Network security analysis system based on AI algorithm

Abstract

The invention belongs to the technical field of network security, and particularly relates to a network security analysis system based on an AI algorithm. Comprising a data acquisition and preprocessing module, an abnormal behavior characteristic index construction module, a safety mode evolution law index construction module and a threat risk comprehensive evaluation module. According to the system, multi-source heterogeneous data such as network flow, equipment logs, threat intelligence and user behaviors are analyzed through deep learning, a graph neural network and an attention mechanism, potential attack time periods are recognized in real time, the threat evolution trend is predicted, and dynamic early warning is achieved by fusing multi-dimensional risk factors. Compared with a traditional detection mode based on rules, the method has higher unknown threat detection capacity, interpretability and real-time performance, the network security protection level can be greatly improved, and the method is suitable for various complex network environments.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and in particular relates to a network security analysis system based on AI algorithm. Background Art

[0002] With the widespread adoption of the internet and IoT devices, network structures are becoming increasingly complex, and the types and methods of cyberattacks are constantly evolving. This makes it difficult for traditional network security protection methods based on rules or static feature matching to promptly and accurately identify complex network threats. Existing network security analysis methods typically rely on feature libraries or expert rules, lacking detection capabilities for unknown attacks and multi-stage, complex attacks, and lack dynamic modeling of network security trends and prediction of evolutionary trends. The development of artificial intelligence technologies, particularly deep learning and graph neural networks, has provided new solutions for the detection, tracing, and early warning of network security threats. However, there is still room for improvement in multi-source heterogeneity of data, dynamic feature changes, and real-time risk assessment. Summary of the Invention

[0003] In response to the technical problems existing in the above background technology, the present invention proposes a network security analysis system based on AI algorithm.

[0004] In order to achieve the above-mentioned purpose, the technical solution adopted by the present invention is as follows: including a data acquisition and preprocessing module, an abnormal behavior characteristic index construction module, a security mode evolution law index construction module and a threat risk comprehensive assessment module;

[0005] Data acquisition and preprocessing module: used to collect network traffic data, device logs, threat intelligence data, and user behavior data, and process the collected data to generate standardized data sets;

[0006] Abnormal behavior characteristic index construction module: Based on a deep learning model, it identifies traffic anomaly patterns in standardized data, determines all potential attack periods, and uses an attention mechanism to analyze the correlation differences between traffic characteristics and user behavior characteristics within each attack period, calculating the correlation degree of abnormal characteristics. It also combines the characteristic change trends of adjacent time periods at the current moment to generate the abnormal behavior impact value at the current moment. Based on the weighted calculation of this value and the traffic anomaly score, it obtains the network abnormal behavior characteristic index.

[0007] The security pattern evolution law index construction module uses a graph neural network to analyze the correlation between threat intelligence and device logs in historical security events to obtain global security pattern correlation. A temporal convolutional network is used to extract the dynamic evolution characteristics of threat intelligence within the current set time period and calculate the local pattern matching degree. Based on the difference between global correlation and local matching degree, a security pattern evolution law index is constructed.

[0008] Comprehensive threat risk assessment module: This module integrates the abnormal behavior characteristic index and the security mode evolution law index to generate a risk assessment factor, combines the current traffic anomaly score to obtain a corrected risk value, and implements real-time early warning of network security threats based on the relationship between the corrected risk value and the set risk value threshold.

[0009] Preferably, in the data acquisition and preprocessing module, the specific operation method of processing the collected data to generate a standardized data set is:

[0010] First, set the collection cycle and collect the data flow within the cycle. Calculating the information entropy of data , dynamically adjust the sampling frequency according to the information entropy, ,in, Represents the maximum information entropy set, when and When the difference is less than the set threshold, the sampling frequency Increase to the initial sampling frequency twice, and vice versa Lower than hour, becomes ;

[0011] Convert unstructured data into structured data, perform wavelet packet decomposition and ARMA model prediction on the data, and remove noise by combining residual analysis to obtain the data after noise removal. ;

[0012] Calculate the kernel density estimate of the data and normalize it by density region. The kernel density estimate is calculated as follows: , where n is the total number of samples, h is the bandwidth, represents the i-th sample data point, is the target location;

[0013] set up Greater than setting The area is defined as the high-density area and linear normalization is used. The rest of the area is the low-density area and logarithmic transformation is used. The calculation method is: ,in represents the denoised data, The data are normalized.

[0014] As a preferred method, the data is subjected to wavelet packet decomposition and ARMA model prediction, and the noise is removed by combining residual analysis. The specific implementation method of obtaining the data after noise removal is as follows:

[0015] First, the approximate entropy is used to dynamically determine the number of wavelet packet decomposition layers L, which is calculated as follows: ,in is the approximate entropy of the original data X, and calculates the energy proportion of each frequency band , retain the frequency band whose energy ratio is greater than the set threshold, and the calculation method of the frequency band energy ratio is: ,in is the coefficient of the bth frequency band, and m is the number of coefficients;

[0016] Then determine the ARMA model order , calculated as: ,in represents the residual variance, The ARMA model order is dynamically adjusted. The predicted value is obtained according to the improved ARMA model, and the calculated residual is further obtained. ;

[0017] Finally, bidirectional linear interpolation combined with wavelet coefficient reconstruction is used to obtain the denoised data calculation method: ,in is the residual significance evaluation coefficient, which is generated by calculating the ratio of the absolute value of the residual to the local mean. is the time domain linear interpolation.

[0018] Preferably, the determination of the potential attack period in the abnormal behavior characteristic index construction module is specifically to use a variational autoencoder to generate a normal traffic space model for historical traffic data, extract the reconstruction error valleys in the traffic data, and take the time period from the corresponding moment of each valley to the adjacent peak moment as the potential attack period.

[0019] Preferably, the abnormal feature correlation degree is calculated as follows:

[0020] A bidirectional long short-term memory network is used to perform time series modeling on the traffic feature sequence within the potential attack period to obtain the traffic feature time series dependency vector.

[0021] The cosine similarity between the traffic feature time series dependency vector and the user behavior feature vector is calculated through the cross-attention mechanism to obtain the abnormal feature correlation. The calculation method is: ,in are the traffic feature time series dependency vector and the user behavior feature vector respectively. are the parameters of the model.

[0022] Preferably, the method for determining the abnormal behavior impact value at the current moment is:

[0023] The convolutional neural network is used to extract the spatial features of the traffic data in the current adjacent time period, and the feature change rate is calculated through the gated recurrent unit to obtain the feature mutation value at the current moment;

[0024] Average correlation of abnormal features based on historical attack periods , calculate the characteristic mutation value at the current moment and The Euclidean distance is used to generate the abnormal behavior impact value through the exponential function: , where M is the impact value of abnormal behavior, is the feature mutation value at the current moment.

[0025] Preferably, the method for constructing the network abnormal behavior characteristic index is:

[0026] The isolation forest algorithm is used to generate anomaly score sequences for the preprocessed traffic data. The hierarchical attention mechanism is used to perform temporal weighting on the anomaly scores to obtain the network abnormal behavior characteristic index, which is calculated as follows: ,in, is the abnormal score at the current moment, M is the impact value of abnormal behavior, ⊙ is element-level multiplication, is the weight parameter, Abnormal behavior characteristic index.

[0027] Preferably, the step of obtaining the global security mode correlation includes:

[0028] Map historical threat intelligence and device logs into a heterogeneous graph network, where nodes include IP addresses, ports, and vulnerability types, and edges represent event associations.

[0029] The graph attention network is used to calculate the attention weights between nodes and generate the association graph matrix G of the global security pattern.

[0030] Preferably, the calculation method of the security mode evolution law index is:

[0031] The threat intelligence sequence of the current adjacent time period is extracted through the temporal convolutional network to generate a local pattern feature vector;

[0032] Calculate the matrix similarity S between the local pattern feature vector and the global graph matrix G, and generate the security pattern evolution law index through the exponential function. ,in is the security model evolution law index, is the Frobenius norm, are the diagonal elements of G.

[0033] Preferably, the risk assessment factor is generated by:

[0034] First, the abnormal behavior characteristic index E and the security mode evolution law index Normalize and then use the normalized common behavior characteristic index E and security mode evolution law index The weighted sum is performed to obtain the initial risk assessment factor, and the Softmax function is used on the initial risk assessment factor to make it fall in the [0,1] interval to generate the risk assessment factor K.

[0035] Preferably, the modified risk value is calculated as follows: , where Z is the current traffic anomaly score, is the dynamic adjustment coefficient.

[0036] Compared with the prior art, the advantages and positive effects of the present invention are:

[0037] This invention utilizes a method that combines deep learning, graph neural networks, and attention mechanisms to dynamically and intelligently extract features and predict risks from heterogeneous data from multiple sources on the network, significantly improving the sensitivity and accuracy of detecting unknown and complex attacks. Through modular architecture design, it supports flexible deployment and rapid updates, reducing system integration and operation and maintenance costs. Furthermore, the system boasts strong interpretability and high real-time performance, providing a scientific and quantitative basis for decision-making in security operations and maintenance, significantly enhancing the intelligence and sustainability of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following is a brief introduction to the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0039] Figure 1 It is a structural flow chart of the present invention. DETAILED DESCRIPTION

[0040] In order to more clearly understand the above-mentioned objects, features and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments. It should be noted that the embodiments of the present application and the features therein can be combined with each other without conflict.

[0041] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways than those described herein. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0042] In this embodiment, with the expansion of network scale and the diversification of device types, network security threats are also showing a trend of rapid growth and high complexity. In particular, advanced persistent threats (APTs), zero-day vulnerability attacks, ransomware propagation, and multi-stage combined attacks are emerging in an endless stream, causing huge risks of data leakage and economic losses. This invention proposes a network security analysis system based on AI algorithms. The specific implementation process is as follows: Figure 1 As shown, it includes a data acquisition and preprocessing module, an abnormal behavior feature index construction module, a security mode evolution law index construction module, and a threat risk comprehensive assessment module.

[0043] Data acquisition and preprocessing module: used to collect network traffic data, device logs, threat intelligence data, and user behavior data, and process the collected data to generate a standardized data set. Specifically, the data acquisition and preprocessing module processes the collected data to generate a standardized data set in the following manner:

[0044] First, set the collection cycle and collect the data flow within the cycle. Calculating the information entropy of data , dynamically adjust the sampling frequency according to the information entropy, ,in, Represents the maximum information entropy set, when and When the difference is less than the set threshold, the sampling frequency Increase to the initial sampling frequency twice, and vice versa Lower than hour, becomes ; Convert the unstructured data into structured data, perform wavelet packet decomposition and ARMA model prediction on the data, and remove the noise by combining residual analysis to obtain the data after noise removal ; Calculate the data kernel density estimate and normalize it by density region. The kernel density estimate is calculated as follows: , where n is the total number of samples, h is the bandwidth, represents the i-th sample data point, is the target position; set Greater than setting The area is defined as the high-density area and linear normalization is used. The rest of the area is the low-density area and logarithmic transformation is used. The calculation method is: ,in represents the denoised data, The data are normalized.

[0045] The data is subjected to wavelet packet decomposition and ARMA model prediction, and the noise is removed by combining residual analysis to obtain the data after noise removal. The specific implementation method is to first use the approximate entropy to dynamically determine the wavelet packet decomposition layer number L, which is calculated as follows: ,in is the approximate entropy of the original data X, and calculates the energy proportion of each frequency band , retain the frequency band whose energy ratio is greater than the set threshold, and the calculation method of the frequency band energy ratio is: ,in is the coefficient of the bth frequency band, m is the number of coefficients; then determine the ARMA model order , calculated as: ,in represents the residual variance, The ARMA model order is dynamically adjusted. The predicted value is obtained according to the improved ARMA model, and the calculated residual is further obtained. Finally, bidirectional linear interpolation combined with wavelet coefficient reconstruction is used to obtain the denoised data calculation method: ,in is the residual significance evaluation coefficient, which is generated by calculating the ratio of the absolute value of the residual to the local mean. is the time domain linear interpolation.

[0046] Abnormal behavior characteristic index construction module: Based on the deep learning model, it identifies traffic anomaly patterns in standardized data, determines all potential attack periods, and uses the attention mechanism to analyze the correlation differences between traffic characteristics and user behavior characteristics in each attack period, and calculates the correlation degree of abnormal characteristics; combined with the characteristic change trend of adjacent time periods at the current moment, it generates the abnormal behavior impact value at the current moment, and obtains the network abnormal behavior characteristic index based on the weighted calculation of this value and the traffic anomaly score.

[0047] Among them, the determination of potential attack periods in the abnormal behavior characteristic index construction module is specifically to use a variational autoencoder to generate a normal traffic space model for historical traffic data, extract the reconstruction error valley values ​​in the traffic data, and take the time period from the corresponding moment of each valley value to the adjacent peak moment as the potential attack period.

[0048] The calculation method for abnormal feature correlation is as follows: a bidirectional long short-term memory network is used to perform time series modeling on the traffic feature sequence within the potential attack period to obtain the traffic feature time series dependency vector; the cosine similarity between the traffic feature time series dependency vector and the user behavior feature vector is calculated through the cross-attention mechanism to obtain the abnormal feature correlation. The calculation method is: ,in are the traffic feature time series dependency vector and the user behavior feature vector respectively. is a parameter of the model. Specifically, a bidirectional long short-term memory (BiLSTM) network is first used to model the temporal dependency of traffic feature sequences within the potential attack period, thereby obtaining a traffic feature time series vector that represents historical and future dependencies. A cross-attention mechanism is then used to model the correlation between this traffic time series dependency vector and the user behavior feature vector. The cosine similarity between the two is calculated, and the anomaly feature correlation is further output. In the specific calculation, the traffic time series vector is linearly transformed to obtain a query vector, and the user behavior vector is independently linearly transformed to obtain key and value vectors. The similarity between the query and key vectors is normalized using an attention scoring function, and then the value vector is weighted. Finally, an attention correlation representation is output, and the relative deviation is quantified using the cosine similarity function. This anomaly feature correlation metric comprehensively characterizes the coupling between traffic anomalies and user behavior characteristics, helping to accurately identify attacks triggered by abnormal user operations or highly concealed attacks disguised as normal behavior. This method significantly improves the interpretability and detection sensitivity of the system when analyzing complex multi-source behavior correlations.

[0049] The method for determining the impact value of abnormal behavior at the current moment is as follows: using a convolutional neural network to extract the spatial features of the traffic data of the current adjacent period, calculating the feature change rate through a gated recurrent unit, and obtaining the feature mutation value at the current moment; based on the average correlation degree of abnormal features in historical attack periods , calculate the characteristic mutation value at the current moment and The Euclidean distance is used to generate the abnormal behavior impact value through the exponential function: , where M is the impact value of abnormal behavior, is the feature mutation value at the current moment. Specifically, a convolutional neural network is first used to extract local spatial features from traffic data for the current and adjacent time periods, identifying spatial structural patterns and local variation trends in the traffic, thereby forming a vector representation describing the spatial distribution characteristics of the data. A gated recurrent unit is then introduced to perform temporal dependency learning on the convolutional feature sequence to calculate the feature change rate and extract dynamic information from the sequence, thereby obtaining the feature mutation value at the current moment. Next, the Euclidean distance between this feature mutation value and the mean correlation of anomaly features within known historical attack periods is calculated to measure the closeness of the current feature mutation to historical attack features. Finally, an exponential function is used to nonlinearly map this Euclidean distance, outputting an abnormal behavior impact value M between 0 and 1 to characterize the potential impact of the current abnormal behavior on the overall network security status. This design not only fully integrates feature information from both spatial and temporal dimensions but also dynamically adapts to fluctuations in network behavior. This significantly enhances the system's sensitivity and responsiveness in multi-stage attacks or covert threat scenarios, helping to improve the accuracy and early warning reliability of subsequent risk assessment modules.

[0050] The network abnormal behavior characteristic index is constructed by using the isolation forest algorithm to generate an abnormal score sequence for the preprocessed traffic data, and performing time-series weighting on the abnormal scores through the hierarchical attention mechanism to obtain the network abnormal behavior characteristic index. The calculation method is: ,in, is the abnormal score at the current moment, M is the impact value of abnormal behavior, ⊙ is element-level multiplication, is the weight parameter, is the abnormal behavior characteristic index. Specifically, the isolation forest algorithm is first applied to preprocessed, standardized traffic data. By randomly partitioning the feature subspace and conducting in-depth analysis of isolated paths, a series of anomaly scores is generated for each data segment, reflecting its degree of deviation from the normal behavior distribution. Subsequently, to fully account for the continuity and phased changes of abnormal behavior in the temporal dimension, a hierarchical attention mechanism is introduced to perform multi-level time-series weighted modeling on the anomaly score series. This mechanism dynamically focuses on the temporal pattern of anomaly scores by assigning learnable weight parameters to different time windows. It also incorporates the current abnormal behavior impact value M through element-wise multiplication to enhance features. This allows the anomaly score to not only consider the static metrics of the isolation forest but also incorporate traffic context and the degree of abnormal behavior mutation. Finally, after softmax normalization, the network abnormal behavior characteristic index E is obtained. The output E serves as a key input metric for the subsequent comprehensive risk assessment module. This method fully combines the isolated anomaly detection capabilities of machine learning with the time series attention advantages of deep learning, achieving a more comprehensive, dynamic, and interpretable characterization of network abnormal behavior, thereby significantly improving the detection sensitivity of complex attack behaviors.

[0051] Security pattern evolution law index construction module: Use graph neural networks to analyze the correlation map between threat intelligence and device logs in historical security events to obtain global security pattern correlation; use temporal convolutional networks to extract the dynamic evolution characteristics of threat intelligence within the current set time period and calculate the local pattern matching degree; based on the difference between global correlation and local matching degree, construct a security pattern evolution law index.

[0052] The step of obtaining the relevance of the global security pattern includes mapping historical threat intelligence and device logs into a heterogeneous graph network, where nodes include IP addresses, ports, vulnerability types, and edges represent event associations; and using a graph attention network to calculate attention weights between nodes to generate a graph matrix G representing the correlation of the global security pattern. Specifically, historical threat intelligence data and device log information are first mapped into a heterogeneous graph network, where nodes include IP addresses, port numbers, vulnerability types, and attacked device identifiers, and edges are defined as time series associations or homologous attack path associations in historical events, forming a well-structured heterogeneous event graph. A graph attention network is then introduced to this graph to adaptively calculate attention weights between different nodes, thereby characterizing the degree of influence between nodes on the global security situation. This outputs a node weight matrix and an edge weight matrix, thereby generating a graph matrix G representing the correlation of the global security pattern. This matrix can express the interaction strength and security coupling relationships between various network entities, forming a global pattern foundation that can be used for subsequent evolutionary pattern comparison. Through this method, the system can not only automatically extract the contextual semantic features of nodes and edges, but also dynamically adapt to changes in threat intelligence in different time periods, enhance the ability to identify attack chains, lateral penetration behaviors and distributed attack patterns, and help achieve more forward-looking and comprehensive network security protection.

[0053] The calculation method of the security pattern evolution law index is as follows: feature extraction is performed on the threat intelligence sequence of the current adjacent time period through a temporal convolutional network to generate a local pattern feature vector; the matrix similarity S between the local pattern feature vector and the global graph matrix G is calculated, and the security pattern evolution law index is generated through an exponential function. ,in is the security model evolution law index, is the Frobenius norm, is the diagonal element of G. Specifically, the time series convolutional network is first used to extract features from the threat intelligence sequence collected in the current adjacent time period, thereby generating a local pattern feature vector containing time series context information. This feature vector can characterize the behavior pattern and evolution trend of threat intelligence in the current time window. Subsequently, the local pattern feature vector is similar to the global security pattern association graph matrix G obtained in advance through the graph neural network, and the matrix similarity measure S is used to characterize the consistency between the local pattern and the global pattern. Then, the difference between the diagonal elements of the S and G matrices is calculated, and combined with the Frobenius norm to measure the degree of matching deviation of the local pattern in the global pattern, and finally the matching deviation is mapped to the range of 0 to 1 through the exponential function, and the security pattern evolution law index is output. This design not only takes into account local agile detection capabilities, but also ensures consistency with the long-term accumulated global security model, thereby achieving early warning of unknown threats and evolving attack behaviors, and significantly improving the accuracy and interpretability of network security situational awareness.

[0054] Finally, the threat risk comprehensive assessment module: integrates the abnormal behavior characteristic index and the security mode evolution law index to generate a risk assessment factor, combines the current traffic anomaly score to obtain a corrected risk value, and realizes real-time early warning of network security threats based on the relationship between the corrected risk value and the set risk value threshold.

[0055] The method for generating the risk assessment factor is to firstly convert the abnormal behavior characteristic index E and the security mode evolution law index Normalize and then use the normalized common behavior characteristic index E and security mode evolution law index The initial risk assessment factor is obtained by weighted summation, and the Softmax function is used to make the initial risk assessment factor fall within the [0,1] interval to generate the risk assessment factor K. Specifically, the abnormal behavior feature index E and the security mode evolution law index G′ are first normalized to make them comparable; then, the normalized E and the security mode evolution law index G′ are compared according to the pre-defined weight coefficient. A weighted summation is performed to obtain a preliminary risk assessment factor. To ensure stable output values ​​and facilitate subsequent risk assessment, the preliminary risk assessment factor is input into the Softmax function, normalizing its numerical range to the [0, 1] interval, ultimately outputting the risk assessment factor K. This risk assessment factor comprehensively reflects the dynamics of traffic anomalies and security model evolution, while also being highly interpretable and adjustable, providing an intuitive and reliable basis for risk quantification for subsequent security warnings and decision-making.

[0056] Finally, the calculation method of the modified risk value based on the risk assessment factor K is: , where Z is the current traffic anomaly score, Specifically, we first obtain the risk assessment factor K output by the threat risk comprehensive assessment module, and simultaneously obtain the current traffic anomaly score Z to reflect the abnormality of the latest network traffic. Then we introduce a dynamic adjustment coefficient , dynamically updated based on historical warning accuracy or expert experience to adapt to the sensitivity of different network security environments. Finally, through the weighted formula, K and Z are integrated to output the corrected risk value , and Comparisons with pre-set thresholds are used to trigger real-time alerts or automated response strategies. This approach seamlessly integrates static risk assessment with real-time anomaly detection, improving the flexibility and timeliness of overall risk assessments. It prevents false positives and negatives caused by short-term anomaly surges or model drift, thereby maintaining high alert accuracy and practicality in dynamic and changing network scenarios.

[0057] The above description is merely a preferred embodiment of the present invention and does not constitute any other form of limitation to the present invention. Any person skilled in the art may utilize the technical contents disclosed above to change or modify them into equivalent embodiments with equivalent changes for application in other fields. However, any simple modification, equivalent change, and modification of the above embodiments made in accordance with the technical essence of the present invention without departing from the technical solution of the present invention shall still fall within the scope of protection of the technical solution of the present invention.

Claims

1. A network security analysis system based on AI algorithm, characterized by: It includes data acquisition and preprocessing module, abnormal behavior characteristic index construction module, security mode evolution law index construction module and threat risk comprehensive assessment module; Data acquisition and preprocessing module: used to collect network traffic data, device logs, threat intelligence data, and user behavior data, and process the collected data to generate standardized data sets; Abnormal behavior feature index construction module: Based on a deep learning model, it identifies abnormal traffic patterns in standardized data, determines all potential attack periods, and uses an attention mechanism to analyze the correlation differences between traffic characteristics and user behavior characteristics during each attack period, and calculates the abnormal feature correlation degree; Combined with the characteristic change trend of the adjacent time periods at the current moment, the abnormal behavior impact value at the current moment is generated. Based on the weighted calculation of this value and the traffic anomaly score, the network abnormal behavior characteristic index is obtained; Security Pattern Evolution Index Construction Module: Utilizes graph neural networks to analyze the correlation between threat intelligence and device logs in historical security events to obtain global security pattern relevance. A temporal convolutional network is used to extract the dynamic evolution characteristics of threat intelligence within the current set time period and calculate the local pattern matching degree. Based on the difference between global correlation and local matching, a security pattern evolution law index is constructed; Comprehensive threat risk assessment module: This module integrates the abnormal behavior characteristic index and the security mode evolution law index to generate a risk assessment factor, combines the current traffic anomaly score to obtain a corrected risk value, and implements real-time early warning of network security threats based on the relationship between the corrected risk value and the set risk value threshold.

2. A network security analysis system based on AI algorithm according to claim 1, characterized in that: In the data acquisition and preprocessing module, the specific operation method of processing the collected data to generate a standardized data set is as follows: First, set the collection cycle and collect the data flow within the cycle. Calculating the information entropy of data , dynamically adjust the sampling frequency according to the information entropy, ,in, Represents the maximum information entropy set, when and When the difference is less than the set threshold, the sampling frequency Increase to the initial sampling frequency twice, and vice versa Lower than hour, becomes ; Convert unstructured data into structured data, perform wavelet packet decomposition and ARMA model prediction on the data, and remove noise by combining residual analysis to obtain the data after noise removal. ; Calculate the kernel density estimate of the data and normalize it by density region. The kernel density estimate is calculated as follows: , where n is the total number of samples, h is the bandwidth, represents the i-th sample data point, is the target location; set up Greater than setting The area is defined as the high-density area and linear normalization is used. The rest of the area is the low-density area and logarithmic transformation is used. The calculation method is: ,in represents the denoised data, The data are normalized.

3. A network security analysis system based on AI algorithm according to claim 2, characterized in that: The data is decomposed by wavelet packet and predicted by ARMA model, and the noise is eliminated by combining residual analysis. The specific implementation method of obtaining the data after noise removal is as follows: First, the approximate entropy is used to dynamically determine the number of wavelet packet decomposition layers L, which is calculated as follows: ,in is the approximate entropy of the original data X, and calculates the energy proportion of each frequency band , retain the frequency band whose energy ratio is greater than the set threshold, and the calculation method of the frequency band energy ratio is: ,in is the coefficient of the bth frequency band, and m is the number of coefficients; Then determine the ARMA model order , calculated as: ,in represents the residual variance, The ARMA model order is dynamically adjusted. The predicted value is obtained according to the improved ARMA model, and the calculated residual is further obtained. ; Finally, bidirectional linear interpolation combined with wavelet coefficient reconstruction is used to obtain the denoised data calculation method: ,in is the residual significance evaluation coefficient, which is generated by calculating the ratio of the absolute value of the residual to the local mean. is the time domain linear interpolation.

4. The network security analysis system based on AI algorithm according to claim 1, characterized in that: The determination of potential attack periods in the abnormal behavior feature index construction module is specifically to use a variational autoencoder to generate a normal traffic space model for historical traffic data, extract the reconstruction error valleys in the traffic data, and use the time period from the corresponding moment of each valley value to the adjacent peak moment as the potential attack period.

5. The network security analysis system based on AI algorithm according to claim 1, characterized in that: The calculation method of the abnormal feature correlation degree is: A bidirectional long short-term memory network is used to perform time series modeling on the traffic feature sequence within the potential attack period to obtain the traffic feature time series dependency vector. The cosine similarity between the traffic feature time series dependency vector and the user behavior feature vector is calculated through the cross-attention mechanism to obtain the abnormal feature correlation. The calculation method is: ,in are the traffic feature time series dependency vector and the user behavior feature vector respectively. are the parameters of the model.

6. A network security analysis system based on AI algorithm according to claim 5, characterized in that: The method for determining the impact value of abnormal behavior at the current moment is: The convolutional neural network is used to extract the spatial features of the traffic data in the current adjacent time period, and the feature change rate is calculated through the gated recurrent unit to obtain the feature mutation value at the current moment; Average correlation of abnormal features based on historical attack periods , calculate the characteristic mutation value at the current moment and The Euclidean distance is used to generate the abnormal behavior impact value through the exponential function: , where M is the impact value of abnormal behavior, is the feature mutation value at the current moment.

7. A network security analysis system based on AI algorithm according to claim 6, characterized in that: The method for constructing the network abnormal behavior characteristic index is: The isolation forest algorithm is used to generate anomaly score sequences for the preprocessed traffic data. The hierarchical attention mechanism is used to perform temporal weighting on the anomaly scores to obtain the network abnormal behavior characteristic index, which is calculated as follows: ,in, is the abnormal score at the current moment, M is the impact value of abnormal behavior, ⊙ is element-level multiplication, is the weight parameter, Abnormal behavior characteristic index.

8. The network security analysis system based on AI algorithm according to claim 1, characterized in that: The step of obtaining the global security mode correlation includes: Map historical threat intelligence and device logs into a heterogeneous graph network, where nodes include IP addresses, ports, and vulnerability types, and edges represent event associations. The graph attention network is used to calculate the attention weights between nodes and generate the association graph matrix G of the global security pattern.

9. The network security analysis system based on AI algorithm according to claim 8, characterized in that: The calculation method of the security mode evolution law index is: The threat intelligence sequence of the current adjacent time period is extracted through the temporal convolutional network to generate a local pattern feature vector; Calculate the matrix similarity S between the local pattern feature vector and the global graph matrix G, and generate the security pattern evolution law index through the exponential function. ,in is the security model evolution law index, is the Frobenius norm, are the diagonal elements of G.

10. The network security analysis system based on AI algorithm according to claim 1, characterized in that: The method for generating the risk assessment factor is: First, the abnormal behavior characteristic index E and the security mode evolution law index Normalize and then use the normalized common behavior characteristic index E and security mode evolution law index The weighted sum is performed to obtain the initial risk assessment factor. The Softmax function is used on the initial risk assessment factor to make it fall in the [0,1] interval to generate the risk assessment factor K. The calculation method of the risk value modified according to the risk assessment factor is: , where Z is the current traffic anomaly score, is the dynamic adjustment coefficient, is the adjusted risk value.

Images