AI-based multi-dimensional network attack tracing and early warning system
The AI-based multi-dimensional network attack tracing and early warning system enables the fusion and intelligent analysis of multi-source data, solving the problems of low tracing efficiency and poor accuracy in existing technologies and improving network security defense capabilities.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGZHOU SIYUN DATA TECH CO LTD
- Filing Date
- 2026-01-26
- Publication Date
- 2026-07-03
Smart Images
Figure CN121585467B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of cybersecurity technology, and in particular to an AI-based multi-dimensional network attack tracing and early warning system. Background Technology
[0002] With the rapid development of Internet technology, network attack methods have become more diversified, covert, and large-scale. From traditional DDoS attacks and SQL injection to new supply chain attacks and APT (Advanced Persistent Threat) attacks, the attack forms are constantly evolving, posing a severe challenge to the network security protection system.
[0003] Existing network attack tracing and early warning technologies have the following shortcomings: First, the data collection dimensions are limited, mostly focusing only on network traffic data or device log data, ignoring the correlation between threat intelligence data and user behavior data, resulting in incomplete attack feature extraction and a high risk of missed or false positives; Second, the analysis methods lack intelligent and multi-dimensional integration capabilities, and cannot effectively construct attack propagation paths, leading to low tracing efficiency and poor accuracy; Third, there is a lack of intuitive visualization, making it difficult for users to quickly understand the tracing process, which is detrimental to subsequent decision-making.
[0004] To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention
[0005] The purpose of this invention is to provide an AI-based multi-dimensional network attack tracing and early warning system to address the aforementioned technical deficiencies. This invention achieves accurate tracing and efficient early warning of network attacks through multi-source data fusion and collection, AI intelligent analysis, and early warning defense, thereby enhancing network security protection capabilities.
[0006] The objective of this invention can be achieved through the following technical solution: an AI-based multi-dimensional network attack tracing and early warning system, comprising a network security management center, a multi-source data acquisition module, an AI multi-dimensional analysis module, a defense matching module, and an early warning operation module;
[0007] The multi-source data acquisition module collects multi-dimensional data from the network environment, cleans and standardizes the collected raw multi-dimensional data, extracts attack-related features, generates a standardized feature dataset, and sends the standardized feature dataset to the network security management center for storage.
[0008] Based on a standardized feature dataset, an AI multi-dimensional analysis module is used to analyze network attacks. This AI multi-dimensional analysis module includes an attack identification submodule, a path reconstruction submodule, and a source location submodule. The specific steps are as follows:
[0009] The attack identification submodule is used to perform attack identification and attack segmentation analysis on the standardized feature dataset, and outputs low-intensity, medium-intensity, or high-intensity attacks.
[0010] The path reconstruction submodule constructs an attack propagation graph based on the association information between the attack identification results and the standardized feature dataset;
[0011] The source location submodule is used to perform attack source location feedback analysis on the attack propagation graph to obtain the attack source node;
[0012] The defense matching module is used to analyze the attack intensity value of the attack source node to classify the defense risk and obtain low-risk, medium-risk, and high-risk signals.
[0013] Preferably, the analysis process of the attack identification submodule is as follows:
[0014] Input the standardized feature dataset into a pre-set fusion model, and the model will output the attack type.
[0015] The number of attack types is obtained, and the number of attack types is processed to determine whether it is a single attack state or a mixed attack state.
[0016] Preferably, in a single attack state:
[0017] Based on the attack type, obtain the core characteristics of each attack type;
[0018] Each core attack feature in the attack type is mapped to the [0,1] interval through Min-Max normalization, and the core attack features in the attack type are labeled as Ti, where i is a natural number greater than zero;
[0019] Obtain the preset weight coefficient ai corresponding to each core attack feature Ti in the attack type, and calculate the attack strength value based on the core attack feature Ti and the preset weight coefficient ai.
[0020] Preset thresholds for obtaining attack strength values: GJmin and GJmax, 0 < GJmin < GJmax;
[0021] The attack strength value is processed to determine whether it is low, medium, or high intensity.
[0022] Preferably, when in a mixed attack state:
[0023] Obtain the attack intensity value for each attack type, take the maximum value among the attack intensity values as the final attack intensity value, and perform discrimination processing on the final attack intensity value with GJmin and GJmax, outputting low intensity, medium intensity or high intensity.
[0024] Preferably, the analysis process of the path reconstruction submodule is as follows:
[0025] S1: Starting from the attacked device, trace back to the upstream devices that have data interaction with the attacked device, and at the same time trace forward to the downstream devices affected by the attacked device;
[0026] S2: Based on time series, the attack events of each device are linked together in the order of occurrence, and the triggering conditions of each event are marked;
[0027] S3: Use a graph structure data format to construct an attack propagation graph, that is, mark devices, users or IPs as nodes, and mark data interaction or operation relationships as edges.
[0028] Preferably, the analysis process of the source location submodule is as follows:
[0029] Extract the timestamps of all nodes associated with attack events in the attack propagation graph, sort them by time from earliest to latest, and filter out the top 3 candidate nodes with the earliest timestamps;
[0030] The system retrieves collected threat intelligence data and uses this data to obtain the historical tags and danger levels of each candidate node.
[0031] Analyze the historical tags of each candidate node, retain the candidate nodes with historical tags and set them as preliminary matching nodes. Determine the danger level of the preliminary matching nodes, retain the preliminary matching nodes with medium or high risk, and determine that the threat level of the preliminary matching nodes with medium or high risk has passed the match.
[0032] Check the network communication records of candidate nodes, retain the nodes that have communication records with malicious domains in the threat intelligence data within 1 hour before the attack event, and set them as suspected nodes. Obtain the communication frequency of the suspected nodes. If the communication frequency is greater than or equal to the preset communication frequency threshold, the association verification of the corresponding suspected node is deemed to be successful.
[0033] The threat level matching and correlation verification of candidate nodes are analyzed to obtain the attack source node, verification signal, or rescreening signal.
[0034] Preferably, when a verification signal is generated, candidate nodes that are determined to have passed either threat level matching or association verification are set as nodes to be verified;
[0035] Retrieve user behavior data and preset abnormal behavior data. Preset abnormal behavior data includes login from a different location and abnormal operation time.
[0036] Based on the user behavior data of the node to be verified during the attack period, if the node to be verified is found to have preset abnormal behavior data, then the source node of the attack or the exclusion signal can be obtained.
[0037] Preferably, the analysis process of the defense matching module is as follows:
[0038] The attack intensity value and the range of influence of the attack source node are obtained. The range of influence of the attack source indicates the number of affected devices.
[0039] The attack risk index is calculated by weighting and summing the attack intensity value and the scope of influence of the attack source.
[0040] The attack risk index is then processed to obtain low-risk, medium-risk, or high-risk signals, and a risk feedback list is generated based on these signals.
[0041] The risk feedback list includes the IP address of the attack source node, the attack strength value, and the attack type.
[0042] The beneficial effects of this invention are as follows:
[0043] This invention collects data such as network traffic, device logs, threat intelligence, and user behavior, covering all dimensions of information related to network attacks. It avoids feature loss caused by a single data dimension, provides a comprehensive data foundation for subsequent AI analysis, and significantly reduces the probability of missed or false positives.
[0044] This invention employs a fusion model to identify attack types and intensity, taking into account both local and temporal features to improve attack identification accuracy. It also constructs attack propagation graphs and accurately locates attack sources, solving the problems of low efficiency and poor accuracy in traditional source tracing. Furthermore, it generates tiered early warnings based on risk levels to ensure that attacks of different severity receive corresponding responses, enabling automatic matching of defense strategies, avoiding protection delays, and enhancing the proactive defense capabilities of network security. Attached Figure Description
[0045] The invention will now be further described with reference to the accompanying drawings;
[0046] Figure 1 This is a flowchart of the system of the present invention;
[0047] Figure 2 This is a partial analysis diagram of Embodiment 2 of the present invention. Detailed Implementation
[0048] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0049] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments;
[0050] Example 1: Please refer to Figures 1 to 2 As shown, the present invention is an AI-based multi-dimensional network attack tracing and early warning system, including a network security management center, a multi-source data acquisition module, an AI multi-dimensional analysis module, a defense matching module, and an early warning operation module. The AI multi-dimensional analysis module includes an attack identification submodule, a path reconstruction submodule, and a source location submodule.
[0051] The multi-source data acquisition module has a one-way communication connection with the network security management center, the network security management center has a two-way communication connection with the AI multi-dimensional analysis module, the network security management center has a one-way communication connection with the defense matching module, and the defense matching module has a one-way communication connection with the early warning operation module.
[0052] Multi-dimensional data from the network environment is collected through a multi-source data acquisition module. The collected raw multi-dimensional data is then cleaned and standardized. Attack-related features (abnormal port access frequency, packet retransmission rate, asymmetric traffic ratio, etc.) are extracted to generate a standardized feature dataset, which is then sent to the network security management center for storage.
[0053] The multi-dimensional data includes network traffic data, device log data, threat intelligence data, and user behavior data;
[0054] The network traffic data includes TCP / UDP packets, traffic volume, etc.
[0055] The device log data includes server operation logs, error logs, login logs, etc.
[0056] The threat intelligence data includes known attacking IP addresses, IP address threat levels, malicious domain names, etc.
[0057] The user behavior data includes user login time, login location, and operation behavior (such as file upload / download, system configuration modification, etc.);
[0058] Based on a standardized feature dataset, an AI multi-dimensional analysis module is used to analyze network attacks. This AI multi-dimensional analysis module includes an attack identification submodule, a path reconstruction submodule, and a source location submodule. The specific steps are as follows:
[0059] The attack identification submodule is used to perform attack identification and attack segmentation analysis on the standardized feature dataset. The specific attack identification and attack segmentation analysis process is as follows:
[0060] The standardized feature dataset is input into a pre-set fusion model (a fusion of a deep learning model based on CNN+LSTM and a traditional machine learning model based on XGBoost). The fusion model extracts local features (such as short-term abnormal traffic features and single abnormal operation features) through CNN, extracts time-series features (such as long-term traffic change trends and continuous operation behavior features) through LSTM, and then classifies the features through a pre-set XGBoost model to output the attack type. The attack types include DDoS attacks, SQL injection attacks, cross-site scripting attacks (XSS), etc.
[0061] The number of attack types is obtained and processed. If the number of attack types is equal to 1, it is determined to be a single attack state. If the number of attack types is greater than 1, it is determined to be a mixed attack state.
[0062] When in a single attack state:
[0063] Based on the attack type, the core characteristics of each attack type are obtained. For example, the core characteristics of a DDoS attack include peak traffic and number of abnormal connections, while the core characteristics of a brute-force attack include the number of abnormal login attempts and login failure frequency.
[0064] Each core attack feature in the attack type is mapped to the [0,1] interval through Min-Max normalization, and the core attack features in the attack type are labeled as Ti, where i is a natural number greater than zero;
[0065] Obtain the preset weight coefficient ai corresponding to each core attack feature Ti in the attack type, and calculate the attack strength value based on the core attack feature Ti and the preset weight coefficient ai.
[0066] Attack strength value = ∑ (Ti of each attack core feature × preset weight coefficient ai) × 10;
[0067] Preset thresholds for obtaining attack strength values: GJmin and GJmax, 0 < GJmin < GJmax;
[0068] The attack intensity value is processed for discrimination. If the attack intensity value is < GJmin, it is judged as low intensity; if GJmin ≤ attack intensity value ≤ GJmax, it is judged as medium intensity; if the attack intensity value is > GJmax, it is judged as high intensity. The output is low intensity, medium intensity, or high intensity.
[0069] When in a mixed attack state:
[0070] The attack intensity value of each attack type is obtained, the maximum value among the attack intensity values is taken as the final attack intensity value, and the final attack intensity value is compared with GJmin and GJmax to output low intensity, medium intensity or high intensity.
[0071] The early warning operation module responds to the low, medium, or high intensity output and displays the preset warning text corresponding to the low, medium, or high intensity to understand the attack risk situation;
[0072] This invention achieves objectivity and relevance of the evaluation results through three steps: feature weight allocation, standardized feature value weighted calculation, and precise intensity threshold division.
[0073] Example 2: The path reconstruction submodule is used to perform attack propagation graph acquisition and analysis on the collected correlation information. The specific attack propagation graph acquisition and analysis process is as follows:
[0074] Based on the attack identification results (attack type, attack strength value) and the correlation information in the standardized feature dataset (such as source IP address, destination IP address, operation time series, device interaction records), an attack propagation graph is constructed.
[0075] step:
[0076] S1: Starting from the attacked device (located through the "attack trigger log" in the device log), trace back to the upstream devices that have data interaction with the device, and at the same time trace forward to the downstream devices affected by the device;
[0077] S2: Based on time series, chain attack events (such as abnormal logins and malicious code execution) of each device in the order of occurrence, and mark the triggering conditions of each event (such as access requests from a certain IP or operation instructions from a certain user).
[0078] S3: The attack propagation graph is constructed using a graph structure data format, that is, devices, users or IPs are marked as nodes, and data interaction or operation relationships are marked as edges, with edge attributes indicating the interaction time or operation type;
[0079] The early warning module responds to and stores the attack propagation graph, providing data support for subsequent analysis.
[0080] Example 3: The source location submodule is used to perform attack source location feedback analysis on the attack propagation graph. The specific attack source location feedback analysis process is as follows:
[0081] Extract the timestamps of all nodes associated with attack events in the attack propagation graph (such as the time when the IP initiates access, the time when the device triggers abnormal logs, and the time when the user performs sensitive operations), sort them from earliest to latest time, and filter out the top 3 candidate nodes with the earliest timestamps (to avoid misjudging a single node and cover potential initial attack nodes).
[0082] The system retrieves collected threat intelligence data and uses this data to obtain the historical tags and danger levels of each candidate node.
[0083] Historical tags include known attack source IPs, botnet node IPs, etc.
[0084] The risk levels are categorized as low, medium, and high.
[0085] Analyze the historical tags of each candidate node, retain the candidate nodes with historical tags and set them as preliminary matching nodes. Determine the danger level of the preliminary matching nodes, retain the preliminary matching nodes with medium or high risk, and determine that the threat level of the preliminary matching nodes with medium or high risk has passed the match.
[0086] Check the network communication records of candidate nodes (extracted from network traffic data), retain the nodes among the candidate nodes that have communication records with malicious domains in threat intelligence data within 1 hour before the attack event (preset duration), and set them as suspected nodes. Obtain the communication frequency of the suspected nodes. If the communication frequency is greater than or equal to the preset communication frequency threshold, the corresponding suspected node is determined to have passed the association verification.
[0087] The threat level matching and association verification of candidate nodes are analyzed. If a candidate node is determined to have passed both threat level matching and association verification, then the corresponding candidate node is set as the attack source node.
[0088] If a candidate node is determined to pass either threat level matching or association verification, a verification signal is generated.
[0089] If the threat level matching and association verification are not passed, a rescreening signal is generated;
[0090] The early warning operation module responds to the attack source node, verification signal, or rescreening signal, and immediately displays the attack source node, executes the preset early warning operation of the verification signal, or relocates the attack source node in order to accurately and effectively lock the attack source.
[0091] When a verification signal is generated, candidate nodes that are determined to pass either threat level matching or association verification will be set as nodes to be verified.
[0092] Retrieve user behavior data and preset abnormal behavior data. Preset abnormal behavior data includes login from a different location (login IP is in a different region than the commonly used IP) and abnormal operation time, etc.
[0093] Based on user behavior data of the node to be verified during the attack period, it is determined whether there is any preset abnormal behavior data of the node to be verified. If at least one of the preset abnormal behavior data exists, the node to be verified is determined to be the source node of the attack. If at least one of the preset abnormal behavior data does not exist, an exclusion signal is generated.
[0094] The early warning operation module responds to the attack source node or elimination signal and immediately displays the corresponding preset text of the attack source node or elimination signal, so as to further relocate the attack source node and improve the efficiency of attack source location.
[0095] The defense matching module is used to perform defense risk classification analysis on the attack strength value of the attack source node. The specific defense risk classification analysis process is as follows:
[0096] Obtain the attack intensity value of the attack source node and the scope of the attack source's influence (number of affected devices).
[0097] The attack risk index is calculated by weighting and summing the attack intensity value and the scope of influence of the attack source.
[0098] That is: Attack Risk Index = Attack Strength Value × Preset Weighting Coefficient of Attack Strength Value + Influence Range of Attack Source × Preset Weighting Coefficient of Influence Range of Attack Source;
[0099] The attack risk index is then processed. If the attack risk index is less than the minimum value in the preset attack risk index range, a low-risk signal is generated. If the attack risk index is within the preset attack risk index range, a medium-risk signal is generated. If the attack risk index is greater than the maximum value in the preset attack risk index range, a high-risk signal is generated.
[0100] A risk feedback list is obtained based on low-risk, medium-risk, or high-risk signals;
[0101] The risk feedback list includes the IP address of the attack source node, the attack strength value, and the attack type;
[0102] The early warning operation module is used to respond to low-risk, medium-risk, and high-risk signals, and immediately display the risk feedback list corresponding to the low-risk, medium-risk, and high-risk signals. It reminds the operation and management personnel to select appropriate defense strategies based on the risk feedback list to improve the timeliness and effectiveness of network attack response.
[0103] In summary, this invention collects data such as network traffic, device logs, threat intelligence, and user behavior, covering all dimensions of information related to network attacks. This avoids feature loss caused by single data dimensions, providing a comprehensive data foundation for subsequent AI analysis and significantly reducing the probability of missed or false positives. Furthermore, it employs a fusion model to identify attack types and intensity, taking into account both local and temporal features to improve attack identification accuracy. It also constructs attack propagation graphs and accurately locates attack sources, solving the problems of low efficiency and poor accuracy in traditional source tracing. Additionally, it generates tiered warnings based on risk levels, ensuring that attacks of different severity receive corresponding responses, achieving automatic matching of defense strategies, avoiding protection delays, and enhancing the proactive defense capabilities of network security.
[0104] The threshold is set for comparative analysis of results to determine whether they are good or bad. The value of the threshold is determined by a combination of large-scale model analysis of sample data and human experience. It can also be adjusted appropriately based on seasonal or common-sense influencing factors.
[0105] The size of the coefficient is a specific value obtained by quantifying each parameter to facilitate subsequent comparison. The size of the coefficient depends on the amount of sample data and the corresponding operating coefficient initially set by those skilled in the art for each set of sample data; as long as it does not affect the proportional relationship between the parameter and the quantified value.
[0106] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.
Claims
1. An AI-based multi-dimensional network attack tracing and early warning system, characterized in that, It includes a network security management center, a multi-source data acquisition module, an AI multi-dimensional analysis module, a defense matching module, and an early warning operation module; The multi-source data acquisition module collects multi-dimensional data from the network environment, cleans and standardizes the collected raw multi-dimensional data, extracts attack-related features, generates a standardized feature dataset, and sends the standardized feature dataset to the network security management center for storage. Based on a standardized feature dataset, an AI multi-dimensional analysis module is used to analyze network attacks. This AI multi-dimensional analysis module includes an attack identification submodule, a path reconstruction submodule, and a source location submodule. The specific steps are as follows: The attack identification submodule is used to perform attack identification and attack segmentation analysis on the standardized feature dataset, and outputs low-intensity, medium-intensity, or high-intensity attacks. The path reconstruction submodule constructs an attack propagation graph based on the association information between the attack identification results and the standardized feature dataset; The source location submodule is used to perform attack source location feedback analysis on the attack propagation graph to obtain the attack source node; The defense matching module is used to analyze the attack intensity value of the attack source node to classify the defense risk and obtain low-risk, medium-risk and high-risk signals. The analysis process of the source location submodule is as follows: Extract the timestamps of all nodes associated with attack events in the attack propagation graph, sort them by time from earliest to latest, and filter out the top 3 candidate nodes with the earliest timestamps; The system retrieves collected threat intelligence data and uses this data to obtain the historical tags and danger levels of each candidate node. Analyze the historical tags of each candidate node, retain the candidate nodes with historical tags and set them as preliminary matching nodes. Determine the danger level of the preliminary matching nodes, retain the preliminary matching nodes with medium or high risk, and determine that the threat level of the preliminary matching nodes with medium or high risk has passed the match. Check the network communication records of candidate nodes, retain the nodes that have communication records with malicious domains in the threat intelligence data within 1 hour before the attack event, and set them as suspected nodes. Obtain the communication frequency of the suspected nodes. If the communication frequency is greater than or equal to the preset communication frequency threshold, the association verification of the corresponding suspected node is deemed to be successful. The threat level matching and correlation verification of candidate nodes are analyzed to obtain the attack source node, verification signal, or rescreening signal. 2.The AI-based multi-dimensional cyber attack tracing and early warning system according to claim 1, characterized in that, The analysis process of the attack identification submodule is as follows: Input the standardized feature dataset into a pre-set fusion model, and the model will output the attack type. The number of attack types is obtained, and the number of attack types is processed to determine whether it is a single attack state or a mixed attack state. 3.The AI-based multi-dimensional cyber attack tracing and early warning system according to claim 2, characterized in that, When in a single attack state: Based on the attack type, obtain the core characteristics of each attack type; Each core attack feature in the attack type is mapped to the [0,1] interval through Min-Max normalization, and the core attack features in the attack type are labeled as Ti, where i is a natural number greater than zero; Obtain the preset weight coefficient ai corresponding to each core attack feature Ti in the attack type, and calculate the attack strength value based on the core attack feature Ti and the preset weight coefficient ai. Preset thresholds for obtaining attack strength values: GJmin and GJmax, 0 < GJmin < GJmax; The attack strength value is processed to determine whether it is low, medium, or high intensity.
4. The AI-based multi-dimensional network attack tracing and early warning system according to claim 2, characterized in that, When in a mixed attack state: Obtain the attack intensity value for each attack type, take the maximum value among the attack intensity values as the final attack intensity value, and perform discrimination processing on the final attack intensity value with GJmin and GJmax, outputting low intensity, medium intensity or high intensity. 5.The AI-based multi-dimensional cyber attack tracing and early warning system according to claim 1, characterized in that, The analysis process of the path restoration submodule is as follows: S1: Starting from the attacked device, trace back to the upstream devices that have data interaction with the attacked device, and at the same time trace forward to the downstream devices affected by the attacked device; S2: Based on time series, the attack events of each device are linked together in the order of occurrence, and the triggering conditions of each event are marked; S3: Use a graph structure data format to construct an attack propagation graph, that is, mark devices, users or IPs as nodes, and mark data interaction or operation relationships as edges. 6.The AI-based multi-dimensional cyber attack tracing and early warning system according to claim 1, wherein, When a verification signal is generated, candidate nodes that are determined to pass either threat level matching or association verification will be set as nodes to be verified. Retrieve user behavior data and preset abnormal behavior data. Preset abnormal behavior data includes login from a different location and abnormal operation time. Based on the user behavior data of the node to be verified during the attack period, if the node to be verified is found to have preset abnormal behavior data, then the source node of the attack or the exclusion signal can be obtained. 7.The AI-based multi-dimensional cyber attack tracing and early warning system according to claim 1, wherein, The analysis process of the defense matching module is as follows: The attack intensity value and the range of influence of the attack source node are obtained. The range of influence of the attack source indicates the number of affected devices. The attack risk index is calculated by weighting and summing the attack intensity value and the scope of influence of the attack source. The attack risk index is then processed to obtain low-risk, medium-risk, or high-risk signals, and a risk feedback list is generated based on these signals. The risk feedback list includes the IP address of the attack source node, the attack strength value, and the attack type.
Citation Information
Patent Citations
Tracing analysis method for network attacks
CN111490970A
Network attack tracing method and device based on threat graph, equipment and medium
CN120896734A