Artificial intelligence-based network security robot inspection method, system and device

Abstract

The present invention relates to a network security robot inspection method, system and device based on artificial intelligence, and belongs to the field of network security technology. The inspection method includes: automatically collecting inspection data of the target object based on machine process automation according to a data capture rule engine; normalizing the collected inspection data; inputting the normalized inspection data into a traceability alarm model based on the principal component selected by principal component analysis, and predicting the output as the risk level of the network security risk event and the network traffic of the target object. The present invention realizes the automatic collection of inspection data through machine process automation and collects inspection data based on a data capture rule engine, thereby improving the validity of the data and the efficiency of data collection and post-processing analysis. The risk level and network traffic of the input principal component type data are predicted by the created traceability alarm model, thereby realizing real-time monitoring of network security risk events.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically relates to a network security robot inspection method, system and device based on artificial intelligence. Background Art

[0002] One of the core goals of network security is to detect potential threats and attacks in a timely manner. With the widespread application of information technology and the rapid growth of cyberspace, network threats are becoming increasingly complex and varied, and attack methods and technologies are constantly evolving. Traditional security detection and early warning cannot effectively respond to new threats and need to be continuously upgraded and improved. However, security detection and security problem response in related technologies are in the passive prevention and passive blocking stages, requiring a lot of manual operation, manual intervention, and experience judgment, wasting manpower and not responding in time. At the same time, attack methods are endless, and the feature library is passively expanding, requiring more resources and computing power. The detection efficiency decreases with the increase of the feature library.

[0003] Therefore, there is an urgent need to propose an artificial intelligence-based network security robot inspection method, system and device, which can analyze and automatically execute process tasks based on artificial intelligence, improve the real-time and efficiency of detection and early warning, and provide accurate and effective early warning information for network security. Summary of the invention

[0004] In order to solve the above problems existing in the prior art, the present invention provides a network security robot inspection method, system and device based on artificial intelligence, which realizes the automatic collection of inspection data through machine process automation, and collects inspection data according to the data capture rule engine, thereby improving the validity of data and the efficiency of data collection and post-processing analysis. The risk level and network traffic of the input principal component type data are predicted by the created traceability alarm model, realizing real-time monitoring of network security risk events, and improving the alarm traceability response speed through the matching of target objects.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] In a first aspect, the present invention provides a network security robot inspection method based on artificial intelligence, comprising the following steps:

[0007] Collect inspection data: Based on machine process automation and data capture rule engine, the inspection data of the target object is automatically collected; the inspection data includes network security data and network traffic data;

[0008] Data normalization processing: normalize the collected inspection data;

[0009] Source tracing alarm analysis: The normalized inspection data is input into the source tracing alarm model based on the principal components selected by principal component analysis, and the predicted output is the risk level of the network security risk event and the network traffic of the target object;

[0010] Compare the predicted value and risk level of network traffic with the set monitoring threshold, track the target object of abnormal network traffic that meets the alarm conditions, and obtain the traceability information of the same network security risk event by matching the target object and timestamp;

[0011] Among them, collecting inspection data includes the following steps:

[0012] Create a data crawling rule engine: collect historical abnormal network security data and network traffic data to mine correlation rules;

[0013] Integrate RPA and packaging engine: Integrate RPA tools and data capture rule engines to achieve data interactive communication;

[0014] Automated data collection: When the data capture rule engine detects conditions that meet the rules, it triggers the RPA tool to start automatically and perform collection operations according to the rules defined by the data capture rule engine.

[0015] Furthermore, the traceability information includes IP address, port number, device identification, protocol type and behavior data.

[0016] Furthermore, the creation of the data crawling rule engine includes the following steps:

[0017] Capture network security data and network traffic data packets generated during device communication, and extract network security feature libraries from network security data and network traffic;

[0018] Vectorize and encode the extracted network security feature library, and merge all feature sets into a network security feature sequence;

[0019] Use association analysis algorithms to mine association rules within network security feature sequences, build frequent sets by mining frequent items of features in feature sequences, and then obtain association rules based on calculating the confidence of each feature frequent set;

[0020] The network security feature sequence is linearly combined with the mined association rules, and the feature sequence is reconstructed as a data crawling rule engine.

[0021] Furthermore, the network security feature library includes a time feature set, a port number feature set, a protocol feature set, a risk level feature set, a device identification feature set, a data flow feature set, a data packet feature set, and a behavior feature set.

[0022] Further, the data flow feature set includes source IP address, destination IP address, flow duration, average flow rate, number of flow packets, number of flow bytes and packet length distribution parameters;

[0023] The data packet feature set includes the total number of packets, the number of packet bytes, the average packet length, the total number of flow packets and the average flow packet length; the behavior feature set includes registration, login, creation, modification, transaction and access behaviors.

[0024] Furthermore, the creation of the traceability alarm model includes the following steps:

[0025] Perform principal component analysis on network security inspection data, select principal components for training and testing, and obtain data after dimensionality reduction of network security inspection data;

[0026] According to the results of principal component analysis of the network security inspection data sequence, a data set is constructed by extracting the principal components in the network security inspection data sequence;

[0027] K-fold cross validation is used to divide the data set into a validation data set and a training data set;

[0028] A traceability alarm model is established based on multi-dimensional data of traffic. The input is the selected principal component, and the predicted output is the risk level of the network security risk event and the network traffic of the target object. The hidden layer is selected through experiments and trial and error, and the transfer function is the log-sigmoid function.

[0029] After determining the network structure and training data set, the neural network toolbox is used to train the samples. The training is completed when the error between the actual output and the expected output reaches the allowable range.

[0030] Furthermore, in creating a traceability alarm model, the principal component analysis of network security inspection data includes the following steps:

[0031] Conduct data centralization and data normalization on the inspection data to eliminate the impact of dimension, data variation and data magnitude differences on variable analysis;

[0032] Calculate the covariance matrix to express the variance of each feature and the covariance between different features; solve the eigenvalues ​​and corresponding eigenvectors of the covariance matrix;

[0033] The eigenvectors are sorted from large to small according to the corresponding eigenvalues ​​to form a transformation matrix, and the principal component matrix is ​​calculated; the eigenvalues ​​are used to calculate the cumulative contribution rate of the variance, and the eigenvectors corresponding to the first M eigenvalues ​​with cumulative contribution rates greater than 80% are taken as the principal components.

[0034] Furthermore, in creating the source tracing alarm model, the data division using K-fold cross validation includes:

[0035] Randomly divide the dataset into pairs of equal size k partitions, of which k The value is 4, for each partition i , in the remaining k - Train the model on 1 partition and then i The model is evaluated on , and the final validation score is equal to k The average of the scores is taken, that is, 75% of the data is used as the training data set and 25% of the data is used as the validation data set.

[0036] In a second aspect, the present invention provides an artificial intelligence-based network security robot inspection system, which is applied to an artificial intelligence-based network security robot inspection method as described above, including a digital employee module, a network inspection and analysis module, and a traceability alarm module;

[0037] The digital employee module integrates the RPA scheduling and control capabilities with the AI ​​capabilities of the technical platform, and completes the collection of inspection data of target objects through the RPA preset data capture rule engine;

[0038] The network inspection and analysis module predicts the network security risk level and network traffic of the target object by preprocessing the collected inspection data and then inputting it into the traceability alarm model, wherein the preprocessing includes data normalization and principal component screening.

[0039] The tracing alarm module compares the risk level of the predicted network security risk event and the network traffic of the target object with the monitoring threshold, tracks the target object for the abnormal network traffic that meets the alarm conditions, and obtains the tracing information of the same network security risk event by matching the target object and the timestamp.

[0040] In a third aspect, the present invention provides an artificial intelligence-based network security robot inspection system, including an artificial intelligence-based network security robot inspection system as described above.

[0041] The beneficial effects of the present invention are:

[0042] The present invention realizes the automatic collection of inspection data through machine process automation, creates a data capture rule engine by associating and mining the inherent combination and connection between feature sets in the network security feature library, collects inspection data based on the correlation between network security inspection data features and network security risk events, and improves the validity of data and the efficiency of data collection and post-processing analysis. At the same time, the creation of the data capture rule engine combines network security data and network traffic data, provides sufficient conditional data types for selection for the creation of the data capture rule engine, and the captured data provides support for post-source tracing analysis.

[0043] In the process of creating the traceability alarm model, the present invention performs principal component analysis on the network security inspection data based on the selective collection of the data capture rule engine, which reduces the complexity and dimension of the data and improves the generalization ability and anti-overfitting ability of the model; at the same time, in the training process, K-fold cross-validation is used to effectively utilize the data set for model evaluation, reducing the deviation introduced by unreasonable data division. The created traceability alarm model predicts the risk level and network traffic of the input principal component type data, realizes real-time monitoring of network security risk events, and improves the alarm traceability response speed through the matching of target objects. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0045] Figure 1 A schematic diagram of the steps of an artificial intelligence-based network security robot inspection method provided by an embodiment of the present invention;

[0046] Figure 2 A schematic diagram of the steps for collecting inspection data provided by an embodiment of the present invention;

[0047] Figure 3 A schematic diagram of the steps of creating a data crawling rule engine provided by an embodiment of the present invention;

[0048] Figure 4 A schematic diagram of the steps for creating a source tracing alarm model provided by an embodiment of the present invention;

[0049] Figure 5 A schematic structural diagram of an artificial intelligence-based network security robot inspection system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation methods, structures, features and effects of the present invention are described in detail below in conjunction with the accompanying drawings and preferred embodiments.

[0051] In the description of this disclosure, the term "Robotic Process Automation (RPA)" refers to a non-invasive automation technology that simulates human behavior of operating a computer based on a pre-recorded script, interacts with the application system and completes the expected tasks. Its technical principle is to simulate human manual operation, transform human repetitive and regular work into robot work, thereby replacing manual operation.

[0052] In the description of this disclosure, RPA can simulate and execute tedious and repetitive business processes non-invasively and 24 / 7 based on preset business rules and processes without affecting the normal operation of the business system. At the same time, it can also call encapsulated engines such as control engines, data engines, business engines and other management engines, as well as model engines, rule engines, decision engines and other AI engines according to the instructions of "digital employees" to achieve process scheduling, robot cluster management and control, cross-system data acquisition, etc., to support grassroots users in carrying out various businesses, which will help reduce costs, increase efficiency, improve quality and reduce burdens.

[0053] In the description of this disclosure, the term "target object" refers to devices and systems that require network security inspections. Target objects may include but are not limited to security devices, network devices, servers, hosts, cloud platforms, management systems, etc.

[0054] In the description of the present disclosure, the term "Principal Component Analysis (PCA)" is used to convert high-dimensional data into a low-dimensional representation while retaining the main information of the data. The principle of principal component analysis is based on the covariance matrix and eigenvalue decomposition of the data, including data standardization, calculation of the covariance matrix, eigenvalue decomposition, eigenvalue sorting and projection.

[0055] See also Figure 1 , this embodiment provides a network security robot inspection method based on artificial intelligence, comprising the following steps:

[0056] S1. Collect inspection data: Based on machine process automation and data capture rule engine, the inspection data of the target object is automatically collected; the inspection data includes network security data and network traffic data.

[0057] It should be noted that network security data includes log data and configuration information of resources including the system's security equipment and network equipment. Network traffic data refers to the data traffic passing through the network captured, recorded and analyzed through traffic probe technology. Configuration information and traffic data provide correlation support for subsequent key data screening.

[0058] Specifically, Figure 2 As shown, collecting patrol data includes the following steps:

[0059] S11. Create a data capture rule engine: mine correlation rules by collecting historical abnormal network security data and network traffic data.

[0060] It is understandable that abnormal network security data and network traffic data refer to data showing network attacks, vulnerabilities or other risk events that have occurred during system operation.

[0061] like Figure 3 As shown, creating a data crawling rule engine includes the following steps:

[0062] Capture network security data and network traffic data packets generated during device communication, and extract a network security feature library from the network security data and network traffic, including a time feature set, a port number feature set, a protocol feature set, a risk level feature set, a device identification feature set, a data flow feature set, a data packet feature set, and a behavior feature set.

[0063] It should be noted that the port number feature set refers to the source port and destination port set used in network communication; the protocol feature set refers to the protocol set used in network communication, such as TCP, UDP, etc.; the risk level feature set refers to the level set of the importance or severity of network security risk events; the device identification feature set refers to the set of devices or systems that identify the generation of logs or configuration information. The data flow feature set includes characteristic parameters such as source IP address, destination IP address, flow duration, average flow rate, number of flow packets, number of flow bytes, and message length distribution; the data packet feature set includes characteristic parameters such as total number of packets, number of packet bytes, average packet length, total number of flow packets, and average flow packet length; the behavior feature set includes registration, login, creation, modification, transaction, and access. The extraction of the behavior feature set is obtained by filtering the hypertext transfer protocol data packet based on the behavior classification dictionary.

[0064] The extracted network security feature library is vectorized and encoded, and all feature sets are merged into a network security feature sequence. The network security feature sequence is a linear combination of features mined from all inspection data of the same network security risk event.

[0065] Use association analysis algorithms (such as Apriori algorithm or FP-Growth algorithm) to mine association rules within network security feature sequences.

[0066] In a single network security feature sequence, the appearance of an isolated feature cannot effectively prove that the feature sequence will lead to the occurrence of a network security risk event. However, if the correlation between a feature in the feature sequence and other features exists in a large number of network security risk events, it indicates that to a certain extent, the feature sequence has the possibility of a high network security risk event occurring.

[0067] Therefore, frequent items in the feature sequence are mined to construct frequent sets to obtain association rules. The confidence is calculated for each frequent feature set mined, and the rule is output when the confidence is greater than the minimum confidence threshold.

[0068] The formula for calculating confidence is:

[0069] ;

[0070] Among them, X and Y are different item sets and are not empty, It represents the probability of the occurrence of the consequent under the condition that the antecedent occurs, and is the possibility of the occurrence of a conditional probability.

[0071] The network security feature sequence is linearly combined with the mined association rules, and the feature sequence is reconstructed as a data crawling rule engine.

[0072] It is understandable that by mining the intrinsic correlation between network security feature sequences through association rule algorithms, the correlation between network security inspection data characteristics and network security risk events is improved, which improves the accuracy and reliability of subsequent traceability alarm analysis; at the same time, the feature sequences are reconstructed to further characterize the combination and connection of feature sequences, thereby improving the sensitivity of the data capture rule engine.

[0073] S12. Integrate RPA and packaging engine: Integrate RPA tools and data capture rule engines to achieve data interaction and communication. For example, use API or plug-in mechanism, message queue and shared database to achieve communication and data exchange between RPA tools and data capture rule engines.

[0074] S13. Automated data collection: When the data capture rule engine detects conditions that meet the rules, it triggers the RPA tool to start automatically and perform collection operations according to the rules defined by the data capture rule engine. For example, RPA opens the Nmap program to complete the port scan of the IP address-related network segment.

[0075] It is understandable that the collection of patrol data through RPA combined with the data capture rule engine reduces the interference of irrelevant data and improves the efficiency of data collection and processing and analysis; at the same time, combined with RPA automated operations, real-time monitoring and detection of the system is achieved, and continuous monitoring and collection can promptly discover potential security vulnerabilities, abnormal behaviors or threat events.

[0076] It should be noted that network traffic varies due to time, location, network scale, application type, user composition and usage habits, and even affected by emergencies. Network traffic is different in volume, composition and proportion. Therefore, in this embodiment, the correlation analysis of traffic data is added to the constructed data capture rule engine. At the same time, the reason why the creation of the data capture rule engine depends on both network security data and network traffic data is that this embodiment has already screened the data during the data collection process. Therefore, only one of the methods leads to less conditional data types that trigger the rule engine, and it is impossible to accurately and keenly discover and collect risk event data. Therefore, in this embodiment, it is necessary to collect enough multi-source data of risk events to create a data capture rule engine. In the actual creation process, the network security feature library is established, which includes the fusion of log data and network traffic features.

[0077] S2. Data normalization: Since different target objects have different data processing formats, the collected inspection data is normalized:

[0078] ;

[0079] in, Represents a normalized inspection data. X i Represents a certain unnormalized inspection data, X min Indicates the minimum data of a certain inspection data. X max Indicates the maximum data of a patrol data.

[0080] It is understandable that the data collected by the data capture rule engine only filters out the feature sequences that are more relevant to the characterization of network security risk events, and does not selectively collect only the inspection data of network security risk events during the later operation process.

[0081] S3. Source tracing alarm analysis: The normalized inspection data is input into the source tracing alarm model according to the principal components selected by principal component analysis to conduct network security inspection and analysis of the target object.

[0082] like Figure 4 As shown in the figure, creating a traceability alarm model includes the following steps:

[0083] Perform principal component analysis on the network security inspection data, select principal components for training and testing, and obtain data after dimensionality reduction of the network security inspection data.

[0084] The original data is standardized so that the mean of each feature is 0 and the variance is 1, thereby eliminating the dimensional differences between different features and ensuring that each feature contributes equally to dimensionality reduction.

[0085] Calculate the covariance matrix of the standardized data, perform eigenvalue decomposition on the covariance matrix, and obtain the eigenvalues ​​and corresponding eigenvectors.

[0086] It can be understood that the covariance matrix reflects the correlation between different features, the eigenvalue represents the variance of the data in the direction of the eigenvector, and the eigenvector represents the direction of the data in the new feature space.

[0087] Sort the eigenvalues ​​in descending order, select the eigenvectors corresponding to the first M eigenvalues ​​as principal components, project the original data onto the selected principal components, and obtain the reduced-dimensional data.

[0088] It should be noted that the data set used for model training is normally collected inspection data, not abnormal network security data and network traffic data. Principal component analysis reduces the complexity and dimension of the data, improves the training efficiency and performance of the model, helps to improve the generalization ability and anti-overfitting ability of the model, and at the same time helps to better understand the structure and characteristics of the data, which helps to optimize the training and performance of the model.

[0089] According to the results of principal component analysis of network security inspection data sequence, a data set is constructed by extracting the principal components in the network security inspection data sequence.

[0090] K-fold cross validation is used to randomly divide the dataset into k partitions. For each partition i , in the remaining k - Train the model on 1 partition and then i The model is evaluated on , and the final validation score is equal to k It is understandable that dividing the data set into a training data set and a validation data set through K-fold cross validation can effectively evaluate the performance of the model, reduce the risk of overfitting, and provide more reliable and comprehensive evaluation results. It is a common and effective model evaluation method.

[0091] In this embodiment, kThe value of is 4, which means that the dataset is divided into 4 subsets of equal size, and 3 of them are used as training datasets each time, and the remaining 1 subset is used as validation dataset. Therefore, the proportion of the training dataset is 3 / 4, or 75%. This means that in each round of training, 75% of the data is used to train the model, and the remaining 25% is used to verify the performance of the model. By repeating this process 4 times, the evaluation results of 4 models can be obtained, and the average value is finally taken as the final evaluation result.

[0092] A traceability alarm model is established based on the multi-dimensional data of traffic. The input is the selected principal components, and the predicted output is the risk level of network security risk events and the network traffic of the target object. The hidden layer is selected through experiments and trial and error, and the transfer function is the log-sigmoid function.

[0093] After determining the network structure and training data set, the neural network toolbox is used to train the samples. After the error between the actual output and the expected output reaches the allowable range, the trained traceability alarm model is used to analyze the inspection data.

[0094] It should be noted that after the tracing alarm model predicts the risk level of network security risk events and the network traffic of the target object for the patrol data, a rapid level alarm can be issued. At the same time, the predicted value and risk level of the network traffic can be compared with the set monitoring threshold, and the target object tracking can be performed for abnormal network traffic of a higher level. The abnormal network traffic data is matched with the target object, thereby obtaining the tracing information IP address, port number, device identification, protocol type and behavior data.

[0095] During the actual inspection process, the collected inspection data is first stored in the database and then analyzed. After matching the target object, timestamp and other information of the abnormal network traffic data, the traceability information can be obtained through the database.

[0096] This embodiment also provides a network security robot inspection system based on artificial intelligence, such as Figure 5 As shown, it includes digital employee module, network inspection and analysis module and traceability alarm module;

[0097] The digital employee module integrates the RPA scheduling and control capabilities with the technical middle platform AI capabilities, and completes the collection of target object inspection data through the RPA preset data capture rule engine. RPA is responsible for the collection function of the control data capture rule engine, and the technical middle platform AI is responsible for providing the ability support for building the rule engine and machine learning.

[0098] The network inspection and analysis module predicts the network security risk level and network traffic of the target object by preprocessing the collected inspection data and then inputting it into the traceability alarm model, wherein the preprocessing includes data normalization and principal component screening.

[0099] The tracing alarm module compares the risk level of the predicted network security risk event and the network traffic of the target object with the monitoring threshold, tracks the target object for the abnormal network traffic that needs to issue an alarm, and obtains the tracing information of the same network security risk event by matching the target object and the timestamp.

[0100] This embodiment also provides an artificial intelligence-based network security robot inspection device, including an artificial intelligence-based network security robot inspection system disclosed in this embodiment.

[0101] Among them, the explanation of the network security robot inspection system based on artificial intelligence can be found in the relevant description of the above embodiment, which will not be repeated here.

[0102] The present invention realizes the automatic collection of inspection data through machine process automation, creates a data capture rule engine by associating and mining the inherent combination and connection between feature sets in the network security feature library, collects inspection data based on the correlation between network security inspection data features and network security risk events, and improves the validity of data and the efficiency of data collection and post-processing analysis. At the same time, the creation of the data capture rule engine combines network security data and network traffic data, provides sufficient conditional data types for selection for the creation of the data capture rule engine, and the captured data provides support for post-source tracing analysis.

[0103] In the process of creating the traceability alarm model, the present invention performs principal component analysis on the network security inspection data based on the selective collection of the data capture rule engine, which reduces the complexity and dimension of the data and improves the generalization ability and anti-overfitting ability of the model; at the same time, in the training process, K-fold cross-validation is used to effectively utilize the data set for model evaluation, reducing the deviation introduced by unreasonable data division. The created traceability alarm model predicts the risk level and network traffic of the input principal component type data, realizes real-time monitoring of network security risk events, and improves the alarm traceability response speed through the matching of target objects.

[0104] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Although the present invention has been disclosed as a preferred embodiment as above, it is not used to limit the present invention. Any technical personnel in this field can make some changes or modify the technical contents disclosed above into equivalent embodiments without departing from the scope of the technical solution of the present invention. However, any brief modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention are still within the scope of the technical solution of the present invention.

Claims

1. A network security robot inspection method based on artificial intelligence, characterized in that: The following steps are involved: Collect inspection data: Based on machine process automation and data capture rule engine, the inspection data of target objects is automatically collected; The inspection data includes network security data and network traffic data; Data normalization processing: normalize the collected inspection data; Source tracing alarm analysis: The normalized inspection data is input into the source tracing alarm model based on the principal components selected by principal component analysis, and the predicted output is the risk level of the network security risk event and the network traffic of the target object; Compare the predicted value and risk level of network traffic with the set monitoring threshold, track the target object of abnormal network traffic that meets the alarm conditions, and obtain the traceability information of the same network security risk event by matching the target object and timestamp; Among them, collecting inspection data includes the following steps: Create a data crawling rule engine: collect historical abnormal network security data and network traffic data to mine correlation rules; Integrate RPA and packaging engine: Integrate RPA tools and data capture rule engines to achieve data interactive communication; Automated data collection: When the data crawling rule engine detects conditions that meet the rules, it triggers the RPA tool to start automatically and perform collection operations according to the rules defined by the data crawling rule engine; The step of creating a data crawling rule engine includes the following steps: Capture network security data and network traffic data packets generated during device communication, and extract network security feature libraries from network security data and network traffic; Vectorize and encode the extracted network security feature library, and merge all feature sets into a network security feature sequence; Use association analysis algorithms to mine association rules within network security feature sequences, build frequent sets by mining frequent items of features in feature sequences, and then obtain association rules based on calculating the confidence of each feature frequent set; The network security feature sequence is linearly combined with the mined association rules, and the feature sequence is reconstructed as a data crawling rule engine.

2. The network security robot inspection method based on artificial intelligence according to claim 1 is characterized by: The traceability information includes IP address, port number, device identification, protocol type and behavior data.

3. The network security robot inspection method based on artificial intelligence according to claim 1 is characterized by: The network security feature library includes a time feature set, a port number feature set, a protocol feature set, a risk level feature set, a device identification feature set, a data flow feature set, a data packet feature set, and a behavior feature set.

4. The network security robot inspection method based on artificial intelligence according to claim 3 is characterized by: The data flow feature set includes source IP address, target IP address, flow duration, average flow rate, number of flow messages, number of flow bytes and message length distribution parameters; The data packet feature set includes the total number of packets, the number of packet bytes, the average packet length, the total number of flow packets and the average flow packet length; the behavior feature set includes registration, login, creation, modification, transaction and access behaviors.

5. The network security robot inspection method based on artificial intelligence according to claim 1 is characterized by: The creation of the traceability alarm model includes the following steps: Perform principal component analysis on network security inspection data, select principal components for training and testing, and obtain data after dimensionality reduction of network security inspection data; According to the results of principal component analysis of the network security inspection data sequence, a data set is constructed by extracting the principal components in the network security inspection data sequence; K-fold cross validation is used to divide the data set into a validation data set and a training data set; A traceability alarm model is established based on multi-dimensional data of traffic. The input is the selected principal component, and the predicted output is the risk level of the network security risk event and the network traffic of the target object. The hidden layer is selected through experiments and trial and error, and the transfer function is the log-sigmoid function. After determining the network structure and training data set, the neural network toolbox is used to train the samples. The training is completed when the error between the actual output and the expected output reaches the allowable range.

6. The network security robot inspection method based on artificial intelligence according to claim 5 is characterized by: The principal component analysis of network security inspection data includes the following steps: Conduct data centralization and data normalization on the inspection data to eliminate the impact of dimension, data variation and data magnitude differences on variable analysis; Calculate the covariance matrix to express the variance of each feature and the covariance between different features; solve the eigenvalues ​​and corresponding eigenvectors of the covariance matrix; The eigenvectors are sorted from large to small according to the corresponding eigenvalues ​​to form a transformation matrix, and the principal component matrix is ​​calculated; the eigenvalues ​​are used to calculate the cumulative contribution rate of the variance, and the eigenvectors corresponding to the first M eigenvalues ​​with cumulative contribution rates greater than 80% are taken as the principal components.

7. The network security robot inspection method based on artificial intelligence according to claim 6 is characterized by: The K-fold cross validation includes: Randomly divide the dataset into pieces of equal size k partitions, of which k The value is 4, for each partition i , in the remaining k - Train the model on 1 partition and then i The model is evaluated on , and the final validation score is equal to k The average of the scores is taken, that is, 75% of the data is used as the training data set and 25% of the data is used as the validation data set.

8. An artificial intelligence-based network security robot inspection system, using an artificial intelligence-based network security robot inspection method according to any one of claims 1 to 7, characterized in that: Includes digital employee module, network inspection and analysis module, and traceability alarm module; The digital employee module integrates the RPA scheduling and control capabilities with the AI ​​capabilities of the technical platform, and completes the collection of inspection data of target objects through the RPA preset data capture rule engine; The network inspection and analysis module predicts the network security risk level and network traffic of the target object by preprocessing the collected inspection data and then inputting it into the traceability alarm model, wherein the preprocessing includes data normalization and principal component screening; The tracing alarm module compares the risk level of the predicted network security risk event and the network traffic of the target object with the monitoring threshold, tracks the target object for the abnormal network traffic that meets the alarm conditions, and obtains the tracing information of the same network security risk event by matching the target object and the timestamp.

9. A network security robot inspection system based on artificial intelligence, characterized by: It includes an artificial intelligence-based network security robot inspection system as described in claim 8.

Images