Internet data security protection method and system based on artificial intelligence algorithm

Abstract

This invention discloses an internet data security protection method and system based on artificial intelligence algorithms, comprising the following steps: S1, real-time collection of multi-dimensional security data in the target network; S2, anomaly detection, outputting anomaly risk values ​​representing potential security risks; S3, dynamic attack fingerprint construction, forming a structured attack fingerprint vector; S4, using a deep metric learning model, semantically matching the currently constructed attack fingerprint vector with the fingerprint vectors of historical data leakage attacks, calculating a dynamic matching degree representing the similarity between the two in causing data leakage; S5, constructing and maintaining a network security knowledge graph, outputting the associated paths and causal probabilities that may lead to data leakage when new attacks or anomalies occur; S6, generating combined defense strategy instructions that integrate security effects and business continuity considerations; S7, calculating dynamic trust scores and executing fine-grained access control and isolation measures.

Description

Technical Field

[0001] This invention relates to the field of internet data security technology, and in particular to internet data security protection methods and systems based on artificial intelligence algorithms. Background Technology

[0002] The internet data security protection method and system based on artificial intelligence algorithms utilizes advanced AI algorithms such as deep learning, machine learning, and pattern recognition to monitor and intelligently analyze multi-dimensional information such as network traffic, user behavior, and data access patterns in real time. This allows for accurate identification of abnormal behavior, prediction of potential threats, dynamic adjustment of security strategies, and automated response. The system not only effectively improves the real-time performance, accuracy, and adaptability of data security protection but also enhances defense against unknown threats while reducing the cost of manual intervention. Its significance lies not only in the strict protection of personal user privacy, the effective maintenance of core enterprise data assets, and the secure operation of critical national information infrastructure, but also in driving innovation in data security protection models, promoting the deep integration of artificial intelligence and cybersecurity, providing solid technical support for building a secure and trustworthy digital ecosystem and promoting the high-quality development of the digital economy. Ultimately, it achieves a leapfrog transformation from passive defense to proactive intelligent protection, contributing to the sustainable development of the digital society while ensuring data security.

[0003] Existing technologies often employ matching algorithms based on fixed rules or simple linear models, such as cosine similarity. These algorithms fail to effectively characterize the nonlinear evolutionary characteristics of attack methods during implementation, such as variations in attack payloads and transitions between attack phases. This results in insufficiently precise and accurate similarity measurements for novel variant attacks or the evolving forms of known attacks, leading to false negatives or missed detections. Therefore, this paper proposes an internet data security protection method and system based on artificial intelligence algorithms. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing an internet data security protection method and system based on artificial intelligence algorithms.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: The method for protecting internet data security based on artificial intelligence algorithms includes the following steps: S1. Real-time collection of multi-dimensional security data in the target network, wherein the multi-dimensional security data includes at least user behavior data, system operation data, and network attack data; S2. Based on the collected user behavior data and system operation data, use a time-series deep learning model to perform anomaly detection and output anomaly risk values ​​that represent potential security risks. S3. Dynamically construct attack fingerprints from the collected network attack data, extract multi-dimensional features including basic attack attributes, attack payload characteristics, request sequence time patterns and attack tactical identifiers, and form a structured attack fingerprint vector. S4. Using a deep metric learning model, semantically match the currently constructed attack fingerprint vector with the fingerprint vector of historical data leakage attacks, and calculate a dynamic matching degree that represents the similarity between the two in terms of causing data leakage. S5. Construct and maintain a cybersecurity knowledge graph. The nodes of the cybersecurity knowledge graph should include at least attack events, abnormal events, users, devices and data assets. The edges represent the spatiotemporal and causal relationships between events and entities. When a new attack or abnormal event occurs, use a graph neural network to reason about the knowledge graph and output the associated paths and causal probabilities that the event may lead to data leakage. S6. Based on the dynamic matching degree, the causal probability, the real-time business status and the preset business criticality weight, the reinforcement learning decision engine is used to perform adaptive strategy optimization to generate a combined defense strategy instruction that integrates security effect and business continuity considerations. S7. Through an adaptive trust assessment engine deeply integrated with the zero-trust architecture, based on the combined defense strategy instructions, real-time user behavior baseline, device health status and request context, calculate dynamic trust scores and execute fine-grained access control and access isolation measures.

[0006] The above further includes: Furthermore, the construction of the dynamic attack fingerprint specifically includes: Natural language processing techniques are used to analyze unstructured attack logs to extract attack tactical identifiers and payload text features; Temporal convolutional network models are used to perform pattern analysis on attack request sequences to capture their stage evolution characteristics; The extracted attack basic attribute features, text features, and time sequence pattern features are fused and vectorized to generate the structured attack fingerprint vector for deep metric learning.

[0007] Furthermore, S4 specifically includes: The architecture of the deep metric learning model is a Siamese network or a prototype network. The deep metric learning model is trained to learn a complex distance metric function that captures the nonlinear evolution of attack behavior. The deep metric learning model takes the current attack fingerprint vector and the historical attack fingerprint vector as input and directly outputs a matching score in the range of 0 to 1. The matching score dynamically represents the semantic similarity between the current attack and historical attacks known to lead to data leakage.

[0008] Furthermore, the reasoning using graph neural networks specifically includes: The attack fingerprint vector output by the deep metric learning model is used as the initial feature representation of the corresponding attack event node in the network security knowledge graph. When a new event is injected, a graph attention network model is used to perform multiple rounds of message propagation and feature aggregation along the edges of the graph to infer the potential correlation paths between the new event and historical abnormal risk events and key data assets. The final causal probability is calculated by combining the confidence levels of all associated paths.

[0009] Furthermore, S6 specifically includes: A reinforcement learning decision model for network security defense is constructed. The state space, action space, and reward function of the reinforcement learning decision model are specially designed to simultaneously optimize the security protection effect and the continuity of business operation. The dynamic matching degree, causal probability, real-time business system status indicators, and predefined business-critical weights of different data assets and system functions are jointly encoded into a multi-dimensional state vector that represents the current comprehensive situation, which is then used as the input to the reinforcement learning decision model. The reinforcement learning decision model selects and combines a set of atomic defense actions from its predefined action space based on the input state vector, and outputs a specific, executable combined defense strategy instruction. During the offline training and online learning phases of the reinforcement learning decision-making model, the long-term value of the selected action is evaluated based on a composite reward function. This composite reward function simultaneously quantifies security benefits and business impacts, guiding the model to learn to make balanced decisions in complex threat environments.

[0010] Furthermore, S7 specifically includes: Receiving and parsing decision instructions: Receive combined defense strategy instructions issued by the reinforcement learning decision engine. The instructions include at least the target protection range, the suggested control action type, and the strategy priority identifier. The engine parses the instructions to determine the set of subjects and the scope of resources to be evaluated and managed. Aggregate multi-source real-time trust evidence: continuously obtain real-time user behavior baseline and current behavior deviation score from the time-series deep learning model, obtain endpoint security status, software compliance and vulnerability information from the device management agent as device health status indicators, and extract time, geographical location and target resource sensitivity level from access requests to form request context; Calculate dynamic trust score: Based on a preset fusion algorithm, the real-time user behavior baseline deviation, device health status score, request context risk value and the risk weight contained in the combined defense strategy instruction are weighted and fused to calculate a dynamic trust score that changes with time and context for this specific access session. Implement adaptive access control: compare the calculated dynamic trust score with a preset dynamic trust threshold that can be associated with resource sensitivity, and make real-time decisions on allowing access, upgrading the authentication level, restricting the scope of operation, or denying access based on the comparison result and the constraints of the combined defense strategy instructions, thereby achieving session-level fine-grained authorization that follows the principle of least privilege. Implement dynamic micro-segmentation: When the dynamic trust score is lower than the isolation trigger threshold or the policy instruction explicitly requires it, the reinforcement learning decision engine dynamically generates network isolation policies and access control lists based on the scope of influence inferred from the knowledge graph. Logical isolation is only implemented for users, devices and server subnets that are identified as threatened or abnormal, rather than interrupting normal business access to the entire network.

[0011] An internet data security protection system based on artificial intelligence algorithms includes: Network data acquisition module: collects user behavior data, system operation data and network attack data in the target network in real time, and performs preliminary analysis of unstructured logs; The anomaly detection module has a built-in trained temporal deep learning model that performs sequence analysis on user behavior and system operation data and outputs risk values ​​that characterize network behavior anomalies. Dynamic attack fingerprint construction module: Extracts multi-dimensional features from network attack data and generates structured attack fingerprint vectors through fusion processing; The deep metric learning matching module has a built-in Siamese network or prototype network model to calculate the semantic matching degree between the current attack fingerprint and the historical leaked attack fingerprint; Knowledge Graph Construction and Reasoning Module: Constructs and maintains a cybersecurity knowledge graph, and uses a graph neural network model to perform real-time reasoning on the graph, outputting event association paths and causal probabilities; Reinforcement learning strategy decision-making module: Generates optimal combined defense strategy instructions based on multi-dimensional input states; The adaptive trust assessment and execution module serves as the execution engine for the zero-trust policy: based on dynamic trust scores and decision instructions, it implements fine-grained authentication, access control, and resource isolation operations. The strategy coordination and arbitration module coordinates, routes, and adjudicates conflicts among the outputs of various decision-making and execution modules to ensure the synergy and consistency of the system response.

[0012] Furthermore, the strategy coordination and arbitration module includes a hierarchical strategy coordination and arbitration mechanism, the specific execution steps of which include: Reception and Unified Quantization: Receive the raw output from the intelligent perception layer. The raw output includes the dynamic matching degree calculated by the deep metric learning matching module, the causal probability and association path output by the knowledge graph construction and reasoning module, and the abnormal risk value output by the anomaly detection module. Input the above heterogeneous data into a pre-trained unified quantization model and map it into a comprehensive threat situation score vector with consistent dimensions and scale. Multi-dimensional scenario judgment: Based on the comprehensive threat situation scoring vector, real-time business status data and a predefined multi-dimensional scenario rule base, a joint judgment is made. The scenario rule base defines at least the handling scenario categories corresponding to different business sensitive periods, different system load ranges and different combinations of attack types. Dynamic decision routing: Based on the determined handling scenario category and the preset priority mapping table, the macro defense decision request is routed to the corresponding decision engine. The decision engine includes at least the reinforcement learning decision engine, the built-in strategy module of the adaptive trust evaluation engine, and an emergency response engine based on hard-coded rules. Multi-engine output arbitration: When multiple routed decision engines output potentially conflicting policy instructions, a conflict arbitration rule set is invoked to resolve the conflict. The rule set is weighted and evaluated based on the instruction's timeliness requirements, scope of impact, execution cost, and policy objectives, and selects or merges them to generate a unique set of executable instructions. Instruction distribution and supervised execution: The final instruction set after arbitration is distributed to the corresponding execution module, and the execution status and feedback results of the instructions are monitored. For emergency response instructions marked as the highest priority, a bypass channel directly to the execution module is established to ensure their forced execution within milliseconds.

[0013] The present invention has the following beneficial effects: In this invention, by constructing dynamic attack fingerprints and matching deep metric learning, a fine characterization and similarity measurement of the nonlinear evolution of attack behavior are achieved. Furthermore, by using network security knowledge graphs and graph neural network reasoning, isolated events are placed in a macroscopic entity relationship network for causal analysis. This not only identifies the attack itself, but also reveals the complete chain and true intent of multi-step, latent attacks, greatly improving the depth and accuracy of threat detection. Attached Figure Description

[0014] Figure 1 This is a flowchart illustrating the steps of the Internet data security protection method based on artificial intelligence algorithms proposed in this invention. Figure 2 This is a system block diagram of the Internet data security protection system based on artificial intelligence algorithms proposed in this invention. Detailed Implementation

[0015] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] Please see Figures 1-2 As shown, this invention is an internet data security protection method based on artificial intelligence algorithms, comprising the following steps: S1. Real-time collection of multi-dimensional security data in the target network, wherein the multi-dimensional security data includes at least user behavior data, system operation data, and network attack data; S2. Based on the collected user behavior data and system operation data, use a time-series deep learning model to perform anomaly detection and output anomaly risk values ​​that represent potential security risks. S3. Dynamically construct attack fingerprints from the collected network attack data, extract multi-dimensional features including basic attack attributes, attack payload characteristics, request sequence time patterns and attack tactical identifiers, and form a structured attack fingerprint vector. S4. Using a deep metric learning model, semantically match the currently constructed attack fingerprint vector with the fingerprint vector of historical data leakage attacks, and calculate a dynamic matching degree that represents the similarity between the two in terms of causing data leakage. S5. Construct and maintain a cybersecurity knowledge graph. The nodes of the cybersecurity knowledge graph should include at least attack events, abnormal events, users, devices and data assets. The edges represent the spatiotemporal and causal relationships between events and entities. When a new attack or abnormal event occurs, use a graph neural network to reason about the knowledge graph and output the associated paths and causal probabilities that the event may lead to data leakage. S6. Based on the dynamic matching degree, the causal probability, the real-time business status and the preset business criticality weight, the reinforcement learning decision engine is used to perform adaptive strategy optimization to generate a combined defense strategy instruction that integrates security effect and business continuity considerations. S7. Through an adaptive trust assessment engine deeply integrated with the zero-trust architecture, based on the combined defense strategy instructions, real-time user behavior baseline, device health status and request context, calculate dynamic trust scores and execute fine-grained access control and access isolation measures.

[0017] In one embodiment, the dynamic attack fingerprint construction specifically includes: Natural language processing techniques are used to analyze unstructured attack logs to extract attack tactical identifiers and payload text features; Temporal convolutional network models are used to perform pattern analysis on attack request sequences to capture their stage evolution characteristics; The extracted attack basic attribute features, text features, and time sequence pattern features are fused and vectorized to generate the structured attack fingerprint vector for deep metric learning.

[0018] In one embodiment, S4 specifically includes: The architecture of the deep metric learning model is a Siamese network or a prototype network. The deep metric learning model is trained to learn a complex distance metric function that captures the nonlinear evolution of attack behavior. The deep metric learning model takes the current attack fingerprint vector and the historical attack fingerprint vector as input and directly outputs a matching score in the range of 0 to 1. The matching score dynamically represents the semantic similarity between the current attack and historical attacks known to lead to data leakage.

[0019] In one embodiment, the step of using a graph neural network for reasoning specifically includes: The attack fingerprint vector output by the deep metric learning model is used as the initial feature representation of the corresponding attack event node in the network security knowledge graph. When a new event is injected, a graph attention network model is used to perform multiple rounds of message propagation and feature aggregation along the edges of the graph to infer the potential correlation paths between the new event and historical abnormal risk events and key data assets. The final causal probability is calculated by combining the confidence levels of all associated paths.

[0020] In one embodiment, step S6 specifically includes: A reinforcement learning decision model for network security defense is constructed. The state space, action space, and reward function of the reinforcement learning decision model are specially designed to simultaneously optimize the security protection effect and the continuity of business operation. The dynamic matching degree, causal probability, real-time business system status indicators, and predefined business-critical weights of different data assets and system functions are jointly encoded into a multi-dimensional state vector that represents the current comprehensive situation, which is then used as the input to the reinforcement learning decision model. Constructing the state vector specifically includes: The state vector is a unified mathematical representation that integrates heterogeneous information from multiple sources. It includes at least the attack semantic matching degree output by the deep metric learning module, the event causal probability and confidence degree output by the graph neural network inference module, the real-time risk value output by the anomaly detection module, the system load and critical service availability indicators provided by the business monitoring module, and the business criticality weight coefficients that are pre-configured statically or dynamically calculated based on the data asset value and user role permissions. The reinforcement learning decision model selects and combines a set of atomic defense actions from its predefined action space based on the input state vector, and outputs a specific, executable combined defense strategy instruction. The predefined action space specifically includes: The action space consists of a series of atomic defense actions of different granularities that can be executed independently or in combination. These actions include at least implementing multi-factor authentication upgrades for different users or user groups, limiting or temporarily blocking traffic rates for specific IP addresses or network segments, initiating isolation processes for suspected compromised servers or terminals, adjusting firewall rules to filter specific types of traffic, and dynamically upgrading the recording level of specific types of system logs to enhance audit tracing capabilities. During the offline training and online learning phases of the reinforcement learning decision-making model, the long-term value of the selected action is evaluated based on a composite reward function. This composite reward function simultaneously quantifies security benefits and business impacts, guiding the model to learn to make balanced decisions in complex threat environments. The design of the composite reward function specifically includes: The composite reward function is constructed as a weighted sum of positive incentives and negative penalties; Positive incentives are generated when a confirmed cyberattack is successfully blocked or mitigated without causing critical business interruption, while negative penalties are triggered when a real data leak occurs, defensive actions cause high-weight business services to become unavailable or experience severe performance degradation, or the system generates a large number of false alarms that interfere with normal operations. The different priorities of security and business are balanced by adjusting the weight coefficients of each item. The training and deployment of the model specifically includes: The reinforcement learning decision model is first pre-trained in a simulation platform that simulates a real network and business environment, using historical attack data and business traffic data. After being deployed to the production environment, the model enters the online learning phase. Through feedback from security operators on the system's automatically executed commands and post-hoc analysis of the actual defense effects, it continuously fine-tunes its policy network parameters, thereby achieving dynamic policy optimization capabilities that adapt to specific network environments and business models.

[0021] In one embodiment, S7 specifically includes: Receiving and parsing decision instructions: Receive combined defense strategy instructions issued by the reinforcement learning decision engine. The instructions include at least the target protection range, the suggested control action type, and the strategy priority identifier. The engine parses the instructions to determine the set of subjects and the scope of resources to be evaluated and managed. Aggregate multi-source real-time trust evidence: continuously obtain real-time user behavior baseline and current behavior deviation score from the time-series deep learning model, obtain endpoint security status, software compliance and vulnerability information from the device management agent as device health status indicators, and extract time, geographical location and target resource sensitivity level from access requests to form request context; Calculate dynamic trust score: Based on a preset fusion algorithm, the real-time user behavior baseline deviation, device health status score, request context risk value and the risk weight contained in the combined defense strategy instruction are weighted and fused to calculate a dynamic trust score that changes with time and context for this specific access session. The specific fusion algorithm for calculating dynamic trust scores is as follows: Design a configurable weighted scoring function whose input variables include at least the normalized user behavior deviation, the device health status quantification value, the request context risk coefficient, and the strategy adjustment factor obtained by mapping the combined defense strategy instructions. Through an online learning mechanism, the weight coefficients of each input variable are dynamically adjusted based on the success or failure of historical access decisions, enabling the scoring model to adapt to changes in internal threat patterns and the business environment. Implement adaptive access control: compare the calculated dynamic trust score with a preset dynamic trust threshold that can be associated with resource sensitivity, and make real-time decisions on allowing access, upgrading the authentication level, restricting the scope of operation, or denying access based on the comparison result and the constraints of the combined defense strategy instructions, thereby achieving session-level fine-grained authorization that follows the principle of least privilege. Implementing adaptive access control specifically includes: Preset differentiated dynamic trust thresholds for data assets or system functions with different sensitivity levels; Access control decisions depend not only on whether the dynamic trust score of the current session exceeds the threshold, but also on the trend of the score's change; For sessions where the score is trending downwards, even if the current score is slightly above the threshold, enhanced authentication requirements or operational restrictions may be triggered to implement preventative controls. Implement dynamic micro-segmentation: When the dynamic trust score is lower than the isolation trigger threshold or the policy instruction explicitly requires it, the reinforcement learning decision engine dynamically generates network isolation policies and access control lists based on the scope of influence inferred from the knowledge graph. Logical isolation is only implemented for users, devices and server subnets that are identified as threatened or abnormal, rather than interrupting normal business access of the entire network. Implementing dynamic micro-segmentation specifically includes: The adaptive trust evaluation engine works in conjunction with the knowledge graph construction and reasoning module; When isolation is required, the engine queries the knowledge graph for other users, devices, and servers that are directly related to the current low-trust entity or have potential risk transmission paths. Based on this, the engine issues precise flow table rules through the software-defined network controller to achieve a dynamic isolation strategy guided by business logic rather than physical topology.

[0022] An internet data security protection system based on artificial intelligence algorithms includes: Network data acquisition module: collects user behavior data, system operation data and network attack data in the target network in real time, and performs preliminary analysis of unstructured logs; The anomaly detection module has a built-in trained temporal deep learning model that performs sequence analysis on user behavior and system operation data and outputs risk values ​​that characterize network behavior anomalies. Dynamic attack fingerprint construction module: Extracts multi-dimensional features from network attack data and generates structured attack fingerprint vectors through fusion processing; The deep metric learning matching module has a built-in Siamese network or prototype network model to calculate the semantic matching degree between the current attack fingerprint and the historical leaked attack fingerprint; Knowledge Graph Construction and Reasoning Module: Constructs and maintains a cybersecurity knowledge graph, and uses a graph neural network model to perform real-time reasoning on the graph, outputting event association paths and causal probabilities; Reinforcement learning strategy decision-making module: Generates optimal combined defense strategy instructions based on multi-dimensional input states; The adaptive trust assessment and execution module serves as the execution engine for the zero-trust policy: based on dynamic trust scores and decision instructions, it implements fine-grained authentication, access control, and resource isolation operations. The strategy coordination and arbitration module coordinates, routes, and adjudicates conflicts among the outputs of various decision-making and execution modules to ensure the synergy and consistency of the system response.

[0023] In one embodiment, the strategy coordination and arbitration module includes a hierarchical strategy coordination and arbitration mechanism, the specific execution steps of which include: Reception and Unified Quantization: Receive the raw output from the intelligent perception layer. The raw output includes the dynamic matching degree calculated by the deep metric learning matching module, the causal probability and association path output by the knowledge graph construction and reasoning module, and the abnormal risk value output by the anomaly detection module. Input the above heterogeneous data into a pre-trained unified quantization model and map it into a comprehensive threat situation score vector with consistent dimensions and scale. The unified quantization model is as follows: A lightweight, fully connected neural network is trained on historical data to learn how to normalize and fuse inputs from multiple sources and with different dimensions, such as dynamic matching degree, causal probability, and abnormal risk value, into a fixed-length comprehensive threat situation score vector. Each dimension of this vector corresponds to a semantically aligned threat dimension, enabling subsequent scenario judgments to be based on a consistent standard. Multi-dimensional scenario judgment: Based on the comprehensive threat situation scoring vector, real-time business status data and a predefined multi-dimensional scenario rule base, a joint judgment is made. The scenario rule base defines at least the handling scenario categories corresponding to different business sensitive periods, different system load ranges and different combinations of attack types. Dynamic decision routing: Based on the determined handling scenario category and the preset priority mapping table, the macro defense decision request is routed to the corresponding decision engine. The decision engine includes at least the reinforcement learning decision engine, the built-in strategy module of the adaptive trust evaluation engine, and an emergency response engine based on hard-coded rules. Dynamic decision-making routing specifically refers to: Based on the aforementioned scenario category, a dynamically updated priority mapping table is queried, which defines the calling order and weight of each decision engine under different scenarios; For example, in the event of a suspected new type of attack during peak business hours, the reinforcement learning decision engine is invoked first to seek the strategy with the least impact on business. In the event of a known high-risk vulnerability attack, the system is directly routed to the emergency response engine to execute the preset blocking instructions. Multi-engine output arbitration: When multiple routed decision engines output potentially conflicting policy instructions, a conflict arbitration rule set is invoked to resolve the conflict. The rule set is weighted and evaluated based on the instruction's timeliness requirements, scope of impact, execution cost, and policy objectives, and selects or merges them to generate a unique set of executable instructions. The conflict arbitration rule set must include at least the following conflict resolution rules: Timing conflict rule: When different engine instructions conflict with the time requirement of immediate blocking and continuous monitoring of the same object, the immediate blocking instruction with higher timeliness requirements shall be executed first. Permission conflict rules: When there is a conflict between commands that set permissions for the same user that involve escalation and demotion, the principle of least privilege and security priority shall be followed, and the command with stricter permission restrictions shall be executed; Resource operation conflict rules: When an instruction involves mutually exclusive operations such as isolation and rate limiting on the same network resource or server, assess the urgency and impact of the operation, and select the combination of operations that yields the highest benefit under the current overall threat situation; Instruction distribution and supervised execution: The final instruction set after arbitration is distributed to the corresponding execution module, and the execution status and feedback results of the instructions are monitored. For emergency response instructions marked as the highest priority, a bypass channel directly to the execution module is established to ensure their forced execution within milliseconds.

[0024] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and variations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for protecting internet data security based on artificial intelligence algorithms, characterized in that: Includes the following steps: S1. Real-time collection of multi-dimensional security data in the target network, including user behavior data, system operation data, and network attack data; S2. Based on the collected user behavior data and system operation data, use a time-series deep learning model to perform anomaly detection and output anomaly risk values ​​that represent potential security risks. S3. Dynamically construct attack fingerprints from the collected network attack data, extract multi-dimensional features including basic attack attributes, attack payload characteristics, request sequence time patterns and attack tactical identifiers, and form a structured attack fingerprint vector. S4. Using a deep metric learning model, semantically match the currently constructed attack fingerprint vector with the fingerprint vector of historical data leakage attacks, and calculate a dynamic matching degree that represents the similarity between the two in terms of causing data leakage. S5. Construct and maintain a network security knowledge graph. The nodes of the network security knowledge graph include attack events, abnormal events, users, devices and data assets. The edges represent the spatiotemporal and causal relationships between events and entities. When a new attack or abnormal event occurs, use a graph neural network to reason about the knowledge graph and output the associated paths and causal probabilities that the event may lead to data leakage. S6. Based on the dynamic matching degree, the causal probability, the real-time business status and the preset business criticality weight, the reinforcement learning decision engine is used to perform adaptive strategy optimization to generate a combined defense strategy instruction that integrates security effect and business continuity considerations. S7. Through an adaptive trust assessment engine deeply integrated with the zero-trust architecture, based on the combined defense strategy instructions, real-time user behavior baseline, device health status and request context, calculate dynamic trust scores and execute fine-grained access control and access isolation measures.

2. The method according to claim 1, characterized in that, The dynamic attack fingerprint construction specifically includes: Natural language processing techniques are used to parse unstructured attack logs to extract attack tactical identifiers and payload text features; Temporal convolutional network models are used to perform pattern analysis on attack request sequences to capture their stage evolution characteristics; The extracted attack basic attribute features, text features, and time sequence pattern features are fused and vectorized to generate the structured attack fingerprint vector for deep metric learning.

3. The method according to claim 1, characterized in that, S4 specifically includes: The architecture of the deep metric learning model is a Siamese network or a prototype network. The deep metric learning model is trained to learn a complex distance metric function that captures the nonlinear evolution of attack behavior. The deep metric learning model takes the current attack fingerprint vector and the historical attack fingerprint vector as input and directly outputs a matching score in the range of 0 to 1. The matching score dynamically represents the semantic similarity between the current attack and historical attacks known to lead to data leakage.

4. The method according to claim 1, characterized in that, The reasoning using graph neural networks specifically includes: The attack fingerprint vector output by the deep metric learning model is used as the initial feature representation of the corresponding attack event node in the network security knowledge graph. When a new event is injected, a graph attention network model is used to perform multiple rounds of message propagation and feature aggregation along the edges of the graph to infer the potential correlation paths between the new event and historical abnormal risk events and key data assets. The final causal probability is calculated by combining the confidence levels of all associated paths.

5. The method according to claim 1, characterized in that, S6 specifically includes: Construct a reinforcement learning decision model for network security defense; The dynamic matching degree, causal probability, real-time business system status indicators, and predefined business-critical weights of different data assets and system functions are jointly encoded into a state vector representing the current comprehensive situation, which serves as the input to the reinforcement learning decision model. The reinforcement learning decision model selects and combines a set of atomic defense actions from its predefined action space based on the input state vector, and outputs an executable combined defense strategy instruction. During the offline training and online learning phases of the reinforcement learning decision-making model, the long-term value of the selected action is evaluated based on a composite reward function. This composite reward function simultaneously quantifies security benefits and business impacts, guiding the model to learn to make balanced decisions in complex threat environments.

6. The method according to claim 1, characterized in that, Specifically, S7 includes: Receiving and parsing decision instructions: Receive combined defense strategy instructions issued by the reinforcement learning decision engine, and the engine parses the instructions to determine the set of subjects and resource scope to be evaluated and controlled; Aggregate multi-source real-time trust evidence: continuously obtain real-time user behavior baseline and current behavior deviation score from the time-series deep learning model, obtain endpoint security status, software compliance and vulnerability information from the device management agent as device health status indicators, and extract time, geographical location and target resource sensitivity level from access requests to form request context; Calculate the dynamic trust score: The real-time user behavior baseline deviation, device health status score, request context risk value, and risk weight contained in the combined defense strategy instructions are weighted and fused to calculate the dynamic trust score for this specific access session. Implement adaptive access control: compare the calculated dynamic trust score with the dynamic trust threshold of the associated resource sensitivity, and make real-time decisions on allowing access, upgrading the authentication level, restricting the scope of operation, or denying access based on the comparison result and the constraints of the combined defense strategy instructions. Implement dynamic micro-segmentation: When the dynamic trust score is lower than the isolation trigger threshold or the policy instruction explicitly requires it, the reinforcement learning decision engine dynamically generates network isolation policies and access control lists based on the scope of influence inferred from the knowledge graph, and only implements logical isolation for users, devices and server subnets that are identified as threatened or abnormal.

7. An internet data security protection system based on artificial intelligence algorithms, characterized in that, To implement the method of claim 1, the method comprises: Network data acquisition module: collects user behavior data, system operation data and network attack data in the target network in real time, and performs preliminary analysis of unstructured logs; The anomaly detection module has a built-in trained temporal deep learning model that performs sequence analysis on user behavior and system operation data and outputs risk values ​​that characterize network behavior anomalies. Dynamic attack fingerprint construction module: Extracts multi-dimensional features from network attack data and generates structured attack fingerprint vectors through fusion processing; The deep metric learning matching module has a built-in Siamese network or prototype network model to calculate the semantic matching degree between the current attack fingerprint and the historical leaked attack fingerprint; Knowledge Graph Construction and Reasoning Module: Constructs and maintains a cybersecurity knowledge graph, and uses a graph neural network model to perform real-time reasoning on the graph, outputting event association paths and causal probabilities; Reinforcement learning strategy decision-making module: Generates optimal combined defense strategy instructions based on multi-dimensional input states; Adaptive Trust Assessment and Execution Module: Based on dynamic trust scores and decision instructions, it implements fine-grained authentication, access control, and resource isolation operations. The strategy coordination and arbitration module coordinates, routes, and adjudicates conflicts among the outputs of the various decision-making and execution modules.

8. The Internet data security protection system based on artificial intelligence algorithms according to claim 7, characterized in that, The strategy coordination and arbitration module includes a hierarchical strategy coordination and arbitration mechanism. The specific execution steps of the hierarchical strategy coordination and arbitration mechanism include: Reception and Unified Quantization: Receive the raw output from the intelligent perception layer. The raw output includes the dynamic matching degree calculated by the deep metric learning matching module, the causal probability and association path output by the knowledge graph construction and reasoning module, and the abnormal risk value output by the anomaly detection module. Input the above heterogeneous data into a pre-trained unified quantization model and map it into a comprehensive threat situation score vector with consistent dimensions and scale. Multi-dimensional scenario judgment: Based on the comprehensive threat situation scoring vector, real-time business status data, and a predefined multi-dimensional scenario rule base, a joint judgment is made; Dynamic decision routing: Based on the determined handling scenario category and the preset priority mapping table, the macro defense decision request is routed to the corresponding decision engine; Multi-engine output arbitration: When multiple routed decision engines output potentially conflicting policy instructions, a conflict arbitration rule set is invoked to resolve the conflict. The rule set is weighted and evaluated based on the instruction's timeliness requirements, scope of impact, execution cost, and policy objectives, and selects or merges them to generate a unique set of executable instructions. Instruction distribution and execution monitoring: The final instruction set after arbitration is distributed to the corresponding execution module, and the execution status and feedback results of the instructions are monitored. For emergency response instructions marked as the highest priority, a bypass channel directly to the execution module is established.

Images