Enterprise platform security management method and system based on artificial intelligence

Abstract

The present invention relates to the field of platform security management technology, and in particular to an enterprise platform security management method and system based on artificial intelligence. The method comprises the following steps: obtaining platform user behavior logs; performing outlier filtering optimization on the platform user behavior logs, thereby generating optimized user behavior logs; performing behavior pattern clustering analysis on the optimized user behavior logs, generating behavior pattern clusters; performing deep feature mining evolution based on behavior pattern clusters, and constructing a platform deep behavior feature map; performing user behavior simulation generation based on the platform deep behavior feature map, and performing malicious behavior mixed insertion processing, thereby obtaining a mixed simulated user behavior sequence; performing interactive behavior response analysis on the enterprise platform based on the mixed simulated user behavior sequence, and generating interactive behavior response feature data. The present invention realizes efficient and highly secure enterprise platform management.

Description

Technical Field

[0001] The present invention relates to the technical field of platform security management, and in particular to an enterprise platform security management method and system based on artificial intelligence. Background Art

[0002] In today's digital age, with the continuous improvement of informatization and automation levels, enterprise information systems have become an important infrastructure for enterprise production, operation and management. However, with the continuous increase in system scale and complexity, enterprises are facing increasingly complex and hidden network security threats, which lead to confidential information leakage, system paralysis and even financial losses. In traditional security management methods, the use of conventional security analysis systems often requires manual analysis of massive security logs and network traffic data, which is not only inefficient, but also easy to miss key security events, resulting in low security. With the rapid development of artificial intelligence technology, its application in the security field has become increasingly popular and mature, and the security management method of artificial intelligence uses machine learning and data mining technology to realize automatic detection and prediction of abnormal behaviors, thereby helping enterprises to promptly discover potential security threats and take corresponding measures. Enterprises use artificial intelligence technology to achieve real-time monitoring, rapid response and intelligent analysis of security incidents to improve the efficiency and effectiveness of security management. Summary of the invention

[0003] In order to solve the above technical problems, the present invention proposes an enterprise platform security management method and system based on artificial intelligence to solve at least one of the above technical problems.

[0004] To achieve the above object, the present invention provides an enterprise platform security management method based on artificial intelligence, comprising the following steps:

[0005] Step S1: Obtaining platform user behavior logs; performing outlier filtering optimization on the platform user behavior logs, thereby generating optimized user behavior logs;

[0006] Step S2: Performing behavior pattern clustering analysis on the optimized user behavior logs to generate behavior pattern clusters; performing deep feature mining and evolution based on the behavior pattern clusters to construct a deep behavior feature map of the platform;

[0007] Step S3: Generate user behavior simulation based on the platform's deep behavior feature map, and perform mixed insertion processing of malicious behavior to obtain a mixed simulated user behavior sequence;

[0008] Step S4: performing interactive behavior response analysis on the enterprise platform based on the mixed simulated user behavior sequence to generate interactive behavior response feature data; performing malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data;

[0009] Step S5: Based on the malicious behavior response data, the enterprise platform is subjected to request transmission logic analysis, and security vulnerability tracing and location are performed to obtain the platform security vulnerability points;

[0010] Step S6: Dynamically configure the protection parameters for the platform security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0011] The present invention optimizes user behavior logs to remove abnormal and invalid data, improves the accuracy and efficiency of subsequent analysis, generates optimized user behavior logs to establish baseline behavior data, and provides a reliable data basis for subsequent analysis and model building. Behavior pattern clustering can help identify potential patterns and trends in user behavior, discover abnormal or regular behavior, and build deep behavioral feature maps to better characterize the complexity and diversity of user behavior, providing more comprehensive feature data for subsequent simulation and analysis. By simulating and generating user behavior sequences, the present invention simulates user behavior in real scenarios, evaluates system performance and security, and helps the system discover and respond to malicious user behavior by mixing in malicious behavior, thereby enhancing the ability to identify and handle potential threats. The analysis should help understand how users interact with the enterprise platform and provide a reference for optimizing user experience and system performance. Malicious behavior response analysis can promptly identify and respond to malicious behavior and strengthen the prevention and control of security threats. Through vulnerability location, security vulnerabilities in the system can be quickly identified, and the security of the system can be repaired and strengthened in a timely manner. The location of security vulnerabilities can help understand the potential risks and sources of vulnerabilities in the system and provide a basis for subsequent security protection measures. Dynamic configuration of protection strategies can adjust security strategies according to real-time security intelligence and system status to improve the ability to respond to security threats. The establishment of intelligent security management models combines data mining and machine learning technologies to improve the detection and response speed of security incidents, and effectively ensure the security and stability of enterprise platforms.

[0012] Preferably, step S1 comprises the following steps:

[0013] Step S11: Obtaining platform user behavior logs;

[0014] Step S12: identifying the timestamp format of the platform user behavior log to obtain multiple timestamp formats in the log;

[0015] Step S13: performing timestamp normalization based on multiple timestamp formats in the log to generate a user behavior log with unified timestamps;

[0016] Step S14: performing field feature statistics on the timestamp unified user behavior log to obtain the normal value range feature of the log field;

[0017] Step S15: Identify abnormal outliers based on the normal value range characteristics of the log field, and extract abnormal outliers in the log;

[0018] Step S16: performing outlier filtering optimization on the timestamp unified user behavior log according to the log abnormal outlier value, thereby generating an optimized user behavior log.

[0019] The present invention records the operation behavior and activity information of platform users through user behavior logs, which is an important data source for analyzing user behavior and trends. By obtaining user behavior logs, we can deeply understand the user's behavior patterns and preferences on the platform, and provide basic data for subsequent analysis and optimization. Timestamp format recognition accurately extracts time information in user behavior logs, and provides accurate time data for subsequent time-related analysis. Multiple timestamp formats in the log can process time data in different formats, ensuring the comprehensiveness and accuracy of subsequent analysis. The unification of timestamps can ensure that time data in different formats are consistent in analysis, avoiding analysis errors caused by different time formats, and generating unified timestamps for user behavior logs with unified time The representation of data simplifies subsequent time-related processing and analysis. Field feature statistics help identify the distribution and characteristics of fields in user behavior logs, providing a basis for subsequent anomaly detection. The normal value range characteristics of log fields are obtained to establish the normal mode of user behavior, which is convenient for subsequent anomaly detection and outlier identification. Abnormal outlier identification can help find abnormal data points in user behavior logs, indicating potential problems or abnormal situations. Extracting abnormal outliers from logs can timely discover abnormal situations. Outlier filtering optimization can eliminate abnormal outliers, improve the quality and accuracy of user behavior log data, generate optimized user behavior logs to ensure data accuracy and reliability, and provide more reliable data support for subsequent user behavior analysis and decision-making.

[0020] Preferably, step S2 comprises the following steps:

[0021] Step S21: Calculate the behavior frequency of each user on the optimized user behavior log to obtain the behavior frequency of each user;

[0022] Step S22: performing behavior pattern cluster analysis on the optimized user behavior log to generate behavior pattern clusters;

[0023] Step S23: performing frequency distribution analysis on the behavior frequency of each user based on behavior pattern clustering to generate behavior frequency distribution data;

[0024] Step S24: performing behavior feature analysis on the behavior frequency distribution data to obtain user behavior feature data;

[0025] Step S25: Perform deep feature mining and evolution on user behavior feature data to build a deep behavior feature map of the platform.

[0026] The present invention reveals the activity level and behavior habits of each user on the platform through user behavior frequency calculation, provides a basis for personalized recommendation and customized service, obtains the behavior frequency of each user to quantify the user behavior characteristics, and provides data support for subsequent behavior analysis and pattern recognition. Behavior pattern clustering analysis can classify similar user behaviors into the same category, help discover the commonality and regularity of user behaviors, generate behavior pattern clustering to understand the diversity of user behaviors, and provide an analytical basis for personalized recommendation and behavior prediction. Behavior frequency distribution analysis helps understand the behavior characteristics and distribution of different user groups, provides a basis for user behavior classification and customized services, and generates behavior patterns. Frequency distribution data can be used to discover the regularity and differences of user behavior, and data support can be provided for the extraction and analysis of user behavior features. Behavioral feature analysis can identify important features and patterns in user behavior data, and provide a basis for user behavior prediction and personalized recommendations. User behavior feature data can be obtained to deeply understand the nature and laws of user behavior, and provide decision support for platform operation and optimization. Deep feature mining evolution can mine potential associations and patterns in user behavior data, and build a more comprehensive and in-depth user behavior feature map. The deep behavior feature map of the platform can be constructed to discover the laws and values ​​hidden in user behavior data, and provide deeper insights and guidance for platform strategy and operation.

[0027] Preferably, step S25 specifically comprises the following steps:

[0028] Calculate the behavior feature similarity of the user behavior feature data according to the behavior frequency of each user to obtain user behavior similarity data;

[0029] Conduct implicit dependency analysis of user behaviors based on user behavior similarity data to generate implicit dependency relationships of user behaviors;

[0030] Embed user behavior feature data into a multimodal space to obtain a unified behavior feature space;

[0031] Utilize the implicit dependency of user behaviors to fit multi-layer behavior relationships in the unified behavior feature space and construct a multi-level behavior association network;

[0032] Conduct deep iterative mining on multi-level behavioral association networks to build a deep behavioral feature map of the platform.

[0033] The present invention reveals the similarities and differences of behavioral features between users through behavioral feature similarity calculation, provides a basis for user grouping and personalized recommendation, obtains user behavior similarity data to discover the correlation between user behaviors, and provides a basis for subsequent implicit dependency analysis and behavioral relationship mining. User behavior implicit dependency analysis reveals the potential dependencies and influencing factors between user behaviors, providing a deeper understanding for behavior prediction and personalized recommendation. It generates user behavior implicit dependencies to discover hidden associations between user behaviors, and provides guidance for subsequent behavioral relationship fitting and network construction. Multimodal spatial embedding integrates user behavior features of different dimensions into a unified feature space, providing cross-dimensional behavior analysis and association mining. It provides a unified data representation, obtains unified behavioral feature space dimensionality reduction and simplifies data processing, and provides a data basis for the subsequent construction of a behavioral association network. Multi-layer behavioral relationship fitting helps discover the complex associations and influence relationships between user behaviors, providing a deeper understanding for the modeling and analysis of behavioral networks. It builds a multi-level behavioral association network to reveal the multi-level relationships between user behaviors, and provides data support for subsequent deep iterative mining. Deep iterative mining can discover hidden patterns and laws in user behavior networks, build a more comprehensive and in-depth behavioral feature map, and build a deep behavioral feature map of the platform to deeply understand the complex relationships and potential laws of user behaviors, providing more accurate data support for platform optimization and personalized services.

[0034] Preferably, step S3 specifically comprises the following steps:

[0035] Step S31: Generate user behavior simulation based on the platform deep behavior feature map to obtain multiple user behavior simulation data;

[0036] Step S32: Analyze malicious behavior characteristics based on a preset malicious attack behavior database, and learn and generate to obtain a malicious attack behavior sequence;

[0037] Step S33: performing random mixed insertion processing on multiple user behavior simulation data based on the malicious attack behavior sequence, thereby obtaining a mixed simulated user behavior sequence.

[0038] The present invention helps simulate the real behavior of users on the platform through user behavior simulation generation, provides a basis for subsequent abnormal behavior detection and analysis, obtains multiple user behavior simulation data to expand the data set, and increases the generalization ability and accuracy of the abnormal behavior detection model. Malicious behavior feature analysis helps identify the characteristics and patterns of malicious attack behavior, provides a basis for abnormal behavior detection, obtains malicious attack behavior sequences to construct malicious behavior sample sets, which are used to train the anomaly detection model and improve detection accuracy. The mixed simulated user behavior sequence simulates the mixed situation between user behavior and malicious attacks in the real environment, improves the robustness of the abnormal behavior detection model, and randomly mixes and inserts processing to simulate different types of abnormal behavior scenarios, thereby increasing the detection ability of the anomaly detection model for diversified abnormal behaviors.

[0039] Preferably, the specific steps of step S4 are:

[0040] Step S41: simulating the interactive behavior of the enterprise platform based on the mixed simulated user behavior sequence to obtain platform interactive behavior simulation data;

[0041] Step S42: performing interactive behavior response analysis on the platform interactive behavior simulation data to generate interactive behavior response feature data;

[0042] Step S43: Calculate the malicious behavior detection probability for the interactive behavior response feature data to obtain the malicious behavior detection probability;

[0043] Step S44: performing malicious behavior response analysis on the interactive behavior response feature data based on the malicious behavior detection probability to obtain malicious behavior response data.

[0044] The present invention can simulate the real operation and behavior of users on the enterprise platform through interactive behavior simulation, and provides representative data for subsequent analysis. The platform interactive behavior simulation data is obtained to build a behavioral model of the enterprise platform, and basic data support is provided for malicious behavior detection and analysis. The interactive behavior response analysis reveals the response patterns and characteristics of users to platform operations, and provides a behavioral feature basis for subsequent malicious behavior detection. The interactive behavior response feature data is generated to deeply understand the user behavior pattern, and more accurate feature input is provided for the malicious behavior detection model. The malicious behavior detection probability calculation evaluates the malicious behavior of each interactive behavior, and provides quantitative indicators for anomaly detection. The malicious behavior detection probability is obtained to screen out potential malicious behaviors, and provides an important reference for the subsequent malicious behavior response analysis. The malicious behavior response analysis conducts in-depth analysis on interactive behaviors with high malicious behavior detection probability, identifies potential malicious behavior patterns and laws, obtains malicious behavior response data to respond to malicious attacks in a timely manner, and protects the security and stability of the enterprise platform.

[0045] Preferably, the specific steps of step S41 are:

[0046] Conduct interface specification analysis on the enterprise platform to obtain platform API interface specification data;

[0047] Build a containerized virtual environment based on the platform API interface specification data and construct a platform virtual environment framework;

[0048] Perform call script language conversion on the mixed simulated user behavior sequence to obtain the behavior sequence API call script;

[0049] The behavior sequence API call script is used to simulate the interactive access request of the platform virtual environment framework to obtain the platform interactive behavior simulation data.

[0050] The present invention understands the API structure and function of the enterprise platform through interface specification analysis, provides a basis for subsequent interactive behavior simulation, obtains platform API interface specification data to help determine the available API endpoints and parameters, provides guidance for the subsequent virtual environment construction, and quickly deploys and manages the platform environment in a containerized virtual environment. It provides an environment that simulates the behavior of the real platform, builds a platform virtual environment framework to accurately simulate the behavior and function of the enterprise platform, and provides a reliable basis for subsequent simulation and testing. It calls the script language to convert the user behavior sequence into an API script that can be called by the virtual environment framework, realizes the automatic execution of the behavior sequence, obtains the behavior sequence API call script to simulate the user behavior and interact with the platform environment, generates simulation data for subsequent analysis, simulates the actual interactive behavior of the user and the platform through the API call script to interact with the virtual environment, generates data of real scenarios, and obtains platform interactive behavior simulation data to analyze user behavior patterns and platform responses.

[0051] Preferably, the specific steps of step S5 are:

[0052] Step S51: extract security-related parameters of the enterprise platform based on the malicious behavior response data, and perform security risk analysis to mark platform security risk nodes;

[0053] Step S52: performing request transmission logic analysis on the platform interaction behavior simulation data to generate an interaction behavior request logic link;

[0054] Step S53: Evolving the malicious behavior attack path of the platform security risk node based on the interactive behavior request logical link to obtain the malicious behavior attack trajectory;

[0055] Step S54: trace the malicious attack path to locate the security vulnerability, thereby obtaining the platform security vulnerability point.

[0056] The present invention helps enterprises understand the weak links of the platform by extracting security-related parameters and performing security risk analysis to identify potential security threats and risk points, marking platform security risk nodes to help enterprises focus on areas with security issues, thereby strengthening security protection measures for these nodes, requesting transmission logic analysis to reveal the logical relationship between interactive behaviors and data transmission paths, understanding the data flow and communication behavior of the platform, generating an interactive behavior request logical link to establish a full picture of request transmission, and providing a basis for subsequent security vulnerability analysis and the evolution of malicious behavior attack paths. Through the evolution of malicious behavior attack paths, it simulates how malicious attackers use the platform's vulnerabilities and security risk nodes to carry out attacks, helping enterprises understand potential attack methods, and obtaining security threats and attack methods predicted by malicious behavior attack trajectories, providing a reference basis for security protection and response, and tracing and locating security vulnerabilities to help enterprises accurately find the root causes of malicious behavior attacks, repair and reinforce the platform's security vulnerability points, and obtain the platform's security vulnerability points to improve the company's security management level, prevent future security threats and attacks, and ensure the security of the company's information assets.

[0057] Preferably, the specific steps of step S6 are:

[0058] Step S61: Make security protection patch decisions for platform security vulnerability points to generate security vulnerability protection strategies;

[0059] Step S62: Based on the security vulnerability protection strategy, real-time protection and repair tracking is performed on the enterprise platform, and log protection monitoring data is extracted;

[0060] Step S63: Calculate the residual vulnerability distribution of the log protection monitoring data to obtain residual vulnerability distribution data;

[0061] Step S64: quantifying the repair effect of the residual vulnerability distribution data to generate a repair effect quantification value;

[0062] Step S65: dynamically configuring the protection parameters of the security vulnerability protection strategy based on the repair effect quantification value to generate a dynamically configured protection strategy;

[0063] Step S66: Perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0064] The present invention timely repairs known security vulnerabilities through security protection patch decision-making, improves the security and stability of the platform, generates security vulnerability protection strategies to help enterprises establish comprehensive security protection measures, effectively respond to various potential threats, track and monitor the security vulnerability repair situation in real time, take measures to prevent potential risks in time, extract log protection monitoring data to provide data support for tracking and analyzing security events, help enterprises understand the security status of the platform, calculate the residual vulnerability distribution to help enterprises understand the distribution of security vulnerabilities, improve security protection strategies in a targeted manner, obtain residual vulnerability distribution data to identify common vulnerability types and frequencies, provide guidance for subsequent security vulnerability repair, quantitatively evaluate the effect of security vulnerability repair by repair effects, help enterprises understand the effectiveness of repair measures, generate repair effect quantitative values ​​to quantify the effectiveness of security protection work, provide data support for security management decisions, dynamically configure protection strategies to adjust security protection strategies in real time according to repair effect quantitative values, improve the ability to respond to potential threats, generate dynamic configuration protection strategies to flexibly respond to changes in security threats, improve the security and elasticity of enterprise platforms, analyze security data through data mining modeling, discover hidden patterns and laws, help enterprises better understand security threats and vulnerabilities, build an intelligent platform security management model to predict potential security risks, provide intelligent security management decision support, and enhance the security protection capabilities of enterprises.

[0065] In this specification, an enterprise platform security management system based on artificial intelligence is provided, which is used to execute the enterprise platform security management method based on artificial intelligence as described above, including:

[0066] An outlier filtering module is used to obtain platform user behavior logs; perform outlier filtering optimization on platform user behavior logs to generate optimized user behavior logs;

[0067] The deep mining module is used to perform behavioral pattern clustering analysis on optimized user behavior logs and generate behavioral pattern clusters; perform deep feature mining evolution based on behavioral pattern clusters and build a deep behavioral feature map of the platform;

[0068] Malicious behavior simulation module, used to generate user behavior simulation based on the platform's deep behavioral feature map, and perform malicious behavior mixed insertion processing to obtain a mixed simulated user behavior sequence;

[0069] The behavior response module is used to perform interactive behavior response analysis on the enterprise platform based on a mixed simulated user behavior sequence to generate interactive behavior response feature data; perform malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data;

[0070] The vulnerability tracing module is used to analyze the request transmission logic of the enterprise platform based on the malicious behavior response data, and to trace and locate the security vulnerabilities of the platform, thereby obtaining the security vulnerabilities of the platform;

[0071] The security management module is used to dynamically configure the protection parameters of the platform's security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0072] The present invention obtains the platform user behavior log through the outlier filtering module, identifies abnormal behavior and potential security threats, optimizes the user behavior log by outlier filtering to reduce noise data, improves data quality, and provides a more reliable basis for subsequent analysis. The behavior pattern clustering analysis helps enterprises understand the patterns and trends of user behavior, provides a basis for personalized services and security protection, builds a platform deep behavior feature map to deeply explore the potential characteristics of user behavior, and provides support for security management and service optimization. Malicious behavior simulation helps simulate malicious user behavior, evaluates the security and protection capabilities of the platform, obtains a mixed simulated user behavior sequence to detect and prevent malicious behavior, and improves the platform's defense capabilities against potential attacks. Interaction response analysis helps enterprises understand the user's interaction methods and preferences for the platform, providing a reference for optimizing user experience. Malicious behavior response analysis quickly identifies malicious behavior and takes corresponding measures to protect the security of the platform and user data. Security vulnerability tracing and positioning quickly discovers potential security risk points, repairs vulnerabilities in a timely manner, and improves the security of the platform. Obtaining platform security vulnerabilities provides important clues for security management, helping enterprises establish a more sound security protection mechanism, dynamically configure protection strategies, flexibly adjust security protection parameters according to vulnerability situations, improve the ability to prevent potential threats, and build an intelligent platform security management model to predict security risks and optimize security strategies to improve the overall security and stability of the platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 This is a schematic diagram of the steps of an enterprise platform security management method based on artificial intelligence of the present invention;

[0074] Figure 2 Detailed implementation flow chart of step S1;

[0075] Figure 3 Detailed implementation flow chart of step S2;

[0076] Figure 4 Detailed implementation flow chart of step S3. DETAILED DESCRIPTION

[0077] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0078] The example of this application provides an enterprise platform security management method and system based on artificial intelligence. The execution subject of the enterprise platform security management method and system based on artificial intelligence includes but is not limited to: mechanical equipment, data processing platform, cloud server node, network upload device, etc. equipped with the system can be regarded as the general computing node of this application, and the data processing platform includes but is not limited to: at least one of an audio and image management system, an information management system, and a cloud data management system.

[0079] See also Figures 1 to 4 The present invention provides an enterprise platform security management method based on artificial intelligence, and the enterprise platform security management method based on artificial intelligence includes the following steps:

[0080] Step S1: Obtaining platform user behavior logs; performing outlier filtering optimization on the platform user behavior logs, thereby generating optimized user behavior logs;

[0081] Step S2: Performing behavior pattern clustering analysis on the optimized user behavior logs to generate behavior pattern clusters; performing deep feature mining and evolution based on the behavior pattern clusters to construct a deep behavior feature map of the platform;

[0082] Step S3: Generate user behavior simulation based on the platform's deep behavior feature map, and perform mixed insertion processing of malicious behavior to obtain a mixed simulated user behavior sequence;

[0083] Step S4: performing interactive behavior response analysis on the enterprise platform based on the mixed simulated user behavior sequence to generate interactive behavior response feature data; performing malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data;

[0084] Step S5: Based on the malicious behavior response data, the enterprise platform is subjected to request transmission logic analysis, and security vulnerability tracing and location are performed to obtain the platform security vulnerability points;

[0085] Step S6: Dynamically configure the protection parameters for the platform security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0086] The present invention optimizes user behavior logs to remove abnormal and invalid data, improves the accuracy and efficiency of subsequent analysis, generates optimized user behavior logs to establish baseline behavior data, and provides a reliable data basis for subsequent analysis and model building. Behavior pattern clustering can help identify potential patterns and trends in user behavior, discover abnormal or regular behavior, and build deep behavioral feature maps to better characterize the complexity and diversity of user behavior, providing more comprehensive feature data for subsequent simulation and analysis. By simulating and generating user behavior sequences, the present invention simulates user behavior in real scenarios, evaluates system performance and security, and helps the system discover and respond to malicious user behavior by mixing in malicious behavior, thereby enhancing the ability to identify and handle potential threats. The analysis should help understand how users interact with the enterprise platform and provide a reference for optimizing user experience and system performance. Malicious behavior response analysis can promptly identify and respond to malicious behavior and strengthen the prevention and control of security threats. Through vulnerability location, security vulnerabilities in the system can be quickly identified, and the security of the system can be repaired and strengthened in a timely manner. The location of security vulnerabilities can help understand the potential risks and sources of vulnerabilities in the system and provide a basis for subsequent security protection measures. Dynamic configuration of protection strategies can adjust security strategies according to real-time security intelligence and system status to improve the ability to respond to security threats. The establishment of intelligent security management models combines data mining and machine learning technologies to improve the detection and response speed of security incidents, and effectively ensure the security and stability of enterprise platforms.

[0087] In the embodiment of the present invention, refer to Figure 1 , is a schematic diagram of the steps of an enterprise platform security management method based on artificial intelligence of the present invention. In this example, the steps of the enterprise platform security management method based on artificial intelligence include:

[0088] Step S1: Obtaining platform user behavior logs; performing outlier filtering optimization on the platform user behavior logs, thereby generating optimized user behavior logs;

[0089] In this embodiment, various operation behavior records of users on the platform are collected from various log systems of the enterprise platform, including behavior data such as logging in, browsing, clicking, downloading, and submitting forms, to ensure that the collected log data contains key information such as user ID, operation time, operation type, and operation object, and analyze the statistical characteristics in the user behavior log, including the operation frequency, access time distribution, and access path of each user. Based on these statistical characteristics, outliers or outliers are identified. For example, the access frequency of some users is much higher than that of normal users, or some access paths have serious deviations. Anomaly detection algorithms, such as clustering-based outlier detection and density-based outlier detection, are used to filter and eliminate abnormal user behaviors, and the filtered user behavior data is used as the optimized user behavior log to provide more reliable basic data for subsequent behavior pattern analysis.

[0090] Step S2: Performing behavior pattern clustering analysis on the optimized user behavior logs to generate behavior pattern clusters; performing deep feature mining and evolution based on the behavior pattern clusters to construct a deep behavior feature map of the platform;

[0091] In this embodiment, a suitable clustering algorithm is selected, such as K-Means, DBSCAN, etc., and clustering is performed according to the user's behavioral characteristics. The behavioral characteristics include the user's access frequency, access time, access path, operation type, etc. Through cluster analysis, users with similar behavior patterns are classified into the same cluster cluster, and the optimal number of clusters is determined to reflect the diversity of user behavior patterns. The user behavior data in each cluster cluster is deeply analyzed to mine more detailed behavioral characteristics. These characteristics include the user's stay time when browsing web pages, click hot spots, form input behavior, etc. These detailed characteristics are modeled and extracted using deep learning and other technologies to better characterize the user's behavior pattern. By comparing and analyzing the deep features of each cluster cluster, the differences between user behavior patterns are found. The above-mined deep user behavior features are organized into a hierarchical feature map. The map contains the behavioral features of different types of users and the correlation between these features. This feature map provides support for subsequent user behavior simulation, abnormal behavior detection, etc. As time goes by, the feature map is dynamically updated to track the evolution of user behavior patterns.

[0092] Step S3: Generate user behavior simulation based on the platform's deep behavior feature map, and perform mixed insertion processing of malicious behavior to obtain a mixed simulated user behavior sequence;

[0093] In this embodiment, the user behavior patterns in the deep behavior feature map of the platform are used to generate simulated user behavior sequences through probabilistic models or generative adversarial networks and other technologies. These simulated sequences should be able to reflect various characteristics of actual user behavior, such as access frequency, access time, access path, etc. For different types of user groups, corresponding simulated behavior sequences are generated to cover the main user groups on the platform. The generated simulated behavior sequences should have high fidelity and representativeness and be able to reflect the behavioral characteristics of real users. In the generated simulated user behavior sequences, some malicious or abnormal behavior data are appropriately inserted. These malicious behaviors include abnormal access frequency, web browsing time, form input, etc. Through the insertion of malicious behaviors, various attack behaviors that occur in the real system are simulated. The insertion ratio and mode of malicious behaviors should be carefully designed to ensure that the overall behavior sequence can still maintain rationality and fidelity. After the above steps, the generated behavior sequence will contain two components: normal user behavior and malicious user behavior. These mixed simulated behavior sequences are used for subsequent security analysis and evaluation. For different application scenarios, multiple groups of mixed simulated behavior sequences are generated to enhance the comprehensiveness of the analysis.

[0094] Step S4: performing interactive behavior response analysis on the enterprise platform based on the mixed simulated user behavior sequence to generate interactive behavior response feature data; performing malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data;

[0095] In this embodiment, a mixed simulated user behavior sequence is input into the enterprise's technical platform, and the interactive response of the platform when facing these simulated behavior sequences is monitored and recorded. The interactive response includes various indicators such as web page loading time, system feedback information, and user operation results. These interactive response data are collected and organized to form interactive behavior response feature data, and the interactive response of those simulated sequences containing malicious behaviors on the platform is analyzed in detail to find abnormal response features caused by these malicious behaviors, such as abnormal response time, frequent error messages, etc. By comparing the interactive response differences between normal user behaviors and malicious user behaviors on the platform, the feature data of malicious behaviors are extracted. These malicious behavior response feature data are used for subsequent security detection and early warning, and the abnormal response features caused by malicious behaviors are identified, such as abnormal response time, frequent error messages, etc. By comparing the interactive response differences between normal user behaviors and malicious user behaviors on the platform, the feature data of malicious behaviors are extracted, including response time, error type, operation results, etc.

[0096] Step S5: Analyze the request transmission logic of the enterprise platform based on the malicious behavior response data, and trace and locate the security vulnerability, so as to obtain the security vulnerability points of the platform;

[0097] In this embodiment, key request parameters, request headers, request paths and other information are extracted from malicious behavior response data, and the transmission path and logic of malicious requests are analyzed, including front-end pages, back-end interfaces, middleware, etc., and combined with normal user behavior response data, the transmission differences between normal requests and malicious requests are compared and analyzed, the complete request transmission logic of the enterprise platform is sorted out, and suspicious transmission links are identified. The code implementation, data verification, permission control and other aspects of these links are further analyzed in depth to discover existing security vulnerabilities, and the discovered security vulnerabilities are described and classified in detail, including vulnerability type, impact range, risk level, etc. The security vulnerability information is organized into a report to provide a basis for subsequent vulnerability repairs.

[0098] Step S6: Dynamically configure the protection parameters for the platform security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0099] In this embodiment, according to the nature and impact scope of the security vulnerability, corresponding dynamic protection parameters are designed, the dynamic protection parameters are associated with the vulnerability points to form a protection strategy configuration plan, and the protection strategy configuration plan is deployed to the security protection components of the enterprise platform to achieve dynamic protection, continuously monitor the security status of the platform, and update the protection strategy in time according to the newly discovered vulnerabilities. The configuration parameters, trigger conditions, protection effects and other data of the dynamic protection strategy are collected and organized. Using data mining technology, these data are analyzed and modeled to discover the correlation patterns between different protection strategies. Based on the established correlation model, an intelligent platform security management decision support system is constructed. The system can automatically recommend the optimal dynamic protection strategy configuration based on the real-time monitored security status.

[0100] In this embodiment, refer to Figure 2 , is a flowchart of detailed implementation steps of step S1. In this embodiment, the detailed implementation steps of step S1 include:

[0101] Step S11: Obtaining platform user behavior logs;

[0102] Step S12: identifying the timestamp format of the platform user behavior log to obtain multiple timestamp formats in the log;

[0103] Step S13: performing timestamp normalization based on multiple timestamp formats in the log to generate a user behavior log with unified timestamps;

[0104] Step S14: performing field feature statistics on the timestamp unified user behavior log to obtain the normal value range feature of the log field;

[0105] Step S15: Identify abnormal outliers based on the normal value range characteristics of the log field, and extract abnormal outliers in the log;

[0106] Step S16: performing outlier filtering optimization on the timestamp unified user behavior log according to the log abnormal outlier value, thereby generating an optimized user behavior log.

[0107] In this embodiment, after obtaining authorization, log data containing user behavior information is extracted from the log storage system of the platform to ensure that the log data contains key information such as user ID, operation time, and operation type. The timestamp format in the log data is analyzed, different timestamp representation methods are identified, and regular expressions are written to uniformly convert timestamps of different formats into the same standard format. The converted standard timestamp format is applied to the original user behavior log, and statistical analysis is performed on the data of each field of the user behavior log, including statistical indicators such as the maximum value, minimum value, average value, and variance of the field. Based on the statistical results, the normal value range of each field is determined, and the value of each field is compared with its normal value range. For abnormal values ​​that exceed the normal value range, they are marked as outliers, and these outliers are extracted as abnormal data in the log. According to the log abnormality report, the abnormal outliers in the timestamp unified user behavior log are located and filtered out to generate an optimized user behavior log, eliminating the interference of abnormal values.

[0108] In this embodiment, refer to Figure 3 , is a flowchart of detailed implementation steps of step S2. In this embodiment, the detailed implementation steps of step S2 include:

[0109] Step S21: Calculate the behavior frequency of each user on the optimized user behavior log to obtain the behavior frequency of each user;

[0110] Step S22: performing behavior pattern cluster analysis on the optimized user behavior log to generate behavior pattern clusters;

[0111] Step S23: performing frequency distribution analysis on the behavior frequency of each user based on behavior pattern clustering to generate behavior frequency distribution data;

[0112] Step S24: performing behavior feature analysis on the behavior frequency distribution data to obtain user behavior feature data;

[0113] Step S25: Perform deep feature mining and evolution on user behavior feature data to build a deep behavior feature map of the platform.

[0114] In this embodiment, the optimized user behavior log data is traversed, and for each user, the number of times they perform various types of behavior operations is counted to obtain the frequency data of each user in different behavior types. The behavior frequency data of each user is used as a feature vector, and clustering analysis is performed on these feature vectors using a clustering algorithm (such as k-means, hierarchical clustering, etc.). Users with similar behavior patterns are classified into the same cluster cluster to obtain clustering results representing different behavior patterns. For users in each cluster cluster, their frequency distribution in various types of behaviors is counted to obtain the behavior frequency distribution data of each cluster cluster, such as a bar chart or density curve. The frequency distribution characteristics of each behavior pattern cluster are analyzed, such as skewness, kurtosis, distribution range, etc., and the above statistical features are extracted to form a feature vector describing the user behavior pattern of the cluster. The behavior feature vectors of each cluster are combined to generate a full amount of user behavior feature data. Complex modeling methods such as deep learning are used to explore deeper user behavior patterns based on the behavior feature data, and a graph model containing multi-level user behavior features is constructed to visualize and describe the complex behavior characteristics of users on the platform.

[0115] In this embodiment, the specific steps of step S25 are:

[0116] Calculate the behavior feature similarity of the user behavior feature data according to the behavior frequency of each user to obtain user behavior similarity data;

[0117] Conduct implicit dependency analysis of user behaviors based on user behavior similarity data to generate implicit dependency relationships of user behaviors;

[0118] Embed user behavior feature data into a multimodal space to obtain a unified behavior feature space;

[0119] Utilize the implicit dependency of user behaviors to fit multi-layer behavior relationships in the unified behavior feature space and construct a multi-level behavior association network;

[0120] Conduct deep iterative mining on multi-level behavioral association networks to build a deep behavioral feature map of the platform.

[0121] In this embodiment, the behavior feature data of each user is represented as a vector, and the similarity between any two user behavior feature vectors is calculated, such as cosine similarity or Euclidean distance, to obtain the behavior similarity data between each pair of users, to form a user behavior similarity matrix, to analyze the user similarity matrix, to mine significant user behavior similarity groups, to further analyze the characteristics of these similar user groups, to extract potential user behavior dependencies, to construct a user behavior implicit dependency graph, to represent the behavior association between users, to use multimodal learning technology, such as deep neural network, to project various behavior features into a unified low-dimensional feature space, to ensure that the feature The space can better preserve the relationship and structure between the original features, output a unified user behavior feature vector, map the implicit dependency of user behavior to a unified feature space, construct a primary user behavior association network, and use graph neural networks and other methods to further explore the hidden multi-level behavior associations in the feature space on this basis, output a multi-level network model that describes user behavior associations, use graph embedding, graph neural networks and other technologies to perform deep learning and optimization on the multi-layer network model, extract high-order features at each level in the network, and comprehensively construct a platform-level deep behavior feature map that can comprehensively describe the complex behavior patterns and associations of users on the platform.

[0122] In this embodiment, refer to Figure 4 , is a flowchart of detailed implementation steps of step S3. In this embodiment, the detailed implementation steps of step S3 include:

[0123] Step S31: Generate user behavior simulation based on the platform deep behavior feature map to obtain multiple user behavior simulation data;

[0124] Step S32: Analyze malicious behavior characteristics based on a preset malicious attack behavior database, and learn and generate to obtain a malicious attack behavior sequence;

[0125] Step S33: performing random mixed insertion processing on multiple user behavior simulation data based on the malicious attack behavior sequence, thereby obtaining a mixed simulated user behavior sequence.

[0126] In this embodiment, various user behavior patterns and internal connections contained in the platform's deep behavior feature map are utilized, and probabilistic graph models, Markov chains and other methods are adopted to generate multiple user behavior sequences according to the distribution characteristics of nodes (users) and edges (behavior associations) in the map. These simulated user behavior data can better reflect the behavioral characteristics and laws of real users on the platform. Various malicious attack behavior data that have occurred in the platform's history are collected and sorted out to build a malicious attack behavior database. The time series characteristics, combination characteristics, etc. of the malicious behaviors in the database are analyzed, and their typical behavior patterns and characteristics are extracted. Deep learning and other methods are used to perform learning modeling based on the malicious behavior database to generate representative malicious attack behavior sequences, randomly select the generated user behavior simulation data sequences, and randomly insert the generated malicious attack behavior sequences into the user behavior simulation data to obtain a mixed simulated user behavior sequence containing normal user behavior and malicious attack behavior. The mixed data can be used for subsequent malicious behavior detection and defense algorithm training and evaluation.

[0127] In this embodiment, step S4 includes the following steps:

[0128] Step S41: simulating the interactive behavior of the enterprise platform based on the mixed simulated user behavior sequence to obtain platform interactive behavior simulation data;

[0129] Step S42: performing interactive behavior response analysis on the platform interactive behavior simulation data to generate interactive behavior response feature data;

[0130] Step S43: Calculate the malicious behavior detection probability for the interactive behavior response feature data to obtain the malicious behavior detection probability;

[0131] Step S44: performing malicious behavior response analysis on the interactive behavior response feature data based on the malicious behavior detection probability to obtain malicious behavior response data.

[0132] In this embodiment, a mixed simulated user behavior sequence is input into the interactive environment of the enterprise platform, and various operation behaviors of the user on the platform are simulated by gradually calling and interacting with the interactive interface, functional modules, etc. of the platform, and various event data, log information, etc. generated by the platform during the interaction process are recorded and collected as platform interactive behavior simulation data. Various events and log information contained in the platform interactive behavior simulation data are analyzed, and feature information such as the time, duration, involved functional modules, and access resources of the event are extracted. Based on these feature information, feature data representing the interactive behavior response is generated, and the interactive behavior response feature data is input into a pre-trained malicious behavior detection model. The model calculates the probability of malicious behavior in each interactive behavior response based on the feature data, and obtains the malicious behavior detection probability of each interactive behavior response. The calculated malicious behavior detection probability is analyzed and screened, and the interactive behavior responses whose detection probability exceeds a certain threshold are identified as potential malicious behavior responses. The interactive behavior response data identified as malicious are output as malicious behavior response data.

[0133] In this embodiment, the specific steps of step S41 are:

[0134] Conduct interface specification analysis on the enterprise platform to obtain platform API interface specification data;

[0135] Build a containerized virtual environment based on the platform API interface specification data and construct a platform virtual environment framework;

[0136] Perform call script language conversion on the mixed simulated user behavior sequence to obtain the behavior sequence API call script;

[0137] The behavior sequence API call script is used to simulate the interactive access request of the platform virtual environment framework to obtain the platform interactive behavior simulation data.

[0138] In this embodiment, various API interface documents and technical specifications provided by the enterprise platform are collected and sorted out, and detailed information such as the input parameters, return data structure, and calling method of each API interface are analyzed to compile a complete set of platform API interface specification data to provide a basis for the subsequent virtual environment construction. Container technologies such as Docker and Kubernetes are used to build a virtual environment that can simulate various functional modules of the enterprise platform according to the obtained API interface specifications. The virtual environment framework can provide an API interface consistent with the actual platform for calling, and convert the mixed simulated user behavior sequence into a corresponding API call script. The script language can select Python, Bash and other commonly used scripting languages. The script contains various calling logics for the virtual environment API interface, runs the API call script, and interactive access is performed through the virtual environment framework. Various event data, log information, etc. generated by the virtual environment when receiving the API call request are recorded and collected. These data constitute the platform interactive behavior simulation data and can be used for subsequent analysis and detection.

[0139] In this embodiment, the specific steps of step S5 are:

[0140] Step S51: extract security-related parameters of the enterprise platform based on the malicious behavior response data, and perform security risk analysis to mark platform security risk nodes;

[0141] Step S52: performing request transmission logic analysis on the platform interaction behavior simulation data to generate an interaction behavior request logic link;

[0142] Step S53: Evolving the malicious behavior attack path of the platform security risk node based on the interactive behavior request logical link to obtain the malicious behavior attack trajectory;

[0143] Step S54: trace the malicious attack path to locate the security vulnerability, thereby obtaining the platform security vulnerability point.

[0144] In this embodiment, characteristic parameters in malicious behavior response data, such as abnormal click patterns, sensitive operation frequencies, etc., are analyzed, key parameters related to platform security are extracted, a correspondence between these security-related parameters and platform functional modules is established, the security risk level of each module is determined, the platform functional modules are marked according to the risk level, security risk nodes are identified, platform functional module information marked with security risk nodes is output, the request data packet generated by each user interaction behavior is analyzed, and key information contained therein, such as request path, parameters, return value, etc., is extracted. Based on this information, a logical link between each user interaction behavior on the platform is constructed, and these interaction behavior request logical links are integrated into a comprehensive request. Transmit the logical link diagram, output the complete interactive behavior request logical link, start from the security risk node, follow the interactive behavior request logical link, simulate the attack path of various malicious behaviors, analyze the key nodes and attack methods in the attack path, and build a complete malicious behavior attack trajectory. For different types of malicious behaviors, generate multiple attack trajectories, output the attack trajectories of various malicious behaviors, analyze the key attack nodes and methods in the attack trajectory, find out the root vulnerabilities that lead to the success of these attacks, and combine the platform function module information to locate the specific system components or codes with security vulnerabilities. For different types of malicious behavior attacks, summarize the various security vulnerabilities on the platform and output the security vulnerability point information of the platform.

[0145] In this embodiment, the specific steps of step S6 are:

[0146] Step S61: Make security protection patch decisions for platform security vulnerability points to generate security vulnerability protection strategies;

[0147] Step S62: Based on the security vulnerability protection strategy, real-time protection and repair tracking is performed on the enterprise platform, and log protection monitoring data is extracted;

[0148] Step S63: Calculate the residual vulnerability distribution of the log protection monitoring data to obtain residual vulnerability distribution data;

[0149] Step S64: quantifying the repair effect of the residual vulnerability distribution data to generate a repair effect quantification value;

[0150] Step S65: dynamically configuring the protection parameters of the security vulnerability protection strategy based on the repair effect quantification value to generate a dynamically configured protection strategy;

[0151] Step S66: Perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0152] In this embodiment, according to the risk level, impact scope and other factors of each security vulnerability, the key vulnerabilities that need to be repaired first are determined, the available security patch repair solutions are searched and evaluated, the appropriate patch strategy is selected, the repair patch strategies of each vulnerability are integrated into a comprehensive security vulnerability protection strategy, the complete security vulnerability protection strategy is output, and according to the protection strategy, the repair patches are deployed to various relevant components on the enterprise platform, the operation status and security events of the platform are monitored in real time, various log data generated during the protection and repair process are recorded, key log indicators related to security vulnerability protection, such as repair progress and false alarm rate, are extracted, the real-time monitoring log data of the platform security vulnerability protection is output, the platform security status reflected in the log data is analyzed, the unrepaired vulnerabilities that still exist are identified, the distribution of various vulnerabilities in different functional modules of the platform is counted, the distribution data report of the residual security vulnerabilities of the platform is generated, the distribution statistics of the residual vulnerabilities of the platform are output, and the distribution of the residual vulnerabilities of the platform is generated. According to the number of residual vulnerabilities, risk level and other factors, a quantitative evaluation index system for repair effect is designed. The residual vulnerability distribution data is substituted into the evaluation index formula to calculate the quantitative value of the repair effect. The differences in repair effects of different types of vulnerabilities are analyzed to determine the overall repair effect level, and the quantitative evaluation value of the repair effect is output. According to the evaluation of the repair effect, key parameters in the security vulnerability protection strategy, such as repair priority and protection intensity, are adjusted. The protection effects before and after dynamic adjustment are compared to ensure continuous optimization of the platform security protection level, and a new security vulnerability protection strategy that has been dynamically configured and adjusted is output. Data mining technologies such as machine learning are used to analyze and model the evolution process of the protection strategy and the effect data, summarize the key factors affecting the platform security status, and build an intelligent security management model covering early warning, protection, repair and other links. The model is applied to actual platform management, and the security protection strategy is continuously optimized and improved to output a mature intelligent platform security management model.

[0153] In this embodiment, an enterprise platform security management system based on artificial intelligence is provided, which is used to execute the enterprise platform security management method based on artificial intelligence as described above, including:

[0154] An outlier filtering module is used to obtain platform user behavior logs; perform outlier filtering optimization on platform user behavior logs to generate optimized user behavior logs;

[0155] The deep mining module is used to perform behavioral pattern clustering analysis on optimized user behavior logs and generate behavioral pattern clusters; perform deep feature mining evolution based on behavioral pattern clusters and build a deep behavioral feature map of the platform;

[0156] Malicious behavior simulation module, used to generate user behavior simulation based on the platform's deep behavioral feature map, and perform malicious behavior mixed insertion processing to obtain a mixed simulated user behavior sequence;

[0157] The behavior response module is used to perform interactive behavior response analysis on the enterprise platform based on a mixed simulated user behavior sequence to generate interactive behavior response feature data; perform malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data;

[0158] The vulnerability tracing module is used to analyze the request transmission logic of the enterprise platform based on the malicious behavior response data, and to trace and locate the security vulnerabilities of the platform, thereby obtaining the security vulnerabilities of the platform;

[0159] The security management module is used to dynamically configure the protection parameters of the platform's security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

[0160] The present invention obtains the platform user behavior log through the outlier filtering module, identifies abnormal behavior and potential security threats, optimizes the user behavior log by outlier filtering to reduce noise data, improves data quality, and provides a more reliable basis for subsequent analysis. The behavior pattern clustering analysis helps enterprises understand the patterns and trends of user behavior, provides a basis for personalized services and security protection, builds a platform deep behavior feature map to deeply explore the potential characteristics of user behavior, and provides support for security management and service optimization. Malicious behavior simulation helps simulate malicious user behavior, evaluates the security and protection capabilities of the platform, obtains a mixed simulated user behavior sequence to detect and prevent malicious behavior, and improves the platform's defense capabilities against potential attacks. Interaction response analysis helps enterprises understand the user's interaction methods and preferences for the platform, providing a reference for optimizing user experience. Malicious behavior response analysis quickly identifies malicious behavior and takes corresponding measures to protect the security of the platform and user data. Security vulnerability tracing and positioning quickly discovers potential security risk points, repairs vulnerabilities in a timely manner, and improves the security of the platform. Obtaining platform security vulnerabilities provides important clues for security management, helping enterprises establish a more sound security protection mechanism, dynamically configure protection strategies, flexibly adjust security protection parameters according to vulnerability situations, improve the ability to prevent potential threats, and build an intelligent platform security management model to predict security risks and optimize security strategies to improve the overall security and stability of the platform.

[0161] Therefore, the embodiments should be regarded as illustrative and non-restrictive from all points, and the scope of the present invention is limited by the appended claims rather than the above description, and it is therefore intended that all changes falling within the meaning and range of equivalent elements of the application documents are included in the present invention.

[0162] The above is only a specific embodiment of the present invention, so that those skilled in the art can understand or implement the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but should conform to the widest scope consistent with the principles and novel features invented herein.

Claims

1. An enterprise platform security management method based on artificial intelligence, characterized in that: The following steps are involved: Step S1: Obtaining platform user behavior logs; performing outlier filtering optimization on the platform user behavior logs, thereby generating optimized user behavior logs; Among them, the specific steps of step S1 are: Step S11: Obtaining platform user behavior logs; Step S12: identifying the timestamp format of the platform user behavior log to obtain multiple timestamp formats in the log; Step S13: performing timestamp normalization based on multiple timestamp formats in the log to generate a user behavior log with unified timestamps; Step S14: performing field feature statistics on the timestamp unified user behavior log to obtain the normal value range feature of the log field; Step S15: Identify abnormal outliers based on the normal value range characteristics of the log field, and extract abnormal outliers in the log; Step S16: performing outlier filtering optimization on the timestamp unified user behavior log according to the log abnormal outlier value, thereby generating an optimized user behavior log; Step S2: Performing behavior pattern clustering analysis on the optimized user behavior logs to generate behavior pattern clusters; performing deep feature mining and evolution based on the behavior pattern clusters to construct a deep behavior feature map of the platform; Among them, the specific steps of step S2 are: Step S21: Calculate the behavior frequency of each user on the optimized user behavior log to obtain the behavior frequency of each user; Step S22: performing behavior pattern cluster analysis on the optimized user behavior log to generate behavior pattern clusters; Step S23: performing frequency distribution analysis on the behavior frequency of each user based on behavior pattern clustering to generate behavior frequency distribution data; Step S24: performing behavior feature analysis on the behavior frequency distribution data to obtain user behavior feature data; Step S25: Perform deep feature mining and evolution on user behavior feature data to construct a deep behavior feature map of the platform; Among them, the specific steps of step S25 are: Calculate the behavior feature similarity of the user behavior feature data according to the behavior frequency of each user to obtain user behavior similarity data; Conduct implicit dependency analysis of user behaviors based on user behavior similarity data to generate implicit dependency relationships of user behaviors; Embed user behavior feature data into a multimodal space to obtain a unified behavior feature space; Utilize the implicit dependency of user behaviors to fit multi-layer behavior relationships in the unified behavior feature space and construct a multi-level behavior association network; Conduct deep iterative mining on multi-level behavioral association networks to build a deep behavioral feature map of the platform; Step S3: Generate user behavior simulation based on the platform's deep behavior feature map, and perform mixed insertion processing of malicious behavior to obtain a mixed simulated user behavior sequence; Step S4: performing interactive behavior response analysis on the enterprise platform based on the mixed simulated user behavior sequence to generate interactive behavior response feature data; performing malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data; The specific steps of step S4 are: Step S41: simulating the interactive behavior of the enterprise platform based on the mixed simulated user behavior sequence to obtain platform interactive behavior simulation data; The specific steps of step S41 are: Conduct interface specification analysis on the enterprise platform to obtain platform API interface specification data; Build a containerized virtual environment based on the platform API interface specification data and construct a platform virtual environment framework; Perform call script language conversion on the mixed simulated user behavior sequence to obtain the behavior sequence API call script; Use the behavior sequence API to call the script to simulate the interactive access request to the platform virtual environment framework and obtain the platform interactive behavior simulation data; Step S42: performing interactive behavior response analysis on the platform interactive behavior simulation data to generate interactive behavior response feature data; Step S43: Calculate the malicious behavior detection probability for the interactive behavior response feature data to obtain the malicious behavior detection probability; Step S44: performing malicious behavior response analysis on the interactive behavior response feature data based on the malicious behavior detection probability to obtain malicious behavior response data; Step S5: Based on the malicious behavior response data, the request transmission logic of the enterprise platform is analyzed, and the security vulnerability is traced and located, so as to obtain the platform security vulnerability points; wherein, the specific steps of step S5 are: Step S51: extract security-related parameters of the enterprise platform based on the malicious behavior response data, and perform security risk analysis to mark platform security risk nodes; Step S52: performing request transmission logic analysis on the platform interaction behavior simulation data to generate an interaction behavior request logic link; Step S53: Evolving the malicious behavior attack path of the platform security risk node based on the interactive behavior request logical link to obtain the malicious behavior attack trajectory; Step S54: tracing and locating the security vulnerability of the malicious behavior attack path, thereby obtaining the platform security vulnerability point; Step S6: dynamically configure the protection parameters for the platform security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model; The specific steps of step S6 are: Step S61: Make security protection patch decisions for platform security vulnerability points to generate security vulnerability protection strategies; Step S62: Based on the security vulnerability protection strategy, real-time protection and repair tracking is performed on the enterprise platform, and log protection monitoring data is extracted; Step S63: Calculate the residual vulnerability distribution of the log protection monitoring data to obtain residual vulnerability distribution data; Step S64: quantifying the repair effect of the residual vulnerability distribution data to generate a repair effect quantification value; Step S65: dynamically configuring the protection parameters of the security vulnerability protection strategy based on the repair effect quantification value to generate a dynamically configured protection strategy; Step S66: Perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

2. The enterprise platform security management method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of step S3 are: Step S31: Generate user behavior simulation based on the platform deep behavior feature map to obtain multiple user behavior simulation data; Step S32: Analyze malicious behavior characteristics based on a preset malicious attack behavior database, and learn and generate to obtain a malicious attack behavior sequence; Step S33: performing random mixed insertion processing on multiple user behavior simulation data based on the malicious attack behavior sequence, thereby obtaining a mixed simulated user behavior sequence.

3. An enterprise platform security management system based on artificial intelligence, characterized in that: The method for executing the enterprise platform security management method based on artificial intelligence as claimed in claim 1 comprises: An outlier filtering module is used to obtain platform user behavior logs; perform outlier filtering optimization on platform user behavior logs to generate optimized user behavior logs; The deep mining module is used to perform behavioral pattern clustering analysis on optimized user behavior logs and generate behavioral pattern clusters; perform deep feature mining evolution based on behavioral pattern clusters and build a deep behavioral feature map of the platform; Malicious behavior simulation module, used to generate user behavior simulation based on the platform's deep behavioral feature map, and perform mixed insertion processing of malicious behavior to obtain a mixed simulated user behavior sequence; The behavior response module is used to perform interactive behavior response analysis on the enterprise platform based on a mixed simulated user behavior sequence to generate interactive behavior response feature data; perform malicious behavior response analysis on the interactive behavior response feature data to obtain malicious behavior response data; The vulnerability tracing module is used to analyze the request transmission logic of the enterprise platform based on the malicious behavior response data, and to trace and locate the security vulnerabilities of the platform, thereby obtaining the security vulnerabilities of the platform; The security management module is used to dynamically configure the protection parameters of the platform's security vulnerability points to generate a dynamically configured protection strategy; perform data mining modeling on the dynamically configured protection strategy to build an intelligent platform security management model.

Images