Network security data management system and method based on AI large model

Abstract

The invention belongs to the technical field of data security management, and discloses a network security data management system and method based on an AI large model, and the method comprises the steps: obtaining historical network behavior data and corresponding time information and network environment data, carrying out the characterization processing of the network behavior data in different time periods, and obtaining a network behavior data feature; obtaining network security features and forming a historical database; training the baseline model to predict network security features; acquiring real-time time information and network environment data, and acquiring expected and current actual network security features; comparing the current network security feature with an expected network security feature, and generating a risk assessment result; and dynamically adjusting a data access control and encryption strategy according to a risk assessment result. According to the method, by predicting normal network behaviors and comparing the normal network behaviors with actual behaviors, security threats can be accurately identified, the security policy is adaptively adjusted according to the risk level, and the balance of security and availability is realized.

Description

Technical Field

[0001] The present invention relates to the field of data security management technology, and more specifically, to a network security data management system and method based on an AI big model. Background Art

[0002] With the rapid development of information technology and the widespread use of network applications, network security issues are becoming increasingly prominent. Various cyberattack methods are constantly evolving, from simple virus attacks in the early days to more complex forms such as advanced persistent threats (APTs), ransomware attacks, and supply chain attacks. In this context, traditional network security protection methods based on rules and signature libraries are no longer able to cope with increasingly complex security threats. Therefore, network security solutions based on artificial intelligence technology have gradually become a research hotspot and development trend.

[0003] Existing network security monitoring and protection technologies suffer from the following major issues: Existing anomaly detection methods are typically based on statistical analysis of historical data or simple behavioral pattern matching. These methods lack the ability to accurately model the normal state of network behavior under different time and environmental conditions. This makes it difficult to distinguish between true security threats and normal business fluctuations, resulting in a large number of false positives and false negatives. Furthermore, existing network security systems lack intelligent and adaptive data management capabilities. Most systems employ fixed data access control and encryption policies that are unable to dynamically adjust based on actual risk levels. These static security policies are either overly restrictive or overly permissive, failing to provide adequate protection in high-risk situations, impacting system availability and user experience. Summary of the Invention

[0004] In order to overcome the problems of existing technologies affecting system availability and user experience, the present invention proposes a network security data management system and method based on an AI big model to solve the above problems.

[0005] The present invention provides the following technical solutions: A network security data management method based on an AI big model, comprising: Obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; Based on the historical database, a baseline model is trained to predict network security characteristics based on time information and network environment data; Acquire real-time time information and network environment data, and obtain expected network security characteristics through baseline models; obtain real-time collected network environment data and perform characterization processing to obtain current network security characteristics; Generate risk assessment results based on current network security characteristics and expected network security characteristics; Adjust data access control and encryption policies based on risk assessment results.

[0006] Preferably, the network environment data includes network access records, data flow characteristics, and user operation behaviors; the network access records include access users, access resources, access time, and access rights; the data flow characteristics include flow size, flow direction, protocol type, and data packet characteristics; the user operation behaviors include operation type, operation object, operation time interval, and operation sequence mode; The time information includes month, week, hour and whether it is a weekday label, and the network environment data includes network traffic load, number of active users and frequency of external connection requests. Preferably, the characterization process includes: For network access records: Calculate the access frequency matrix of different users to each resource; obtain the access diversity index by the ratio of the number of different users accessing the resource to the total number of accesses; obtain the abnormal access index by weighting the number of accesses at irregular times and the number of unauthorized accesses; and combine the access diversity index and the abnormal access index to obtain the network access feature vector. For data traffic characteristics: the total traffic volume index is obtained by the total traffic volume; the protocol distribution entropy index is calculated by calculating the traffic proportion of different protocol types; the traffic burst index is obtained by the ratio of instantaneous maximum traffic to average traffic; the data packet characteristic index is obtained by the average packet size value, packet size standard deviation value and large packet ratio value; the above four indicators are combined to form a data traffic feature vector; For user operation behavior: the operation timing index is obtained by the average operation interval length and the operation interval standard deviation; the operation type distribution index is obtained by the frequency statistics of various operations; the operation coverage index is obtained by the ratio of the different objects operated to the total number of objects in the system; the operation sequence pattern index is obtained by counting the number of the most and least common operation sequences; the operation complexity index is obtained by the number of operation types; the above five indicators are combined to form the user operation behavior feature vector; The network security features are formed by combining the features of three dimensions: network access features, data flow features and user operation behaviors.

[0007] Preferably, the training of a baseline model for predicting network security features based on time information and network environment data includes: Filter out the data without any security incidents from the historical database and record them as normal operation data; The normal operation data is divided into a training set and a validation set. Time information and network environment data are extracted from the data in different time periods to construct feature vectors as model inputs, and the corresponding network security features are used as model outputs. Use deep neural network architecture to design baseline model, initialize model structure parameters, and set model hyperparameters; Iterative training is performed using the training set data. In each iterative training, the model prediction value is calculated through forward propagation, the error between the predicted value and the actual network security characteristics is calculated, the model loss is calculated based on a predefined loss function, and the model parameters are updated using the backpropagation algorithm and optimizer to minimize the loss function. The model performance is evaluated regularly using the validation set. If the performance of the model on the validation set reaches the preset threshold, the training is completed. Otherwise, the hyperparameters and model structure parameters are adjusted and the training process is repeated; finally, a trained baseline model is obtained.

[0008] Preferably, generating a risk assessment result based on current network security characteristics and expected network security characteristics includes: Calculate the degree of deviation between the current network security features and the expected network security features in each dimension, and determine the feature dimensions whose deviation exceeds the preset threshold; The comprehensive risk score is obtained by weighted summing the size of feature deviations in different dimensions, where the weights of different dimensions are set based on historical security incident data; Analyze the distribution characteristics of feature deviations in different dimensions, including deviation concentration and deviation direction; Determine risk types based on distribution characteristics and a pre-established library of historical attack patterns; Generates the current risk assessment results including risk score and risk type.

[0009] Preferably, the deviation concentration is represented by the ratio of the deviation degree of each dimension to the total deviation degree, and the deviation direction is represented by the ratio of the deviation degree of each dimension to the deviation degrees of the other two dimensions.

[0010] Preferably, the pre-established historical attack pattern library includes typical deviation distributions of different types of attacks; the typical deviation distributions are classification kernels obtained after cluster analysis of deviation distributions corresponding to various types of attacks in history; Determining the risk type according to the distribution characteristics and a pre-established historical attack pattern library includes: matching a typical deviation distribution closest to the distribution characteristics in the historical attack pattern library, and using the attack type corresponding to the typical deviation distribution as the risk type.

[0011] Preferably, adjusting data access control and encryption policies according to risk assessment results includes: The system security level is divided into three levels: low, medium, and high according to the risk score, and the affected data resources are determined according to the risk type; Dynamically adjust access control policies based on security levels for affected data resources: maintain the original policy at low levels, add authentication requirements at mid-levels, and restrict access rights and log all operations at high levels; For affected data resources, the encryption strategy is adjusted according to the security level, including: maintaining existing encryption at the low level, increasing encryption strength at the medium level, and implementing multi-layer encryption and starting the data isolation mechanism at the high level.

[0012] The present invention also provides a network security data management system based on an AI big model, which is used to implement a network security data management method based on an AI big model, including: The historical data module is used to obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; A model training module is used to train a baseline model for predicting network security characteristics based on time information and network environment data based on the historical database; The feature acquisition module is used to obtain real-time time information and network environment data, and obtain the expected network security features through the baseline model; obtain the real-time collected network environment data, perform feature processing to obtain the current network security features; A risk assessment module is used to generate risk assessment results based on current network security characteristics and expected network security characteristics; The security policy adjustment module is used to adjust data access control and encryption policies based on risk assessment results.

[0013] The present invention provides a network security data management system and method based on an AI big model, which has the following beneficial effects: By comprehensively characterizing network access records, data traffic patterns, and user behavior, the system captures comprehensive security-related information within the network environment. Combined with time information and network environment data, the trained baseline model predicts normal network security characteristics based on these time and environment data. This predictive model fully considers the temporal patterns and environmental dependencies of network behavior, helping to distinguish true security threats from normal business fluctuations, thereby reducing false positives and missed alerts.

[0014] By comparing observed network security characteristics with the expected characteristics predicted by the model, the system can accurately calculate the degree of deviation and conduct risk assessments based on a library of historical attack patterns. A dynamic security policy adjustment mechanism based on risk assessment results enables data protection measures to be flexibly adjusted based on the actual threat situation. In low-risk situations, the system maintains relatively relaxed access control and encryption policies to ensure system availability and user experience. In high-risk situations, the system automatically increases the security level, implementing strict access restrictions and multi-layered encryption protection. This adaptive security strategy ensures data security in high-risk situations while avoiding the impact of overprotection on system operation, achieving a balance between security and availability. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a flow chart of a network security data management method based on an AI large model of the present invention; Figure 2 This is a module schematic diagram of a network security data management system based on an AI big model of the present invention. DETAILED DESCRIPTION

[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0017] Example 1 See also Figure 1 In this embodiment, a network security data management method based on an AI big model includes: S1. Obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; The network environment data includes network access records, data flow characteristics, and user operation behaviors; the network access records include access users, access resources, access time, and access rights; the data flow characteristics include flow size, flow direction, protocol type, and data packet characteristics; and the user operation behaviors include operation type, operation object, operation time interval, and operation sequence mode; The time information includes month, day of the week, hour, and whether it is a weekday label, and the network environment data includes network traffic load, number of active users, and frequency of external connection requests.

[0018] The characterization process includes: For network access records: Calculate the access frequency matrix of different users to each resource; obtain the access diversity index by the ratio of the number of different users accessing the resource to the total number of accesses; obtain the abnormal access index by weighting the number of accesses at irregular times and the number of unauthorized accesses; and combine the access diversity index and the abnormal access index to obtain the network access feature vector. For data traffic characteristics: the total traffic volume index is obtained by the total traffic volume; the protocol distribution entropy index is calculated by calculating the traffic proportion of different protocol types; the traffic burst index is obtained by the ratio of instantaneous maximum traffic to average traffic; the data packet characteristic index is obtained by the average packet size value, packet size standard deviation value and large packet ratio value; the above four indicators are combined to form a data traffic feature vector; For user operation behavior: the operation timing index is obtained by the average operation interval length and the operation interval standard deviation; the operation type distribution index is obtained by the frequency statistics of various operations; the operation coverage index is obtained by the ratio of the different objects operated to the total number of objects; the operation sequence pattern index is obtained by counting the number of the most and least common operation sequences; the operation complexity index is obtained by the number of operation types; the above five indicators are combined to form the user operation behavior feature vector; The network security features are formed by combining the features of three dimensions: network access features, data flow features and user operation behaviors.

[0019] In this embodiment, first, network access records, data flow characteristics and user operation behavior data are collected through network data collection equipment or software, and corresponding time information and network environment data are recorded at the same time.

[0020] Record each user's access to various resources, including the user ID, the resource URI accessed, the specific time of access, and the user's permission level at the time of access. Network monitoring devices are used to record characteristics such as the amount of data transmitted on the network, the direction of data flow (e.g., inbound or outbound), the network protocol used (e.g., HTTP, HTTPS, FTP), and the size distribution of data packets. Terminal security agents and application-layer logs are used to record various user operations, including the type of operation (e.g., query, modify, delete), the object operated on (e.g., file, database table), the time interval between consecutive operations, and the sequence of operations.

[0021] Detailed time information is marked for each piece of network behavior data and specific network environment data is collected to facilitate subsequent analysis of normal network behavior characteristics under different time characteristics and network environment characteristics, providing data support for subsequent analysis of whether the actual network behavior characteristics are normal.

[0022] To characterize network access records, we first compile a matrix of the frequency of accesses by different users to various resources. By analyzing this matrix, we can identify common user access patterns, such as frequent access to specific resources by certain users or widespread access to certain resources. This statistical analysis helps establish a baseline for user access behavior and provides a reference for subsequent anomaly detection. Next, we calculate the access diversity metric—the ratio of the number of unique users accessing a resource to the total number of accesses. This metric reflects the degree of resource access dispersion and helps identify unusual access patterns. For example, if a resource typically accessed by only a few users suddenly becomes accessed by a large number of different users, this may indicate an attack targeting that resource. Next, we calculate the abnormal access metric, weighted by the number of accesses at unusual times and the number of unauthorized accesses. Access at unusual times (such as during weekdays or weekends) and unauthorized access (where a user's permissions are lower than the required permissions for a resource) are often associated with unauthorized use or attacks, making this metric a direct indicator of potential security threats. Finally, we combine the access diversity and abnormal access metrics into a network access feature vector, which comprehensively reflects the security status of network access.

[0023] To characterize data traffic characteristics, we first calculate the total traffic volume metric by summing the traffic volume. Abnormal fluctuations in the total traffic volume may indicate a data leak, a denial-of-service attack, or other network security issues. Next, we calculate the protocol distribution entropy metric by taking the traffic proportions of different protocol types. This metric reflects the degree of dispersion of network traffic across different protocols. Sudden changes in protocol distribution may indicate a change in network behavior, such as an attacker using an unconventional protocol for communication. Next, we calculate the traffic burstiness metric by taking the ratio of the instantaneous maximum traffic volume to the average traffic volume. High burstiness may indicate a sudden, large amount of data transmission, which may signal a data leak or a DDoS attack. Finally, we calculate the data packet characteristic metric by taking the average packet size, the packet size standard deviation, and the large packet ratio. These four metrics are combined to form a data traffic feature vector. These features reflect data transmission patterns. Abnormal packet size distribution may indicate the use of covert channels or other unusual network behavior.

[0024] To characterize user operation behavior, we first derive the operation timing metric from the average operation interval duration and the standard deviation of the operation interval. This metric reflects the user's operation rhythm. Abnormal operation rhythms may indicate the use of automated tools or unauthorized user operations. Next, we derive the operation type distribution metric from the frequency statistics of various operations. Changes in the operation type distribution may reflect changes in user behavior. For example, a sudden increase in deletion operations may indicate data destructive behavior. Next, we derive the operation coverage metric from the ratio of the number of different objects operated on to the total number of objects. A high coverage rate may indicate extensive resource exploration by the user, which in some cases may signal information gathering or lateral movement. Finally, we derive the operation sequence pattern metric from the number of most and least frequent operation sequences. This metric reflects the regularity of user operations. Irregular operation sequences may indicate exploratory attack behavior. Finally, we derive the operation complexity metric from the number of operation types. These five metrics are combined to form a user operation behavior feature vector.

[0025] Ultimately, network security signatures are combined to form a comprehensive security signature based on three dimensions: network access characteristics, data traffic characteristics, and user operation behavior. These signatures capture comprehensive security-related information from different perspectives within the network environment. These signatures combine static features (such as access rights and protocol types) with dynamic features (such as access frequency, traffic burstiness, and operation timing), integrating both rule-based and statistical indicators. They can effectively identify various types of network security threats, including unauthorized access, data leaks, denial of service attacks, insider threats, and advanced persistent threats.

[0026] S2. Based on the historical database, train a baseline model that predicts network security characteristics based on time information and network environment data; The baseline model trained to predict network security features based on time information and network environment data includes: Filter out the data without any security incidents from the historical database and record them as normal operation data; The normal operation data is divided into a training set and a validation set. Time information and network environment data are extracted from the data in different time periods to construct feature vectors as model inputs, and the corresponding network security features are used as model outputs. Use deep neural network architecture to design baseline model, initialize model structure parameters, and set model hyperparameters; Iterative training is performed using the training set data. In each iterative training, the model prediction value is calculated through forward propagation, the error between the predicted value and the actual network security characteristics is calculated, the model loss is calculated based on a predefined loss function, and the model parameters are updated using the backpropagation algorithm and optimizer to minimize the loss function. The model performance is evaluated regularly using the validation set. If the performance of the model on the validation set reaches the preset threshold, the training is completed. Otherwise, the hyperparameters and model structure parameters are adjusted and the training process is repeated; finally, a trained baseline model is obtained.

[0027] In this embodiment, first, data without security incidents is filtered out from the historical database and recorded as normal operation data. This data represents the behavioral characteristics of the network in a normal state and is the basis for establishing a baseline model.

[0028] The selected normal operation data was randomly divided into a training set and a validation set in an 8:2 ratio. Time information (such as month, weekday, hour, and whether it was a weekday) and network environment data (such as network traffic load, number of active users, and frequency of external connection requests) were extracted from this data by time period to construct feature vectors as model inputs. Corresponding network security features (including network access features, data traffic features, and user operation behavior features) were used as model outputs. This input-output mapping relationship enables the model to learn the characteristics of normal network behavior under specific time and network conditions.

[0029] A baseline model was designed using a deep neural network architecture. This model, comprised of multiple fully connected layers, effectively captures the complex nonlinear relationships between temporal information, network environment data, and network security characteristics. Model structural parameters were initialized, such as the number of neurons in each layer and the type of activation function. Hyperparameters such as the learning rate, batch size, and number of training rounds were also set.

[0030] Iterative training is performed using the training set data. In each iteration, the model calculates predicted network security features through forward propagation, compares them with the actual network security features, and calculates the prediction error. The model loss is calculated based on a predefined loss function (such as mean squared error). Backpropagation is then used to calculate the gradient, and an optimizer (such as Adam) is used to update the model parameters to minimize the loss function. This process enables the model to gradually learn the mapping relationship between time information and network environment data and network security features.

[0031] During training, model performance is regularly evaluated using the validation set. If the model's performance on the validation set (e.g., prediction accuracy or mean squared error) reaches a preset threshold, training is considered complete. If the threshold is not reached, hyperparameters such as the learning rate and batch size are adjusted, or network structure parameters (e.g., number of layers and neurons) are modified, and the training process is repeated. This iterative optimization ensures that the model has good generalization capabilities and can accurately predict normal network security characteristics under different time and network environments.

[0032] The resulting trained baseline model can predict normal network security characteristics expected under given time information and network environment data. This model captures the temporal patterns and environmental dependencies of network behavior, such as differences in network behavior between weekdays and non-weekdays, or normal behavior patterns under varying network loads. By comparing observed network security characteristics with those predicted by the model, potential abnormal behavior can be identified, providing important insights for network security management.

[0033] S3. Obtain real-time time information and network environment data, and obtain the expected network security characteristics through the baseline model; obtain the real-time collected network environment data, perform characterization processing to obtain the current network security characteristics; First, automatically obtain the current time information and collect real-time network environment data. The acquired time information and network environment data are combined to form a feature vector, which is then fed into the trained baseline model. Based on this input data, the baseline model predicts normal network security characteristics expected at the current time and network environment. These characteristics include expected network access characteristics, data traffic characteristics, and user operation behavior characteristics. This prediction represents the normal state under the current conditions and serves as an important reference for subsequent risk assessments.

[0034] At the same time, real-time network behavior data is collected, including network access records, data traffic characteristics, and user operation behavior. This real-time data is processed using the same characterization methods as historical data to calculate the current network access feature vector, data traffic feature vector, and user operation behavior feature vector. These vectors are then combined to form the current network security signature, which reflects the current state.

[0035] In this way, two sets of cybersecurity signatures are simultaneously obtained: expected signatures based on time and environmental predictions, and current signatures calculated based on actual observed data. This provides the necessary data foundation for subsequent risk assessment, enabling the identification of potential anomalies and risks by comparing expected and current signatures.

[0036] S4. Generate risk assessment results based on current network security characteristics and expected network security characteristics; Generating risk assessment results based on current network security characteristics and expected network security characteristics includes: Calculate the degree of deviation between the current network security features and the expected network security features in each dimension, and determine the feature dimensions whose deviation exceeds the preset threshold; The comprehensive risk score is obtained by weighted summing the size of feature deviations in different dimensions, where the weights of different dimensions are set based on historical security incident data; Analyze the distribution characteristics of feature deviations in different dimensions, including deviation concentration and deviation direction; Determine risk types based on distribution characteristics and a pre-established library of historical attack patterns; Generates the current risk assessment results including risk score and risk type.

[0037] The deviation concentration is represented by the ratio of the deviation degree of each dimension to the total deviation degree, and the deviation direction is represented by the ratio of the deviation degree of each dimension to the deviation degrees of the other two dimensions.

[0038] The pre-established historical attack pattern library includes typical deviation distributions of different types of attacks; the typical deviation distributions are classification kernels obtained after cluster analysis of deviation distributions corresponding to various types of attacks in history; Determining the risk type according to the distribution characteristics and a pre-established historical attack pattern library includes: matching a typical deviation distribution closest to the distribution characteristics in the historical attack pattern library, and using the attack type corresponding to the typical deviation distribution as the risk type.

[0039] In this embodiment, the degree of deviation between the current network security characteristics and the expected network security characteristics is first calculated. Specifically, the difference between the current characteristic value and the expected characteristic value is calculated for each of the three dimensions: network access characteristics, data flow characteristics, and user operation behavior characteristics. The degree of deviation for each dimension can be calculated using Euclidean distance, and the calculated result is compared with a pre-set threshold to determine which dimensions have deviations outside the normal range.

[0040] Then, a comprehensive risk score is calculated using a weighted summation based on the deviations in the features across different dimensions. Weights are derived from an analysis of historical security incident data and reflect the contribution of different dimensional features to security risk. For example, when high-risk events occur in historical data, data traffic is typically more likely to be abnormal, so a higher weight can be assigned.

[0041] Next, we analyze the distribution characteristics of feature deviations in different dimensions, including deviation concentration and deviation direction. Deviation concentration is calculated as the ratio of the deviation degree in each dimension to the total deviation degree, reflecting whether the anomaly is concentrated in a single dimension or distributed across multiple dimensions. For example, if the deviation in the network access dimension accounts for 80% of the total deviation, while the deviations in the other two dimensions are smaller, this indicates that the anomaly is primarily concentrated in network access behavior. Deviation direction is calculated as the ratio of the deviation degree in each dimension to the deviation degree in the other two dimensions, reflecting the relationship between the deviations in different dimensions. These distribution characteristics are crucial for identifying specific types of attacks.

[0042] Based on the calculated distribution characteristics, the system searches for the most matching pattern in a pre-established library of historical attack patterns to determine the risk type. This library contains typical deviation distributions for different attack types, derived through cluster analysis of historical security event data. For example, DDoS attacks typically manifest as high deviations in data traffic, while insider threats may manifest as high deviations in user behavior. The system calculates the similarity between the current distribution characteristics and each pattern in the library, and selects the attack type corresponding to the pattern with the highest similarity as the current risk type.

[0043] Finally, a risk assessment result is generated, including a risk score and risk type. The risk score reflects the degree of abnormality in the current network status, with higher scores indicating greater risk. The risk type indicates the possible attack type, such as unauthorized access, data leakage, and denial of service attacks.

[0044] S5. Adjust data access control and encryption policies based on risk assessment results.

[0045] Adjustments to data access control and encryption policies based on risk assessment results include: The system security level is divided into three levels: low, medium, and high according to the risk score, and the affected data resources are determined according to the risk type; Dynamically adjust access control policies based on security levels for affected data resources: maintain the original policy at low levels, add authentication requirements at mid-levels, and restrict access rights and log all operations at high levels; For affected data resources, the encryption strategy is adjusted according to the security level, including: maintaining existing encryption at the low level, increasing encryption strength at the medium level, and implementing multi-layer encryption and starting the data isolation mechanism at the high level.

[0046] In this embodiment, the system security level is divided into three levels: low, medium, and high based on risk scores. The score range corresponding to each level can be set based on historical records, expert experience, and other factors. Furthermore, the affected data resources are determined based on the risk type. For example, if the risk type is unauthorized access, the primary impact is on resources related to user authentication; if the risk type is data leakage, the primary impact is on sensitive data storage areas.

[0047] For affected data resources, access control policies are dynamically adjusted based on the security level. When the security level is low, the existing access control policy is maintained. When the security level is medium, authentication requirements are added to affected resources, such as requiring users to undergo secondary authentication, shortening session timeouts, and adding verification codes to raise the barrier to entry. When the security level is high, access to affected resources is strictly restricted, allowing access only to necessary management personnel. All operations are logged, and all access behavior is monitored in real time.

[0048] At the same time, adjust the encryption policy for affected data resources based on the security level. When the security level is low, maintain the existing encryption method, but increase the frequency of encryption key rotation. When the security level is medium, increase the encryption strength, such as upgrading the encryption algorithm from AES-128 to AES-256, or adding more encryption layers. When the security level is high, implement multi-layer encryption protection, including transport layer encryption, application layer encryption, and storage layer encryption, and activate data isolation mechanisms to migrate high-risk data to isolated storage areas and limit exchange with other data.

[0049] This dynamic adjustment mechanism, based on risk assessment, allows data protection measures to flexibly adapt to actual threat situations, ensuring data security in high-risk situations while avoiding overprotection that could impact usability and user experience in low-risk situations. Compared to traditional static security policies, this dynamic adjustment mechanism better balances security and usability, improving overall security effectiveness.

[0050] Example 2 See also Figure 2 The present invention provides a network security data management system based on an AI big model, which is used to implement a network security data management method based on an AI big model, including: The historical data module is used to obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; A model training module is used to train a baseline model for predicting network security characteristics based on time information and network environment data based on the historical database; The feature acquisition module is used to obtain real-time time information and network environment data, and obtain the expected network security features through the baseline model; obtain the real-time collected network environment data, perform feature processing to obtain the current network security features; A risk assessment module is used to generate risk assessment results based on current network security characteristics and expected network security characteristics; The security policy adjustment module is used to adjust data access control and encryption policies based on risk assessment results.

[0051] In the several embodiments provided by the present invention, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only one type. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0052] The above description is only a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed by the present invention, which should be covered by the scope of protection of the present invention.

[0053] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security data management method based on AI big model, characterized by: include: Obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; Based on the historical database, a baseline model is trained to predict network security characteristics based on time information and network environment data; Acquire real-time time information and network environment data, and obtain expected network security characteristics through baseline models; obtain real-time collected network environment data and perform characterization processing to obtain current network security characteristics; Generate risk assessment results based on current network security characteristics and expected network security characteristics; Adjust data access control and encryption policies based on risk assessment results.

2. A network security data management method based on AI big model according to claim 1, characterized in that: The network environment data includes network access records, data flow characteristics, and user operation behaviors; the network access records include access users, access resources, access time, and access rights; the data flow characteristics include flow size, flow direction, protocol type, and data packet characteristics; and the user operation behaviors include operation type, operation object, operation time interval, and operation sequence mode; The time information includes month, day of the week, hour, and whether it is a weekday label, and the network environment data includes network traffic load, number of active users, and frequency of external connection requests.

3. A network security data management method based on AI big model according to claim 2, characterized in that: The characterization process includes: For network access records: Calculate the access frequency matrix of different users to each resource; obtain the access diversity index by the ratio of the number of different users accessing the resource to the total number of accesses; obtain the abnormal access index by weighting the number of accesses at irregular times and the number of unauthorized accesses; and combine the access diversity index and the abnormal access index to obtain the network access feature vector. For data traffic characteristics: the total traffic volume index is obtained by the total traffic volume; the protocol distribution entropy index is calculated by calculating the traffic proportion of different protocol types; the traffic burst index is obtained by the ratio of instantaneous maximum traffic to average traffic; the data packet characteristic index is obtained by the average packet size value, packet size standard deviation value and large packet ratio value; the above four indicators are combined to form a data traffic feature vector; For user operation behavior: the operation timing index is obtained by the average operation interval length and the operation interval standard deviation; the operation type distribution index is obtained by the frequency statistics of various operations; the operation coverage index is obtained by the ratio of the different objects operated to the total number of objects in the system; the operation sequence pattern index is obtained by counting the number of the most and least common operation sequences; the operation complexity index is obtained by the number of operation types; the above five indicators are combined to form the user operation behavior feature vector; The network security features are formed by combining the features of three dimensions: network access features, data flow features and user operation behaviors.

4. A network security data management method based on AI big model according to claim 3, characterized in that: The baseline model trained to predict network security features based on time information and network environment data includes: Filter out the data without any security incidents from the historical database and record them as normal operation data; The normal operation data is divided into a training set and a validation set. Time information and network environment data are extracted from the data in different time periods to construct feature vectors as model inputs, and the corresponding network security features are used as model outputs. Use deep neural network architecture to design baseline model, initialize model structure parameters, and set model hyperparameters; Iterative training is performed using the training set data. In each iterative training, the model prediction value is calculated through forward propagation, the error between the predicted value and the actual network security characteristics is calculated, the model loss is calculated based on a predefined loss function, and the model parameters are updated using the backpropagation algorithm and optimizer to minimize the loss function. The model performance is evaluated regularly using the validation set. If the performance of the model on the validation set reaches the preset threshold, the training is completed. Otherwise, the hyperparameters and model structure parameters are adjusted and the training process is repeated; finally, a trained baseline model is obtained.

5. The network security data management method based on AI big model according to claim 4 is characterized in that: Generating risk assessment results based on current network security characteristics and expected network security characteristics includes: Calculate the degree of deviation between the current network security features and the expected network security features in each dimension, and determine the feature dimensions whose deviation exceeds the preset threshold; The comprehensive risk score is obtained by weighted summing the size of feature deviations in different dimensions, where the weights of different dimensions are set based on historical security incident data; Analyze the distribution characteristics of feature deviations in different dimensions, including deviation concentration and deviation direction; Determine risk types based on distribution characteristics and a pre-established library of historical attack patterns; Generates the current risk assessment results including risk score and risk type.

6. A network security data management method based on AI big model according to claim 5, characterized in that: The deviation concentration is represented by the ratio of the deviation degree of each dimension to the total deviation degree, and the deviation direction is represented by the ratio of the deviation degree of each dimension to the deviation degrees of the other two dimensions.

7. A network security data management method based on AI big model according to claim 6, characterized in that: The pre-established historical attack pattern library includes typical deviation distributions of different types of attacks; the typical deviation distributions are classification kernels obtained after cluster analysis of deviation distributions corresponding to various types of attacks in history; Determining the risk type according to the distribution characteristics and a pre-established historical attack pattern library includes: matching a typical deviation distribution closest to the distribution characteristics in the historical attack pattern library, and using the attack type corresponding to the typical deviation distribution as the risk type.

8. The network security data management method based on AI big model according to claim 7 is characterized in that: Adjustments to data access control and encryption policies based on risk assessment results include: The system security level is divided into three levels: low, medium, and high according to the risk score, and the affected data resources are determined according to the risk type; Dynamically adjust access control policies based on security levels for affected data resources: maintain the original policy at low levels, add authentication requirements at mid-levels, and restrict access rights and log all operations at high levels; For affected data resources, the encryption strategy is adjusted according to the security level, including: maintaining existing encryption at the low level, increasing encryption strength at the medium level, and implementing multi-layer encryption and starting the data isolation mechanism at the high level.

9. A network security data management system based on an AI big model, used to implement a network security data management method based on an AI big model according to any one of claims 1 to 8, characterized in that: include: The historical data module is used to obtain historical network behavior data and corresponding time information and network environment data, perform characterization processing on the network behavior data by time period, obtain corresponding network security features, and form a historical database; A model training module is used to train a baseline model for predicting network security characteristics based on time information and network environment data based on the historical database; The feature acquisition module is used to obtain real-time time information and network environment data, and obtain the expected network security features through the baseline model; Obtain the network environment data collected in real time and perform characterization processing to obtain the current network security characteristics; A risk assessment module is used to generate risk assessment results based on current network security characteristics and expected network security characteristics; The security policy adjustment module is used to adjust data access control and encryption policies based on risk assessment results.

Images