Artificial intelligence assisted 5G network security evaluation method and device

Abstract

The invention discloses an artificial intelligence assisted 5G network security evaluation method and device, and the method comprises the steps: obtaining the historical network data of a to-be-detected network in a historical time period, determining the target network data of the to-be-detected network according to the historical network data, and determining the abnormal detection data of the to-be-detected network based on the target network data; acquiring real-time network data of a network to be tested; generating target operation parameters of the network to be detected according to the real-time network data and the anomaly detection data; and based on the target operation parameters and the intelligent analysis model, performing analysis operation on the target operation parameters to obtain security analysis parameters of the to-be-tested network, and according to all the security analysis parameters, generating a network security evaluation result of the to-be-tested network. It can be seen that the 5G network security evaluation method and device can be combined with an artificial intelligence method to conduct intelligent security evaluation on the 5G network, the accuracy and reliability of the obtained security evaluation result of the 5G network can be improved, and the intelligence and efficiency of the obtained security evaluation result of the 5G network can be improved.

Description

Technical Field

[0001] The present invention relates to the field of network security assessment technology, and in particular to an artificial intelligence-assisted 5G network security assessment method and device. Background Art

[0002] With the continuous development of science and technology, network and information technology have also developed rapidly. Network informatization has penetrated into all walks of life, and people's daily lives are inseparable from network information.

[0003] With the advent of the era of network security, people have put forward more requirements for the security of network information, and network security assessment has come into being. Network security assessment is an important part of the network security work system, and can be used to evaluate network security attributes and indicators of network security. However, most of the existing network security assessment methods only collect part of the network data and analyze the data, and perform data communication or data interception based on the data analysis results. This method not only has the problem of incomplete network security assessment, resulting in errors in the network security assessment results, but also has the problem of low efficiency of network security assessment. It can be seen that it is particularly important to provide a new network security assessment method to improve the intelligence and efficiency of network security assessment and improve the accuracy and reliability of network security assessment. Summary of the invention

[0004] The present invention provides an artificial intelligence-assisted 5G network security assessment method and device, which can combine artificial intelligence methods to perform intelligent security assessment on 5G networks, which is beneficial to improving the accuracy and reliability of security assessment results of 5G networks, as well as improving the intelligence and efficiency of security assessment results of 5G networks.

[0005] In order to solve the above technical problems, the first aspect of the present invention discloses an artificial intelligence-assisted 5G network security assessment method, the method comprising:

[0006] Acquire historical network data of the network under test within a preset historical time period, and determine target network data corresponding to the network under test according to the historical network data, wherein the target network data includes network operation data corresponding to the network under test and network response data corresponding to the network under test;

[0007] Based on the target network data, determining abnormal detection data of the network to be tested;

[0008] Acquire real-time network data of the network to be tested;

[0009] Generating target operating parameters of the network to be tested according to the real-time network data and the abnormality detection data;

[0010] Based on the target operating parameters and the predetermined intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested, wherein the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested;

[0011] A network security evaluation result of the network to be tested is generated based on all the security analysis parameters.

[0012] As an optional embodiment, in the first aspect of the present invention, the method further comprises:

[0013] Determine security risk information corresponding to the network to be tested according to the network security assessment result, wherein the security risk information includes one or more of security vulnerability information, security threat information, protection vulnerability information, and network attack information corresponding to the network to be tested;

[0014] Based on the security risk information and a predetermined risk assessment model, an intelligent assessment operation is performed on the security risk information to obtain a risk assessment result, wherein the risk assessment result includes a risk event corresponding to the network to be tested and an impact parameter of each risk event on the network to be tested, and the impact parameter includes one or more of a benefit impact parameter, a business impact parameter, and a security impact parameter of the risk event on the network to be tested;

[0015] Determine the risk impact degree corresponding to each risk event according to the impact parameter of each risk event on the network to be tested, and perform a sorting operation on all risk events based on the risk impact degrees corresponding to all risk events to obtain a risk event sequence;

[0016] Based on the risk event sequence, determine the events to be processed from all the risk events, obtain event information of each of the events to be processed, and generate event processing parameters corresponding to each of the events to be processed based on the event information of each of the events to be processed;

[0017] Based on the event processing parameters corresponding to all the events to be processed, security optimization parameters corresponding to the network to be tested are generated.

[0018] As an optional implementation manner, in the first aspect of the present invention, generating a network security evaluation result of the network to be tested according to all the security analysis parameters includes:

[0019] Determine network anomaly parameters of the network to be tested according to all the security analysis parameters, wherein the network anomaly parameters include one or more of malicious traffic parameters, malicious behavior parameters, and security threat parameters of the network to be tested;

[0020] Based on the network anomaly parameters, a network risk parameter of the network to be tested is generated, and a network security anomaly coefficient corresponding to the network risk parameter is determined in combination with a predetermined risk mining model;

[0021] Determine the abnormal processing parameters of the network to be tested according to the target operating parameters and the network security abnormality coefficient, and generate the corresponding security processing degree of the network to be tested based on the network security abnormality coefficient and the abnormal processing parameters; wherein the security processing degree includes the security degree corresponding to the processing operation performed by the network to be tested on the network abnormality parameters;

[0022] Based on the security processing degree, a network security evaluation result of the network to be tested is generated.

[0023] As an optional implementation manner, in the first aspect of the present invention, after generating the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, the method further includes:

[0024] Generate an optimization simulation result according to the security optimization parameter and the real-time network data in combination with a predetermined intelligent simulation model, wherein the optimization simulation result includes a simulation result after simulating the network to be tested to perform an optimization operation matching the security optimization parameter;

[0025] According to the optimization simulation result, determine the simulation processing safety parameter corresponding to the optimization simulation result, and judge whether the simulation processing safety parameter meets the preset safety processing condition;

[0026] When it is determined that the simulation processing safety parameter does not meet the preset safety processing condition, based on the real-time network data and the optimization simulation result, the simulation optimization data of the network to be tested is generated, and based on the simulation optimization data, at least one update processing parameter matching the simulation optimization data is determined in a predetermined update processing parameter library;

[0027] Based on all the update processing parameters, a target update parameter is generated, and an update operation is performed on the security optimization parameter based on the target update parameter to update the security optimization parameter.

[0028] As an optional implementation manner, in the first aspect of the present invention, before generating the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, the method further includes:

[0029] Predicting predicted attack information of the network to be tested based on the security risk information and the real-time network data, wherein the predicted attack information includes one or more of a predicted attack path, a predicted attack location, a predicted attack method, a predicted attack time, and a predicted attack event corresponding to the network to be tested;

[0030] Extracting target prediction information from the predicted attack information, and determining prediction processing parameters matching the target prediction information based on the target prediction information;

[0031] Based on the prediction processing parameters and the target prediction information, generate a prediction defense result corresponding to the target prediction information, and determine whether the prediction defense result meets a preset security defense condition;

[0032] When it is determined that the predicted defense result meets the preset security defense condition, generating attack defense parameters of the network to be tested based on all the predicted processing parameters;

[0033] The step of generating security optimization parameters corresponding to the network to be tested based on event processing parameters corresponding to all the events to be processed includes:

[0034] Based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters, security optimization parameters corresponding to the network to be tested are generated.

[0035] As an optional implementation manner, in the first aspect of the present invention, performing an analysis operation on the target operating parameter based on the target operating parameter and a predetermined intelligent analysis model to obtain the security analysis parameter of the network to be tested includes:

[0036] Performing a data preprocessing operation on the target operating parameter to obtain a target processing parameter, wherein the data preprocessing operation includes one or more of a data cleaning operation and a data format standardization operation;

[0037] Performing a feature extraction operation on the target processing parameter to obtain a target feature parameter corresponding to the target processing parameter, and inputting the target feature parameter into a predetermined intelligent analysis model to perform an analysis operation on the target feature parameter through the predetermined intelligent analysis model to obtain a data analysis result;

[0038] Based on the data analysis result, determine the security assessment parameters of the network to be tested, wherein the security assessment parameters include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters;

[0039] According to the security assessment parameters, security analysis parameters of the network to be tested are generated.

[0040] As an optional implementation manner, in the first aspect of the present invention, the generating of the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters includes:

[0041] Extracting a first processing parameter from among the event processing parameters corresponding to all the events to be processed, and determining a first processing result corresponding to each of the first processing parameters, and extracting a second processing parameter from among the attack defense parameters, and determining a second processing result corresponding to each of the second processing parameters;

[0042] Determine a processing association relationship between all the first processing results and all the second processing results, and based on the processing association relationship, determine whether there are overlapping processing results between all the first processing results and all the second processing results;

[0043] When it is determined that the overlapping processing results exist, determining a first overlapping processing parameter and a second overlapping processing parameter corresponding to each of the overlapping processing results, and performing a parameter merging operation on each of the first overlapping processing parameter and the second overlapping processing parameter to obtain a target merging parameter;

[0044] Based on the target merging parameters, a parameter updating operation is performed on the number of event processing parameters corresponding to all the events to be processed and the attack defense parameters to obtain target updated processing parameters, and security optimization parameters corresponding to the network to be tested are generated according to the target updated processing parameters.

[0045] A second aspect of the present invention discloses an artificial intelligence-assisted 5G network security assessment device, the device comprising:

[0046] An acquisition module is used to acquire historical network data of the network to be tested within a preset historical time period;

[0047] A determination module, configured to determine target network data corresponding to the network to be tested according to the historical network data, wherein the target network data includes network operation data corresponding to the network to be tested and network response data corresponding to the network to be tested;

[0048] The determination module is further used to determine the abnormality detection data of the network to be tested based on the target network data;

[0049] The acquisition module is further used to acquire real-time network data of the network to be tested;

[0050] A generating module, used for generating target operating parameters of the network to be tested according to the real-time network data and the abnormality detection data;

[0051] An analysis module, configured to perform an analysis operation on the target operation parameters based on the target operation parameters and a predetermined intelligent analysis model to obtain security analysis parameters of the network to be tested, wherein the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested;

[0052] The generating module is further used to generate a network security evaluation result of the network to be tested according to all the security analysis parameters.

[0053] As an optional implementation, in the second aspect of the present invention, the determination module is further used to determine the security risk information corresponding to the network to be tested according to the network security evaluation result, wherein the security risk information includes one or more of the security vulnerability information, security threat information, protection vulnerability information, and network attack information corresponding to the network to be tested;

[0054] The device also includes:

[0055] An evaluation module, configured to perform an intelligent evaluation operation on the security risk information based on the security risk information and a predetermined risk evaluation model to obtain a risk evaluation result, wherein the risk evaluation result includes a risk event corresponding to the network to be tested and an impact parameter of each risk event on the network to be tested, wherein the impact parameter includes one or more of a benefit impact parameter, a business impact parameter, and a security impact parameter of the risk event on the network to be tested;

[0056] The determination module is further configured to determine the risk impact degree corresponding to each risk event according to the impact parameter of each risk event on the network to be tested;

[0057] A sorting module, used to perform a sorting operation on all the risk events based on the risk impact levels corresponding to all the risk events to obtain a risk event sequence;

[0058] The determination module is further used to determine the events to be processed from all the risk events based on the risk event sequence;

[0059] The acquisition module is further used to acquire event information of each event to be processed;

[0060] The generating module is further used to generate event processing parameters corresponding to each of the events to be processed based on the event information of each of the events to be processed; and to generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all of the events to be processed.

[0061] As an optional implementation, in the second aspect of the present invention, the specific manner in which the generation module generates the network security evaluation result of the network to be tested according to all the security analysis parameters includes:

[0062] Determine network anomaly parameters of the network to be tested according to all the security analysis parameters, wherein the network anomaly parameters include one or more of malicious traffic parameters, malicious behavior parameters, and security threat parameters of the network to be tested;

[0063] Based on the network anomaly parameters, a network risk parameter of the network to be tested is generated, and a network security anomaly coefficient corresponding to the network risk parameter is determined in combination with a predetermined risk mining model;

[0064] Determine the abnormal processing parameters of the network to be tested according to the target operating parameters and the network security abnormality coefficient, and generate the corresponding security processing degree of the network to be tested based on the network security abnormality coefficient and the abnormal processing parameters; wherein the security processing degree includes the security degree corresponding to the processing operation performed by the network to be tested on the network abnormality parameters;

[0065] Based on the security processing degree, a network security evaluation result of the network to be tested is generated.

[0066] As an optional implementation, in the second aspect of the present invention, the generation module is further used to generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, and then generate optimization simulation results according to the security optimization parameters and the real-time network data in combination with a predetermined intelligent simulation model, wherein the optimization simulation results include simulation results after simulating the network to be tested to perform an optimization operation matching the security optimization parameters;

[0067] The determination module is further used to determine the simulation processing safety parameter corresponding to the optimization simulation result according to the optimization simulation result;

[0068] The device also includes:

[0069] A judgment module, used to judge whether the simulation processing safety parameters meet the preset safety processing conditions;

[0070] The generating module is further configured to generate the simulation optimization data of the network to be tested based on the real-time network data and the optimization simulation result when the judging module judges that the simulation processing safety parameter does not meet the preset safety processing condition;

[0071] The determination module is further configured to determine, based on the simulation optimization data, at least one update processing parameter that matches the simulation optimization data in a predetermined update processing parameter library;

[0072] The generating module is further used to generate a target updating parameter based on all the updating processing parameters;

[0073] An updating module is used to perform an updating operation on the security optimization parameter based on the target update parameter to update the security optimization parameter.

[0074] As an optional implementation, in the second aspect of the present invention, the device further includes:

[0075] A prediction module, used for predicting the predicted attack information of the network to be tested according to the security risk information and the real-time network data before the generation module generates the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, wherein the predicted attack information includes one or more of the predicted attack path, predicted attack location, predicted attack mode, predicted attack time, and predicted attack event corresponding to the network to be tested;

[0076] The determination module is further used to extract target prediction information from the predicted attack information, and determine prediction processing parameters matching the target prediction information based on the target prediction information;

[0077] The generating module is further configured to generate a predicted defense result corresponding to the target prediction information based on the prediction processing parameter and the target prediction information;

[0078] The judgment module is further used to judge whether the predicted defense result meets the preset security defense condition;

[0079] The generating module is further configured to generate attack defense parameters of the network to be tested based on all the predicted processing parameters when the judging module judges that the predicted defense result meets the preset security defense condition;

[0080] The specific manner in which the generating module generates the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed includes:

[0081] Based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters, security optimization parameters corresponding to the network to be tested are generated.

[0082] As an optional implementation, in the second aspect of the present invention, the analysis module performs an analysis operation on the target operation parameter based on the target operation parameter and a predetermined intelligent analysis model, and a specific manner of obtaining the security analysis parameter of the network to be tested includes:

[0083] Performing a data preprocessing operation on the target operating parameter to obtain a target processing parameter, wherein the data preprocessing operation includes one or more of a data cleaning operation and a data format standardization operation;

[0084] Performing a feature extraction operation on the target processing parameter to obtain a target feature parameter corresponding to the target processing parameter, and inputting the target feature parameter into a predetermined intelligent analysis model to perform an analysis operation on the target feature parameter through the predetermined intelligent analysis model to obtain a data analysis result;

[0085] Based on the data analysis result, determine the security assessment parameters of the network to be tested, wherein the security assessment parameters include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters;

[0086] According to the security assessment parameters, security analysis parameters of the network to be tested are generated.

[0087] As an optional implementation, in the second aspect of the present invention, the specific manner in which the generation module generates the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters includes:

[0088] Extracting a first processing parameter from among the event processing parameters corresponding to all the events to be processed, and determining a first processing result corresponding to each of the first processing parameters, and extracting a second processing parameter from among the attack defense parameters, and determining a second processing result corresponding to each of the second processing parameters;

[0089] Determine a processing association relationship between all the first processing results and all the second processing results, and based on the processing association relationship, determine whether there are overlapping processing results between all the first processing results and all the second processing results;

[0090] When it is determined that the overlapping processing results exist, determining a first overlapping processing parameter and a second overlapping processing parameter corresponding to each of the overlapping processing results, and performing a parameter merging operation on each of the first overlapping processing parameter and the second overlapping processing parameter to obtain a target merging parameter;

[0091] Based on the target merging parameters, a parameter updating operation is performed on the number of event processing parameters corresponding to all the events to be processed and the attack defense parameters to obtain target updated processing parameters, and security optimization parameters corresponding to the network to be tested are generated according to the target updated processing parameters.

[0092] The third aspect of the present invention discloses another artificial intelligence-assisted 5G network security assessment device, the device comprising:

[0093] A memory storing executable program code;

[0094] a processor coupled to the memory;

[0095] The processor calls the executable program code stored in the memory to execute the artificial intelligence-assisted 5G network security assessment method disclosed in the first aspect of the present invention.

[0096] The fourth aspect of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the artificial intelligence-assisted 5G network security assessment method disclosed in the first aspect of the present invention.

[0097] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0098] In an embodiment of the present invention, historical network data of the network to be tested within a historical time period is obtained, target network data of the network to be tested is determined based on the historical network data, and abnormal detection data of the network to be tested is determined based on the target network data; real-time network data of the network to be tested is obtained; target operating parameters of the network to be tested are generated based on the real-time network data and the abnormal detection data; based on the target operating parameters and the intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested, and based on all security analysis parameters, a network security evaluation result of the network to be tested is generated. It can be seen that the implementation of the present invention can combine artificial intelligence methods to perform intelligent security evaluation of 5G networks, which is conducive to improving the accuracy and reliability of the security evaluation results of 5G networks, as well as improving the intelligence and efficiency of the security evaluation results of 5G networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0100] Figure 1 It is a flowchart of an artificial intelligence-assisted 5G network security assessment method disclosed in an embodiment of the present invention;

[0101] Figure 2 It is a flowchart of another artificial intelligence-assisted 5G network security assessment method disclosed in an embodiment of the present invention;

[0102] Figure 3 It is a structural schematic diagram of an artificial intelligence-assisted 5G network security assessment device disclosed in an embodiment of the present invention;

[0103] Figure 4 It is a structural schematic diagram of another artificial intelligence-assisted 5G network security assessment device disclosed in an embodiment of the present invention;

[0104] Figure 5 It is a structural diagram of another artificial intelligence-assisted 5G network security assessment device disclosed in an embodiment of the present invention. DETAILED DESCRIPTION

[0105] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0106] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or end including a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units inherent to these processes, methods, products or ends.

[0107] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0108] The present invention discloses an artificial intelligence-assisted 5G network security assessment method and device, which can combine artificial intelligence methods to perform intelligent security assessment on 5G networks, which is conducive to improving the accuracy and reliability of the security assessment results of 5G networks, and is conducive to improving the intelligence and efficiency of the security assessment results of 5G networks. The following are detailed descriptions.

[0109] Embodiment 1

[0110] See also Figure 1 , Figure 1 It is a flowchart of an artificial intelligence-assisted 5G network security assessment method disclosed in an embodiment of the present invention. Figure 1 The described artificial intelligence-assisted 5G network security assessment method can be applied to an artificial intelligence-assisted 5G network security assessment device, wherein the artificial intelligence-assisted 5G network security assessment device can be integrated in a local server or a cloud server, and the embodiments of the present invention are not limited thereto. Figure 1 As shown, the artificial intelligence-assisted 5G network security assessment method may include the following operations:

[0111] 101. Obtain historical network data of the network to be tested within a preset historical time period, and determine target network data corresponding to the network to be tested based on the historical network data.

[0112] In the embodiment of the present invention, the target network data includes network operation data corresponding to the network to be tested and network response data corresponding to the network to be tested.

[0113] In the embodiment of the present invention, optionally, the network to be tested may be a 5G network.

[0114] In an embodiment of the present invention, optionally, the historical network data of the network to be tested obtained within a preset historical time period may be one or more of the historical traffic data, historical configuration data, historical log information, historical performance information, historical event information, historical service status information, historical hardware information, historical patch information, and historical authentication information of the network to be tested; wherein the historical traffic data includes inbound traffic information and outbound traffic information of the network to be tested; the historical configuration information includes network device configuration information, server configuration information, security policy configuration information, and access control list configuration information of the network to be tested; the historical log information includes server log information and network device log information of the network to be tested; the historical performance information includes network delay information, network loss information, and other network information of the network to be tested; Packet rate information, network throughput information, network interface utilization information, network interface error rate information; historical event information includes alarm information of intrusion detection system (IDS) and intrusion prevention system (IPS), and access control decision record information of firewall; historical service status information includes operation status information of network services (such as DNS, DHCP, Web server, etc.), service response event information, and service availability information; historical hardware information includes hardware status information of network equipment under test, hardware failure information, and hardware maintenance information; historical patch information includes software version information installed on network equipment and servers, applied patches, and update history information; historical authentication information includes user authentication information and device authentication information of the network under test.

[0115] In an embodiment of the present invention, optionally, the network operation data includes one or more of the flow data, connection status data, device status data, configuration data, system log data, and performance indicator data of the network to be tested; wherein the flow data includes the total flow, inbound and outbound flow, data transmission rate, etc. in the network; the connection status data includes the device connection status in the network, including active connection, disconnection, connection attempt, etc.; the device status data includes the operation status and performance indicators of each device in the network (such as routers, switches, servers); the configuration data includes the configuration parameters of the network device, such as IP address, subnet mask, routing protocol configuration, etc.; the system log data includes the operation logs of the network device and the system, including error logs, warning information, system updates, etc.; the performance indicator data includes bandwidth utilization, packet loss rate, delay, jitter, etc. Network response data includes one or more of security event log data, attack response data, fault response data, performance response data, and configuration change data. Among them, security event log data includes alarms of intrusion detection system (IDS) and intrusion prevention system (IPS), response records of security incidents, etc. Attack response data includes records of network responses to security threats, such as mitigation measures for DDoS attacks, detection and removal of malware, etc. Fault response data includes records of response time, fault handling process, recovery time, etc. of network faults. Performance response data includes performance response of the network under high load or attack conditions, such as throughput changes, latency changes, etc. Configuration change data includes records of change history of network configuration, including change time, change content, change operator, etc.

[0116] 102. Determine anomaly detection data of the network to be tested based on the target network data.

[0117] In the embodiment of the present invention, optionally, the above-mentioned determining the abnormal detection data of the network to be tested based on the target network data may include:

[0118] Performing data recognition operations on target network data to obtain data recognition results corresponding to the target network data, and determining whether there are abnormal recognition results among all data recognition results;

[0119] When it is determined that there are abnormal identification results among all the data identification results, the target network data corresponding to the abnormal identification results are determined as abnormal detection data of the network to be tested.

[0120] 103. Obtain real-time network data of the network under test.

[0121] In the embodiment of the present invention, optionally, the real-time network data of the network to be tested may be obtained in real time, or may be obtained periodically according to a preset time period, or may be obtained when the real-time network data of the network to be tested is needed, which is not specifically limited in the embodiment of the present invention.

[0122] In the embodiment of the present invention, optionally, the real-time network data includes one or more of real-time network traffic data, real-time user activity data, and real-time system status data of the network to be tested.

[0123] 104. Generate target operating parameters of the network to be tested based on the real-time network data and the anomaly detection data.

[0124] In the embodiment of the present invention, optionally, the generating of target operating parameters of the network to be tested according to the real-time network data and the anomaly detection data may include:

[0125] Extracting first target data such as real-time network data and extracting second target data from abnormality detection data, and generating key operation data of the network to be tested according to the first target data and the second target data;

[0126] Based on key operating data, target operating parameters of the network under test are generated.

[0127] 105. Based on the target operating parameters and the predetermined intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested.

[0128] In the embodiment of the present invention, the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested.

[0129] In an embodiment of the present invention, optionally, the predetermined intelligent analysis model is a predetermined artificial intelligence model that is trained to convergence and is used to perform intelligent analysis operations on target operating parameters.

[0130] 106. Generate network security evaluation results for the network under test based on all security analysis parameters.

[0131] In the embodiment of the present invention, the network security evaluation result may optionally include one or more of the network security issues, network risk level, and network impact assessment information of the network to be tested. Further, the network security evaluation result may also include one or more of the security risk assessment information, vulnerability analysis parameters, security suggestion information, and improvement measure information of the network to be tested.

[0132] It can be seen that implementation Figure 1The described artificial intelligence-assisted 5G network security evaluation method can obtain historical network data of the network to be tested within a preset historical time period and determine the target network data corresponding to the network to be tested and then determine the anomaly detection data, obtain real-time network data of the network to be tested, generate target operating parameters according to the real-time network data and the anomaly detection data, perform analysis operations on the target operating parameters based on the target operating parameters and the intelligent analysis model to obtain the security analysis parameters of the network to be tested, and generate the network security evaluation results of the network to be tested according to all security analysis parameters. Through continuous monitoring and analysis, it is possible to timely discover and respond to potential security threats and reduce the risk of network attacks. It is also possible to optimize the use of network resources and improve network performance and efficiency by analyzing network operation data, and it is possible to quickly identify abnormal behaviors and attack patterns in the network to be tested, which is conducive to shortening the response time of the network to be tested to abnormal behaviors, so that it can combine artificial intelligence to perform intelligent security evaluation on the 5G network to be tested, which is conducive to improving the accuracy and reliability of the security evaluation results of the 5G network, and is conducive to improving the intelligence and efficiency of the security evaluation results of the 5G network.

[0133] Embodiment 2

[0134] See also Figure 2 , Figure 2 It is a flowchart of an artificial intelligence-assisted 5G network security assessment method disclosed in an embodiment of the present invention. Figure 2 The described artificial intelligence-assisted 5G network security assessment method can be applied to an artificial intelligence-assisted 5G network security assessment device, wherein the artificial intelligence-assisted 5G network security assessment device can be integrated in a local server or a cloud server, and the embodiments of the present invention are not limited thereto. Figure 2 As shown, the artificial intelligence-assisted 5G network security assessment method may include the following operations:

[0135] 201. Obtain historical network data of the network to be tested within a preset historical time period, and determine target network data corresponding to the network to be tested according to the historical network data.

[0136] 202. Determine anomaly detection data of the network to be tested based on the target network data.

[0137] 203. Obtain real-time network data of the network to be tested.

[0138] 204. Generate target operating parameters of the network to be tested based on the real-time network data and the anomaly detection data.

[0139] 205. Based on the target operating parameters and the predetermined intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested.

[0140] 206. Generate network security evaluation results for the network under test based on all security analysis parameters.

[0141] In the embodiment of the present invention, for the detailed description of steps 201 to 206, please refer to the other descriptions of steps 101 to 106 in the first embodiment, and the embodiment of the present invention will not be repeated.

[0142] 207. Based on the network security assessment results, determine the security risk information corresponding to the network to be tested.

[0143] In the embodiment of the present invention, the security risk information includes one or more of security vulnerability information, security threat information, protection vulnerability information, and network attack information corresponding to the network to be tested.

[0144] In the embodiment of the present invention, optionally, determining the security risk information corresponding to the network to be tested according to the network security evaluation result may include:

[0145] According to the network security assessment results, determine the risk keywords in the network security assessment results, and based on the risk keywords, determine the security risk information corresponding to the network to be tested.

[0146] 208. Based on the security risk information and a predetermined risk assessment model, an intelligent assessment operation is performed on the security risk information to obtain a risk assessment result.

[0147] In an embodiment of the present invention, the risk assessment result includes risk events corresponding to the network to be tested and impact parameters of each risk event on the network to be tested, and the impact parameters include one or more of the benefit impact parameters, business impact parameters, and security impact parameters of the risk event on the network to be tested.

[0148] In an embodiment of the present invention, optionally, the predetermined risk assessment model is a predetermined network risk assessment model that is trained to convergence, and the predetermined risk assessment model is an artificial intelligence model that has been trained by artificial intelligence.

[0149] 209. Determine the risk impact degree corresponding to each risk event according to the impact parameter of each risk event on the network to be tested, and perform a sorting operation on all risk events based on the risk impact degrees corresponding to all risk events to obtain a risk event sequence.

[0150] In an embodiment of the present invention, optionally, the risk impact degree corresponding to each risk event may include the impact degree of each risk event on the network to be tested, wherein the impact degree of each risk event on the network to be tested may include one or more of the traffic impact degree, configuration impact degree, performance impact degree, and service impact degree.

[0151] In the embodiment of the present invention, optionally, performing a sorting operation on all risk events based on the risk impact levels corresponding to all risk events to obtain a risk event sequence may include:

[0152] Based on the risk impact levels corresponding to all risk events, all risk events are sorted from high to low according to the risk impact levels to obtain a risk event sequence.

[0153] 210. Based on the risk event sequence, determine the pending events from all risk events, obtain event information of each pending event, and generate event processing parameters corresponding to each pending event based on the event information of each pending event.

[0154] In the embodiment of the present invention, optionally, the above-mentioned determining the events to be processed from all risk events based on the risk event sequence may include:

[0155] Based on the risk event sequence, risk events whose risk impact is greater than or equal to a preset risk threshold are determined as events to be processed.

[0156] In the embodiment of the present invention, optionally, the generating of event processing parameters corresponding to each event to be processed based on the event information of each event to be processed may include:

[0157] Based on the event information of each event to be processed, determining event exception information corresponding to each event to be processed;

[0158] For each event to be processed, based on the event exception information corresponding to the event to be processed, at least one event processing sub-parameter that matches the event exception information corresponding to the event to be processed is determined from a predetermined set of processing parameters, and based on all event processing sub-parameters corresponding to the event to be processed, an event processing parameter corresponding to the event to be processed is generated.

[0159] 211. Based on the event processing parameters corresponding to all the events to be processed, generate security optimization parameters corresponding to the network to be tested.

[0160] In the embodiment of the present invention, optionally, the security optimization parameters corresponding to the network to be tested may include event processing parameters corresponding to all events to be processed.

[0161] It can be seen that implementation Figure 2The described artificial intelligence-assisted 5G network security assessment method can determine the security risk information corresponding to the network to be tested according to the network security assessment results, generate risk assessment results based on the security risk information and the risk assessment model, determine the risk impact degree corresponding to each risk event according to the impact parameters of each risk event on the network to be tested, and then perform a sorting operation on all risk events to obtain a risk event sequence, determine the events to be processed based on the risk event sequence and obtain event information to generate event processing parameters corresponding to each event to be processed, and generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all events to be processed. It can more accurately identify security vulnerabilities, threats, protection deficiencies and attack modes in the network, and through intelligent evaluation and sorting of risk events, it can give priority to the problems that have the greatest impact on the network, effectively allocate security resources, and help improve the risk of the network to be tested. It can improve risk resistance, and can speed up response and reduce potential losses by quickly determining the risk impact and event handling priority. It can also reduce network security risks and enhance the overall security of the network by promptly handling high-risk events. It can also determine the event processing parameters corresponding to each event to be processed according to the event information of each event to be processed, which is conducive to improving the accuracy and reliability of determining the event processing parameters of each event to be processed, and then help improve the accuracy and reliability of generating security optimization parameters corresponding to the network to be tested, and further help improve the security resistance and security optimization capabilities of the network to be tested. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network to be tested, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0162] In an optional embodiment, a network security evaluation result of the network to be tested is generated according to all security analysis parameters, including:

[0163] Determine network anomaly parameters of the network to be tested based on all security analysis parameters, wherein the network anomaly parameters include one or more of malicious traffic parameters, malicious behavior parameters, and security threat parameters of the network to be tested;

[0164] Based on the network anomaly parameters, the network risk parameters of the network to be tested are generated, and the network security anomaly coefficient corresponding to the network risk parameters is determined by combining with the predetermined risk mining model;

[0165] Determine the abnormal processing parameters of the network to be tested according to the target operating parameters and the network security abnormality coefficient, and generate the corresponding security processing degree of the network to be tested based on the network security abnormality coefficient and the abnormal processing parameters; wherein the security processing degree includes the security degree corresponding to the processing operation performed by the network to be tested on the network abnormality parameters;

[0166] Based on the security processing degree, a network security evaluation result of the network to be tested is generated.

[0167] In this optional embodiment, optionally, determining the network abnormality parameters of the network to be tested according to all security analysis parameters may include:

[0168] Based on the security analysis parameters, determine the key security parameters of the network to be tested, wherein the key security parameters include one or more of the firewall configuration parameters, intrusion detection parameters, and security protocol parameters of the network to be tested;

[0169] Determine key abnormal parameters according to key security parameters of the network to be tested, wherein the key abnormal parameters include one or more of abnormal traffic parameters, DDoS attack parameters, abnormal data packet parameters, abnormal access parameters, and abnormal software parameters;

[0170] Based on all key abnormal parameters, determine the network abnormal parameters of the network under test.

[0171] In this optional embodiment, optionally, the above-mentioned generating a network risk parameter of the network to be tested based on the network anomaly parameter, and determining a network security anomaly coefficient corresponding to the network risk parameter in combination with a predetermined risk mining model may include:

[0172] Determine the abnormal weight value corresponding to each network abnormal parameter, and determine the network abnormal parameters whose abnormal weight values ​​are greater than or equal to a preset abnormal weight threshold as the network risk parameters of the network to be tested;

[0173] Input all network risk parameters into a predetermined risk mining model, so as to perform calculation operations on all network risk parameters through the risk mining model to obtain risk calculation results; wherein the risk calculation results include the risk levels corresponding to the network risk parameters;

[0174] Based on the risk calculation results, determine the network security anomaly coefficient corresponding to the network risk parameters.

[0175] In this optional embodiment, optionally, the above-mentioned generation of the security processing degree corresponding to the network under test based on the network security anomaly coefficient and the anomaly processing parameters may include: determining the security processing result after the network under test performs the security processing operation matching the anomaly processing parameters based on the network security anomaly coefficient and the anomaly processing parameters, and determining the security degree corresponding to the security processing result, and generating the security processing degree corresponding to the network under test based on the security degree corresponding to the security processing result. For example, the security processing result may include the response time of the automated response risk, the longer the response time, the lower the security processing degree corresponding to the network under test, and the shorter the response time, the higher the security processing degree corresponding to the network under test.

[0176] In this optional embodiment, optionally, the above-mentioned generation of network security evaluation results of the network to be tested based on the security processing degree may include: performing a quantitative evaluation operation on the security processing degree to obtain a quantitative evaluation result, and generating a network security evaluation result of the network to be tested based on the quantitative evaluation result.

[0177] It can be seen that the implementation of this optional embodiment can determine the network anomaly parameters of the network to be tested according to all security analysis parameters, generate the network risk parameters of the network to be tested based on the network anomaly parameters and determine the corresponding network security anomaly coefficient in combination with the risk mining model, determine the anomaly processing parameters according to the target operation parameters and the network security anomaly coefficient, and generate the security processing degree based on the network security anomaly coefficient and the anomaly processing parameters to generate the network security evaluation result of the network to be tested. By identifying and evaluating the network anomaly parameters, potential security threats can be discovered in time, so that corresponding protective measures can be taken to improve the overall security of the network. By using the risk mining model and the network security anomaly coefficient, the network risk can be quantified, which is conducive to improving the accuracy and reliability of assessing the network risk, and by determining the anomaly Common processing parameters and security processing levels can allocate security resources more effectively, which is conducive to improving the security assessment and security resistance capabilities of the network under test. By generating the security processing level, the network's response capability to security incidents can be evaluated and improved, ensuring a quick and effective response when a security incident occurs. By identifying and handling security threats in advance, potential losses and impacts caused by security incidents can be reduced, which is conducive to improving the stability and reliability of network operation, and further conducive to improving the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0178] In another optional embodiment, after generating security optimization parameters corresponding to the network to be tested based on event processing parameters corresponding to all events to be processed, the method further includes:

[0179] Generate optimization simulation results based on security optimization parameters and real-time network data in combination with a predetermined intelligent simulation model, wherein the optimization simulation results include simulation results after simulating the network to be tested to perform optimization operations that match the security optimization parameters;

[0180] According to the optimization simulation results, determine the simulation processing safety parameters corresponding to the optimization simulation results, and judge whether the simulation processing safety parameters meet the preset safety processing conditions;

[0181] When it is determined that the simulation processing safety parameter does not meet the preset safety processing condition, based on the real-time network data and the optimization simulation result, simulation optimization data of the network to be tested is generated, and based on the simulation optimization data, at least one update processing parameter matching the simulation optimization data is determined in a predetermined update processing parameter library;

[0182] Based on all update processing parameters, target update parameters are generated, and an update operation is performed on the security optimization parameters based on the target update parameters to update the security optimization parameters.

[0183] In this optional embodiment, optionally, the above-mentioned generation of optimization simulation results based on security optimization parameters and real-time network data in combination with a predetermined intelligent simulation model may include: inputting the security optimization parameters and real-time network data into a predetermined intelligent simulation model, so as to perform simulated optimization operations on the security optimization parameters and real-time network data through the intelligent simulation model, so as to simulate the network to be tested to perform optimization operations matching the security optimization parameters, and obtain optimization simulation results. Further, the optimization simulation results may include one or more of network performance simulation results, network security simulation results, and network resource consumption simulation results.

[0184] In this optional embodiment, optionally, optimizing the simulation processing safety parameters corresponding to the simulation results may include optimizing the processing parameters corresponding to the simulation results.

[0185] In this optional embodiment, optionally, the above-mentioned determination of whether the simulation processing safety parameter meets the preset safety processing condition may include:

[0186] Determine a first safety level corresponding to the simulation processing safety parameter, determine a second safety level corresponding to the preset safety processing condition, and judge whether the first safety level is greater than or equal to the second safety level;

[0187] When it is determined that the first security level is greater than or equal to the second security level, it is determined that the simulation processing security parameters meet the preset security processing conditions; when it is determined that the first security level is less than the second security level, it is determined that the simulation processing security parameters do not meet the preset security processing conditions.

[0188] In this optional embodiment, further optionally, when it is determined that the simulation processing safety parameters meet the preset safety processing conditions, the process can be terminated.

[0189] In this optional embodiment, optionally, the generating of the simulation optimization data of the network to be tested based on the real-time network data and the optimization simulation result may include:

[0190] Based on real-time network data and optimization simulation results, determine the target processing reason why the simulated processing safety parameters do not meet the preset safety processing conditions, and generate simulation optimization data for the network to be tested based on the target processing reason.

[0191] In this optional embodiment, optionally, the above-mentioned determining at least one update processing parameter matching the simulation optimization data in a predetermined update processing parameter library based on the simulation optimization data may include:

[0192] Determine the simulation optimization keyword corresponding to the simulation optimization data, and calculate the matching degree between each update processing parameter included in the predetermined update processing parameter library and the simulation optimization keyword, and determine the update processing parameter whose matching degree is greater than or equal to the preset matching degree threshold as the update processing parameter that matches the simulation optimization data.

[0193] In this optional embodiment, the target update parameters may optionally include all update processing parameters.

[0194] It can be seen that the implementation of this optional embodiment can generate optimization simulation results based on security optimization parameters, real-time network data and intelligent simulation models, determine corresponding simulation processing security parameters based on the optimization simulation results, and judge whether the simulation processing security parameters meet the preset security processing conditions. If not, the simulation optimization data of the network to be tested is generated based on the real-time network data and the optimization simulation results, and at least one matching update processing parameter is determined in the update processing parameter library based on the simulation optimization data. The target update parameters are generated based on all update processing parameters and then the security optimization parameters are updated. More effective security measures can be predicted and implemented through simulation and optimization operations, thereby enhancing the defense capabilities of the network. The intelligent simulation model can help identify the optimal configuration of resources, reduce unnecessary waste of resources, and improve resource utilization efficiency. Through simulation optimization operations, potential security risks can be predicted before actual deployment, so as to intervene before the risk occurs, and network security decisions can be made through simulation results. It provides data support to make decisions more scientific and accurate. Analysis and simulation optimization based on real-time network data can quickly respond to security incidents in the network and shorten the response time. By continuously updating security optimization parameters, network security measures can be continuously improved to adapt to the ever-changing network environment. The automated simulation and optimization process reduces the possibility of human operation errors and improves the accuracy of operations. The cost-effectiveness of different security measures can be evaluated through simulation, which is conducive to improving resource utilization. The intelligent simulation model can continuously learn and adapt according to real-time and historical data to improve the prediction accuracy of the model, which is conducive to improving the stability and reliability of network operation, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0195] In yet another optional embodiment, before generating security optimization parameters corresponding to the network to be tested based on event processing parameters corresponding to all events to be processed, the method further includes:

[0196] Predicting the predicted attack information of the network to be tested based on the security risk information and real-time network data, wherein the predicted attack information includes one or more of the predicted attack path, predicted attack location, predicted attack method, predicted attack time, and predicted attack event corresponding to the network to be tested;

[0197] Extracting target prediction information from the predicted attack information, and determining prediction processing parameters matching the target prediction information based on the target prediction information;

[0198] Based on the prediction processing parameters and the target prediction information, generate the prediction defense result corresponding to the target prediction information, and determine whether the prediction defense result meets the preset security defense conditions;

[0199] When it is determined that the predicted defense result meets the preset security defense conditions, the attack defense parameters of the network to be tested are generated based on all the predicted processing parameters;

[0200] Wherein, based on the event processing parameters corresponding to all pending events, security optimization parameters corresponding to the network to be tested are generated, including:

[0201] Based on the event processing parameters and attack defense parameters corresponding to all pending events, security optimization parameters corresponding to the network to be tested are generated.

[0202] In this optional embodiment, optionally, predicting the predicted attack information of the network to be tested based on the security risk information and the real-time network data may include:

[0203] According to the security risk information and real-time network data, the potential vulnerability information of the network to be tested is determined, and based on the potential vulnerability information, the predicted attack information of the network to be tested is determined.

[0204] In this optional embodiment, the target prediction information optionally includes key prediction information corresponding to the predicted attack information. Further, the prediction processing parameter is a prediction processing parameter that matches the target prediction information, wherein the prediction processing parameter matches the predicted attack information.

[0205] In this optional embodiment, the predicted defense result may optionally include the predicted defense result after performing a processing operation matching the predicted processing parameters on the target prediction information.

[0206] In this optional embodiment, optionally, the above-mentioned determination of whether the predicted defense result meets the preset security defense condition may include:

[0207] Determine a first defense security level corresponding to the predicted defense result, determine a second defense security level corresponding to the preset security defense condition, and judge whether the first defense security level is greater than or equal to the second defense security level;

[0208] When it is determined that the first defense security level is greater than or equal to the second defense security level, it is determined that the predicted defense result meets the preset security defense condition; when it is determined that the first defense security level is less than the second defense security level, it is determined that the predicted defense result does not meet the preset security defense condition.

[0209] In this optional embodiment, further optionally, when it is determined that the predicted defense result does not meet the preset security defense conditions, the present process can be terminated, or the prediction processing parameters can be updated and the operation of generating the predicted defense result corresponding to the target prediction information based on the prediction processing parameters and the target prediction information and determining whether the predicted defense result meets the preset security defense conditions can be re-executed.

[0210] In this optional embodiment, the attack defense parameters may optionally include all prediction processing parameters.

[0211] It can be seen that the implementation of this optional embodiment can predict the predicted attack information of the network to be tested based on the security risk information and real-time network data, extract the target prediction information in the predicted attack information and determine the prediction processing parameters, generate the predicted defense result corresponding to the target prediction information based on the prediction processing parameters and the target prediction information, and judge whether the preset security defense conditions are met. If so, the attack defense parameters of the network to be tested are generated based on all the prediction processing parameters, and then the security optimization parameters corresponding to the network to be tested are generated based on all the event processing parameters and the attack defense parameters. By combining real-time network data and security risk information, potential network attacks can be more accurately predicted, including attack paths, locations, methods, times and events, and by extracting target prediction information and matching corresponding prediction processing parameters, defense measures can be designed more specifically to improve the effectiveness of defense. By predicting attacks and taking defensive measures in advance, the possibility of successful attacks can be reduced, which is beneficial to improving the security of the network under test, as well as improving the operational stability and reliability of the network under test. By feeding back the implemented data to the prediction model, the prediction and defense strategies can be continuously improved to achieve continuous security optimization, which is beneficial to improving the stability and reliability of network operation, and further to improving the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is beneficial to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0212] In yet another optional embodiment, based on the target operating parameters and the predetermined intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested, including:

[0213] Performing a data preprocessing operation on the target operating parameters to obtain target processing parameters, wherein the data preprocessing operation includes one or more of a data cleaning operation and a data format standardization operation;

[0214] Performing a feature extraction operation on the target processing parameter to obtain a target feature parameter corresponding to the target processing parameter, and inputting the target feature parameter into a predetermined intelligent analysis model to perform an analysis operation on the target feature parameter through the predetermined intelligent analysis model to obtain a data analysis result;

[0215] Based on the data analysis results, determine the security assessment parameters of the network to be tested, where the security assessment parameters include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters;

[0216] Generate security analysis parameters for the network under test based on the security assessment parameters.

[0217] In this optional embodiment, optionally, the data cleaning operation is used to clear invalid, erroneous or incomplete data in the target operating parameters; the data format standardization operation is used to convert the target operating parameters into a unified format.

[0218] In this optional embodiment, optionally, the target characteristic parameters corresponding to the target processing parameters may include one or more of traffic characteristic parameters, access characteristic parameters, configuration characteristic parameters, connection characteristic parameters, device status characteristic parameters, and performance characteristic parameters.

[0219] In this optional embodiment, optionally, the above-mentioned determination of the security assessment parameters of the network to be tested based on the data analysis results may include: determining the data assessment parameters of the network to be tested based on the data analysis results, wherein the data assessment parameters may include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters; determining the security assessment parameters of the network to be tested based on the data assessment parameters. Further, the risk assessment parameters may include the severity and possibility of potential threats in the network to be tested; the abnormal behavior parameters may include security threat parameters; and the component impact parameters may include the security status of each component in the network to be tested and the impact parameters of each component on the overall network security.

[0220] In this optional embodiment, the security analysis parameters may optionally include all security assessment parameters.

[0221] It can be seen that the implementation of this optional embodiment can perform data preprocessing operations on target operating parameters to obtain target processing parameters, perform feature extraction operations on target processing parameters to obtain corresponding target feature parameters and input them into the intelligent analysis model to perform analysis operations on the target feature parameters to obtain data analysis results, determine the security assessment parameters of the network to be tested based on the data analysis results, and then generate security analysis parameters of the network to be tested. Through precise analysis, potential security threats can be identified earlier, so as to take preventive measures and reduce the occurrence of security incidents. Risk assessment parameters can be improved to help organizations understand the current security status, assess the severity of potential threats, and their possible impact on the business. Component impact parameters can be used to help identify key components and potential vulnerabilities in the network, thereby more effectively allocating security resources. The automated data analysis process reduces the need for manual analysis and improves It improves the efficiency of processing large amounts of data. Through intelligent analysis models, future security trends can be predicted, allowing organizations to prepare and adapt in advance. By quickly identifying and responding to security incidents, potential damage and recovery time can be reduced. Intelligent analysis models can continuously learn and adapt to new threats over time to improve their accuracy and effectiveness. Through continuous analysis, organizations can be better prepared to deal with potential security crises. Strengthening network security helps ensure business continuity and maintain operations even in the face of security threats, which is conducive to improving the stability and reliability of network operations, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessments on 5G networks under test, which is conducive to improving the accuracy and reliability of the security assessment results of 5G networks, as well as improving the intelligence and efficiency of the security assessment results of 5G networks.

[0222] In yet another optional embodiment, based on the event processing parameters and attack defense parameters corresponding to all the events to be processed, security optimization parameters corresponding to the network to be tested are generated, including:

[0223] Extracting first processing parameters from among the event processing parameters corresponding to all the events to be processed, and determining a first processing result corresponding to each first processing parameter, and extracting second processing parameters from among the attack and defense parameters, and determining a second processing result corresponding to each second processing parameter;

[0224] Determine a processing association relationship between all first processing results and all second processing results, and based on the processing association relationship, determine whether there are overlapping processing results between all first processing results and all second processing results;

[0225] When it is determined that there are overlapping processing results, determining a first overlapping processing parameter and a second overlapping processing parameter corresponding to each overlapping processing result, and performing a parameter merging operation on each first overlapping processing parameter and the second overlapping processing parameter to obtain a target merging parameter;

[0226] Based on the target merging parameters, a parameter update operation is performed on the number of event processing parameters and attack defense parameters corresponding to all pending events to obtain target update processing parameters, and security optimization parameters corresponding to the network to be tested are generated according to the target update processing parameters.

[0227] In this optional embodiment, the first processing parameter may include event corresponding policy parameters and security processing rule parameters; the second processing parameter may include intrusion detection system configuration parameters and firewall rule parameters. Further, the first processing result includes the processing result corresponding to the first processing parameter, and the second processing parameter includes the processing result corresponding to the second processing parameter.

[0228] In this optional embodiment, optionally, the processing association relationship between all the first processing results and all the second processing results includes the result similarity between each first processing result and each of the second processing results.

[0229] In this optional embodiment, optionally, judging whether there are overlapping processing results between all first processing results and all second processing results based on the processing association relationship may include:

[0230] Based on the processing association relationship, determine the result similarity between each first processing result and each second processing result, and judge whether there is a target similarity greater than or equal to a preset similarity threshold among all the result similarities;

[0231] When it is determined that there is a target similarity degree greater than or equal to a preset similarity threshold among the similarities of all results, it is determined that there are overlapping processing results between all the first processing results and all the second processing results, and the first processing results and the second processing results corresponding to all the target similarities are determined as overlapping processing results; when it is determined that there is no target similarity degree greater than or equal to the preset similarity threshold among the similarities of all results, it is determined that there are no overlapping processing results between all the first processing results and all the second processing results.

[0232] In this optional embodiment, optionally, the target merging parameter may be one of the first overlapping processing parameter and the second overlapping processing parameter.

[0233] In this optional embodiment, optionally, the number of parameters corresponding to the target update processing parameters is less than the number corresponding to the sum of the event processing parameters and the attack defense parameters.

[0234] It can be seen that the implementation of this optional embodiment can extract the first processing parameters corresponding to all events to be processed and then determine the first processing result, and extract the second processing parameters in the attack defense parameters and then determine the second processing result, determine the processing association relationship between the first processing result and the second processing result, and judge whether there are overlapping processing results based on the processing association relationship. If so, determine the first overlapping processing parameters and the second overlapping processing parameters corresponding to each overlapping processing result and perform a parameter merging operation to obtain a target merged parameter, and perform a parameter update operation on the event processing parameters and the attack defense parameters based on the target merged parameter to obtain the target updated processing parameter and then generate the security optimization parameters corresponding to the network to be tested. By merging overlapping processing parameters, redundant operations can be reduced and the efficiency of network management and response to events can be improved. Based on the optimized parameters, attacks can be defended more effectively, and the security, reliability and stability of the network to be tested in defending against attacks can be improved. By eliminating overlapping processing results, security resources can be allocated more reasonably, and by reducing unnecessary security measures, security optimization can be reduced. Low operating costs while maintaining or improving security levels, as well as simplified and optimized security measures can speed up the response time to security incidents, reduce potential damage, and automated parameter merging and updating reduce the possibility of human errors, which is conducive to improving the accuracy, reliability and intelligence of generating target update processing parameters and security optimization parameters. By continuously updating and optimizing security parameters, the network can better adapt to the changing threat environment. By identifying and resolving overlapping processing results, it can reduce the risks caused by repeated measures, such as waste of resources or configuration errors. By ensuring the effectiveness and efficiency of network security measures, it helps to ensure business continuity and stability, which is conducive to improving the stability and reliability of network operation, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0235] Embodiment 3

[0236] See also Figure 3 , Figure 3 Schematic diagram of the structure of an artificial intelligence-assisted 5G network security assessment device disclosed in an embodiment of the present invention. Figure 3 As shown, the artificial intelligence-assisted 5G network security evaluation device may include:

[0237] The acquisition module 301 is used to acquire historical network data of the network to be tested within a preset historical time period;

[0238] A determination module 302 is used to determine target network data corresponding to the network to be tested according to the historical network data, wherein the target network data includes network operation data corresponding to the network to be tested and network response data corresponding to the network to be tested;

[0239] The determination module 302 is further used to determine the abnormal detection data of the network to be tested based on the target network data;

[0240] The acquisition module 301 is also used to acquire real-time network data of the network to be tested;

[0241] A generating module 303 is used to generate target operating parameters of the network to be tested according to the real-time network data and the abnormality detection data;

[0242] The analysis module 304 is used to perform an analysis operation on the target operation parameters based on the target operation parameters and the predetermined intelligent analysis model to obtain security analysis parameters of the network to be tested, wherein the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested;

[0243] The generating module 303 is further used to generate a network security evaluation result of the network to be tested according to all security analysis parameters.

[0244] It can be seen that implementation Figure 3 The described device can obtain historical network data of the network to be tested within a preset historical time period and determine the target network data corresponding to the network to be tested and then determine the anomaly detection data, obtain real-time network data of the network to be tested, generate target operating parameters according to the real-time network data and the anomaly detection data, perform analysis operations on the target operating parameters based on the target operating parameters and the intelligent analysis model to obtain the security analysis parameters of the network to be tested, and generate the network security evaluation results of the network to be tested according to all the security analysis parameters. Through continuous monitoring and analysis, it is possible to timely discover and respond to potential security threats and reduce the risk of network attacks. It is also possible to optimize the use of network resources and improve network performance and efficiency by analyzing network operation data, and it is possible to quickly identify abnormal behaviors and attack patterns in the network to be tested, which is conducive to shortening the response time of the network to be tested to abnormal behaviors, so that it can combine artificial intelligence to perform intelligent security evaluation on the 5G network to be tested, which is conducive to improving the accuracy and reliability of the security evaluation results of the 5G network, and is conducive to improving the intelligence and efficiency of the security evaluation results of the 5G network.

[0245] In an optional embodiment, if Figure 4As shown, the determination module 302 is further used to determine the security risk information corresponding to the network to be tested according to the network security evaluation results, wherein the security risk information includes one or more of the security vulnerability information, security threat information, protection vulnerability information, and network attack information corresponding to the network to be tested;

[0246] The device also includes:

[0247] An evaluation module 305 is used to perform an intelligent evaluation operation on the security risk information based on the security risk information and a predetermined risk evaluation model to obtain a risk evaluation result, wherein the risk evaluation result includes a risk event corresponding to the network to be tested and an impact parameter of each risk event on the network to be tested, and the impact parameter includes one or more of a benefit impact parameter, a business impact parameter, and a security impact parameter of the risk event on the network to be tested;

[0248] The determination module 302 is further used to determine the risk impact degree corresponding to each risk event according to the impact parameter of each risk event on the network to be tested;

[0249] A sorting module 306 is used to perform a sorting operation on all risk events based on the risk impact levels corresponding to all risk events to obtain a risk event sequence;

[0250] The determination module 302 is further used to determine the events to be processed from all risk events based on the risk event sequence;

[0251] The acquisition module 301 is also used to acquire event information of each event to be processed;

[0252] The generating module 303 is further used to generate event processing parameters corresponding to each event to be processed based on the event information of each event to be processed; and to generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all events to be processed.

[0253] It can be seen that implementation Figure 4The described device can determine the security risk information corresponding to the network to be tested according to the network security evaluation results, generate risk assessment results based on the security risk information and the risk assessment model, determine the risk impact degree corresponding to each risk event according to the impact parameters of each risk event on the network to be tested, and then perform a sorting operation on all risk events to obtain a risk event sequence, determine the events to be processed based on the risk event sequence and obtain event information to generate event processing parameters corresponding to each event to be processed, and generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all events to be processed. It can more accurately identify security vulnerabilities, threats, protection deficiencies and attack modes in the network, and through intelligent evaluation and sorting of risk events, it can give priority to problems that have the greatest impact on the network, effectively allocate security resources, and is conducive to improving the risk resistance ability of the network to be tested, and It can also speed up response and reduce potential losses by quickly determining the risk impact and event handling priority. It can also reduce network security risks and enhance the overall security of the network by promptly handling high-risk events. It can also determine the event processing parameters corresponding to each event to be processed according to the event information of each event to be processed, which is conducive to improving the accuracy and reliability of determining the event processing parameters of each event to be processed, and then help improve the accuracy and reliability of generating security optimization parameters corresponding to the network to be tested, and further help improve the security resistance and security optimization capabilities of the network to be tested. It can combine artificial intelligence to conduct intelligent security assessment of 5G networks to be tested, which is conducive to improving the accuracy and reliability of the security assessment results of 5G networks, as well as improving the intelligence and efficiency of the security assessment results of 5G networks.

[0254] In another optional embodiment, Figure 4 As shown, the specific method of generating the network security evaluation result of the network to be tested by the generating module 303 according to all security analysis parameters includes:

[0255] Determine network anomaly parameters of the network to be tested based on all security analysis parameters, wherein the network anomaly parameters include one or more of malicious traffic parameters, malicious behavior parameters, and security threat parameters of the network to be tested;

[0256] Based on the network anomaly parameters, the network risk parameters of the network to be tested are generated, and the network security anomaly coefficient corresponding to the network risk parameters is determined by combining with the predetermined risk mining model;

[0257] Determine the abnormal processing parameters of the network to be tested according to the target operating parameters and the network security abnormality coefficient, and generate the corresponding security processing degree of the network to be tested based on the network security abnormality coefficient and the abnormal processing parameters; wherein the security processing degree includes the security degree corresponding to the processing operation performed by the network to be tested on the network abnormality parameters;

[0258] Based on the security processing degree, a network security evaluation result of the network to be tested is generated.

[0259] It can be seen that implementation Figure 4 The described device can determine the network anomaly parameters of the network to be tested according to all security analysis parameters, generate the network risk parameters of the network to be tested based on the network anomaly parameters and determine the corresponding network security anomaly coefficient in combination with the risk mining model, determine the anomaly processing parameters according to the target operation parameters and the network security anomaly coefficient, and generate the security processing degree based on the network security anomaly coefficient and the anomaly processing parameters, and then generate the network security evaluation result of the network to be tested. By identifying and evaluating the network anomaly parameters, potential security threats can be discovered in time, so that corresponding protective measures can be taken to improve the overall security of the network. By using the risk mining model and the network security anomaly coefficient, the network risk can be quantified, which is conducive to improving the accuracy and reliability of assessing the network risk, and by determining the anomaly processing Parameters and security processing levels can allocate security resources more effectively, which is conducive to improving the security assessment and security resistance capabilities of the network under test. By generating the security processing level, the network's response capability to security incidents can be evaluated and improved, ensuring a quick and effective response when a security incident occurs. By identifying and handling security threats in advance, potential losses and impacts caused by security incidents can be reduced, which is conducive to improving the stability and reliability of network operation, and further conducive to improving the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0260] In yet another optional embodiment, Figure 4 As shown, the generation module 303 is also used to generate security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, and then generate optimization simulation results according to the security optimization parameters and real-time network data in combination with a predetermined intelligent simulation model, wherein the optimization simulation results include simulation results after simulating the network to be tested to perform optimization operations matching the security optimization parameters;

[0261] The determination module 302 is further used to determine the simulation processing safety parameters corresponding to the optimization simulation results according to the optimization simulation results;

[0262] The device also includes:

[0263] A determination module 307 is used to determine whether the simulation processing safety parameters meet the preset safety processing conditions;

[0264] The generating module 303 is further used to generate simulation optimization data of the network to be tested based on the real-time network data and the optimization simulation results when the judging module 307 judges that the simulation processing security parameter does not meet the preset security processing conditions;

[0265] The determination module 302 is further configured to determine, based on the simulation optimization data, at least one update processing parameter that matches the simulation optimization data in a predetermined update processing parameter library;

[0266] The generating module 303 is further used to generate target update parameters based on all update processing parameters;

[0267] The updating module 308 is used to perform an updating operation on the security optimization parameter based on the target update parameter to update the security optimization parameter.

[0268] It can be seen that implementation Figure 4 The described device can generate optimization simulation results based on security optimization parameters, real-time network data and intelligent simulation models, determine corresponding simulation processing security parameters based on the optimization simulation results, and judge whether the simulation processing security parameters meet the preset security processing conditions. If not, simulation optimization data of the network to be tested is generated based on the real-time network data and the optimization simulation results, and at least one matching update processing parameter is determined in the update processing parameter library based on the simulation optimization data, and the target update parameters are generated based on all update processing parameters to update the security optimization parameters. More effective security measures can be predicted and implemented through simulation and optimization operations, thereby enhancing the defense capabilities of the network, and intelligent simulation models can help identify the optimal configuration of resources, reduce unnecessary waste of resources, and improve resource utilization efficiency. Through simulation optimization operations, potential security risks can be predicted before actual deployment, so as to intervene before the risk occurs, and simulation results provide network security decision-making. Data support makes decision-making more scientific and accurate. Analysis and simulation optimization based on real-time network data can quickly respond to security incidents in the network and shorten the response time. By continuously updating security optimization parameters, network security measures can be continuously improved to adapt to the ever-changing network environment. The automated simulation and optimization process reduces the possibility of human operation errors and improves the accuracy of operations. The cost-effectiveness of different security measures can be evaluated through simulation, which is conducive to improving resource utilization. The intelligent simulation model can continuously learn and adapt according to real-time and historical data to improve the prediction accuracy of the model, which is conducive to improving the stability and reliability of network operation, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0269] In yet another optional embodiment, Figure 4 As shown, the device also includes:

[0270] The prediction module 309 is used to predict the predicted attack information of the network to be tested according to the security risk information and the real-time network data before the generation module 303 generates the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, wherein the predicted attack information includes one or more of the predicted attack path, predicted attack location, predicted attack mode, predicted attack time, and predicted attack event corresponding to the network to be tested;

[0271] The determination module 302 is further used to extract target prediction information from the predicted attack information, and determine prediction processing parameters matching the target prediction information based on the target prediction information;

[0272] The generating module 303 is further used to generate a predicted defense result corresponding to the target prediction information based on the prediction processing parameters and the target prediction information;

[0273] The judgment module 307 is also used to judge whether the predicted defense result meets the preset security defense condition;

[0274] The generating module 303 is further used to generate attack defense parameters of the network to be tested based on all the predicted processing parameters when the judging module 307 judges that the predicted defense result meets the preset security defense condition;

[0275] The specific manner in which the generating module 303 generates the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed includes:

[0276] Based on the event processing parameters and attack defense parameters corresponding to all pending events, security optimization parameters corresponding to the network to be tested are generated.

[0277] It can be seen that implementation Figure 4The described device can predict the predicted attack information of the network to be tested based on the security risk information and real-time network data, extract the target prediction information in the predicted attack information and determine the prediction processing parameters, generate the predicted defense result corresponding to the target prediction information based on the prediction processing parameters and the target prediction information, and judge whether the preset security defense conditions are met. If satisfied, the attack defense parameters of the network to be tested are generated based on all the prediction processing parameters, and then the security optimization parameters corresponding to the network to be tested are generated based on all the event processing parameters and the attack defense parameters. By combining the real-time network data and security risk information, potential network attacks can be more accurately predicted, including the attack path, location, method, time and event, and by extracting the target prediction information and matching the corresponding prediction processing parameters, defense measures can be designed more specifically to improve the effectiveness of defense. By generating attack defense parameters and security optimization parameters in advance, defense measures can be quickly deployed before an actual attack occurs, thereby improving response speed; by predicting attacks and taking defense measures in advance, the possibility of a successful attack can be reduced, thereby helping to improve the security of the network under test, as well as improving the operational stability and reliability of the network under test; by feeding back the implemented data into the prediction model, the prediction and defense strategies can be continuously improved, and continuous security optimization can be achieved, which is conducive to improving the stability and reliability of network operation, and further to improving the security resistance and security optimization capabilities of the network under test; and by combining artificial intelligence to conduct intelligent security assessments on 5G networks under test, it is conducive to improving the accuracy and reliability of the security assessment results of 5G networks, as well as improving the intelligence and efficiency of the security assessment results of 5G networks.

[0278] In yet another optional embodiment, Figure 4 As shown, the analysis module 304 performs an analysis operation on the target operation parameters based on the target operation parameters and the predetermined intelligent analysis model, and the specific manner of obtaining the security analysis parameters of the network to be tested includes:

[0279] Performing a data preprocessing operation on the target operating parameters to obtain target processing parameters, wherein the data preprocessing operation includes one or more of a data cleaning operation and a data format standardization operation;

[0280] Performing a feature extraction operation on the target processing parameter to obtain a target feature parameter corresponding to the target processing parameter, and inputting the target feature parameter into a predetermined intelligent analysis model to perform an analysis operation on the target feature parameter through the predetermined intelligent analysis model to obtain a data analysis result;

[0281] Based on the data analysis results, determine the security assessment parameters of the network to be tested, where the security assessment parameters include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters;

[0282] Generate security analysis parameters for the network under test based on the security assessment parameters.

[0283] It can be seen that implementation Figure 4 The described device can perform data preprocessing operations on target operating parameters to obtain target processing parameters, perform feature extraction operations on target processing parameters to obtain corresponding target feature parameters and input them into an intelligent analysis model to perform analysis operations on the target feature parameters to obtain data analysis results, determine security assessment parameters of the network to be tested based on the data analysis results, and then generate security analysis parameters of the network to be tested. Through precise analysis, potential security threats can be identified earlier, so that preventive measures can be taken to reduce the occurrence of security incidents, and risk assessment parameters can be improved to help organizations understand the current security status, assess the severity of potential threats, and their possible impact on the business, and through component impact parameters, it helps to identify key components and potential vulnerabilities in the network, thereby more effectively allocating security resources, and the automated data analysis process reduces the need for manual analysis and improves processing The efficiency of large amounts of data, through intelligent analysis models, can predict future security trends, allowing organizations to prepare and adapt in advance, and by quickly identifying and responding to security incidents, potential damage and recovery time can be reduced. Intelligent analysis models can continuously learn and adapt to new threats over time to improve their accuracy and effectiveness. Through continuous analysis, organizations can be better prepared to respond to potential security crises. Strengthening network security helps ensure business continuity and maintain operations even in the face of security threats, which is conducive to improving the stability and reliability of network operations, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessments on 5G networks under test, which is conducive to improving the accuracy and reliability of the security assessment results of 5G networks, as well as improving the intelligence and efficiency of the security assessment results of 5G networks.

[0284] In yet another optional embodiment, Figure 4 As shown, the specific manner in which the generation module 303 generates security optimization parameters corresponding to the network to be tested based on the event processing parameters and attack defense parameters corresponding to all the events to be processed includes:

[0285] Extracting first processing parameters from among the event processing parameters corresponding to all the events to be processed, and determining a first processing result corresponding to each first processing parameter, and extracting second processing parameters from among the attack and defense parameters, and determining a second processing result corresponding to each second processing parameter;

[0286] Determine a processing association relationship between all first processing results and all second processing results, and based on the processing association relationship, determine whether there are overlapping processing results between all first processing results and all second processing results;

[0287] When it is determined that there are overlapping processing results, determining a first overlapping processing parameter and a second overlapping processing parameter corresponding to each overlapping processing result, and performing a parameter merging operation on each first overlapping processing parameter and the second overlapping processing parameter to obtain a target merging parameter;

[0288] Based on the target merging parameters, a parameter update operation is performed on the number of event processing parameters and attack defense parameters corresponding to all pending events to obtain target update processing parameters, and security optimization parameters corresponding to the network to be tested are generated according to the target update processing parameters.

[0289] It can be seen that implementation Figure 4 The described device can extract the first processing parameters corresponding to all events to be processed and thus determine the first processing result, and extract the second processing parameters in the attack and defense parameters and thus determine the second processing result, determine the processing association relationship between the first processing result and the second processing result, and judge whether there are overlapping processing results based on the processing association relationship. If so, determine the first overlapping processing parameters and the second overlapping processing parameters corresponding to each overlapping processing result and perform a parameter merging operation to obtain a target merged parameter, perform a parameter updating operation on the event processing parameters and the attack and defense parameters based on the target merged parameter to obtain the target updated processing parameter and then generate the security optimization parameters corresponding to the network to be tested, and can reduce redundant operations and improve the efficiency of network management and response to events by merging overlapping processing parameters, and can more effectively defend against attacks based on the optimized parameters, and improve the security, reliability and stability of the network to be tested in defending against attacks, and can more reasonably allocate security resources by eliminating overlapping processing results, and can reduce operational costs by reducing unnecessary security measures. Cost, while maintaining or improving the security level, and through simplified and optimized security measures, the response time to security incidents can be accelerated, potential damage can be reduced, and automated parameter merging and updating reduce the possibility of human errors, which is conducive to improving the accuracy, reliability and intelligence of generating target update processing parameters and security optimization parameters. By continuously updating and optimizing security parameters, the network can better adapt to the changing threat environment. By identifying and resolving overlapping processing results, the risks caused by repeated measures, such as waste of resources or configuration errors, can be reduced. By ensuring the effectiveness and efficiency of network security measures, it helps to ensure business continuity and stability, which is conducive to improving the stability and reliability of network operation, and further helps to improve the security resistance and security optimization capabilities of the network under test. It can combine artificial intelligence to conduct intelligent security assessment of the 5G network under test, which is conducive to improving the accuracy and reliability of the security assessment results of the 5G network, as well as improving the intelligence and efficiency of the security assessment results of the 5G network.

[0290] Embodiment 4

[0291] See also Figure 5 , Figure 5 Schematic diagram of another artificial intelligence-assisted 5G network security assessment device disclosed in an embodiment of the present invention. Figure 5 As shown, the artificial intelligence-assisted 5G network security evaluation device may include:

[0292] A memory 401 storing executable program codes;

[0293] a processor 402 coupled to the memory 401;

[0294] The processor 402 calls the executable program code stored in the memory 401 to execute the steps in the artificial intelligence-assisted 5G network security assessment method described in Embodiment 1 of the present invention or Embodiment 2 of the present invention.

[0295] Embodiment 5

[0296] An embodiment of the present invention discloses a computer storage medium, which stores computer instructions. When the computer instructions are called, they are used to execute the steps in the artificial intelligence-assisted 5G network security assessment method described in Embodiment 1 or Embodiment 2 of the present invention.

[0297] Embodiment 6

[0298] An embodiment of the present invention discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps in the artificial intelligence-assisted 5G network security assessment method described in Example 1 or Example 2.

[0299] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0300] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, magnetic disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0301] Finally, it should be noted that the artificial intelligence-assisted 5G network security assessment method and device disclosed in the embodiment of the present invention only discloses the preferred embodiment of the present invention, which is only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that the technical solutions described in the aforementioned embodiments can still be modified, or some of the technical features therein can be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An artificial intelligence-assisted 5G network security assessment method, characterized in that: The method comprises: Acquire historical network data of the network under test within a preset historical time period, and determine target network data corresponding to the network under test according to the historical network data, wherein the target network data includes network operation data corresponding to the network under test and network response data corresponding to the network under test; Based on the target network data, determining abnormal detection data of the network to be tested; Acquire real-time network data of the network to be tested; Generating target operating parameters of the network to be tested according to the real-time network data and the abnormality detection data; Based on the target operating parameters and the predetermined intelligent analysis model, an analysis operation is performed on the target operating parameters to obtain security analysis parameters of the network to be tested, wherein the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested; A network security evaluation result of the network to be tested is generated based on all the security analysis parameters.

2. The artificial intelligence-assisted 5G network security assessment method according to claim 1 is characterized in that: The method further comprises: Determine security risk information corresponding to the network to be tested according to the network security assessment result, wherein the security risk information includes one or more of security vulnerability information, security threat information, protection vulnerability information, and network attack information corresponding to the network to be tested; Based on the security risk information and a predetermined risk assessment model, an intelligent assessment operation is performed on the security risk information to obtain a risk assessment result, wherein the risk assessment result includes a risk event corresponding to the network to be tested and an impact parameter of each risk event on the network to be tested, and the impact parameter includes one or more of a benefit impact parameter, a business impact parameter, and a security impact parameter of the risk event on the network to be tested; Determine the risk impact degree corresponding to each risk event according to the impact parameter of each risk event on the network to be tested, and perform a sorting operation on all risk events based on the risk impact degrees corresponding to all risk events to obtain a risk event sequence; Based on the risk event sequence, determine the events to be processed from all the risk events, obtain event information of each of the events to be processed, and generate event processing parameters corresponding to each of the events to be processed based on the event information of each of the events to be processed; Based on the event processing parameters corresponding to all the events to be processed, security optimization parameters corresponding to the network to be tested are generated.

3. The artificial intelligence-assisted 5G network security assessment method according to claim 1 is characterized in that: Generating a network security evaluation result of the network to be tested according to all the security analysis parameters includes: Determine network anomaly parameters of the network to be tested according to all the security analysis parameters, wherein the network anomaly parameters include one or more of malicious traffic parameters, malicious behavior parameters, and security threat parameters of the network to be tested; Based on the network anomaly parameters, a network risk parameter of the network to be tested is generated, and a network security anomaly coefficient corresponding to the network risk parameter is determined in combination with a predetermined risk mining model; Determine the abnormal processing parameters of the network to be tested according to the target operating parameters and the network security abnormality coefficient, and generate the corresponding security processing degree of the network to be tested based on the network security abnormality coefficient and the abnormal processing parameters; wherein the security processing degree includes the security degree corresponding to the processing operation performed by the network to be tested on the network abnormality parameters; Based on the security processing degree, a network security evaluation result of the network to be tested is generated.

4. The artificial intelligence-assisted 5G network security assessment method according to claim 2 is characterized in that: After generating the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, the method further includes: Generate an optimization simulation result according to the security optimization parameter and the real-time network data in combination with a predetermined intelligent simulation model, wherein the optimization simulation result includes a simulation result after simulating the network to be tested to perform an optimization operation matching the security optimization parameter; According to the optimization simulation result, determine the simulation processing safety parameter corresponding to the optimization simulation result, and judge whether the simulation processing safety parameter meets the preset safety processing condition; When it is determined that the simulation processing safety parameter does not meet the preset safety processing condition, based on the real-time network data and the optimization simulation result, the simulation optimization data of the network to be tested is generated, and based on the simulation optimization data, at least one update processing parameter matching the simulation optimization data is determined in a predetermined update processing parameter library; Based on all the update processing parameters, a target update parameter is generated, and an update operation is performed on the security optimization parameter based on the target update parameter to update the security optimization parameter.

5. The artificial intelligence-assisted 5G network security assessment method according to claim 4 is characterized in that: Before generating the security optimization parameters corresponding to the network to be tested based on the event processing parameters corresponding to all the events to be processed, the method further includes: Predicting predicted attack information of the network to be tested based on the security risk information and the real-time network data, wherein the predicted attack information includes one or more of a predicted attack path, a predicted attack location, a predicted attack method, a predicted attack time, and a predicted attack event corresponding to the network to be tested; Extracting target prediction information from the predicted attack information, and determining prediction processing parameters matching the target prediction information based on the target prediction information; Based on the prediction processing parameters and the target prediction information, generate a prediction defense result corresponding to the target prediction information, and determine whether the prediction defense result meets a preset security defense condition; When it is determined that the predicted defense result meets the preset security defense condition, generating attack defense parameters of the network to be tested based on all the predicted processing parameters; The step of generating security optimization parameters corresponding to the network to be tested based on event processing parameters corresponding to all the events to be processed includes: Based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters, security optimization parameters corresponding to the network to be tested are generated.

6. The artificial intelligence-assisted 5G network security assessment method according to claim 1, characterized in that: The performing an analysis operation on the target operating parameter based on the target operating parameter and a predetermined intelligent analysis model to obtain the security analysis parameter of the network to be tested includes: Performing a data preprocessing operation on the target operating parameter to obtain a target processing parameter, wherein the data preprocessing operation includes one or more of a data cleaning operation and a data format standardization operation; Performing a feature extraction operation on the target processing parameter to obtain a target feature parameter corresponding to the target processing parameter, and inputting the target feature parameter into a predetermined intelligent analysis model to perform an analysis operation on the target feature parameter through the predetermined intelligent analysis model to obtain a data analysis result; Based on the data analysis result, determine the security assessment parameters of the network to be tested, wherein the security assessment parameters include one or more of risk assessment parameters, abnormal behavior parameters, and component impact parameters; According to the security assessment parameters, security analysis parameters of the network to be tested are generated.

7. The artificial intelligence-assisted 5G network security assessment method according to claim 5, characterized in that: The generating, based on the event processing parameters corresponding to all the events to be processed and the attack defense parameters, the security optimization parameters corresponding to the network to be tested comprises: Extracting a first processing parameter from among the event processing parameters corresponding to all the events to be processed, and determining a first processing result corresponding to each of the first processing parameters, and extracting a second processing parameter from among the attack defense parameters, and determining a second processing result corresponding to each of the second processing parameters; Determine a processing association relationship between all the first processing results and all the second processing results, and based on the processing association relationship, determine whether there are overlapping processing results between all the first processing results and all the second processing results; When it is determined that the overlapping processing results exist, determining a first overlapping processing parameter and a second overlapping processing parameter corresponding to each of the overlapping processing results, and performing a parameter merging operation on each of the first overlapping processing parameter and the second overlapping processing parameter to obtain a target merging parameter; Based on the target merging parameters, a parameter updating operation is performed on the number of event processing parameters corresponding to all the events to be processed and the attack defense parameters to obtain target updated processing parameters, and security optimization parameters corresponding to the network to be tested are generated according to the target updated processing parameters.

8. An artificial intelligence-assisted 5G network security assessment device, characterized in that: The device comprises: An acquisition module is used to acquire historical network data of the network to be tested within a preset historical time period; A determination module, configured to determine target network data corresponding to the network to be tested according to the historical network data, wherein the target network data includes network operation data corresponding to the network to be tested and network response data corresponding to the network to be tested; The determination module is further used to determine the abnormality detection data of the network to be tested based on the target network data; The acquisition module is further used to acquire real-time network data of the network to be tested; A generating module, used for generating target operating parameters of the network to be tested according to the real-time network data and the abnormality detection data; An analysis module, configured to perform an analysis operation on the target operation parameters based on the target operation parameters and a predetermined intelligent analysis model to obtain security analysis parameters of the network to be tested, wherein the security analysis parameters include one or more of terminal security parameters, access network security parameters, and core network security parameters corresponding to the network to be tested; The generating module is further used to generate a network security evaluation result of the network to be tested according to all the security analysis parameters.

9. An artificial intelligence-assisted 5G network security assessment device, characterized in that: The device comprises: A memory storing executable program code; a processor coupled to the memory; The processor calls the executable program code stored in the memory to execute the artificial intelligence-assisted 5G network security assessment method as described in any one of claims 1-7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer instructions, which, when called, are used to execute the artificial intelligence-assisted 5G network security assessment method as described in any one of claims 1 to 7.

Images