A security incident prediction and prevention system based on artificial intelligence

Abstract

The present invention discloses a security incident prediction and prevention system based on artificial intelligence, which relates to the field of network security prediction and prevention technology, including a collection and processing module for constructing an improved feature extraction model and collecting network data to extract network data features; a prediction and prevention module for constructing an improved security prediction model, and predicting network security incidents based on the extracted network data features, formulating and implementing prevention plans. The present invention forms an improved feature extraction model by deeply fusing a multi-scale low-frequency memory network with a convolutional neural network, thereby improving the accuracy and representativeness of network data feature extraction. At the same time, by using a multi-scale low-frequency memory network to construct an improved security prediction model and predict network security incidents based on network data features, a prevention plan is formulated and implemented, which greatly improves the accuracy of the prediction and the speed of response to network security incidents.

Description

Technical Field

[0001] The present invention relates to the technical field of network security prediction and prevention, and in particular to a security event prediction and prevention system based on artificial intelligence. Background Art

[0002] In the modern information society, network security has become an important issue of global concern. With the popularization of the Internet and the rapid development of information technology, the means and frequency of network attacks are also constantly upgrading. Traditional network security protection measures mainly rely on static protection means such as firewalls, intrusion detection systems (IDS), and antivirus software. Although these means can prevent known attacks to a certain extent, their protection effect is insufficient in the face of ever-changing new attacks and advanced persistent threats (APT). In recent years, the development of artificial intelligence (AI) technology has brought new hope to the field of network security. Through machine learning and deep learning algorithms, a large amount of network data can be automatically analyzed, potential attack features can be extracted from it, and early warning and response to unknown threats can be achieved. Especially with the development of big data technology, the ability to collect and process massive network data in real time has been further enhanced, making AI-based security incident prediction and prevention systems possible. However, existing technologies still have shortcomings. Many existing methods have limitations in feature extraction, making it difficult to fully capture the complex features in network data, and are not accurate enough in predicting and preventing network security incidents. It is difficult to provide comprehensive protection in a complex and changing network environment. Summary of the invention

[0003] In view of the above-mentioned problems existing in the existing artificial intelligence-based security incident prediction and prevention system, the present invention is proposed.

[0004] Therefore, the problem to be solved by the present invention is that many existing methods have limitations in feature extraction, it is difficult to fully capture the complex features in network data, they are not accurate enough in predicting and preventing network security incidents, and it is difficult to provide comprehensive protection in a complex and changeable network environment.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions: a security incident prediction and prevention system based on artificial intelligence, which includes a collection and processing module for constructing an improved feature extraction model and collecting network data to extract network data features;

[0006] The prediction and prevention module is used to build an improved security prediction model, predict network security events based on the extracted network data features, formulate and implement prevention plans;

[0007] The display and storage module is used to visualize the collected and analyzed network data and store it securely in the database;

[0008] The central control module is used to comprehensively control the operation of other modules and remotely connect to the staff's mobile terminal.

[0009] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system of the present invention, wherein: the construction of the improved feature extraction model refers to using a convolutional neural network CNN to construct a feature extraction basic model, including an input layer, a complex convolution layer and an output layer, the input layer format is set to a network data format, and the output layer format is a network data feature format;

[0010] Design a multi-scale low-frequency memory network MLFM including input gate, update gate, supplement gate, forget gate and output gate;

[0011] Add an MLFM unit at the end of each convolutional layer of CNN, connect the input layer of CNN to the MLFM unit, and extract the high-frequency features h of network data based on the convolutional layer. con , the format is (N, C con , H, W), extracting low-frequency features of network data based on MLFM unit h MLFM , the format is (N, C MLFM , H, W), where N is the batch size, C con and C MLFM are the number of channels for extracting network data information in the convolutional layer and MLFM, respectively. H and W are the height and width of the features, respectively;

[0012] In the same dimension, the high-frequency features of network data and the low-frequency features of network data are concatenated to form the concatenated features h com , the format is (N, C con +C MLFM , H, W);

[0013] A multi-scale fusion layer is added after each convolution layer of the feature extraction basic model. The multi-scale fusion layer is set between two convolution layers to obtain the output of the previous convolution layer and connect to the next convolution layer to pass the output to the next convolution layer. Repeat the process until all convolution layers are traversed and the network data features are output through the output layer. ;

[0014] The multi-scale fusion layer includes:

[0015] For the splicing feature h com Perform multi-scale convolution processing: where h mu is the multi-scale convolution output, W i is the i-th scale convolution kernel, b i is the i-th bias, N is the number of scales, and ReLU is the activation function;

[0016] The multi-scale convolution output h muPerform wavelet transform to get h wa , the self-attention fusion weights are obtained through back-propagation algorithm training, and the query matrix Q, key matrix K and value matrix V are calculated respectively: Where W Q , W K and W V are the fusion weights of the query matrix Q, key matrix K, and value matrix V respectively;

[0017] Weighted fusion based on self-attention fusion mechanism: where h fu is the fusion feature, d k is the scaling factor and T is the transpose operation.

[0018] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system of the present invention, wherein: the collection of network data to extract network data features refers to building an improved feature extraction model and then deploying the feature extraction model to the collection and processing module, the collection and processing module collects network data through network traffic sensors and monitoring software and performs cleaning and filtering, converts it into a unified format and then inputs the improved feature extraction model to extract network data features .

[0019] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system of the present invention, wherein: the construction of the improved security prediction model refers to selecting a deep neural network DNN to construct a basic security prediction model, which includes a feature input layer, a double hidden layer and a prediction output layer, the feature input layer format is a network data feature format, and the prediction output layer format is a network security incident prediction result;

[0020] Add an MLFM unit after the first hidden layer to process the output of the first hidden layer to obtain the low-frequency adjustment result, and use the gating mechanism to fuse the low-frequency adjustment result with the output of the first hidden layer: where g 1 is the gated intermediate representation, W g is the weight of the gated intermediate representation, b g is the bias of the gated intermediate representation, For low frequency adjustment results, As the fusion result, is the sigmoid activation function, is the element-wise product;

[0021] Input the fusion result into the second hidden layer to obtain the second hidden layer output h 2 , introducing a cross-layer connection between the first hidden layer and the second hidden layer will fuse the results and the second hidden layer output h 2 The splicing result is obtained by splicing ;

[0022] Use multi-head mechanism to stitch the results Transformation is performed to obtain h mh And output through the prediction output layer: Where y is the prediction result of network security events, W o is the predicted output layer weight, b o To predict the output layer bias;

[0023] Bayesian optimization is used to adjust model hyperparameters, and gradient descent method is used for model training to obtain an improved safety prediction model.

[0024] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, wherein: the prediction of network security incidents based on the extracted network data features, the formulation of prevention plans and their implementation refers to deploying an improved security prediction model to the prediction and prevention module, the prediction and prevention module receives the network data features extracted by the collection and processing module, and inputs the network data features into the improved security prediction model to obtain network security incident prediction results, identifies the network threat type based on the prediction results, determines the network threat level, and formulates preventive measures, detection measures and response measures for implementation.

[0025] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, the network data includes network traffic, system logs, user behavior data and IoT device data, and the monitoring software includes Apache Kafka and Elasticsearch.

[0026] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, the visual display of the collected and analyzed network data refers to the display storage module forming a visual table for display of the collected network data, network security incident prediction results and prevention plans, and simultaneously sorting the network security incident prediction results in the order of network data collection time to form a time-network security statistical chart for display.

[0027] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, the secure storage in the database refers to the display storage module storing the displayed data and the generated charts in the database, and simultaneously implementing security protection measures on the stored data. The database backs up the stored data in the cloud, and regularly performs integrity and security checks on the stored data and backup data to generate a test report.

[0028] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, wherein: the comprehensive control of the operation of the remaining modules refers to the central control module being connected to the remaining modules through a network, and generating control commands that are transmitted to the remaining modules through the network for execution, the central control module monitors the command execution status of the remaining modules in real time, and issues an early warning when a failure occurs in the remaining modules.

[0029] As a preferred solution of the artificial intelligence-based security incident prediction and prevention system described in the present invention, the remotely connected staff mobile terminal refers to the remotely connected staff mobile terminal of the central control module, and the staff connects to the central control module through the mobile terminal to view the operating status of the remaining modules, and accesses the display charts and stored data through the display storage module.

[0030] The beneficial effects of the present invention are as follows: the present invention forms an improved feature extraction model through deep fusion of a multi-scale low-frequency memory network and a convolutional neural network, thereby improving the accuracy and representativeness of network data feature extraction. At the same time, by using a multi-scale low-frequency memory network to construct an improved security prediction model and predicting network security incidents based on network data characteristics, a prevention plan is formulated and implemented, which greatly improves the accuracy of the prediction and improves the response speed to network security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0032] Figure 1 This is a flow chart of the security incident prediction and prevention system based on artificial intelligence.

[0033] Figure 2 Schematic diagram of the process of security incident prediction. DETAILED DESCRIPTION

[0034] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0035] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0036] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it a separate or selective embodiment that is mutually exclusive with other embodiments.

[0037] Example 1

[0038] Reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and which provides a security incident prediction and prevention system based on artificial intelligence. The security incident prediction and prevention system based on artificial intelligence includes:

[0039] S1, a collection and processing module, used to build an improved feature extraction model and collect network data to extract network data features;

[0040] Specifically, building an improved feature extraction model refers to building a feature extraction basic model using a convolutional neural network CNN, including an input layer, a complex convolution layer, and an output layer, the input layer format is set to a network data format, and the output layer format is a network data feature format;

[0041] Design a multi-scale low-frequency memory network MLFM including input gate, update gate, supplement gate, forget gate and output gate;

[0042] The input gate receives the input network data, the update gate extracts the high-frequency and low-frequency information of the network data, the supplement gate extracts the low-frequency information of the network data, the forget gate combines the low-frequency information extracted by the supplement gate and discards the high-frequency information through wavelet transform, retains the low-frequency information, and the output gate outputs the low-frequency information;

[0043] Add an MLFM unit at the end of each convolutional layer of CNN, connect the input layer of CNN to the MLFM unit, and extract the high-frequency features h of network data based on the convolutional layer. con , the format is (N, C con , H, W), extracting low-frequency features of network data based on MLFM unit h MLFM , the format is (N, C MLFM , H, W), where N is the batch size, C con and C MLFM are the number of channels for extracting network data information in the convolutional layer and MLFM, respectively. H and W are the height and width of the features, respectively;

[0044] In the same dimension, the high-frequency features of network data and the low-frequency features of network data are concatenated to form the concatenated features h com , the format is (N, C con +C MLFM , H, W);

[0045] A multi-scale fusion layer is added after each convolution layer of the feature extraction basic model. The multi-scale fusion layer is set between two convolution layers to obtain the output of the previous convolution layer and connect to the next convolution layer to pass the output to the next convolution layer. Repeat the process until all convolution layers are traversed and the network data features are output through the output layer. ;

[0046] The multi-scale fusion layer includes:

[0047] For the splicing feature h com Perform multi-scale convolution processing: where h mu is the multi-scale convolution output, W i is the i-th scale convolution kernel, b i is the i-th bias, N is the number of scales, and ReLU is the activation function;

[0048] The multi-scale convolution output h mu Perform wavelet transform to get h wa , the self-attention fusion weights are obtained through back-propagation algorithm training, and the query matrix Q, key matrix K and value matrix V are calculated respectively: Where W Q , W K and W V are the fusion weights of the query matrix Q, key matrix K, and value matrix V respectively;

[0049] Weighted fusion based on self-attention fusion mechanism: where h fu is the fusion feature, d k is the scaling factor and T is the transpose operation.

[0050] By using convolutional neural networks (CNN) to build a basic model for feature extraction, we can make full use of the advantages of CNN in image data processing, effectively extract the spatial features of network data, and improve the accuracy of feature extraction. By introducing a multi-scale low-frequency memory network (MLFM), we can capture both high-frequency and low-frequency information, especially through wavelet transform and memory units, retain low-frequency information, discard useless high-frequency noise, and improve the representativeness and stability of features. By adding MLFM units at the end of each convolutional layer, we can combine the high-frequency features extracted by the convolutional layer and the low-frequency features extracted by MLFM to form a more comprehensive feature representation, improve the model's perception of different frequency features, and enhance feature extraction. The depth and breadth of the multi-scale fusion layer can capture feature information of different scales by introducing multi-scale convolution processing between two convolutional layers, and perform weighted fusion through the back propagation algorithm and the self-attention mechanism to improve the expression ability of the features. In the feature extraction process, multi-scale features are continuously fused and strengthened to improve the quality and generalization ability of the final output features. By calculating the query matrix, key matrix and value matrix, and using the self-attention mechanism for weighted fusion, the intrinsic relationship between features can be effectively captured, the model's attention to important features can be enhanced, and the accuracy of prediction can be improved. The self-attention mechanism is used to optimize feature representation, especially when processing complex and changeable network data, it can improve the robustness and accuracy of the model.

[0051] Furthermore, the collection of network data to extract network data features refers to building an improved feature extraction model and deploying the feature extraction model to the collection and processing module. The collection and processing module collects network data through network flow sensors and monitoring software, cleans and filters it, converts it into a unified format, and then inputs the improved feature extraction model to extract network data features. .

[0052] It should also be noted that the network data includes network traffic, system logs, user behavior data and IoT device data, and the monitoring software includes Apache Kafka and Elasticsearch.

[0053] By building and deploying an improved feature extraction model, the collection and processing module can efficiently collect and process network data. The combination of network traffic sensors and monitoring software ensures the comprehensiveness and accuracy of data collection. Data cleaning and unified format conversion steps improve the quality and consistency of data, making the subsequent feature extraction process more reliable. The improved feature extraction model combines convolutional neural networks (CNN) and multi-scale low-frequency memory networks (MLFM), which can fully capture the high-frequency and low-frequency features of network data. The CNN part is responsible for extracting the spatial features of the data, while the MLFM part extracts low-frequency information through multi-layer gating mechanisms and wavelet transforms, retaining important time series features. Network traffic sensors monitor the flow of network data packets in real time, and monitoring software continuously records and analyzes network activities. This combination of real-time monitoring and recording ensures the comprehensiveness and timeliness of network data, and helps to quickly discover and respond to network security incidents.

[0054] S2, prediction and prevention module, used to build an improved security prediction model, predict network security events based on the extracted network data features, formulate and implement prevention plans;

[0055] Specifically, building an improved security prediction model refers to selecting a deep neural network DNN to build a basic security prediction model, which includes a feature input layer, a double hidden layer, and a prediction output layer. The feature input layer format is a network data feature format, and the prediction output layer format is a network security event prediction result.

[0056] Add an MLFM unit after the first hidden layer to process the output of the first hidden layer to obtain the low-frequency adjustment result, and use the gating mechanism to fuse the low-frequency adjustment result with the output of the first hidden layer: where g 1 is the gated intermediate representation, W g is the weight of the gated intermediate representation, b g is the bias of the gated intermediate representation, For low frequency adjustment results, As the fusion result, is the sigmoid activation function, is the element-wise product;

[0057] Input the fusion result into the second hidden layer to obtain the second hidden layer output h 2 , introducing a cross-layer connection between the first hidden layer and the second hidden layer will fuse the results and the second hidden layer output h 2 The splicing result is obtained by splicing ;

[0058] Use multi-head mechanism to stitch the results Transformation is performed to obtain hmh And output through the prediction output layer: Where y is the prediction result of network security events, W o is the predicted output layer weight, b o To predict the output layer bias;

[0059] Bayesian optimization is used to adjust model hyperparameters, and gradient descent method is used for model training to obtain an improved safety prediction model.

[0060] By selecting a deep neural network (DNN) to build a basic security prediction model, we can take advantage of DNN's advantages in processing complex data and effectively improve the prediction accuracy of network security incidents. The multi-layer structure of DNN can fully learn and capture the complex features in network data, providing a solid foundation for security incident prediction. Adding a multi-scale low-frequency memory network (MLFM) unit after the first hidden layer can extract and adjust low-frequency features and enhance the model's ability to capture long-term dependent features. The gating mechanism is used to fuse the low-frequency adjustment results with the output of the first hidden layer to retain important low-frequency information and improve the accuracy and representativeness of feature representation. The MLFM unit and the gating mechanism are added to enhance the feature extraction and adjustment capabilities, retain and utilize low-frequency information, and improve the prediction accuracy of the model. A cross-layer connection is introduced between the first layer and the second hidden layer, and the fusion result is spliced ​​with the output of the second hidden layer, which enhances the information flow and feature transmission, avoids information loss, and improves the learning ability and generalization performance of the model. The cross-layer connection is used to strengthen the information transmission between different layers, enrich the feature expression, and improve the learning effect of the model. The splicing result is transformed by the multi-head mechanism, which can capture data features from different angles and improve the diversity and expression ability of features. The introduction of the multi-head mechanism makes the model more flexible and robust when processing complex features. The use of Bayesian optimization for model hyperparameter adjustment can efficiently find the optimal combination of model parameters and improve the performance of the model. The gradient descent method iteratively updates the model parameters to minimize the loss function and improve the convergence speed and prediction accuracy of the model.

[0061] Furthermore, predicting network security incidents based on the extracted network data features, formulating and implementing prevention plans refers to deploying an improved security prediction model to the prediction and prevention module, the prediction and prevention module receives the network data features extracted by the collection and processing module, and inputs the network data features into the improved security prediction model to obtain network security incident prediction results, identifying the network threat type based on the prediction results, determining the network threat level, and formulating preventive measures, detection measures, and response measures for implementation.

[0062] By deploying the improved security prediction model to the prediction and prevention module, advanced deep learning algorithms can be used to efficiently analyze and predict network data, thereby improving the accuracy and timeliness of detecting potential security incidents. The prediction and prevention module receives the network data features extracted by the collection and processing module and inputs them into the improved security prediction model to ensure the continuity and real-time nature of data flow and improve the response speed of the overall system. By analyzing the prediction results of network security events, specific network threat types are identified, and the threat level is determined based on the nature and potential impact of the threat, which facilitates the formulation of targeted protection measures. According to the identified network threat types and levels, corresponding preventive measures can be formulated to effectively prevent the occurrence of potential threats, such as by configuring firewall rules, implementing access control policies, and conducting employee safety training to improve overall network security.

[0063] S3, display storage module, used to visualize the collected and analyzed network data and store it securely in the database;

[0064] Specifically, visually displaying the collected and analyzed network data means that the display storage module displays the collected network data, network security event prediction results and prevention plans in a visual table, and simultaneously sorts the network security event prediction results in the order of network data collection time to form a time-network security statistical chart for display.

[0065] The storage module can be used to clearly visualize the collected network data, allowing users to intuitively view and analyze information such as network traffic, attack types and frequencies. The use of visual tables makes it easier to read and understand data, reducing the possibility of misinterpretation of information. The network security event prediction results are displayed through visual tables and statistical charts, which can effectively convey the results and trends of model predictions. Users can quickly understand potential security threats and risks by viewing these charts and take preventive measures in a timely manner. By presenting the prevention plan in a visual table, users can clearly understand the specific content and implementation steps of each preventive measure, thereby improving the feasibility and effectiveness of the preventive measures. Visualized prevention plans can help security personnel better understand and implement security policies.

[0066] Furthermore, secure storage in a database means that the display storage module stores the displayed data and generated charts in the database, and simultaneously implements security protection measures on the stored data. The database backs up the stored data in the cloud, and regularly performs integrity and security checks on the stored data and backup data to generate a test report.

[0067] Storing the displayed data and generated charts in the database can ensure the persistence and traceability of the data. The use of the database not only provides efficient data management and query capabilities, but also supports the storage and access of large-scale data. Security protection measures are implemented for the stored data, including encrypted storage and access control, to ensure the security of data during storage and transmission, prevent data leakage and unauthorized access. The database backs up the stored data in the cloud, provides data redundancy and disaster recovery capabilities, and can quickly restore data from the cloud when the local server fails to ensure the continuity and reliability of the system. The integrity and security of the stored data and the backup data are regularly checked to ensure that the data has not been tampered with and there are no security risks. The generated test reports can help managers promptly discover and deal with potential problems and improve the security of the system.

[0068] S4, central control module, is used to comprehensively control the operation of other modules and remotely connect to the staff's mobile terminal.

[0069] Specifically, comprehensive control of the operation of the remaining modules means that the central control module is connected to the remaining modules through the network, and generates control commands and transmits them to the remaining modules through the network for execution. The central control module monitors the command execution status of the remaining modules in real time, and issues warnings when failures occur in the remaining modules.

[0070] The central control module can uniformly manage and dispatch each module in the system by generating control commands to ensure the coordinated operation of the system. The accurate generation and issuance of control commands ensures the consistency and effectiveness of system operations. By transmitting control commands over the network, remote control and management can be achieved, reducing human intervention and improving the degree of automation of operations. The reliability and timeliness of network transmission ensure that control commands can be quickly reached and executed. The central control module monitors the command execution status of each module in real time and can promptly discover problems and abnormal situations during execution. Real-time monitoring ensures the dynamic controllability of the system and helps to quickly locate and solve problems. When a system or module fails, the central control module can issue an early warning in a timely manner to remind relevant personnel to take necessary countermeasures and reduce the impact of the failure on system operation. The existence of the early warning mechanism improves the emergency response capability and safety of the system.

[0071] Furthermore, remote connection to the staff mobile terminal refers to the central control module remotely connecting to the staff mobile terminal, and the staff connects to the central control module through the mobile terminal to view the operating status of other modules, and accesses display charts and stored data through the display storage module.

[0072] By remotely connecting to the staff's mobile terminal, the staff can access the system anytime and anywhere to view the operating status and analysis results of each module, which improves the flexibility and convenience of system management. The staff connects to the central control module through the mobile terminal and can view the operating status of each module in the system in real time, promptly discover and handle abnormal situations in operation, and ensure the stability and reliability of the system. Through the display storage module, the staff can access the display charts and storage data generated by the system through the mobile terminal, obtain intuitive network security event analysis results and prevention plans, and improve work efficiency and decision-making accuracy.

[0073] Example 2

[0074] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0075] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0076] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0077] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit with a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit with a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0078] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A security incident prediction and prevention system based on artificial intelligence, characterized by: include, A collection and processing module is used to build an improved feature extraction model and collect network data to extract network data features; The prediction and prevention module is used to build an improved security prediction model, predict network security events based on the extracted network data features, formulate and implement prevention plans; The display and storage module is used to visualize the collected and analyzed network data and store it securely in the database; The central control module is used to comprehensively control the operation of other modules and remotely connect to the staff's mobile terminal; The constructing of the improved feature extraction model refers to constructing a feature extraction basic model using a convolutional neural network CNN, including an input layer, a complex convolution layer and an output layer, the input layer format is set to a network data format, and the output layer format is a network data feature format; Design a multi-scale low-frequency memory network MLFM including input gate, update gate, supplement gate, forget gate and output gate; Add an MLFM unit at the end of each convolutional layer of CNN, connect the input layer of CNN to the MLFM unit, and extract the high-frequency features h of network data based on the convolutional layer. con , the format is (N, C con , H, W), extracting low-frequency features of network data based on MLFM unit h MLFM , the format is (N, C MLFM , H, W), where N is the batch size, C con and C MLFM are the number of channels for extracting network data information in the convolutional layer and MLFM, respectively. H and W are the height and width of the features, respectively; In the same dimension, the high-frequency features of network data and the low-frequency features of network data are concatenated to form the concatenated features h com , the format is (N, C con +C MLFM , H, W); A multi-scale fusion layer is added after each convolution layer of the feature extraction basic model. The multi-scale fusion layer is set between two convolution layers to obtain the output of the previous convolution layer and connect to the next convolution layer to pass the output to the next convolution layer. Repeat the process until all convolution layers are traversed and the network data features are output through the output layer. ; The multi-scale fusion layer includes: For the splicing feature h com Perform multi-scale convolution processing: where h mu is the multi-scale convolution output, W i is the i-th scale convolution kernel, b i is the i-th bias, N is the number of scales, and ReLU is the activation function; The multi-scale convolution output h mu Perform wavelet transform to get h wa , the self-attention fusion weights are obtained through back-propagation algorithm training, and the query matrix Q, key matrix K and value matrix V are calculated respectively: Where W Q , W K and W V are the fusion weights of the query matrix Q, key matrix K, and value matrix V respectively; Weighted fusion based on self-attention fusion mechanism: where h fu is the fusion feature, d k is the scaling factor and T is the transpose operation.

2. The artificial intelligence-based security incident prediction and prevention system according to claim 1, characterized in that: The collection of network data to extract network data features refers to building an improved feature extraction model and deploying the feature extraction model to the collection and processing module. The collection and processing module collects network data through network flow sensors and monitoring software, cleans and filters it, converts it into a unified format, and then inputs it into the improved feature extraction model to extract network data features. .

3. The artificial intelligence-based security incident prediction and prevention system according to claim 2, characterized in that: The improved security prediction model is constructed by selecting a deep neural network DNN to construct a basic security prediction model, which includes a feature input layer , double hidden layers and a prediction output layer, the feature input layer format is the network data feature format, and the prediction output layer format is the network security event prediction result; Add an MLFM unit after the first hidden layer to process the output of the first hidden layer to obtain the low-frequency adjustment result, and use the gating mechanism to fuse the low-frequency adjustment result with the output of the first hidden layer: Where g1 is the gated intermediate representation, W g is the weight of the gated intermediate representation, b g is the bias of the gated intermediate representation, For low frequency adjustment results, As the fusion result, is the sigmoid activation function, is the element-wise product; The fusion result is input into the second hidden layer to obtain the second hidden layer output h2, and a cross-layer connection is introduced between the first hidden layer and the second hidden layer to obtain the fusion result. Combined with the second hidden layer output h2 to get the splicing result ; Use multi-head mechanism to stitch the results Transformation is performed to obtain h mh And output through the prediction output layer: Where y is the prediction result of network security events, W o is the predicted output layer weight, b o To predict the output layer bias; Bayesian optimization is used to adjust model hyperparameters, and gradient descent is used for model training to obtain an improved safety prediction model.

4. The artificial intelligence-based security incident prediction and prevention system according to claim 3, characterized in that: The predicting of network security incidents based on the extracted network data features, formulating and implementing prevention plans refers to deploying an improved security prediction model to the prediction and prevention module, the prediction and prevention module receives the network data features extracted by the collection and processing module, and inputs the network data features into the improved security prediction model to obtain network security incident prediction results, identifies the network threat type based on the prediction results, determines the network threat level, and formulates preventive measures, detection measures, and response measures for implementation.

5. The artificial intelligence-based security incident prediction and prevention system according to claim 4, characterized in that: The network data includes network traffic, system logs, user behavior data and IoT device data, and the monitoring software includes Apache Kafka and Elasticsearch.

6. The artificial intelligence-based security incident prediction and prevention system according to claim 5, characterized in that: The visual display of the collected and analyzed network data refers to the display storage module forming a visual table to display the collected network data, network security event prediction results and prevention plans, and simultaneously sorting the network security event prediction results in the order of network data collection time to form a time-network security statistical chart for display.

7. The artificial intelligence-based security incident prediction and prevention system according to claim 6, characterized in that: The secure storage in the database means that the display storage module stores the displayed data and the generated charts in the database, and simultaneously implements security protection measures on the stored data. The database backs up the stored data in the cloud, and regularly performs integrity and security checks on the stored data and backup data to generate a test report.

8. The artificial intelligence-based security incident prediction and prevention system according to claim 7, characterized in that: The comprehensive control of the operation of the remaining modules means that the central control module is connected to the remaining modules through the network, and generates control commands and transmits them to the remaining modules through the network for execution. The central control module monitors the command execution status of the remaining modules in real time and issues warnings when failures occur in the remaining modules.

9. The artificial intelligence-based security incident prediction and prevention system according to claim 8, characterized in that: The remote connection to the staff mobile terminal refers to the remote connection of the central control module to the staff mobile terminal. The staff connects to the central control module through the mobile terminal to view the operating status of other modules, and accesses the display charts and stored data through the display storage module.

Images