Network information security risk assessment system based on AI

Abstract

The invention relates to an AI-based network information security risk assessment system. The method comprises the following steps that: a data processing module acquires risk index data of a network topology region, and performs feature extraction on the risk index data to generate a risk feature vector; and the correlation analysis module performs similarity matrix calculation based on each risk feature vector to obtain correlation relationship data among different types of vectors, then inputs the data into a neural network model to construct a parameter correlation graph, and extracts network effect features among the data. And the feature fusion module calculates the correlation influence degree of each parameter according to the network effect features to obtain a corresponding global influence weight, and performs weighted fusion on the risk feature vectors based on the global influence weight to generate comprehensive feature representation. And finally, the risk assessment module inputs the comprehensive feature representation into a trained risk assessment model to obtain a risk score of the current security situation. According to the system, more efficient, intelligent and accurate evaluation of network security risks is realized, and stable and safe operation of a network information system is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology, and in particular relates to an AI-based network information security risk assessment system. Background Art

[0002] With the development of artificial intelligence (AI), AI-based cybersecurity risk assessment techniques have emerged. However, the proliferation of cyberattack methods, such as malware intrusions, phishing, and DDoS attacks, poses significant challenges to cybersecurity. Traditional cybersecurity risk assessment methods rely heavily on static rules and manual experience, making it difficult to accurately and real-timely identify potential risks in the face of massive amounts of complex and dynamically changing network data. These methods have failed to overcome the limitations of traditional assessment methods and achieve more efficient, intelligent, and accurate assessments of cybersecurity risks to address the increasingly complex cybersecurity landscape and ensure the stable and secure operation of network information systems. Summary of the Invention

[0003] Based on this, it is necessary to provide an AI-based network information security risk assessment system that can achieve a more efficient, intelligent and accurate assessment of network security risks in response to the above technical problems.

[0004] In a first aspect, this application provides an AI-based network information security risk assessment system, comprising:

[0005] The data processing module is used to obtain risk indicator data of the network topology area; the risk indicator data includes at least one of network traffic data, system log data and security event information; and is also used to extract features from the risk indicator data to obtain a risk feature vector for evaluating the current security situation.

[0006] The association analysis module is used to calculate the similarity matrix of each risk feature vector to obtain the association relationship data between different types of vectors; it is also used to input the association relationship data into the neural network model to construct a parameter association graph, and use node embedding technology to extract the network effect characteristics between the data.

[0007] The feature fusion module is used to calculate the associated influence of each parameter based on the network effect characteristics and use the graph convolution layer to aggregate the information of neighboring nodes to obtain the corresponding global influence weight; it is also used to perform weighted fusion of risk feature vectors based on the global influence weight to generate a comprehensive feature representation.

[0008] The risk assessment module is used to input the comprehensive feature representation into the trained risk assessment model to calculate the risk score of the current security situation.

[0009] In one embodiment, feature extraction is performed on risk indicator data to obtain a risk feature vector for evaluating the current security situation, including:

[0010] The principal component analysis method is used to extract numerical features from the traffic size, number of data packets and connection establishment frequency of the network traffic data in the risk indicator data to generate the first eigenvector.

[0011] A statistical feature extractor is used to extract numerical features from the timestamp and event type fields of the system log data in the risk indicator data to generate a second feature vector.

[0012] The security event information in the risk indicator data is extracted using a feature extraction method based on support vector machines. Key features are extracted from the time of event occurrence, the system components involved, and the severity of the event to generate a third feature vector.

[0013] The first feature vector, the second feature vector, and the third feature vector are semantically aligned and input into a preset identical feature space mapping rule to obtain a mapping feature vector that eliminates feature semantic differences.

[0014] The feature fusion network based on the self-attention mechanism is used to perform multi-layer nonlinear transformation on the mapping feature vector to obtain a risk feature vector that comprehensively reflects the current network information security situation.

[0015] In one embodiment, similarity matrix calculation is performed on each risk feature vector to obtain correlation relationship data between different types of vectors, including:

[0016] The cosine similarity algorithm is used to calculate each risk feature vector to obtain the similarity between each feature quantity.

[0017] Calculate the matrix value of similarity and use cluster analysis algorithm to determine the type value division of the vector to obtain the cluster division result.

[0018] The clustering results are converted into a relational graph structure using dimension value mapping, and the correlation analysis algorithm is used to parse the vector correlation relationship in the relational graph.

[0019] According to the vector association relationship, the association degree between vectors is quantitatively calculated using a preset quantization formula to obtain the association relationship data between different types of vectors.

[0020] In one embodiment, the matrix value of the similarity is calculated and the type value division of the vector is determined using a cluster analysis algorithm to obtain a cluster division result, including:

[0021] Based on the similarity of each risk feature vector, the distance value between each pair of vectors is calculated to construct a similarity matrix.

[0022] The similarity matrix between each pair of vectors is calculated using the following formula:

[0023]

[0024]

[0025] Among them, C ij represents the cosine similarity between the i-th vector and the j-th vector, v i represents the i-th risk feature vector, v j represents the j-th risk feature vector, d ij represents the Euclidean distance between the i-th vector and the j-th vector, C ik represents the cosine similarity between the i-th vector and the k-th component, C jk represents the cosine similarity between the jth vector and the kth component, n represents the vector dimension, s ij represents the Gaussian similarity between the i-th vector and the j-th vector, and σ represents the bandwidth parameter of the Gaussian kernel function.

[0026] Calculate the matrix value of the similarity matrix and use the clustering algorithm to determine the initial center point, and calculate the distance value from each vector to the center point.

[0027] Each vector is divided into the nearest center point according to the distance value to obtain the initial clustering result.

[0028] Among them, if the initial clustering result does not converge, the center point is recalculated and the number of iterations is increased to update the initial clustering result; if the initial clustering result converges, the iteration is stopped to obtain the final clustering division result.

[0029] In one embodiment, the correlation influence of each parameter is calculated based on the network effect characteristics and the information of the neighboring nodes is aggregated using a graph convolution layer to obtain the corresponding global influence weight, including:

[0030] A parameter association matrix is ​​constructed based on the network effect characteristics, and the initial influence degree corresponding to each parameter is calculated.

[0031] The graph structure is constructed according to the initial influence degree to obtain the neighborhood relationship between neighborhood nodes.

[0032] Based on the neighborhood relationship, the graph convolution algorithm is used to aggregate the feature information of the neighborhood nodes and update the node weight value.

[0033] The node weight value is judged based on a preset threshold. If the node weight value exceeds the preset threshold, the global weight distribution is adjusted based on the preset threshold to obtain the global influence weight.

[0034] The global weight distribution is optimized using machine learning algorithms to obtain updated global influence weights.

[0035] In one embodiment, the comprehensive feature representation is input into a trained risk assessment model to calculate a risk score for the current security situation, including:

[0036] Obtain the representation value in the comprehensive feature representation and determine whether the representation value meets the preset threshold value.

[0037] If the representation value satisfies the threshold value, the clustering algorithm is used to process the comprehensive feature representation to obtain a processed comprehensive feature representation.

[0038] If the representation value does not meet the threshold value, the dimensionality reduction algorithm is used to adjust the comprehensive feature representation to obtain a processed comprehensive feature representation.

[0039] The processed comprehensive feature representation is input into the trained risk assessment model to obtain the situation value of the current security situation.

[0040] Use the following formula to calculate the situation value and obtain the risk score of the current security situation:

[0041]

[0042] Where R represents the comprehensive risk score of the security situation, n represents the number of risk feature vectors, ω i represents the weight coefficient of the i-th risk feature vector, a i represents the actual value of the i-th risk feature vector, m i represents the maximum threshold of the i-th risk feature vector, α represents the time attenuation coefficient, β represents the time scale parameter, t represents the time interval, and p i Represents the part of the situation value p that is related to the i-th influencing factor.

[0043] In one embodiment, the risk assessment module further includes:

[0044] The risk level of the current security situation is determined based on the risk score. If the risk level exceeds the preset threshold, an early warning mechanism is generated.

[0045] Risk signals are extracted from the early warning mechanism, and clustering algorithms are used to classify and process the risk signals to obtain risk classification results.

[0046] According to the risk classification results, the dimensionality reduction algorithm is used to extract features of high-risk areas to obtain feature extraction results.

[0047] The key risk points are extracted from the feature extraction results, and the decision tree algorithm is used to prioritize the key risk points to obtain the priority ranking results.

[0048] Execute the risk treatment plan according to the priority sorting results to obtain the implementation results and update the risk assessment model based on the implementation results.

[0049] Secondly, this application also provides an AI-based network information security risk assessment method, which includes:

[0050] Obtain risk indicator data of the network topology area; the risk indicator data includes at least one of network traffic data, system log data and security event information; perform feature extraction on the risk indicator data to obtain a risk feature vector for evaluating the current security situation.

[0051] The similarity matrix of each risk feature vector is calculated to obtain the correlation data between different types of vectors; the correlation data is input into the neural network model to construct a parameter association graph, and the node embedding technology is used to extract the network effect characteristics between the data.

[0052] According to the network effect characteristics, the correlation influence of each parameter is calculated and the information of neighboring nodes is aggregated using the graph convolution layer to obtain the corresponding global influence weight; based on the global influence weight, the risk feature vector is weighted and fused to generate a comprehensive feature representation.

[0053] The comprehensive feature representation is input into the trained risk assessment model to calculate the risk score of the current security situation.

[0054] In a third aspect, the present application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor implements the above system and method when executing the computer program.

[0055] In a fourth aspect, the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the above system and method are implemented.

[0056] In the aforementioned AI-based network information security risk assessment system, the data processing module acquires risk indicator data for a network topology region, including at least one of network traffic data, system log data, and security event information, and performs feature extraction to generate a risk feature vector required for assessing the current security situation. The association analysis module calculates a similarity matrix based on each risk feature vector, deriving correlation data between different types of vectors. This data is then input into a neural network model to construct a parameter association graph, using node embedding technology to extract network effect features between the data. The feature fusion module calculates the correlation influence of each parameter based on the network effect features, aggregates neighboring node information using a graph convolution layer to obtain the corresponding global influence weight, and then performs weighted fusion of the risk feature vectors to generate a comprehensive feature representation. Finally, the risk assessment module inputs the comprehensive feature representation into a trained risk assessment model, which calculates a risk score for the current security situation. This system enables more efficient, intelligent, and accurate assessment of network security risks, addressing the increasingly complex network security landscape and ensuring the stable and secure operation of network information systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0058] Figure 1 A flowchart of an AI-based network information security risk assessment system provided in an embodiment of the present invention;

[0059] Figure 2 A flowchart of an embodiment of the present invention for extracting features from risk indicator data to obtain a risk feature vector for evaluating the current security situation;

[0060] Figure 3 A flowchart of calculating a similarity matrix for each risk feature vector to obtain correlation relationship data between different types of vectors provided by an embodiment of the present invention;

[0061] Figure 4 A flowchart of an embodiment of the present invention for calculating the associated influence of each parameter based on network effect characteristics and using a graph convolution layer to aggregate information of neighboring nodes to obtain the corresponding global influence weight;

[0062] Figure 5 A flowchart of an AI-based network information security risk assessment method provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0064] First, the implementation environment of the embodiment of the present application is described. By way of example, the implementation environment includes a data acquisition device, a data storage device, and a computing and processing device.

[0065] In an AI-based network information security risk assessment system, a data acquisition device is connected to a switch via a network link, transmitting collected network information, host data, security device logs, and other data to the switch. The switch distributes data from the data acquisition device to a computing and processing device, providing data support for the training and inference of risk assessment models. Furthermore, the switch connects to a data storage device via a network link, transferring data requiring long-term preservation. The computing and processing device establishes a high-speed network connection with the switch, receives data, analyzes it, and processes it. A portion of the processing results is fed back to the data storage device for storage and subsequent query and historical data analysis. The remaining portion is transmitted to relevant terminal devices via network communication equipment in accordance with established security policies, providing a basis for network information security risk assessment and decision-making.

[0066] Data collection devices, such as network sensors, keenly monitor network traffic, accurately capture data packets, and provide real-time feedback on dynamic information such as network connections, transmission volume, and protocol types. Host probes, deployed on each host system, collect in-depth system logs, process status, and user operation records, providing comprehensive insight into potential risks at the host level. Furthermore, security device log collectors integrate closely with security infrastructure such as firewalls, IDS, and IPS, aggregating the log data they generate and efficiently capturing critical information such as network attacks and threat events.

[0067] Data storage devices, such as hard disk arrays, provide robust data storage capabilities and fault tolerance, securely storing massive amounts of network data and assessment results for easy access and retrieval. Network-attached storage (NAS) leverages network interfaces to create a centralized data storage service platform, facilitating convenient data access and sharing across various devices within the network. Storage area networks (SANs) utilize high-speed Fibre Channel or iSCSI protocols to build dedicated storage networks, delivering high-performance, highly reliable storage services to core devices such as servers. These various data storage devices work together to ensure secure storage and orderly management of system data.

[0068] General-purpose servers for computing and processing equipment run system software programs and undertake data processing, analysis, and preliminary AI model operations. GPU servers, with their specialized graphics processing units, significantly improve model training and inference efficiency, helping the system more accurately and efficiently identify network security risks. Computing and processing equipment collaborates with data acquisition and storage devices via high-speed network connections, receiving raw data for in-depth analysis and processing, and storing the results as feedback to provide a basis for decision-making, driving the intelligent operation of the entire network information security risk assessment system.

[0069] In combination with the above implementation environment, the application scenarios of the embodiments of the present application are explained.

[0070] An AI-based network information security risk assessment system provided in an embodiment of the present application uses artificial intelligence technology to comprehensively and accurately assess network information security risks. By collecting network traffic data, system logs, and various types of security event information in real time, and using machine learning algorithms to conduct in-depth analysis of massive data, potential security threats and abnormal behavior patterns are identified. The system can not only quickly detect known attack methods, but also has the intelligent perception capability of unknown new threats with the help of deep learning models. In the risk assessment link, AI technology comprehensively calculates the risk level based on multi-dimensional data, generates a detailed and intuitive risk assessment report, provides strong support for network security decision-making, and ensures the stable operation and data security of network information systems. For example, an AI-based network information security risk assessment system provided in an embodiment of the present application can be applied to at least one scenario including but not limited to the following scenarios.

[0071] First, this AI-based network information security risk assessment system is applied to enterprise office networks. Within this network, data collection devices form a rigorous data collection network. Network sensors monitor network traffic in real time, accurately capturing employee data transfers and fluctuations during daily work, while also analyzing the protocols used by various office software. Host probes are deployed on every office computer to collect in-depth system logs, detailing employee login times, operational behavior, and running processes, providing insights into potential violations or malware intrusions. Security device log collectors connect to enterprise-deployed security devices such as firewalls and IDS to aggregate log data on external attack attempts and abnormal traffic. The massive amount of collected data is transmitted via network links to data storage devices, facilitating data sharing and access across departments with authorized permissions. General-purpose servers within the computing and processing equipment run the risk assessment system software, performing preliminary data processing and analysis. GPU servers leverage their powerful parallel computing capabilities to accelerate AI model training and inference, accurately assessing security risks facing enterprise office networks and providing a scientific basis for formulating sound cybersecurity strategies.

[0072] Second, this AI-based network information security risk assessment system is applied to financial institutions' networks. For financial institutions, network sensors closely monitor traffic on financial transaction networks, accurately capturing the data packets of each transaction and providing real-time feedback on transaction connection status, capital flow volume, and the financial transaction protocols followed. Security device log collectors are closely integrated with the financial institution's rigorous firewalls, IPS, and other security infrastructure, efficiently aggregating logs generated by various security devices and rapidly detecting any attack threats targeting the financial network. Collected data is rapidly transmitted to data storage devices. Storage area networks provide financial institutions with high-performance, highly reliable data storage services, ensuring the secure storage and immediate accessibility of massive amounts of transaction data and risk assessment results. Computing and processing equipment is fully operational, with general-purpose servers handling routine data processing and analysis tasks, while GPU servers utilize specialized graphics processing units to accelerate the operation of complex AI algorithms. Through in-depth analysis of historical transaction data and real-time monitoring data, they accurately assess the security risks facing financial networks, helping financial institutions effectively mitigate risks, safeguard customer funds, and maintain the stability of financial transactions.

[0073] In one embodiment, Figure 1 As shown, this application provides an AI-based network information security risk assessment system, which may include:

[0074] The data processing module 101 is used to obtain risk indicator data of the network topology area; the risk indicator data includes at least one of network traffic data, system log data and security event information; and is also used to extract features from the risk indicator data to obtain a risk feature vector for evaluating the current security situation.

[0075] Specifically, network traffic data details key information such as the data transmission rate, number of packets, and flow direction within the network, providing a direct reflection of the network's operational status. System log data records various details of system operations, including system startup, user logins, and software execution history, enabling the identification of potential security risks. Security event information, including intrusion detection alerts and malware reports, is crucial for identifying network security threats. After acquiring data, the module applies specialized data feature extraction algorithms to extract key features from different types of data, converting the raw data into risk feature vectors that assess the current security situation.

[0076] The association analysis module 102 is used to calculate the similarity matrix of each risk feature vector to obtain the association relationship data between different types of vectors; it is also used to input the association relationship data into the neural network model to construct a parameter association graph, and use node embedding technology to extract the network effect characteristics between the data.

[0077] The risk feature vector is used as input through the similarity matrix calculation method, and algorithms such as cosine similarity are used to accurately measure the similarity between each risk feature vector to generate a similarity matrix. In the matrix, each element represents the degree of association between different types of vectors. Subsequently, the association analysis module inputs the association relationship data into the constructed graph neural network model. In the model, a parameter association graph is generated through the construction of complex nodes and edges. At the same time, node embedding technology is used to map the characteristics of each node in high-dimensional space to low-dimensional vector space, so that the potential network effect characteristics between nodes can be fully extracted. The characteristics reflect the mutual influence and synergy mechanism of different risk factors in the entire network topology structure, providing key network relationship insights for subsequent feature fusion and risk assessment.

[0078] The feature fusion module 103 is used to calculate the associated influence of each parameter based on the network effect characteristics and use the graph convolution layer to aggregate the information of the neighboring nodes to obtain the corresponding global influence weight; it is also used to perform weighted fusion of the risk feature vector based on the global influence weight to generate a comprehensive feature representation.

[0079] Graph convolutional layers are used to comprehensively integrate the relevant information of neighboring nodes. Through repeated iterative calculations, the feature information between neighboring nodes is effectively fused to obtain global influence weights that reflect the relative importance of each parameter in the entire network system. Subsequently, based on the generated global influence weights, a weighted fusion operation is performed on the risk feature vectors. Different risk feature vectors are assigned corresponding weights according to their importance, and each vector element is weighted and combined to ultimately generate a highly comprehensive, comprehensive, and refined comprehensive feature representation. This comprehensive feature representation effectively integrates risk information from multiple sources and can more accurately and completely present the current network information security situation.

[0080] The risk assessment module 104 is used to input the comprehensive feature representation into the trained risk assessment model to calculate the risk score of the current security situation.

[0081] Specifically, the comprehensive feature representation comprehensively covers the security situation characteristics reflected by various aspects of information such as network traffic, system logs, and security events. By inputting the comprehensive feature representation into the trained risk assessment model, the model comprehensively considers and quantitatively analyzes the various risk factors in the current network security situation based on its own learned patterns and laws, and ultimately accurately calculates a risk score that reflects the current security situation. This risk score intuitively presents the level of network security risk in a standardized numerical form, providing network security managers and relevant decision-makers with clear and unambiguous security situation assessment results, helping them to quickly formulate targeted security protection strategies and response measures to ensure the stable and secure operation of network information systems.

[0082] In the aforementioned AI-based network information security risk assessment system, the data processing module acquires risk indicator data for a network topology region, including at least one of network traffic data, system log data, and security event information, and performs feature extraction to generate a risk feature vector required for assessing the current security situation. The association analysis module calculates a similarity matrix based on each risk feature vector, deriving correlation data between different types of vectors. This data is then input into a neural network model to construct a parameter association graph, using node embedding technology to extract network effect features between the data. The feature fusion module calculates the correlation influence of each parameter based on the network effect features, aggregates neighboring node information using a graph convolution layer to obtain the corresponding global influence weight, and then performs weighted fusion of the risk feature vectors to generate a comprehensive feature representation. Finally, the risk assessment module inputs the comprehensive feature representation into a trained risk assessment model, which calculates a risk score for the current security situation. This system enables more efficient, intelligent, and accurate assessment of network security risks, addressing the increasingly complex network security landscape and ensuring the stable and secure operation of network information systems.

[0083] In one embodiment, Figure 2 As shown, feature extraction of risk indicator data to obtain a risk feature vector for evaluating the current security situation may include the following steps:

[0084] Step S201 : Using principal component analysis to extract numerical features from traffic size, number of data packets and connection establishment frequency from network traffic data in the risk indicator data, and generating a first feature vector.

[0085] Step S202 : Using a statistical feature extractor, the system log data in the risk indicator data is subjected to numerical features extracted from the timestamp and event type fields to generate a second feature vector.

[0086] Step S203 , using a feature extraction method based on a support vector machine, the security event information in the risk indicator data is subjected to key features extracted from the event occurrence time, the system components involved, and the event severity, to generate a third feature vector.

[0087] Step S204 : semantically aligning the first feature vector, the second feature vector, and the third feature vector and inputting a preset identical feature space mapping rule to obtain a mapping feature vector that eliminates feature semantic differences.

[0088] Step S205 , using a feature fusion network based on a self-attention mechanism to perform multi-layer nonlinear transformation on the mapped feature vector to obtain a risk feature vector that comprehensively reflects the current network information security situation.

[0089] For the network traffic data in the risk indicator data, principal component analysis is used to extract numerical features from dimensions such as traffic size, number of packets, and connection establishment frequency to generate the first eigenvector. Next, for the system log data in the risk indicator data, a statistical feature extractor is used to extract numerical features from the timestamp and event type fields to generate the second eigenvector. For the security event information in the risk indicator data, a support vector machine-based feature extraction method is used to extract key features from aspects such as the event occurrence time, the system components involved, and the event severity to generate the third eigenvector. After the above eigenvectors are generated, the first, second, and third eigenvectors are semantically aligned and input into the same preset feature space mapping rules to obtain a mapped eigenvector that eliminates feature semantic differences. Finally, a feature fusion network based on the self-attention mechanism is used to perform multi-layer nonlinear transformation operations on the mapped eigenvector, resulting in a risk feature vector that comprehensively reflects the current network information security situation.

[0090] In one embodiment, Figure 3 As shown, similarity matrix calculation is performed on each risk feature vector to obtain correlation relationship data between different types of vectors, which may include the following steps:

[0091] Step S301: Calculate each risk feature vector using the cosine similarity algorithm to obtain the similarity between each feature quantity.

[0092] Step S302 , calculating the matrix value of the similarity and using a cluster analysis algorithm to determine the type value division of the vector to obtain a cluster division result.

[0093] Step S303: transform the clustering result into a relationship graph structure by using dimension value mapping, and analyze the vector relationship in the relationship graph by using a correlation analysis algorithm.

[0094] Step S304 : performing quantitative calculation on the correlation degree between vectors using a preset quantization formula according to the vector correlation relationship, and obtaining correlation relationship data between vectors of different types.

[0095] Based on the calculated similarities, the matrix values ​​are further calculated. Subsequently, the vectors are classified into different types using a cluster analysis algorithm. Dimensional value mapping is used to transform the clustering results into an intuitive relationship graph structure. Finally, based on the determined vector associations, a pre-set quantitative formula is used to accurately quantify the degree of correlation between vectors, ultimately generating correlation data between different types of vectors. This data quantitatively represents the degree of correlation between different risk feature vectors, providing key information for a comprehensive understanding of the cybersecurity landscape.

[0096] This embodiment scientifically and systematically processes risk feature vectors, from calculating similarities to ultimately obtaining correlation data, effectively mining the complex and subtle connections between different risk features. This helps more accurately identify potential risk points in network information security and their mutual influence mechanisms, providing strong data support and decision-making basis for the formulation of network security protection strategies. Furthermore, the introduction of cluster analysis and relationship graph structures makes data analysis and understanding more intuitive and efficient, improving the accuracy and reliability of the entire risk assessment process and enhancing the system's ability to respond to complex network security threats.

[0097] In one embodiment, calculating the matrix value of similarity and using a cluster analysis algorithm to determine the type value division of the vector to obtain the cluster division result may include the following steps:

[0098] Step S401 : Calculate the distance between each pair of vectors based on the similarity of each risk feature vector to construct a similarity matrix.

[0099] The similarity matrix between each pair of vectors is calculated using the following formula:

[0100]

[0101] Among them, C ij represents the cosine similarity between the i-th vector and the j-th vector, v i represents the i-th risk feature vector, v j represents the j-th risk feature vector, d ij represents the Euclidean distance between the i-th vector and the j-th vector, C ik represents the cosine similarity between the i-th vector and the k-th component, C jk represents the cosine similarity between the jth vector and the kth component, n represents the vector dimension, s ij represents the Gaussian similarity between the i-th vector and the j-th vector, and σ represents the bandwidth parameter of the Gaussian kernel function.

[0102] Step S402 , calculating the matrix value of the similarity matrix and determining the initial center point using a clustering algorithm, and calculating the distance value from each vector to the center point.

[0103] Step S403: Divide each vector into the nearest center point according to the distance value to obtain an initial clustering result.

[0104] Among them, if the initial clustering result does not converge, the center point is recalculated and the number of iterations is increased to update the initial clustering result; if the initial clustering result converges, the iteration is stopped to obtain the final clustering division result.

[0105] Based on the similarity of each risk feature vector, the distance value between each pair of vectors is calculated, and then a similarity matrix is ​​constructed. The matrix value of the similarity matrix is ​​calculated, and the initial center point is determined using the clustering algorithm. Then, the distance value of each vector to the center point is calculated. Subsequently, based on the calculated distance value, each vector is divided into the center point with the closest distance, thereby obtaining the initial clustering result. During this process, it is necessary to judge the convergence of the initial clustering result. If the initial clustering result does not converge, it means that the clustering result is not yet stable. At this time, it is necessary to recalculate the center point and increase the number of iterations to update the initial clustering result. If the initial clustering result converges, it indicates that the clustering result has reached a stable state. The iteration is stopped to obtain the final clustering division result.

[0106] By constructing a similarity matrix and applying complex formulas to calculate the similarity between vectors, the relationships between risk feature vectors can be more accurately characterized. During the cluster analysis process, an iterative convergence approach is used to determine the final clustering results, making the clustering results more stable and accurate, effectively avoiding the problem of local optimal solutions, and more comprehensively exploring the underlying structures and patterns in the data. Accurate clustering results help to more clearly identify different types of risk characteristics, providing strong support for risk assessment and management of network information security, enabling security managers to formulate more targeted protection strategies, and improving the ability of network information systems to respond to security threats.

[0107] In one embodiment, Figure 4 As shown in the figure, the correlation influence of each parameter is calculated based on the network effect characteristics and the information of the neighboring nodes is aggregated using the graph convolution layer to obtain the corresponding global influence weight. The following steps can be included:

[0108] Step S501: construct a parameter association matrix based on the network effect characteristics, and calculate the initial influence degree corresponding to each parameter.

[0109] Step S502: construct a graph structure according to the initial influence degree to obtain the neighborhood relationship between neighborhood nodes.

[0110] Step S503: Based on the neighborhood relationship, the graph convolution algorithm is used to aggregate the feature information of the neighborhood nodes and update the node weight value.

[0111] Step S504 : judging the node weight value based on a preset threshold value. If the node weight value exceeds the preset threshold value, adjusting the global weight distribution based on the preset threshold value to obtain a global influence weight.

[0112] Step S505: Optimize the global weight distribution using a machine learning algorithm to obtain an updated global influence weight.

[0113] First, a parameter correlation matrix is ​​constructed based on the network effect features extracted by the correlation analysis module. Through in-depth analysis and calculation of this matrix, the initial influence corresponding to each parameter is obtained. This initial influence preliminarily reflects the importance and influence of each parameter in the network environment. A graph structure is then constructed based on the obtained initial influence. In this graph structure, each node represents a different parameter, and the edges represent the associations between parameters. This construction method clearly identifies the neighborhood relationships between neighboring nodes, providing a clear structural foundation for subsequent information aggregation. Based on the determined neighborhood relationships, a graph convolution algorithm is then used to aggregate the feature information of neighboring nodes. The graph convolution algorithm fully considers the topological structure between nodes, fusing and updating the feature information of neighboring nodes to obtain node weights. The obtained node weights are then evaluated based on a preset threshold. If a node weight exceeds the preset threshold, it indicates that the node has a significant influence in the network and requires adjustment to the global weight distribution. This adjustment based on the preset threshold results in a global influence weight, which makes the weight distribution of each parameter more reasonable and more accurately reflects its role in the overall network security situation assessment. Finally, a machine learning algorithm is used to optimize the global weight distribution. Machine learning algorithms have powerful learning and adaptive capabilities, and can further adjust and optimize the global weight distribution based on large amounts of data and complex patterns to obtain updated global influence weights.

[0114] By constructing a parameter correlation matrix and graph structure, network effect characteristics are expressed in an intuitive and computationally efficient form, providing a clear framework for subsequent information processing and analysis. The application of graph convolution algorithms can fully exploit the information between neighboring nodes, making node weight values ​​more accurate and comprehensive. Adjusting the global weight distribution based on preset thresholds effectively highlights the influence of important parameters, preventing the excessive influence of individual parameters or the neglect of the influence of key parameters. The resulting updated global impact weights can more accurately reflect the importance of each parameter in network information security risk assessment, thereby improving the accuracy and reliability of the entire risk assessment system and better responding to complex and changing network security threats.

[0115] In one embodiment, inputting the comprehensive feature representation into a trained risk assessment model to calculate a risk score for the current security situation may include the following steps:

[0116] Step S601: Obtain a representation value in the comprehensive feature representation, and determine whether the representation value meets a preset threshold value.

[0117] If the representation value satisfies the threshold value, the clustering algorithm is used to process the comprehensive feature representation to obtain a processed comprehensive feature representation.

[0118] If the representation value does not meet the threshold value, the dimensionality reduction algorithm is used to adjust the comprehensive feature representation to obtain a processed comprehensive feature representation.

[0119] Step S602: Input the processed comprehensive feature representation into the trained risk assessment model to obtain the situation value of the current security situation.

[0120] Use the following formula to calculate the situation value and obtain the risk score of the current security situation:

[0121]

[0122] Where R represents the comprehensive risk score of the security situation, n represents the number of risk feature vectors, ω i represents the weight coefficient of the i-th risk feature vector, a i represents the actual value of the i-th risk feature vector, m i represents the maximum threshold of the i-th risk feature vector, α represents the time attenuation coefficient, β represents the time scale parameter, t represents the time interval, and p i Represents the part of the situation value p that is related to the i-th influencing factor.

[0123] Obtain the representation value of the comprehensive feature representation and compare it with the preset threshold. If the representation value meets the preset threshold, it means that the comprehensive feature representation has good feature distribution and distinguishability under the current evaluation criteria. At this time, a clustering algorithm is used to process the comprehensive feature representation, clustering similar features to further explore the inherent structure of the data, thereby obtaining a processed comprehensive feature representation. If the representation value does not meet the preset threshold, it indicates that the comprehensive feature representation may have dimensional redundancy or insignificant features. In this case, a dimensionality reduction algorithm is used to adjust the comprehensive feature representation, highlighting key features, thereby obtaining a processed comprehensive feature representation. The processed comprehensive feature representation is input into the trained risk assessment model, and the input features are analyzed and evaluated to obtain the situation value of the current security situation.

[0124] In one embodiment, the risk assessment module may further include:

[0125] Step S701: determine the risk level of the current security situation based on the risk score. If the risk level exceeds a preset threshold, generate an early warning mechanism.

[0126] Step S702: extract risk signals from the early warning mechanism, and classify the risk signals using a clustering algorithm to obtain risk classification results.

[0127] Step S703: extract features of the high-risk area using a dimensionality reduction algorithm according to the risk classification result to obtain a feature extraction result.

[0128] Step S704: extract key risk points from the feature extraction results, and prioritize the key risk points using a decision tree algorithm to obtain a priority ranking result.

[0129] Step S705: Execute the risk treatment plan according to the priority ranking result to obtain the implementation result and update the risk assessment model based on the implementation result.

[0130] First, the calculated risk score is used to determine the current security situation's risk level. This risk level is rigorously compared against a preset threshold. If the risk level exceeds the threshold, indicating a serious network security threat, the system quickly generates an early warning mechanism to promptly notify relevant personnel of potential security risks. Next, the system extracts the risk signals contained in the generated early warning mechanism and classifies them using a clustering algorithm. Clustering algorithms can group risk signals into different categories based on their similarities, resulting in a clear risk classification. Based on this risk classification, the system then focuses on high-risk areas. A dimensionality reduction algorithm is used to extract features from these high-risk areas, removing redundant information and highlighting key features, resulting in representative feature extraction results. Key risk points are then precisely identified from these feature extraction results. To more effectively allocate processing resources and sequence, a decision tree algorithm is used to prioritize these key risk points, ultimately generating a prioritized result. Finally, based on the prioritized results, the system rapidly implements the corresponding risk treatment plan. During implementation, detailed results are recorded. Based on these results, the risk assessment model is updated and optimized to better adapt to the ever-changing network security environment.

[0131] In one embodiment, the present application also provides an AI-based network information security risk assessment method, such as Figure 5 As shown, the method may include the following steps:

[0132] Step S801, obtaining risk indicator data of a network topology area; the risk indicator data includes at least one of network traffic data, system log data, and security event information; performing feature extraction on the risk indicator data to obtain a risk feature vector for evaluating the current security situation.

[0133] In step S802, similarity matrix calculation is performed on each risk feature vector to obtain correlation data between different types of vectors; the correlation data is input into the neural network model to construct a parameter correlation graph, and the network effect characteristics between the data are extracted using node embedding technology.

[0134] In step S803, the correlation influence of each parameter is calculated based on the network effect characteristics and the information of the neighboring nodes is aggregated using the graph convolution layer to obtain the corresponding global influence weight; based on the global influence weight, the risk feature vector is weighted and fused to generate a comprehensive feature representation.

[0135] In step S804, the comprehensive feature representation is input into the trained risk assessment model to calculate the risk score of the current security situation.

[0136] The AI-based network information security risk assessment method first obtains risk indicator data for a network topology region, including at least one of network traffic data, system log data, and security event information. Feature extraction is then performed on the risk indicator data to generate a risk feature vector used to assess the current security situation. A similarity matrix is ​​then calculated for each risk feature vector to determine the correlation between different types of vectors. This correlation data is then fed into a neural network model to construct a parameter correlation graph. Node embedding techniques are then used to extract network effect features between the data. The correlation influence of each parameter is then calculated based on the network effect features. A graph convolutional layer is used to aggregate information from neighboring nodes to obtain a corresponding global influence weight. The risk feature vectors are then weighted and fused based on this global influence weight to generate a comprehensive feature representation. Finally, the comprehensive feature representation is fed into a trained risk assessment model to calculate a risk score for the current security situation. This method enables more efficient, intelligent, and accurate assessment of network security risks, addressing the increasingly complex network security landscape and ensuring the stable and secure operation of network information systems.

[0137] It should be understood that, although the various steps in the flowcharts involved in the various embodiments described above are displayed in sequence according to the instructions of the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be executed in other orders. Moreover, at least a portion of the steps in the flowcharts involved in the various embodiments described above can include multiple steps or multiple stages, and these steps or stages are not necessarily executed and completed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0138] In one embodiment, a computer device is provided, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the aforementioned AI-based network information security risk assessment system are implemented.

[0139] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned system embodiments are implemented.

[0140] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to the partial description of the method embodiments. The device embodiments described above are merely illustrative, wherein the components described as separate parts may or may not be physically separated, and the parts displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the disclosed solution. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0141] The above-described embodiments merely represent several implementation methods of the embodiments of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person skilled in the art may make various modifications and improvements without departing from the concept of the embodiments of the present application, and these modifications and improvements fall within the scope of protection of the embodiments of the present application.

Claims

1. An AI-based network information security risk assessment system, characterized by: The system comprises: a data processing module for acquiring risk indicator data for a network topology region; the risk indicator data comprising at least one of network traffic data, system log data, and security event information; and for performing feature extraction on the risk indicator data to obtain a risk feature vector for assessing the current security situation; An association analysis module is used to calculate the similarity matrix of each risk feature vector to obtain association relationship data between different types of vectors; it is also used to input the association relationship data into a neural network model to construct a parameter association graph, and use node embedding technology to extract network effect characteristics between data; A feature fusion module is used to calculate the correlation influence of each parameter based on the network effect characteristics and aggregate the information of neighboring nodes using a graph convolution layer to obtain a corresponding global influence weight; and is also used to perform weighted fusion on the risk feature vector based on the global influence weight to generate a comprehensive feature representation; The risk assessment module is used to input the comprehensive feature representation into the trained risk assessment model to calculate the risk score of the current security situation.

2. The system according to claim 1, wherein: The feature extraction of the risk indicator data to obtain a risk feature vector for evaluating the current security situation includes: Using principal component analysis on the network traffic data in the risk indicator data, extracting numerical features from traffic size, number of data packets, and connection establishment frequency to generate a first feature vector; Using a statistical feature extractor on the system log data in the risk indicator data, extracting numerical features from the timestamp and event type fields to generate a second feature vector; Using a support vector machine-based feature extraction method for the security event information in the risk indicator data, extract key features from the event occurrence time, the system components involved, and the severity of the event to generate a third feature vector; Semantically aligning the first feature vector, the second feature vector, and the third feature vector and inputting a preset identical feature space mapping rule to obtain a mapping feature vector that eliminates feature semantic differences; A feature fusion network based on the self-attention mechanism is used to perform multi-layer nonlinear transformation on the mapping feature vector to obtain a risk feature vector that comprehensively reflects the current network information security situation.

3. The system according to claim 1, wherein: The similarity matrix calculation is performed on each of the risk feature vectors to obtain correlation relationship data between different types of vectors, including: Calculating each of the risk feature vectors using a cosine similarity algorithm to obtain similarities between the feature quantities; Calculating the matrix value of the similarity and determining the type value division of the vector using a cluster analysis algorithm to obtain a cluster division result; Converting the clustering results into a relationship graph structure using dimension value mapping, and parsing the vector association relationships in the relationship graph using a correlation analysis algorithm; According to the vector association relationship, a preset quantization formula is used to quantify the association degree between the vectors to obtain association relationship data between different types of vectors.

4. The system according to claim 3, characterized in that The calculating of the matrix value of the similarity and determining the type value division of the vector using a cluster analysis algorithm to obtain a cluster division result includes: Calculating the distance between each pair of vectors based on the similarity of each risk feature vector to construct a similarity matrix; The similarity matrix between each pair of vectors is calculated using the following formula: Among them, C ij represents the cosine similarity between the i-th vector and the j-th vector, v i represents the i-th risk feature vector, v j represents the j-th risk feature vector, d ij represents the Euclidean distance between the i-th vector and the j-th vector, C ik represents the cosine similarity between the i-th vector and the k-th component, C jk represents the cosine similarity between the jth vector and the kth component, n represents the vector dimension, s ij represents the Gaussian similarity between the i-th vector and the j-th vector, and σ represents the bandwidth parameter of the Gaussian kernel function; Calculating the matrix value of the similarity matrix and determining the initial center point using a clustering algorithm, and calculating the distance value from each vector to the center point; Divide each vector into the nearest center point according to the distance value to obtain an initial clustering result; If the initial clustering result does not converge, the center point is recalculated and the number of iterations is increased to update the initial clustering result; if the initial clustering result converges, the iteration is stopped to obtain the final clustering result.

5. The system according to claim 1, wherein: The calculation of the correlation influence of each parameter based on the network effect characteristics and the use of a graph convolution layer to aggregate information of neighboring nodes to obtain the corresponding global influence weight include: Constructing a parameter association matrix based on the network effect characteristics and calculating the initial influence degree corresponding to each parameter; Constructing a graph structure based on the initial influence to obtain a neighborhood relationship between neighborhood nodes; Aggregating feature information of the neighborhood nodes using a graph convolution algorithm based on the neighborhood relationship, and updating the node weight value; The node weight value is judged based on a preset threshold value, and if the node weight value exceeds the preset threshold value, the global weight distribution is adjusted based on the preset threshold value to obtain a global influence weight; The global weight distribution is optimized using a machine learning algorithm to obtain an updated global influence weight.

6. The system according to claim 1, wherein: Inputting the comprehensive feature representation into the trained risk assessment model to calculate the risk score of the current security situation includes: Obtaining a representation value in the comprehensive feature representation, and determining whether the representation value meets a preset threshold value; If the representation value satisfies a threshold value, the comprehensive feature representation is processed using a clustering algorithm to obtain a processed comprehensive feature representation; If the representation value does not meet the threshold value, the comprehensive feature representation is adjusted using a dimensionality reduction algorithm to obtain a processed comprehensive feature representation; Inputting the processed comprehensive feature representation into a trained risk assessment model to obtain a situation value of the current security situation; The situation value is calculated using the following formula to obtain the risk score of the current security situation: Where R represents the comprehensive risk score of the security situation, n represents the number of risk feature vectors, ω i represents the weight coefficient of the i-th risk feature vector, a i represents the actual value of the i-th risk feature vector, m i represents the maximum threshold of the i-th risk feature vector, α represents the time attenuation coefficient, β represents the time scale parameter, t represents the time interval, and p i Represents the part of the situation value p that is related to the i-th influencing factor.

7. The system according to claim 1, wherein: The risk assessment module further includes: Determine the risk level of the current security situation based on the risk score, and generate an early warning mechanism if the risk level exceeds a preset threshold; Extracting risk signals from the early warning mechanism and classifying the risk signals using a clustering algorithm to obtain risk classification results; According to the risk classification result, a dimensionality reduction algorithm is used to extract features of the high-risk area to obtain a feature extraction result; Extracting key risk points from the feature extraction results, and prioritizing the key risk points using a decision tree algorithm to obtain a priority ranking result; Execute the risk treatment plan according to the priority ranking result to obtain the implementation result and update the risk assessment model based on the implementation result.

8. A network information security risk assessment method based on AI, characterized in that: The method comprises: Acquire risk indicator data of a network topology area; the risk indicator data includes at least one of network traffic data, system log data, and security event information; perform feature extraction on the risk indicator data to obtain a risk feature vector for evaluating the current security situation; Performing similarity matrix calculation on each of the risk feature vectors to obtain correlation data between different types of vectors; inputting the correlation data into a neural network model to construct a parameter correlation graph, and using node embedding technology to extract network effect characteristics between the data; Calculating the correlation influence of each parameter based on the network effect characteristics and aggregating information of neighboring nodes using a graph convolution layer to obtain a corresponding global influence weight; performing weighted fusion on the risk feature vector based on the global influence weight to generate a comprehensive feature representation; The comprehensive feature representation is input into the trained risk assessment model to calculate the risk score of the current security situation.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the system according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the system according to any one of claims 1 to 7 are implemented.

Images