Enterprise data security management method and system based on artificial intelligence

Abstract

The present invention relates to the field of data security management technology, specifically an enterprise data security management method and system based on artificial intelligence, including obtaining the current network node IP address, MAC address, device type, and network role to obtain a node state information sequence, while establishing a directed relationship graph to calculate a network reachable matrix to extract state feature information and capture a first feature data sequence therefrom, the network reachable matrix and the first feature data sequence are fused by an algorithm to obtain a network state model and hierarchically divided to extract a second feature data sequence, the first feature data sequence and the second feature data sequence are matched by an identification formula to match a link abnormality pattern so as to match data channel abnormality information, back up abnormal channel data streams, and implement a backup data channel strategy according to the data channel abnormality information. The present invention can quickly identify potential security threats and data channel abnormalities by real-time monitoring of the security status of an enterprise network system.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to an enterprise data security management method and system based on artificial intelligence. Background Art

[0002] With the acceleration of enterprise digital transformation and the increasing complexity of network environment, enterprise data security has become an important link in enterprise operations that cannot be ignored. However, the current security threats faced by enterprise network systems are increasing, and data channel anomalies are frequent, which brings great risks to the normal operation of enterprises. Traditional enterprise data security management methods often rely on manual monitoring and post-processing, which makes it difficult to quickly and accurately identify security threats and data channel anomalies, leading to serious consequences such as data leakage and system paralysis. The system uses advanced artificial intelligence technology, through deep learning and big data analysis, to monitor the security status of enterprise network systems in real time and quickly identify potential security threats and data channel anomalies. Summary of the invention

[0003] (1) Technical issues to be solved

[0004] The purpose of the present invention is to provide an enterprise data security management method and system based on artificial intelligence to solve the difficult problems of identifying potential threats in enterprise network security and how to ensure the reliability and integrity of data transmission when data channels are abnormal.

[0005] (2) Technical solution

[0006] To achieve the above objectives, on the one hand, the present invention provides an enterprise data security management method based on artificial intelligence, the method comprising:

[0007] The current network node IP address, MAC address, device type, and network role are obtained to obtain a node status information sequence, the node connection status information is obtained to establish a directed relationship graph, and a GCN model is established based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix.

[0008] The current network dynamic link topology is obtained according to the directed relationship graph, and the network dynamic link topology is serialized to obtain static topology time state slices of different time slices, and then the deep dimensional state feature information data is extracted. The state feature information data is input into the long short-term memory network model to capture the fine-grained key feature information data of the relevant time series data and recorded as the first feature data sequence. The network reachable matrix and the first feature data sequence are fused by an algorithm to obtain a network state model.

[0009] The network status model is hierarchically divided and a second characteristic data sequence is extracted therefrom. The first characteristic data sequence and the second characteristic data sequence are matched with a link abnormality pattern through an identification formula. The data channel abnormal information is matched through the abnormal pattern and the data flow in the abnormal data channel is backed up. A backup data channel strategy is implemented according to the data channel abnormal information.

[0010] Furthermore, the method of establishing a GCN model according to the directed relationship graph and the node state information sequence to calculate a network reachability matrix includes:

[0011] The directed relationship graph is divided into a target subgraph by a graph partitioning algorithm, the union of the nodes in the target subgraph is obtained and recorded as a common set, the similarity weights between the nodes are obtained by a similarity calculation formula and a similar adjacency matrix A is constructed; the similarity calculation formula is:

[0012]

[0013] Where S represents the number of nodes in the public set, T(v i ∩v j ) indicates that v i Node and v j The number of nodes that are adjacent to the node at the same time; k in Yes i Node and v j The in-degree and k of the node out Yes i Node and v j The sum of the out-degrees of the nodes, i = 1, 2, 3, ..., n, j = 1, 2, 3, ..., n.

[0014] The average degree of each node in the directed relationship graph is obtained, and the average degree of the current node and the average degree of its neighboring nodes are summed to obtain the current node feature to construct a feature matrix; the similar adjacency matrix and the feature matrix are aggregated to obtain an aggregated matrix to construct a GCN model to capture the continuous state relationship between nodes and edges in the directed graph to obtain a state vector, and the network reachability matrix is ​​obtained by calculating the similarity distance between the state vectors.

[0015] Furthermore, the method of dividing the directed relationship graph into target subgraphs by a graph partitioning algorithm includes:

[0016] Obtain the neighbor nodes of each node in the directed relationship graph and record them as the neighbor set. At the same time, obtain the intersection and union of the neighbor set of each node and the neighbor set of its neighbor node, and obtain the node weight according to the weight calculation formula and record it as the weight coefficient. The weight calculation formula is:

[0017]

[0018] Among them, N(v m ) represents node v i The neighbor set of the neighbor node, N(v i ) represents node v i The neighbor set of J i Represents node v i Weight coefficient, i = 1, 2, 3…, n.

[0019] The nodes whose weight coefficients meet the system preset similarity threshold are recorded as the first similar node set, and the node set whose weight coefficients do not meet the system preset similarity threshold is recorded as the second similar node set. The edges of the nodes in the first similar node set are deleted from the directed relationship graph to obtain the second directed relationship graph, and in the second directed relationship graph, adjacent directed edges are added to the nodes of the second similar node set and the weight coefficients of the nodes are set to the weight values ​​ω of the nodes in the third directed relationship graph to obtain a weighted target subgraph G = (V, E, ω), where V represents the nodes in the second similar node set, and E represents the outgoing edges of the nodes in the second similar node set.

[0020] Furthermore, the method of obtaining the current network dynamic link topology according to the directed relationship graph and serializing the network dynamic link topology to obtain static topology time state slices of different time slices includes:

[0021] Extract the data transmission information between nodes in the preset time period in the network dynamic link topology and record it as an information sequence, and calculate the delay jitter sequence of the information sequence through the delay calculation formula; the delay calculation formula is:

[0022]

[0023] Where N is the total number of packets in the information sequence, D i is the delay time of the ith data packet in the information sequence.

[0024] The delay jitter sequence generates an initial time slice according to the objective function, and obtains an adjustment time slice through a genetic algorithm, and the network dynamic link topology is cut according to the adjustment time slice to obtain a static topology time state slice; the objective function is:

[0025]

[0026] Wherein, A is the sequence length of the delay jitter sequence, T m is the mth delay jitter value of the delay jitter sequence, m=1, 2, ..., A, j=m, m+1, ..., A.

[0027] Furthermore, the method of obtaining a network status model by fusing the network reachability matrix and the first feature data sequence through a fusion algorithm includes:

[0028] The first characteristic data sequence is digitized by the correlation function [P 11 , P 12 ,......,P 1i ]The influence of historical state on current state obtains the sequence of spatiotemporal state characteristic values, and the correlation function is:

[0029]

[0030] in, YesP 1i The value at time t, YesP 1i The value at time t-Δh, τ is the sequence length of the first feature data sequence, i=1, 2,..., n.

[0031] The network reachability matrix obtains a spatial characteristic value sequence according to a node correlation function; the node correlation function is:

[0032]

[0033] Among them, L ik represents the path length between node i and node k, A ik represents the path length between node j and node k; R j =(L j1 , L j2 , ..., L jn ), YesR j The average path length, R i =(L i1 , L i2 , ..., L in ), YesR i The average value of the path length, k = 1, 2, ..., n, i = 1, 2, ..., n, j = 1, 2, ..., n.

[0034] The spatiotemporal state characteristic value sequence and the spatial characteristic value sequence are subjected to multi-feature value fusion to obtain a state fusion feature sequence, the state fusion feature sequence and the directed relationship graph are aggregated through the GCN model to obtain a node spatiotemporal state topology graph, the node spatiotemporal state topology graph is traversed through linear rules to obtain a spatiotemporal state fusion matrix, and the spatiotemporal state fusion matrix constructs a network spatiotemporal state model through a neural network algorithm.

[0035] Furthermore, the first characteristic data sequence and the second characteristic data sequence match the link abnormality pattern through an identification formula, and the method for matching data channel abnormality information through the abnormal pattern includes:

[0036] The first feature data sequence [P 11 , P 12 ,......,P 1i ] and the second characteristic data sequence [P 21 , P 22 , ..., P 2i ]According to the first identification formula, the deformation data sequence [R1, R2, ..., R m ]; The first identification formula:

[0037]

[0038] Among them, Cov(P 1i , P 2i ) is P 1i With P 2i covariance, i = 1, 2, 3, …, n; m = 1, 2, …, n.

[0039] The offset between the deformed data sequence and the first feature data sequence is calculated, and the data set whose offset is greater than the cumulative anomaly threshold preset by the system is recorded as an anomaly set, and the data set whose offset is less than or equal to the cumulative anomaly threshold preset by the system is recorded as an action set. According to the PCA technology, the anomaly set and the action set are respectively mapped to the coordinate axes to obtain an anomaly curve and an action curve, and the Fleche distance between the anomaly curve and the action curve is calculated. If the Fleche distance is greater than the preset distance value, a data channel anomaly occurs, and the anomaly set is input into the long short-term memory network model to obtain anomaly information.

[0040] Furthermore, the method for implementing a backup data channel strategy according to the data channel abnormality information includes:

[0041] The abnormal source set is obtained through the abnormal information, and the fault dependency matrix is ​​obtained by judging the reachability of the abnormal source set and the current network node according to the second identification formula; the second identification formula is:

[0042]

[0043] Among them, e i is the ith fault point in the abnormal source set; t j is the jth node in the current network node.

[0044] The relative value of the column vector in the fault dependency matrix is ​​measured by the Euclidean norm, the column vector whose relative value is lower than the preset value is taken and fitted with the vectorized second characteristic data sequence to obtain the standby data channel status information, and the data stream is routed to the standby channel according to the standby data channel status information.

[0045] Based on the same inventive concept, on the other hand, the present invention also provides an enterprise data security management system based on artificial intelligence, the system comprising:

[0046] The matrix conversion module obtains the current network node IP address, MAC address, device type, and network role to obtain a node status information sequence, obtains the node connection status information to establish a directed relationship graph, and establishes a GCN model based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix.

[0047] A feature extraction module obtains the current network dynamic link topology according to the directed relationship graph and serializes the network dynamic link topology to obtain static topology time state slices of different time slices, and then extracts deep dimensional state feature information data, inputs the state feature information data into a long short-term memory network model to capture the fine-grained key feature information data of related time series data and records it as a first feature data sequence, and obtains a network state model by fusing the network reachable matrix and the first feature data sequence through a fusion algorithm.

[0048] The abnormal matching module divides the network status model into levels and extracts a second characteristic data sequence therefrom. The first characteristic data sequence and the second characteristic data sequence match the link abnormality pattern through an identification formula, the data channel abnormal information is matched through the abnormal pattern and the data flow in the abnormal data channel is backed up, and a backup data channel strategy is implemented according to the data channel abnormal information.

[0049] (3) Beneficial effects

[0050] Compared with the prior art, the present invention has the following beneficial effects:

[0051] 1. Utilizing advanced artificial intelligence technology, through deep learning and big data analysis, it can monitor the security status of enterprise network systems in real time and quickly identify potential security threats and data channel anomalies.

[0052] 2. Once a channel abnormality is detected, the system will immediately issue an alarm and automatically switch to the backup channel to ensure stable data transmission. The system will also automatically trigger a backup operation to prevent data loss or tampering. This innovative management method will significantly enhance the company's data security capabilities and provide solid support for the company's digital transformation. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 This is a flowchart of an enterprise data security management method based on artificial intelligence according to Embodiment 1 of the present invention;

[0054] Figure 2 This is a module block diagram of an enterprise data security management system based on artificial intelligence according to Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0055] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Before giving examples, it is necessary to explain the application scenarios of the present invention: the method and system can be used to identify potential network threats and how to ensure the reliability and integrity of data transmission when data channels are abnormal.

[0057] Example 1

[0058] like Figure 1 As shown, this embodiment provides an enterprise data security management method based on artificial intelligence, and the method includes the following steps:

[0059] S1, obtain the current network node IP address, MAC address, device type, and network role to obtain a node status information sequence, obtain the node connection status information to establish a directed relationship graph, and establish a GCN model based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix.

[0060] First, the core attributes of the current network node are extracted, including IP address, MAC address, device type and the role it plays in the network. These attributes together constitute the detailed status information sequence of the node. Then, in order to gain a deeper understanding of the connection relationship between nodes, the connection status information of the nodes is further obtained, and a directed relationship graph is constructed based on this information. This graph can intuitively show the connection mode and direction between nodes. Secondly, with the directed relationship graph and node status information sequence as the basis, the graph convolutional network model is further used for in-depth analysis. The GCN model can effectively process graph structure data, and calculate the reachability matrix in the network through the attribute information of the nodes and the connection relationship between the nodes. This reachability matrix can clearly show whether there is a reachable path between any two nodes in the network, thereby better understanding the network structure relationship.

[0061] S2, according to the directed relationship graph, obtain the current network dynamic link topology and serialize the network dynamic link topology to obtain static topology time state slices of different time slices, and then extract deep dimensional state feature information data, input the state feature information data into the long short-term memory network model to capture the fine-grained key feature information data of the relevant time series data and record it as the first feature data sequence, and obtain the network state model by fusing the network reachable matrix and the first feature data sequence through a fusion algorithm.

[0062] After an in-depth analysis of the directed relationship graph, the dynamic link topology in the current network can be captured. This structure reflects the dynamic changes of network links in real time. Subsequently, we use serialization processing technology to convert these dynamic link topologies into a series of static topology time state slices under different time slices. The purpose of this step is to convert dynamic and continuous network changes into static and analyzable time series data, which is more convenient for extracting deep dimensional state feature information data in static topology time state slices. In addition, these feature information data not only contain the basic structural information of the network topology, but also contain the dynamic change characteristics of the network under different time states. Finally, we input these state feature information data into the long short-term memory network (LSTM) model. With its unique gating mechanism, the LSTM model can effectively capture the fine-grained key feature information in the time series data. These key feature information data are recorded as the first feature data sequence, which will provide an important reference for subsequent network analysis, prediction and optimization.

[0063] S3, hierarchically divide the network status model and extract the second characteristic data sequence therefrom, match the link abnormality pattern with the first characteristic data sequence and the second characteristic data sequence through an identification formula, match the data channel abnormality information through the abnormal pattern and back up the data flow in the abnormal data channel, and implement the backup data channel strategy according to the data channel abnormality information.

[0064] The method for establishing a GCN model according to the directed relationship graph and the node state information sequence to calculate a network reachability matrix includes:

[0065] The directed relationship graph is divided into a target subgraph by a graph partitioning algorithm, the union of the nodes in the target subgraph is obtained and recorded as a common set, the similarity weights between the nodes are obtained by a similarity calculation formula and a similar adjacency matrix A is constructed; the similarity calculation formula is:

[0066]

[0067] Where S represents the number of nodes in the public set, T(v i ∩v j ) indicates that vi Node and v j The number of nodes that are adjacent to the node at the same time; k in Yes i Node and v j The in-degree and k of the node out Yes i Node and v j The sum of the out-degrees of the nodes, i = 1, 2, 3, ..., n, j = 1, 2, 3, ..., n.

[0068] The average degree of each node in the directed relationship graph is obtained, and the average degree of the current node and the average degree of its neighboring nodes are summed to obtain the current node feature to construct a feature matrix; the similar adjacency matrix and the feature matrix are aggregated to obtain an aggregated matrix to construct a GCN model to capture the continuous state relationship between nodes and edges in the directed graph to obtain a state vector, and the network reachability matrix is ​​obtained by calculating the similarity distance between the state vectors.

[0069] The method of dividing the directed relationship graph into target subgraphs by using a graph partitioning algorithm comprises:

[0070] Obtain the neighbor nodes of each node in the directed relationship graph and record them as the neighbor set. At the same time, obtain the intersection and union of the neighbor set of each node and the neighbor set of its neighbor node and obtain the node weight according to the weight calculation formula and record them as the weight coefficient. The weight calculation formula is:

[0071]

[0072] Among them, N(v m ) represents node v i The neighbor set of the neighbor node, N(v i ) represents node v i The neighbor set of J i Represents node v i Weight coefficient, i = 1, 2, 3…, n.

[0073] The nodes whose weight coefficients meet the system preset similarity threshold are recorded as the first similar node set, and the node set whose weight coefficients do not meet the system preset similarity threshold is recorded as the second similar node set. The edges of the nodes in the first similar node set are deleted from the directed relationship graph to obtain the second directed relationship graph, and adjacent directed edges are added to the nodes of the second similar node set in the second directed relationship graph and the weight coefficients of the nodes are set to the weight values ​​η of the nodes in the third directed relationship graph to obtain a weighted target subgraph G = (V, E, η), where V represents the nodes in the second similar node set, and E represents the outgoing edges of the nodes in the second similar node set.

[0074] The method of obtaining the current network dynamic link topology according to the directed relationship graph and serializing the network dynamic link topology to obtain static topology time state slices of different time slices includes:

[0075] Extract the data transmission information between nodes in the preset time period in the network dynamic link topology and record it as an information sequence, and calculate the delay jitter sequence of the information sequence through the delay calculation formula; the delay calculation formula is:

[0076]

[0077] Where N is the total number of packets in the information sequence, D i is the delay time of the ith data packet in the information sequence.

[0078] The delay jitter sequence generates an initial time slice according to the objective function, and obtains an adjustment time slice through a genetic algorithm, and the network dynamic link topology is cut according to the adjustment time slice to obtain a static topology time state slice. The objective function is:

[0079]

[0080] Wherein, A is the sequence length of the delay jitter sequence, T m is the mth delay jitter value of the delay jitter sequence, m=1, 2, ..., A, j=m, m+1, ..., A.

[0081] The method of obtaining a network status model by fusing the network reachability matrix and the first feature data sequence through a fusion algorithm comprises:

[0082] The first characteristic data sequence is digitized by the correlation function [P 11 , P 12 ,......,P 1i ]The influence of historical state on current state obtains the sequence of spatiotemporal state characteristic values, and the correlation function is:

[0083]

[0084] in, YesP 1i The value at time t, YesP 1i The value at time t-Δh, τ is the sequence length of the first feature data sequence, i=1, 2,..., n.

[0085] The network reachability matrix obtains a sequence of spatial characteristic values ​​according to a node correlation function. The node correlation function is:

[0086]

[0087] Among them, L ik represents the path length between node i and node k, A ik represents the path length between node j and node k; R j =(L j1 , L j2 ,......,L jn ), YesR j The average path length, R i =(L i1 , L i2 , ..., L in ), YesR i The average value of the path length, k = 1, 2, ..., n, i = 1, 2, ..., n, j = 1, 2, ..., n.

[0088] The spatiotemporal state characteristic value sequence and the spatial characteristic value sequence are subjected to multi-feature value fusion to obtain a state fusion feature sequence, the state fusion feature sequence and the directed relationship graph are aggregated through the GCN model to obtain a node spatiotemporal state topology graph, the node spatiotemporal state topology graph is traversed through linear rules to obtain a spatiotemporal state fusion matrix, and the spatiotemporal state fusion matrix constructs a network spatiotemporal state model through a neural network algorithm.

[0089] The acquired spatiotemporal state characteristic value sequence is combined with the spatial characteristic value sequence, and a more comprehensive and accurate state fusion feature sequence is formed through a series of fusion algorithms. The graph convolutional network (GCN) model is used to combine this state fusion feature sequence with the known directed relationship graph. Through the aggregation operation in the model, a node spatiotemporal state topology map is generated to more deeply understand and analyze the spatiotemporal state changes in the network. In the process of traversing the spatiotemporal state topology map, a series of linear rules are applied to carefully analyze and calculate the nodes and connections in the graph, and finally the spatiotemporal state fusion matrix is ​​obtained. This matrix not only contains the spatial information in the network, but also incorporates the change characteristics of the time dimension. Finally, in order to more intuitively display and predict the spatiotemporal state changes in the network, a neural network algorithm is used, and a network spatiotemporal state model is constructed based on the spatiotemporal state fusion matrix. This model can fully reflect the spatiotemporal state characteristics in the network and provide a powerful tool for subsequent network analysis, optimization and prediction.

[0090] The first characteristic data sequence and the second characteristic data sequence are matched with a link abnormality pattern through an identification formula, and the method for matching data channel abnormality information through the abnormal pattern includes:

[0091] The first feature data sequence [P 11 , P 12 , ..., P1i ] and the second characteristic data sequence [P 21 , P 22 , ..., P 2i ]According to the first identification formula, the deformation data sequence [R1, R2, ..., R m ]. The first identification formula:

[0092]

[0093] Among them, Cov(P 1i , P 2i ) is P 1i With P 2i covariance, i = 1, 2, 3, …, n; m = 1, 2, …, n.

[0094] The offset between the deformed data sequence and the first feature data sequence is calculated, and the data set whose offset is greater than the cumulative anomaly threshold preset by the system is recorded as an anomaly set, and the data set whose offset is less than or equal to the cumulative anomaly threshold preset by the system is recorded as an action set. According to the PCA technology, the anomaly set and the action set are respectively mapped to the coordinate axes to obtain an anomaly curve and an action curve, and the Fleche distance between the anomaly curve and the action curve is calculated. If the Fleche distance is greater than the preset distance value, a data channel anomaly occurs, and the anomaly set is input into the long short-term memory network model to obtain anomaly information.

[0095] The method for implementing a backup data channel strategy according to the abnormal data channel information includes:

[0096] The abnormal source set is obtained through the abnormal information, and the fault dependency matrix is ​​obtained by judging the reachability of the abnormal source set and the current network node according to the second identification formula; the second identification formula is:

[0097]

[0098] Among them, e i is the ith fault point in the abnormal source set; t j is the jth node in the current network node;

[0099] The relative value of the column vector in the fault dependency matrix is ​​measured by the Euclidean norm, the column vector whose relative value is lower than the preset value is taken and fitted with the vectorized second characteristic data sequence to obtain the standby data channel status information, and the data stream is routed to the standby channel according to the standby data channel status information.

[0100] Example 2

[0101] Based on the same inventive concept, Figure 2As shown, this embodiment also provides an enterprise data security management system based on artificial intelligence, and the system includes:

[0102] The matrix conversion module is used to obtain the current network node IP address, MAC address, device type, and network role to obtain a node status information sequence, obtain the node connection status information to establish a directed relationship graph, and establish a GCN model based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix.

[0103] A feature extraction module is connected to the matrix conversion module, and is used to obtain the current network dynamic link topology according to the directed relationship graph and serialize the network dynamic link topology to obtain static topology time state slices of different time slices, and then extract deep dimensional state feature information data, input the state feature information data into the long short-term memory network model to capture the fine-grained key feature information data of the relevant time series data and record it as the first feature data sequence, and obtain the network state model by fusing the network reachable matrix and the first feature data sequence through a fusion algorithm.

[0104] The abnormal matching module is connected to the feature extraction module, and is used to divide the network status model into levels and extract a second feature data sequence therefrom. The first feature data sequence and the second feature data sequence match the link abnormality pattern through an identification formula, match the data channel abnormal information through the abnormal pattern and back up the data flow in the abnormal data channel, and implement a backup data channel strategy according to the data channel abnormal information.

[0105] The present invention is described by specific embodiments, and it should be understood by those skilled in the art that various changes and equivalent substitutions may be made to the present invention without departing from the scope of the present invention. In addition, various modifications may be made to the present invention for specific situations or materials without departing from the scope of the present invention. Therefore, the present invention is not limited to the disclosed specific embodiments, but should include all implementation methods falling within the scope of the claims of the present invention.

Claims

1. An enterprise data security management method based on artificial intelligence, characterized in that: The method comprises: Obtain the current network node IP address, MAC address, device type, and network role to obtain a node status information sequence, obtain the node connection status information to establish a directed relationship graph, and establish a GCN model based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix; According to the directed relationship graph, the current network dynamic link topology is obtained and the network dynamic link topology is serialized to obtain static topology time state slices of different time slices, and then the deep dimensional state feature information data is extracted, and the state feature information data is input into the long short-term memory network model to capture the fine-grained key feature information data of the relevant time series data as the first feature data sequence, and the network reachability matrix and the first feature data sequence are fused by an algorithm to obtain a network state model; The network state model is hierarchically divided and a second characteristic data sequence is extracted therefrom, the first characteristic data sequence and the second characteristic data sequence are matched with a link abnormality pattern through an identification formula, data channel abnormality information is matched through the abnormal pattern and a data stream in the abnormal data channel is backed up, and a backup data channel strategy is implemented according to the data channel abnormality information; The method of obtaining a network status model by fusing the network reachability matrix and the first feature data sequence through a fusion algorithm comprises: The first characteristic data sequence is digitized by the correlation function [P 11 , P 12 , ..., P 1i ]The influence of historical state on current state obtains the sequence of spatiotemporal state characteristic values, and the correlation function is: in, YesP 1i The value at time t, YesP 1i The value at time t-Δh, τ is the sequence length of the first feature data sequence, i=1, 2, ..., n; The network reachability matrix obtains a spatial characteristic value sequence according to a node correlation function; the node correlation function is: Among them, L ik represents the path length between node i and node k, L jk represents the path length between node j and node k; R j =(L j1 , L j2 , ..., L jn ), YesR j The average path length, R i =(L i1 , L i2 , ..., L in ), YesR i The average value of the path length, k = 1, 2, ..., n, i = 1, 2, ..., n, j = 1, 2, ..., n; The spatiotemporal state characteristic value sequence and the spatial characteristic value sequence are subjected to multi-feature value fusion to obtain a state fusion feature sequence, the state fusion feature sequence and the directed relationship graph are aggregated through the GCN model to obtain a node spatiotemporal state topology map, the spatiotemporal state topology map is traversed through the linear rule to obtain a spatiotemporal state fusion matrix, and the spatiotemporal state fusion matrix is ​​used to construct a network spatiotemporal state model through a neural network algorithm. The method for establishing a GCN model according to the directed relationship graph and the node state information sequence to calculate a network reachability matrix includes: The directed relationship graph is divided into a target subgraph by a graph partitioning algorithm, the union of the nodes in the target subgraph is obtained and recorded as a common set, the similarity weights between the nodes are obtained by a similarity calculation formula and a similar adjacency matrix A is constructed; the similarity calculation formula is: Where S represents the number of nodes in the public set, T(v i ∩v j ) indicates that v i Node and v j The number of nodes that are adjacent to the node at the same time; k in Yes i Node and v j The in-degree and k of the node out Yes i Node and v j The sum of the out-degrees of the nodes, i = 1, 2, 3, ..., n, j = 1, 2, 3 ..., n, where n represents the number of all nodes in the target subgraph; The average degree of each node in the directed relationship graph is obtained, and the average degree of the current node and the average degree of its neighboring nodes are summed to obtain the current node feature to construct a feature matrix; the similar adjacency matrix and the feature matrix are aggregated to obtain an aggregated matrix to construct a GCN model to capture the continuous state relationship between nodes and edges in the directed relationship graph to obtain a state vector, and the network reachability matrix is ​​obtained by calculating the similarity distance between the state vectors.

2. The enterprise data security management method based on artificial intelligence according to claim 1 is characterized in that: The method of dividing the directed relationship graph into target subgraphs by using a graph partitioning algorithm comprises: Obtain the neighbor nodes of each node in the directed relationship graph and record them as the neighbor set. At the same time, obtain the intersection and union of the neighbor set of each node and the neighbor set of its neighbor node, and obtain the node weight according to the weight calculation formula and record it as the weight coefficient. The weight calculation formula is: Among them, N(v m ) represents node v i The neighbor set of the neighbor node, N(v i ) represents node v i The neighbor set of J i Represents node v i The weight coefficient of , i = 1, 2, 3, ..., n; The nodes whose weight coefficients meet the system preset similarity threshold are recorded as the first similar node set, and the node set whose weight coefficients do not meet the system preset similarity threshold is recorded as the second similar node set. The edges of the nodes in the first similar node set are deleted from the directed relationship graph to obtain the second directed relationship graph, and adjacent directed edges are added to the nodes of the second similar node set in the second directed relationship graph to obtain the third directed relationship graph, and the weight coefficient of the node is set to the weight value ω of the node in the third directed relationship graph to obtain a weighted target subgraph G = (V, E, ω), where V represents the nodes in the second similar node set, and E represents the outgoing edges of the nodes in the second similar node set.

3. The enterprise data security management method based on artificial intelligence according to claim 1 is characterized in that: The method of obtaining the current network dynamic link topology according to the directed relationship graph and serializing the network dynamic link topology to obtain static topology time state slices of different time slices includes: The data transmission information between nodes in the preset time period in the network dynamic link topology is extracted and recorded as an information sequence, and the delay jitter sequence of the information sequence is calculated by the delay calculation formula; the delay calculation formula is: Where N is the total number of packets in the information sequence, D i is the delay time of the ith data packet of the information sequence; The delay jitter sequence generates an initial time slice according to the objective function, and obtains an adjustment time slice through a genetic algorithm, and the network dynamic link topology is cut according to the adjustment time slice to obtain a static topology time state slice; the objective function is: Wherein, A is the sequence length of the delay jitter sequence, T m is the mth delay jitter value of the delay jitter sequence, m=1, 2, ..., A, j=m, m+1, ..., A.

4. The enterprise data security management method based on artificial intelligence according to claim 1 is characterized in that: The first characteristic data sequence and the second characteristic data sequence are matched with a link abnormality pattern through an identification formula, and the method for matching data channel abnormality information through the abnormal pattern includes: The first feature data sequence [P 11 , P 12 , ..., P 1i ] and the second characteristic data sequence [P 21 , P 22 , ..., P 2i ]According to the first identification formula, the deformation data sequence [R1, R2, ..., R m ]; The first identification formula: Among them, Cov(P 1i , P 2i ) is P 1i With P 2i Covariance of , m = 1, 2, ..., n; The offset between the deformed data sequence and the first feature data sequence is calculated, and the data set whose offset is greater than the cumulative anomaly threshold preset by the system is recorded as an anomaly set, and the data set whose offset is less than or equal to the cumulative anomaly threshold preset by the system is recorded as an action set. According to the PCA technology, the anomaly set and the action set are respectively mapped to the coordinate axes to obtain an anomaly curve and an action curve, and the Fleche distance between the anomaly curve and the action curve is calculated. If the Fleche distance is greater than the preset distance value, a data channel anomaly occurs, and the anomaly set is input into the long short-term memory network model to obtain anomaly information.

5. The enterprise data security management method based on artificial intelligence according to claim 1 is characterized in that: The method for implementing a backup data channel strategy according to the abnormal data channel information includes: The abnormal source set is obtained through the abnormal information, and the fault dependency matrix is ​​obtained by judging the reachability of the abnormal source set and the current network node according to the second identification formula; the second identification formula is: Among them, e i is the ith fault point in the abnormal source set; t j is the jth node in the current network node; The relative value of the column vector in the fault dependency matrix is ​​measured by the Euclidean norm, the column vector whose relative value is lower than the preset value is taken and fitted with the vectorized second characteristic data sequence to obtain the standby data channel status information, and the data stream is routed to the standby channel according to the standby data channel status information.

6. The enterprise data security management system based on artificial intelligence is characterized by: The system comprises: A matrix conversion module is used to obtain the current network node IP address, MAC address, device type, and network role to obtain a node status information sequence, obtain the node connection status information to establish a directed relationship graph, and establish a GCN model based on the directed relationship graph and the node status information sequence to calculate the network reachability matrix; A feature extraction module, connected to the matrix conversion module, is used to obtain the current network dynamic link topology according to the directed relationship graph and serialize the network dynamic link topology to obtain static topology time state slices of different time slices, thereby extracting deep dimensional state feature information data, inputting the state feature information data into a long short-term memory network model to capture the fine-grained key feature information data of the relevant time series data as a first feature data sequence, and obtaining a network state model by fusing the network reachable matrix with the first feature data sequence through a fusion algorithm; an abnormal matching module, connected to the feature extraction module, for dividing the network state model into layers and extracting a second feature data sequence therefrom, matching the first feature data sequence and the second feature data sequence with a link abnormality pattern through an identification formula, matching data channel abnormal information through the abnormal pattern and backing up the data flow in the abnormal data channel, and implementing a backup data channel strategy according to the data channel abnormal information; The method of obtaining a network status model by fusing the network reachability matrix and the first feature data sequence through a fusion algorithm comprises: The first characteristic data sequence is digitized by the correlation function [P 11 , P 12 , ..., P 1i ]The influence of historical state on current state obtains the sequence of spatiotemporal state characteristic values, and the correlation function is: in, YesP 1i The value at time t, YesP 1i The value at time t-Δh, τ is the sequence length of the first feature data sequence, i=1, 2, ..., n; The network reachability matrix obtains a spatial characteristic value sequence according to a node correlation function; the node correlation function is: Among them, L ik represents the path length between node i and node k, L jk represents the path length between node j and node k; R j =(L j1 , L j2 , ..., L jn ), YesR j The average path length, R i =(L i1 , L i2 , ..., L in ), YesR i The average value of the path length, k = 1, 2, ..., n, i = 1, 2, ..., n, j = 1, 2, ..., n; The spatiotemporal state characteristic value sequence and the spatial characteristic value sequence are subjected to multi-feature value fusion to obtain a state fusion feature sequence, the state fusion feature sequence and the directed relationship graph are aggregated through the GCN model to obtain a node spatiotemporal state topology map, the spatiotemporal state topology map is traversed through the linear rule to obtain a spatiotemporal state fusion matrix, and the spatiotemporal state fusion matrix is ​​used to construct a network spatiotemporal state model through a neural network algorithm. The method for establishing a GCN model according to the directed relationship graph and the node state information sequence to calculate a network reachability matrix includes: The directed relationship graph is divided into a target subgraph by a graph partitioning algorithm, the union of the nodes in the target subgraph is obtained and recorded as a common set, the similarity weights between the nodes are obtained by a similarity calculation formula and a similar adjacency matrix A is constructed; the similarity calculation formula is: Where S represents the number of nodes in the public set, T(v i ∩v j ) indicates that v i Node and v j The number of nodes that are adjacent to the node at the same time; k in Yes i Node and v j The in-degree and k of the node out Yes i Node and v j The sum of the out-degrees of the nodes, i = 1, 2, 3, ..., n, j = 1, 2, 3 ..., n, where n represents the number of all nodes in the target subgraph; The average degree of each node in the directed relationship graph is obtained, and the average degree of the current node and the average degree of its neighboring nodes are summed to obtain the current node feature to construct a feature matrix; the similar adjacency matrix and the feature matrix are aggregated to obtain an aggregated matrix to construct a GCN model to capture the continuous state relationship between nodes and edges in the directed relationship graph to obtain a state vector, and the network reachability matrix is ​​obtained by calculating the similarity distance between the state vectors.

Images