Network security supervision system based on artificial intelligence technology

Abstract

The invention discloses a network security supervision system based on an artificial intelligence technology, belongs to the technical field of network security, and aims to solve the problems of one-sided supervision view angle, poor traceability and weak model generalization ability caused by insufficient model generalization ability and insufficient multi-dimensional data fusion. The system comprises a data acquisition layer, a data preprocessing layer, an artificial intelligence analysis layer, a safety supervision layer and a dynamic optimization layer, solves the problem that a traditional supervision system is single in data, enhances the supervision view angle, and compared with a traditional rule base system, the analysis capability is higher, unknown threats can be identified, the traceability efficiency is greatly improved, and the method is suitable for popularization and application. In addition, the model in the application can also adapt to various scenes and has relatively strong adaptation capability, and the model is internally provided with an automatic disposal script, so that quick response of emergency alarm can be realized, and the supervision efficiency is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security monitoring system based on artificial intelligence technology. Background Technology

[0002] With the rapid development of the digital economy, the network environment has become increasingly complex, and malicious attack methods are becoming more intelligent, covert, and diversified. Traditional rule-based network security supervision systems have obvious limitations: on the one hand, rule bases rely on manual updates and are difficult to deal with unknown threats; on the other hand, traditional systems are inefficient in processing massive amounts of network data and cannot achieve real-time supervision.

[0003] The rise of artificial intelligence technology has provided new solutions for cybersecurity supervision. While threat detection models incorporating machine learning have emerged, they still have shortcomings, including: most systems employ a single machine learning algorithm, adapting only to specific scenarios. When faced with complex data distributions across multiple scenarios, detection accuracy drops significantly, indicating insufficient model generalization ability; existing supervision systems can only identify threat situations but cannot link them to their sources, hindering subsequent security response and attribution analysis; cybersecurity supervision requires integrating multi-dimensional information such as traffic data, log data, asset data, and threat intelligence data, but existing supervision systems often focus on single data types, lacking a unified data fusion and analysis framework, leading to a one-sided supervisory perspective; furthermore, cyberattack methods are constantly evolving, and the fixed model parameters of existing supervision systems cannot dynamically adjust algorithm strategies according to changes in attack patterns. Long-term use can lead to "model aging," resulting in a lack of dynamic adaptability and a decline in supervisory capabilities.

[0004] To address the above issues, a cybersecurity monitoring system based on artificial intelligence technology is proposed. Summary of the Invention

[0005] The purpose of this invention is to provide a network security supervision system based on artificial intelligence technology. By using this invention, the problems of insufficient model generalization ability, insufficient multi-dimensional data fusion, resulting in a one-sided regulatory perspective, poor traceability ability, and weak model generalization ability in the above-mentioned background are solved.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network security monitoring system based on artificial intelligence technology, comprising a data acquisition layer, a data preprocessing layer, an artificial intelligence analysis layer, a security monitoring layer, and a dynamic optimization layer, wherein each layer is electrically connected in sequence; The data acquisition layer is used to collect multi-dimensional network security data, which includes traffic data, log data, asset data, and threat intelligence data. The data preprocessing layer is used to clean, standardize, and fuse the collected multi-dimensional data, and finally output structured analysis data. The artificial intelligence analysis layer has a built-in multimodal algorithm model for threat detection, anomaly identification, and source tracing analysis of structured analysis data; The security monitoring layer is used to display the security situation, handle alarms, and distribute protection strategies based on the output results of the artificial intelligence analysis layer. The dynamic optimization layer can dynamically adjust the algorithm parameters of the artificial intelligence analysis layer based on historical monitoring data and new attack patterns, thereby optimizing model performance.

[0007] Furthermore, the data acquisition layer includes a traffic acquisition module, a log acquisition module, an asset acquisition module, and a threat intelligence acquisition module; The traffic acquisition module uses deep packet inspection technology to collect traffic data of each layer of the TCP / IP protocol stack in real time through acquisition probes deployed on core network nodes, with a acquisition frequency of no less than 1000 packets / second. The log collection module can collect the operation logs of network devices, servers and terminal devices through Syslog protocol, SNMP protocol or API interface, and the log fields include at least timestamp, device ID, operation type, event description and return code; The asset acquisition module collects asset information in the network through a combination of active scanning and passive discovery, including asset IP address, MAC address, device type, operating system version, running services, and open ports. The acquisition period can be configured to be 1-24 hours. The threat intelligence collection module connects to a third-party threat intelligence platform to obtain malicious IP addresses, malicious domains, malicious hash values, vulnerability information, and organizational information in real time, with a data update frequency of no less than once per hour.

[0008] Furthermore, the data preprocessing layer includes a data cleaning module, a data standardization module, and a data fusion module; The data cleaning module uses an outlier detection algorithm to identify and remove outlier data from multi-dimensional data. The data standardization module adopts the Min-Max standardization method, which can map data of different magnitudes to the [0,1] interval, and convert the timestamp of log data into Unix timestamp format, and convert the device type of asset data into vector form through One-Hot encoding; The data fusion module, based on a multimodal data fusion algorithm with an attention mechanism, merges the cleaned multi-dimensional data into unified structured analysis data. The fused data is in JSON format and includes fields such as "data type", "time stamp", "core feature" and "association ID".

[0009] Furthermore, the artificial intelligence analysis layer includes a threat detection model, an anomaly recognition model, and a source tracing analysis model, and the threat detection model, anomaly recognition model, and source tracing analysis model work together through a model scheduler; The threat detection model is a multi-classification model built on deep learning. The network structure includes an input layer, three convolutional layers, two pooling layers, one fully connected layer, and an output layer. It can output the threat type and threat confidence level. The anomaly identification model uses the Isolation Forest algorithm based on unsupervised learning. It takes the transmission rate and data packet size fluctuation in traffic data and the operation frequency in log data as input features, and can output the device ID, anomaly features and anomaly score of the abnormal behavior. The source tracing analysis model is a knowledge graph-based model that includes an entity layer, a relationship layer, and a reasoning layer. It uses a rule-based reasoning algorithm to trace the propagation path of threats and generate a source tracing report. The model scheduler uses a priority scheduling strategy to reduce the response latency of model collaboration.

[0010] Furthermore, the security supervision layer includes a situation display module, an alarm handling module, and a protection strategy module; The situation display module uses computer vision technology to display the network security situation through traffic heatmaps, threat radar maps, and asset topology maps, with a data refresh rate of no less than 1 time per second. The alarm handling module can trigger alarms of different levels based on threat confidence and anomaly score. The alarm methods include SMS, email and system pop-up, and alarm escalation is supported. The alarm handling module has built-in automated handling scripts that can perform preset operations for emergency alarms. The protection strategy module can generate access control, vulnerability remediation, and traffic restriction policies based on the source tracing report, and supports both manual review and automatic distribution.

[0011] Furthermore, the dynamic optimization layer includes a data storage module, a model evaluation module, and a parameter adjustment module; The data storage module uses a distributed database to store historical monitoring data and supports data backup and recovery. The model evaluation module can periodically calculate the performance indicators of each model, including the accuracy, recall and F1 score of the threat detection model, the precision of the anomaly identification model, and the source tracing accuracy of the source tracing analysis model. When the core indicators of any model are lower than the preset threshold for two consecutive evaluation cycles, the model optimization process is triggered. The parameter adjustment module employs a reinforcement learning algorithm, which can dynamically adjust the key parameters of each model and update the model through incremental training to improve the model's performance metrics.

[0012] Furthermore, the cybersecurity monitoring system based on artificial intelligence technology also includes a user interaction layer, which is electrically connected to the security monitoring layer. The interaction layer includes a role management module, a permission configuration module, and an operation log module. The role management module supports the creation of multiple user roles, including system administrator, security analyst, and general viewer. The permission configuration module can assign corresponding operation permissions to different roles based on the RBAC model, and also supports batch authorization and single authorization. The operation log module is used to record all user operations. The operation log is immutable and supports data export.

[0013] Furthermore, the network security supervision system based on artificial intelligence technology also includes an interface extension layer, which is electrically connected to the data acquisition layer and the security supervision layer respectively. The interface extension layer includes an acquisition interface module and an output interface module. The acquisition interface module provides an RJ45 Ethernet interface, a Wi-Fi 802.11ac interface, a LoRa interface, an NB-IoT interface, an RS485 interface, a Modbus interface, and a Profinet interface; The output interface module provides a RESTful API interface, a JSON-RPC interface, a Kafka message queue interface, an HDMI interface, and a VGA interface.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This application solves the problem of single data in traditional regulatory systems and enhances the regulatory perspective by integrating multi-dimensional data such as traffic, logs, assets and threat intelligence, and combining them with an attention mechanism fusion algorithm to highlight key information.

[0015] 2. The threat detection model in this application uses deep learning to improve the accuracy of identifying complex threats; while the source tracing analysis model is based on knowledge graphs to achieve full-link source tracing. Compared with traditional rule base systems, it has stronger analytical capabilities and can identify unknown threats, thus greatly improving source tracing efficiency.

[0016] 3. This application dynamically adjusts the model parameters through reinforcement learning and combines incremental training to update the model, which can ensure that the network security supervision system can maintain high performance when attack patterns evolve. In addition, the model in this application can also be adapted to multiple scenarios such as general networks, Internet of Things and industrial Internet, and has strong adaptability.

[0017] 4. The model in this application has built-in automated handling scripts, which can realize rapid response to emergency alarms and use a visual interface to intuitively display the security situation. Compared with manual supervision, the supervision efficiency is improved, while reducing the workload of security analysts.

[0018] 5. The model in this application provides multiple types of interfaces, including network, wireless, and industrial interfaces, which can support interfacing with third-party platforms, seamlessly integrate into existing network security systems, reduce system deployment costs, and have strong compatibility. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the system flow of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] like Figure 1 As shown, a network security monitoring system based on artificial intelligence technology includes a data acquisition layer, a data preprocessing layer, an artificial intelligence analysis layer, a security monitoring layer, and a dynamic optimization layer. The layers are electrically connected and communicate with external networks via Ethernet, including but not limited to general network devices, IoT terminals, and industrial control equipment.

[0022] The data acquisition layer is used to collect multi-dimensional cybersecurity data, including traffic data, log data, asset data, and threat intelligence data.

[0023] The data preprocessing layer is used to clean, standardize, and fuse the collected multi-dimensional data to output structured analysis data.

[0024] The AI ​​analysis layer incorporates a multimodal algorithm model for threat detection, anomaly identification, and source tracing analysis of structured analysis data.

[0025] The security supervisory layer can output results based on the artificial intelligence analysis layer, thereby realizing the display of security situation, alarm handling and the distribution of protection strategies.

[0026] The dynamic optimization layer can dynamically adjust the algorithm parameters of the artificial intelligence analysis layer based on historical monitoring data and new attack patterns to optimize model performance.

[0027] The data acquisition layer includes a traffic acquisition module, a log acquisition module, an asset acquisition module, and a threat intelligence acquisition module.

[0028] The traffic acquisition module uses deep packet inspection (DPI) technology. Through acquisition probes deployed on core network nodes, it collects traffic data of each layer of the TCP / IP protocol stack in real time. The traffic data includes source IP, destination IP, port number, packet size, transmission rate and protocol type, and the traffic data acquisition frequency is no less than 1000 packets / second. The log collection module collects the operation logs of network devices, servers and terminal devices through Syslog protocol, SNMP protocol or API interface. The operation logs include login logs, operation logs and error logs, and the log fields must include at least timestamp, device ID, operation type, event description and return code. The aforementioned data collection network equipment includes, but is not limited to, devices such as routers and switches; servers include, but are not limited to, web servers and database servers; and terminal devices include, but are not limited to, PCs and IoT sensors.

[0029] The asset acquisition module collects asset information in the network by combining active scanning (such as Nmap port scanning) and passive discovery (such as ARP cache analysis). The asset information includes asset IP address, MAC address, device type (server / terminal / IoT sensor), operating system version, running services, and open ports. The information collection period is configurable, and the configuration range can be controlled from 1 to 24 hours.

[0030] The threat intelligence collection module connects to a third-party threat intelligence platform to obtain the latest threat intelligence data in real time. The threat intelligence data includes malicious IP addresses, malicious domains, malicious hash values, vulnerability information, and attack organization information. The threat intelligence data is updated at a frequency of no less than once per hour.

[0031] The data preprocessing layer includes a data cleaning module, a data standardization module, and a data fusion module; The data cleaning module employs an outlier detection algorithm to identify and remove abnormal data from multi-dimensional data. Abnormal data includes duplicate data packets in traffic data, null fields in log data, and invalid IPs in asset data. The outlier removal rate is no less than 99%. The outlier detection algorithm can be either the Z-score algorithm or the isolated forest algorithm.

[0032] The data standardization module adopts the Min-Max standardization method, which can map data of different magnitudes to the [0,1] interval. The standardization formula for the transmission rate of traffic data is: Standardized rate = (Actual rate - Minimum rate) / (Maximum rate - Minimum rate). Then, the timestamps of log data are converted to Unix timestamp format. In addition, the device type of asset data is converted to vector form through One-Hot encoding.

[0033] The data fusion module adopts a multimodal data fusion algorithm based on an attention mechanism, which can integrate cleaned traffic data, log data, asset data and threat intelligence data into unified structured analysis data. During the multimodal data fusion process, key data can be highlighted by the attention weight allocation with a weight range of 0-1. The fused data is formatted as JSON and includes fields such as data type, timestamp, core features and associated ID.

[0034] The AI ​​analysis layer includes a threat detection model, an anomaly identification model, and a source tracing analysis model. These three models can work collaboratively through a model scheduler, as detailed below: The threat detection model employs a deep learning-based multi-classification model. It takes fused structured analysis data as input and outputs the threat type and threat confidence score. Threat types include DDoS attacks, SQL injection, malicious code, and brute-force attacks, with threat confidence scores ranging from 0 to 1. The deep learning model's network structure consists of an input layer, three convolutional layers, two pooling layers, one fully connected layer, and an output layer. The model training uses a cross-entropy loss function and the Adam optimizer. The learning rate is dynamically adjustable, with an initial learning rate of 0.001 that decays by 10% every 10 epochs. The input layer has a dimension equal to the number of features in the structured data; there are 3 convolutional layers, each with 64, 128, and 256 filters, and a kernel size of 3×3; 2 pooling layers, using max pooling, with a kernel size of 2×2; 1 fully connected layer with 128 neurons; and the output layer uses the Softmax activation function with a dimension of 4, corresponding to the 4 threat types.

[0035] The anomaly detection model uses the Isolation Forest algorithm based on unsupervised learning. It takes the transmission rate and packet size fluctuation in traffic data and the operation frequency in log data as input features to identify abnormal behaviors in the network, such as abnormal login, abnormal data transmission, and abnormal device offline. Then, it outputs the device ID, abnormal characteristics, and abnormal score of the abnormal behavior. The abnormal score ranges from 0 to 1. When the abnormal score is ≥0.8, it is judged as a high-risk anomaly. The Isolation Forest algorithm is configured with 100 trees, each tree has 256 samples, and the anomaly detection accuracy is no less than 95%. The source tracing analysis model is a knowledge graph-based model that includes an entity layer, a relation layer, and a reasoning layer, as detailed below: The entity layer contains four types of entities: IP address, device, vulnerability, and threat intelligence. Each entity contains a unique ID and attributes.

[0036] The relationship layer defines three types of relationships: attack initiation, existing vulnerabilities, and associated threat intelligence.

[0037] The inference layer uses rule-based inference algorithms (such as RDFS inference) and combines them with the output of the threat detection model to trace the propagation path of threats and generate a source tracing report. The report includes the attack source, intermediate nodes, affected devices, and related threat intelligence.

[0038] The model scheduler employs a priority scheduling strategy, with threat detection models having the highest priority for processing real-time traffic data; anomaly identification models have the second highest priority for processing periodic asset data; and source tracing analysis models have the lowest priority for processing confirmed threat data. The scheduling cycle does not exceed 1 second, ensuring that the model collaborative response latency is controlled within 500ms.

[0039] The security supervision layer includes a situation display module, an alarm handling module, and a protection strategy module. It can visualize the supervision effect through traffic situation maps, threat situation maps, and asset situation maps.

[0040] The protection strategy module can generate targeted protection strategies based on the source tracing report from the source tracing analysis model, as detailed below: Access control policies: For example, to prohibit malicious IPs from accessing core servers, ACL rules can be issued to the router.

[0041] Vulnerability remediation strategy: For devices with high-risk vulnerabilities, links to vulnerability remediation patches and remediation steps can be pushed out.

[0042] Traffic limiting policies: For example, for nodes that are subjected to DDoS attacks, configure traffic scrubbing rules to discard abnormal UDP traffic.

[0043] The above protection strategies support both manual review and automatic deployment, with a deployment success rate of no less than 98%.

[0044] The dynamic optimization layer includes a data storage module, a model evaluation module, and a parameter tuning module, as detailed below; The data storage module uses a distributed database to store historical regulatory data, which includes raw collected data, preprocessed structured data, artificial intelligence analysis results, and safety supervision records. The data storage time is configurable, with a configuration range of 1-365 days. In addition, it supports data backup and recovery functions, and the backup frequency can be set to once per day. The model evaluation module can periodically calculate the performance metrics of each model in the AI ​​analysis layer. These performance metrics include the accuracy, recall, and F1 score of the threat detection model. The F1 score is calculated as follows: 2 × accuracy × recall / (accuracy + recall). In addition, it also includes the precision of the anomaly identification model (number of accurately identified anomalies / total number of identified anomalies) and the source tracing accuracy of the source tracing analysis model (number of correctly traced threats / total number of source-traced threats). When any model's core metrics fall below the preset threshold for two consecutive evaluation periods, the model optimization process is triggered to optimize the model.

[0045] The parameter tuning module employs a reinforcement learning algorithm, using the performance metrics of the model evaluation module as reward signals to dynamically adjust the key parameters of each model, as detailed below: For threat detection models, the number of filters and learning rate of convolutional layers can be adjusted; for anomaly detection models, the number of trees and samples in isolated forests can be adjusted; for source tracing analysis models, the weights of inference rules in knowledge graphs can be adjusted; after parameter adjustments, the new model can be incrementally trained using historical data from the past 7 days to ensure that performance metrics are improved after model updates.

[0046] The network security monitoring system also includes a user interaction layer, which is electrically connected to the security monitoring layer to enable users to operate and configure the system.

[0047] The user interaction layer includes a role management module, a permission configuration module, and an operation log module, as detailed below: The role management module supports the creation of multiple user roles, such as system administrator, security analyst, and general viewer, and each role corresponds to a unique role ID and role description; The permission configuration module is based on the RBAC (role-based access control) model, which can assign corresponding operation permissions to different roles. The operation permission types include data collection configuration permissions, model parameter configuration permissions, alarm handling permissions, and report export permissions. The permission allocation is displayed using a "role-permission" mapping table, and supports batch authorization and single authorization.

[0048] The operation log module records all user operations, including operation time, user, operation type, operation content, and operation result. The operation log is immutable, supports querying by time range and operation type, and also supports exporting data in Excel format.

[0049] The network security monitoring system also includes an interface extension layer, which is electrically connected to both the data acquisition layer and the security monitoring layer to enable the system to interface with external devices / platforms, as detailed below: The interface extension layer includes a data acquisition interface module and an output interface module. The data acquisition interface module provides a variety of standardized data acquisition interfaces, as follows: Network interface: It adopts an RJ45 Ethernet interface to connect the acquisition probes of the network core node.

[0050] Wireless interfaces: Wi-Fi 802.11ac, LoRa, and NB-IoT interfaces are used to collect data from IoT terminals.

[0051] Industrial interfaces: Utilizing RS485, Modbus, and Profinet interfaces for data acquisition from industrial control equipment.

[0052] The above output interface module provides a variety of standardized output interfaces, as follows: Control interface: It adopts an API interface to distribute protection policies to external network devices.

[0053] Data interface: JSON-RPC interface and Kafka message queue interface are used to push regulatory data to third-party platforms.

[0054] Display interfaces: HDMI and VGA interfaces are used to connect external display devices to display the security status.

[0055] The hardware architecture of a network security monitoring system includes server clusters, data acquisition probes, storage devices, and display devices, as detailed below: The server cluster consists of more than three industrial-grade servers and uses load balancing technology to distribute processing tasks, ensuring that the processing latency remains within one second when the system receives 100,000 data entries per second. Data acquisition probes include network probes, terminal probes, and IoT probes, as detailed below: The aforementioned network probes support DPI (Deep Packet Inspection) and are deployed on the mirrored ports of the network core switch; the aforementioned terminal probes are installed in the lightweight acquisition software of the terminal device and support Windows / Linux / macOS systems; the aforementioned IoT probes include embedded devices that can support LoRa / NB-IoT communication.

[0056] The storage devices employ a distributed storage array and support RAID5 redundancy backup, while the display devices include a 27-inch high-definition monitor and a 55-inch video wall, enabling simultaneous display of security status across multiple screens.

[0057] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0058] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network security monitoring system based on artificial intelligence technology, characterized in that, It includes a data acquisition layer, a data preprocessing layer, an artificial intelligence analysis layer, a security monitoring layer, and a dynamic optimization layer, and each layer is electrically connected in sequence. The data acquisition layer is used to collect multi-dimensional network security data, which includes traffic data, log data, asset data, and threat intelligence data. The data preprocessing layer is used to clean, standardize, and fuse the collected multi-dimensional data, and finally output structured analysis data. The artificial intelligence analysis layer has a built-in multimodal algorithm model for threat detection, anomaly identification, and source tracing analysis of structured analysis data; The security monitoring layer is used to display the security situation, handle alarms, and distribute protection strategies based on the output results of the artificial intelligence analysis layer. The dynamic optimization layer can dynamically adjust the algorithm parameters of the artificial intelligence analysis layer based on historical monitoring data and new attack patterns, thereby optimizing model performance.

2. The network security monitoring system based on artificial intelligence technology according to claim 1, characterized in that, The data acquisition layer includes a traffic acquisition module, a log acquisition module, an asset acquisition module, and a threat intelligence acquisition module; The traffic acquisition module uses deep packet inspection technology to collect traffic data of each layer of the TCP / IP protocol stack in real time through acquisition probes deployed on core network nodes, with a acquisition frequency of no less than 1000 packets / second. The log collection module can collect the operation logs of network devices, servers and terminal devices through Syslog protocol, SNMP protocol or API interface, and the log fields include at least timestamp, device ID, operation type, event description and return code; The asset acquisition module collects asset information in the network through a combination of active scanning and passive discovery, including asset IP address, MAC address, device type, operating system version, running services, and open ports. The acquisition period can be configured to be 1-24 hours. The threat intelligence collection module connects to a third-party threat intelligence platform to obtain malicious IP addresses, malicious domains, malicious hash values, vulnerability information, and organizational information in real time, with a data update frequency of no less than once per hour.

3. The network security monitoring system based on artificial intelligence technology according to claim 2, characterized in that, The data preprocessing layer includes a data cleaning module, a data standardization module, and a data fusion module; The data cleaning module uses an outlier detection algorithm to identify and remove outlier data from multi-dimensional data. The data standardization module adopts the Min-Max standardization method, which can map data of different magnitudes to the [0,1] interval, and convert the timestamp of log data into Unix timestamp format, and convert the device type of asset data into vector form through One-Hot encoding; The data fusion module employs a multimodal data fusion algorithm based on an attention mechanism to fuse the cleaned multidimensional data into unified structured analysis data. The fused data is in JSON format and includes fields such as "data type", "time stamp", "core feature" and "association ID".

4. A network security monitoring system based on artificial intelligence technology according to claim 3, characterized in that, The artificial intelligence analysis layer includes a threat detection model, an anomaly recognition model, and a source tracing analysis model, and the threat detection model, anomaly recognition model, and source tracing analysis model work together through a model scheduler; The threat detection model is a multi-classification model built on deep learning. The network structure includes an input layer, three convolutional layers, two pooling layers, one fully connected layer, and an output layer. It can output the threat type and threat confidence level. The anomaly identification model uses the Isolation Forest algorithm based on unsupervised learning. It takes the transmission rate and data packet size fluctuation in traffic data and the operation frequency in log data as input features, and can output the device ID, anomaly features and anomaly score of the abnormal behavior. The source tracing analysis model is a knowledge graph-based model that includes an entity layer, a relationship layer, and a reasoning layer. It uses a rule-based reasoning algorithm to trace the propagation path of threats and generate a source tracing report. The model scheduler uses a priority scheduling strategy to reduce the response latency of model collaboration.

5. A network security monitoring system based on artificial intelligence technology according to claim 4, characterized in that, The security supervision layer includes a situation display module, an alarm handling module, and a protection strategy module; The situation display module uses computer vision technology to display the network security situation through traffic heatmaps, threat radar maps, and asset topology maps, with a data refresh rate of no less than 1 time per second. The alarm handling module can trigger alarms of different levels based on threat confidence and anomaly score. The alarm methods include SMS, email and system pop-up, and alarm escalation is supported. The alarm handling module has built-in automated handling scripts that can perform preset operations for emergency alarms. The protection strategy module can generate access control, vulnerability remediation, and traffic restriction policies based on the source tracing report, and supports both manual review and automatic distribution.

6. A network security monitoring system based on artificial intelligence technology according to claim 5, characterized in that, The dynamic optimization layer includes a data storage module, a model evaluation module, and a parameter adjustment module; The data storage module uses a distributed database to store historical monitoring data and supports data backup and recovery. The model evaluation module can periodically calculate the performance indicators of each model, including the accuracy, recall and F1 score of the threat detection model, the precision of the anomaly identification model, and the source tracing accuracy of the source tracing analysis model. When the core indicators of any model are lower than the preset threshold for two consecutive evaluation cycles, the model optimization process is triggered. The parameter adjustment module employs a reinforcement learning algorithm, which can dynamically adjust the key parameters of each model and update the model through incremental training to improve the model's performance metrics.

7. A network security monitoring system based on artificial intelligence technology according to claim 6, characterized in that, It also includes a user interaction layer, which is electrically connected to the security supervision layer. The interaction layer includes a role management module, a permission configuration module, and an operation log module. The role management module supports the creation of multiple user roles, including system administrator, security analyst, and general viewer. The permission configuration module can assign corresponding operation permissions to different roles based on the RBAC model, and also supports batch authorization and single authorization. The operation log module is used to record all user operations. The operation log is immutable and supports data export.

8. A network security monitoring system based on artificial intelligence technology according to claim 7, characterized in that, It also includes an interface extension layer, which is electrically connected to the data acquisition layer and the security monitoring layer respectively. The interface extension layer includes an acquisition interface module and an output interface module. The acquisition interface module provides an RJ45 Ethernet interface, a Wi-Fi 802.11ac interface, a LoRa interface, an NB-IoT interface, an RS485 interface, a Modbus interface, and a Profinet interface; The output interface module provides a RESTful API interface, a JSON-RPC interface, a Kafka message queue interface, an HDMI interface, and a VGA interface.

Images