A traffic security analysis and acceleration method based on AI big model

Abstract

The present invention discloses a traffic security analysis and acceleration method based on an AI big model, and the present invention relates to the field of network traffic security technology. The security analysis system comprises a training model module, a data encryption module, a resource model module, a planning and judgment module, an optimization and processing module, a deep analysis module, a real-time response module and a visualization module. The training model module trains a model by establishing a decision tree, and identifies traffic data in network traffic according to the decision tree. The present invention has the advantages of: monitoring network traffic in real time through the resource model module, and temporarily removing abnormal data, further analyzing abnormal data through the planning and judgment module, judging whether it needs to be returned to the network traffic, limiting the traffic of abnormal data and stopping the operation through the combination of the optimization and processing module and the real-time response module, thereby improving the speed of normal traffic in the network traffic, so as to ensure network transmission efficiency.

Description

Technical Field

[0001] The present invention relates to the field of network traffic security technology, and specifically to a traffic security analysis and acceleration method based on an AI big model. Background Art

[0002] Existing traffic analysis methods usually rely on specific hardware platforms. The larger the network traffic, the higher the hardware requirements and the higher the deployment requirements. However, in real scenarios, the deployment environment is diverse and the hardware facilities provided are also different, which puts forward new requirements for traffic analysis systems.

[0003] However, the existing patent (publication number: CN 111935145 B) can be widely applied to various hardware platforms according to the traffic analysis system. Users can ignore the hardware and leave it to the platform system to adapt. The platform system can dynamically adjust according to the current status of the hardware platform, and can directly perform preliminary keyword matching on the traffic message, as well as serve as an interface for docking with other third parties. Through the deep detection of the virtual machine on the traffic, anomalies are found, and then the anomalies are traced. The attack coverage and virtual machine distribution obtained by morphological analysis and comparison can be realized to effectively deploy the defense strategy. However, there is still a lack of abnormal traffic data in the security analysis system, and the network traffic is affected to a certain extent. At the same time, when personnel use the security analysis system, the data is not easy for personnel to understand, resulting in a lack of trust in the security analysis system and the need to protect some data in the security analysis system. For this reason, we propose a traffic security analysis and acceleration method based on AI large model. Summary of the invention

[0004] The purpose of the present invention is to provide a traffic security analysis and acceleration method based on an AI big model.

[0005] In order to solve the problems raised in the above background technology, the present invention provides the following technical solutions: a traffic security analysis system based on an AI big model, the security analysis system comprising a training model module, a data encryption module, a resource model module, a planning and judgment module, an optimization and processing module, a deep analysis module, a real-time response module and a visualization module;

[0006] The training model module trains the model by establishing a decision tree, and identifies the traffic data in the network traffic according to the decision tree, and transmits the trained model data to the resource model module;

[0007] The data encryption module is used to encrypt network traffic and decision trees, and to encrypt sensitive data in network traffic and data transmitted between modules through digital signatures;

[0008] The resource model module includes an AI learning unit, a monitoring unit and an identification unit. The AI ​​learning unit is provided with an AI large model, and the AI ​​large model is trained based on network traffic. The monitoring unit is used to monitor network traffic data in real time, and transmit abnormal data monitored in the network traffic data to the identification unit. The identification unit is used to identify the abnormal data transmitted by the monitoring unit and classify the abnormal data.

[0009] The planning and judgment module processes the data in the identification unit, generates corresponding optimization instructions according to the classified abnormal data, and then transmits the optimization instructions to the optimization and processing module;

[0010] The optimization and processing module calls the network management authority of the security analysis system according to different types of optimization instructions, processes the abnormal traffic according to the optimization instruction data and the network management authority, processes the abnormal data identified in the resource model module using the traffic management strategy, and limits and marks the abnormal data, and then transmits the marked abnormal data to the deep analysis module, and calls the network hardware configuration and network protocol in the security analysis system at the same time, and improves the response speed to the network traffic by optimizing the network hardware configuration and calculating the number of parallel transmission channels in the network protocol and generating parallel channels, wherein the number of parallel transmission channels is based on the formula:

[0011]

[0012] Sure, n Indicates the number of parallel transmission channels in the network protocol. X Indicates the size of the data packet. Y Indicates the transmission speed before optimization. Z Indicates the size of network delay and improves the response speed to network traffic;

[0013] The in-depth analysis module is provided with a honeypot system, and the honeypot system is used to run abnormal data and identify the vulnerabilities of the abnormal data, and then transmit the vulnerabilities of the abnormal data to the visualization module;

[0014] The real-time response module monitors the marked abnormal data in real time, terminates the operation of the abnormal data, and feeds back the termination data of the abnormal data to the real-time response module after the abnormal data is terminated;

[0015] The visualization module is used to display the decision data of the decision tree, the abnormal data in the resource model and the dangerous types of the abnormal data in the deep analysis module. At the same time, the management personnel delete the abnormal data in the real-time response module and can perform abnormal data recovery.

[0016] As a further solution of the present invention: the decision tree in the training model module is displayed in the visualization module, so that the operator can have a clearer understanding of the prediction results and the decision-making process, thereby improving the operator's credibility in traffic safety analysis.

[0017] As a further solution of the present invention: the data encryption module encrypts the decision tree during transmission, and inserts noise into the decision tree during transmission, so that the AI ​​learning unit improves the decision process, and uses the visualization module to convert the decision tree in the AI ​​learning unit into a visual list and display it, and a parsing unit is set in the visualization module. The parsing unit is used to read the content of the decision tree, and parse and inject understanding into the read content based on natural language, and transmit the injected understanding model to the visualization module, so as to facilitate the operator's understanding of the decision process and obtain the operator's trust in the security analysis.

[0018] As a further solution of the present invention: the resource model module processes the network traffic through a trusted decision-making process, and monitors the abnormal data in the network traffic in real time through the combination of the AI ​​learning unit and the monitoring unit, and uses the identification unit to judge the characteristics of the abnormal data, and its characteristic classification includes traffic characteristics and behavior characteristics respectively. The planning and judgment module is provided with an early warning level, and the early warning level is divided into normal, dangerous and emergency. The early warning level is judged according to the combination of the traffic characteristics and the behavior characteristics of the abnormal data, and then the planning and judgment module decides whether to perform traffic acceleration processing according to the early warning level. When the early warning level is judged to be normal, the planning and judgment module does not need to generate optimization instructions. When the early warning level is judged to be dangerous, the planning and judgment module generates optimization instructions and transmits the optimization instructions to the optimization and processing module. When the early warning level is judged to be urgent, the planning and judgment module generates optimization instructions and transfer instructions, and transmits the optimization instructions and transfer instructions to the optimization and processing module. Then, after receiving the transfer instruction, the optimization and processing module transmits the abnormal data to the deep analysis module.

[0019] As a further solution of the present invention: after receiving the optimization instruction, the optimization and processing module will obtain the network management authority in the security analysis system, and parse the current data packet according to the network management authority, insert a task diversion unit into the optimization and processing module, use the task diversion unit to divide the data packet and temporarily remove abnormal data, then call the hardware resources in the security analysis system, and generate parallel channels in the network protocol, and then divide and process the data packet to improve the processing speed of the data packet.

[0020] As a further solution of the present invention:

[0021]

[0022] Where M represents the total transmission time, K represents the optimized data transmission speed, L represents the current network transmission efficiency, It indicates the network transmission efficiency before optimization, and then the feasibility of parallel number is verified through the formula.

[0023] As a further solution of the present invention: after receiving the abnormal data, the deep analysis module starts the honeypot system and runs the abnormal data, and records the characteristics of the abnormal data to improve the security analysis system's confrontation with the abnormal data.

[0024] As a further solution of the present invention: the real-time response module is combined with the optimization and processing module to monitor and process the abnormal data, and stop the operation of the abnormal data. At the same time, the optimization and processing module is called to limit the flow of the abnormal data to improve the flow data of normal data packets.

[0025] In addition, the present invention also provides an acceleration method for traffic security analysis based on an AI large model. Step 1: establish a decision tree model through a training model module, and then encrypt the network traffic and the decision tree through a data encryption module to ensure the irreversibility and security of the network traffic data and the decision tree;

[0026] Step 2: Monitor the network data in real time through the resource model module, and use the identification unit to identify the abnormal data detected by the monitoring unit, and then transmit the identified and classified abnormal data to the planning and judgment module for further judgment;

[0027] Step 3: In the planning and judgment module, the dangerous situation of the abnormal data is judged, and optimization instructions are generated according to the dangerous situation, the non-abnormal data is returned to the data packet, and a log is generated for recording, the abnormal data is generated into corresponding optimization instructions, and the optimization instructions are transmitted to the optimization and processing module;

[0028] Step 4: By combining the optimization and processing module with the real-time response module, ensure the speed limit of abnormal data and improve the transmission efficiency of the current network traffic. The visualization module displays the data details in each link, making it easier for administrators in the security analysis system to view and modify their data.

[0029] By adopting the above technical solution, compared with the prior art, the beneficial effects of the present invention are:

[0030] 1. The present invention monitors network traffic in real time through a resource model module, and temporarily removes abnormal data. The planning and judgment module further analyzes the abnormal data to determine whether it needs to be returned to the network traffic. The optimization and processing module is combined with the real-time response module to limit the traffic of abnormal data and stop the operation, thereby increasing the speed of normal traffic in the network traffic to ensure network transmission efficiency.

[0031] 2. The present invention encrypts network traffic and decision trees through a data encryption module to ensure the tamper-proof and security of the network traffic and decision trees, while ensuring the security of the security analysis system.

[0032] 3. The present invention sets a parsing unit in the visualization module, uses the parsing unit to extract the content in the decision tree, generates understanding content for the extracted content through natural language, and then converts the generated understanding content into a visualization list and transmits it to the visualization module, so as to facilitate personnel's understanding of the operating logic in the security analysis system and thereby increase the credibility of the security analysis system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of a traffic security analysis system in an embodiment of the present invention;

[0034] Figure 2 Schematic diagram of the acceleration method steps in an embodiment of the present invention. DETAILED DESCRIPTION

[0035] The specific embodiments of the present invention are further described below in conjunction with the accompanying drawings. It should be noted that the description of these embodiments is used to help understand the present invention, but does not constitute a limitation of the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0036] The present invention provides a traffic security analysis system based on an AI big model, the security analysis system comprising a training model module, a data encryption module, a resource model module, a planning and judgment module, an optimization and processing module, a deep analysis module, a real-time response module and a visualization module;

[0037] The training model module trains the model by establishing a decision tree, identifies the traffic data in the network traffic according to the decision tree, and transmits the trained model data to the resource model module;

[0038] The data encryption module is used to encrypt network traffic and decision trees, and encrypt sensitive data in network traffic and data transmitted between modules through digital signatures;

[0039] The resource model module includes an AI learning unit, a monitoring unit and an identification unit. The AI ​​learning unit is provided with an AI large model, and the AI ​​large model is trained based on network traffic. The monitoring unit is used to monitor network traffic data in real time and transmit abnormal data in the monitored network traffic data to the identification unit. The identification unit is used to identify the abnormal data transmitted by the monitoring unit and classify the abnormal data.

[0040] The planning and judgment module processes the data in the identification unit and generates corresponding optimization instructions based on the classified abnormal data, and then transmits the optimization instructions to the optimization and processing module;

[0041] The optimization and processing module retrieves the network management authority of the security analysis system according to different types of optimization instructions, processes abnormal traffic according to the optimization instruction data and network management authority, processes the abnormal data identified in the resource model module using the traffic management strategy, and limits and marks the abnormal data, and then transmits the marked abnormal data to the deep analysis module. At the same time, it retrieves the network hardware configuration and network protocol in the security analysis system, and improves the response speed to network traffic by optimizing the network hardware configuration and adding parallel transmission technology of the network protocol;

[0042] A honeypot system is set in the deep analysis module. The honeypot system is used to run abnormal data and identify the vulnerabilities of the abnormal data, and then transmit the vulnerabilities of the abnormal data to the visualization module;

[0043] The real-time response module monitors the marked abnormal data in real time, terminates the operation of the abnormal data, and feeds back the termination data of the abnormal data to the real-time response module after the abnormal data is terminated;

[0044] The visualization module is used to display the decision data of the decision tree, the abnormal data in the resource model, and the dangerous types of abnormal data in the deep analysis module. At the same time, the management personnel can delete the abnormal data in the real-time response module and recover the abnormal data.

[0045] In one embodiment of the present invention: the decision tree in the training model module is displayed in the visualization module, so that the operator can have a clearer understanding of the prediction results and the decision-making process, thereby improving the operator's credibility in traffic safety analysis.

[0046] In one embodiment of the present invention: a data encryption module encrypts the decision tree during transmission, and inserts noise into the decision tree during transmission, so that the AI ​​learning unit improves the decision process, and uses a visualization module to convert the decision tree in the AI ​​learning unit into a visual list and display it, and a parsing unit is set in the visualization module. The parsing unit is used to read the content of the decision tree, and parse and inject understanding into the read content based on natural language, and transmit the injected understanding model to the visualization module, so as to facilitate the operator's understanding of the decision process and obtain the operator's trust in the security analysis.

[0047] In one embodiment of the present invention: the resource model module processes the network traffic through a trusted decision-making process, and monitors the abnormal data in the network traffic in real time through the combination of the AI ​​learning unit and the monitoring unit, and uses the identification unit to judge the characteristics of the abnormal data, and its characteristic classification includes traffic characteristics and behavior characteristics. The planning and judgment module is provided with a warning level, and the warning level is divided into normal, dangerous and emergency. The warning level is judged according to the combination of the traffic characteristics and the behavior characteristics of the abnormal data, and then the planning and judgment module decides whether to perform traffic acceleration processing according to the warning level. When the warning level is judged to be normal, the planning and judgment module does not need to generate optimization instructions. When the warning level is judged to be dangerous, the planning and judgment module generates optimization instructions and transmits the optimization instructions to the optimization and processing module. When the warning level is judged to be urgent, the planning and judgment module generates optimization instructions and transfer instructions, and transmits the optimization instructions and transfer instructions to the optimization and processing module. Then, after receiving the transfer instruction, the optimization and processing module transmits the abnormal data to the deep analysis module.

[0048] In one embodiment of the present invention: after receiving the optimization instruction, the optimization and processing module will obtain the network management authority in the security analysis system, and parse the current data packet according to the network management authority, insert a task diversion unit in the optimization and processing module, use the task diversion unit to divide the data packet and temporarily remove abnormal data, then call the hardware resources in the security analysis system, and generate parallel channels in the network protocol, and then divide and process the data packet to improve the processing speed of the data packet.

[0049] In one embodiment of the present invention:

[0050]

[0051] Where M represents the total transmission time, K represents the optimized data transmission speed, L represents the current network transmission efficiency, It indicates the network transmission efficiency before optimization, and then the feasibility of parallel number is verified through the formula.

[0052] In one embodiment of the present invention, after receiving the abnormal data, the deep analysis module starts the honeypot system and runs the abnormal data, and records the characteristics of the abnormal data to improve the security analysis system's confrontation with the abnormal data.

[0053] In one embodiment of the present invention: the real-time response module monitors and processes the abnormal data by combining with the optimization and processing module, and stops the operation of the abnormal data. At the same time, the optimization and processing module is called to limit the flow of the abnormal data to improve the flow data of normal data packets.

[0054] Example 1, please refer to the attached Figure 1 ,The vulnerabilities in the abnormal data are identified through the honeypot system in the deep analysis module, and a visual list of the vulnerabilities of the abnormal data is generated and transmitted to the visualization module, which facilitates subsequent administrators to update the firewall according to the vulnerabilities of the abnormal data, thereby improving the network security.

[0055] Example 2, please refer to the attached Figure 1 Through the training model module, we can train people to handle network traffic in a way that is easy for them to understand, and then use the resource model module to identify network traffic, making the overall network traffic security analysis simpler and more accurate.

[0056] Specifically, the resource model module is used to monitor the network traffic in real time, and the abnormal data is temporarily eliminated. The planning and judgment module is used to further analyze the abnormal data to determine whether it needs to be returned to the network traffic. The optimization and processing module is combined with the real-time response module to limit the traffic of abnormal data and stop the operation, thereby increasing the speed of normal traffic in the network traffic to ensure network transmission efficiency.

[0057] Specifically, the network traffic and decision tree are encrypted through the data encryption module to ensure the immutability and security of the network traffic and decision tree, while ensuring the security of the security analysis system.

[0058] Specifically, by setting a parsing unit in the visualization module, and using the parsing unit to extract the content in the decision tree, and generating understanding content for the extracted content through natural language, and then converting the generated understanding content into a visualization list and transmitting it to the visualization module, it is convenient for personnel to understand the operating logic in the security analysis system, thereby increasing the credibility of the security analysis system.

[0059] Working principle:

[0060] First, the data model in the network traffic is obtained through the training model module, and then the network traffic and decision tree are encrypted through the data encryption module to ensure the irreversibility and security of the network traffic data and decision tree. The network data is monitored in real time through the resource model module, and the abnormal data monitored by the monitoring unit is identified by the identification unit, and then the identified and classified abnormal data is transmitted to the planning judgment module for further judgment;

[0061] Finally, the dangerous situation of abnormal data is judged in the planning judgment module, and optimization instructions are generated according to the dangerous situation. The non-abnormal data is returned to the data packet, and a log is generated for recording. The corresponding optimization instructions are generated for the abnormal data, and the optimization instructions are transmitted to the optimization and processing module. By combining the optimization and processing module with the real-time response module, the speed limit of abnormal data is ensured and the transmission efficiency of the current network traffic is improved. The data details in each link are displayed through the visualization module, which makes it convenient for administrators in the security analysis system to view and modify their data. At this point, the entire workflow is completed.

[0062] The above-mentioned front, back, left, right, top and bottom are all based on the figures in the specification. Figure 1 As a benchmark, according to the person's observation perspective, the side of the device facing the observer is defined as the front, the left side of the observer is defined as the left, and so on.

[0063] In the description of the present invention, it should be understood that the terms "center", "longitudinal", "lateral", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside" and the like indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as limiting the scope of protection of the present invention.

[0064] It should be noted that the device structure and the drawings of the present invention mainly describe the principle of the present invention. In terms of the technology of the design principle, the settings of the power mechanism, power supply system and control system of the device are not fully described. On the premise that the technical personnel in this field understand the principle of the above invention, the details of the power mechanism, power supply system and control system can be clearly known. The control method of the application document is automatic control through a controller, and the control circuit of the controller can be realized by simple programming by the technical personnel in this field.

[0065] The standard parts used therein can all be purchased from the market and can be customized according to the instructions and drawings. The specific connection methods of each part adopt conventional means such as mature bolts, rivets, welding, etc. in the prior art. The machinery, parts and equipment all adopt conventional models in the prior art, and the structures and principles of the components known to technical personnel in this field can be known by these technical personnel through technical manuals or through conventional experimental methods.

[0066] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited to the described embodiments. For those skilled in the art, various changes, modifications, substitutions and variations of these embodiments are made without departing from the principles and spirit of the present invention, and still fall within the scope of protection of the present invention.

Claims

1. A traffic security analysis system based on an AI big model, characterized by: The security analysis system includes a training model module, a data encryption module, a resource model module, a planning and judgment module, an optimization and processing module, a deep analysis module, a real-time response module and a visualization module; The training model module trains the model by establishing a decision tree, and identifies the traffic data in the network traffic according to the decision tree, and transmits the trained model data to the resource model module; The data encryption module is used to encrypt network traffic and decision trees, and to encrypt sensitive data in network traffic and data transmitted between modules through digital signatures; The resource model module includes an AI learning unit, a monitoring unit and an identification unit. The AI ​​learning unit is provided with an AI large model, and the AI ​​large model is trained based on network traffic. The monitoring unit is used to monitor network traffic data in real time, and transmit abnormal data monitored in the network traffic data to the identification unit. The identification unit is used to identify the abnormal data transmitted by the monitoring unit and classify the abnormal data. The planning and judgment module processes the data in the identification unit, generates corresponding optimization instructions according to the classified abnormal data, and then transmits the optimization instructions to the optimization and processing module; The optimization and processing module calls the network management authority of the security analysis system according to different types of optimization instructions, processes the abnormal traffic according to the optimization instruction data and the network management authority, processes the abnormal data identified in the resource model module using the traffic management strategy, and limits and marks the abnormal data, and then transmits the marked abnormal data to the deep analysis module, and calls the network hardware configuration and network protocol in the security analysis system at the same time, and improves the response speed to the network traffic by optimizing the network hardware configuration and calculating the number of parallel transmission channels in the network protocol and generating parallel channels, wherein the number of parallel transmission channels is based on the formula: Sure, n Indicates the number of parallel transmission channels in the network protocol. X Indicates the size of the data packet. Y Indicates the transmission speed before optimization. Z Indicates the size of network delay and improves the response speed to network traffic; The in-depth analysis module is provided with a honeypot system, and the honeypot system is used to run abnormal data and identify the vulnerabilities of the abnormal data, and then transmit the vulnerabilities of the abnormal data to the visualization module; The real-time response module monitors the marked abnormal data in real time, terminates the operation of the abnormal data, and feeds back the termination data of the abnormal data to the real-time response module after the abnormal data is terminated; The visualization module is used to display the decision data of the decision tree, the abnormal data in the resource model and the dangerous types of the abnormal data in the deep analysis module. At the same time, the management personnel delete the abnormal data in the real-time response module and can perform abnormal data recovery.

2. According to claim 1, a traffic security analysis system based on an AI big model is characterized by: The decision tree in the training model module is displayed in the visualization module, so that the operator can have a clearer understanding of the prediction results and decision-making process, thereby improving the operator's credibility in traffic safety analysis.

3. According to claim 1, a traffic security analysis system based on an AI big model is characterized in that: The data encryption module encrypts the decision tree during transmission and inserts noise into the decision tree during transmission, so that the AI ​​learning unit improves the decision process. The visualization module is used to convert the decision tree in the AI ​​learning unit into a visual list and display it. A parsing unit is set in the visualization module. The parsing unit is used to read the content of the decision tree, parse the read content based on natural language and inject understanding, and transmit the injected understanding model to the visualization module, so as to facilitate the operator's understanding of the decision process and obtain the operator's trust in the security analysis.

4. According to claim 1, a traffic security analysis system based on an AI big model is characterized in that: The resource model module processes network traffic through a trusted decision-making process, and monitors abnormal data in network traffic in real time through the combination of an AI learning unit and a monitoring unit, and uses an identification unit to determine the characteristics of abnormal data, wherein the characteristic classifications include traffic characteristics and behavior characteristics. An early warning level is set in the planning and judgment module, and the early warning level is divided into normal, dangerous and emergency. The early warning level is judged based on the combination of the traffic characteristics and behavior characteristics of the abnormal data, and then the planning and judgment module decides whether to perform traffic acceleration processing based on the early warning level. When the early warning level is judged to be normal, the planning and judgment module does not need to generate optimization instructions. When the early warning level is judged to be dangerous, the planning and judgment module generates optimization instructions and transmits the optimization instructions to the optimization and processing module. When the early warning level is judged to be urgent, the planning and judgment module generates optimization instructions and transfer instructions, and transmits the optimization instructions and transfer instructions to the optimization and processing module. Then, after receiving the transfer instruction, the optimization and processing module transmits the abnormal data to the deep analysis module.

5. According to claim 1, a traffic security analysis system based on an AI big model is characterized in that: After receiving the optimization instruction, the optimization and processing module will obtain the network management authority in the security analysis system, and parse the current data packet according to the network management authority, insert a task diversion unit in the optimization and processing module, use the task diversion unit to divide the data packet and temporarily remove abnormal data, then call the hardware resources in the security analysis system, and generate parallel channels in the network protocol, and then divide and process the data packet to improve the processing speed of the data packet.

6. According to claim 5, a traffic security analysis system based on an AI big model is characterized in that: Where M represents the total transmission time, K represents the optimized data transmission speed, L represents the current network transmission efficiency, It indicates the network transmission efficiency before optimization, and then the feasibility of parallel number is verified through the formula.

7. The traffic security analysis system based on AI big model according to claim 1 is characterized by: After receiving the abnormal data, the deep analysis module starts the honeypot system and runs the abnormal data, and records the characteristics of the abnormal data to improve the security analysis system's confrontation with the abnormal data.

8. According to claim 1, a traffic security analysis system based on an AI big model is characterized by: The real-time response module is combined with the optimization and processing module to monitor and process the abnormal data, and stop the operation of the abnormal data. At the same time, the optimization and processing module is called to limit the flow of the abnormal data to improve the flow data of normal data packets.

9. An acceleration method for traffic security analysis based on an AI big model, characterized by: The acceleration method for traffic security analysis based on an AI large model is obtained according to the traffic security analysis system based on an AI large model according to any one of claims 1 to 8, and the steps are as follows: Step 1: Establish a decision tree model through the training model module, and then encrypt the network traffic and decision tree through the data encryption module to ensure the irreversibility and security of the network traffic data and decision tree; Step 2: Monitor the network data in real time through the resource model module, and use the identification unit to identify the abnormal data detected by the monitoring unit, and then transmit the identified and classified abnormal data to the planning and judgment module for further judgment; Step 3: In the planning and judgment module, the dangerous situation of the abnormal data is judged, and optimization instructions are generated according to the dangerous situation, the non-abnormal data is returned to the data packet, and a log is generated for recording, the abnormal data is generated into corresponding optimization instructions, and the optimization instructions are transmitted to the optimization and processing module; Step 4: By combining the optimization and processing module with the real-time response module, ensure the speed limit of abnormal data and improve the transmission efficiency of the current network traffic. The visualization module displays the data details in each link, making it easier for administrators in the security analysis system to view and modify their data.

Images