A network security method and system based on intelligent network

Abstract

The present invention discloses a network security method and system based on a smart network, including: collecting real-time behavior data of network users, using improved classification algorithms to identify and decide on user behavior, assigning different identifiers according to different business needs, and diverting to different network areas according to different identifiers; assigning credibility weights according to the degree of fit between user behavior and normal behavior, and performing diversion operations according to the weights, and users with too low weights are confirmed to have abnormal behavior and automatically diverted to the monitoring network area; the smart network analyzes and identifies user behavior, updates the user's weight and category identification in real time, and performs automatic regulation. The network security method and system based on a smart network invented by us has better real-time adaptability, improves network reliability and efficiency under the condition of automated and intelligent management, reduces the need for manual operation, has higher security, and enables the entire system to have better optimization and higher performance.

Description

Technical Field

[0001] The present invention relates to the field of smart network security technology, and in particular to a network security method and system based on a smart network. Background Art

[0002] Increasingly complex cybersecurity threats, attackers now use increasingly sophisticated and covert methods, including zero-day vulnerability exploits, advanced persistent threats (APTs), etc., making detection and response more difficult. Ransomware attacks have increased dramatically in the past few years. Attackers encrypt user data and demand a ransom to unlock it, posing a major threat to both individual users and enterprises. Attackers are increasingly inclined to infiltrate target organizations by attacking weaknesses in the supply chain, such as third-party service providers or partners. With the popularity of IoT devices, inadequately secure devices have become a way for attackers to invade networks. Weak passwords and lack of firmware updates are common problems. Attackers obtain sensitive user information through deception and fraud. Social engineering and phishing attacks remain common intrusion routes. New technologies such as cloud computing, the Internet of Things, and artificial intelligence have brought new challenges to network security, requiring adaptable defense mechanisms. Summary of the invention

[0003] In view of the above-mentioned problems, the present invention is proposed.

[0004] Therefore, the technical problem solved by the present invention is that the existing network security methods have poor abnormal behavior processing capabilities, low execution efficiency, require a high degree of human participation, and cannot provide real-time feedback on user needs.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security method and system based on a smart network, comprising:

[0006] Slice the network into multiple independent network areas and specialize the functions of different areas;

[0007] Use improved classification algorithms to identify and make decisions on user behavior, assign different identifiers based on different business needs, and divert traffic to different network areas based on different identifiers;

[0008] Weights are assigned based on the degree of fit of behavioral habits. Users with excessively high weights are identified as having abnormal behavior and are automatically directed to the monitoring network area.

[0009] The smart network analyzes and makes decisions based on user behavior, updates user weights and identifications in real time, and performs automatic regulation.

[0010] As a preferred solution of a network security method and system based on a smart network described in the present invention, the risk level includes analyzing user behavior and setting risk levels based on access to sensitive data, abnormal login attempts, system configuration changes, and data transmission; considering the impact scope, severity, and recovery difficulty of potential risk behaviors when setting risk levels; and parameterizing the evaluated risk level into a risk level parameter R.

[0011] As a preferred solution of the network security method and system based on intelligent network described in the present invention, wherein: the weight includes setting the user weight by considering the risk level of user behavior, historical behavior impact, and behavior frequency, expressed as;

[0012]

[0013] F=1+γlog(1+n)

[0014] Where W represents the updated weight; W current represents the current weight; Y represents the user's actual behavior score; Represents the predicted user behavior score; R represents the behavior risk level; H represents the historical behavior score; F represents the weight update speed based on the behavior frequency; α represents the learning rate; β represents the historical behavior abnormality rate; γ represents the frequency adjustment influence parameter; n represents the frequency of the same type of behavior within the monitored unit time.

[0015] As a preferred solution of the network security method and system based on intelligent network described in the present invention, wherein: the improved recognition algorithm includes:

[0016] Integrate AI and random forest algorithms to collect user behavior data, extract user behavior features, and train and fit the AI-random forest model;

[0017] The AI-modified random forest model is used to make real-time voting classification decisions, obtain the degree of positive correlation between user behavior data and normal behavior data, and update the user weight W; a high weight indicates that the user's behavior is highly abnormal, and a low weight indicates that the user's behavior is not abnormal and the behavior is normal;

[0018] The AI-Random Forest model is trained based on the historical behavioral data of users with different access needs. After completion, the demand classification decision is made for users with normal behavior.

[0019] The AI-Random Forest model is trained using historical malicious behavior and virus behavior data sets. After completion, user behaviors are voted on and identified. If malicious behavior is identified, it is marked as malicious and malicious behavior processing operations are performed at the same time.

[0020] As a preferred solution of a network security method and system based on a smart network described in the present invention, wherein: the network slice includes:

[0021] Normal behavior users classify network space requirements according to latency, high bandwidth, stability, security, and reliability based on the different needs of network users, denoted as m;

[0022] Divide the physical network resources into multiple logical network slices according to demand, and customize each network slice to meet different business needs and service characteristics, represented as m i Each business service area is divided into an abnormal behavior isolation zone, and network access identified as abnormal behavior is directed to this area for real-time monitoring.

[0023] As a preferred solution of the network security method and system based on intelligent network described in the present invention, the automatic control includes:

[0024] Each user is given a weight and a label, denoted as user U(W, m, W 异 ),W represents the voting weight of user behavior, W 异 represents the voting weight of abnormal behavior, m represents the user behavior category label, and m i Indicates different categories of network areas;

[0025] When a user visits, we first vote on the user's behavior, identify the abnormality of the user's behavior, score each user's behavior and update the weight;

[0026] μ represents the historical experience threshold of abnormal behavior, m represents the classification weight of the AI ​​random forest model for user behavior, and λ represents the historical experience threshold of malicious behavior; W 异 Indicates the voting weight of the AI ​​random forest model for abnormal user behavior;

[0027] When W < μ, the user behavior is identified as normal behavior, and functional traffic is diverted according to the user's demand category label and allocated to each network area;

[0028] When W>μ, the user behavior is identified as abnormal behavior, and the diversion operation is performed to guide the user access to the monitoring network area for isolation, and an abnormal notification is issued, and the abnormal behavior database is updated at the same time;

[0029] When a user is identified as having abnormal behavior, a vote is performed to classify and identify malicious behavior in the monitoring network area. If W 异 >λ, it is marked as malicious behavior, the access port is hidden from malicious users, the attack source is tracked, and an alarm message is sent to the management port;

[0030] The smart network monitors user behavior in real time, performs real-time voting classification based on the AI ​​random forest model, and continuously adjusts user weights. After determining the weight of W to ensure that abnormal and malicious behaviors can be eliminated, if there is no abnormality, the user is classified and identified, and the network area m is i Compare the similarity with the user behavior category m in real time, make random forest classification decisions, and guide the most similar category to different network areas.

[0031] A preferred solution of a network security method and system based on a smart network described in the present invention, wherein: the dynamic adjustment includes:

[0032] After the user is identified as abnormal and transferred to the network isolation monitoring area, the algorithm continues to score the user's behavior and update the weight. If W < μ after the update, another voting decision is made. If the behavior is normal, the user's access is transferred to the normal business area, and the user U (W, m, W) is updated at the same time. 异 ), the algorithm makes a classification decision on the user's behavior classification weight m, and performs service diversion operations after matching with the business server;

[0033] If the weight of the user is updated in the isolated monitoring area and it is still W>μ, the behavior is judged to be abnormal, and malicious behavior detection is performed. The random forest model is used to vote on malicious behavior. If W 异 >λ, it is considered as malicious behavior and malicious behavior processing is performed; if W 异 <λ, there is no malicious behavior, then it is monitored in the isolated monitoring area, and after it is determined that W<μ, it is transferred to the normal business area to wait for classification;

[0034] If W>μ is identified during monitoring in the business service area, indicating abnormal behavior, the access will be transferred to the isolated monitoring area, and then transferred to the original business service area after the behavior is determined to be normal;

[0035] When conducting business, the malicious behavior voting decision algorithm will be used to evaluate the user’s W in real time. 异 , monitor, W appears 异 >λ, it is determined that the user's service access is malicious, and the user U(W, m, W 异 ) tag directly locks the user, stops business access and transfers to the isolated monitoring area. If it is determined to be malicious behavior again, the malicious behavior processing operation will be executed; if there is no malicious behavior and no abnormal behavior, it will be transferred to the normal business area and wait for the service classification decision operation.

[0036] A network security system based on a smart network using any method of the present invention, characterized in that:

[0037] The user behavior data collection module collects real-time behavior data of various network users, historical data of abnormal behavior, and historical data of malicious attack behavior, and transmits them to the analysis and identification module; the analysis and identification module classifies and identifies various data, and assigns weights, labels normal behavior users based on behavior categories, and performs exception processing operations on abnormal behavior users; the network slicing module divides physical network resources into multiple logical network slices, and customizes each network slice to meet different business needs and service characteristics; the management port module receives and processes abnormal behavior reports, monitors user demand feedback in real time, and processes them.

[0038] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and wherein the processor implements the steps of any one of the methods of the present invention when executing the computer program.

[0039] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of any one of the methods of the present invention are implemented.

[0040] Beneficial effects of the invention: The network security method and system based on the intelligent network provided by the invention can analyze and identify user behaviors, update the user's weight and category identification in real time, and perform automatic regulation. The network security method and system based on the intelligent network invented by us have better real-time adaptability, improve network reliability and efficiency under the condition of automated intelligent management, reduce the need for manual operation, have higher security, and enable the whole system to have better optimization and higher performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:

[0042] Figure 1 An overall flow chart of a network security method and system based on a smart network provided for the first embodiment of the present invention. DETAILED DESCRIPTION

[0043] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0044] Example 1

[0045] Reference Figure 1 , is an embodiment of the present invention, and provides a network security method and system based on a smart network, including:

[0046] S1: Collect user data and perform preprocessing.

[0047] Furthermore, handling missing values, detecting and handling missing values ​​in the data, can be handled by filling, deleting or interpolating. Handling outliers: Detecting and handling outliers in the data, statistical methods or visualization methods can be used to identify outliers.

[0048] Furthermore, the user data includes real-time network behavior data of normal users, behavior data of abnormal behavior users, and historical data of malicious attack behaviors. These data are preprocessed separately to obtain standardized and normalized data.

[0049] Furthermore, physical network resources are divided into multiple logical network slices as needed, and each network slice is customized to meet different business needs and service characteristics; an abnormal behavior isolation zone is divided, network access identified as abnormal behavior is directed to this area, and real-time monitoring is performed.

[0050] Going a step further, use SDN controllers to perform real-time network traffic analysis to identify different types of business traffic, and deploy deep packet inspection (DPI) and traffic analysis algorithms such as machine learning classifiers to accurately identify traffic types.

[0051] Furthermore, key network performance indicators (KPIs) are defined for each service type.

[0052] Real-time communication, delay Δt≤20ms.

[0053] For large data transmission, bandwidth B ≥ 100Mbps.

[0054] For critical business applications, availability U≥99.999% and security S≥99%

[0055] Conventional data transmission, standard reliability R ≥ 99%.

[0056] Based on the identified business types and defined KPIs, network slices are dynamically created using the SDN controller.

[0057] Utilize the flow table rules of SDN to guide different business traffic to the corresponding network slices, and deploy corresponding NFV functions for each network slice.

[0058] Different methods are given for different types of services; Real-time communication: deploy low-latency routing strategies. Large data transmission: deploy high-bandwidth channels. Key business applications: deploy advanced security features, intrusion detection systems (IDS). Conventional data transmission: deploy standard network security and performance monitoring features.

[0059] Furthermore, network performance monitoring tools are deployed to monitor the performance of each network slice in real time to ensure that KPIs are met, and network resource allocation and traffic management policies are automatically adjusted based on performance monitoring results. Flow table rules and network configurations are dynamically adjusted using the programmability of the SDN controller.

[0060] It should be noted that normal behavior users classify network space requirements according to latency, high bandwidth, stability, security, and reliability based on the different needs of network users.

[0061] S2: Assign credibility weights based on how well the user behavior fits the normal behavior.

[0062] Furthermore, the data is divided into a training set and a test set. Usually 70% of the data is used as a training set and 30% as a test set. Appropriate parameters are selected, such as the number of trees, the maximum depth of the tree, etc. The decision of the random forest is based on the collective prediction of multiple decision trees. The contribution weight of each decision tree is the same.

[0063] Furthermore, the optimal combination of parameters, such as the number of trees, the maximum depth of the tree, etc., is found through grid search and cross-validation methods. Evaluate and select the features that have the greatest impact on model prediction. Use the built-in feature importance evaluation function of random forest. Feature importance I = ∑treesΔaccuracy, where Δaccuracy is the accuracy improvement of the feature in a single tree. Use the cross-validation method to verify the stability and generalization ability of the model. Divide the dataset into K subsets, and use one of the subsets as the test set in turn, and the rest as the training set. The cross-validation score is expressed as:

[0064]

[0065] Where K represents the number of subsets, and ModelScore(k) represents the model score of the kth iteration.

[0066] Furthermore, AI and random forest algorithms are integrated to collect a large amount of user behavior data, and the user data set is used to train the random forest model, extract the relevant features of the user's normal behavior, and train and fit the AI-random forest model. When the fitting degree of the random forest reaches more than 95%, it can be considered a successful fitting.

[0067] Furthermore, the AI-modified random forest model is used to make real-time voting classification decisions, obtain the degree of positive correlation between user behavior data and normal behavior data, and assign weights; a high weight indicates that the user behavior is normal, and a low weight proves that the user behavior tends to be abnormal.

[0068] Furthermore, the AI-Random Forest model is trained based on historical data of users’ different demand behaviors, and the demand categories of users with normal behaviors are marked.

[0069] Furthermore, the performance of the model is evaluated using the test set to calculate the model's accuracy, recall, precision and other indicators. The accuracy can be expressed as:

[0070]

[0071] Among them, TP is a true positive example, TN is a true negative example, FP is a false positive example, and FN is a false negative example.

[0072] Furthermore, the AI-Random Forest model is trained using historical malicious behavior and virus behavior data sets to vote on user behaviors entering the network, and malicious behaviors are marked if identified, while malicious behavior processing operations are performed at the same time.

[0073] It should be noted that the feasibility of this scheme benefits from the maturity and wide application of the random forest algorithm, especially in the field of anomaly detection. In addition, the use of standardized data and carefully adjusted model parameters can further improve the performance and applicability of the model.

[0074] S3: Analyze and identify users with different weights and perform traffic diversion operations.

[0075] Furthermore, when a user visits, a voting decision is first made on the user's behavior, the abnormality of the user's behavior is identified, and each user's behavior is scored and the weight is updated.

[0076] Furthermore, μ is used to represent the historical experience threshold of abnormal behavior, m is used to represent the classification weight of the AI ​​random forest model for user behavior, and λ is used to represent the historical experience threshold of malicious behavior; W 异 Represents the voting weight of the AI ​​random forest model for abnormal user behavior.

[0077] Furthermore, when W < μ, the user behavior is identified as normal behavior, and functional diversion is performed according to the user's demand category label and allocated to each network area.

[0078] Furthermore, when W>μ, the user behavior is identified as abnormal behavior, and a diversion operation is performed to introduce the user access to the monitoring network area for isolation, and an abnormal notification is issued, and the abnormal behavior database is updated at the same time.

[0079] Furthermore, when a user is identified as having abnormal behavior, a voting is performed to classify and identify malicious behavior in the monitoring network area. 异 >λ, it is marked as malicious behavior, the access port is hidden from malicious users, the attack source is tracked, and an alarm message is sent to the management port.

[0080] Furthermore, the intelligent network monitors the user's behavior in real time, and performs real-time voting classification based on the AI ​​random forest model, while constantly adjusting the user weights; after judging the weight of W to ensure that abnormal and malicious behaviors can be eliminated, if there is no abnormality, the user is classified and identified, and the network area m is i Compare the similarity with the user behavior category m in real time, make random forest classification decisions, and guide the most similar category to different network areas.

[0081] It should be noted that in a smart network, highly connected network areas use big data cloud computing methods to identify various user behaviors in real time, and at the same time, can use the computing power of the network edge area to implement tracking services for user needs, ensuring that the needs of network users can be met and responded to in real time; at the same time, for network malicious behavior and attack behaviors, network edge area diversion operations can be performed, and a large number of attack behaviors at the same time can be diverted to the backup network area for monitoring, tracing, and anti-tracking operations to ensure overall network security.

[0082] S4: Update user weights and category identifiers in real time.

[0083] Furthermore, each user is given a weight and a label, denoted as user U(W, m, W 异 ),W represents the voting weight of user behavior, W 异 represents the voting weight of abnormal behavior, m represents the user behavior category label, and m i Indicates different types of network areas.

[0084] Furthermore, after the user is identified as having abnormal behavior and transferred to the network isolation monitoring area, the algorithm continues to score the user's behavior and update the weight. If W < μ after the update, another voting decision is made. If the behavior is normal, the user's access is transferred to the normal business area, and the user U (W, m, W 异), the algorithm makes a classification decision on the user's behavior classification weight m, and performs service diversion operations after matching with the business server.

[0085] Furthermore, if the weight of the user is updated in the isolated monitoring area and W>μ, the behavior is judged to be abnormal, malicious behavior detection is performed, and the random forest model is used to vote on malicious behavior. If W 异 >λ, it is considered as malicious behavior and malicious behavior processing is performed; if W 异 <λ, there is no malicious behavior, it is monitored in the isolated monitoring area. After it is determined that W<μ, it is transferred to the normal business area to wait for classification.

[0086] Furthermore, if W>μ is identified during monitoring in the business service area, indicating abnormal behavior, the access is transferred to the isolation monitoring area, and then transferred to the original business service area after the behavior is determined to be normal.

[0087] Furthermore, when conducting business, the malicious behavior voting decision algorithm will be used to determine the user's W in real time. 异 , monitor, W appears 异 >λ, it is determined that the user's service access is malicious, and the user U(W, m, W 异 ) tag directly locks the user, stops business access and transfers to the isolated monitoring area. If it is determined to be malicious behavior again, the malicious behavior processing operation will be executed; if there is no malicious behavior and no abnormal behavior, it will be transferred to the normal business area and wait for the service classification decision operation.

[0088] It should be noted that the smart network monitors user behavior in real time, performs real-time voting classification based on the AI ​​random forest model, and continuously adjusts user weights.

[0089] A network security system based on a smart network, characterized by:

[0090] User behavior data collection module collects real-time behavior data of various network users, historical data of abnormal behavior, historical data of malicious attack behavior, and transmits them to the analysis and identification module;

[0091] The analysis and identification module classifies and identifies various data and assigns weights to them. It labels normal users based on their behavior categories and performs exception handling operations on abnormal users.

[0092] The network slicing module divides the physical network resources into multiple logical network slices and customizes each network slice to meet different business needs and service characteristics;

[0093] Management port module, receives and processes abnormal behavior reports, monitors user demand feedback in real time and processes it.

[0094] Example 2

[0095] The following is an embodiment of the present invention, which provides a network security method and system based on a smart network. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation comparison experiments.

[0096] The present invention uses a method of comparison with the traditional network control method to draw conclusions, in which the data have been quantified into 5 levels of rating, which is more intuitive, as shown in Table 1:

[0097] Table 1 Comparison results of regulation benefits

[0098]

[0099]

[0100] It can be seen that our invention has better real-time adaptability. Under the condition of automated and intelligent management, it improves network reliability and efficiency, reduces the need for manual operation, has higher security, and enables the entire system to have better optimization and higher performance. At the same time, it also gains high user satisfaction and high praise rate, and provides new ideas for the development of the entire network security industry.

[0101] Next, we select a public network behavior dataset that contains normal and abnormal user behavior labels. We select several commonly used abnormal behavior recognition models for comparison, such as support vector machine (SVM), logistic regression (LR), and traditional decision tree (DT). We use accuracy, recall, precision, and F1-Score as evaluation indicators. We use the same dataset for training and testing each model to ensure a fair comparison.

[0102] Table 2 Theoretical experimental data table

[0103]

[0104] It can be seen that the improved algorithm invented by us outperforms several other commonly used models in identifying abnormal user behavior. It performs best in accuracy, recall, precision and F1 score, which proves its effectiveness and superiority in dealing with such problems.

[0105] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (DRAM), etc. The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0106] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security method based on a smart network, characterized in that: include: Collect real-time behavior data of network users, use improved recognition algorithms to identify user behaviors and assign weights, and perform diversion operations based on the weights; Users with excessively high weights are identified as having abnormal behavior and are automatically directed to the monitoring network area for further monitoring. If there are no abnormalities, they are directed back to the normal business network area. Use improved classification algorithms to identify and make decisions on user behavior, assign different identifiers based on different business needs, and divert traffic to different network areas based on different identifiers; The intelligent network analyzes and identifies user behaviors, updates user weights and category identifiers in real time, and performs automatic regulation; The weight includes setting the user weight by considering the risk level of the user behavior, the impact of historical behavior, and the frequency of behavior, which is expressed as; F=1+γlog(1+n) Where W represents the updated weight; W current represents the current weight; Y represents the user's actual behavior score; represents the predicted user behavior score; R represents the behavior risk level; H represents the historical behavior score; F represents the weight update speed based on the behavior frequency; α represents the learning rate; β represents the historical behavior abnormality rate; γ represents the frequency adjustment influence parameter; n represents the frequency of the same type of behavior in the monitored unit time; The improved classification algorithm includes: Integrate AI and random forest algorithms to collect user behavior data, extract user behavior features, and train and fit the AI-random forest model; The AI-modified random forest model is used to make real-time voting classification decisions, obtain the degree of positive correlation between user behavior data and normal behavior data, and update the user weight W; a high weight indicates that the user's behavior is highly abnormal, and a low weight indicates that the user's behavior is not abnormal and the behavior is normal; The AI-Random Forest model is trained based on the historical behavioral data of users with different access needs. After completion, the demand classification decision is made for users with normal behavior. The AI-Random Forest model is trained using historical malicious behavior and virus behavior data sets. After completion, user behaviors are voted on and identified. If malicious behaviors are identified, they are marked as malicious and malicious behavior processing operations are performed. The automatic control includes: Each user is given a weight and a label, denoted as user U(W, m, W 异 ),W represents the voting weight of user behavior, W 异 represents the voting weight of abnormal behavior, m represents the user behavior category label, and m i Indicates different categories of network areas; When a user visits, we first vote on the user's behavior, identify the abnormality of the user's behavior, score each user's behavior and update the weight; μ represents the historical experience threshold of abnormal behavior, m represents the classification weight of the AI ​​random forest model for user behavior, and λ represents the historical experience threshold of malicious behavior; W 异 Indicates the voting weight of the AI ​​random forest model for abnormal user behavior; When W < μ, the user behavior is identified as normal behavior, and functional traffic is diverted according to the user's demand category label and allocated to each network area; When W>μ, the user behavior is identified as abnormal behavior, and the diversion operation is performed to guide the user access to the monitoring network area for isolation, and an abnormal notification is issued, and the abnormal behavior database is updated at the same time; When a user is identified as having abnormal behavior, a vote is performed to classify and identify malicious behavior in the monitoring network area. If W 异 >λ, it is marked as malicious behavior, the access port is hidden from malicious users, the attack source is tracked, and an alarm message is sent to the management port; The smart network monitors user behavior in real time, performs real-time voting classification based on the AI ​​random forest model, and continuously adjusts user weights. After determining the weight of W to ensure that abnormal and malicious behaviors can be eliminated, if there is no abnormality, the user is classified and identified, and the network area m is i The approximation is compared with the user behavior category m in real time, a random forest classification decision is made, and the most similar category is directed to different network areas.

2. A network security method based on an intelligent network as claimed in claim 1, characterized in that: Risk levels include analyzing user behavior and setting risk levels based on access to sensitive data, abnormal login attempts, system configuration changes, and data transmission; When setting the risk level, the impact scope, severity, and recovery difficulty of the potential risk behavior are considered; the assessed risk level is parameterized into the risk level parameter R.

3. A network security method based on an intelligent network as claimed in claim 2, characterized in that: Network slicing includes: Normal behavior users classify network space requirements according to latency, high bandwidth, stability, security, and reliability based on the different needs of network users, denoted as m; Divide the physical network resources into multiple logical network slices according to demand, and customize each network slice to meet different business needs and service characteristics, represented as m i Each business service area is divided into an abnormal behavior isolation zone, and network access identified as abnormal behavior is directed to this area for real-time monitoring.

4. A network security method based on an intelligent network as claimed in claim 3, characterized in that: Dynamic adjustments include: After the user is identified as abnormal and transferred to the network isolation monitoring area, the algorithm continues to score the user's behavior and update the weight. If W < μ after the update, another voting decision is made. If the behavior is normal, the user's access is transferred to the normal business area, and the user U (W, m, W) is updated at the same time. 异 ), the algorithm makes a classification decision on the user's behavior classification weight m, and performs service diversion operations after matching with the business server; If the weight of the user is updated in the isolated monitoring area and it is still W>μ, the behavior is judged to be abnormal, and malicious behavior detection is performed. The random forest model is used to vote on malicious behavior. If W 异 >λ, it is considered as malicious behavior and malicious behavior processing is performed; if W 异 <λ, there is no malicious behavior, then it is monitored in the isolated monitoring area, and after it is determined that W<μ, it is transferred to the normal business area to wait for classification; If W>μ is identified during monitoring in the business service area, indicating abnormal behavior, the access will be transferred to the isolated monitoring area, and then transferred to the original business service area after the behavior is determined to be normal; When conducting business, the malicious behavior voting decision algorithm will be used to evaluate the user’s W in real time. 异 , monitor, W appears 异 >λ, it is determined that the user's service access is malicious, and the user U(W, m, W 异 ) tag directly locks the user, stops business access and transfers to the isolated monitoring area. If it is determined to be malicious behavior again, the malicious behavior processing operation will be executed; if there is no malicious behavior and no abnormal behavior, it will be transferred to the normal business area and wait for the service classification decision operation.

5. A network security system based on a smart network using the method according to any one of claims 1 to 4, characterized in that: User behavior data collection module collects real-time behavior data of various network users, historical data of abnormal behavior, historical data of malicious attack behavior, and transmits them to the analysis and identification module; The analysis and identification module classifies and identifies various data and assigns weights to them. It labels normal users based on their behavior categories and performs exception handling operations on abnormal users. The network slicing module divides the physical network resources into multiple logical network slices and customizes each network slice to meet different business needs and service characteristics; Management port module, receives and processes abnormal behavior reports, monitors user demand feedback in real time and processes it.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images