Data security analysis system and method based on artificial intelligence

Abstract

The present invention relates to the field of data security analysis technology, and specifically, to a data security analysis system and method based on artificial intelligence. It includes: a data processing unit performs parallel cleaning and standardization processing on network traffic data, user behavior data, and system log data, and integrates them into a comprehensive feature vector; an anomaly detection unit uses the DBSCAN algorithm to perform cluster analysis on the comprehensive feature vector, and uses the Gaussian mixture model to perform probability modeling to screen outliers; a behavior analysis unit determines the type of outliers through pattern matching, and performs risk assessment on the outliers to generate a security analysis report; a security response unit adopts an automated response mechanism based on the risk level of the outliers, and generates a security response report. The data security analysis system and method based on artificial intelligence achieves efficient outlier division by dynamically adjusting clustering parameters and density sensing technology, and then combines the Gaussian mixture model with the screening mechanism of posterior probability to achieve anomaly detection and security risk assessment.

Description

Technical Field

[0001] The present invention relates to the technical field of data security analysis, and in particular to a data security analysis system and method based on artificial intelligence. Background Art

[0002] The artificial intelligence-based data security analysis system and method aims to improve the accuracy of anomaly detection in multi-dimensional data and enhance the real-time response capability of security threats. It screens outliers by dynamically adjusting clustering algorithm parameters and probability modeling, controls the outlier detection and risk assessment process in different density areas, and realizes intelligent anomaly detection, behavior tracking and security response.

[0003] Existing data security analysis systems are usually difficult to adapt to the dynamic changes of complex and diverse network traffic and user behavior data. In addition, due to the large amount of network data in a dynamic environment, it is difficult to accurately adjust the neighborhood radius of each comprehensive feature vector, and data at low-density points will be mistaken for abnormal points, which will lead to the problem that network data is difficult to screen efficiently and abnormal points in low-density areas are missed or misdetected. Therefore, a data security analysis system and method based on artificial intelligence are provided. Summary of the invention

[0004] The purpose of the present invention is to provide an artificial intelligence-based data security analysis system and method to solve the problem raised in the above background technology that it is difficult to accurately adjust the neighborhood radius of each comprehensive feature vector due to the large amount of network data in a dynamic environment, and data at low-density points will be mistaken for abnormal points, which will make it difficult to efficiently screen network data and cause missed or misdetected abnormal points in low-density areas.

[0005] To achieve the above objectives, the present invention provides a data security analysis system based on artificial intelligence, comprising:

[0006] A data processing unit, wherein the data processing unit adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel and integrate them into a comprehensive feature vector;

[0007] It also includes an anomaly detection unit, which uses the DBSCAN algorithm to perform cluster analysis on the comprehensive feature vector to divide it into high-density clusters and low-density points, and uses a Gaussian mixture model to perform probability modeling on the low-density points to filter out abnormal points;

[0008] It also includes a behavior analysis unit, which determines the type of abnormal point through pattern matching, performs risk assessment on the abnormal point, and finally generates a security analysis report;

[0009] It also includes a security response unit, which adopts an automated response mechanism based on the risk level of the abnormal point and generates a security response report.

[0010] The data processing unit includes a parallel processing module and a comprehensive feature module;

[0011] The parallel processing module adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel. The specific steps are as follows:

[0012] S1.1. Remove incomplete network packets from network traffic data, remove duplicate network packets, align network traffic data timestamps, and extract IP address codes from network traffic data , port number , Traffic size And the network protocol type ;

[0013] S1.2. Remove incomplete login information from user behavior data and extract user operation behavior codes from user behavior data ;

[0014] S1.3. Numerically process the event type of the system log data and use One-hot encoding to obtain the system log event type. , get the timestamp of the system log event .

[0015] The comprehensive feature module is used to encode the IP address , port number , Traffic size , Network protocol type , User operation behavior coding , System log event type and timestamp Integrated into a comprehensive feature vector , as follows:

[0016] .

[0017] As a further improvement of the technical solution, the anomaly detection unit includes a cluster analysis module and a modeling screening module;

[0018] Among them, the clustering analysis module performs clustering analysis on the comprehensive feature vector V through the DBSCAN algorithm and divides it into high-density clusters and low-density points;

[0019] The modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, and screens and marks abnormal points.

[0020] As a further improvement of the technical solution, the clustering analysis module performs clustering analysis on the comprehensive feature vector V through the DBSCAN algorithm and divides it into high-density clusters and low-density points. The specific steps are as follows:

[0021] S2.1.1. Calculate the comprehensive feature vector and Euclidean distance ;

[0022] ;

[0023] in, , indicating the A comprehensive feature vector;

[0024] , indicating the A comprehensive feature vector;

[0025] S2.1.2. Introduce a dynamic adjustment strategy in the DBSCAN algorithm, measure the local density by the k-nearest neighbor distance, and dynamically adjust the neighborhood radius of each comprehensive feature vector and minimum points ;

[0026] S2.1.3, defines the neighborhood radius of each comprehensive feature vector and minimum points Afterwards, each comprehensive feature vector is classified into core points, boundary points and noise points. The specific method is as follows:

[0027] If the comprehensive feature vector of There are at least points, then As the core point;

[0028] If the comprehensive feature vector Does not meet the core point condition, but is within the neighborhood of a core point, then is the boundary point;

[0029] If the comprehensive feature vector It neither meets the core point conditions nor belongs to the neighborhood of any core point. It is a noise point;

[0030] S2.1.4. Introduce density gradient perception technology into the DBSCAN algorithm to calculate the distance change from each comprehensive feature vector to the center point of its neighborhood to perceive the density change. The specific method is as follows:

[0031] ;

[0032] in, for local density; for Euclidean distance to the neighborhood center; for Gradient density;

[0033] according to Gradient density , dynamically adjust the clustering radius;

[0034] S2.1.5. High-density clusters are formed by connecting core points and boundary points, and noise points form low-density point sets. ;

[0035] ;

[0036] in, A low-density point set The first low-density point in ; A low-density point set The Low density points; is the total number of low-density points.

[0037] As a further improvement of this technical solution, in S2.1.2, a dynamic adjustment strategy is introduced in the DBSCAN algorithm to measure the local density by the k nearest neighbor distance and dynamically adjust the neighborhood radius of each comprehensive feature vector and minimum points , the specific method is as follows:

[0038] S2.1.2.1. Calculate each comprehensive feature vector With all other points Euclidean distance , and find the comprehensive eigenvector Before nearest neighbor points;

[0039] S2.1.2.2. Calculate the comprehensive feature vector Neighborhood radius :

[0040] ;

[0041] in, is the comprehensive feature vector and The Euclidean distance of

[0042] The comprehensive feature vector of high-density areas There is a smaller Value; comprehensive feature vector of low-density area There is a larger value;

[0043] S2.1.2.3. Dynamic adjustment of minimum points , as follows:

[0044] In high-density areas, local points are denser and larger selection ;

[0045] In low-density areas, the points are sparsely distributed and the selection is small. .

[0046] As a further improvement of this technical solution, the modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, screen out abnormal points, and mark them. The specific steps are as follows:

[0047] S2.2.1. Setting the number of different distributions in the Gaussian mixture model , randomly initialize each Gaussian distribution The mean vector of , set the initial covariance matrix is the identity matrix, setting the initial weight of each distribution ;

[0048] S2.2.2. Use the Bayesian formula to calculate whether each point belongs to the Gaussian distribution The posterior probability ;

[0049] in, for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection;

[0050] S2.2.3. Based on the posterior probability Update the mean vector , covariance matrix and weight ;

[0051] S2.2.4, repeat S2.2.2-S2.2.3 until the mean vector , covariance matrix and weight Parameter convergence;

[0052] S2.2.5. Based on the converged mean vector , covariance matrix and weight Parameters, calculate each low-density point The probability density belonging to the Gaussian mixture model;

[0053] ;

[0054] in, ; is the total number of low-density points;

[0055] S2.2.6. Setting probability thresholds , probability density Less than the probability threshold Low density points Marked as abnormal points and output to the behavior analysis unit.

[0056] As a further improvement of this technical solution, in S2.2.2, the Bayesian formula is used to calculate whether each point belongs to the Gaussian distribution. The posterior probability , the specific method is as follows:

[0057] ;

[0058] in, For the Gaussian distribution at the point The probability density at ; for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection; is the integration variable;

[0059] In S2.2.3, according to the posterior probability Update the mean vector , covariance matrix and weight , the specific method is as follows:

[0060] ;

[0061] ;

[0062] ;

[0063] in, To accumulate all points Belong to The sum of the probabilities of Gaussian components; Low density point Relative to the mean deviation.

[0064] As a further improvement of the technical solution, the behavior analysis unit includes an outlier matching module and an outlier evaluation module;

[0065] The outlier matching module uses pattern matching technology to analyze outlier behaviors for matching and determine outlier types, as follows:

[0066] S3.1. Establish a behavioral pattern feature library of known security threats and attack behaviors;

[0067] S3.2, comparing the behavior characteristics of each abnormal point with the known patterns in the behavior pattern feature library to determine the type of abnormal point;

[0068] The outlier assessment module performs risk assessment on each outlier, as follows:

[0069] S3.3. According to pattern matching, the risk level of abnormal points is evaluated, and the risk level is divided into high risk, medium risk and low risk;

[0070] S3.4. Prioritize the outliers according to the evaluation results and calculate the risk score of each outlier based on the CVA model;

[0071] S3.5. Based on all analysis results, the system generates a safety analysis report.

[0072] As a further improvement of the technical solution, the automated response mechanism in the security response unit is as follows:

[0073] S4.1. For high-risk anomalies, take emergency response measures immediately, automatically block network connections related to the anomaly, isolate the system where the anomaly is located from the main network, and immediately notify the user;

[0074] S4.2. For medium-risk anomalies, take preventive measures, strengthen monitoring and analysis, increase monitoring frequency, track suspicious activities in real time, and immediately alert users;

[0075] S4.3. For low-risk anomalies, monitor and record them, and notify the user to confirm whether further processing is required;

[0076] S4.4. Record the response process and abnormal point analysis in detail and generate a security response report.

[0077] On the other hand, the present invention provides a data security analysis method based on artificial intelligence, based on the above-mentioned data security analysis system based on artificial intelligence, comprising the following steps:

[0078] S1, adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data and system log data in parallel and integrate them into a comprehensive feature vector;

[0079] S2. Use DBSCAN algorithm and introduce dynamic adjustment strategy and density gradient perception technology to perform cluster analysis on comprehensive feature vectors, divide them into high-density clusters and low-density points, and use Gaussian mixture model to perform probability modeling on low-density points to screen and mark abnormal points;

[0080] S3. Determine the type of abnormal point through pattern matching, conduct risk assessment on the abnormal point, and generate a safety analysis report;

[0081] S4. Based on the risk level of the abnormal point, an automated response mechanism is used to execute security measures and generate a security response report.

[0082] Compared with the prior art, the present invention has the following beneficial effects:

[0083] 1. In the data security analysis system and method based on artificial intelligence, based on the dynamic adjustment strategy and density gradient perception technology in the DBSCAN clustering algorithm, the neighborhood radius and the minimum number of points can be dynamically adjusted according to different density areas, and high-density clusters and low-density points can be accurately divided. In the boundary areas with large density changes, false detections and missed detections can be significantly reduced.

[0084] 2. In the data security analysis system and method based on artificial intelligence, the Gaussian mixture model is combined with the posterior probability outlier screening mechanism to realize the probability modeling of low-density points, and the real outliers are screened out through the Bayesian formula, and further combined with the set probability threshold to ensure accurate screening of outliers. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] Figure 1 It is the overall flow chart of the present invention;

[0086] The meaning of each number in the figure is:

[0087] 1. Data processing unit; 2. Anomaly detection unit; 3. Behavior analysis unit; 4. Security response unit. DETAILED DESCRIPTION

[0088] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Embodiment 1:

[0089] See also Figure 1 As shown, a data security analysis system based on artificial intelligence is provided, including:

[0090] Data processing unit 1, wherein the data processing unit 1 adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel and integrate them into a comprehensive feature vector;

[0091] In this embodiment, the data processing unit 1 includes a parallel processing module and a comprehensive feature module;

[0092] The parallel processing module adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel. The specific steps are as follows:

[0093] S1.1. Remove incomplete network packets from network traffic data, remove duplicate network packets, align network traffic data timestamps, and extract IP address codes from network traffic data , port number , Traffic size And the network protocol type ;

[0094] Network traffic data comes from network devices such as routers, switches, and firewalls. The continuous value features of traffic size are normalized and scaled to the range of 0 to 1. For the protocol type in the network traffic, it is standardized through One-hot encoding.

[0095] S1.2. Remove incomplete login information from user behavior data and extract user operation behavior codes from user behavior data ;

[0096] User behavior data comes from the user's operation records in the system, such as login time, operation type, accessed resources, and account status. Duplicate operation records of users, such as repeated queries and login attempts by the same user, are removed. The time series of user behavior is sorted to ensure that each user's operation behavior is arranged in chronological order.

[0097] Encode the user's operation behaviors of login and logout, and convert the discrete operation type into a numerical feature; the login operation is coded as 1, and the logout operation is coded as 2;

[0098] S1.3. Numerically process the event type of the system log data and use One-hot encoding to obtain the system log event type. , get the timestamp of the system log event .

[0099] System log data comes from the operating system, applications, and databases, recording system events, error logs, and user activity logs; removing duplicate or useless system log lines, including removing duplicate or useless system log lines; and converting the log timestamp data into a standardized time format.

[0100] The comprehensive feature module is used to encode the IP address , port number , Traffic size , Network protocol type , User operation behavior coding , System log event type and timestamp Integrated into a comprehensive feature vector , as follows:

[0101] .

[0102] Each dimension of the comprehensive feature vector represents an important feature, and each element of the comprehensive feature vector is a numerical feature after standardization and is analyzed under the same dimension.

[0103] It also includes an anomaly detection unit 2, which uses the DBSCAN algorithm to perform cluster analysis on the comprehensive feature vector, divides it into high-density clusters and low-density points, and uses a Gaussian mixture model to perform probability modeling on the low-density points to filter out abnormal points;

[0104] In this embodiment, the anomaly detection unit 2 includes a cluster analysis module and a modeling and screening module;

[0105] Among them, the clustering analysis module performs clustering analysis on the comprehensive feature vector V through the DBSCAN algorithm and divides it into high-density clusters and low-density points;

[0106] The modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, and screens and marks abnormal points.

[0107] The cluster analysis module performs cluster analysis on the comprehensive feature vector V by using the DBSCAN algorithm and divides it into high-density clusters and low-density points. The specific steps are as follows:

[0108] S2.1.1. Calculate the comprehensive feature vector and Euclidean distance ;

[0109] ;

[0110] in, , indicating the A comprehensive feature vector;

[0111] , indicating the A comprehensive feature vector;

[0112] S2.1.2. Introduce a dynamic adjustment strategy in the DBSCAN algorithm, measure the local density by the k-nearest neighbor distance, and dynamically adjust the neighborhood radius of each comprehensive feature vector and minimum points ;

[0113] S2.1.3, defines the neighborhood radius of each comprehensive feature vector and minimum points Afterwards, each comprehensive feature vector is classified into core points, boundary points and noise points. The specific method is as follows:

[0114] If the comprehensive feature vector of There are at least points, then As the core point;

[0115] If the comprehensive feature vector Does not meet the core point condition, but is within the neighborhood of a core point, then is the boundary point;

[0116] If the comprehensive feature vector It neither meets the core point conditions nor belongs to the neighborhood of any core point. It is a noise point;

[0117] S2.1.4. Introduce density gradient perception technology into the DBSCAN algorithm to calculate the distance change from each comprehensive feature vector to the center point of its neighborhood to perceive the density change. The specific method is as follows:

[0118] ;

[0119] in, for local density; for Euclidean distance to the neighborhood center; for Gradient density;

[0120] according to Gradient density , dynamically adjust the clustering radius;

[0121] express Gradient density, reflecting How local density varies with distance; The larger the The local density is larger, the closer to the center of mass; conversely, the density is lower and farther away from the center of mass; according to the size of the density gradient, it can be judged that Whether it is in a relatively uniform density area or a density transition area, as follows:

[0122] if Larger, description Located in a high density and uniform area. In this case, the neighborhood radius Can be kept small to ensure more accurate clustering in dense areas;

[0123] if Smaller, description Located in the density transition area or boundary area. At this time, the neighborhood radius It can be appropriately increased to ensure that a wider set of points can be captured, making clustering more effective;

[0124] S2.1.5. High-density clusters are formed by connecting core points and boundary points, and noise points form low-density point sets. ;

[0125] ;

[0126] in, A low-density point set The first low-density point in ; A low-density point set The Low density points; is the total number of low-density points.

[0127] In this embodiment S2.1.2, a dynamic adjustment strategy is introduced into the DBSCAN algorithm to measure the local density by the k nearest neighbor distance and dynamically adjust the neighborhood radius of each comprehensive feature vector. and minimum points , the specific method is as follows:

[0128] S2.1.2.1. Calculate each comprehensive feature vector With all other points Euclidean distance , and find the comprehensive eigenvector Before nearest neighbor points;

[0129] S2.1.2.2. Calculate the comprehensive feature vector Neighborhood radius :

[0130] ;

[0131] in, is the comprehensive feature vector and The Euclidean distance of

[0132] The comprehensive feature vector of high-density areas There is a smaller Value; comprehensive feature vector of low-density area There is a larger value;

[0133] S2.1.2.3. Dynamic adjustment of minimum points , as follows:

[0134] In high-density areas, local points are denser and larger selection ;

[0135] In low-density areas, the points are sparsely distributed and the selection is small. .

[0136] In this embodiment, the neighborhood radius of each comprehensive feature vector is dynamically adjusted. and minimum points After that, redefine the core points and boundary points:

[0137] Core point: If the comprehensive feature vector The number of points in the neighborhood of is greater than or equal to the dynamically adjusted , then this point is the core point;

[0138] Boundary point: If the comprehensive feature vector If a point does not meet the core point conditions, but it is in the neighborhood of a core point, it is marked as a boundary point.

[0139] In this embodiment, the modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, screen and mark abnormal points. The specific steps are as follows:

[0140] S2.2.1. Setting the number of different distributions in the Gaussian mixture model , randomly initialize each Gaussian distribution The mean vector of , set the initial covariance matrix is the identity matrix, setting the initial weight of each distribution ;

[0141] S2.2.2. Use the Bayesian formula to calculate whether each point belongs to the Gaussian distribution The posterior probability ;

[0142] in, for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection;

[0143] S2.2.3. Based on the posterior probability Update the mean vector , covariance matrix and weight ;

[0144] S2.2.4, repeat S2.2.2-S2.2.3 until the mean vector , covariance matrix and weight Parameter convergence;

[0145] S2.2.5. Based on the converged mean vector , covariance matrix and weight Parameters, calculate each low-density point The probability density belonging to the Gaussian mixture model;

[0146] ;

[0147] in, ; is the total number of low-density points;

[0148] S2.2.6. Setting probability thresholds , probability density Less than the probability threshold Low density points Marked as an abnormal point and output to the behavior analysis unit 3.

[0149] Probability Threshold Set the strategy as follows:

[0150] Setting probability thresholds based on the distribution characteristics of probability density , calculate the probability density of all points The mean and standard deviation ; Set probability threshold ;

[0151] In this embodiment S2.2.2, the Bayesian formula is used to calculate whether each point belongs to the Gaussian distribution The posterior probability , the specific method is as follows:

[0152] ;

[0153] in, For the Gaussian distribution at the point The probability density at ; for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection; is the integration variable;

[0154] In this embodiment S2.2.3, according to the posterior probability Update the mean vector , covariance matrix and weight , the specific method is as follows:

[0155] ;

[0156] ;

[0157] ;

[0158] in, To accumulate all points Belong to The sum of the probabilities of Gaussian components; Low density point Relative to the mean deviation.

[0159] It also includes a behavior analysis unit 3, which determines the type of abnormal point through pattern matching, performs risk assessment on the abnormal point, and finally generates a safety analysis report;

[0160] In this embodiment, the behavior analysis unit 3 includes an outlier matching module and an outlier evaluation module;

[0161] The outlier matching module uses pattern matching technology to analyze outlier behaviors for matching and determine outlier types, as follows:

[0162] S3.1. Establish a behavioral pattern feature library of known security threats and attack behaviors;

[0163] S3.2, comparing the behavior characteristics of each abnormal point with the known patterns in the behavior pattern feature library to determine the type of abnormal point;

[0164] In this embodiment, external threat intelligence is used to further confirm whether the abnormal point is associated with a known security threat, attack activity or vulnerability;

[0165] The outlier assessment module performs risk assessment on each outlier, as follows:

[0166] S3.3. According to pattern matching, the risk level of abnormal points is evaluated, and the risk level is divided into high risk, medium risk and low risk;

[0167] S3.4. Prioritize the outliers according to the evaluation results and calculate the risk score of each outlier based on the CVA model;

[0168] The CVA model is a risk assessment model used to quantify the potential threat of each anomaly to a system or network:

[0169] ;

[0170] in, Criticality: the criticality of the resources or systems involved in the abnormal point; Vulnerability: the vulnerability of the system or application where the anomaly is located; For asset value, the economic value or importance of the resource or data associated with the anomaly;

[0171] Use ratings to indicate the importance of resources.

[0172] It is derived from the system's security, vulnerabilities, and protection capabilities assessment, which can be determined through vulnerability scanning and historical attack records.

[0173] Based on the economic value of the system or data or its importance to business operations;

[0174] S3.5. Based on all analysis results, the system generates a safety analysis report.

[0175] The report content is as follows:

[0176] Basic information of anomaly points: including the type, behavior characteristics, source IP, port and other basic information of anomaly points;

[0177] Risk level and assessment: Detailed description of the risk level and risk score of the abnormal points, providing potential hazards and impact analysis;

[0178] Behavior tracking results: Displays the time series behavior of anomalies, other associated anomalies, and possible attack paths.

[0179] It also includes a security response unit 4, which adopts an automated response mechanism based on the risk level of the abnormal point and generates a security response report;

[0180] In this embodiment, the automated response mechanism in the security response unit 4 is as follows:

[0181] S4.1. For high-risk anomalies, take emergency response measures immediately, automatically block network connections related to the anomaly, isolate the system where the anomaly is located from the main network, and immediately notify the user;

[0182] S4.2. For medium-risk anomalies, take preventive measures, strengthen monitoring and analysis, increase monitoring frequency, track suspicious activities in real time, and immediately alert users;

[0183] S4.3. For low-risk anomalies, monitor and record them, and notify the user to confirm whether further processing is required;

[0184] S4.4. Record the response process and abnormal point analysis in detail and generate a security response report.

[0185] In this embodiment, the security response report records the abnormal points and their risk levels, and also includes all response measures taken by the system for subsequent review and optimization of the protection strategy. The security response report includes:

[0186] Specific information about the anomaly, including IP address, timestamp, risk level, source, and associated behavior patterns; all automated response measures taken by the system; and historical behavior of the anomaly. Embodiment 2:

[0187] The data security analysis method based on artificial intelligence, based on the above-mentioned data security analysis system based on artificial intelligence, includes the following steps:

[0188] S1, adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data and system log data in parallel and integrate them into a comprehensive feature vector;

[0189] S2. Use DBSCAN algorithm and introduce dynamic adjustment strategy and density gradient perception technology to perform cluster analysis on comprehensive feature vectors, divide them into high-density clusters and low-density points, and use Gaussian mixture model to perform probability modeling on low-density points to screen and mark abnormal points;

[0190] S3. Determine the type of abnormal point through pattern matching, conduct risk assessment on the abnormal point, and generate a safety analysis report;

[0191] S4. Based on the risk level of the abnormal point, an automated response mechanism is used to execute security measures and generate a security response report.

[0192] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited by the above embodiments, and the above embodiments and descriptions are only preferred examples of the present invention, and are not intended to limit the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, and these changes and improvements all fall within the scope of the present invention to be protected.

Claims

1. The data security analysis system based on artificial intelligence is characterized by: include: A data processing unit (1), wherein the data processing unit (1) adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel, and integrate them into a comprehensive feature vector; An anomaly detection unit (2), wherein the anomaly detection unit (2) uses a DBSCAN algorithm to perform cluster analysis on the comprehensive feature vector to divide it into high-density clusters and low-density points, and uses a Gaussian mixture model to perform probability modeling on the low-density points to filter out abnormal points; The data processing unit (1) comprises a parallel processing module and a comprehensive feature module; The parallel processing module adopts a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel. The specific steps are as follows: S1.

1. Remove incomplete network packets from network traffic data, remove duplicate network packets, align network traffic data timestamps, and extract IP address codes from network traffic data , port number , Traffic size And the network protocol type ; S1.

2. Remove incomplete login information from user behavior data and extract user operation behavior codes from user behavior data ; S1.

3. Numerically process the event type of the system log data and use One-hot encoding to obtain the system log event type. , get the timestamp of the system log event ; The comprehensive feature module is used to encode the IP address , port number , Traffic size , Network protocol type , User operation behavior coding , System log event type and timestamp Integrated into a comprehensive feature vector , as follows: ； A behavior analysis unit (3), wherein the behavior analysis unit (3) determines the type of abnormal point through pattern matching, performs risk assessment on the abnormal point, and finally generates a safety analysis report; A security response unit (4), wherein the security response unit (4) adopts an automated response mechanism based on the risk level of the abnormal point and generates a security response report; The clustering analysis module performs clustering analysis on the comprehensive feature vector V through the DBSCAN algorithm and divides it into high-density clusters and low-density points. The specific steps are as follows: S2.1.

1. Calculate the comprehensive feature vector and Euclidean distance ; ； in, , indicating the A comprehensive feature vector; , indicating the A comprehensive feature vector; S2.1.

2. Introduce a dynamic adjustment strategy in the DBSCAN algorithm, measure the local density by the k-nearest neighbor distance, and dynamically adjust the neighborhood radius of each comprehensive feature vector and minimum points ; S2.1.3, defines the neighborhood radius of each comprehensive feature vector and minimum points Afterwards, each comprehensive feature vector is classified into core points, boundary points and noise points. The specific method is as follows: If the comprehensive feature vector of There are at least points, then As the core point; If the comprehensive feature vector Does not meet the core point condition, but is within the neighborhood of a core point, then is the boundary point; If the comprehensive feature vector It neither meets the core point conditions nor belongs to the neighborhood of any core point. It is a noise point; S2.1.

4. Introduce density gradient perception technology into the DBSCAN algorithm to calculate the distance change from each comprehensive feature vector to the center point of its neighborhood to perceive the density change. The specific method is as follows: ； in, for local density; for Euclidean distance to the neighborhood center; for Gradient density; according to Gradient density , dynamically adjust the clustering radius; S2.1.

5. High-density clusters are formed by connecting core points and boundary points, and noise points form low-density point sets. ; ； in, A low-density point set The first low-density point in ; A low-density point set The Low density points; is the total number of low-density points.

2. The data security analysis system based on artificial intelligence according to claim 1 is characterized in that: The anomaly detection unit (2) includes a cluster analysis module and a modeling screening module; Among them, the clustering analysis module performs clustering analysis on the comprehensive feature vector V through the DBSCAN algorithm and divides it into high-density clusters and low-density points; The modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, and screens and marks abnormal points.

3. The data security analysis system based on artificial intelligence according to claim 2 is characterized in that: In S2.1.2, a dynamic adjustment strategy is introduced into the DBSCAN algorithm to measure the local density by the k-nearest neighbor distance and dynamically adjust the neighborhood radius of each comprehensive feature vector. and minimum points , the specific method is as follows: S2.1.2.

1. Calculate each comprehensive feature vector With all other points Euclidean distance , and find the comprehensive eigenvector Before nearest neighbor points; S2.1.2.

2. Calculate the comprehensive feature vector Neighborhood radius : ； in, is the comprehensive feature vector and The Euclidean distance of The comprehensive feature vector of high-density areas There is a smaller Value; comprehensive feature vector of low-density area There is a larger value; S2.1.2.

3. Dynamic adjustment of minimum points , as follows: In high-density areas, local points are denser and larger selection ; In low-density areas, the points are sparsely distributed and the selection is small. .

4. The data security analysis system based on artificial intelligence according to claim 3 is characterized in that: The modeling and screening module uses a Gaussian mixture model to perform probability modeling on low-density points, screen out and mark outliers. The specific steps are as follows: S2.2.

1. Setting the number of different distributions in the Gaussian mixture model , randomly initialize each Gaussian distribution The mean vector of , set the initial covariance matrix is the identity matrix, setting the initial weight of each distribution ; S2.2.

2. Use the Bayesian formula to calculate whether each point belongs to the Gaussian distribution The posterior probability ; in, for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection; S2.2.

3. Based on the posterior probability Update the mean vector , covariance matrix and weight ; S2.2.4, repeat S2.2.2-S2.2.3 until the mean vector , covariance matrix and weight Parameter convergence; S2.2.

5. Based on the converged mean vector , covariance matrix and weight Parameters, calculate each low-density point The probability density belonging to the Gaussian mixture model; ； in, ; is the total number of low-density points, For each low density point In the The probability density function of a Gaussian distribution; S2.2.

6. Setting probability thresholds , probability density Less than the probability threshold Low density points Marked as anomalies and output to the behavior analysis unit (3).

5. The artificial intelligence-based data security analysis system according to claim 4, characterized in that: In S2.2.2, the Bayesian formula is used to calculate whether each point belongs to the Gaussian distribution. The posterior probability , the specific method is as follows: ； in, For the Gaussian distribution at the point The probability density function at ; for Belong to Gaussian distributed latent variables; is the mean vector , covariance matrix and weight Parameter collection; is the integration variable; In S2.2.3, according to the posterior probability Update the mean vector , covariance matrix and weight , the specific method is as follows: ； ； ； in, To add up all the points Belong to The sum of the probabilities of Gaussian components; Low density point Relative to the mean deviation.

6. The data security analysis system based on artificial intelligence according to claim 1, characterized in that: The behavior analysis unit (3) includes an outlier matching module and an outlier evaluation module; The outlier matching module uses pattern matching technology to analyze outlier behaviors for matching and determine outlier types, as follows: S3.

1. Establish a behavioral pattern feature library of known security threats and attack behaviors; S3.2, comparing the behavior characteristics of each abnormal point with the known patterns in the behavior pattern feature library to determine the type of abnormal point; The outlier assessment module performs risk assessment on each outlier, as follows: S3.

3. According to pattern matching, the risk level of abnormal points is evaluated, and the risk level is divided into high risk, medium risk and low risk; S3.

4. Prioritize the outliers according to the evaluation results and calculate the risk score of each outlier based on the CVA model; S3.

5. Based on all analysis results, the system generates a safety analysis report.

7. The data security analysis system based on artificial intelligence according to claim 1 is characterized in that: The automated response mechanism in the security response unit (4) is specifically as follows: S4.

1. For high-risk anomalies, take emergency response measures immediately, automatically block network connections related to the anomaly, isolate the system where the anomaly is located from the main network, and immediately notify the user; S4.

2. For medium-risk anomalies, take preventive measures, strengthen monitoring and analysis, increase monitoring frequency, track suspicious activities in real time, and immediately alert users; S4.

3. For low-risk anomalies, monitor and record them, and notify the user to confirm whether further processing is required; S4.

4. Record the response process and abnormal point analysis in detail and generate a security response report.

8. The data security analysis method based on artificial intelligence is based on the data security analysis system based on artificial intelligence as claimed in any one of claims 1 to 7, characterized in that: The steps include: S10.

1. Use a synchronous processing strategy to clean and standardize network traffic data, user behavior data, and system log data in parallel and integrate them into a comprehensive feature vector; S10.

2. Use DBSCAN algorithm and introduce dynamic adjustment strategy and density gradient perception technology to perform cluster analysis on comprehensive feature vectors, divide them into high-density clusters and low-density points, and use Gaussian mixture model to perform probability modeling on low-density points, screen and mark abnormal points; S10.

3. Determine the type of abnormal point through pattern matching, conduct risk assessment on the abnormal point, and generate a safety analysis report; S10.

4. Based on the risk level of the abnormal point, an automated response mechanism is used to execute security measures and generate a security response report.

Images