Artificial intelligence system and method for resisting network attacks

Abstract

A system and method for artificial intelligence to resist network attacks, which includes a user device, an identity authentication device, a server device and a network device. The network device receives multiple network packets transmitted from the user device to the server device, and the network device performs the following steps: the packet filtering unit of the network device receives the network packet and transmits the network packet to the identity authentication device or filters its network packet according to a filtered user database; the identity authentication device receives the network packet, performs identity authentication on the user device that generates the network packet, and transmits the network packet to a server device according to the identity authentication result.

Description

Technical Field

[0001] The present invention relates to an artificial intelligence system and method for resisting network attacks, which utilizes an artificial intelligence model to quickly identify and filter network packets with attack behaviors and can avoid the large amount of computing resource consumption caused by identity authentication. Background Art

[0002] With the rapid development of the Internet, in addition to speeding up the transmission of information, it has also changed the behavior of many industries. In order to ensure security on the Internet, how to prevent network attacks is a major issue. The current way to prevent network attacks is to analyze packets after the attack occurs. Due to the diversification of Internet transmission methods, the single type of network attack behavior in the past has begun to transform into a complex attack behavior or a completely new attack method.

[0003] The existing means of resisting DDoS attacks mainly rely on empirical rules and CDN to smooth traffic to mitigate the damage caused by DDoS attacks. The main design intention of CDN is to improve service quality and increase revenue by adding equipment to provide higher traffic services. However, using CDN to mitigate DDoS attacks will cause users to pay huge costs and require a lot of human resources to analyze attack patterns, formulate rules and avoid conflicts between rules. Therefore, this method of defense is too passive and the defense range is quite limited.

[0004] In addition, some practitioners use communication protocols such as TLS to perform identity authentication to confirm the identities of both parties in order to prevent network equipment from being hacked. However, hackers will take advantage of the time-consuming nature of communication protocols to consume a large amount of computing resources of communication equipment, thereby paralyzing the communication equipment.

[0005] There is another method for filtering malicious traffic intrusion, which mainly imports packets into a detection and filtering device, and the detection and filtering device needs to convert the packets into a traffic picture, and then use the model picture of the known malicious traffic packet to compare and analyze the traffic picture to determine whether the traffic picture conforms to the model picture. However, in addition to the need to first know the model picture of the malicious traffic packet, which increases the filtering process, the conversion process of the packet into the traffic picture relatively consumes its operating efficiency, and the image comparison efficiency also needs to be improved to make an accurate comparison, which also requires additional equipment to improve the operating efficiency, and the detection and filtering equipment also needs to constantly change the traffic picture and the model picture of the malicious traffic packet according to the changes in the malicious packet, which relatively causes trouble in the comparison and analysis.

[0006] Therefore, how to solve the above problems and deficiencies of the prior art is an urgent research and improvement direction for the inventors of the present invention and related manufacturers engaged in this industry. Summary of the invention

[0007] The main purpose of the present invention is to provide an artificial intelligence system and method for resisting network attacks by using an artificial intelligence model to quickly identify and filter network packets with attack behaviors, and to avoid the large amount of computing resource consumption caused by using identity authentication alone.

[0008] Another object of the present invention is to provide an artificial intelligence system and method for resisting network attacks that can significantly reduce costs.

[0009] To achieve the above purpose, the specific technical solutions of the present invention are as follows:

[0010] An artificial intelligence system for defending against cyber attacks, comprising:

[0011] At least one user equipment, the user equipment having user equipment data and generating at least one network packet;

[0012] and a network device, which is connected to the user device and has a packet filtering unit, the packet filtering unit has at least one filtering user database, and the packet filtering unit receives the network packet and transmits the network packet to an identity authentication device or filters its network packet according to its filtering user database, the identity authentication device receives the network packet and performs identity authentication on the user device that generates the network packet, and the identity authentication device transmits the network packet to a server device according to the identity authentication result.

[0013] Furthermore, the network device also includes:

[0014] a packet capture unit connected to the packet filtering unit and capturing network packets transmitted to the identity authentication device;

[0015] a packet storage unit connected to the packet capture unit and storing the network packet;

[0016] a feature extraction unit connected to the packet storage unit and extracting the network packet and parsing the network packet using at least one feature template to generate a behavior feature information and a packet information of the network packet;

[0017] a feature storage unit connected to the feature extraction unit and storing the behavior feature information and the packet information; and

[0018] A processing unit, the processing unit is connected to the feature extraction unit and receives its behavior feature information, and an artificial intelligence model of the processing unit determines whether the behavior feature information of the network packet is normal or malicious and generates a feature information result, and the processing unit transmits the feature information result of the malicious network packet to the packet filtering unit, the packet filtering unit further receives the packet information of the feature storage unit, and the packet filtering unit stores the user device data that generates the malicious network packet into the filtering user database through the feature information result and the packet information.

[0019] Furthermore, the network device also includes an automatic feature labeling unit and a feature automatic labeling storage unit, the automatic feature labeling unit is connected to the feature storage unit, and the automatic feature labeling unit captures the behavior feature information in the feature storage unit and labels it so that the behavior feature information has a feature automatic classification labeling, and the feature automatic labeling storage unit is connected to the automatic feature labeling unit and stores the behavior feature information and the corresponding feature automatic classification labeling, and the feature automatic labeling storage unit is connected to a training unit, and a model to be trained in the training unit captures the behavior feature information and the corresponding feature automatic classification labeling and generates a trained model.

[0020] Furthermore, the network device also includes a comparison unit, which is connected to the training unit and a correct feature labeling storage unit, and the correct feature labeling storage unit stores at least one training feature information and a feature correct classification labeling of the training feature information. The comparison unit extracts the training feature information and the feature correct classification labeling of the correct feature labeling storage unit. The training unit outputs the trained model to the comparison unit, and the trained model extracts the training feature information and outputs a training information result. The comparison unit compares the training information results with the training feature information and the feature correct classification labeling to determine whether to optimize the trained model or output the trained model to the processing unit.

[0021] Furthermore, the network device also includes an optimization unit, which is connected to the comparison unit to perform optimization when the comparison unit decides to optimize the trained model.

[0022] Furthermore, the optimization unit is further connected to the automatic feature annotation unit, so that when the comparison unit decides to optimize the trained model, the optimization unit optimizes the automatic feature annotation unit, and the automatic feature annotation unit generates another set of feature automatic classification annotations.

[0023] Furthermore, the optimization unit is further connected to the feature extraction unit so that when the comparison unit decides to optimize the trained model, the optimization unit enables the feature extraction unit to use another feature template, and the feature extraction unit generates another behavior feature information based on the other feature template.

[0024] An artificial intelligence method for defending against cyber attacks, comprising:

[0025] At least one user device generates at least one network packet to a network device;

[0026] A packet filtering unit of the network device receives the network packet and transmits the network packet to an identity authentication device or filters the network packet according to a filtering user database;

[0027] The identity authentication device receives the network packet, performs identity authentication on the user device that generates the network packet, and transmits the network packet to a server device according to the identity authentication result.

[0028] Furthermore, the steps of receiving the network packet, performing identity authentication on the user device generating the network packet, and transmitting the network packet to a server device according to the identity authentication result include:

[0029] A packet capture unit captures the network packet transmitted to the identity authentication device from the packet filtering unit;

[0030] A packet storage unit stores the network packets captured by the packet capture unit, and a feature capture unit captures the network packets of the packet storage unit and analyzes the network packets with at least one feature template to generate a behavior feature information and a packet information of the network packet and store them in a feature storage unit;

[0031] An artificial intelligence model of the processing unit determines whether the behavior characteristic information of the network packet is normal or malicious and generates a characteristic information result;

[0032] The processing unit transmits the characteristic information result of the malicious network packet to the packet filtering unit, and the packet filtering unit further receives the packet information of the characteristic storage unit, and the packet filtering unit stores the user device data that generates the malicious network packet into the filtering user database through the characteristic information result and the packet information.

[0033] Furthermore, the step of capturing the network packet of the packet storage unit by a feature capturing unit and parsing the network packet with at least one feature template to generate a behavior feature information and a packet information of the network packet includes:

[0034] A feature storage unit stores the behavior feature information of the feature extraction unit, and an automatic feature annotation unit extracts the behavior feature information in the feature storage unit and annotates it so that the behavior feature information has a feature automatic classification annotation;

[0035] A feature automatic labeling storage unit stores the behavior feature information and the corresponding feature automatic classification labeling, and a training unit captures the behavior feature information and the corresponding feature automatic classification labeling to generate a trained model.

[0036] The trained model is output to a comparison unit, and the comparison unit further retrieves the training feature information and a feature correct classification label from the correct feature label storage unit;

[0037] The trained model captures the training feature information and outputs a training information result;

[0038] The comparison unit compares the training information results with the training feature information and the correct feature classification labels to determine whether to optimize the trained model or output the trained model to the processing unit.

[0039] Furthermore, the comparison unit compares the training information results with the training feature information and the correct classification and labeling of the features to determine the step of optimizing the trained model, including:

[0040] The automatic feature labeling unit is optimized by an optimization unit, and the automatic feature labeling unit then extracts the behavior feature information in the feature storage unit and labels it so that the behavior feature information has another set of feature automatic classification labels;

[0041] The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs;

[0042] The model to be trained of the training unit captures the behavior feature information and the corresponding features and automatically classifies and labels them and outputs another trained model;

[0043] The other trained model is output to the comparison unit, and the comparison unit extracts the training feature information and the feature correct classification label;

[0044] The other trained model captures the training feature information and outputs another training information result;

[0045] The comparison unit compares the other training information results with the training feature information and the feature correct classification labels, and outputs the other trained model to the processing unit.

[0046] Furthermore, the comparison unit compares the training information results with the training feature information and the correct classification and labeling of the features to determine the step of optimizing the trained model, including:

[0047] An optimization unit is connected to the feature extraction unit;

[0048] The optimization unit enables the feature extraction unit to use another feature template, and the feature extraction unit generates another behavior feature information according to the another feature template;

[0049] The automatic feature labeling unit then extracts another behavior feature information in the feature storage unit and labels it so that the behavior feature information has another set of feature automatic classification labels;

[0050] The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs;

[0051] The model to be trained of the training unit captures the behavior feature information and the corresponding features and automatically classifies and labels them and outputs another trained model;

[0052] The other trained model is output to the comparison unit, and the comparison unit extracts the training feature information and the feature correct classification label;

[0053] The other trained model captures the training feature information and outputs another training information result;

[0054] The comparison unit compares the other training information results with the training feature information and the feature correct classification labels, and outputs the other trained model to the processing unit.

[0055] Through the above design scheme, the present invention can bring the following beneficial effects:

[0056] 1. Able to quickly identify and filter network packets with attack behaviors;

[0057] 2. Can significantly reduce costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The present invention is further described below with reference to the accompanying drawings and specific embodiments:

[0059] Figure 1 A schematic diagram of the system architecture of the artificial intelligence system for resisting network attacks of the present invention.

[0060] Figure 2 A schematic diagram of the system architecture implementation of the artificial intelligence system for resisting network attacks of the present invention.

[0061] Figure 3 FIG. 2 is a schematic diagram of another system architecture implementation of the artificial intelligence system for resisting network attacks of the present invention.

[0062] Figure 4 Schematic diagram of the content of the behavior characteristic information of the present invention.

[0063] Figure 5 A schematic diagram of another system architecture optimization method for implementing the artificial intelligence system for resisting network attacks of the present invention.

[0064] Figure 6The present invention is a flowchart of the method for artificial intelligence to resist network attacks.

[0065] Figure 7 This is a further flow chart of the method for artificial intelligence to resist network attacks of the present invention.

[0066] Figure 8 The present invention is a flowchart for comparing the artificial intelligence method for resisting network attacks.

[0067] Fig. 9 A flow chart for optimizing the artificial intelligence method for resisting network attacks of the present invention.

[0068] Fig.10 A flowchart for another optimization of the artificial intelligence method for resisting network attacks of the present invention.

[0069] Explanation of the symbols in the figure: 1- artificial intelligence system for resisting network attacks; 2- user equipment; 3- identity authentication equipment; 4- server equipment; 5- network equipment; 51- packet filtering unit; 511- filtering user database; 52- packet capture unit; 521- packet storage unit; 53- feature capture unit; 531- feature template; 532- feature storage unit; 54- processing unit; 541- artificial intelligence model; 55- automatic feature annotation unit; 551- automatic feature annotation storage unit; 56 -training unit; 561-model to be trained; 562-trained model; 57-comparison unit; 58-correct feature annotation storage unit; 59-optimization unit; P1-network packet; I1-behavioral feature information; I2-packet information; R1-feature information result; C1-feature automatic classification and annotation; I3-training feature information; C2-feature correct classification and annotation; S1~S7-steps; S41~S45-steps; S4511~S4516-steps; S4521~S4528-steps. DETAILED DESCRIPTION

[0070] Please refer to Figure 1 and Figure 2As shown, it is a system architecture diagram and a system architecture implementation diagram of the artificial intelligence system for resisting network attacks of the present invention. It can be clearly seen from the figure that the artificial intelligence system 1 for resisting network attacks includes at least one user device 2, an identity authentication device 3, a server device 4 and a network device 5, wherein the identity authentication device 3, the server device 4 and the network device 5 can be independent devices or devices integrated in a single device, and the network device 5 is connected between the user device 2 and the identity authentication device 3. The user device 2 has a user device data and generates at least one network packet P1, and the identity authentication device 3 is connected to the server device 4, and the identity authentication device 3 can be but not limited to a router, a gateway, a repeater or a bridge.

[0071] The network device 5 has a packet filtering unit 51, and the packet filtering unit 51 has at least one filtering user database 511, and the filtering user database 511 records at least one user device data that transmits malicious packet data, and the packet filtering unit 51 captures the network packet P1 flowing from the user device 2 through the identity authentication device 3. After the packet filtering unit 51 captures the network packet P1, it will first filter it according to the user device 2 data in its filtering user database 511. If the user device 2 that transmits the network packet P1 is recorded as the user device 2 data of the malicious packet data, According to the present invention, the packet filtering unit 51 filters the network packet P1. On the contrary, if the user device 2 transmitting the network packet P1 is not the user device 2 data recorded as malicious packet data, the packet filtering unit 51 transmits the captured network packet P1 to the identity authentication device 3. The identity authentication device 3 receives the network packet P1, and performs identity authentication on the user device 2 generating the network packet P1, and transmits the network packet P1 to a server device 4 according to the identity authentication result. The identity authentication device 3 mainly performs authentication through the security protocol connection of the Transport Layer Security (TLS) or the Secure Sockets Layer (SSL) or other identity authentication methods. Therefore, the identity authentication device 3 performs identity authentication on the user device 2 transmitting the network packet P1. If the identity authentication device 3 succeeds in authentication, the identity authentication device 3 transmits the network packet P1 to the server device 4. If the identity authentication device 3 fails in authentication, the network packet P1 will not be transmitted to the server device 4.

[0072] In this way, the artificial intelligence system 1 for resisting network attacks can quickly identify and filter network packets P1 with attacking behavior, so there is no need to add equipment or build more complex equipment to reduce the setup cost. It can also prevent the identity authentication device 3 from being maliciously attacked by the user device 2 that generates the malicious network packet P1 and consuming a large amount of computing resources. The identity authentication device 3 is used for further filtering to make the packets reaching the server device 4 normal packets, thereby blocking the network attack.

[0073] Please refer to Figure 3 , is another system architecture implementation diagram of the artificial intelligence system for resisting network attacks of the present invention, wherein the network device 5 also includes a packet capture unit 52, a packet storage unit 521, a feature capture unit 53 and a processing unit 54 connected in sequence, and the processing unit 54 is further connected to the packet filtering unit 51.

[0074] While the identity authentication device 3 transmits the network packet P1 to the server device 4, the packet capture unit 52 also captures the network packet P1 transmitted to the identity authentication device 3, and the packet capture unit 52 stores the captured network packet P1 in the packet storage unit 521, and the feature capture unit 53 captures the network packet P1 in the packet storage unit 521, and the feature capture unit 53 uses at least one feature template 531 to parse the network packet P1 and generate a behavior feature information I1 and a packet information I2 of the network packet P1, wherein the feature template 531 can be analyzed according to each network packet P1, a fixed number of network packets P1 or the network packets P1 obtained in a fixed time period to obtain the behavior feature information I1. The feature template 531 includes the transmission protocol, capture quantity, header information, transmission port number, transmission time, packet content, transmission speed, transmission direction, TCP flag number, receiving end, packet quantity, packet size, inter-arrival time, data flow activity time, data flow idle time, etc. of the network packet P1 of the user device 2 or the server device 4. Figure 4 As shown, the feature extraction unit 53 obtains the behavior feature information I1 of the network packet P1 through the feature template 531. Figure 4 As shown, the content of the behavior characteristic information I1 and the characteristic template 531, the behavior characteristic information I1 shown is a set of quantitative data, matrix or image. The characteristic template 531 does not limit Figure 4 4 groups in the embodiment.

[0075] After the feature extraction unit 53 generates the behavior feature information I1 and the packet information I2, the feature extraction unit 53 transmits the behavior feature information I1 to the processing unit 54, and transmits the behavior feature information I1 and the packet information I2 to a feature storage unit 532 for storage, and the content of the packet information I2 is the Internet Protocol Address (IP Address) of the network packet P1 and the corresponding behavior feature information I1. The feature storage unit 532 is further connected to the packet filtering unit 51. An artificial intelligence model 541 of the processing unit 54 determines whether the behavior feature information I1 of the network packet P1 is normal or malicious and generates a feature information result R1, wherein the artificial intelligence model 541 is composed of an artificial intelligence algorithm (Artificial Intelligence), and the artificial intelligence algorithm can be but not limited to artificial neural network, decision tree, perceptron, support vector machine, integrated learning, dimensionality reduction and metric learning, clustering, Bayesian classifier or feed forward neural network model (Feed Forward Neural Network The processing unit 54 transmits the characteristic information result R1 of the malicious network packet P1 to the packet filtering unit 51, and the packet filtering unit 51 receives the characteristic information result R1, and the packet filtering unit 51 also receives the packet information I2 of the characteristic storage unit 532, and the packet filtering unit 51 learns the user equipment data that generates the malicious network packet through the characteristic information result R1 and the packet information I2, and the packet filtering unit 51 stores the user equipment data of the malicious network packet in the filtering user database 511, so that when the user equipment 2 that generates the malicious network packet P1 transmits the network packet P1 to the server device 4 again, the packet filtering unit 51 captures the network packet P1, and first filters the user equipment 2 data in the filtering user database 511 according to the user equipment 2 data in the filtering user database 511. On the contrary, if the artificial intelligence model 541 of the processing unit 54 determines that the behavior feature information I1 of the network packet P1 is normal and generates the feature information result R1, the packet filtering unit 51 transmits the network packet P1 generated by the user device 2 that generates the normal network packet P1 to the identity authentication device 3. If the identity authentication device 3 verifies successfully, the identity authentication device 3 transmits the network packet P1 to the server device 4. For example: the artificial intelligence model 541 determines that the behavior feature information I1 is an attack feature or a normal feature, and then transmits the feature information result R1 (the feature information I1 is an attack or normal) to the packet filtering unit 51. The packet filtering unit 51 obtains the Internet Protocol Address (IP Address) of the packet according to the feature information result R1 and the packet information I2.The characteristic information result R1 is an attack, and the Internet Protocol address (IP Address) of the packet, i.e., the user device data of the malicious network packet, is stored in the filtering user database 511 as a blacklist. In the future, packets with the same Internet Protocol address (IP Address) will be filtered by the packet filtering unit 51. Thus, the artificial intelligence system 1 for resisting network attacks can use the artificial intelligence model 541 to quickly identify and filter the network packet P1 with attack behavior. In this way, there is no need to add equipment and build more complex equipment to reduce the setting cost. In addition, the identity authentication device 3 can also judge whether it is a normal network packet P1 or a malicious network packet P1 through the behavior characteristic information I1 parsed by the characteristic template 531 by the artificial intelligence model 541 before the identity authentication stage, and further avoid the problem of consuming a large amount of computing resources due to malicious attacks by the user device 2 that generates the malicious network packet P1. ,

[0076] In addition, the network device 5 further includes an automatic feature annotation unit 55 , an automatic feature annotation storage unit 551 , a training unit 56 , a comparison unit 57 , a correct feature annotation storage unit 58 and an optimization unit 59 .

[0077] The automatic feature annotation unit 55 is connected to the feature storage unit 532, and the automatic feature annotation unit 55 extracts the behavior feature information I1 in the feature storage unit 532, and the automatic feature annotation unit 55 annotates the behavior feature information I1, so that the behavior feature information I1 has a feature automatic classification annotation C1. Specifically, the behavior feature information I1 is classified as a normal feature or a malicious feature by the automatic feature annotation unit 55, wherein the automatic feature annotation unit 55 can be a classifier with a classification algorithm, and the classification algorithm can be but not limited to logistic regression, decision tree, support vector machine (SVM), naive Bayes, near Neighbor algorithm (KNN), etc., and the automatic feature labeling unit 55 transmits the behavior feature information I1 and the corresponding feature automatic classification label C1 to the automatic labeling storage unit, and the automatic labeling storage unit stores the behavior feature information I1 and the corresponding feature automatic classification label C1, and the training unit 56 is connected to the feature automatic labeling storage unit, and the training unit 56 extracts the behavior feature information I1 and the corresponding feature automatic classification label C1 in the automatic labeling storage unit, and the training unit 56 has a model to be trained 561, wherein the model to be trained 561 is composed of an artificial intelligence algorithm (Artificial Intelligence), and the training unit 56 extracts the behavior feature information I1 and the corresponding feature automatic classification label C1 from the model to be trained 561, and the model to be trained 561 generates a trained model 562 through the behavior feature information I1 and the corresponding feature automatic classification label C1.

[0078] The comparison unit 57 is connected to the training unit 56, the correct feature annotation storage unit 58 and the optimization unit 59. The correct feature annotation storage unit 58 stores at least one training feature information I3 and a feature correct classification annotation C2 of the training feature information I3. The training feature information I3 and the feature correct classification annotation C2 are both generated outside the system and pre-stored in the correct feature annotation storage unit 58. The training feature information I2 is equivalent to the behavior feature information, and the feature correct classification annotation C2 indicates that the training feature information I2 is a normal feature or an attack feature. The training feature information I3 and the feature correct classification annotation C2 can be generated and annotated manually or by a device. For example, the classification of the feature correct classification label C2 here is correct and is the standard answer, and the trained model 562 of the training unit 56 is output to the comparison unit 57, and the comparison unit 57 further extracts the training feature information I3 and the feature correct classification label C2 of the correct feature label storage unit 58, and the trained model 562 extracts the training feature information I3 in the comparison unit 57 and outputs a training information result, and the comparison unit 57 compares the training information results with the training feature information I3 and the feature correct classification label C2. If the comparison unit 57 compares the training information result R2 with the training feature information I3 and the feature correct classification label C2, if the training information is consistent with the classification label, then the training information is correct. When the matching rate of the result R2 with the training feature information I3 and the feature correct classification label C2 is higher than the set value, the comparison unit 57 outputs the trained model 562 to the processing unit 54, and the trained model 562 updates the artificial intelligence model 541. On the contrary, if the matching rate of the training information result R2 with the training feature information I3 and the feature correct classification label C2 is lower than the set value, the comparison unit decides to optimize the trained model C1. For example, two training feature information (A) and (B) are assumed by default, and the feature correct classification label corresponding to (A) is normal (○), and the feature correct classification label corresponding to (B) is attack (X). When (A) and (B) are input into the trained model 562, the trained model 562 is The training information result of the training feature information (A) output by the training model 562 is normal (○), and the training information result of the training feature information (B) is normal (○). At this time, the comparison unit 57 compares the training information results and the correct classification and labeling of the features. In this example, the training information result of (A) is normal (○) and the correct classification and labeling of the features is normal (○), which meets the preset requirements. The training information result of (B) is normal (○) but the correct classification and labeling of the features is attack (X), which does not meet the default requirements. The accuracy of the judgment by the trained model 562 is 50%. If the set value needs to be greater than 90%, the comparison unit decides to adjust the automatic feature labeling unit 55. The set value is not limited to greater than 90% and can be adjusted according to the actual situation.The optimization unit 59 optimizes the automatic feature labeling unit 55, and the optimization unit 59 uses a classification algorithm to perform optimization so that the automatic feature labeling unit 55 generates another set of feature automatic classification labels C1 for the behavior feature information I1 by another algorithm or by replacing the labeling parameters. The feature automatic labeling storage unit 551 stores the behavior feature information I1 and the other set of feature automatic classification labels C1 belonging to it. In addition, the to-be-trained model 561 of the training unit 56 captures the behavior feature information I1 and the corresponding feature automatic classification labels C1 and outputs another trained model 562 to the comparison unit 57.

[0079] The comparison unit 57 further extracts the training feature information I3 and the feature correct classification label C2 of the correct feature label storage unit 58, and the trained model 562 extracts the training feature information I3 in the comparison unit 57 and outputs another training information result, and the comparison unit 57 compares the another training information result with the training feature information I3 and the feature correct classification label C2. If the comparison unit 57 compares the classification label between the another training information result and the training feature information I3 and the feature correct classification label C2, if the training information result is consistent with the training feature information I3, the training model 562 outputs another training information result. When the matching rate between the training feature information I3 and the feature correct classification label C2 is higher than the set value, the comparison unit 57 outputs the other trained model 562 to the processing unit 54, and the trained model 562 updates the artificial intelligence model 541. Conversely, if the matching rate between the other training information result and the training feature information I3 and the feature correct classification label C2 is lower than the set value, the comparison unit adjusts the feature automatic classification label C1 again until the matching rate between the training information result and the training feature information I3 and the feature correct classification label C2 is higher than the set value.

[0080] Please also refer to Figure 5 As shown, it is a schematic diagram of another system architecture optimization method for the artificial intelligence system for resisting network attacks of the present invention, wherein the optimization unit 59 has another optimization method, wherein the optimization unit 59 is connected to the feature extraction unit 53, so that when the comparison unit 57 decides to optimize the trained model C1, the optimization unit 59 enables the feature extraction unit 53 to use another feature template 531, and the feature extraction unit 53 generates another behavior feature information I1 based on the another feature template 531 for the optimization unit 59 to change the number or items of the feature template 531, so that the feature extraction unit 53 obtains another behavior feature information I1 of the network packet P1 through the feature template 531, and the automatic feature labeling unit 55 generates another set of feature automatic classification labels C1 from the another behavior feature information I1.

[0081] To clearly explain the operation process of this embodiment, please refer to Figure 6The flowchart of the method for artificial intelligence to resist network attacks of the present invention. The method for artificial intelligence to resist network attacks comprises the following steps:

[0082] Step S1: The user equipment generates a network packet to the network equipment;

[0083] Step S2: The packet filtering unit of the network device receives the network packet and transmits the network packet to the identity authentication device or filters its network packet according to the filtering user database; the packet filtering unit 51 has the filtering user database 511, and the filtering user database 511 records at least one user device 2 data that will transmit malicious packet data, and the packet filtering unit 51 captures the network packet P1 flowing from the user device 2 through the identity authentication device 3, and after the packet filtering unit 51 captures the network packet P1, it will first filter the user data according to the filtering user database 511. The user device 2 data in the library 511 is filtered. If the user device 2 transmitting the network packet P1 is not the user device 2 data recorded as malicious packet data, the packet filtering unit 51 transmits the captured network packet P1 to the identity authentication device 3. Otherwise, it enters step S21: the packet filtering unit filters the network packet and terminates the connection; if the user device 2 transmitting the network packet P1 is recorded as the user device 2 data of malicious packet data, the packet filtering unit 51 filters its network packet P1 and terminates the connection of the user device 2.

[0084] Step S3: The identity authentication device receives the network packet, performs identity authentication on the user device that generates the network packet, and transmits the network packet to the server device based on the identity authentication result; wherein the identity authentication device 3 can verify the user device 2 to which it transmits the network packet P1. If the identity authentication device 3 is successfully authenticated, the identity authentication device 3 transmits the network packet P1 to the server device 4. Otherwise, it enters step S31: the identity authentication device stops transmitting the network packet and terminates the connection. If the identity authentication device 3 fails to verify, the network packet P1 will not be transmitted to the server device 4.

[0085] Thereby, the artificial intelligence system 1 for resisting network attacks can quickly identify and filter network packets P1 with attacking behaviors, so there is no need to add equipment or build more complex equipment to reduce the setup cost. In addition, the identity authentication device 3 is used for further identity authentication to avoid the problem of malicious attacks by user devices 2 that generate malicious network packets P1 and consume a large amount of computing resources.

[0086] Please also refer to Figure 7 This is a further flow chart of the method for artificial intelligence to resist network attacks of the present invention. The following steps are included after step S3:

[0087] Step S4: The packet capture unit captures the network packet transmitted to the identity authentication device from the packet filtering unit; while the identity authentication device 3 transmits the network packet P1 to the server device 4 , the packet capture unit 52 also captures the network packet P1 transmitted to the identity authentication device 3 .

[0088] Step S5: The packet storage unit stores the network packets captured by the packet capture unit, and the feature capture unit captures the network packets of the packet storage unit and parses the network packets with a feature template to generate behavioral feature information and packet information of the network packets and store them in the feature storage unit; the packet capture unit 52 stores the captured network packet P1 in the packet storage unit 521, and the feature capture unit 53 captures the network packet P1 in the packet storage unit 521, and the feature capture unit 53 parses the network packet P1 with a feature template 531 and generates behavioral feature information I1 and packet information I2 of the network packet P1, and the behavioral feature information I1 and packet information I2 generated by the feature capture unit 53 are stored in the feature storage unit 532.

[0089] Step S6: The artificial intelligence model of the processing unit determines whether the behavior characteristic information of the network packet is normal or malicious and generates a characteristic information result; after the feature extraction unit 53 generates the behavior characteristic information I1, the feature extraction unit 53 transmits its behavior characteristic information I1 to the processing unit 54, and the artificial intelligence model 541 of the processing unit 54 determines whether the behavior characteristic information I1 of the network packet P1 is a normal network packet P1 or a malicious network packet P1 and generates a characteristic information result R1.

[0090] Step S7: The processing unit transmits the characteristic information result of the malicious network packet to the packet filtering unit, and the packet filtering unit receives the packet information, and the packet filtering unit generates the user device data of the malicious network packet through the characteristic information result and the packet information and stores it in the filtering user database; the packet filtering unit 51 receives the characteristic information result R1, and the packet filtering unit 51 receives the packet information I2 of the characteristic storage unit, and the packet filtering unit 51 generates the user device data of the malicious network packet (i.e., the Internet Protocol location corresponding to the characteristic information I1) through the characteristic information result R1 (the characteristic information I1 is attack or normal) and the packet information I2 (the characteristic information I1 and the Internet Protocol location corresponding to the characteristic information I1, IP) Protocol location, IP), and the packet filtering unit 51 stores the packet information data of the user device 2 that generates the malicious network packet P1 to the filtering user database 511, so that when the user device 2 that generates the malicious network packet P1 transmits the network packet P1 to the server device 4 again, the packet filtering unit 51 captures the network packet P1 and first filters it according to the user device data in its filtering user database 511. On the contrary, if the artificial intelligence model 541 of the processing unit 54 determines that the behavior feature information I1 of the network packet P1 is normal and generates the feature information result R1, the packet filtering unit 51 transmits the network packet P1 generated by the user device 2 that generates the normal network packet P1 to the identity authentication device 3.

[0091] Thereby, the artificial intelligence system 1 for resisting network attacks can utilize the artificial intelligence model 541 to quickly identify and filter network packets P1 with attacking behaviors, thereby eliminating the need to add equipment and build more complex equipment to reduce setup costs. In addition, during the identity authentication stage, the identity authentication device 3 can also determine whether the network packet P1 is normal or malicious through the behavioral feature information I1 analyzed by the feature template 531 by the artificial intelligence model 541, and further store the user device 2 that generates the malicious network packet P1 in the filtering user database 511 based on the feature information result R1, thereby avoiding the problem of consuming a large amount of computing resources due to malicious attacks by the user device 2 that generates the malicious network packet P1.

[0092] Please also refer to Figure 8 The flowchart of the artificial intelligence method for resisting network attacks of the present invention is shown. The steps of capturing the network packet P1 of the packet storage unit 521 by the feature capture unit 53 and parsing the network packet P1 with the feature template 531 to generate the behavior feature information I1 and the packet information I2 of the network packet P1 include the following steps:

[0093] Step S41: The feature storage unit stores the behavior feature information of the feature extraction unit, and the automatic feature labeling unit extracts the behavior feature information in the feature storage unit and labels it so that the behavior feature information has a feature automatic classification labeling; the feature storage unit 532 stores the behavior feature information I1 generated by the feature extraction unit 53, and the automatic feature labeling unit 55 extracts the behavior feature information I1 in the feature storage unit 532, and the automatic feature labeling unit 55 labels the behavior feature information I1 so that the behavior feature information I1 has a feature automatic classification labeling C1.

[0094] Step S42: The behavior feature information and its corresponding automatic classification label are stored in the feature automatic labeling storage unit, and the model to be trained of the training unit extracts the behavior feature information and its corresponding automatic classification label and generates a trained model; the automatic feature labeling unit 55 transmits the behavior feature information I1 and its corresponding automatic classification label C1 to the automatic labeling storage unit, and the automatic labeling storage unit stores the behavior feature information I1 and its corresponding automatic classification label C1, and the training unit 56 extracts the behavior feature information I1 and its corresponding automatic classification label C1 in the automatic labeling storage unit, and the training unit 56 extracts the behavior feature information I1 and its corresponding automatic classification label C1 from the model to be trained 561, and the model to be trained 561 generates a trained model 562 through the behavior feature information I1 and its corresponding automatic classification label C1.

[0095] Step S43: The trained model is output to the comparison unit, and the comparison unit further retrieves the training feature information and the feature correct classification label of the correct feature label storage unit; wherein the trained model 561 is output to the comparison unit 57, and the comparison unit 57 further retrieves the training feature information I2 and the feature correct classification label C2 of the correct feature label storage unit 58.

[0096] Step S44: The trained model captures the training feature information and outputs the training information result; the trained model 562 captures the training feature information I3 in the comparison unit 57 and outputs the training information result.

[0097] Step S45: The comparison unit compares the training information results with the training feature information and the feature correct classification label to decide whether to optimize the trained model or output the trained model to the processing unit; and the comparison unit 57 compares the training information results with the training feature information I3 and the feature correct classification label C2. If the comparison unit 57 compares the classification labels between the training information results and the training feature information I3 and the feature correct classification label C2 to see whether they are consistent, if the matching rate between the training information results and the training feature information I3 and the feature correct classification label C2 is higher than the set value, the comparison unit 57 outputs the trained model 562 to the processing unit 54.

[0098] Please also refer to Fig. 9 The figure is a flowchart of optimizing the artificial intelligence defense network attack method of the present invention. The comparison unit 57 compares the training information results R2 with the training feature information I2 and the feature correct classification label C2 to determine the steps of optimizing the trained model C1, including the following steps:

[0099] Step S4511: The optimization unit optimizes the automatic feature labeling unit, and the automatic feature labeling unit then extracts the behavioral feature information in the feature storage unit and labels it so that the behavioral feature information has another set of feature automatic classification labels; if the matching rate between the training information result and the training feature information I3 and the feature correct classification labeling C2 is lower than the set value, the comparison unit 57 decides to optimize the trained model C1, and the optimization unit 59 optimizes the automatic feature labeling unit 55, and the optimization unit 59 uses a classification algorithm to perform optimization so that the automatic feature labeling unit 55 generates another set of feature automatic classification labels C1 for the behavioral feature information I1 by another algorithm or by replacing the labeling parameters.

[0100] Step S4512: The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs; and the feature automatic labeling storage unit 551 stores the behavior feature information I1 and another set of feature automatic classification labels C1 to which it belongs.

[0101] Step S4513: The model to be trained of the training unit captures the behavior feature information and the corresponding features, automatically classifies and labels them, and outputs another trained model; the model to be trained 561 of the training unit 56 captures the behavior feature information I1 and the corresponding features, automatically classifies and labels them C1, and outputs another trained model 562.

[0102] Step S4514: The other trained model is output to the comparison unit, and the comparison unit further extracts the training feature information and the feature correct classification label of the correct feature label storage unit; the other trained model 562 of the training unit 56 is output to the comparison unit 57, and the comparison unit 57 further extracts the training feature information I3 and the feature correct classification label C2 of the correct feature label storage unit 58.

[0103] Step S4515: the other trained model captures the training feature information and outputs another training information result; and the other trained model 562 captures the training feature information I3 in the comparison unit 57 and outputs another training information result.

[0104] Step S4516: The comparison unit compares the other training information results with the training feature information and the feature correct classification label, and outputs the other trained model to the processing unit; the comparison unit 57 compares the other training information results with the training feature information I3 and the feature correct classification label C2. If the comparison unit 57 compares whether the classification labels between the other training information result and the training feature information I3 and the feature correct classification label C2 are consistent, if the matching rate between the training information result and the training feature information I3 and the feature correct classification label C2 is higher than the set value, the comparison unit 57 outputs the other trained model 562 to the processing unit 54, and the trained model 562 updates the artificial intelligence model 541. Conversely, if the matching rate between the other training information result and the training feature information I3 and the feature correct classification label C2 is lower than the set value, the comparison unit 57 adjusts the feature automatic classification label C1 again until the matching rate between the training information result and the training feature information I3 and the feature correct classification label C2 is higher than the set value.

[0105] Please also refer to Fig.10 As shown, it is a flowchart of another optimization of the artificial intelligence defense network attack method of the present invention. The comparison unit 57 compares the training information results R2 with the training feature information I2 and the feature correct classification label C2 to determine the steps of optimizing the trained model C1, including the following steps:

[0106] Step S4521 : The optimization unit is connected to the feature extraction unit; wherein the optimization unit 59 is connected to the feature extraction unit 53 .

[0107] Step S4522: The optimization unit enables the feature extraction unit to use another feature template, and the feature extraction unit generates another behavior feature information based on the another feature template; when the comparison unit 57 decides to optimize the trained model C1, the optimization unit 59 enables the feature extraction unit 53 to use another feature template 531, and the feature extraction unit 53 generates another behavior feature information I1 based on the another feature template 531. The optimization unit 59 changes the number or items of the feature template 531, so that the feature extraction unit 53 obtains another behavior feature information I1 of the network packet P1 through the feature template 531.

[0108] Step S4523: The automatic feature labeling unit then extracts another behavior feature information in the feature storage unit and labels it so that the behavior feature information has another set of feature automatic classification labels; the automatic feature labeling unit 55 generates another set of feature automatic classification labels C1 from the other behavior feature information I1.

[0109] Step S4524: The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs; the feature automatic labeling storage unit 551 stores the behavior feature information I1 and another set of feature automatic classification labels C1 to which it belongs.

[0110] Step S4525: The model to be trained of the training unit captures the behavior feature information and the corresponding features, automatically classifies and labels them, and outputs another trained model; the model to be trained 561 of the training unit 56 captures the behavior feature information I1 and the corresponding features, automatically classifies and labels them C1, and outputs another trained model 562.

[0111] Step S4526: The other trained model is output to the comparison unit, and the comparison unit captures the training feature information and the feature correct classification label; the other trained model 562 of the training unit 56 is output to the comparison unit 57, and the comparison unit 57 further captures the training feature information I3 and the feature correct classification label C2 of the correct feature label storage unit 58.

[0112] Step S4527: the other trained model captures the training feature information and outputs another training information result; and the other trained model 562 captures the training feature information I3 in the comparison unit 57 and outputs another training information result.

[0113] Step S4528: The comparison unit compares the other training information results with the training feature information and the feature correct classification label, and outputs the other trained model to the processing unit; the comparison unit 57 compares the other training information results with the training feature information I3 and the feature correct classification label C2. If the comparison unit 57 compares whether the classification labels between the other training information result and the training feature information I3 and the feature correct classification label C2 are consistent, if the matching rate between the training information result and the training feature information I3 and the feature correct classification label C2 is higher than the set value, the comparison unit 57 outputs the other trained model 562 to the processing unit 54, and the trained model 562 updates the artificial intelligence model 541. Conversely, if the matching rate between the other training information result and the training feature information I3 and the feature correct classification label C2 is lower than the set value, the comparison unit 57 adjusts the feature automatic classification label C1 again until the matching rate between the training information result and the training feature information I3 and the feature correct classification label C2 is higher than the set value.

[0114] Thereby, the artificial intelligence system 1 for resisting network attacks can utilize the artificial intelligence model 541 to quickly identify and filter network packets P1 with attacking behaviors, thereby eliminating the need to add equipment and build more complex equipment to reduce setup costs. In addition, during the identity authentication stage, the identity authentication device 3 can also determine whether the network packet P1 is normal or malicious through the behavioral feature information I1 analyzed by the feature template 531 by the artificial intelligence model 541, and further store the user device 2 that generates the malicious network packet P1 in the filtering user database 511 based on the feature information result R1, thereby avoiding the problem of consuming a large amount of computing resources due to malicious attacks by the user device 2 that generates the malicious network packet P1.

Claims

1. An artificial intelligence system for defending against network attacks, characterized in that: The device comprises at least one user equipment, wherein the user equipment has user equipment data and generates at least one network packet; and a network device, the network device is connected to the user device, and the network device has a packet filtering unit, the packet filtering unit has at least one filtering user database, and the packet filtering unit receives the network packet and transmits the network packet to an identity authentication device or filters the network packet according to its filtering user database, the identity authentication device receives the network packet, and performs identity authentication on the user device that generates the network packet, and the identity authentication device transmits the network packet to a server device according to the identity authentication result; The network device also includes: a packet capture unit connected to the packet filtering unit and capturing network packets transmitted to the identity authentication device; a packet storage unit connected to the packet capture unit and storing the network packet; a feature extraction unit connected to the packet storage unit and extracting the network packet and parsing the network packet using at least one feature template to generate a behavior feature information and a packet information of the network packet; a feature storage unit connected to the feature extraction unit and storing the behavior feature information and the packet information; and a processing unit, the processing unit is connected to the feature extraction unit and receives its behavior feature information, and an artificial intelligence model of the processing unit determines whether the behavior feature information of the network packet is normal or malicious and generates a feature information result, and the processing unit transmits the feature information result of the malicious network packet to the packet filtering unit, the packet filtering unit further receives the packet information of the feature storage unit, and the packet filtering unit stores the user device data that generates the malicious network packet in the filtering user database through the feature information result and the packet information; The network device also includes an automatic feature annotation unit and a feature automatic annotation storage unit, the automatic feature annotation unit is connected to the feature storage unit, and the automatic feature annotation unit captures the behavior feature information in the feature storage unit and annotates it, so that the behavior feature information has a feature automatic classification annotation, and the feature automatic annotation storage unit is connected to the automatic feature annotation unit and stores the behavior feature information and the corresponding feature automatic classification annotation, and the feature automatic annotation storage unit is connected to a training unit, and a to-be-trained model of the training unit captures the behavior feature information and the corresponding feature automatic classification annotation and generates a trained model; The network device further comprises a comparison unit, the comparison unit being connected to the training unit and a correct feature annotation storage unit, the correct feature annotation storage unit storing at least one training feature information and a correct feature classification annotation of the training feature information, and the comparison unit extracts the training feature information and the correct feature classification annotation of the correct feature annotation storage unit, and the training unit outputs the trained model to the comparison unit, and the trained model extracts the training feature information and outputs a training information result, and the comparison unit compares the training information results with the training feature information and the correct feature classification annotation to determine whether to optimize the trained model or output the trained model to the processing unit; The network device further comprises an optimization unit connected to the comparison unit to perform optimization when the comparison unit decides to optimize the trained model; The optimization unit is further connected to the feature extraction unit so that when the comparison unit decides to optimize the trained model, the optimization unit enables the feature extraction unit to use another feature template, and the feature extraction unit generates another behavior feature information according to the other feature template.

2. The artificial intelligence system for resisting network attacks according to claim 1, characterized in that: The optimization unit is further connected to the automatic feature annotation unit, so that when the comparison unit decides to optimize the trained model, the optimization unit optimizes the automatic feature annotation unit, and the automatic feature annotation unit generates another set of feature automatic classification annotations.

3. An artificial intelligence method for resisting network attacks, characterized in that: At least one user device generates at least one network packet to a network device; A packet filtering unit of the network device receives the network packet and transmits the network packet to an identity authentication device or filters the network packet according to a filtering user database; The identity authentication device receives the network packet, performs identity authentication on the user device that generates the network packet, and transmits the network packet to a server device according to the identity authentication result; The steps of receiving the network packet, performing identity authentication on the user device generating the network packet, and transmitting the network packet to a server device according to the identity authentication result include: A packet capture unit captures the network packet transmitted to the identity authentication device from the packet filtering unit; A packet storage unit stores the network packets captured by the packet capture unit, and a feature capture unit captures the network packets of the packet storage unit and analyzes the network packets with at least one feature template to generate a behavior feature information and a packet information of the network packet and store them in a feature storage unit; An artificial intelligence model of the processing unit determines whether the behavior characteristic information of the network packet is normal or malicious and generates a characteristic information result; The processing unit transmits the characteristic information result of the malicious network packet to the packet filtering unit, and the packet filtering unit further receives the packet information of the characteristic storage unit, and the packet filtering unit stores the user device data that generates the malicious network packet in the filtering user database through the characteristic information result and the packet information; The step of capturing a network packet from a packet storage unit by a feature capturing unit and parsing the network packet using at least one feature template to generate a behavior feature information and a packet information of the network packet comprises: A feature storage unit stores the behavior feature information of the feature extraction unit, and an automatic feature annotation unit extracts the behavior feature information in the feature storage unit and annotates it so that the behavior feature information has a feature automatic classification annotation; A feature automatic labeling storage unit stores the behavior feature information and the corresponding feature automatic classification labeling, and a training unit captures the behavior feature information and the corresponding feature automatic classification labeling to generate a trained model. The trained model is output to a comparison unit, and the comparison unit further retrieves the training feature information and a feature correct classification label from the correct feature label storage unit; The trained model captures the training feature information and outputs a training information result; The comparison unit compares the training information results with the training feature information and the correct feature classification labels to determine whether to optimize the trained model or output the trained model to the processing unit; The step of comparing the training information results with the training feature information and the correct classification and labeling of the features to determine the optimization of the trained model includes: An optimization unit is connected to the feature extraction unit; The optimization unit enables the feature extraction unit to use another feature template, and the feature extraction unit generates another behavior feature information according to the another feature template; The automatic feature labeling unit then extracts another behavior feature information in the feature storage unit and labels it so that the behavior feature information has another set of feature automatic classification labels; The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs; The model to be trained of the training unit captures the behavior feature information and the corresponding features and automatically classifies and labels them and outputs another trained model; The other trained model is output to the comparison unit, and the comparison unit extracts the training feature information and the feature correct classification label; The other trained model captures the training feature information and outputs another training information result; The comparison unit compares the other training information results with the training feature information and the feature correct classification labels, and outputs the other trained model to the processing unit.

4. The artificial intelligence method for resisting network attacks according to claim 3 is characterized in that: The step of comparing the training information results with the training feature information and the correct classification and labeling of the features to determine the optimization of the trained model includes: The automatic feature labeling unit is optimized by an optimization unit, and the automatic feature labeling unit then extracts the behavior feature information in the feature storage unit and labels it so that the behavior feature information has another set of feature automatic classification labels; The feature automatic labeling storage unit stores the behavior feature information and another set of feature automatic classification labels to which it belongs; The model to be trained of the training unit captures the behavior feature information and the corresponding features and automatically classifies and labels them and outputs another trained model; The other trained model is output to the comparison unit, and the comparison unit extracts the training feature information and the feature correct classification label; The other trained model captures the training feature information and outputs another training information result; The comparison unit compares the other training information results with the training feature information and the feature correct classification labels, and outputs the other trained model to the processing unit.

Images