A network security defect detection method and system based on AI technology

Abstract

The present invention provides a network security defect detection method and system based on AI technology, which relates to the field of network security detection technology. The method includes: obtaining a data packet, the data packet includes communication data of a network to be detected; preprocessing the data packet to obtain first feature data, the first feature data includes feature data between a source IP and a destination IP; obtaining a first feature graph according to the first feature data; using a self-attention mechanism to learn the weights of feature information of neighboring nodes of the first feature graph, using the learned weights to weight the feature information of each neighboring node, and combining the first feature graph with the input to a pre-trained neural network model to output a detection result. The present invention improves the neural network model by introducing an attention mechanism to update the feature state of a central node, and can better express the influence of the central node on the neighboring nodes.

Description

Technical Field

[0001] The present invention relates to the field of network security detection technology, and in particular to a network security defect detection method and system based on AI technology. Background Art

[0002] At present, botnets are one of the main threats to network security. Botnets refer to computer groups centrally controlled by hackers. Their core feature is that hackers can manipulate hosts infected with Trojans or zombie programs to perform the same malicious behavior through a one-to-many command and control channel. When infected Trojans or zombie programs penetrate into the network, it is easy to cause the leakage of related sensitive information. At present, attackers prefer to use P2P technology, which is more concealed and threatening, to create botnets. Therefore, the detection of P2P botnets has become a hot research topic. The existing detection methods for P2P botnets are difficult to detect large amounts of data and encrypted traffic. Summary of the invention

[0003] The purpose of the present invention is to provide a network security defect detection method and system based on AI technology to improve the above-mentioned problems.

[0004] In order to achieve the above objectives, the present application provides the following technical solutions:

[0005] On the one hand, an embodiment of the present application provides a network security defect detection method based on AI technology, the method comprising:

[0006] Acquire a data packet, wherein the data packet includes communication data of a network to be detected;

[0007] Preprocessing the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP;

[0008] Obtaining a first feature map according to the first feature data;

[0009] The self-attention mechanism is used to learn the weights of the neighboring node feature information of the first feature map, and the learned weights are used to weight the feature information of each neighboring node. The first feature map is combined with the input into a pre-trained neural network model to output the detection result.

[0010] In a second aspect, an embodiment of the present application provides a network security defect detection system based on AI technology, the system comprising:

[0011] An acquisition module, used for acquiring a data packet, wherein the data packet includes communication data of a network to be detected;

[0012] A first processing module, used for preprocessing the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP;

[0013] A second processing module, used for obtaining a first feature map according to the first feature data;

[0014] A detection module is used to use a self-attention mechanism to learn the weights of the feature information of neighboring nodes of the first feature map, use the learned weights to weight the feature information of each neighboring node, and combine the first feature map with the input into a pre-trained neural network model to output the detection result.

[0015] In a third aspect, an embodiment of the present application provides a network security defect detection device based on AI technology, the device comprising a memory and a processor. The memory is used to store a computer program; the processor is used to implement the steps of the above-mentioned network security defect detection method based on AI technology when executing the computer program.

[0016] In a fourth aspect, an embodiment of the present application provides a readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned network security defect detection method based on AI technology are implemented.

[0017] The beneficial effects of the present invention are:

[0018] Compared with the prior art, the present invention pre-processes the communication data included in the data packet, extracts the features of the nodes to produce a feature graph, extracts the features between the nodes by introducing the attention mechanism, realizes the node status update, learns the botnet features, and completes the detection of the botnet by classifying the nodes. The present invention does not rely on the traffic protocol features, integrates the information of the P2P botnet node interaction features and the network topology structure to realize the detection of the botnet with a large amount of data, and introduces the attention mechanism to weight the feature information of each neighboring node, effectively solving the problem that the central node is influenced differently by the neighboring nodes, and provides a method with high accuracy for detecting the P2P botnet.

[0019] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or be understood by implementing the embodiments of the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 This is a flow chart of the network security defect detection method based on AI technology described in an embodiment of the present invention.

[0022] Figure 2 This is a schematic diagram of the structure of the network security defect detection system based on AI technology described in an embodiment of the present invention.

[0023] Figure 3 Schematic diagram of the structure of the network security defect detection device based on AI technology described in an embodiment of the present invention.

[0024] Markings in the figure: 901, acquisition module; 902, first processing module; 903, second processing module; 904, detection module; 9021, first acquisition unit; 9022, first processing unit; 9023, filtering unit; 9031, second acquisition unit; 9032, conversion unit; 9033, second processing unit; 9034, third processing unit; 9035, fusion unit; 9041, calculation unit; 9042, fourth processing unit; 9011, third acquisition unit; 9012, training unit; 9013, testing unit; 800, network security defect detection device based on AI technology; 801, processor; 802, memory; 803, multimedia component; 804, I / O interface; 805, communication component. DETAILED DESCRIPTION

[0025] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. The components of the embodiments of the present invention generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present invention provided in the drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0026] It should be noted that similar reference numerals and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings. At the same time, in the description of the present invention, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance.

[0027] Example 1

[0028] like Figure 1 As shown, this embodiment provides a network security defect detection method based on AI technology, which includes step S1, step S2, step S3 and step S4.

[0029] Step S1, obtaining a data packet, wherein the data packet includes communication data of a network to be detected;

[0030] It can be understood that the present application obtains communication data in the form of captured data packets. In the specific process, the host can be used as the object to obtain the communication data between it and other hosts, or the entire network under test can be used as the research object to obtain the communication data between the external host and the internal host of the network under test.

[0031] It can be understood that step S11, step S12 and step S13 are included before step S1.

[0032] Step S11, obtaining a training set and a test set, wherein the training set includes a sample set representing normal network traffic and a sample set representing botnet traffic, and traffic data of a preset proportion of the sample set representing normal network traffic and the sample set representing botnet traffic is used as the training set;

[0033] It is understandable that the sample set representing normal network traffic and the sample set representing botnet traffic have a preset percentage of traffic data as the training set, where the preset percentage can be flexibly set according to the actual situation. For example, in the sample set representing botnet traffic, the normal network data included can be 500,000. In the sample set representing botnet traffic, the botnet data included can be 500,000. If the preset percentage is 70%, 350,000 normal network data and 350,000 botnet data constitute the training data set; the remaining 150,000 normal network data and the remaining 150,000 botnet data constitute the test data set.

[0034] Step S12: training the neural network model using the traffic samples in the training set to obtain trained traffic data;

[0035] Step S13: testing the trained neural network model using the traffic data in the test set to obtain a trained and tested neural network model.

[0036] It can be understood that the trained neural network model is tested using the traffic data in the test set to detect the accuracy of the model. When the accuracy of the model detection result is greater than the preset threshold, it means that the model has completed the test training, that is, a neural network model that can detect P2P botnets is obtained.

[0037] Step S2, preprocessing the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP;

[0038] It can be understood that step S2 includes step S21, step S22 and step S23, wherein:

[0039] S21, obtaining preset filtering rules;

[0040] It is understandable that by establishing some basic filtering rules to simply filter the captured data packet set, it is possible to filter the communication data of some mainstream websites, such as removing ARP protocol data packets. Establishing basic filtering rules is a technology well known to technical personnel in this field, so it will not be repeated here.

[0041] S22, performing deduplication processing on the data packet to obtain a deduplicated data packet;

[0042] It is understandable that there is a large amount of duplicate data in the original data. If it is analyzed directly, the duplicate data will interfere with the results and affect the detection effect. Therefore, the original data should be deduplicated to reduce data redundancy, reduce the calculation amount of the model, and improve the efficiency of detecting P2P botnets.

[0043] S23. Filter the communication data in the data packet after deduplication according to the filtering rule to obtain first characteristic data.

[0044] It is understandable that as the scene increases, there will be a sharp increase in the traffic generated by normal hosts. For the detection of botnets, normal traffic often interferes with the detection results. The amount of data generated by normal hosts when accessing web pages, uploading files, accessing web pages, and watching videos is very large, while the amount of data generated by zombie hosts when obtaining update information or obtaining control commands is very small. In order to improve the detection efficiency of the system, when the obtained botnet data comes from the actual network, the data packets should be filtered in combination with the whitelist before model training to remove part of the normal traffic. In normal network scenarios, the proportion of C&C (command and control channel) traffic data of botnets is very small, while the amount of normal traffic data can generally reach dozens or even hundreds of times the scale of zombie traffic. By filtering out some obvious normal traffic, the sample set ratio can be optimized to a certain extent, and the sample quality can be improved, thereby obtaining a higher detection rate in subsequent training and detection steps.

[0045] Step S3, obtaining a first characteristic graph according to the first characteristic data;

[0046] It can be understood that step S3 includes step S31, step S32, step S33, step S34 and step S35, wherein:

[0047] Step S31, obtaining node information of each node and node betweenness centrality information of each node, wherein the node information includes out-degree information and in-degree information of each node;

[0048] Step S32: using a graph analysis algorithm to convert the first feature data into a second feature graph, wherein the second feature graph includes a topological relationship of each node;

[0049] It can be understood that the first feature data includes two attributes, source IP and destination IP. Based on the graph analysis algorithm, the hosts that communicate with each other in the PCAP data packet are used as nodes of the graph, and the connection relationship between the hosts is used as the edge of the graph to construct a topological graph, that is, the second feature graph, which is specifically:

[0050] Ge=(V,E)

[0051] In the above formula, V is the set of nodes in the graph {v1,v2,···,v n}, E∈R n×n is the node adjacency matrix, whose element e ij =1 is node V i With V j There is direct communication between them.

[0052] Step S33: obtaining a third feature graph according to the second feature graph and the node information, wherein the third feature graph includes a weight between each node;

[0053] It can be understood that according to the two attributes of the out-degree information and in-degree information of each node, the in-degree is used as the weight between the nodes in the graph based on the topological graph structure to construct the in-degree graph, that is, the third characteristic graph, which is specifically:

[0054] Gd=(V,D)

[0055] In the above formula, D = diag (d1, d2, ···, d n ) is the node in-degree matrix, which represents the degree of the corresponding node.

[0056] Step S34, obtaining a fourth feature graph according to the second feature graph and the node betweenness centrality information, wherein the fourth feature graph includes a centrality coefficient of each node;

[0057] It can be understood that betweenness centrality reflects the dependency relationship between two non-adjacent nodes and is a useful feature for detecting P2P botnets. Therefore, based on the node betweenness centrality, the node betweenness centrality is used as the weight between nodes based on the topological graph to construct the betweenness centrality graph, i.e., the fourth characteristic graph, which is specifically:

[0058]

[0059] In the above formula, B v is the centrality coefficient of node V, σ ij From the node V i To Node V j The total number of shortest paths, σ ij (v) is the total number of shortest paths passing through node v.

[0060] Step S35: Fusing the second feature map, the third feature map and the fourth feature map to obtain the first feature map.

[0061] It can be understood that in the graph fusion process, the adjacency matrix of each graph is first standardized, and then the adjacency matrices of different graphs are weighted and summed by element product to combine different graphs. In order to keep the fusion result after the weighted sum operation normalized, a SoftMax operation is added to the weighted matrix. The graph fusion process can be expressed as:

[0062]

[0063] In the above formula, ω' i is the i weight on an edge, ° represents the element-wise multiplication operation, G is the graph obtained by graph fusion, i.e., the first feature graph, A i ' is the normalized adjacency matrix.

[0064] In this embodiment, communication data is converted into feature graphs, and feature extraction is performed on the feature graphs without relying on traffic protocol features. The P2P botnet node interaction features and network topology information are integrated to achieve detection of botnets with large data volumes.

[0065] Step S4: Use the self-attention mechanism to learn the weights of the neighboring node feature information of the first feature map, use the learned weights to weight each of the neighboring node feature information, and combine the first feature map with the input into a pre-trained neural network model to output the detection result.

[0066] It can be understood that before step S4, step S41 and step S42 are included, wherein:

[0067] Step S41: Calculate the first feature graph using a neural collaborative filtering algorithm to obtain a first feature vector, where the first feature vector includes the similarity between each neighboring node and the central node;

[0068] Step S42: performing a normalization operation on the first feature vector to obtain a weight for weighted calculation.

[0069] In this embodiment, the weights corresponding to all neighboring nodes in a domain order are the same, which cannot reflect the difference in the influence of neighboring nodes on the central node, which may lead to inaccurate detection of P2P botnets, and when the number of nodes is small, the graph convolution model is prone to overfitting. Therefore, the attention mechanism is introduced to improve the method of updating the feature state of the central node in the graph convolution model, which can better extract node features, and the obtained weight parameters have better explanatory power. Therefore, this application calculates the first feature vector by using the neural collaborative filtering algorithm to obtain the first feature vector, and performs a normalization operation on the first feature vector to obtain the weighted calculated weight, and finally performs a weighted summation on the neighboring node features, which is specifically:

[0070]

[0071] In the above formula, X i (l) is the neighbor node feature matrix obtained by weighted summation, The similarity between the central node and its neighboring nodes is measured by introducing the attention mechanism to weight the feature information of each neighboring node, which effectively solves the problem that the central node is influenced differently by its neighboring nodes, and provides a high-accuracy method for detecting P2P botnets.

[0072] It can be understood that by combining the vulnerability information of the botnet, i.e., the communication data, the neural network can learn the characteristics of the P2P botnet, thereby realizing the automated detection of the P2P botnet with a high accuracy. The infected Trojans or zombie programs in the botnet infiltrate the network and cause the leakage of sensitive information of the enterprise. Through this application, the botnet can be detected quickly and automatically to prevent the leakage of sensitive information.

[0073] Example 2

[0074] like Figure 2 As shown, this embodiment provides a network security defect detection system based on AI technology, the system includes an acquisition module 901, a first processing module 902, a second processing module 903 and a detection module 904, wherein:

[0075] An acquisition module 901 is used to acquire a data packet, wherein the data packet includes communication data of a network to be detected;

[0076] A first processing module 902, configured to pre-process the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP;

[0077] A second processing module 903, configured to obtain a first feature map according to the first feature data;

[0078] The detection module 904 is used to use the self-attention mechanism to learn the weights of the neighboring node feature information of the first feature graph, use the learned weights to weight each of the neighboring node feature information, and combine the first feature graph with the input into a pre-trained neural network model to output the detection results.

[0079] In a specific implementation of the present disclosure, the first processing module 902 includes a first acquisition unit 9021, a first processing unit 9022 and a filtering unit 9023, wherein:

[0080] A first acquisition unit 9021 is used to acquire a preset filtering rule;

[0081] A first processing unit 9022, configured to perform deduplication processing on the data packet to obtain a deduplicated data packet;

[0082] The filtering unit 9023 is used to filter the communication data in the data packet after deduplication according to the filtering rule to obtain the first characteristic data.

[0083] In a specific implementation of the present disclosure, the second processing module 903 includes a second acquisition unit 9031, a conversion unit 9032, a second processing unit 9033, a third processing unit 9034 and a fusion unit 9035, wherein:

[0084] The second acquisition unit 9031 is used to acquire node information of each node and node betweenness centrality information of each node, wherein the node information includes out-degree information and in-degree information of each node;

[0085] A conversion unit 9032, configured to convert the first feature data into a second feature graph using a graph analysis algorithm, wherein the second feature graph includes a topological relationship of each node;

[0086] A second processing unit 9033 is used to obtain a third feature graph according to the second feature graph and the node information, wherein the third feature graph includes a weight between each node;

[0087] A third processing unit 9034 is used to obtain a fourth feature graph according to the second feature graph and the node betweenness centrality information, wherein the fourth feature graph includes a centrality coefficient of each node;

[0088] The fusion unit 9035 is used to fuse the second feature map, the third feature map and the fourth feature map to obtain the first feature map.

[0089] In a specific implementation of the present disclosure, the detection module 904 includes a calculation unit 9041 and a fourth processing unit 9042, wherein:

[0090] A calculation unit 9041 is used to calculate the first feature graph using a neural collaborative filtering algorithm to obtain a first feature vector, where the first feature vector includes a similarity between each neighboring node and the central node;

[0091] The fourth processing unit 9042 is used to perform a normalization operation on the first feature vector to obtain a weight for weighted calculation.

[0092] In a specific implementation of the present disclosure, the acquisition module 901 includes a third acquisition unit 9011, a training unit 9012 and a testing unit 9013, wherein:

[0093] The third acquisition unit 9011 is used to acquire a training set and a test set, wherein the training set includes a sample set representing normal network traffic and a sample set representing botnet traffic, and traffic data of a preset proportion of the sample set representing normal network traffic and the sample set representing botnet traffic is used as the training set;

[0094] A training unit 9012, configured to train a neural network model using traffic samples in the training set to obtain trained traffic data;

[0095] The testing unit 9013 is used to test the trained neural network model through the traffic data in the test set to obtain a trained and tested neural network model.

[0096] Example 3

[0097] Corresponding to the above method embodiments, the embodiments of the present disclosure also provide a network security defect detection device based on AI technology. The network security defect detection device based on AI technology described below and the network security defect detection method based on AI technology described above can be referenced to each other.

[0098] Figure 3 FIG. 8 is a block diagram of a network security defect detection device 800 based on AI technology according to an exemplary embodiment. Figure 3 As shown, the network security defect detection device 800 based on AI technology may include: a processor 801, a memory 802. The network security defect detection device 800 based on AI technology may also include one or more of a multimedia component 803, an input / output (I / O) interface 804, and a communication component 805.

[0099] The processor 801 is used to control the overall operation of the network security defect detection device 800 based on AI technology to complete all or part of the steps in the network security defect detection method based on AI technology. The memory 802 is used to store various types of data to support the operation of the network security defect detection device 800 based on AI technology. These data may include, for example, instructions for any application or method operating on the network security defect detection device 800 based on AI technology, as well as application-related data, such as contact data, sent and received messages, pictures, audio, video, etc. The memory 802 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, disk or optical disk. The multimedia component 803 may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in the memory 802 or sent via the communication component 805. The audio component also includes at least one speaker for outputting audio signals. The I / O interface 804 provides an interface between the processor 801 and other interface modules, and the above-mentioned other interface modules can be keyboards, mice, buttons, etc. These buttons can be virtual buttons or physical buttons. The communication component 805 is used for wired or wireless communication between the network security defect detection device 800 based on AI technology and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component 805 may include: Wi-Fi module, Bluetooth module, NFC module.

[0100] In an exemplary embodiment, the network security defect detection device 800 based on AI technology can be implemented by one or more application specific integrated circuits (Application Specific Integrated Circuit, referred to as ASIC), digital signal processors (Digital Signal Processing Device, referred to as DSP), digital signal processing devices (Digital Signal Processing Device, referred to as DSPD), programmable logic devices (Programmable Logic Device, referred to as PLD), field programmable gate arrays (Field Programmable Gate Array, referred to as FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned network security defect detection method based on AI technology.

[0101] In another exemplary embodiment, a computer-readable storage medium including program instructions is also provided, and when the program instructions are executed by a processor, the steps of the above-mentioned network security defect detection method based on AI technology are implemented. For example, the computer-readable storage medium can be the above-mentioned memory 802 including program instructions, and the above-mentioned program instructions can be executed by the processor 801 of the network security defect detection device 800 based on AI technology to complete the above-mentioned network security defect detection method based on AI technology.

[0102] Corresponding to the above method embodiment, the embodiment of the present disclosure further provides a readable storage medium. The readable storage medium described below and the network security defect detection method based on AI technology described above can be referenced to each other.

[0103] Example 4

[0104] A readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network security defect detection method based on AI technology of the above method embodiment.

[0105] The readable storage medium may specifically be a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, or other readable storage medium that can store program codes.

[0106] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0107] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

Claims

1. A network security defect detection method based on AI technology, characterized by: Acquire a data packet, wherein the data packet includes communication data of a network to be detected; Preprocessing the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP; Obtaining a first feature map according to the first feature data; Using a self-attention mechanism to learn the weights of the feature information of neighboring nodes of the first feature graph, using the learned weights to weight the feature information of each neighboring node, and combining the first feature graph with the input into a pre-trained neural network model to output a detection result; Wherein, it is characterized in that obtaining a first feature map according to the first feature data comprises: Obtaining node information of each node and node betweenness centrality information of each node, wherein the node information includes out-degree information and in-degree information of each node; Using a graph analysis algorithm to convert the first feature data into a second feature graph, wherein the second feature graph includes a topological relationship of each node; Obtain a third feature graph according to the second feature graph and the node information, wherein the third feature graph includes a weight between each node; Obtain a fourth feature graph according to the second feature graph and the node betweenness centrality information, wherein the fourth feature graph includes a centrality coefficient of each node; The second feature map, the third feature map and the fourth feature map are merged to obtain the first feature map; Among them, the specific calculation process of the centrality coefficient of each node is: ； In the above formula, is the centrality coefficient of node V, is the total number of shortest paths from node Vi to node Vj, is the total number of shortest paths passing through node v.

2. The network security defect detection method based on AI technology according to claim 1 is characterized in that: The preprocessing of the data packet to obtain the first characteristic data includes: Get the preset filtering rules; Deduplication processing is performed on the data packets to obtain deduplication data packets; The communication data in the data packet after deduplication is filtered according to the filtering rule to obtain first characteristic data.

3. The network security defect detection method based on AI technology according to claim 1 is characterized in that: The using the self-attention mechanism to learn the weights of the neighboring node feature information of the first feature graph includes: The first feature graph is calculated using a neural collaborative filtering algorithm to obtain a first feature vector, where the first feature vector includes a similarity between each neighboring node and a central node; The first feature vector is normalized to obtain a weight for weighted calculation.

4. The network security defect detection method based on AI technology according to claim 1 is characterized in that: Before obtaining the data packet, the method includes: Obtaining a training set and a test set, wherein the training set includes a sample set representing normal network traffic and a sample set representing botnet traffic, and traffic data of a preset proportion of the sample set representing normal network traffic and the sample set representing botnet traffic is used as the training set; The neural network model is trained using the traffic samples in the training set to obtain trained traffic data; The trained neural network model is tested by using the traffic data in the test set to obtain a trained and tested neural network model.

5. A network security defect detection system based on AI technology, characterized by: An acquisition module, used for acquiring a data packet, wherein the data packet includes communication data of a network to be detected; A first processing module, used for preprocessing the data packet to obtain first characteristic data, wherein the first characteristic data includes characteristic data between a source IP and a destination IP; A second processing module, used for obtaining a first feature map according to the first feature data; A detection module, configured to learn the weights of the feature information of neighboring nodes of the first feature graph by using a self-attention mechanism, weight each of the feature information of the neighboring nodes by using the learned weights, and input the weights into a pre-trained neural network model in combination with the first feature graph to output a detection result; Wherein, the second processing module includes: A second acquisition unit is used to acquire node information of each node and node betweenness centrality information of each node, wherein the node information includes out-degree information and in-degree information of each node; A conversion unit, configured to convert the first feature data into a second feature graph using a graph analysis algorithm, wherein the second feature graph includes a topological relationship of each node; A second processing unit, configured to obtain a third feature graph according to the second feature graph and the node information, wherein the third feature graph includes a weight between each node; A third processing unit is used to obtain a fourth feature graph according to the second feature graph and the node betweenness centrality information, wherein the fourth feature graph includes a centrality coefficient of each node; a fusion unit, configured to fuse the second feature map, the third feature map and the fourth feature map to obtain the first feature map; Among them, the specific calculation process of the centrality coefficient of each node is: ； In the above formula, is the centrality coefficient of node V, is the total number of shortest paths from node Vi to node Vj, is the total number of shortest paths passing through node v.

6. The network security defect detection system based on AI technology according to claim 5 is characterized in that: The first processing module comprises: A first acquisition unit, used to acquire a preset filtering rule; A first processing unit, configured to perform deduplication processing on the data packet to obtain a deduplicated data packet; The filtering unit is used to filter the communication data in the data packet after deduplication according to the filtering rule to obtain the first characteristic data.

7. The network security defect detection system based on AI technology according to claim 5 is characterized in that: The detection module further includes: A calculation unit, configured to calculate the first feature graph using a neural collaborative filtering algorithm to obtain a first feature vector, wherein the first feature vector includes a similarity between each neighboring node and a central node; The fourth processing unit is used to perform a normalization operation on the first feature vector to obtain a weight for weighted calculation.

8. The network security defect detection system based on AI technology according to claim 5 is characterized in that: Before the acquisition module, it also includes: A third acquisition unit is used to acquire a training set and a test set, wherein the training set includes a sample set representing normal network traffic and a sample set representing botnet traffic, and traffic data of a preset proportion of the sample set representing normal network traffic and the sample set representing botnet traffic is used as the training set; A training unit, used to train the neural network model using the traffic samples in the training set to obtain trained traffic data; The testing unit is used to test the trained neural network model through the traffic data in the test set to obtain a trained and tested neural network model.

Images