Network security operation and maintenance automatic analysis response system based on artificial intelligence

Abstract

The invention relates to the technical field of network security, in particular to a network security operation and maintenance automatic analysis and response system based on artificial intelligence, which comprises an operation sensing module for acquiring a server state, extracting a security log, monitoring a network protocol and a transmission direction, identifying a performance bottleneck, sorting event data and generating a sensing summary sheet, the path offset identification module tracks a cross-domain path, identifies an abnormal path and generates an offset list; the behavior chain construction module sorts an event sequence and generates a behavior chain graph; the response processing module arranges processing steps, records a response process, generates an operation and maintenance execution sequence, synthesizes an output module to complete a process and generates an analysis result. According to the invention, by comparing the server resources with the historical reference, the abnormity is identified, and the event behavior basis is provided. And tracking cross-domain path lag and abnormity, and positioning threats. Arranging event data, and constructing an attack chain. The automatic response improves the speed and accuracy, shortens the response time, and enhances the attack handling capability.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, and in particular to an automatic analysis and response system for network security operation and maintenance based on artificial intelligence. BACKGROUND

[0002] Network security technology aims to protect data, systems and networks, and ensure their confidentiality, integrity and availability. Through prevention, detection, response and recovery, etc., it mainly includes malicious code detection, vulnerability scanning, intrusion identification, access control, encrypted transmission, etc. With the development of network architecture complexity and attack means, network security operation and maintenance gradually transforms to intelligence and automation, improving defense capability and operation and maintenance efficiency.

[0003] The automatic analysis and response system based on artificial intelligence identifies network behavior anomalies through machine learning models, classifies alarms in combination with semantic rules, and drives responses using policy matching. The system technology includes parsing network logs and communication data, using supervised learning to identify threats, applying natural language processing to analyze alarm texts, building event causal chains, and executing automatic responses such as isolating communication paths and adjusting policies through a rule base.

[0004] Existing technologies rely on manual or semi-automatic operations, resulting in slow response when facing rapidly changing attack patterns and lack of timely response capabilities. Attack path identification often stays at the single event level, making it difficult to fully track attack behavior chains. Due to insufficient event correlation analysis, it is difficult to fully understand cross-domain attack paths, and attack behavior lags and anomalies are also difficult to discover in a timely manner. In addition, operation and maintenance response relies on manual processing, and the response process lacks automation, making it difficult to efficiently handle complex security events, increasing the risk of human error and reducing defense efficiency. SUMMARY

[0005] The purpose of the present application is to solve the problems existing in the prior art, and an automatic analysis and response system for network security operation and maintenance based on artificial intelligence is proposed.

[0006] In order to achieve the above-mentioned purpose, the technical scheme adopted by the present application is as follows: the automatic analysis and response system for network security operation and maintenance based on artificial intelligence, the system comprises:

[0007] The operation perception module is used for collecting server running state and security log information, monitoring communication protocols and transmission directions in the network link and port activity, arranging information in chronological order, comparing system operation records during event triggering period, identifying access behaviors consistent with event occurrence process, and generating operation perception summary table;

[0008] A path deviation identification module is configured to track the response sequence of the start and end nodes of the cross-domain path according to the access information of the operation awareness summary table, record the node jump sequence and time distribution, identify the path segment with response lag and sequence anomaly, determine the deviation direction and position, mark the abnormal node and record the associated resources, and generate a path deviation identification list;

[0009] A behavior chain construction module is configured to extract the access behavior and operation step according to the path deviation identification list, sort the sequence of event occurrence, judge the trigger logic between behaviors, connect the related operation links to form a logical chain, and generate a behavior chain association graph;

[0010] A response handling module is configured to determine the link influence range and priority order according to the behavior chain association graph and the path deviation identification list, compile the handling steps and operation process, record the execution process and resource call, form a systematic task link, and generate an operation and maintenance response execution sequence;

[0011] A comprehensive output module is configured to integrate the execution process and recovery state of the handling link according to the record content of the operation and maintenance response execution sequence, compare the operation states before and after the event, sort the detection and response process, integrate the path, behavior and handling information, and generate a network security operation and maintenance comprehensive analysis result.

[0012] As a further scheme of the present application,

[0013] The operation awareness module result is specifically CPU utilization, memory occupancy, port activity, event trigger period, system operation comparison, and access behavior;

[0014] The path deviation identification module result includes cross-domain path response, node jump sequence, path segment lag, sequence anomaly, deviation direction, abnormal node marking, and associated resources.

[0015] The behavior chain construction module result includes access behavior and operation link, event sequence, behavior trigger dependency, operation link correlation, and event logic chain.

[0016] The response handling module result includes link influence range, priority order, handling step, operation process, execution step, resource call, and task link.

[0017] The comprehensive output module result includes handling execution process, recovery state, system operation comparison, detection and handling process, path behavior response information, and network security operation and maintenance comprehensive analysis.

[0018] As a further scheme of the present application, the operation awareness module includes:

[0019] The system monitoring submodule obtains CPU utilization, memory occupation and port activity state of the server, compares the obtained data with a benchmark value set based on historical running data, identifies potential system resource bottlenecks, uses the identification result as a reference basis for subsequent security event analysis and behavior chain construction, and generates a system resource occupation report;

[0020] The data integration submodule integrates each monitoring index with log information according to data in the system resource occupation report, arranges and archives in chronological order, extracts key event information in the log, and compares with system operation records to generate an event trigger time data set;

[0021] The security event analysis submodule compares system operation records with security device logs according to the event trigger time data set, identifies access behaviors consistent with the event occurrence process, combines communication protocols and transmission directions in the network link to generate a running awareness summary table.

[0022] As a further scheme of the application, the path offset identification module comprises:

[0023] The path tracking submodule obtains the starting point and the ending point of the cross-domain path according to the access information in the running awareness summary table, tracks the jump order and time interval of the path, records the response of each node, and generates a node jump record;

[0024] The node response analysis submodule analyzes the response and time interval of each node according to the node jump record, identifies path segments with abnormal response lag or order, marks abnormal nodes, records relevant resource information, and generates a node response analysis report;

[0025] The offset identification submodule determines the direction and position of the path offset according to the node response analysis report, marks the nodes with offset, records associated resources, and generates a path offset identification list.

[0026] As a further scheme of the application, the behavior chain construction module comprises:

[0027] The behavior extraction submodule extracts relevant access behaviors and operation links according to the node record in the path offset identification list, records the trigger relationship between each behavior, and generates an access behavior record;

[0028] The sequence combing submodule combs the sequence before and after the event occurrence according to the access behavior record, analyzes and marks the dependency relationship between behaviors, and generates event sequence data;

[0029] The logic chain construction submodule links operation links with relevance one by one according to the event sequence data, constructs a logic chain of events, and generates a behavior chain correlation map.

[0030] As a further scheme of the present application, the response processing module comprises:

[0031] The impact evaluation submodule evaluates the impact range and priority of each link according to the key information in the behavior chain association graph and path deviation identification list, determines high-priority links, and generates link impact evaluation results;

[0032] The processing step arrangement submodule arranges the processing steps and operation processes of each link according to the link impact evaluation results, records the execution steps and resource usage of each operation link, and generates a processing operation process;

[0033] The task link generation submodule forms a task link by sequentially connecting each step based on the processing operation process, records the execution during the entire operation process, and generates an operation and maintenance response execution sequence.

[0034] As a further scheme of the present application, the comprehensive output module comprises:

[0035] The execution process integration submodule integrates the execution process and recovery state of each processing link according to the records in the operation and maintenance response execution sequence, sorts the operation steps and resource usage during the response process, and generates a processing execution process record;

[0036] The system comparison submodule compares the running states of the system before and after the event based on the processing execution process record, analyzes the changes in the system state caused by each link, and generates system state comparison data;

[0037] The comprehensive analysis submodule integrates various types of data according to the system state comparison data in combination with path, behavior, and response information, and generates a network security operation and maintenance comprehensive analysis result.

[0038] Compared with the prior art, the present application has the following advantages and positive effects:

[0039] In the present application, the performance bottleneck and abnormal behavior are identified in a timely manner by dynamically comparing the server resource state with the historical benchmark, and the access behavior during the event triggering period is provided with a basis. Tracking the response lag and sequence anomaly in the cross-domain path helps to discover changes in the attack path and timely locate potential threats. By sorting event data and comparison, each operation link is traced back, an attack behavior chain is constructed, and key steps are ensured not to be missed. The automated response process reduces manual intervention, improves response speed and accuracy. The overall processing logic shortens the response time when dealing with complex attacks, and enhances the tracking and processing capacity for multi-dimensional attack chains. BRIEF DESCRIPTION OF DRAWINGS

[0040] Figure 1 The method flowchart of the present application;

[0041] Figure 2 The acquisition flowchart of the operation perception module of the present application is shown in the figure;

[0042] Figure 3 The acquisition flowchart of the path deviation identification module of the present application is shown in the figure;

[0043] Figure 4 The acquisition flowchart of the behavior chain construction module of the present application is shown in the figure;

[0044] Figure 5 The acquisition flowchart of the response handling module of the present application is shown in the figure;

[0045] Figure 6 The acquisition flowchart of the network security operation and maintenance comprehensive analysis result of the present application is shown in the figure. DETAILED DESCRIPTION

[0046] The technical solutions in the present application will be described below in conjunction with the accompanying drawings.

[0047] In the embodiments of the present application, sometimes the subscript such as W1 may be written in the form of non-subscript such as W1, and the meanings expressed thereby are consistent when the difference is not emphasized.

[0048] To make the technical problems, technical solutions and advantages to be solved by the present application more clear, the following will be described in detail in conjunction with the accompanying drawings and specific embodiments.

[0049] Please refer to Figure 1 The present application provides a technical solution: an automatic analysis and response system for network security operation and maintenance based on artificial intelligence, which comprises:

[0050] An operation perception module is used to acquire server operation state information including CPU utilization, memory occupancy and port activity, extract security device logs and operation records, monitor communication protocols and transmission directions in network links, and dynamically compare the collected system resource states with historical performance benchmarks to identify performance bottlenecks or resource abnormalities as the basis for subsequent log integration and behavior identification. The module sorts various data in chronological order, compares system operations during event triggering periods, identifies access behaviors consistent with event occurrence processes, and generates an operation perception summary table.

[0051] A path deviation identification module is used to track the starting point and end point responses of cross-domain paths according to the access information in the operation perception summary table, record the node jump order and time interval, identify path segments with response lag or sequence abnormalities, determine the deviation direction and location, label abnormal nodes and record associated resources, and generate a path deviation identification list.

[0052] The behavior chain construction module extracts relevant access behaviors and operation links according to the node records in the path offset identification list, sorts the sequence of event occurrence, identifies the triggering and dependency relationship between behaviors, links the operation links with relevance one by one, forms the logical chain of the event, and generates the behavior chain association graph;

[0053] The response processing module determines the influence range and priority order of each link according to the key information of the behavior chain association graph and the path offset identification list, arranges the processing steps and operation processes, records the execution steps and resource calling situation in the response process, forms the systematic task link, and generates the operation and maintenance response execution sequence;

[0054] The comprehensive output module integrates the execution process and recovery state of each processing link according to the record content in the operation and maintenance response execution sequence, compares the system operation before and after the event, sorts out the complete process of detection, identification and processing, integrates the information of path, behavior and response, and generates the network security operation and maintenance comprehensive analysis result.

[0055] The running perception module result is specifically CPU utilization, memory occupancy, port activity, event triggering period, system operation comparison, access behavior, the path offset identification module result includes cross-domain path response, node jump order, path segment lag, sequence anomaly, offset direction, abnormal node annotation, associated resources, the behavior chain construction module result includes access behavior and operation link, event sequence, behavior triggering dependency relationship, operation link relevance, event logical chain, the response processing module result includes link influence range, priority order, processing step, operation process, execution step, resource calling, task link, and the comprehensive output module result includes processing execution process, recovery state, system operation comparison, detection, identification and processing process, path behavior response information, network security operation and maintenance comprehensive analysis.

[0056] Please refer to Figure 2 , the running perception module includes:

[0057] The system monitoring submodule obtains the CPU utilization, memory occupancy and port activity state of the server, compares the obtained data with the benchmark value set based on the historical running data, identifies the potential system resource bottleneck, and uses the identification result as a reference basis for subsequent security event analysis and behavior chain construction, and generates a system resource occupancy report;

[0058] The central processor utilization, memory occupancy and port activity status of host A are obtained. The central processor utilization data sequence and the memory occupancy data sequence are obtained at 12 consecutive monitoring points. The obtained central processor utilization sequence is [80.5, 81.2, 80.9, 82.0, 95.1, 95.5, 96.0, 95.8, 95.3, 85.0, 84.5, 83.0], and the obtained memory occupancy sequence is [70.1, 70.3, 70.0, 70.5, 71.0, 71.2, 71.3, 71.5, 71.4, 70.8, 70.6, 70.2]. The current port activity status is obtained at the end of the monitoring window, that is, the connection number of port 80 is 510, the connection number of port 443 is 305, and the connection number of port 22 is 3. The monitoring data of host A in the same period in the previous 7 working cycles is called from the historical operation database. The historical central processor utilization data set is sorted and processed, and the value corresponding to the 95th percentile is selected. It is calculated that 90.0% is the central processor reference value. The historical memory occupancy data set is sorted and processed, and the value corresponding to the 95th percentile is selected. It is calculated that 75.0% is the memory reference value. The historical port 80 connection number data set is sorted and processed, and the value corresponding to the 95th percentile is selected. It is calculated that 500 is the port 80 reference value. The historical port 443 connection number data set is sorted and processed, and the value corresponding to the 95th percentile is selected. It is calculated that 300 is the port 443 reference value. The historical port 22 connection number data set is sorted and processed, and the value corresponding to the 95th percentile is selected. It is calculated that 2 is the port 22 reference value. The current 12 monitoring points of the central processor utilization [80.5, 81.2, 80.9, 82.0, 95.1, 95.5, 96.0, 95.8, 95.3, 85.0, 84.5, 83.0] are compared with the central processor reference value 90.0% one by one. At the same time, the 12 monitoring points of the memory occupancy [70.1, 70.3, 70.0, 70.5, 71.0, 71.2, 71.3, 71.5, 71.4, 70.8, 70.6, 70.2] are compared with the memory reference value 75.0% one by one. The current port connection number (port 80: 510, port 443: 305, port 22: 3) is compared with the corresponding port reference value (port 80: 500, port 443: 300, port 22: 2). A continuous monitoring point threshold that continuously exceeds the reference value is set to 3. The comparison result of the central processor utilization is determined. It is found that the continuous 5 monitoring values (95.1%, 95.5%, 96.0%, 95.8%, 95.3%) are all greater than the CPU reference value 90.0%, and it is determined that the number of continuous monitoring points 5 is greater than the threshold value 3 of continuous monitoring points, according to which it is determined that the central processor resource of the host A exists bottleneck, the comparison result of the memory occupancy rate is determined, all 12 monitoring values are less than the memory reference value 75.0%, according to which it is determined that the memory resource does not appear bottleneck, the comparison result of the port activity state is determined, the connection number 510 of port 80 is greater than the reference value 500, the connection number 305 of port 443 is greater than the reference value 300, and the connection number 3 of port 22 is greater than the reference value 2, the states of the central processor, port 80, port 443 and port 22 are all identified as abnormal, and the host resource occupancy report is generated.

[0059] The data integration sub-module integrates each monitoring index with the log information according to the data in the system resource occupancy report, arranges and archives in time sequence, extracts the key event information in the log, and compares with the system operation record to generate an event trigger time data set.

[0060] The system resource occupancy report indicates that the CPU resource bottleneck appears at the time stamp 2025-10-1622:00:05, around this time point, each monitoring index is integrated with the server system log, database access log and Web application log in the same period (22:00:00 to 22:00:15) in time sequence and ascending order, forming a unified data stream, analyzing this data stream to dig out the key associated events: at 22:00:03, the Web application log records a login failure event (ID:WEB-FAIL-002) from IP address 203.0.113.5, at 22:00:04, the database access log records an error with the content "SQLSTATE

[42000] :Syntax error or access violation" (ID:DB-ERR-001), the system administrator operation record in the same period is checked, and no planned maintenance or change operation is confirmed, so that the application layer login failure, data layer syntax error and server resource depletion (CPU utilization rate 92%, port 80 connection number 512) are directly associated, and the event trigger time data set is generated.

[0061] The security event analysis sub-module compares the system operation record with the security device log according to the event trigger time data set, identifies the access behavior consistent with the event occurrence process, combines the communication protocol and transmission direction in the network link, and generates a running perception summary table.

[0062] According to the source IP 203.0.113.5 and the login failure time 22:00:03 recorded in the event trigger time data set, the firewall (model: H3CSecPathF5000) log of the network boundary is queried back, and all network sessions initiated from the source IP to the server 192.168.1.100 destination port 80 within the time window of 22:00:02 to 22:00:04 are screened out. In the results, an HTTP POST request with a URL of / login.php is locked, and the string 'or'1'='1'-- contained in the request body is identified as a SQL injection attack payload. The behavior is completely consistent with the SQL syntax error (ID: DB-ERR-001) recorded in the database log, and the network link monitoring data also confirms that the protocol of this communication is HTTP, and the transmission direction is from the external network to the internal server. Based on the above analysis, this access behavior is determined as the core behavior that causes the security event. The time, source / destination IP, communication protocol, key behavior (SQL injection), associated system events (login failure, SQL error), and resulting resource impact (CPU utilization of 92%) are integrated to generate a running perception summary table.

[0063] Please refer to Figure 3 , the path offset identification module comprises:

[0064] The path tracking submodule obtains the starting point and the ending point of the cross-domain path according to the access information in the running perception summary table, traces the jump sequence and time interval of the path, records the response of each node, and generates a node jump record;

[0065] The access information in the running perception summary table is analyzed, and the cross-domain path from the starting point IP 203.0.113.5 to the ending point IP 192.168.1.100 is reconstructed, and the jump sequence is restored as: node 1 (203.0.113.5, starting point) -> node 2 (203.0.113.1, gateway) -> node 3 (198.51.100.1, backbone router) -> node 4 (209.165.201.1, boundary firewall) -> node 5 (192.168.1.100, web server). By calculating the time stamp difference between the request and the response, the jump time interval of each segment is measured as 2ms, 15ms and 5ms respectively, but the interval time of one segment (node 4 to node 5) reaches 1500ms, and the ending node 5 returns an HTTP 500 (Internal Server Error) status code, while the response status of all intermediate nodes is normal. This series of structured data including node IP, role, jump sequence, time interval and response status jointly constitutes the node jump record.

[0066] The node response analysis submodule analyzes the response of each node and the time interval according to the node jump record, identifies the path segment with response lag or sequence anomaly, marks the abnormal node, records the relevant resource information, and generates a node response analysis report.

[0067] The analysis core of the node jump record is to compare the actual response time of each node with the dynamically set reference value. The reference value of each node is determined by the arithmetic mean of the response time of mass normal requests in the past 30 working days (9:00-17:00) of the business stable period and three standard deviations , for example, the reference value of the Web server (node 5) is 25 milliseconds , and the reference values of other intermediate nodes are 5 milliseconds, 20 milliseconds and 10 milliseconds respectively. The analysis shows that the actual response time of node 5 is 1500 milliseconds, which is much higher than its reference value of 25 milliseconds, belonging to response lag (judgment interval is [reference value, +∞)), combined with its returned "HTTP500" status code (which does not match the "HTTP200" status code that should be returned for normal business), it constitutes a sequence anomaly, therefore, node 5 (IP: 192.168.1.100) is marked as an abnormal node, and is associated with the httpd service process (process ID 12345) that is consuming 92% CPU resources and the / login.php script file that the process is executing. The above analysis results form the node response analysis report.

[0068] The offset identification submodule determines the direction and location of the path offset according to the node response analysis report, marks the node where the offset occurs, records the associated resources, and generates a path offset identification list.

[0069] The conclusion in the node response analysis report accurately points out the position of the path deviation to the application layer of the Web server, revealing the deviation direction: a normal user authentication request path is affected by the SQL injection payload and does not terminate within the application, but is illegally diverted to an abnormal query to the internal database (IP: 192.168.1.101), causing the application to crash and return an HTTP 500 error. Node 5 (IP: 192.168.1.100) where the deviation occurred is therefore marked, and all resources associated with it are recorded in detail: the affected application is the user authentication module on host WEB-SRV-01, the deviation trigger file is / login.php, and the direct cause of the deviation is the 'or'1'='1'-- string contained in the HTTP POST request from IP 203.0.113.5. This deviation behavior directly triggers a SQL syntax error event (ID: DB-ERR-001) on the database server and causes CPU resource exhaustion of the httpd service process (process ID 12345) of the deviation node itself. The integration of these information generates the path deviation identification list.

[0070] Referring to Figure 4 The behavior chain construction module includes:

[0071] The behavior extraction submodule extracts relevant access behaviors and operation links according to the node records in the path deviation identification list, records the triggering relationship between each behavior, and generates access behavior records;

[0072] The analysis of the abnormal node (IP: 192.168.1.100) in the path deviation identification list refines a causal chain composed of four key operation links: link A (22:00:03), the SQL injection payload 'or'1'='1'-- contained in the HTTP POST request from IP 203.0.113.5, is confirmed as directly triggering link B (22:00:04), i.e., the Web server performs an abnormal SQL query, and this abnormal query execution directly leads to the occurrence of link C (22:00:05) - the CPU utilization of the Web server rises to 92%, and this resource bottleneck state triggers link D (22:00:05.500), the server returns an HTTP 500 error response. This series of access behaviors, operation links, and their confirmed triggering relationships collectively constitute the access behavior records.

[0073] The sequential combing submodule combs the sequence of events according to the access behavior records, analyzes and marks the dependency relationship between behaviors, and generates event sequence data;

[0074] According to the accurate time stamp in the access behavior records, the occurrence sequence of events is determined as A B C D, to further quantify the correlation between each link, the system analyzes their dependency relationship, the judgment of the dependency relationship combines the two dimensions of causal correlation and time closeness, the time closeness is determined by comparing the time interval of adjacent behaviors with a preset time dependence threshold (1000 milliseconds), which is set based on the normal average response time of 50 milliseconds of the server and combined with security experience, calculation shows that the time interval of A to B, B to C is 1000 milliseconds, and the interval of C to D is 500 milliseconds, all intervals do not exceed the preset threshold, so it is determined that there is a strong dependency relationship between them, and the closeness in time also confirms the causal trigger chain determined in the previous step, the generated event sequence data accurately describes the evolution sequence and internal dependency structure of the event.

[0075] The logical chain construction submodule connects the operation links with correlation one by one according to the event sequence data, constructs the logical chain of the event, and generates the behavior chain association graph.

[0076] Based on the sequence of A B C D and strong dependency relationship determined by the event sequence data, the complete logical chain of the event is constructed, which connects each operation link node through directed edges, and each node is given a qualitative description: link A is characterized as "intrusion behavior", link B is "internal diffusion", link C is "resource impact", and link D is "representation". Each connection edge represents a strong causal relationship of dependence, and the logical path clearly shows the complete process of the event from external attack input to internal resource damage, and then to system abnormal response: intrusion behavior (A) internal diffusion (B) resource impact (C) representation (D), this logical chain is solidified and output in the form of a graph, generating a behavior chain association graph.

[0077] Please refer to Figure 5 , the response handling module includes:

[0078] The impact assessment submodule assesses the impact range and priority order of each link according to the key information in the behavior chain association graph and the path deviation identification list, determines the high priority link, and generates the link impact assessment result;

[0079] The system generates the event sequence (A B C D) and the path offset identification list of associated resources, the influence range and disposal priority of each link are deeply evaluated, and the preset influence level table is called in the evaluation process to quantitatively assign the threat level of each link: link C (CPU exception) is rated as the highest level because it causes core business resource depletion ( ), link A (external request) and link B (abnormal SQL) are rated as high because they are directly related to attack behavior and data layer errors ( ), and link D (HTTP500) is the lowest threat level as a user-side representation ( ). Combined with the core business level (5 levels) and service availability index of the Web server S1 ( ), the resource weight is calculated as , which reflects the impact of each thousand requests when the core server service is unavailable. The comprehensive impact score of each link is calculated by the formula , , , , . By comparing the scores of all links, the highest score 4.0 corresponds to link C, so link C is clearly determined as the highest priority disposal link, followed by A and B, and D is the lowest, forming the link impact evaluation result.

[0080] The disposal step arrangement submodule arranges the disposal steps and operation processes of each link according to the link impact evaluation result, records the execution steps and resource usage of each operation link, and generates the disposal operation process;

[0081] According to the highest priority link (link C, CPU exception) and its associated resources (IP: 192.168.1.100, httpd process ID 12345) determined in the link impact evaluation result, the arrangement of the disposal steps strictly follows the risk minimization and source blocking principle. The first step P1 (isolating resources) is aimed at the highest priority C, and immediately calls the API of the network boundary firewall (H3C SecPathF5000) to perform the operation denysource 203.0.113.5 to destination 192.168.1.100 port 80, realizing the rapid blocking of external attack traffic. For the next high priority A and B, the arrangement step P2 (restoring resources) is to connect the web server through SSH and execute the kill-912345 command to terminate the high CPU occupancy httpd process and restart the service immediately. At the same time, the arrangement step P3 (repairing source) is to conduct code audit and repair on the affected / login.php file, completely repair the SQL injection vulnerability through strict type checking and parameterized query transformation. For the lowest priority D, the arrangement step P4 (cleaning up the representation) is to delete the abnormal log files on the server and clean up the browser cache. These P1 to P4 disposal steps, their specific operation processes, and the use of resources in the operation (P1 occupies firewall configuration resources, P2 occupies web server CPU / memory resources) are recorded to generate the disposal operation process.

[0082] The task link generation submodule generates a task link by sequentially connecting each step based on the disposal operation process, records the execution situation in all operation processes, and generates the operation and maintenance response execution sequence.

[0083] Based on the P1 to P4 steps arranged in the disposal operation process, the system sequentially connects them according to the priority and internal logical order to form a complete task link: P1 (block) P2 (restore) P3 (repair) P4 (clean up), this link clearly divides into the emergency response stage of P1 and P2 and the root cause management stage of P3 and P4. During the execution of the task link, the execution situation of each step is recorded in real time, for example, the execution result of P1 is recorded as "firewall rule added successfully, traffic blocked", the execution result of P2 is "httpd process terminated and restarted successfully, CPU utilization reduced to 15%", the execution result of P3 is " / login.php code repair and deployment completed", and the execution result of P4 is "abnormal log cleared". These execution results, timestamps, and executors are structured and integrated to form a traceable operation and maintenance response execution sequence.

[0084] Please refer to Figure 6 , the comprehensive output module includes:

[0085] The execution process integration submodule integrates the execution process and recovery status of each treatment link according to the records in the operation and maintenance response execution sequence, sorts the operation steps and resource usage in the response process, and generates a treatment execution process record;

[0086] The system forms a treatment execution process record by integrating the records of the operation and maintenance response execution sequence, which details the complete operation chain from P1 (isolation) to P4 (clean-up): the isolation operation (P1) starting at 22:00:06, whose successful result of "traffic blocking" is recorded together with the update of the firewall configuration table; the recovery operation (P2) performed at 22:00:10, whose result of "httpd process restart success" is directly associated with the state recovery of CPU utilization dropping to 15%, and records the instantaneous CPU peak of 0.5% and the memory release of 200MB; the repair operation (P3) completed at 22:05:00, whose result of "code repair completion" corresponds to the state of "SQL injection vulnerability removal", and is associated with an update of the version control system; the clean-up operation (P4) at 22:05:30, with the result of "abnormal log clean-up", marks the system environment returning to normal, and records the space release of the log file system.

[0087] The system comparison submodule compares the running status of the system before and after the event based on the treatment execution process record, analyzes the changes of the system status at each link, and generates system status comparison data;

[0088] To quantify the treatment effect, the system compares and analyzes the running benchmark one hour before the event and the recovery status after the treatment is completed, and this analysis focuses on three core indicators. The benchmark data (average response time milliseconds, CPU utilization , database error log times / minute) before the event and the recovery data (average response time milliseconds, , times / minute) after the treatment are directly compared, the change rates are calculated, the response time is increased by 10%, the CPU utilization is increased by 50%, and the database error log is unchanged. These change rates are weighed against a 20% recovery benchmark threshold set based on operation and maintenance experience, the response time is determined to be "normal recovery", the CPU utilization is determined to be "insufficient recovery", and the database error is determined to be "complete recovery". These quantitative comparison results constitute the system status comparison data.

[0089] The comprehensive analysis submodule integrates various data according to the system status comparison data, combined with the path, behavior and response information, and generates a network security operation and maintenance comprehensive analysis result.

[0090] The system integrates multi-source information, deeply analyzes and judges the conclusion of "CPU utilization recovery deficiency", identifies the path offset recognition list (indicates that SQL injection is the inducement) and the behavior chain association graph (reveals the complete attack chain) through cross comparison, analyzes and determines that 15% of CPU occupancy is not attack residue, but normal recovery overhead caused by background tasks (such as log cleaning and memory arrangement) after service restart, and comprehensively analyzes all data, the system concludes that an intrusion behavior (A) initiated by an external IP, triggers internal diffusion (B) through application layer path offset (SQL injection), further causes core resource impact (C) and business representation abnormality (D), the subsequent emergency disposal (P1, P2) effectively blocks the traffic and restores the service function, and the root governance (P3) eliminates the vulnerability, in addition to the CPU recovery overhead, all core indicators of the system are restored to within the normal threshold, this series of analysis completely associates the input, process and result of the attack and response, and generates a network security operation and maintenance comprehensive analysis result.

[0091] The above merely illustrates the specific embodiments of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. An AI-based automated analysis and response system for network security operations and maintenance, characterized in that: The system includes: The operation awareness module is used to collect server operation status and security log information, monitor communication protocols and transmission directions in network links and port activity, organize information in chronological order, compare system operation records during the event trigger period, identify access behaviors that match the event occurrence process, and generate an operation awareness summary table. The path offset identification module is used to track the response order of the start and end nodes of the cross-domain path based on the access information in the running perception summary table, record the node jump order and time distribution, identify path segments with delayed response and abnormal order, determine the offset direction and position, mark abnormal nodes and record associated resources, and generate a path offset identification list. The behavior chain construction module is used to extract access behaviors and operation steps based on the path offset identification list, sort out the sequence of events, determine the triggering logic between behaviors, connect related operation links to form a logical chain, and generate a behavior chain association graph. The response and handling module is used to determine the scope and priority of the impact of each link based on the behavior chain association map and the path offset identification list, arrange the handling steps and operation process, record the execution process and resource calls, form a systematic task link, and generate an operation and maintenance response execution sequence.

2. The AI-based automated analysis and response system for network security operation and maintenance as described in claim 1, characterized in that, The operation awareness module includes: The system monitoring submodule acquires the server's CPU utilization, memory usage, and port activity status, compares the acquired data with baseline values ​​set based on historical operating data, identifies potential system resource bottlenecks, and uses the identification results as a reference for subsequent security incident analysis and behavior chain construction, generating a system resource usage report. The data integration submodule integrates various monitoring indicators and log information based on the data in the system resource usage report, organizes and archives them in chronological order, extracts key event information from the logs, compares them with system operation records, and generates an event trigger time dataset. The security incident analysis submodule compares system operation records with security device logs based on the event trigger time dataset, identifies access behaviors that match the event occurrence process, and generates an operation awareness summary table by combining the communication protocols and transmission directions in the network link.

3. The AI-based automated analysis and response system for network security operation and maintenance as described in claim 1, characterized in that, The path offset identification module includes: The path tracing submodule obtains the start and end points of the cross-domain path based on the access information in the runtime awareness summary table, tracks the jump order and time interval of the path, records the response status of each node, and generates node jump records. The node response analysis submodule analyzes the response status and time interval of each node based on the node jump record, identifies path segments with delayed response or abnormal sequence, marks abnormal nodes, records relevant resource information, and generates a node response analysis report. The offset identification submodule determines the direction and location of the path offset based on the node response analysis report, marks the node that has offset, records the associated resources, and generates a path offset identification list.

4. The AI-based automated analysis and response system for network security operation and maintenance as described in claim 1, characterized in that, The behavior chain construction module includes: The behavior extraction submodule extracts relevant access behaviors and operation steps based on the node records in the path offset identification list, records the triggering relationship between each behavior, and generates access behavior records. The sequence sorting submodule sorts out the order of events based on the access behavior records, analyzes and marks the dependencies between behaviors, and generates event sequence data. The logic chain construction submodule connects related operation steps one by one according to the event sequence data to construct the logical chain of events and generate a behavior chain association graph.

5. The AI-based automated analysis and response system for network security operation and maintenance according to claim 1, characterized in that, The response handling module includes: The impact assessment submodule assesses the impact range and priority of each link based on the key information in the behavior chain association map and path offset identification list, determines the high-priority links, and generates the link impact assessment results. The disposal step arrangement submodule arranges the disposal steps and operation procedures for each stage based on the impact assessment results of the aforementioned stages, records the execution steps and resource usage of each operation stage, and generates the disposal operation procedure. The task link generation submodule, based on the aforementioned handling operation process, sequentially connects each step to form a task link, records the execution status of all operations, and generates an operation and maintenance response execution sequence.

6. The AI-based automated analysis and response system for network security operation and maintenance according to claim 1, characterized in that, Also includes: The comprehensive output module is used to compile the execution process and recovery status of the handling steps based on the recorded content of the operation and maintenance response execution sequence, compare the running status before and after the event, sort out the detection and response process, integrate path, behavior and handling information, and generate comprehensive network security operation and maintenance analysis results.

7. The AI-based automated analysis and response system for network security operation and maintenance according to claim 6, characterized in that, The integrated output module includes: The execution process integration submodule integrates the execution process and recovery status of each handling stage based on the records in the operation and maintenance response execution sequence, organizes the operation steps and resource usage in the response process, and generates a handling execution process record; The system comparison submodule, based on the records of the disposal execution process, compares the operating status of the system before and after the event, analyzes the changes in the system status of each link, and generates system status comparison data. The comprehensive analysis submodule integrates various types of data based on the system status comparison data, combined with path, behavior and response information, to generate comprehensive network security operation and maintenance analysis results.

Images