AI-based network security situation analysis and prediction method and system

Abstract

The invention relates to the field of network security analysis, in particular to a network security situation analysis and prediction method and system based on AI, and the method comprises the steps: obtaining network source data in real time, and analyzing the behavior characteristics of the network source data; constructing an AI analysis model, inputting the behavior characteristics into the AI analysis model, and analyzing danger coefficients of the behavior characteristics through the AI analysis model; when the analysis result is that the danger coefficient is greater than the preset safety threshold, judging that the behavior characteristics meet an early warning condition, and executing an early warning strategy based on the early warning condition; when the analysis result is that the danger coefficient is smaller than the preset safety threshold value, the monitoring duration is determined according to the danger coefficient; constructing a situation prediction model, inputting the behavior characteristics of which the danger coefficients are smaller than a preset safety threshold value and the monitoring duration into the situation prediction model, predicting the network situation of the behavior characteristics in a time range of the monitoring duration through the situation prediction model, and outputting a prediction result; and generating network security situation feedback based on a prediction result.

Description

Technical Field

[0001] The present application relates to the field of network security analysis, and in particular to an AI-based network security situation analysis and prediction method and system. Background Art

[0002] Network security posture refers to the security status of a network environment at a specific point in time. It includes the comprehensive situation of network assets (such as servers, terminals, data, etc.), threats (such as malware, hacker attacks, etc.), vulnerabilities (such as system vulnerabilities, configuration errors, etc.) and protective measures (such as firewalls, intrusion detection systems, etc.). Network security posture is the foundation of network security.

[0003] Existing technologies, especially in the field of network security, often rely on preset rules and static configurations to monitor and respond to threats. These technologies may include intrusion detection systems (IDS) and intrusion prevention systems (IPS): These systems use predefined rules to identify and block known threats. Security Information and Event Management (SIEM) systems: SIEM systems are used to collect, analyze, and correlate security events and log data from different sources. Firewalls and VPNs. These network devices use static rules to control traffic, and these rules may not be flexible enough to adapt to changes in the network situation. When the network environment is at a high risk, the existing technology uses static monitoring frequencies for monitoring, which can easily lead to delayed detection of potential threats. Therefore, the existing technology has defects and needs to be improved. Summary of the invention

[0004] In order to solve one or several problems in the prior art, the main purpose of this application is to provide an AI-based network security situation analysis and prediction method and system.

[0005] In order to achieve the above-mentioned invention object, the present application proposes an AI-based network security situation analysis and prediction method, the method comprising:

[0006] Acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data, and vulnerability data;

[0007] Constructing an AI analysis model, inputting the behavior characteristics into the AI ​​analysis model, analyzing the risk factor of the behavior characteristics through the AI ​​analysis model, and analyzing the results of the data analysis;

[0008] When the result of the analysis is that the risk factor is greater than the preset safety threshold, it is judged that the behavior characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions;

[0009] When the result of the analysis is that the risk factor is less than a preset safety threshold, determining the monitoring time according to the risk factor;

[0010] Construct a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, which include low-risk situation, medium-risk situation and high-risk situation;

[0011] Generate network security situation feedback based on the prediction results.

[0012] The embodiment of the present application also provides an AI-based network security situation analysis and prediction system, including:

[0013] An acquisition module is used to acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data and vulnerability data;

[0014] A construction module is used to construct an AI analysis model, input the behavior characteristics into the AI ​​analysis model, analyze the risk factor of the behavior characteristics through the AI ​​analysis model, and calculate the results of the data analysis;

[0015] A judgment module, for judging that the behavior characteristics meet the warning conditions when the result of the analysis is that the risk factor is greater than a preset safety threshold, and executing the warning strategy based on the warning conditions;

[0016] A determination module, configured to determine a monitoring time period according to the risk factor when the result of the analysis is that the risk factor is less than a preset safety threshold;

[0017] An input module is used to construct a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, which include low-risk situation, medium-risk situation and high-risk situation;

[0018] The generation module is used to generate network security situation feedback based on the prediction results.

[0019] The present application also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0020] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0021] The AI-based network security situation analysis and prediction method and system of the embodiment of the present application obtains network source data in real time and uses the AI ​​analysis model to quickly analyze the data. It can detect potential threats in time, shorten the response time, and improve the real-time nature of threat detection. Build a situation prediction model to predict the network situation in the future. Early warning of potential threats provides the security team with enough time to prepare and respond. Dynamically adjust the monitoring strategy and early warning strategy according to the changes in the network situation. Flexibly respond to changes in the network environment and improve the adaptability and continuity of security protection. Comprehensively analyze the behavioral characteristics of network source data and conduct risk assessment. Fully understand the network situation, accurately identify potential threats, and improve the accuracy and efficiency of threat detection. Based on the prediction results, execute early warning strategies, including sending alarm information, starting intrusion detection and defense alarms, isolating network segments or source data, etc. Effectively respond to potential threats, reduce security risks, and improve the effectiveness of network security protection. Through verification steps and subsequent monitoring and adjustment, continuously improve the prediction model and monitoring strategy. Continuously improve the ability and level of security protection to ensure continuous optimization of network security. Reduce dependence on rule sets and manual analysis to improve resource utilization efficiency. Reduce the cost of security protection and improve the sustainability of security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 A flowchart of a network security situation analysis and prediction method based on AI according to an embodiment of the present application;

[0023] Figure 2 A flowchart of a network security situation analysis and prediction method based on AI according to an embodiment of the present application;

[0024] Figure 3 This is a schematic block diagram of the structure of an AI-based network security situation analysis and prediction system according to an embodiment of the present application;

[0025] Figure 4 A schematic block diagram of the structure of a computer device according to an embodiment of the present application.

[0026] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0028] Reference Figure 1 In an embodiment of the present application, a network security situation analysis and prediction method based on AI is provided, and the method comprises:

[0029] S1. Acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data, and vulnerability data;

[0030] S2. Build an AI analysis model, input the behavior characteristics into the AI ​​analysis model, analyze the risk factor of the behavior characteristics through the AI ​​analysis model, and calculate the results of the data analysis;

[0031] S3. When the result of the analysis is that the risk factor is greater than the preset safety threshold, it is determined that the behavior characteristics meet the warning conditions, and a warning strategy is executed based on the warning conditions;

[0032] S4. When the result of the analysis is that the risk factor is less than a preset safety threshold, determining a monitoring time according to the risk factor;

[0033] S5, construct a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, the predicted results include low-risk situation, medium-risk situation and high-risk situation;

[0034] S6. Generate network security situation feedback based on the prediction results.

[0035] As described in the above steps S1-S2, network traffic data, system log data and vulnerability data are collected in real time through network sensors, traffic analysis tools, log systems, etc. Real-time data can provide the latest status of the network environment, which helps to detect and respond to potential threats in a timely manner. The collected data is processed using predefined algorithms or rules to extract key features related to network security. Feature extraction helps to identify abnormal behaviors and potential attack patterns, providing a basis for subsequent analysis. Machine learning algorithms (such as deep learning, random forests, etc.) are used to build analysis models, and models are trained using historical data sets to identify dangerous features. AI analysis models can automatically learn and identify complex and dynamic threat patterns, improving the accuracy and efficiency of predictions. The extracted behavioral features are input into the AI ​​analysis model, and the model calculates the risk factor of each feature. The risk factor quantifies the risk level of each feature, which helps to determine whether early warning measures are needed.

[0036] As described in the above steps S3-S6, when the risk factor exceeds the preset safety threshold, the early warning strategy is triggered, such as notifying the security team, initiating emergency response, etc. Timely early warning can help the security team take quick measures to prevent potential threats from causing actual damage. The situation prediction model is used to predict the development trend of the network situation, including low-risk, medium-risk and high-risk situations. Situation prediction helps the security team prepare and adjust strategies in advance to deal with possible threats. Based on the prediction results, a feedback report on the network security situation is generated, including threat analysis, defense measures and future prevention strategies. The feedback report provides management and security teams with a comprehensive view of network security, which helps to continuously improve and optimize security strategies.

[0037] Reference Figure 2 In one embodiment, the method of generating network security situation feedback based on the predicted result includes:

[0038] When the predicted result is a low risk situation, traffic data, log data, and vulnerability data are obtained according to the current network monitoring frequency and scope;

[0039] Generate a network security situation report based on the preset time period and send it to the management end.

[0040] As described above, the output results of the situation prediction model are used as a basis to generate a feedback report on the network security situation. This feedback mechanism can provide the latest status and trends of network security, help decision makers understand the current security situation, and adjust security policies accordingly. According to the current network monitoring frequency and scope, traffic data, log data, and vulnerability data are obtained. In a low-risk situation, the consumption of monitoring resources is reduced, resource allocation is optimized, and continuous attention to network security is maintained. Network security situation reports are generated according to preset time periods, such as daily and weekly. Regularly generating reports helps management to continuously track network security situations, identify potential risks in a timely manner, and take corresponding preventive measures. Send the generated network security situation report to the receiving end specified by the management. Provide network security information to management in a timely manner so that they can understand the latest status of network security and make corresponding decisions.

[0041] In one embodiment, the method of generating network security situation feedback based on the predicted result further includes:

[0042] S61. When the predicted result is a medium risk situation, increase the network monitoring frequency and scope based on the medium risk situation to obtain traffic data, log data, and vulnerability data;

[0043] S62. Based on the medium-risk situation, conduct a risk assessment on the monitored behavioral characteristics and determine the target characteristics predicted to be medium-risk situations;

[0044] S63, obtaining a change trend of the target feature within a preset time, and determining whether the change trend of the target feature within the preset time is greater than a preset trend change threshold;

[0045] S64. When the change trend of the target feature within the preset time is greater than the preset trend change threshold, it is determined that the target feature meets the warning condition, and the warning strategy is executed based on the warning condition and sent to the management end.

[0046] As described above, when the prediction result is a medium-risk situation, the flow data, log data, and vulnerability data are obtained by increasing the network monitoring frequency and range. Increasing the monitoring intensity helps to more comprehensively understand the network behavior under the medium-risk situation, timely discover potential threats, and take corresponding preventive measures. According to the medium-risk situation, the monitored behavior characteristics are risk assessed to determine the target characteristics predicted as medium-risk situation. Risk assessment helps to determine which behavior characteristics may constitute a medium-risk situation, so as to take more targeted preventive measures. The change trend of the target feature within the preset time is obtained and compared with the preset trend change threshold. The monitoring of the change trend helps to identify the development trend of the target feature, so as to predict its possible impact on network security. When the change trend of the target feature within the preset time is greater than the preset trend change threshold, it is judged that the target feature meets the warning condition. The judgment of the warning condition helps to timely discover potential threats and take corresponding preventive measures. When it is judged that the target feature meets the warning condition, the warning strategy is executed and the warning information is sent to the management end. The execution of the warning strategy helps to respond to potential threats in a timely manner and reduce security risks; the sending of warning information helps the management to understand the network security status in a timely manner and make corresponding decisions. It is worth mentioning that reanalyzing the changing trend of the target feature within the preset time also includes comparing it with the previous prediction results. Confirm whether the changing trend of the target feature still supports the prediction of the medium-risk situation. If the verification result supports the medium-risk situation, the early warning strategy is implemented. If the verification result shows that the prediction result is wrong, the early warning strategy is not implemented, but the monitoring strategy is adjusted or other measures are taken according to the actual situation. Before implementing the early warning strategy, the changing trend of the target feature within the preset time is reanalyzed. This may include further review of the data to confirm whether there is any new information or changes that may affect the previous prediction results. By reanalyzing, it can be ensured that the understanding of the target feature is up to date and based on the latest data and analysis. Compare the results of the reanalysis with the previous prediction results. This helps to verify the continuity and accuracy of the prediction. The comparison can reveal whether the prediction result is still valid or whether it is necessary to adjust it. Based on the comparison results, confirm whether the changing trend of the target feature still supports the prediction of the medium-risk situation. The confirmation step can avoid executing the early warning strategy based on inaccurate or outdated information and ensure the accuracy and effectiveness of the early warning. If the verification result supports the medium-risk situation, the early warning strategy is implemented. This confirmation step ensures that the execution of the early warning strategy is based on solid evidence and accurate prediction results, thereby improving the efficiency and effectiveness of the response. If the verification results show that the prediction results are wrong, the early warning strategy will not be executed, but the monitoring strategy will be adjusted or other measures will be taken according to the actual situation. This flexibility ensures that the security team can respond quickly based on the actual situation, rather than just relying on the prediction results.

[0047] In one possible embodiment, assume that a financial institution has a highly secure internal network for handling sensitive customer data and transactions. The network connects remote branches via VPN and performs regular security audits and vulnerability scans. The financial institution deploys a network traffic monitoring system to monitor network traffic data from all branches in real time. The system automatically collects log data from all employee terminals, including login attempts, file access, etc. The AI ​​analysis model automatically extracts behavioral features from the traffic data, such as packet size, transmission frequency, protocol type, etc. Similarly, behavioral features from the log data are also extracted, including the number of failed logins, abnormal file access, etc. The situation prediction model predicts that the network situation is medium risk, indicating that there is a potential threat. The system automatically increases the network monitoring frequency and scope to obtain more detailed data, including traffic data, log data, and vulnerability data. Based on the medium risk situation, the system performs a risk assessment on the monitored behavioral features. Determine the target feature predicted as a medium risk situation, such as an abnormally high traffic flow at a remote branch. The system obtains the change trend of the target feature within a preset time. The analysis shows that the change trend of the target feature is greater than the preset trend change threshold, indicating that the feature meets the warning condition. Based on the warning conditions, the system executes the warning strategy, including sending warning notifications to the security management team. The security management team immediately initiates the emergency response process, isolates the affected network segment, and investigates the abnormal behavior. The security management team verifies the warning strategy to confirm the accuracy of the prediction results and the necessity of the warning strategy. The verification results support the prediction of the medium-risk situation, and the warning strategy can continue to be executed. The system continuously monitors the changing trends of the target characteristics to ensure the effectiveness of the warning strategy. Based on the monitoring results, the security management team adjusts the monitoring strategy to adapt to the changes in the network situation.

[0048] In one embodiment, after the step of obtaining the change trend of the target feature within a preset time and determining whether the change trend of the target feature within the preset time is greater than a preset trend change threshold, the method includes:

[0049] When the change trend of the target feature within the preset time is not greater than the preset trend change threshold, the medium risk situation is changed to a low risk situation;

[0050] Based on the network monitoring frequency and scope of low-risk situations, traffic data, log data and vulnerability data are obtained, and a network security situation report is generated according to the preset time period and sent to the management end.

[0051] As mentioned above, if the change trend of the target feature within the preset time is not greater than the preset trend change threshold, the medium risk situation is changed to a low risk situation. This dynamic adjustment helps to more accurately reflect the changes in the network situation, reduce unnecessary resource consumption, and maintain continuous attention to network security. In a low-risk situation, traffic data, log data, and vulnerability data are obtained according to the current network monitoring frequency and scope. In a low-risk situation, reduce the consumption of monitoring resources, optimize resource allocation, and maintain continuous attention to network security. Generate a network security situation report according to a preset time period, such as daily, weekly, etc. Regularly generating reports helps management to continuously track the network security situation, discover potential risks in a timely manner, and take corresponding preventive measures. Send the generated network security situation report to the receiving end specified by the management. Provide network security information to management in a timely manner so that they can understand the latest status of network security and make corresponding decisions.

[0052] In one embodiment, the method of generating network security situation feedback based on the predicted result further includes:

[0053] When the predicted result is a high-risk situation, the network detection frequency and scope are increased based on the high-risk situation to obtain traffic data, log data and vulnerability data;

[0054] Based on the high-risk situation, conduct risk assessment on the monitored behavioral characteristics and determine the target characteristics predicted as high-risk situations;

[0055] The attack vector of the target feature is identified, and the attack vector of the target feature is intercepted.

[0056] As mentioned above, when the prediction result is a high-risk situation, the traffic data, log data, and vulnerability data are obtained by increasing the frequency and scope of network detection. Increasing the monitoring intensity helps to more comprehensively understand the network behavior under the high-risk situation, timely discover potential threats, and take corresponding preventive measures. According to the high-risk situation, the monitored behavioral characteristics are risk assessed to determine the target characteristics predicted as high-risk situations. Risk assessment helps to determine which behavioral characteristics may constitute a high-risk situation, so as to take more targeted preventive measures. Identify the attack vectors that may be exploited by the target characteristics, that is, the way the attacker may use the target characteristics to attack. The identification of attack vectors helps to understand the attacker's intentions and attack methods, so as to formulate defense strategies more effectively. Take measures to prevent attackers from using target characteristics to attack, such as updating firewall rules, deploying intrusion prevention systems, etc. The interception of attack vectors can prevent successful attacks, protect the security of networks and data, and reduce security risks.

[0057] In one embodiment, after the steps of identifying the attack vector of the target feature and intercepting the attack vector of the target feature, the method includes:

[0058] Re-evaluate the network situation of the behavior characteristics based on the interception results of the attack vector of the target characteristics;

[0059] If the result of the re-evaluation is that the network situation of the behavioral characteristics is a high-risk situation, it is determined that the target characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions;

[0060] If the result of the re-evaluation is that the network situation of the behavioral characteristics is a medium-risk situation or a low-risk situation, traffic data, log data, and vulnerability data are obtained based on the network monitoring frequency and scope of the medium-risk situation or the low-risk situation.

[0061] As described above, after taking measures to intercept the attack vector of the target feature, the network situation of the behavioral feature is re-evaluated to confirm whether the high-risk situation has been alleviated. This re-evaluation helps to ensure the accuracy and real-time nature of the network situation and adjust security policies and resource allocation in a timely manner. If the result of the re-evaluation shows that the network situation of the behavioral feature is still a high-risk situation, the target feature is judged to meet the warning conditions, and the warning strategy is executed based on the warning conditions. This operation ensures that even after taking interception measures, if the network situation is still in a high-risk state, the security team can respond in time and take further defensive measures. If the result of the re-evaluation shows that the network situation of the behavioral feature is a medium-risk situation or a low-risk situation, the network monitoring frequency and scope based on the medium-risk situation or the low-risk situation are used to obtain traffic data, log data, and vulnerability data. This operation ensures that resources are optimally allocated after the network situation is alleviated, while maintaining continuous attention to network security to prevent the recurrence of potential threats.

[0062] In one embodiment, the execution of the early warning strategy includes:

[0063] Send an alert message to the management terminal; or,

[0064] Triggering alerts for intrusion detection and intrusion prevention; or,

[0065] Isolate the network segment or source data of the source data.

[0066] As mentioned above, send alert information to the security management team or relevant personnel via email, SMS, instant messaging or other communication channels. This method can quickly notify relevant personnel so that they can respond and take action in a timely manner. Activate the alert function of the intrusion detection system (IDS) and intrusion prevention system (IPS) to automatically detect and respond to potential threats. This automatic response mechanism can increase the speed of response and reduce the time for human intervention, thereby blocking potential threats faster. Isolate suspicious network traffic or data sources to prevent the spread of threats or further attacks. Isolation measures can immediately reduce the scope of the threat and buy more time for investigation and response.

[0067] The AI-based network security situation analysis and prediction method of the present application obtains network source data in real time and uses AI analysis models to quickly analyze data. It can detect potential threats in time, shorten response time, and improve the real-time nature of threat detection. Build a situation prediction model to predict the network situation in the future. Early warning of potential threats provides the security team with enough time to prepare and respond. Dynamically adjust monitoring strategies and early warning strategies according to changes in network situation. Flexible response to changes in network environment to improve the adaptability and continuity of security protection. Comprehensively analyze the behavioral characteristics of network source data and conduct risk assessment. Fully understand the network situation, accurately identify potential threats, and improve the accuracy and efficiency of threat detection. Based on the prediction results, execute early warning strategies, including sending alarm information, starting intrusion detection and defense alarms, isolating network segments or source data, etc. Effectively respond to potential threats, reduce security risks, and improve the effectiveness of network security protection. Through verification steps and subsequent monitoring and adjustment, continuously improve prediction models and monitoring strategies. Continuously improve the ability and level of security protection to ensure continuous optimization of network security. Reduce dependence on rule sets and manual analysis to improve resource utilization efficiency. Reduce the cost of security protection and improve the sustainability of security protection.

[0068] Reference Figure 3 In an embodiment of the present application, a network security situation analysis and prediction system based on AI is also provided, including:

[0069] Acquisition module 1, used to acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data and vulnerability data;

[0070] Construction module 2 is used to construct an AI analysis model, input the behavior characteristics into the AI ​​analysis model, analyze the risk factor of the behavior characteristics through the AI ​​analysis model, and analyze the results of the data analysis;

[0071] A judgment module 3 is used to judge that the behavior characteristics meet the warning conditions when the result of the analysis is that the risk factor is greater than the preset safety threshold, and execute the warning strategy based on the warning conditions;

[0072] Determination module 4, for determining the monitoring time according to the risk factor when the result of the analysis is that the risk factor is less than a preset safety threshold;

[0073] Input module 5, used to build a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, which include low-risk situation, medium-risk situation and high-risk situation;

[0074] The generation module 6 is used to generate network security situation feedback based on the prediction results.

[0075] As described above, it can be understood that the various components of the AI-based network security situation analysis and prediction system proposed in this application can realize the functions of any one of the AI-based network security situation analysis and prediction methods described above, and the specific structure will not be repeated.

[0076] Reference Figure 4 In an embodiment of the present application, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as monitoring data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network security situation analysis and prediction method based on AI is implemented.

[0077] The processor executes the AI-based network security situation analysis and prediction method, including: acquiring network source data in real time, analyzing the behavior characteristics of the network source data, including traffic data, log data and vulnerability data; constructing an AI analysis model, inputting the behavior characteristics into the AI ​​analysis model, analyzing the risk coefficient of the behavior characteristics through the AI ​​analysis model, and analyzing the results of the data analysis; when the result of the analysis is that the risk coefficient is greater than the preset safety threshold, it is judged that the behavior characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions; when the result of the analysis is that the risk coefficient is less than the preset safety threshold, the monitoring time is determined according to the risk coefficient; constructing a situation prediction model, inputting the behavior characteristics with a risk coefficient less than the preset safety threshold and the monitoring time into the situation prediction model, predicting the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and outputting the predicted results, the predicted results include low-risk situation, medium-risk situation and high-risk situation; based on the predicted results, generating network security situation feedback.

[0078] The above-mentioned AI-based network security situation analysis and prediction method obtains network source data in real time and uses AI analysis models to quickly analyze data. It can detect potential threats in time, shorten response time, and improve the real-time nature of threat detection. Build a situation prediction model to predict the network situation in the future. Early warning of potential threats provides the security team with enough time to prepare and respond. Dynamically adjust monitoring strategies and early warning strategies according to changes in network situation. Flexibly respond to changes in network environment and improve the adaptability and continuity of security protection. Comprehensively analyze the behavioral characteristics of network source data and conduct risk assessment. Fully understand the network situation, accurately identify potential threats, and improve the accuracy and efficiency of threat detection. Based on the prediction results, execute early warning strategies, including sending alarm information, starting intrusion detection and defense alarms, isolating network segments or source data, etc. Effectively respond to potential threats, reduce security risks, and improve the effectiveness of network security protection. Through verification steps and subsequent monitoring and adjustment, continuously improve prediction models and monitoring strategies. Continuously improve the ability and level of security protection to ensure continuous optimization of network security. Reduce dependence on rule sets and manual analysis to improve resource utilization efficiency. Reduce the cost of security protection and improve the sustainability of security protection.

[0079] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, an AI-based network security situation analysis and prediction method is implemented, comprising the steps of: acquiring network source data in real time, analyzing the behavior characteristics of the network source data, including traffic data, log data, and vulnerability data; constructing an AI analysis model, inputting the behavior characteristics into the AI ​​analysis model, analyzing the risk coefficient of the behavior characteristics through the AI ​​analysis model, and analyzing the results of the data analysis; when the result of the analysis is that the risk coefficient is greater than a preset safety threshold, it is determined that the behavior characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions; when the result of the analysis is that the risk coefficient is less than the preset safety threshold, the monitoring time is determined according to the risk coefficient; constructing a situation prediction model, inputting the behavior characteristics with a risk coefficient less than the preset safety threshold and the monitoring time into the situation prediction model, predicting the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and outputting the predicted results, wherein the predicted results include low-risk situation, medium-risk situation, and high-risk situation; based on the predicted results, generating network security situation feedback.

[0080] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0081] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, device, article or method including the element.

[0082] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A network security situation analysis and prediction method based on AI, characterized in that: The method comprises: Acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data, and vulnerability data; Constructing an AI analysis model, inputting the behavior characteristics into the AI ​​analysis model, analyzing the risk factor of the behavior characteristics through the AI ​​analysis model, and analyzing the results of the data analysis; When the result of the analysis is that the risk factor is greater than the preset safety threshold, it is judged that the behavior characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions; When the result of the analysis is that the risk factor is less than a preset safety threshold, determining the monitoring time according to the risk factor; Construct a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, which include low-risk situation, medium-risk situation and high-risk situation; Generate network security situation feedback based on the prediction results.

2. The AI-based network security situation analysis and prediction method according to claim 1 is characterized in that: The method of generating network security situation feedback based on the predicted result includes: When the predicted result is a low risk situation, traffic data, log data, and vulnerability data are obtained according to the current network monitoring frequency and scope; Generate a network security situation report based on the preset time period and send it to the management end.

3. The AI-based network security situation analysis and prediction method according to claim 2 is characterized in that: The method further comprises generating network security situation feedback based on the predicted result: When the predicted result is a medium risk situation, increasing the network monitoring frequency and scope based on the medium risk situation to obtain traffic data, log data, and vulnerability data; Based on the medium-risk situation, conduct a risk assessment on the monitored behavioral characteristics and determine the target characteristics predicted to be medium-risk situations; Obtaining a change trend of the target feature within a preset time, and determining whether the change trend of the target feature within the preset time is greater than a preset trend change threshold; When the change trend of the target feature within the preset time is greater than the preset trend change threshold, it is judged that the target feature meets the warning condition, and the warning strategy is executed based on the warning condition and sent to the management end.

4. The AI-based network security situation analysis and prediction method according to claim 3 is characterized in that: After the step of obtaining the change trend of the target feature within a preset time and determining whether the change trend of the target feature within the preset time is greater than a preset trend change threshold, the method includes: When the change trend of the target feature within the preset time is not greater than the preset trend change threshold, the medium risk situation is changed to a low risk situation; Based on the network monitoring frequency and scope of low-risk situations, traffic data, log data and vulnerability data are obtained, and a network security situation report is generated according to the preset time period and sent to the management end.

5. The AI-based network security situation analysis and prediction method according to claim 2 is characterized in that: The method further comprises generating network security situation feedback based on the predicted result: When the predicted result is a high-risk situation, the network detection frequency and scope are increased based on the high-risk situation to obtain traffic data, log data and vulnerability data; Based on the high-risk situation, conduct risk assessment on the monitored behavioral characteristics and determine the target characteristics predicted as high-risk situations; The attack vector of the target feature is identified, and the attack vector of the target feature is intercepted.

6. The AI-based network security situation analysis and prediction method according to claim 5 is characterized in that: After the steps of identifying the attack vector of the target feature and intercepting the attack vector of the target feature, the method includes: Re-evaluate the network situation of the behavior characteristics based on the interception results of the attack vector of the target characteristics; If the result of the re-evaluation is that the network situation of the behavioral characteristics is a high-risk situation, it is determined that the target characteristics meet the warning conditions, and the warning strategy is executed based on the warning conditions; If the result of the re-evaluation is that the network situation of the behavioral characteristics is a medium-risk situation or a low-risk situation, traffic data, log data, and vulnerability data are obtained based on the network monitoring frequency and scope of the medium-risk situation or the low-risk situation.

7. The AI-based network security situation analysis and prediction method according to claim 1 is characterized in that: The execution early warning strategy includes: Send an alert message to the management terminal; or, Triggering alerts for intrusion detection and intrusion prevention; or, Isolate the network segment or source data of the source data.

8. A network security situation analysis and prediction system based on AI, characterized in that: include: An acquisition module is used to acquire network source data in real time and analyze the behavior characteristics of the network source data, including flow data, log data and vulnerability data; A construction module is used to construct an AI analysis model, input the behavior characteristics into the AI ​​analysis model, analyze the risk factor of the behavior characteristics through the AI ​​analysis model, and calculate the results of the data analysis; A judgment module, for judging that the behavior characteristics meet the warning conditions when the result of the analysis is that the risk factor is greater than a preset safety threshold, and executing the warning strategy based on the warning conditions; A determination module, for determining a monitoring time period according to the risk factor when the result of the analysis is that the risk factor is less than a preset safety threshold; An input module is used to construct a situation prediction model, input the behavior characteristics with a risk factor less than a preset safety threshold and the monitoring time into the situation prediction model, predict the network situation of the behavior characteristics within the time range of the monitoring time through the situation prediction model, and output the predicted results, which include low-risk situation, medium-risk situation and high-risk situation; The generation module is used to generate network security situation feedback based on the prediction results.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images