illegal access and theft of sensitive information), and abnormal internal operations (such as unauthorized device control or data tampering). Existing security assessment methods mainly rely on rule-based detection technologies and static analysis models. These methods have a high recognition rate for known threats, but they show obvious limitations when facing constantly changing attack patterns and complex industrial environments. Summary of the Invention

[0004] The present invention provides an industrial Internet network security big data status assessment method based on AI pattern recognition.

[0005] The industrial Internet network security big data status assessment method based on AI pattern recognition includes the following steps:

[0006] S1, Collecting original network data from multiple network nodes, terminal devices, and servers in the industrial Internet. The data includes network traffic data, device log data, user operation behavior data, protocol interaction data, and security event record data; formatting the original data and aligning the timestamps to generate a structured data set;

[0007] S2, Feature extraction and fusion: Based on a deep learning feature extraction framework, extracting time series features, spatial features, and behavior features in the structured data set respectively, and performing multi-dimensional fusion on the extracted features through a feature fusion module to construct a comprehensive feature vector;

[0008] S3, Constructing a threat pattern recognition model: Using a multi-class deep learning network to construct a network threat pattern recognition model based on training data. The training data includes historical network security event samples and corresponding threat labels, and the model realizes the efficient recognition of threat patterns by minimizing the loss function.

[0009] Optionally, the generation of the structured data set specifically includes:

[0010] Formatting: Convert data from different sources into a unified structured format, normalize field names, and fill in default values for missing key fields;

[0011] Timestamp alignment: Configure all devices in the network to use an industrial standard clock protocol for time synchronization, and correct the timestamps of the collected data based on a central time server;

[0012] Structured data generation: Use a relational database to store structured data, add meta-information tags according to the data source for subsequent query and analysis, and partition and store the structured data by time, data type, or device ID.

[0013] Optionally, the S2 specifically includes:

[0014] Time series feature extraction: Use a long short-term memory network to analyze the time series in network traffic data and device logs, capture the trends and abnormal points of the data changing over time, assign higher weights to the features of key time periods in the time series based on the attention mechanism, improve the sensitivity to emergencies, and output time series feature vectors, representing the dynamic behavior patterns of industrial devices and network systems in the time dimension;

[0015] Spatial feature extraction: Use a convolutional neural network to extract features from the topological structures of network nodes and connections in protocol interaction data and user behavior data, combine with a network embedding algorithm, map the association relationships between network nodes to a low-dimensional vector space, generate network spatial feature vectors, analyze the importance of nodes and interaction patterns in space, and extract the features of high-risk areas in the network;

[0016] Behavior feature extraction: Use a variational autoencoder to perform unsupervised learning on user operation behavior data, capture the potential distribution patterns of user behavior, combine with a frequent pattern mining algorithm to analyze the commonalities and abnormal operation behaviors of user operation sequences, and generate behavior feature vectors, reflecting the relationship between user behavior and the industrial network security status.

[0017] Optionally, the S2 further includes feature fusion:

[0018] Perform multi-dimensional fusion on the time series feature vector, spatial feature vector, and behavior feature vector through a feature fusion module, use a multi-layer perceptron with weight adaptive adjustment to integrate various feature vectors, and output a comprehensive feature vector.

[0019] Optionally, the use of a multi-class deep learning network in S3 to construct a network threat pattern recognition model based on training data specifically includes:

[0020] Data Preparation: Collect historical network security event samples. The sample data includes network traffic data, protocol interaction data, user operation behavior data, and security event record data. Assign threat labels to each historical security event sample. The label categories include malicious traffic, data leakage, distributed denial-of-service attack, privilege escalation, and normal operation. Extract features from the sample data;

[0021] Deep Learning Network Design: Construct a multi-class deep learning network, where the multi-class deep learning network includes:

[0022] An input layer for receiving the comprehensive feature vector;

[0023] A number of hidden layers that use a convolutional neural network to extract spatial features and combine a long short-term memory network to model time series features;

[0024] A fully connected layer that maps high-dimensional features to classification probabilities;

[0025] An output layer that uses the Softmax activation function to generate the probability distribution of threat categories.

[0026] Optionally, it also includes model training: Use the training dataset to train the deep learning network. During the training process, use the cross-entropy loss function as the objective function, defined as:

[0027] where N is the number of samples, C is the number of categories, y ij represents the true label of sample i in category j, and p ij represents the category probability predicted by the model. Use the Adam optimizer to minimize the loss function and iteratively adjust the network weights to improve the classification accuracy;

[0028] Evaluate the model performance on the validation dataset.

[0029] Optionally, the input layer receives the comprehensive feature vector x ∈ R d , where d is the feature dimension. If the input data is batch processed, the input vector is represented as: X = [x 1 , x 2 , …, x N ∈ R N×d , where N is the batch size;

[0030] The calculation of the hidden layer is expressed as:

[0031] Convolution operation to extract spatial features. Perform feature extraction on the input feature X. The convolution operation is expressed as:

[0032] H (1) = f(W (1) *X + b(1) ) where W (1) is the convolutional kernel, * represents the convolution operation, b (1) is the bias vector, f is the non-linear activation function, H (1) is the first layer of hidden features;

[0033] The long short-term memory network models the time features; after concatenating the convolutional features and the time series features, they are input into the fully connected layer, and the calculation formula is:

[0034] H (2) = f(W (2) ·concat(H (1) , h T ) + b (2) ), where concat(·) represents feature concatenation, W (2) and b (2) are the weights and biases of the fully connected layer, and H (2) is the output feature of the fully connected layer;

[0035] The output layer uses the Softmax function to generate the probability distribution for each category;

[0036] Applying the trained deep learning model to real-time threat detection, after inputting real-time data, the network can efficiently identify threat patterns and classify them.

[0037] Advantages of the present invention:

[0038] In the present invention, by performing real-time collection and unified formatting processing on multi-source data in the industrial Internet, and combining with a deep learning feature extraction framework, time series features, spatial features, and behavior features are respectively extracted and then multi-dimensionally fused to generate a comprehensive feature vector. This fusion of multi-source data and unified modeling of multi-dimensional features overcomes the limitations of traditional single data source security assessment methods, achieves comprehensive coverage of potential threats in complex network environments, and improves the accuracy and comprehensiveness of threat pattern recognition.

[0039] In the present invention, by using a multi-class deep learning network and training with historical network security event samples and threat labels, a threat pattern recognition model can be efficiently constructed. The model minimizes the cross-entropy loss function to achieve precise classification of various threat patterns in the network. Compared with traditional rule-based threat detection methods, the deep learning model can automatically learn the potential features in the data and has strong adaptability, thus having higher accuracy and efficiency in identifying unknown threats, effectively reducing the false alarm rate and the missed alarm rate. Description of the Drawings

[0040] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are only those of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0041] Figure 1 It is a schematic flowchart of the method according to an embodiment of the present invention. Detailed implementation manners

[0042] The present invention will be described in detail below in conjunction with the drawings and specific embodiments. At the same time, it should be noted here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments. For some well-known technologies, those skilled in the art can also adopt other alternative methods for implementation; moreover, the drawing part is only for more specifically describing the embodiments, and is not intended to specifically limit the present invention.

[0043] It should be pointed out that in the specification, when referring to "an embodiment", "embodiments", "exemplary embodiments", "some embodiments", etc., it indicates that the described embodiments may include specific features, structures or characteristics, but not necessarily every embodiment includes such specific features, structures or characteristics. In addition, when combining embodiments to describe specific features, structures or characteristics, implementing such features, structures or characteristics in combination with other embodiments (whether explicitly described or not) should be within the knowledge of those skilled in the relevant art.

[0044] Generally, terms can be understood at least in part from their use in the context. For example, at least in part depending on the context, the term "one or more" used herein can be used to describe any feature, structure or characteristic in a singular sense, or can be used to describe a combination of features, structures or characteristics in a plural sense. In addition, the term "based on" can be understood as not necessarily intended to convey a set of exclusive factors, but rather, at least in part depending on the context, allowing the existence of other factors that may not be explicitly described.

[0045] As Figure 1 shown, the industrial Internet network security big data status evaluation method based on AI pattern recognition includes the following steps:

[0046] S1, collect raw network data from multiple network nodes, terminal devices and servers in the industrial Internet. The data includes network traffic data, device log data, user operation behavior data, protocol interaction data and security event record data; format the raw data and align the timestamps to generate a structured data set;

[0047] S2, Feature Extraction and Fusion: Based on the deep learning feature extraction framework, extract the time series features, spatial features, and behavioral features in the structured dataset respectively, and perform multi-dimensional fusion on the extracted features through the feature fusion module to construct a comprehensive feature vector;

[0048] S3, Construction of Threat Pattern Recognition Model: Use a multi-class deep learning network to construct a network threat pattern recognition model based on the training data. The training data includes historical network security event samples and corresponding threat labels, and the model realizes the efficient recognition of threat patterns by minimizing the loss function.

[0049] The generation of the structured dataset specifically includes:

[0050] Formatting: Convert data from different sources into a unified structured format, normalize field names, and fill default values for missing key fields;

[0051] Timestamp Alignment: Configure all devices in the network to use the industrial standard clock protocol for time synchronization, and correct the timestamps of the collected data based on the central time server;

[0052] Structured Data Generation: Use a relational database to store structured data, add meta-information tags according to the data source for subsequent query and analysis, and partition and store the structured data by time, data type, or device ID.

[0053] S2 specifically includes:

[0054] Time Series Feature Extraction: Use a long short-term memory network to analyze the time series in network traffic data and device logs, capture the trends and anomalies of the data over time, assign higher weights to the features of key time periods in the time series based on the attention mechanism, improve the sensitivity to sudden events, and output a time series feature vector, representing the dynamic behavior patterns of industrial devices and network systems in the time dimension;

[0055] Spatial Feature Extraction: Use a convolutional neural network to extract features from the topological structures of network nodes and connections in protocol interaction data and user behavior data, combine with a network embedding algorithm, map the association relationships between network nodes to a low-dimensional vector space, generate a network spatial feature vector, analyze the importance of nodes and interaction patterns in space, and extract the features of high-risk areas in the network;

[0056] Behavioral Feature Extraction: Use a variational autoencoder to perform unsupervised learning on user operation behavior data, capture the potential distribution patterns of user behavior, combine with a frequent pattern mining algorithm to analyze the commonalities and abnormal operation behaviors of user operation sequences, and generate a behavioral feature vector, reflecting the relationship between user behavior and the industrial network security status.

[0057] S2 also includes feature fusion:

[0058] Through the feature fusion module, multi-dimensional fusion is performed on the time series feature vector, spatial feature vector, and behavior feature vector. A multi-layer perceptron based on weight adaptive adjustment is used to integrate various feature vectors and output a comprehensive feature vector. The generation process of the comprehensive feature vector dynamically adjusts the feature fusion strategy according to the task requirements to ensure that the correlations of different feature dimensions are effectively utilized.

[0059] In S3, using the multi-class deep learning network to construct a network threat pattern recognition model specifically includes:

[0060] Data preparation: Collect historical network security event samples. The sample data includes network traffic data, protocol interaction data, user operation behavior data, and security event record data. Assign threat labels to each historical security event sample. The label categories include malicious traffic, data leakage, distributed denial of service attack, privilege escalation, and normal operation. Feature extraction is performed on the sample data;

[0061] Deep learning network design: Construct a multi-class deep learning network. The multi-class deep learning network includes:

[0062] An input layer for receiving the comprehensive feature vector;

[0063] Several hidden layers that use a convolutional neural network to extract spatial features and combine a long short-term memory network to model time series features;

[0064] A fully connected layer that maps high-dimensional features to classification probabilities;

[0065] An output layer that uses the Softmax activation function to generate the probability distribution of threat categories.

[0066] It also includes model training: Use the training dataset to train the deep learning network. During the training process, the cross-entropy loss function is used as the objective function, defined as:

[0067] where N is the number of samples, C is the number of categories, y ij represents the true label of sample i in category j, and p ij represents the category probability predicted by the model. Use the Adam optimizer to minimize the loss function and iteratively adjust the network weights to improve the classification accuracy;

[0068] Evaluate the model performance on the validation dataset.

[0069] The input layer receives the comprehensive feature vector x ∈ R d , where d is the feature dimension. If the input data is batch processed, the input vector is represented as: X = [x 1 ,x2 , …, x N ∈ R N×d , where N is the batch size;

[0070] The calculation of the hidden layer is expressed as:

[0071] The convolution operation extracts spatial features and performs feature extraction on the input feature X. The convolution operation is expressed as:

[0072] H (1) = f(W (1) * X + b (1) ), where W (1) is the convolution kernel, * represents the convolution operation, b (1) is the bias vector, f is the non - linear activation function, and H (1) is the first - layer hidden feature;

[0073] The long short - term memory network models temporal features; after concatenating the convolution features and the time - series features, they are input into the fully - connected layer. The calculation formula is:

[0074] H (2) = f(W (2) · concat(H (1) , h T ) + b (2) ), where concat(·) represents feature concatenation, W (2) and b (2) are the weights and biases of the fully - connected layer, and H (2) is the output feature of the fully - connected layer;

[0075] The output layer uses the Softmax function to generate the probability distribution for each class;

[0076] Applying the trained deep - learning model to real - time threat detection, after inputting real - time data, the network can efficiently identify threat patterns and classify them.

[0077] This invention covers any alternatives, modifications, equivalent methods, and solutions within the spirit and scope of this invention. To enable the public to have a thorough understanding of this invention, specific details are elaborated in the following preferred embodiments of this invention. However, those skilled in the art can fully understand this invention even without the description of these details. Additionally, to avoid unnecessary confusion to the essence of this invention, well - known methods, processes, flows, components, and circuits are not described in detail.

[0078] The above - mentioned are only the preferred embodiments of this invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of this invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of this invention.

Claims

1. An industrial Internet network security big data status assessment method based on AI pattern recognition, characterized in that: The following steps are involved: S1, collecting raw network data from multiple network nodes, terminal devices and servers in the industrial Internet, the data including network traffic data, device log data, user operation behavior data, protocol interaction data and security event record data; formatting and timestamp aligning the raw data to generate a structured data set; S2, feature extraction and fusion: Based on the deep learning feature extraction framework, the time series features, spatial features and behavioral features in the structured data set are extracted respectively, and the extracted features are fused in multiple dimensions through the feature fusion module to construct a comprehensive feature vector; S3, threat pattern recognition model construction: Utilize a multi-classification deep learning network to build a network threat pattern recognition model based on training data. The training data includes historical network security event samples and corresponding threat labels. The model achieves efficient recognition of threat patterns by minimizing the loss function.

2. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 1 is characterized in that: The structured data set generation specifically includes: Formatting: Convert data from different sources into a unified structured format, normalize field names, and fill in default values ​​for missing key fields; Timestamp alignment: configure all devices in the network to use industrial standard clock protocols for time synchronization, and correct the timestamps of collected data based on the central time server; Structured data generation: Use a relational database to store structured data, add metadata tags based on the data source to facilitate subsequent query and analysis, and partition and store structured data by time, data type, or device ID.

3. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 1 is characterized in that: The S2 specifically includes: Time series feature extraction: Use long short-term memory networks to analyze the time series in network traffic data and device logs, capture the trends and anomalies of data over time, give higher weights to the features of key time periods in the time series based on the attention mechanism, improve sensitivity to emergencies, and output time series feature vectors to represent the dynamic behavior patterns of industrial equipment and network systems in the time dimension; Spatial feature extraction: Use convolutional neural networks to extract features from the topological structure of network nodes and connections in protocol interaction data and user behavior data. Combined with network embedding algorithms, map the associations between network nodes to low-dimensional vector space, generate network space feature vectors, analyze the importance of nodes and interaction patterns in space, and extract features of high-risk areas in the network. Behavioral feature extraction: Use variational autoencoders to perform unsupervised learning on user operation behavior data to capture the potential distribution patterns of user behavior. Combined with frequent pattern mining algorithms, analyze the commonalities and abnormal operation behaviors of user operation sequences to generate behavioral feature vectors that reflect the relationship between user behavior and the security status of industrial networks.

4. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 3 is characterized in that: The S2 also includes feature fusion: The feature fusion module is used to perform multi-dimensional fusion of time series feature vectors, spatial feature vectors and behavioral feature vectors. A multi-layer perceptron based on adaptive weight adjustment is used to integrate various feature vectors and output a comprehensive feature vector.

5. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 1 is characterized in that: The use of a multi-classification deep learning network in S3 to construct a network threat pattern recognition model based on training data specifically includes: Data preparation: Collect historical network security event samples. The sample data includes network traffic data, protocol interaction data, user operation behavior data, and security event record data. Assign threat labels to each historical security event sample. Label categories include malicious traffic, data leakage, distributed denial of service attacks, privilege escalation, and normal operations. Perform feature extraction on the sample data. Deep learning network design: Construct a multi-classification deep learning network, which includes: Input layer, used to receive the comprehensive feature vector; Several hidden layers use convolutional neural networks to extract spatial features and long short-term memory networks to model time series features; Fully connected layer, mapping high-dimensional features into classification probabilities; The output layer uses the Softmax activation function to generate the probability distribution of threat categories.

6. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 5 is characterized in that: It also includes model training: using the training data set to train the deep learning network, and using the cross-extraction loss function as the objective function during the training process, which is defined as: Among them, N is the number of samples, C is the number of categories, and y ij represents the true label of sample i in category j, p ij Represents the category probability predicted by the model, uses the Adam optimizer to minimize the loss function, and iteratively adjusts the network weights to improve the classification accuracy; Evaluate model performance on the validation dataset.

7. The industrial Internet network security big data status assessment method based on AI pattern recognition according to claim 6 is characterized in that: The input layer receives the comprehensive feature vector x∈R d , where d is the feature dimension, and the input data is processed in batches, then the input vector is represented as: X = [x1, x2, ..., x N ]∈R N×d , where N is the batch size; The hidden layer calculation is expressed as: Convolution operation extracts spatial features and performs feature extraction on the input feature X. The convolution operation is expressed as: H (1) =f(W (1) *X+b (1) ), where W (1) is the convolution kernel, * indicates the convolution operation, b (1) is the bias vector, f is the nonlinear activation function, H (1) is the first layer of hidden features; The long short-term memory network models the time feature; the convolutional feature and the time series feature are concatenated and input into the fully connected layer. The calculation formula is: H (2) =f(W (2) ·concat(H (1) ,h T )+b (2) ), where concat(·) represents feature concatenation, W (2) and b (2) are the weights and biases of the fully connected layer, H (2) is the output feature of the fully connected layer; The output layer generates a probability distribution for each category using a Softmax function; The trained deep learning model is applied to real-time threat detection. After inputting real-time data, the network can efficiently identify and classify threat patterns.

Images