Network security protection method and network security protection platform based on artificial intelligence

Abstract

The present application discloses a network security protection method and a network security protection platform based on artificial intelligence, the method comprising: obtaining network equipment related information, network related information, network anomaly related information, network equipment image information, and network protection related information; generating security anomaly warning information based on the network related information and the network protection related information, generating user anomaly warning information based on the network anomaly related information, generating network equipment hardware anomaly warning information based on the network equipment related information and the network equipment image information, and generating personnel anomaly warning information based on the network equipment image information; and sending the security anomaly warning information, user anomaly warning information, network equipment hardware anomaly warning information, and personnel anomaly warning information to a preset receiving terminal. The present application helps to improve the efficiency and effectiveness of network security protection by integrating multiple information sources and intelligent analysis technologies.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an artificial intelligence-based network security protection method and a network security protection platform. Background Art

[0002] Network security refers to taking a series of careful measures to effectively prevent and resist all kinds of attacks, intrusions, interference, sabotage and illegal use attempts against the network, and to prevent accidents caused by natural disasters, human errors, etc., to ensure that the network can continue to operate stably and reliably. In addition, network security also covers the full protection of network data integrity, confidentiality and availability, which is the basis for ensuring that information assets are not damaged, business continuity and user trust.

[0003] In the practice of network security protection, the network security protection platform plays a pivotal role. As the cornerstone of the network security system, it bears the responsibility of overall protection. However, most of the security protection platforms currently available on the market are limited to software-level protection, with relatively simple protection methods, making it difficult to fully respond to complex and changing network security threats. This limitation not only reduces the protection effect, but also brings potential security risks to users of the security protection platform, affecting its performance in actual applications. Summary of the invention

[0004] In view of this, an embodiment of the present application provides a network security protection method and a network security protection platform based on artificial intelligence.

[0005] According to one aspect of the present application, a network security protection method based on artificial intelligence is provided, the method comprising:

[0006] Obtaining network equipment related information, network related information, network anomaly related information, network equipment image information, and network protection related information; wherein the network equipment related information includes network equipment access cable information and network equipment location information, the network related information includes network access information and network traffic information, the network anomaly related information includes historical network attack times within a preset time period, historical network failure times within a preset time period, and historical abnormal user quantity within a preset time period, and the network equipment image information is image information within a preset range of the network equipment;

[0007] Generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate the network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device;

[0008] Send security abnormality warning information, user abnormality warning information, network equipment hardware abnormality warning information and personnel abnormality warning information to the preset receiving terminal.

[0009] According to another aspect of the present application, there is provided an artificial intelligence-based network security protection platform, comprising:

[0010] The terminal device collection module is used to collect network device related information, wherein the network device related information includes the cable information connected to the network device and the network device location information;

[0011] The network-related collection module is used to collect network-related information, wherein the network-related information includes network access information and network traffic information

[0012] A network anomaly collection module is used to collect information related to network anomalies, wherein the information related to network anomalies includes information on the number of historical network attacks within a preset time period, information on the number of historical network failures within a preset time period, and information on the number of historical abnormal users within a preset time period;

[0013] A device image acquisition module, used to acquire image information of network devices, wherein the image information of the network devices is image information within a preset range of the network devices;

[0014] Protection information collection module, used to collect network protection related information;

[0015] a warning information generation module, configured to generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device;

[0016] The warning information push module is used to send security abnormality warning information, user abnormality warning information, network equipment hardware abnormality warning information and personnel abnormality warning information to the preset receiving terminal.

[0017] According to another aspect of the present application, a storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the above-mentioned artificial intelligence-based network security protection method is implemented.

[0018] According to another aspect of the present application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the above-mentioned artificial intelligence-based network security protection method when executing the program.

[0019] Through the above-mentioned technical scheme, the embodiment of the present application provides an artificial intelligence-based network security protection method and a network security protection platform, which collects multi-dimensional information such as network equipment, network status, network anomalies, network equipment images and network protection, and uses this information to generate security, user, network equipment hardware and personnel abnormality warning information, and sends these warning information to the preset receiving terminal in real time to achieve rapid response and comprehensive protection. The embodiment of the present application helps to improve the efficiency and effectiveness of network security protection by integrating multiple information sources and intelligent analysis technologies. Through real-time monitoring and instant warnings, the security team can respond quickly to potential threats and reduce the damage caused by attacks. Combined with physical and network-level monitoring, a more comprehensive security protection system is formed to effectively resist attacks from different dimensions. Based on the warning information generated by data analysis, the security team can locate problems more accurately and avoid unnecessary waste of resources.

[0020] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present application more obvious and easy to understand, the specific implementation methods of the present application are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 A schematic diagram of a process of a network security protection method based on artificial intelligence provided by an embodiment of the present application is shown;

[0023] Figure 2 A schematic diagram of a process of another network security protection method based on artificial intelligence provided by an embodiment of the present application is shown;

[0024] Figure 3 A schematic diagram of a process of another network security protection method based on artificial intelligence provided by an embodiment of the present application is shown;

[0025] Figure 4 A schematic diagram of a process of another network security protection method based on artificial intelligence provided by an embodiment of the present application is shown;

[0026] Figure 5 A schematic diagram of a process of another network security protection method based on artificial intelligence provided by an embodiment of the present application is shown;

[0027] Figure 6A schematic diagram of the structure of an artificial intelligence-based network security protection platform provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0028] The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0029] In this embodiment, a network security protection method based on artificial intelligence is provided. Figure 1 As shown, the method includes:

[0030] Step 101, obtaining network equipment related information, network related information, network anomaly related information, network equipment image information, and network protection related information; wherein, the network equipment related information includes the cable information of network equipment access and the network equipment location information, the network related information includes the network access information and the network traffic information, the network anomaly related information includes the historical network attack times within a preset time period, the historical network failure times within a preset time period, and the historical abnormal user number within a preset time period, and the network equipment image information is the image information within a preset range of the network equipment.

[0031] Step 102: Generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate the network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device.

[0032] Step 103: Send the security abnormality warning information, user abnormality warning information, network device hardware abnormality warning information and personnel abnormality warning information to a preset receiving terminal.

[0033] The embodiment of the present application provides a network security protection method based on artificial intelligence, which aims to identify and warn potential network and physical security threats by collecting and analyzing multiple information sources. First, multiple information is collected. Network equipment related information: specifically, it can include the type, length, connection status of the cable connected to the device, and the location of the device in the physical space. This information helps to identify the physical layout and connection status of the device for subsequent diagnosis of hardware failure or physical intrusion. Network related information: specifically, it can cover network access points (such as IP addresses, MAC addresses), network traffic patterns (such as data packet types, sizes, and frequencies). This information is used to monitor the normal and abnormal network activities and help identify potential attack behaviors. Network anomaly related information: specifically, it can include the number of historical network attacks, the number of network failures, and the number of abnormal users. These data provide a long-term perspective on the health of the network and help identify trends and patterns. Image information of network devices: real-time images around network devices are captured through devices such as cameras. This helps to monitor physical access, such as unauthorized access attempts. Network protection related information: may include firewall rules, intrusion detection system (IDS) logs, security policies, etc. Then, based on the collected information, abnormal warnings of different dimensions are generated. Specifically, security abnormality warning information is generated based on network-related information and network protection-related information, user abnormality warning information is generated based on network abnormality-related information, network device hardware abnormality warning information is generated based on network device-related information and network device image information, and personnel abnormality warning information is generated based on network device image information. For example, security abnormality warning information is generated based on network traffic abnormalities, unauthorized access attempts, etc.; user abnormality warning information is generated based on abnormal user behavior (such as too many failed logins, access to sensitive resources, etc.); possible hardware failures or physical damage are identified in combination with device information and image information to generate network device hardware abnormality warning information; unauthorized personnel activities are identified based on image information around network devices to generate personnel abnormality warning information. Finally, the generated various abnormal warning information is sent to the preset receiving terminal (such as the security team, IT administrator's smartphone, email, etc.) for timely response.

[0034] By applying the technical solution of this embodiment, by collecting multi-dimensional information such as network equipment, network status, network anomalies, network equipment images and network protection, this information is used to generate security, user, network equipment hardware and personnel abnormality warning information, and these warning information are sent to the preset receiving terminal in real time to achieve rapid response and comprehensive protection. The embodiment of the present application helps to improve the efficiency and effectiveness of network security protection by integrating multiple information sources and intelligent analysis technologies. Through real-time monitoring and instant warnings, the security team can respond quickly to potential threats and reduce the damage caused by attacks. Combined with physical and network-level monitoring, a more comprehensive security protection system is formed to effectively resist attacks from different dimensions. Based on the warning information generated by data analysis, the security team can locate problems more accurately and avoid unnecessary waste of resources.

[0035] In the embodiment of the present application, optionally, Figure 2 As shown, in step 102, generating security abnormality warning information based on the network related information and the network protection related information includes:

[0036] Step 201: Rating the network access information to obtain access rating information, and rating the network traffic information to obtain traffic rating information.

[0037] Step 202: Based on the access rating information and the traffic rating information, obtain standard protection requirement information matching the access rating information and the traffic rating information in a standard protection requirement library, wherein the standard protection requirement library presets protection requirements corresponding to access rating information and traffic rating information of various levels.

[0038] Step 203: extract current protection requirement information from the network protection related information.

[0039] Step 204: Determine protection requirement evaluation information based on the standard protection requirement information and the current protection requirement information, wherein the protection requirement evaluation information is used to indicate whether the protection evaluation is passed.

[0040] Step 205: When the protection requirement evaluation information indicates that the protection evaluation fails, the security abnormality warning information is generated.

[0041] In the above embodiment, the network access information and the network flow information are rated to obtain the access rating information and the flow rating information respectively. Based on the access rating information and the flow rating information, the matching standard protection requirement information is searched in the standard protection requirement library. The standard protection requirement library pre-sets the protection requirements corresponding to the access and flow information of different levels, which ensures the pertinence and effectiveness of the protection measures. The current actual protection requirement information is extracted from the network protection related information, which reflects the actual state of the current network protection. The standard protection requirement information and the current protection requirement information are compared to generate the protection requirement evaluation information. This information is used to determine whether the current protection meets the standard requirements, that is, whether the protection evaluation is passed. If the protection requirement evaluation information indicates that the protection evaluation is not passed, that is, the current protection does not meet the standard requirements, then a security abnormality warning information is generated to remind relevant personnel to take measures to strengthen protection in a timely manner. The embodiment of the present application can more accurately identify potential security loopholes and weak links by rating the access information and flow information, and matching and evaluating in combination with the standard protection requirement library. At the same time, by comparing the difference between the current protection requirements and the standard requirements, it is possible to timely discover the lack of protection and generate security abnormality warning information, thereby prompting relevant personnel to respond quickly and take necessary protective measures. This will not only help improve the overall effectiveness of network security protection, but also effectively prevent the occurrence of network attacks and security incidents, providing a more solid guarantee for the network security of enterprises or organizations.

[0042] In an embodiment of the present application, optionally, the construction process of the standard protection requirements library includes: obtaining historical network-related information and historical protection information for historical network-related information, and constructing a training set, wherein the historical protection information includes various protection requirements in the standard protection requirements library; using the training set to train the protection model, and extracting the model parameters of the protection model after the training is completed, analyzing the protection requirements corresponding to different access quantity intervals and different network traffic intervals based on the model parameters and various protection requirements, determining the access ratings corresponding to different access quantity intervals and the traffic ratings corresponding to different network traffic intervals, and constructing the standard protection requirements library.

[0043] In the above embodiment, historical network related information and historical protection information for historical network related information are obtained, and the historical network related information at least includes access quantity information and network traffic information. The historical protection information is specifically an effective protection strategy for historical network related information confirmed by protection personnel, including firewall setting information, intrusion detection system configuration information, security policy information, etc. After preprocessing the historical network related information such as removing noise, processing missing values, and standardizing data, the protection model is trained using the preprocessed historical network related information and the corresponding historical protection information, so that the protection model can predict the corresponding protection information based on the network related information. Specifically, a suitable AI model can be selected according to actual needs and data characteristics, such as a deep learning model, a machine learning model, or a reinforcement learning model. After the training is completed, the model parameters of the protection model are extracted, and the model parameters are analyzed to determine the protection information corresponding to different access quantity intervals and network traffic intervals, and each access quantity interval and network traffic interval are graded to determine the protection information corresponding to different access ratings and traffic ratings, thereby constructing a standard protection requirement library containing protection requirements corresponding to access rating information and traffic rating information of each level.

[0044] In an embodiment of the present application, optionally, the network access information includes historical daily access user quantity information within a preset time period; the network traffic information includes historical daily network traffic information within a preset time period; step 201 includes: randomly selecting a preset number of access user quantity information from the historical daily access user quantity information, performing de-extreme value processing on the access user quantity information, calculating the mean of the access user quantity information after de-extreme value processing to obtain average access quantity information, and rating the average access quantity information to obtain the access rating information; randomly selecting the preset number of network traffic information from the historical daily network traffic information, performing de-extreme value processing on the network traffic information, calculating the mean of the network traffic information after de-extreme value processing to obtain average network traffic information, and rating the average network traffic information to obtain the traffic rating information.

[0045] In this embodiment, the process of obtaining access rating information is as follows: extracting the collected network access information, the network access information includes historical daily access user quantity information; randomly selecting x access user quantity information from the historical daily access user quantity information, removing the maximum value and the minimum value of the x access user quantity information, and calculating the mean of the remaining x-2 access user quantity information to obtain average access quantity information; rating the average access quantity information to obtain access rating information; when the average access quantity is greater than a preset value a1, obtaining access rating information, at which time the access rating information is a first-level access rating; when the average access quantity is between the preset values ​​a1 and a2, obtaining access rating information, at which time the access rating information is a second-level access rating; when the average access quantity is less than a2, obtaining access rating information, at which time the access rating information is a third-level access rating. The process of obtaining network traffic rating information is as follows: extract network traffic information, which is historical daily network traffic information; randomly select x network traffic information from the historical daily network traffic information, remove the maximum and minimum values ​​of the x network traffic information, calculate the mean of the remaining x-2 network traffic information, and obtain the average network traffic information; rate the average network traffic information and obtain the network traffic rating information; when the average access number is greater than the preset value b1, obtain the network traffic rating information, and the network traffic rating information is the first-level network traffic rating; when the average access number is between the preset values ​​b1 and b2, obtain the network traffic rating information, and the network traffic rating information is the second-level network traffic rating; when the average access number is less than the preset value b2, obtain the network traffic rating information, and the network traffic rating information is the third-level network traffic rating; x≥10, a1>a2, b1>b2. The above process first extracts network access information and network traffic information, and these two types of information together constitute a comprehensive view of the network security status. Through the comprehensive analysis of these two types of information, the security status of the network can be more accurately evaluated. By rating network access information and network traffic information, the process introduces a scientific rating system. This rating not only considers the absolute value of the data, but also reduces the impact of data fluctuations by removing the mean after removing extreme values ​​(maximum and minimum values), thereby improving the accuracy of the rating. By matching the access rating information and traffic rating information with the standard protection requirements library, the process ensures the standardization of network security protection. This standardization helps to formulate and implement consistent protection strategies and reduces security risks caused by differences in human judgment. The process can extract current protection requirement information in real time and compare and evaluate it with standard protection requirement information. If it is found that the protection requirements do not meet the standards, security abnormality warning information is generated, which helps to promptly discover and respond to potential security threats. The rating standards and protection requirements library in the process can be adjusted and updated according to actual conditions.This flexibility and scalability enables the method to adapt to the ever-changing network security environment and business needs. By regularly evaluating network access information and network traffic information and issuing timely warnings when protection requirements are not met, the method embodies a preventive and proactive security strategy. This strategy helps to discover and resolve problems before the network is attacked, thereby reducing security risks.

[0046] In an embodiment of the present application, optionally, the standard protection requirement information includes standard firewall setting information, standard intrusion detection system configuration information and standard security policy information, and the current protection requirement information includes current firewall setting information, current intrusion detection system configuration information and current security policy information; step 204 includes: comparing the current firewall setting information in the current protection requirement information with the standard firewall setting information in the standard protection requirement information to obtain firewall comparison similarity; comparing the current intrusion detection system configuration information in the current firewall requirement information with the standard intrusion detection system configuration information in the standard protection requirement information to obtain intrusion detection system configuration comparison similarity; comparing the current security policy information in the current firewall requirement information with the standard security policy information in the standard protection requirement information to obtain security policy comparison similarity; if the firewall comparison similarity is greater than a preset firewall similarity value, the intrusion detection system configuration comparison similarity is greater than a preset intrusion detection similarity value, and the security policy comparison similarity is greater than a preset security policy similarity value, then generating protection requirement evaluation information indicating that the protection evaluation has passed; otherwise generating protection requirement evaluation information indicating that the protection evaluation has failed.

[0047] In the above embodiment, the acquired standard protection requirement information and the current protection requirement information are extracted; both the standard protection requirement information and the current protection requirement information include firewall settings, intrusion detection system configurations and security policies; the firewall settings in the current protection requirement information are compared with the firewall settings in the standard protection requirement information to obtain firewall comparison information, and the firewall comparison information is the firewall comparison similarity; the intrusion detection system configuration in the current protection requirement information is compared with the intrusion detection system configuration in the standard protection requirement information to obtain intrusion detection system configuration comparison information, and the intrusion detection system configuration comparison information is the intrusion detection system configuration comparison information. Similarity; compare the security policy in the current protection requirement information with the security policy in the standard protection requirement information to obtain security policy comparison information, which is the security policy comparison similarity; when the firewall comparison similarity is greater than the preset value, the intrusion detection system configuration comparison similarity is greater than the preset value, and the security policy comparison similarity is greater than the preset value, the protection assessment is passed; when the firewall comparison similarity is greater than the preset value, the intrusion detection system configuration comparison similarity is greater than the preset value, and the security policy comparison similarity is greater than the preset value, any one of the above does not appear, the protection assessment is not passed, so that the platform can further add effective protection strategies based on this information. Through the above process, it is possible to intuitively understand whether the protection requirements of the current platform meet the corresponding standard requirements. The process has a high degree of automation, can reduce the subjectivity of manual intervention and judgment, and improve management efficiency. At the same time, by generating security abnormality warning information, it helps network security managers to quickly locate problems and take corresponding measures. The above process used to obtain abnormal security warning information in network security protection has the advantages of comprehensive data analysis and evaluation, scientific rating system, standardized protection requirements, real-time evaluation and early warning, flexibility and scalability, preventive and proactive, and improved management efficiency. These advantages make this method have broad application prospects and practical value in network security protection.

[0048] In an embodiment of the present application, optionally, in step 102, user abnormality warning information is generated based on the network abnormality related information, including: if one or more of the following conditions is met: the historical network attack times information is greater than a preset value of the network attack times, the historical network failure times information is greater than a preset value of the network failure times, and the historical abnormal user number information is greater than a preset value of the abnormal user number, then the user abnormality warning information is generated.

[0049] In the above embodiment, the collected network anomaly related information is extracted, and the network anomaly related information includes information on the number of times the network is attacked within a preset time period, information on the number of network failures within a preset time period, and information on the number of abnormal users; when the number of times the network is attacked within the preset time period is greater than a preset value, user abnormality warning information is generated; when the number of network failures within the preset time period is greater than a preset value, user abnormality warning information is generated; when the number of abnormal users is greater than a preset value, user abnormality warning information is generated.

[0050] In the embodiment of the present application, optionally, Figure 3 The step 101 of obtaining the historical abnormal user quantity information includes:

[0051] Step 301: Collect access user information of users who access within the preset time period, wherein the access user information includes access times of each user, network traffic information used by each user for each access, network logs of each user, and the number of illegal users;

[0052] Step 302: compare the access times of each user with the preset access times;

[0053] Step 303: If the number of user accesses of any user is less than or equal to the preset number of accesses, the network traffic information used for each access of the user is analyzed. If the network traffic used for each access of the user is greater than the preset traffic, the user is determined to be a first abnormal user.

[0054] Step 304: if the number of user accesses of any user is greater than the preset value of the number of accesses, the average access traffic of the user is calculated according to the network traffic information used for each access of the user, and the number of times the network traffic used by the user exceeds a preset multiple of the average access traffic is determined according to the network traffic information used for each access of the user and the average access traffic, and when the number is greater than the preset number threshold, the user is determined to be a second abnormal user;

[0055] Step 305: Analyze the network logs of each user to identify whether each user has abnormal behaviors and activities, and determine the users with abnormal behaviors and activities as third abnormal users, wherein the abnormal behaviors and activities include the number of connection requests exceeding the preset number of connection requests, the number of login behaviors exceeding the preset number of login behaviors, the data transmission volume exceeding the preset data transmission volume, and the number of data transmissions exceeding the preset number of data transmissions;

[0056] Step 306: Calculate the sum of the number of the first abnormal users, the number of the second abnormal users, the number of the third abnormal users and the number of the illegal users to obtain the abnormal user number information;

[0057] Among them, the method for determining the illegal users is: after any user accesses the network, use port scanning software to perform port scanning on the user's device, compare the known port status and port scanning results, determine whether there are unauthorized open ports and remote services, and determine that the user is an illegal user when there are unauthorized open ports and remote services.

[0058] In the above embodiment, the access user information is collected for the accessed users, and the access user information includes the number of access times, the network traffic information used for each access, and the number of illegal users; when the number of user access times is less than the preset value, the network traffic information used for each access is analyzed. When the network traffic information used for each access is greater than the preset traffic, it is determined that the user is an abnormal user, and the number of such users is recorded and marked as Y1 (the first abnormal user); when the number of user access times is greater than the preset value, the network traffic information used for each access is analyzed to obtain the average traffic used for access. Then, the number of times the network traffic used by the user exceeds two times the average traffic within the preset time is recorded. When the number of times the network traffic used exceeds two times the average traffic is greater than the preset value, it is determined to be an abnormal user, and the number of such users is recorded and marked as Y2 (the second abnormal user); the user's network log is analyzed to find abnormal behaviors and activities. Abnormal behaviors and activities include a large number of connection requests, frequent login behaviors and abnormal data transmission. When the user has any abnormal behavior, it is determined that the user violates the rules, and the number of such users is recorded and marked as Y3 (the third abnormal user); the process of obtaining the number of violating users is as follows: Use port scanning software to scan the user The device of the user is scanned for ports to identify possible illegal external connection behaviors. That is, by comparing the known port status with the scanning results, it can be determined whether there are unauthorized open ports and remote services. When there are unauthorized open ports and remote services, it is determined that the user is in violation, and the number of such users is recorded and marked as Y4 (illegal users); the sum of Y1, Y2, Y3 and Y4 is recorded, that is, the number of illegal users is obtained; the above process can enhance the network security monitoring capability. By real-time monitoring the number of attacks on the network, the number of network failures and the number of abnormal users, the process significantly enhances the comprehensiveness and real-time nature of network security monitoring. This monitoring capability helps to timely discover potential security threats and take quick measures to respond, improving the accuracy of anomaly detection. The process uses a variety of methods to identify abnormal users, including analyzing the number of access times, network traffic, illegal external connection behaviors and abnormal behaviors in logs. The multi-dimensional analysis method improves the accuracy of anomaly detection and reduces the possibility of false positives and false negatives. Once a network anomaly or illegal user is detected, the process can immediately generate user abnormality warning information. This rapid response capability helps to curb the spread of security threats in a timely manner and reduce losses.

[0059] In the embodiment of the present application, optionally, the cable information accessed by the network device includes cable physical information and cable path interference information; Figure 4 As shown, in step 102, the network device hardware abnormality warning information is generated based on the network device related information and the image information of the network device, including:

[0060] Step 401: Analyze the cable physical information, determine the cable physical parameters, and evaluate whether the cable physical parameters are abnormal, wherein the cable physical information includes the cable usage time, cable length, and the number of cable fixing devices;

[0061] Step 402: Determine a network device location deviation value based on the network device location information and the network device standard location, and evaluate whether the network device location deviation value is abnormal;

[0062] Step 403: Count the number of abnormal devices in the cable path interference information to determine the number of abnormal devices, and evaluate whether the number of abnormal devices is abnormal, wherein the cable path interference information includes abnormal device information within a preset range of the cable path;

[0063] Step 404: Analyze the image information of the network device to determine the number of people that appear within a preset range of the network device within a preset time period, and evaluate whether the number of people information is abnormal;

[0064] Step 405: When one or more of the cable physical parameters, the network device position deviation value, the number of abnormal devices, and the number of personnel information is abnormal, generate the network device hardware abnormality warning information.

[0065] In this embodiment, information related to the terminal device is extracted, and the information related to the terminal device includes cable information connected to the terminal device, terminal device location information and surrounding image information of the terminal device; the cable information connected to the terminal device is analyzed, and the cable information connected to the terminal device includes cable physical information, cable transmission information and cable path interference information; the cable physical information is first analyzed, and the cable physical information includes the time the cable is put into use, the length of the cable and the number of cable fixing devices, and the time the cable is put into use, the length of the cable and the number of cable fixing devices are processed to obtain the cable physical parameters; the location information of the terminal device is processed, and the location information of the terminal device is the real-time location information of the terminal device, and the deviation between the real-time location information of the terminal device and the preset standard location is monitored to obtain the deviation value; the cable path interference information is processed, and the cable path interference information is the abnormal equipment within the preset range of the cable path, and the number of abnormal equipment is collected to obtain the number of abnormal equipment; the surrounding image information of the terminal device is analyzed, and the number of personnel appearing in the image information of the terminal device within the preset time is collected; when any one of the cable physical parameter abnormality, the deviation value abnormality, the abnormal number of abnormal equipment and the abnormal number of personnel information occurs, the network device hardware abnormality warning information is generated. Through the above process, potential hardware problems can be warned in advance. By analyzing the cable information connected to the terminal device (including cable physical information, cable transmission information and cable path interference information), potential problems such as cable aging and unstable fixation can be discovered in time, thereby avoiding network interruption or performance degradation caused by such problems. Physical security monitoring is enhanced. By monitoring the deviation between the real-time location information of the terminal device and the preset standard location, and analyzing the number of personnel information appearing in the surrounding image information of the terminal device, unauthorized device movement or personnel activities can be discovered in time, enhancing physical security protection. The risk of external interference is reduced. The processing of cable path interference information, especially the number of abnormal devices within the preset range of the cable path, helps to identify devices that may cause electromagnetic interference or other forms of interference, so as to take corresponding measures to reduce the impact of interference on network devices. Improve the speed of anomaly detection and response. This process combines multiple data sources and analysis methods to detect abnormal conditions of network device hardware more comprehensively. Once an anomaly is detected, network device hardware abnormality warning information is immediately generated, which helps to improve the speed of anomaly detection and response and reduce fault recovery time.

[0066] In an embodiment of the present application, optionally, step 401 includes: calculating the ratio between the cable length and the number of cable fixing devices to obtain an evaluation ratio, and combining the evaluation ratio and the cable use time as the cable physical parameter; if the cable use time is greater than a first use time preset value or the evaluation ratio is greater than a first evaluation ratio preset value, it is determined that the cable physical parameter is abnormal; if the cable use time is greater than a second use time preset value, and the evaluation ratio is greater than a second evaluation ratio preset value, it is determined that the cable physical parameter is abnormal; wherein, the first use time preset value is greater than the second use time preset value, and the first evaluation ratio preset value is greater than the second evaluation ratio preset value;

[0067] Step 402 includes: if the network device position deviation value is greater than a preset position deviation value, determining that the network device position deviation value is abnormal;

[0068] Step 403 includes: based on the cable path interference information, obtaining the number of first devices with electromagnetic intensity greater than a preset electromagnetic intensity and the number of second devices with temperature greater than a preset temperature within a preset range of the cable path, calculating the sum of the number of the first devices and the number of the second devices to obtain the number of abnormal devices; if the number of abnormal devices is greater than a preset value of the number of abnormal devices, determining that the number of abnormal devices is abnormal;

[0069] Step 404 includes: if the personnel quantity information is greater than a preset personnel quantity value, determining that there is an abnormality in the personnel quantity information.

[0070] In the above embodiment, the process of obtaining the physical parameters of the cable and the process of judging the abnormality are as follows: extract the time the cable is put into use, the length of the cable and the number of cable fixing devices; calculate the ratio between the length of the cable and the number of cable fixing devices, and obtain the evaluation ratio; the time the cable is put into use and the evaluation ratio constitute the cable physical parameters. When the time the cable is put into use is greater than the preset value m1 or the evaluation ratio is greater than the preset value q1, it means that the cable physical parameters are abnormal; when the time the cable is put into use is greater than the preset value m2 and the evaluation ratio is greater than the preset value q2, it means that the cable physical parameters are abnormal; m1>m2, q1>q2. When the network device position deviation value is greater than the preset value, it means that it is abnormal. The process of obtaining the number of abnormal devices and the process of judging the abnormality are as follows: collect the electromagnetic strength within the preset range of the cable path greater than the preset number and the temperature greater than the preset number, calculate the sum of the electromagnetic strength greater than the preset number and the temperature greater than the preset number, and obtain the number of abnormal devices; when the number of abnormal devices is greater than the preset value, it means that it is abnormal. The number of personnel information greater than the preset value indicates that it is abnormal. The above process can accurately identify physical abnormalities of cables: By comprehensively considering the length of time the cable has been in use, the ratio between the cable length and the number of cable fixing devices (assessment ratio), the physical abnormalities of the cable can be identified more accurately. By collecting electromagnetic strength and temperature information within the preset range of the cable path and calculating the number of abnormal devices, the system can more sensitively identify external interference sources. This helps to take timely measures to reduce interference and protect the normal operation of network equipment. Improve the efficiency of abnormal detection and response. This process includes various situations such as abnormal cable physical parameters, abnormal deviation values, abnormal number of abnormal devices, and abnormal number of personnel information into the monitoring scope. Once an abnormality is detected, a warning message can be quickly generated. This helps to improve the efficiency of abnormal detection and response and reduce fault recovery time.

[0071] In the embodiment of the present application, optionally, Figure 5 As shown, in step 102, generating personnel abnormality warning information based on the image information of the network device includes:

[0072] Step 501: Import the image information of the network device into a human body recognition model to perform human body recognition. After the human body is recognized, collect face information from the image information of the network device, compare the collected face information with face information in a preset face information database, and determine whether the collected face information is face information of a network equipment maintenance personnel stored in the preset face information database;

[0073] Step 502: when the collected facial information does not belong to the facial information of the network equipment maintenance personnel, record the length of time the human body stays within the preset range of the network equipment, and when the length of time is greater than a first preset length of time, perform hand position recognition on the human body, and when it is detected that the distance between the hand position of the human body and the network equipment is less than a preset distance value, generate abnormal warning information of the personnel;

[0074] Step 503: When the stay time is greater than a second stay time preset value, generating the personnel abnormality warning information, wherein the first stay time preset value is less than the second stay time preset value.

[0075] In the above embodiment, the collected image information of the network device is extracted, and the image information of the network device is the image information within the preset range of the network device; the human body model is imported into the image information within the preset range of the network device to perform human body recognition. After the human body is recognized, face information is collected, and the face information is imported into a preset database. The face information is compared from the preset database to see whether it is a network device maintenance personnel stored in the preset database. When it is a network device maintenance personnel, no information is generated; when it is not a network device maintenance personnel, the length of time the person stays within the preset range of the network device is recorded. When the length of time the person stays is greater than the preset value t1, the hand position is monitored in real time to detect the distance information between the hand position and the network device. When the distance information between the hand position and the network device is less than the preset value, abnormal personnel warning information is generated; when the length of time the person stays within the preset range of the network device is greater than the preset value t2, abnormal personnel warning information is directly generated. The above process can enhance the physical security monitoring capability. By collecting the image information of network equipment and importing the human body model for human body recognition, the system can monitor the activities of personnel within the preset range of network equipment in real time. This helps to detect unauthorized personnel entering sensitive areas in a timely manner, thereby enhancing the physical level of security protection capabilities. Improve the accuracy of personnel identification. The system can accurately identify legitimate maintenance personnel and illegal intruders by collecting facial information and comparing it with the network equipment maintenance personnel in the preset database. This high-precision identity recognition method helps to reduce false alarms and missed alarms and improve the reliability of security protection. Respond to potential threats in a timely manner. When the system recognizes that non-network equipment maintenance personnel stay in the preset range for too long, or their behavior shows a potential threat to network equipment (such as the position of their hands close to the network equipment), the system can quickly generate personnel abnormality warning information. This helps managers take timely measures to prevent potential security incidents.

[0076] By applying the technical solution of this embodiment, the network security protection process has the advantages of comprehensive data analysis and evaluation, scientific rating system, standardized protection requirements, real-time evaluation and early warning, flexibility and scalability, preventive and proactive, and improved management efficiency; the acquisition process of user abnormal warning information and the method for acquiring abnormal user quantity information have real-time monitoring and early warning, multi-dimensional analysis and refined identification of abnormal users, which constitute a solid foundation for network security protection and help protect the network from various security threats; it brings significant benefits by early warning of potential hardware problems, enhancing physical security monitoring, reducing external interference risks, improving abnormal detection and response speed, and enhancing overall network security protection capabilities, thereby improving the security, reliability and stability of the network; when the system recognizes that non-network equipment maintenance personnel stay in the preset range for too long, or their behavior shows a potential threat to network equipment, the system can quickly generate personnel abnormal warning information. This helps managers take timely measures to prevent potential security incidents.

[0077] Further, as Figure 1 The specific implementation of the method, the embodiment of the present application provides a network security protection platform based on artificial intelligence, such as Figure 6 As shown, the device comprises:

[0078] The terminal device collection module is used to collect network device related information, wherein the network device related information includes the cable information connected to the network device and the network device location information;

[0079] The network-related collection module is used to collect network-related information, wherein the network-related information includes network access information and network traffic information

[0080] A network anomaly collection module is used to collect information related to network anomalies, wherein the information related to network anomalies includes information on the number of historical network attacks within a preset time period, information on the number of historical network failures within a preset time period, and information on the number of historical abnormal users within a preset time period;

[0081] A device image acquisition module, used to acquire image information of network devices, wherein the image information of the network devices is image information within a preset range of the network devices;

[0082] Protection information collection module, used to collect network protection related information;

[0083] a warning information generation module, configured to generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device;

[0084] The warning information push module is used to send security abnormality warning information, user abnormality warning information, network equipment hardware abnormality warning information and personnel abnormality warning information to the preset receiving terminal.

[0085] In the embodiment of the present application, optionally, the warning information generating module is further used to:

[0086] Rating the network access information to obtain access rating information, and rating the network traffic information to obtain traffic rating information;

[0087] Based on the access rating information and the traffic rating information, obtaining standard protection requirement information matching the access rating information and the traffic rating information in a standard protection requirement library, wherein the standard protection requirement library presets protection requirements corresponding to access rating information and traffic rating information of various levels;

[0088] Extracting current protection requirement information from the network protection related information;

[0089] Determine protection requirement evaluation information based on the standard protection requirement information and the current protection requirement information, wherein the protection requirement evaluation information is used to indicate whether the protection evaluation is passed;

[0090] When the protection requirement evaluation information indicates that the protection evaluation fails, the security abnormality warning information is generated.

[0091] In the embodiment of the present application, optionally, the warning information generating module is further used to:

[0092] Acquire historical network related information and historical protection information for the historical network related information to construct a training set, wherein the historical protection information includes various protection requirements in the standard protection requirement library;

[0093] The protection model is trained using the training set, and the model parameters of the protection model are extracted after the training is completed. Based on the model parameters and various protection requirements, the protection requirements corresponding to different access quantity intervals and different network traffic intervals are analyzed, the access ratings corresponding to different access quantity intervals and the traffic ratings corresponding to different network traffic intervals are determined, and the standard protection requirements library is constructed.

[0094] In the embodiment of the present application, optionally, the network access information includes historical daily access user quantity information within a preset time period; the network traffic information includes historical daily network traffic information within a preset time period;

[0095] The warning information generating module is further used for:

[0096] Randomly selecting a preset number of access user quantity information from the historical daily access user quantity information, performing de-extreme value processing on the access user quantity information, calculating the mean value of the access user quantity information after de-extreme value processing to obtain average access quantity information, and rating the average access quantity information to obtain the access rating information;

[0097] The preset number of network traffic information is randomly selected from the historical daily network traffic information, the network traffic information is de-extremely processed, the mean of the de-extremely processed network traffic information is calculated to obtain the average network traffic information, and the average network traffic information is rated to obtain the traffic rating information.

[0098] In an embodiment of the present application, optionally, the standard protection requirement information includes standard firewall setting information, standard intrusion detection system configuration information and standard security policy information, and the current protection requirement information includes current firewall setting information, current intrusion detection system configuration information and current security policy information;

[0099] The warning information generating module is further used for:

[0100] Comparing the current firewall setting information in the current protection requirement information with the standard firewall setting information in the standard protection requirement information to obtain a firewall comparison similarity;

[0101] Comparing the current intrusion detection system configuration information in the current firewall requirement information with the standard intrusion detection system configuration information in the standard protection requirement information to obtain an intrusion detection system configuration comparison similarity;

[0102] Comparing the current security policy information in the current firewall requirement information with the standard security policy information in the standard protection requirement information to obtain a security policy comparison similarity;

[0103] If the firewall comparison similarity is greater than a preset firewall similarity value, the intrusion detection system configuration comparison similarity is greater than a preset intrusion detection similarity value, and the security policy comparison similarity is greater than a preset security policy similarity value, then generating protection requirement assessment information indicating that the protection assessment has passed;

[0104] Otherwise, protection requirement assessment information indicating that the protection assessment fails is generated.

[0105] In the embodiment of the present application, optionally, the warning information generating module is further used to:

[0106] If one or more of the following conditions is met: the number of historical network attacks is greater than a preset number of network attacks, the number of historical network failures is greater than a preset number of network failures, and the number of historical abnormal users is greater than a preset number of abnormal users, the user abnormality warning information is generated.

[0107] In the embodiment of the present application, optionally, the terminal device acquisition module is further used to:

[0108] Collecting access user information of users who access within the preset time period, wherein the access user information includes access times of each user, network traffic information used by each user for each access, network logs of each user, and the number of users who violate the rules;

[0109] Compare the relationship between the number of user accesses of each user and the preset number of accesses;

[0110] If the number of user accesses of any user is less than or equal to the preset number of accesses, the network traffic information used for each access of the user is analyzed, and when the network traffic used for each access of the user is greater than the preset traffic, the user is determined to be a first abnormal user;

[0111] If the number of user accesses of any user is greater than the preset value of the number of accesses, the average access traffic of the user is calculated according to the network traffic information used for each access of the user, and the number of times the network traffic used by the user exceeds the preset multiple of the average access traffic is determined according to the network traffic information used for each access of the user and the average access traffic, and when the number is greater than the preset number threshold, the user is determined to be a second abnormal user;

[0112] Analyze the network logs of each user to identify whether each user has abnormal behaviors and activities, and determine the users with abnormal behaviors and activities as third abnormal users, wherein the abnormal behaviors and activities include the number of connection requests exceeding the preset number of connection requests, the number of login behaviors exceeding the preset number of login behaviors, the data transmission volume exceeding the preset data transmission volume, and the number of data transmissions exceeding the preset number of data transmissions;

[0113] Calculate the number of the first abnormal users, the number of the second abnormal users, the number of the third abnormal users and the number of the illegal users to obtain the abnormal user number information;

[0114] Among them, the method for determining the illegal users is: after any user accesses the network, use port scanning software to perform port scanning on the user's device, compare the known port status and port scanning results, determine whether there are unauthorized open ports and remote services, and determine that the user is an illegal user when there are unauthorized open ports and remote services.

[0115] In an embodiment of the present application, optionally, the cable information accessed by the network device includes cable physical information and cable path interference information;

[0116] The warning information generating module is further used for:

[0117] Analyze the cable physical information to determine the cable physical parameters, and evaluate whether the cable physical parameters are abnormal, wherein the cable physical information includes the length of time the cable has been in use, the length of the cable, and the number of cable fixing devices;

[0118] Determine the network device location deviation value according to the network device location information and the network device standard location, and evaluate whether the network device location deviation value is abnormal;

[0119] Counting the number of abnormal devices in the cable path interference information to determine the number of abnormal devices, and evaluating whether the number of abnormal devices is abnormal, wherein the cable path interference information includes abnormal device information within a preset range of the cable path;

[0120] Analyze the image information of the network device to determine the number of people that appear within a preset range of the network device within a preset time period, and evaluate whether there is any abnormality in the number of people information;

[0121] When one or more of the cable physical parameters, the network device position deviation value, the number of abnormal devices, and the number of personnel information is abnormal, the network device hardware abnormality warning information is generated.

[0122] In the embodiment of the present application, optionally, the warning information generating module is further used to:

[0123] Calculating the ratio between the cable length and the number of the cable fixing devices to obtain an evaluation ratio, and combining the evaluation ratio and the length of time the cable has been in use as the cable physical parameter;

[0124] If the cable has been in use for a period of time longer than a first preset usage period or the evaluation ratio is greater than a first preset evaluation ratio, it is determined that the cable physical parameter is abnormal;

[0125] If the cable has been in use for a period of time longer than a second preset usage period, and the evaluation ratio is greater than a second preset evaluation ratio value, it is determined that the cable physical parameter is abnormal; wherein the first preset usage period value is greater than the second preset usage period value, and the first preset evaluation ratio value is greater than the second preset evaluation ratio value;

[0126] Evaluate whether the network device location deviation value is abnormal, including:

[0127] If the network device position deviation value is greater than a preset position deviation value, it is determined that the network device position deviation value is abnormal;

[0128] Counting the number of abnormal devices in the cable path interference information to determine the number of abnormal devices, and evaluating whether the number of abnormal devices is abnormal, including:

[0129] Based on the cable path interference information, the number of first devices with electromagnetic intensity greater than a preset electromagnetic intensity and the number of second devices with temperature greater than a preset temperature within a preset range of the cable path are obtained, and the number of abnormal devices is obtained by calculating the sum of the number of the first devices and the number of the second devices;

[0130] If the number of abnormal devices is greater than a preset value of the number of abnormal devices, it is determined that the number of abnormal devices is abnormal;

[0131] Evaluate whether there are any anomalies in the personnel quantity information, including:

[0132] If the personnel quantity information is greater than the preset personnel quantity value, it is determined that there is an abnormality in the personnel quantity information.

[0133] In the embodiment of the present application, optionally, the warning information generating module is further used to:

[0134] The image information of the network device is imported into a human body recognition model for human body recognition. After the human body is recognized, facial information is collected from the image information of the network device, and the collected facial information is compared with facial information in a preset facial information database to determine whether the collected facial information is facial information of a network equipment maintenance personnel stored in the preset facial information database.

[0135] When the collected facial information does not belong to the facial information of the network equipment maintenance personnel, the length of time the human body stays within the preset range of the network equipment is recorded; when the length of time is greater than a first preset length of time, the hand position of the human body is identified; and when it is detected that the distance between the hand position of the human body and the network equipment is less than a preset distance value, the abnormal warning information of the personnel is generated;

[0136] When the stay duration is greater than a second stay duration preset value, the personnel abnormality warning information is generated, wherein the first stay duration preset value is less than the second stay duration preset value.

[0137] This AI-based network security protection platform has demonstrated a number of significant advantages in the complex process of network security protection, providing strong support for the comprehensive protection of the network environment. First of all, its data comprehensive analysis and evaluation capabilities can integrate massive network data from different sources, and use advanced artificial intelligence algorithms for deep mining and intelligent analysis, so as to accurately identify potential security threats. The establishment of a scientific rating system scientifically classifies network risks based on the analysis results, providing a reliable basis for the formulation of security protection strategies. In addition, the platform follows standardized protection requirements to ensure the consistency and effectiveness of various protection measures, reducing security risks caused by operational differences.

[0138] The real-time assessment and early warning mechanism is a highlight of the platform. It can monitor the network status in real time and immediately trigger an early warning once an abnormality is found, effectively shortening the response time of security incidents. At the same time, the platform is highly flexible and scalable, and can flexibly adjust the protection strategy according to changes in the network environment and the growth of user needs to ensure the continued effectiveness of the protection system. Prevention and initiative are the core of the platform's protection strategy. By actively detecting potential threats and taking measures to intervene in advance, security risks can be nipped in the bud.

[0139] In terms of improving management efficiency, the platform has greatly reduced the workload of managers and improved work efficiency through automated and intelligent management methods. In particular, in the process of obtaining abnormal user warning information, the platform can monitor user behavior in real time and use multi-dimensional analysis technology, such as time, location, and behavior patterns, to finely identify abnormal users, effectively preventing the intrusion of malicious users and illegal operations by internal personnel. This mechanism constitutes a solid foundation for network security protection and greatly enhances the network's ability to resist various security threats.

[0140] In addition, the platform also demonstrates outstanding capabilities in hardware security monitoring, effectively avoiding network interruptions caused by hardware failures by providing early warnings of potential hardware problems, such as device overheating and performance degradation. At the same time, enhanced physical security monitoring, such as using smart cameras and sensors to monitor key areas, further reduces the risk of external interference and physical intrusion. The platform also significantly improves the security, reliability and stability of the network by increasing the speed of anomaly detection and response, as well as enhancing overall network security protection capabilities.

[0141] It is particularly worth mentioning that when the system uses intelligent recognition technology to find that non-network equipment maintenance personnel stay in the preset range for too long, or their behavior patterns show potential threats to network equipment, it can immediately generate personnel abnormality warning information and notify managers. This function not only helps to timely discover and prevent potential security incidents, but also provides valuable decision-making support for managers, allowing them to quickly take necessary preventive measures to ensure the security and stability of the network environment. In summary, this AI-based network security protection platform, with its comprehensive and in-depth protection capabilities, has laid a solid foundation for the safe development of cyberspace.

[0142] It should be noted that for other corresponding descriptions of the functional units involved in the network security protection device based on artificial intelligence provided in the embodiment of the present application, please refer to Figure 1 to Figure 2 The corresponding description in the method will not be repeated here.

[0143] The embodiment of the present application also provides a computer device, which can be a personal computer, a server, a network device, etc. The computer device includes a bus, a processor, a memory and a communication interface, and can also include an input and output interface and a display device. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store location information. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, the steps in each method embodiment are implemented.

[0144] Those skilled in the art will appreciate that the structure of the above-mentioned computer device is only a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components, or combine certain components, or have a different arrangement of components.

[0145] In one embodiment, a computer-readable storage medium is provided. The computer-readable storage medium may be non-volatile or volatile, and stores a computer program thereon. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0146] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0147] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0148] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0149] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0150] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security protection method based on artificial intelligence, characterized in that: The method comprises: Obtaining network equipment related information, network related information, network anomaly related information, network equipment image information, and network protection related information; wherein the network equipment related information includes network equipment access cable information and network equipment location information, the network related information includes network access information and network traffic information, the network anomaly related information includes historical network attack times within a preset time period, historical network failure times within a preset time period, and historical abnormal user quantity within a preset time period, and the network equipment image information is image information within a preset range of the network equipment; Generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate the network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device; Send security abnormality warning information, user abnormality warning information, network equipment hardware abnormality warning information and personnel abnormality warning information to the preset receiving terminal; Wherein, generating the security abnormality warning information based on the network-related information and the network protection-related information includes: rating the network access information to obtain access rating information, and rating the network traffic information to obtain traffic rating information; based on the access rating information and the traffic rating information, acquiring standard protection requirement information matching the access rating information and the traffic rating information in a standard protection requirement library, wherein the standard protection requirement library presets protection requirements corresponding to access rating information and traffic rating information of various levels; extracting current protection requirement information from the network protection-related information; based on the standard protection requirement information and the current protection requirement information, determining protection requirement evaluation information, wherein the protection requirement evaluation information is used to indicate whether the protection evaluation is passed; when the protection requirement evaluation information indicates that the protection evaluation is not passed, generating the security abnormality warning information; Among them, based on the access rating information and the traffic rating information, before obtaining the standard protection requirement information matching the access rating information and the traffic rating information in the standard protection requirement library, the method also includes: obtaining historical network-related information and historical protection information for historical network-related information, and constructing a training set, wherein the historical protection information includes various protection requirements in the standard protection requirement library; using the training set to train the protection model, and extracting the model parameters of the protection model after the training is completed, analyzing the protection requirements corresponding to different access quantity intervals and different network traffic intervals based on the model parameters and various protection requirements, determining the access ratings corresponding to different access quantity intervals and the traffic ratings corresponding to different network traffic intervals, and constructing the standard protection requirement library.

2. The method according to claim 1, characterized in that The network access information includes the historical daily access user quantity information within a preset time period; the network traffic information includes the historical daily network traffic information within a preset time period; Rating the network access information to obtain access rating information includes: Randomly selecting a preset number of access user quantity information from the historical daily access user quantity information, performing de-extreme value processing on the access user quantity information, calculating the mean value of the access user quantity information after de-extreme value processing to obtain average access quantity information, and rating the average access quantity information to obtain the access rating information; Rating the network traffic information to obtain traffic rating information includes: The preset number of network traffic information is randomly selected from the historical daily network traffic information, the network traffic information is de-extremely processed, the mean of the de-extremely processed network traffic information is calculated to obtain the average network traffic information, and the average network traffic information is rated to obtain the traffic rating information.

3. The method according to claim 1, characterized in that: The standard protection requirement information includes standard firewall setting information, standard intrusion detection system configuration information and standard security policy information, and the current protection requirement information includes current firewall setting information, current intrusion detection system configuration information and current security policy information; Determining protection requirement evaluation information based on the standard protection requirement information and the current protection requirement information includes: Comparing the current firewall setting information in the current protection requirement information with the standard firewall setting information in the standard protection requirement information to obtain a firewall comparison similarity; Comparing the current intrusion detection system configuration information in the current firewall requirement information with the standard intrusion detection system configuration information in the standard protection requirement information to obtain an intrusion detection system configuration comparison similarity; Comparing the current security policy information in the current firewall requirement information with the standard security policy information in the standard protection requirement information to obtain a security policy comparison similarity; If the firewall comparison similarity is greater than a preset firewall similarity value, the intrusion detection system configuration comparison similarity is greater than a preset intrusion detection similarity value, and the security policy comparison similarity is greater than a preset security policy similarity value, then generating protection requirement assessment information indicating that the protection assessment has passed; Otherwise, protection requirement assessment information indicating that the protection assessment fails is generated.

4. The method according to claim 1, characterized in that: Generating user abnormality warning information based on the network abnormality related information includes: If one or more of the following conditions are met: the number of times the network has been attacked in history is greater than a preset value of the number of times the network has been attacked, the number of times the network has been faulted in history is greater than a preset value of the number of times the network has been faulted, or the number of times the number of abnormal users in history is greater than a preset value of the number of abnormal users, then the abnormal user warning information is generated; Among them, obtaining historical abnormal user quantity information includes: Collecting access user information of users who access within the preset time period, wherein the access user information includes access times of each user, network traffic information used by each user for each access, network logs of each user, and the number of users who violate the rules; Compare the relationship between the number of user accesses of each user and the preset number of accesses; If the number of user accesses of any user is less than or equal to the preset number of accesses, the network traffic information used for each access of the user is analyzed, and when the network traffic used for each access of the user is greater than the preset traffic, the user is determined to be a first abnormal user; If the number of user accesses of any user is greater than the preset value of the number of accesses, the average access traffic of the user is calculated according to the network traffic information used for each access of the user, and the number of times the network traffic used by the user exceeds the preset multiple of the average access traffic is determined according to the network traffic information used for each access of the user and the average access traffic, and when the number is greater than the preset number threshold, the user is determined to be a second abnormal user; Analyze the network logs of each user to identify whether each user has abnormal behaviors and activities, and determine the users with abnormal behaviors and activities as third abnormal users, wherein the abnormal behaviors and activities include the number of connection requests exceeding the preset number of connection requests, the number of login behaviors exceeding the preset number of login behaviors, the data transmission volume exceeding the preset data transmission volume, and the number of data transmissions exceeding the preset number of data transmissions; Calculate the sum of the number of the first abnormal users, the number of the second abnormal users, the number of the third abnormal users, and the number of illegal users to obtain the abnormal user number information; Among them, the method for determining the illegal users is: after any user accesses the network, use port scanning software to perform port scanning on the user's device, compare the known port status and port scanning results, determine whether there are unauthorized open ports and remote services, and determine that the user is an illegal user when there are unauthorized open ports and remote services.

5. The method according to claim 1, characterized in that The cable information accessed by the network device includes cable physical information and cable path interference information; Generating the network device hardware abnormality warning information based on the network device related information and the image information of the network device includes: Analyze the cable physical information to determine the cable physical parameters, and evaluate whether the cable physical parameters are abnormal, wherein the cable physical information includes the length of time the cable has been in use, the length of the cable, and the number of cable fixing devices; Determine the network device location deviation value according to the network device location information and the network device standard location, and evaluate whether the network device location deviation value is abnormal; Counting the number of abnormal devices in the cable path interference information to determine the number of abnormal devices, and evaluating whether the number of abnormal devices is abnormal, wherein the cable path interference information includes abnormal device information within a preset range of the cable path; Analyze the image information of the network device to determine the number of people that appear within a preset range of the network device within a preset time period, and evaluate whether there is any abnormality in the number of people information; When one or more of the cable physical parameters, the network device position deviation value, the number of abnormal devices, and the number of personnel information is abnormal, the network device hardware abnormality warning information is generated.

6. The method according to claim 5, characterized in that Analyzing the cable physical information to determine the cable physical parameters, and evaluating whether the cable physical parameters are abnormal, including: Calculating the ratio between the cable length and the number of the cable fixing devices to obtain an evaluation ratio, and combining the evaluation ratio and the length of time the cable has been in use as the cable physical parameter; If the cable has been in use for a period of time longer than a first preset usage period or the evaluation ratio is greater than a first preset evaluation ratio, it is determined that the cable physical parameter is abnormal; If the cable has been in use for a period of time longer than a second preset usage period, and the evaluation ratio is greater than a second preset evaluation ratio value, it is determined that the cable physical parameter is abnormal; wherein the first preset usage period value is greater than the second preset usage period value, and the first preset evaluation ratio value is greater than the second preset evaluation ratio value; Evaluate whether the network device location deviation value is abnormal, including: If the network device position deviation value is greater than a preset position deviation value, it is determined that the network device position deviation value is abnormal; Counting the number of abnormal devices in the cable path interference information to determine the number of abnormal devices, and evaluating whether the number of abnormal devices is abnormal, including: Based on the cable path interference information, the number of first devices with electromagnetic intensity greater than a preset electromagnetic intensity and the number of second devices with temperature greater than a preset temperature within a preset range of the cable path are obtained, and the number of abnormal devices is obtained by calculating the sum of the number of the first devices and the number of the second devices; If the number of abnormal devices is greater than a preset value of the number of abnormal devices, it is determined that the number of abnormal devices is abnormal; Evaluate whether there are any anomalies in the personnel quantity information, including: If the personnel quantity information is greater than the preset personnel quantity value, it is determined that there is an abnormality in the personnel quantity information.

7. The method according to claim 1, characterized in that Generating personnel abnormality warning information based on the image information of the network device, including: The image information of the network device is imported into a human body recognition model for human body recognition. After the human body is recognized, facial information is collected from the image information of the network device, and the collected facial information is compared with facial information in a preset facial information database to determine whether the collected facial information is facial information of a network equipment maintenance personnel stored in the preset facial information database. When the collected facial information does not belong to the facial information of the network equipment maintenance personnel, the length of time the human body stays within the preset range of the network equipment is recorded; when the length of time is greater than a first preset length of time, the hand position of the human body is identified; and when it is detected that the distance between the hand position of the human body and the network equipment is less than a preset distance value, the abnormal warning information of the personnel is generated; When the stay duration is greater than a second stay duration preset value, the personnel abnormality warning information is generated, wherein the first stay duration preset value is less than the second stay duration preset value.

8. A network security protection platform based on artificial intelligence, characterized in that: include: The terminal device collection module is used to collect network device related information, wherein the network device related information includes the cable information connected to the network device and the network device location information; The network-related collection module is used to collect network-related information, wherein the network-related information includes network access information and network traffic information A network anomaly collection module is used to collect information related to network anomalies, wherein the information related to network anomalies includes information on the number of historical network attacks within a preset time period, information on the number of historical network failures within a preset time period, and information on the number of historical abnormal users within a preset time period; A device image acquisition module, used to acquire image information of network devices, wherein the image information of the network devices is image information within a preset range of the network devices; Protection information collection module, used to collect network protection related information; a warning information generation module, configured to generate security abnormality warning information based on the network-related information and the network protection-related information, generate user abnormality warning information based on the network abnormality-related information, generate network device hardware abnormality warning information based on the network device-related information and the image information of the network device, and generate personnel abnormality warning information based on the image information of the network device; The warning information push module is used to send security abnormality warning information, user abnormality warning information, network equipment hardware abnormality warning information and personnel abnormality warning information to a preset receiving terminal; The warning information generating module is further used for: Rating the network access information to obtain access rating information, and rating the network traffic information to obtain traffic rating information; Based on the access rating information and the traffic rating information, obtaining standard protection requirement information matching the access rating information and the traffic rating information in a standard protection requirement library, wherein the standard protection requirement library presets protection requirements corresponding to access rating information and traffic rating information of various levels; Extracting current protection requirement information from the network protection related information; Determine protection requirement evaluation information based on the standard protection requirement information and the current protection requirement information, wherein the protection requirement evaluation information is used to indicate whether the protection evaluation is passed; When the protection requirement evaluation information indicates that the protection evaluation fails, generating the security abnormality warning information; The warning information generating module is further used for: Acquire historical network related information and historical protection information for the historical network related information to construct a training set, wherein the historical protection information includes various protection requirements in the standard protection requirement library; The protection model is trained using the training set, and the model parameters of the protection model are extracted after the training is completed. Based on the model parameters and various protection requirements, the protection requirements corresponding to different access quantity intervals and different network traffic intervals are analyzed, the access ratings corresponding to different access quantity intervals and the traffic ratings corresponding to different network traffic intervals are determined, and the standard protection requirements library is constructed.

Images