An artificial intelligence-based network security intelligent operation method

Abstract

The present invention belongs to the field of network security and relates to data analysis technology. It is used to solve the problem that the existing technology cannot configure the most suitable configuration toolkit for the communication network. Specifically, it is a network security intelligent operation method based on artificial intelligence, which includes the following steps: performing operation volume analysis on the network: marking the network that needs network security operation tool configuration analysis as the analysis object, marking the network that has completed the network security operation tool configuration analysis and has an operation time of more than L1 months as the evaluation object; obtaining the volume coefficient of the evaluation object; the present invention can mark the configuration mode of the analysis object according to the service type of the analysis object and the service type of the corresponding matching object of the feature tool, and adopt the corresponding configuration mode according to the coverage of the service type in the feature tool to perform the network security operation tool configuration analysis of the analysis object, so as to further improve the network security protection efficiency of the analysis object.

Description

Technical Field

[0001] The present invention belongs to the field of network security and relates to data analysis technology, specifically to an artificial intelligence-based network security intelligent operation method. Background Art

[0002] Network security means that the hardware, software and data of the network system are protected from damage, change or leakage due to accidental or malicious reasons, and the system runs continuously, reliably and normally without interruption of network services.

[0003] The invention patent with announcement number CN115834094B discloses a network security protection system, method and storage medium. The security protection system can deploy cleaning equipment, edge protection nodes and high-defense nodes in the backbone network to achieve network security protection for customers in the entire network; however, the security protection system cannot configure the most suitable configuration toolkit for the communication network, and cannot dynamically evaluate and optimize the configuration toolkit, resulting in the inability to continuously ensure the operational security of the communication network.

[0004] In view of the above technical problems, this application proposes a solution. Summary of the invention

[0005] The purpose of the present invention is to provide a network security intelligent operation method based on artificial intelligence, which is used to solve the problem that the existing technology cannot configure the most suitable configuration toolkit for the communication network;

[0006] The technical problem to be solved by the present invention is: how to provide an artificial intelligence-based network security intelligent operation method that can configure the most suitable configuration toolkit for the communication network.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] An artificial intelligence-based network security intelligent operation method comprises the following steps:

[0009] Step 1: Perform network operation volume analysis: mark the network that needs network security operation tool configuration analysis as the analysis object, and mark the network that has completed network security operation tool configuration analysis and has an operation time of more than L1 months as the evaluation object; obtain the volume coefficient TL of the evaluation object;

[0010] Step 2: Screen the assessment objects according to the volume coefficient TL and threat value;

[0011] Step 3: Mark the characteristic tools of the analysis object;

[0012] Step 4: Generate a configuration toolkit for the analysis object: obtain the service type of the matching object corresponding to the feature tool and the service type of the analysis object, mark the matching object whose service type is consistent with the service type of the analysis object as the coverage value, mark the ratio of the coverage value to the matching value of the feature tool as the coverage coefficient of the analysis object, and compare the coverage coefficient with the preset coverage threshold: if the coverage coefficient is less than the coverage threshold, mark the configuration mode of the analysis object as the merged mode; if the coverage coefficient is greater than or equal to the coverage threshold, mark the configuration mode of the analysis object as the independent mode;

[0013] Step 5: Conduct network security optimization analysis on the assessment object.

[0014] Furthermore, in step one, the process of obtaining the volume coefficient TL of the evaluation object includes: obtaining user data YH and access data FW of the evaluation object, the user data YH is the total number of registered users of the evaluation object, and the access data FW is the number of visits to the evaluation object in the last L1 months; the volume coefficient TL of the evaluation object is obtained by the formula TL=k1*YH+k2*FW, wherein k1 and k2 are both proportional coefficients, and k1>k2>1.

[0015] Furthermore, in step two, the specific process of screening the assessment objects includes: forming a volume range by the maximum and minimum values ​​of the volume coefficient TL of the assessment object, dividing the volume range into a number of individual volume intervals, marking the assessment objects whose volume coefficient TL is within the volume interval as subordinate objects of the volume interval, obtaining the total number of network security threat incidents that have occurred in the subordinate objects in the last L1 months and marking it as a threat value; marking the L2 subordinate objects with the smallest threat values ​​in the volume interval as purified objects of the volume interval.

[0016] Furthermore, in step three, the specific marking process of the feature tool includes: calculating the volume coefficient TL of the analysis object according to the calculation formula of the volume coefficient TL and marking it as the volume performance value of the analysis object, marking the purified object of the volume interval corresponding to the volume performance value as the matching object of the analysis object, forming a security tool set composed of the network security operation tools configured by all matching objects, marking the number of elements corresponding to the network security operation tools in the security tool set as the matching value of the network security operation tools, sorting the network security operation tools in order from large to small according to the matching value values ​​to obtain a matching sequence, and marking the network security operation tool ranked first in the matching sequence as a feature tool.

[0017] Furthermore, the specific process of performing a network security operation tool configuration analysis on the analysis object using the merge mode includes: marking the top L3 network security operation tools in the matching sequence as matching tools, and all the matching tools constitute a configuration toolkit of the analysis object.

[0018] Furthermore, the specific process of performing network security operation tool configuration analysis on the analysis object using the independent mode includes: marking the feature tool as a configuration tool, and then forming a secondary set consisting of the network security operation tools configured by the matching object containing the configuration tool, marking the number of elements corresponding to the network security operation tool in the secondary set as the independent value of the network security operation tool, marking the L3 network security operation tools with the largest independent value in the secondary set as matching tools, and all the matching tools forming the configuration toolkit of the analysis object.

[0019] Furthermore, in step five, the specific process of conducting network security optimization analysis on the assessment object includes: generating an assessment cycle of L1 months in length, marking the L2 subordinate objects with the largest threat values ​​in the volume interval as optimization objects of the volume interval at the end of the assessment cycle; obtaining the overlap coefficient of the optimization object, and comparing the overlap coefficient with the preset overlap threshold: if the overlap coefficient is less than the overlap threshold, it is determined that the optimization object needs to undergo network security operation tool configuration analysis, and at the same time, a tool reorganization signal is generated and sent to the administrator's mobile phone terminal; at the same time; if the overlap coefficient is greater than or equal to the overlap threshold, a tool optimization signal is generated and sent to the administrator's mobile phone terminal.

[0020] Furthermore, the process of obtaining the overlap coefficient of the optimization object includes: marking the purified objects within the volume interval whose service type is the same as the service type of the optimization object as the reference objects of the optimization object, marking the number of overlapping network security operation tools in the configuration toolkit of the optimization object and the configuration toolkit of the reference object as the overlap value, marking the ratio of the overlap value to the total number of network security operation tools in the configuration toolkit of the reference object as the overlap performance value of the optimization object relative to the reference object, and summing and averaging the overlap performance values ​​of the optimization object relative to all reference objects to obtain the overlap coefficient of the optimization object.

[0021] A network security intelligent operation system based on artificial intelligence includes a volume analysis module, a threat screening module, a feature analysis module, a configuration analysis module and an optimization analysis module; the volume analysis module, the threat screening module, the feature analysis module, the configuration analysis module and the optimization analysis module are communicatively connected in sequence, and the optimization analysis module is also communicatively connected to the volume analysis module.

[0022] The volume analysis module is used to perform volume analysis on the network and obtain the volume coefficient TL of the evaluation object;

[0023] The threat screening module is used to screen the purified objects in the volume interval;

[0024] The feature analysis module is used to mark the feature tools of the analysis object;

[0025] The configuration analysis module is used to generate a configuration toolkit for the analysis object in a combined mode or an independent mode;

[0026] The optimization analysis module is used to perform network security optimization analysis on the optimization object.

[0027] The present invention has the following beneficial effects:

[0028] 1. Perform operation volume analysis on the network, calculate the volume coefficient based on the number of registered users and recent visits of the evaluation object, and use the volume coefficient to provide feedback on the service volume of the evaluation object. Then, combine the recent attack data of the evaluation object to screen the purified objects in the volume range. The purified objects are the evaluation objects with the best security protection effect in the volume range, which provide data support for generating configuration toolkits for the analysis objects.

[0029] 2. Mark the feature tools of the analysis object according to the volume coefficient and volume interval of the analysis object. Feedback the main tools of the configuration toolkit of the analysis object through the feature tools, and then perform combined analysis on the feature tools to finally generate the configuration toolkit, thereby improving the network operation security of the analysis object.

[0030] 3. Generate a configuration toolkit for the analysis object, mark the configuration mode of the analysis object according to the service type of the analysis object and the service type of the corresponding matching object of the feature tool, and adopt the corresponding configuration mode to perform the network security operation tool configuration analysis of the analysis object according to the coverage of the service type in the feature tool, so as to further improve the network security protection efficiency of the analysis object;

[0031] 4. Conduct network security optimization analysis on the assessment object, dynamically optimize the security protection status of the assessment object in a periodic analysis manner, conduct a reorganization necessity analysis when the security protection status is abnormal, and reorganize the tools when necessary to cope with dynamically changing network attack tendencies. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0033] Figure 1 This is a flow chart of a method according to Embodiment 1 of the present invention;

[0034] Figure 2 This is a system block diagram of Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0035] The technical scheme of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0036] Embodiment 1: Figure 1 As shown, a network security intelligent operation method based on artificial intelligence includes the following steps:

[0037] Step 1: Perform operation volume analysis on the network: mark the network that needs network security operation tool configuration analysis as the analysis object, and mark the network that has completed network security operation tool configuration analysis and has an operation time of more than L1 months as the evaluation object; obtain the user data YH and access data FW of the evaluation object, where the user data YH is the total number of registered users of the evaluation object, and the access data FW is the number of visits to the evaluation object in the last L1 months; L1 is a numerical constant, and the specific value of L1 is set by the management personnel; the volume coefficient TL of the evaluation object is obtained through the formula TL=k1*YH+k2*FW, where k1 and k2 are both proportional coefficients, and k1>k2>1;

[0038] Step 2: Screen the assessment object according to the volume coefficient TL and the threat value: The maximum and minimum values ​​of the volume coefficient TL of the assessment object constitute the volume range, and the volume range is divided into several individual volume intervals. The assessment object with the volume coefficient TL within the volume interval is marked as a subordinate object of the volume interval, and the total number of network security threat events that occurred in the subordinate object in the last L1 months is obtained and marked as the threat value. Network security threat events include computer viruses, worms, Trojans, advertising programs, phishing, network grafting, etc.; L2 subordinate objects with the smallest threat value in the volume interval are marked as purified objects of the volume interval; L2 is a numerical constant, and the specific value of L2 is set by the management personnel; The volume coefficient is obtained by comprehensive calculation based on the number of registered users of the assessment object and the recent access volume, and the service volume of the assessment object is fed back through the volume coefficient. Then, the purified objects in the volume interval are screened in combination with the recent attack data of the assessment object. The purified objects are a group of assessment objects with the best security protection effect in the volume interval, which provides data support for generating a configuration toolkit for the analysis object;

[0039] Step 3: Mark the characteristic tools of the analysis object: Calculate the volume coefficient TL of the analysis object according to the calculation formula of the volume coefficient TL and mark it as the volume performance value of the analysis object, mark the purified object of the volume interval corresponding to the volume performance value as the matching object of the analysis object, and form a security tool set by the network security operation tools configured by all matching objects. The network security operation tools include network packet analysis tools, vulnerability scanning tools, penetration testing tools, intrusion detection and defense, encryption tools, firewall software tools, password management tools, etc.; mark the number of elements corresponding to the network security operation tools in the security tool set as the matching value of the network security operation tools, sort the network security operation tools in descending order according to the matching value values ​​to obtain a matching sequence, and mark the network security operation tool ranked first in the matching sequence as a characteristic tool; mark the characteristic tools according to the volume coefficient of the analysis object and the purified object of the volume interval, and use the characteristic tools to feedback the main tools of the configuration toolkit of the analysis object, and then perform a combination analysis on the characteristic tools to finally generate a configuration toolkit, thereby improving the network operation security of the analysis object;

[0040] Step 4: Generate a configuration toolkit for the analysis object: obtain the service type of the matching object corresponding to the feature tool and the service type of the analysis object, mark the matching object whose service type is consistent with the service type of the analysis object as the coverage value, mark the ratio of the coverage value to the matching value of the feature tool as the coverage coefficient of the analysis object, and compare the coverage coefficient with the preset coverage threshold: if the coverage coefficient is less than the coverage threshold, the configuration mode of the analysis object is marked as the merge mode; if the coverage coefficient is greater than or equal to the coverage threshold, the configuration mode of the analysis object is marked as the independent mode; the specific process of using the merge mode to perform network security operation tool configuration analysis on the analysis object includes: marking the top L3 network security operation tools in the matching sequence as matching tools, L3 is a numerical constant, and the specific value of L3 is set by the management personnel; all matching tools constitute the analysis pair The specific process of using the independent mode to perform a configuration analysis of the network security operation tool on the analysis object includes: marking the feature tool as a configuration tool, and then forming a secondary set with the network security operation tools configured by the matching object containing the configuration tool, marking the number of elements corresponding to the network security operation tool in the secondary set as the independent value of the network security operation tool, marking the L3 network security operation tools with the largest independent value in the secondary set as matching tools, and forming a configuration toolkit for the analysis object with all matching tools; marking the configuration mode of the analysis object according to the service type of the analysis object and the service type of the matching object corresponding to the feature tool, and adopting the corresponding configuration mode according to the coverage of the service type in the feature tool to perform the configuration analysis of the network security operation tool of the analysis object, so as to further improve the network security protection efficiency of the analysis object;

[0041] Step 5: Conduct network security optimization analysis on the evaluation object: Generate an evaluation cycle of L1 months, and at the end of the evaluation cycle, mark the L2 subordinate objects with the largest threat value in the volume interval as the optimization objects of the volume interval; mark the purified objects in the volume interval with the same service type as the optimization object as the reference object of the optimization object, mark the number of network security operation tools that overlap in the configuration toolkit of the optimization object and the configuration toolkit of the reference object as the overlap value, mark the ratio of the overlap value to the total number of network security operation tools in the configuration toolkit of the reference object as the overlap performance value of the optimization object relative to the reference object, and analyze the overlap performance of the optimization object relative to all reference objects. The values ​​are summed and averaged to obtain the overlap coefficient of the optimization object, and the overlap coefficient is compared with the preset overlap threshold: if the overlap coefficient is less than the overlap threshold, it is determined that the optimization object needs to perform network security operation tool configuration analysis, and at the same time, a tool reorganization signal is generated and sent to the administrator's mobile terminal; at the same time; if the overlap coefficient is greater than or equal to the overlap threshold, a tool optimization signal is generated and sent to the administrator's mobile terminal; the security protection status of the assessment object is dynamically optimized in a periodic analysis manner, and a reorganization necessity analysis is performed when the security protection status is abnormal. When necessary, tool reorganization is performed to cope with dynamically changing network attack tendencies.

[0042] Embodiment 2: Figure 2 As shown, an artificial intelligence-based network security intelligent operation system includes a volume analysis module, a threat screening module, a feature analysis module, a configuration analysis module and an optimization analysis module; the volume analysis module, the threat screening module, the feature analysis module, the configuration analysis module and the optimization analysis module are communicatively connected in sequence, and the optimization analysis module is also communicatively connected to the volume analysis module.

[0043] The volume analysis module is used to perform volume analysis on the network and obtain the volume coefficient TL of the evaluation object;

[0044] The threat screening module is used to screen the purified objects in the volume interval;

[0045] The feature analysis module is used to mark the feature tools of the analysis object;

[0046] The configuration analysis module is used to generate a configuration toolkit for the analysis object in a combined mode or an independent mode;

[0047] The optimization analysis module is used to perform network security optimization analysis on the optimization object.

[0048] A network security intelligent operation method based on artificial intelligence, when working, marks the network that needs the configuration analysis of the network security operation tool as the analysis object, and marks the network that has completed the configuration analysis of the network security operation tool and the operation time exceeds L1 month as the evaluation object; obtains the volume coefficient TL of the evaluation object; screens the evaluation object according to the volume coefficient TL and the threat value to obtain the purified object of the volume interval; marks the feature tool of the analysis object; then obtains the service type of the matching object corresponding to the feature tool and the service type of the analysis object, marks the matching object whose service type is consistent with the service type of the analysis object as the coverage value, marks the ratio of the coverage value to the matching value of the feature tool as the coverage coefficient of the analysis object, and marks the configuration mode of the analysis object through the coverage coefficient; finally, performs network security optimization analysis on the evaluation object.

[0049] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0050] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula close to the actual value. The coefficients in the formula are set by technicians in this field according to actual conditions; for example: formula TL=k1*YH+k2*FW; technicians in this field collect multiple groups of sample data and set corresponding volume coefficients for each group of sample data; substitute the set volume coefficients and the collected sample data into the formula, any two formulas constitute a set of two-variable linear equations, screen the calculated coefficients and take the average, and obtain the values ​​of k1 and k2 as 2.85 and 2.13 respectively;

[0051] The size of the coefficient is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the coefficient depends on the amount of sample data and the initial setting of the corresponding volume coefficient for each set of sample data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantified value, such as the volume coefficient is proportional to the value of the user data.

[0052] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0053] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security intelligent operation method based on artificial intelligence, characterized in that: The following steps are involved: Step 1: Perform network operation volume analysis: mark the network that needs network security operation tool configuration analysis as the analysis object, and mark the network that has completed network security operation tool configuration analysis and has an operation time of more than L1 months as the evaluation object; obtain the volume coefficient TL of the evaluation object; Step 2: Screen the assessment objects according to the volume coefficient TL and threat value; Step 3: Mark the characteristic tools of the analysis object; Step 4: Generate a configuration toolkit for the analysis object: obtain the service type of the matching object corresponding to the feature tool and the service type of the analysis object, mark the matching object whose service type is consistent with the service type of the analysis object as the coverage value, mark the ratio of the coverage value to the matching value of the feature tool as the coverage coefficient of the analysis object, and compare the coverage coefficient with the preset coverage threshold: if the coverage coefficient is less than the coverage threshold, mark the configuration mode of the analysis object as the merged mode; if the coverage coefficient is greater than or equal to the coverage threshold, mark the configuration mode of the analysis object as the independent mode; Step 5: Conduct network security optimization analysis on the assessment object; In step 1, the process of obtaining the volume coefficient TL of the evaluation object includes: obtaining the user data YH and access data FW of the evaluation object, where the user data YH is the total number of registered users of the evaluation object, and the access data FW is the number of visits to the evaluation object in the last L1 months; obtaining the volume coefficient TL of the evaluation object by the formula TL=k1*YH+k2*FW, where k1 and k2 are both proportional coefficients, and k1>k2>1; In step 2, the specific process of screening the evaluation objects includes: forming a volume range from the maximum and minimum values ​​of the volume coefficient TL of the evaluation object, dividing the volume range into several volume intervals, marking the evaluation objects whose volume coefficient TL is within the volume interval as subordinate objects of the volume interval, obtaining the total number of network security threat events that occurred in the subordinate objects in the last L1 months and marking it as the threat value; marking the L2 subordinate objects with the smallest threat value in the volume interval as the purified objects of the volume interval; In step three, the specific marking process of the feature tool includes: calculating the volume coefficient TL of the analysis object according to the calculation formula of the volume coefficient TL and marking it as the volume performance value of the analysis object, marking the purified object of the volume interval corresponding to the volume performance value as the matching object of the analysis object, forming a security tool set by the network security operation tools configured by all matching objects, marking the number of elements corresponding to the network security operation tools in the security tool set as the matching value of the network security operation tools, sorting the network security operation tools in descending order according to the matching value values ​​to obtain a matching sequence, and marking the network security operation tool ranked first in the matching sequence as a feature tool; The specific process of using the merge mode to perform a configuration analysis of the network security operation tool on the analysis object includes: marking the top L3 network security operation tools in the matching sequence as matching tools, and all matching tools constitute a configuration toolkit of the analysis object; The specific process of performing the configuration analysis of the network security operation tool on the analysis object in the independent mode includes: marking the feature tool as the configuration tool, then forming a secondary set by the network security operation tools configured by the matching object including the configuration tool, marking the number of elements corresponding to the network security operation tool in the secondary set as the independent value of the network security operation tool, marking L3 network security operation tools with the largest independent value in the secondary set as matching tools, and forming a configuration tool package of the analysis object by all the matching tools; In step five, the specific process of conducting network security optimization analysis on the evaluation object includes: generating an evaluation cycle of L1 months, marking the L2 subordinate objects with the largest threat value in the volume interval as optimization objects of the volume interval at the end of the evaluation cycle; obtaining the overlap coefficient of the optimization object, and comparing the overlap coefficient with the preset overlap threshold: if the overlap coefficient is less than the overlap threshold, it is determined that the optimization object needs to be analyzed for network security operation tool configuration, and at the same time, a tool reorganization signal is generated and sent to the mobile phone terminal of the administrator; at the same time; if the overlap coefficient is greater than or equal to the overlap threshold, a tool optimization signal is generated and sent to the mobile phone terminal of the administrator; The process of obtaining the overlap coefficient of the optimization object includes: marking the purified objects within the volume interval whose service type is the same as that of the optimization object as the reference object of the optimization object, marking the number of overlapping network security operation tools in the configuration toolkit of the optimization object and the configuration toolkit of the reference object as the overlap value, marking the ratio of the overlap value to the total number of network security operation tools in the configuration toolkit of the reference object as the overlap performance value of the optimization object relative to the reference object, and summing and averaging the overlap performance values ​​of the optimization object relative to all reference objects to obtain the overlap coefficient of the optimization object.

2. An artificial intelligence-based network security intelligent operation system, used to execute the artificial intelligence-based network security intelligent operation method according to claim 1, characterized in that: It includes a volume analysis module, a threat screening module, a feature analysis module, a configuration analysis module and an optimization analysis module; the volume analysis module, the threat screening module, the feature analysis module, the configuration analysis module and the optimization analysis module are sequentially connected in communication, and the optimization analysis module is also connected in communication with the volume analysis module; The volume analysis module is used to perform volume analysis on the network and obtain the volume coefficient TL of the evaluation object; The threat screening module is used to screen the purified objects in the volume interval; The feature analysis module is used to mark the feature tools of the analysis object; The configuration analysis module is used to generate a configuration toolkit for the analysis object in a combined mode or an independent mode; The optimization analysis module is used to perform network security optimization analysis on the optimization object.

Images