AI-enhanced network security situation anomaly detection and response method and system

Abstract

The invention relates to an AI-enhanced network security situation anomaly detection and response method and system, and the method comprises the steps: obtaining the current anomaly monitoring data of a monitoring end when an anomaly prompt message sent by the monitoring end is received; sending the acquired abnormal monitoring data to a pre-trained abnormal recognition model, wherein the abnormal recognition model recognizes an abnormal type to which the abnormal monitoring data belongs; based on the identified exception type, acquiring associated monitoring data of other monitoring ends associated with the exception type through a preset association rule, and packaging and sending the associated monitoring data and the exception monitoring data to a preset exception analysis model; and the exception analysis model judges and outputs exception reason information of the current network security to the user side based on the current exception monitoring data and the associated monitoring data. The network security situation detection method and device have the effect of improving the network security situation detection efficiency and accuracy.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to an AI-enhanced network security situation anomaly detection and response method and system. Background Art

[0002] Network security situation anomaly detection refers to the identification of behaviors and patterns that are inconsistent with normal situations or potential security threats by monitoring and analyzing network traffic, system logs, user behavior and other information in the network environment. It is an important part of network security monitoring, aiming to detect possible security incidents in a timely manner so that corresponding defensive measures can be taken.

[0003] At present, the monitoring of abnormal situations is generally still a single-point monitoring of different modules. Each function uses separate data monitoring, and then transmits and summarizes the data. The data feedback of this method is relatively simple. When abnormal situations occur concurrently, relevant personnel need to further analyze and determine the cause of the abnormality, which leads to low feedback efficiency and low accuracy. Therefore, it needs to be improved. Summary of the invention

[0004] In order to improve the efficiency and accuracy of network security situation detection, the present application provides an AI-enhanced network security situation anomaly detection and response method and system.

[0005] The above-mentioned invention objective of the present application is achieved through the following technical solutions:

[0006] An AI-enhanced network security situation anomaly detection and response method, comprising the steps of:

[0007] When receiving an abnormal prompt message sent by a monitoring terminal, the current abnormal monitoring data of the monitoring terminal is obtained; different monitoring terminals are used to monitor different types of network abnormalities;

[0008] The acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs;

[0009] Based on the identified anomaly type, the associated monitoring data of other monitoring terminals associated with the anomaly type is obtained through the preset association rules, and is packaged with the anomaly monitoring data and sent to the preset anomaly analysis model;

[0010] The anomaly analysis model determines and outputs the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and associated monitoring data.

[0011] By adopting the above technical solution, different monitoring terminals monitor different types of network anomalies, where different types of network anomalies also include different network paths. The specific types of current network security situation anomalies can be collected and determined through the anomaly recognition model. First, unified data collection and joint analysis are achieved, which improves the efficiency of network security situation detection. Furthermore, not only the abnormal monitoring data but also the associated monitoring data of other monitoring terminals associated with the abnormal monitoring data are identified through association rules, which lengthens the entire network abnormal behavior recognition cycle, can more accurately judge and trace the causes of abnormal behaviors, and improves the accuracy of abnormal behavior detection of network security situation.

[0012] Optionally, based on the identified abnormality type, obtaining associated monitoring data of other monitoring terminals associated with the abnormality type through a preset association rule, and packaging the associated monitoring data with the abnormal monitoring data and sending the data to a preset abnormality analysis model includes:

[0013] Determine whether there is a pre-set correlation factor for the abnormal type. If so, obtain other associated monitoring terminals through the correlation factor.

[0014] Identify the timestamp information of the abnormal monitoring data corresponding to the current abnormal type;

[0015] Extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and timestamp association rules;

[0016] The abnormal monitoring data and the associated monitoring data are packaged and sent to the abnormal analysis model.

[0017] By adopting the above technical solution, since there will be a time difference in data transmission between different monitoring terminals in network situation monitoring, by recording the timestamp information of abnormal monitoring data and then using the timestamp association rules, when abnormal monitoring data appears, it is possible to accurately trace the associated monitoring data of other monitoring terminals, thereby realizing data monitoring of the entire occurrence cycle of the abnormal behavior of the network, thereby more accurately determining the cause of the abnormality.

[0018] Optionally, the acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs, including:

[0019] The anomaly recognition model extracts several data features from the received anomaly monitoring data;

[0020] Based on the preset logical judgment rules, determine whether the current data characteristics meet the decision conditions of the abnormal type;

[0021] If the current data features meet the decision conditions of the abnormal type, the abnormal recognition model immediately outputs the abnormal type to which the current abnormal monitoring data belongs;

[0022] If the current data feature does not meet the decision conditions of the abnormal type, it jumps to the next data feature to be judged based on the logical judgment rules.

[0023] By adopting the above technical solution, in terms of determining the abnormal type, by extracting the data features of the abnormal monitoring data, the judgment and determination of the abnormal type can be accelerated. Since the information types represented by the data features are different, there is a situation where the abnormal type cannot be determined at one time. Therefore, by setting logical judgment rules and based on historical judgment habits, data features that are conducive to the determination of the abnormal type are given priority, which can shorten the time for abnormal type judgment and improve the efficiency of abnormal type judgment.

[0024] Optionally, the acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs, including:

[0025] Set the time interval for sending abnormal monitoring data. The abnormal monitoring data received in the same time interval are sent to the abnormal recognition model at the same time, and the abnormal types corresponding to the abnormal monitoring data are identified;

[0026] If the identified abnormality types include more than two, the preset association rule will first determine whether the abnormal monitoring data are associated.

[0027] By adopting the above technical solution and setting the time interval, abnormal network behaviors occurring within a short period of time can be sent to the abnormality identification model at the same time. If the abnormality types include two or more, the two abnormal monitoring data will be correlated and analyzed, which shortens the time for screening the correlated monitoring data and improves the efficiency of determining the cause of the abnormality.

[0028] Optionally, extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and the timestamp association rule includes:

[0029] Record the time when the abnormal monitoring data of the monitoring end is obtained, that is, the timestamp information, as the data for inputting the timestamp association rule;

[0030] Through the timestamp association rule, the time difference information of data transmission between the monitoring terminal that sends the abnormal prompt message and other associated monitoring terminals is identified;

[0031] The associated monitoring data of other associated monitoring terminals are extracted through the timestamp information and the time difference information.

[0032] By adopting the above technical solution, through the timestamp association rules and the timestamp information of the abnormal monitoring data, the time difference in data transmission between the monitoring end where the associated monitoring data is located and the monitoring end where the abnormal monitoring data is located can be calculated, that is, the associated monitoring data associated with the abnormal monitoring data can be accurately extracted according to the calculated timestamp.

[0033] Optionally, the anomaly analysis model determines and outputs the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and the associated monitoring data, including:

[0034] The abnormal analysis model retrieves all cause information associated with abnormal monitoring data from the preset database;

[0035] The anomaly analysis model identifies whether the associated monitoring data is abnormal;

[0036] When the associated monitoring data is abnormal, the cause information associated with the associated monitoring data is screened out from the cause information and sent to the user end as the abnormal cause information.

[0037] By adopting the above technical solution, when both the abnormal monitoring data and the associated monitoring data are abnormal, the abnormal analysis model will match the corresponding cause information from the preset database based on the two abnormal data, making the determination, analysis and definition of the abnormal cause more accurate.

[0038] Optionally, the abnormal analysis model determines and outputs abnormal cause information of current network security to the user end based on the current abnormal monitoring data and the associated monitoring data, and further includes:

[0039] When the associated monitoring data is normal, the cause information only associated with the abnormal monitoring data is filtered out from the cause information and sent to the user end as the abnormal cause information.

[0040] By adopting the above technical solution, when the associated monitoring data are all normal, the cause information only associated with the abnormal monitoring data is filtered out, that is, for the abnormal behavior of a single monitoring terminal, as much cause information as possible can be filtered out, which helps to prompt the user terminal to understand and know the possible causes of the abnormality, making the investigation of the causes of the abnormality more comprehensive.

[0041] The second object of the invention is achieved by the following technical solutions:

[0042] An AI-enhanced network security situation anomaly detection and response system, comprising:

[0043] The data acquisition module is used to obtain the current abnormal monitoring data of the monitoring terminal when receiving the abnormal prompt message sent by the monitoring terminal; different monitoring terminals are used to monitor different types of network abnormalities;

[0044] An anomaly recognition module is used to send the acquired anomaly monitoring data to a pre-trained anomaly recognition model, and the anomaly recognition model identifies the anomaly type to which the anomaly monitoring data belongs;

[0045] An association module is used to obtain the associated monitoring data of other monitoring terminals associated with the abnormal type based on the identified abnormal type through preset association rules, and package it with the abnormal monitoring data and send it to the preset abnormal analysis model;

[0046] The anomaly analysis module is used for the anomaly analysis model to determine and output the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and associated monitoring data.

[0047] By adopting the above technical solution, different monitoring terminals monitor different types of network anomalies, where different types of network anomalies also include different network paths. The specific types of current network security situation anomalies can be collected and determined through the anomaly recognition model. First, unified data collection and joint analysis are achieved, which improves the efficiency of network security situation detection. Furthermore, not only the abnormal monitoring data but also the associated monitoring data of other monitoring terminals associated with the abnormal monitoring data are identified through association rules, which lengthens the entire network abnormal behavior recognition cycle, can more accurately judge and trace the causes of abnormal behaviors, and improves the accuracy of abnormal behavior detection of network security situation.

[0048] The third objective of the present application is achieved through the following technical solutions:

[0049] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the above-mentioned AI-enhanced network security situation anomaly detection and response method are implemented.

[0050] The fourth objective of the present application is achieved through the following technical solutions:

[0051] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned AI-enhanced network security situation anomaly detection and response method.

[0052] In summary, the present application includes at least one of the following beneficial technical effects:

[0053] 1. The anomaly recognition model can collect and determine the specific types of current network security anomalies. First, unified data collection and joint analysis are achieved, which improves the efficiency of network security situation detection. Furthermore, not only abnormal monitoring data but also related monitoring data of other monitoring terminals related to abnormal monitoring data are identified through association rules, which prolongs the recognition cycle of abnormal behaviors in the entire network. It can more accurately determine and trace the causes of abnormal behaviors, and improve the accuracy of abnormal behavior detection in network security situation.

[0054] 2. When abnormal monitoring data appears, accurately trace the associated monitoring data of other monitoring terminals to achieve data monitoring of the entire occurrence cycle of the abnormal behavior of the network, so as to more accurately determine the cause of the abnormality;

[0055] 3. By extracting the data features of abnormal monitoring data, the judgment and determination of abnormal types can be accelerated. Since the types of information represented by data features are different, it is sometimes impossible to determine the abnormal type at one time. Therefore, by setting logical judgment rules and based on historical judgment habits, data features that are conducive to abnormal type determination are prioritized, which can shorten the time for abnormal type judgment and improve the efficiency of abnormal type judgment.

[0056] 4. By setting the time interval, abnormal network behaviors that occur within a short period of time can be sent to the anomaly recognition model at the same time. If the anomaly types include two or more, the two abnormal monitoring data will be correlated and analyzed, which shortens the time for screening the associated monitoring data and improves the efficiency of determining the cause of the anomaly. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 This is a flowchart of an implementation of an AI-enhanced network security situation anomaly detection and response method embodiment of the present application;

[0058] Figure 2 This is a flowchart of an implementation of step S20 in an embodiment of an AI-enhanced network security situation anomaly detection and response method of the present application;

[0059] Figure 3 This is a flowchart of an implementation of step S30 in an embodiment of an AI-enhanced network security situation anomaly detection and response method of the present application;

[0060] Figure 4 This is a flowchart of an implementation of step S40 of an AI-enhanced network security situation anomaly detection and response method embodiment of the present application;

[0061] Figure 5 It is a schematic diagram of a computer device of the present application. DETAILED DESCRIPTION

[0062] The following is combined with Figure 1-5 This application is described in further detail.

[0063] In the following embodiments, Figure 1 As shown, the present application discloses an AI-enhanced network security situation anomaly detection and response method, which specifically includes the following steps:

[0064] S10: when receiving the abnormal prompt message sent by the monitoring terminal, obtaining the current abnormal monitoring data of the monitoring terminal; different monitoring terminals are used to monitor different types of network abnormalities;

[0065] In this embodiment, the monitoring end includes monitoring software and monitoring hardware. The monitoring software includes intrusion monitoring, firewall, vulnerability monitoring, log management tools, network performance, traffic monitoring tools, etc. The monitoring hardware includes network traffic analyzers, switches and routers, network probes, and port mirrors, etc.

[0066] The monitoring end is preset with a standard range for the monitored data. If the monitored data is not within the standard range, it is regarded as abnormal monitoring data.

[0067] Different types of network anomalies include intrusion attempts, malware activities, phishing and social engineering, data leakage and illegal access, denial of service attacks, abnormal traffic and abnormal resource usage, and abnormal changes in configuration permissions.

[0068] Specifically, when data exceeding a preset standard range is received from different monitoring terminals, the data is marked as abnormal monitoring data.

[0069] S20: sending the acquired abnormal monitoring data to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs;

[0070] In this embodiment, an anomaly recognition model is obtained by training a neural network with data sets of different types of network anomaly information, and the anomaly recognition model has the function of tracing the source of the network data transmission line.

[0071] The exception type includes the name information of the network exception and the network line information where the network exception occurs.

[0072] Specifically, the acquired abnormal monitoring data is sent to an abnormal recognition model obtained through neural network training. The abnormal recognition model recognizes the abnormal monitoring data and outputs the name information of the network abnormal situation to which the abnormal monitoring data belongs and the network line information of the network abnormal situation.

[0073] S30: Based on the identified abnormality type, obtain the associated monitoring data of other monitoring terminals associated with the abnormality type through the preset association rules, and package it with the abnormal monitoring data and send it to the preset abnormality analysis model;

[0074] In this embodiment, in the association rule, the associated other monitoring ends refer to two or more monitoring ends that are pre-associated, and the principle of association is that when abnormal monitoring data appears on any one of the monitoring ends, the data of the associated monitoring end will change, and this change does not necessarily exceed the preset standard range. Therefore, the changed data is packaged as associated monitoring data and sent to the abnormal analysis model.

[0075] The anomaly analysis model is a large language model that performs feature training through a neural network. The anomaly analysis model analyzes the causes of network anomalies by identifying the features of abnormal monitoring data, the type of anomalies, and the associated monitoring data.

[0076] Specifically, based on the identified anomaly type, associated monitoring data associated with the abnormal monitoring data is obtained through association rules, and the anomaly type, associated monitoring data and abnormal monitoring data are packaged together and sent to a preset anomaly analysis model to analyze the cause of the network anomaly.

[0077] S40: The abnormal analysis model determines and outputs abnormal cause information of the current network security to the user end based on the current abnormal monitoring data and the associated monitoring data.

[0078] In this embodiment, the difference between the exception cause and the exception type is that the exception cause includes specific network abnormal behavior information, abnormal network line information, early warning information and response strategy information, among which the specific network abnormal behavior information includes pre-bound network product information, and the network product information is a custom setting, which is conducive to the personalized setting of network abnormal situations for users' network products during the development process.

[0079] Specifically, after receiving the abnormal monitoring data, the associated monitoring data and the abnormal type, the abnormal analysis model determines the specific abnormal network behavior of the current network security, determines the network line information where the network abnormality occurs, and gives pre-stored early warning prompt information and response strategy information.

[0080] In one embodiment, step S20 includes the steps of:

[0081] S21: setting a time interval for sending abnormal monitoring data, and sending the abnormal monitoring data received in the same time interval to the abnormal recognition model at the same time, and identifying the abnormal type corresponding to each abnormal monitoring data;

[0082] S22: If the identified abnormality types include more than two, the preset association rule will first determine whether the abnormal monitoring data are associated.

[0083] In this embodiment, by setting the time interval for sending abnormal monitoring data and automatically identifying whether there is a correlation between two abnormal monitoring data, the efficiency of identifying the network abnormality type can be improved.

[0084] In one embodiment, referring to Figure 2 , step S20 further comprises the steps of:

[0085] S23: The anomaly recognition model extracts a number of data features from the received anomaly monitoring data;

[0086] S24: Based on the preset logic judgment rules, determine whether the current data features meet the decision conditions of the abnormal type;

[0087] S25: If the current data feature meets the determination condition of the abnormal type, the abnormality recognition model immediately outputs the abnormality type to which the current abnormal monitoring data belongs;

[0088] S26: If the current data feature does not meet the determination condition of the abnormal type, jump to the next data feature to be determined based on the logic judgment rule.

[0089] In this embodiment, the abnormal monitoring data is split according to the format of the abnormal monitoring data and the information represented by the characters, so as to obtain different data features.

[0090] Logical judgment rules are used to judge the jump relationship and merging relationship between data features one by one. When the anomaly recognition model is not sufficient to judge the current anomaly type based on the current data features, the logical judgment rules will jump to another data feature, or merge two or more data features for judgment, to improve the accuracy of anomaly type judgment.

[0091] The decision condition refers to the judgment condition that determines whether the anomaly recognition model outputs the anomaly type to which the current feature data belongs. The decision condition can be customized.

[0092] In one embodiment, referring to Figure 3 , step S30 comprises the steps of:

[0093] S31: Determine whether there is a pre-set correlation factor for the abnormal type, and if so, obtain other associated monitoring terminals through the correlation factor;

[0094] S32: Identify the timestamp information of the abnormal monitoring data corresponding to the current abnormal type;

[0095] S33: extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and the timestamp association rule;

[0096] S34: Pack the abnormal monitoring data and the associated monitoring data and send them to the abnormal analysis model.

[0097] In this embodiment, the associated factors refer to other similar or different abnormal influencing factors that have a causal relationship with the abnormal type.

[0098] Timestamp information refers to the time information when the abnormal monitoring data is obtained, and timestamp association rules refer to the time difference calculation rules for data transmission between different monitoring terminals, which are used to calculate when to obtain the data of other associated monitoring terminals as associated monitoring data.

[0099] Among them, if no existing associated factors are identified, only the abnormal monitoring data is sent to the abnormal analysis model.

[0100] Specifically, step S33 includes:

[0101] S331: Record the time when the abnormal monitoring data of the monitoring terminal is obtained, that is, the timestamp information, as the data for inputting the timestamp association rule;

[0102] S332: Identify the time difference information of data transmission between the monitoring terminal that sends the abnormal prompt message and other associated monitoring terminals through the timestamp association rule;

[0103] S333: Extracting the associated monitoring data of other associated monitoring terminals through the timestamp information and the time difference information.

[0104] In this embodiment, the time difference information between different monitoring terminals is different. The time difference information between any two monitoring terminals can be calculated by accumulating the time differences between the monitoring terminals. The time difference information is related to the network environment. The corresponding time difference information will also be adjusted accordingly for different network traffic environments.

[0105] In one embodiment, referring to Figure 4 , step S40 comprises:

[0106] S41: The abnormal analysis model retrieves all cause information associated with the abnormal monitoring data from a preset database;

[0107] S42: The abnormal analysis model identifies whether the associated monitoring data is abnormal;

[0108] S43: when the associated monitoring data is abnormal, selecting the cause information associated with the associated monitoring data from the cause information and sending it to the user end as the abnormal cause information;

[0109] S44: When the associated monitoring data is normal, the cause information only associated with the abnormal monitoring data is filtered out from the cause information, and sent to the user end as the abnormal cause information.

[0110] In this embodiment, the cause information associated with an abnormal monitoring data includes one or more integers. The abnormality of the associated monitoring data includes the fluctuation range of the associated monitoring data, and the fluctuation range here includes two situations: exceeding the preset standard range or not exceeding the standard range. That is, custom settings.

[0111] Among them, when the associated monitoring data is normal, and the cause information associated with the abnormal monitoring data includes two or more, the generation of the abnormal cause information includes multiple types, and the multiple types of abnormal cause information are all sent to the user end.

[0112] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0113] In one embodiment, an AI-enhanced network security situation anomaly detection and response system is provided, and the AI-enhanced network security situation anomaly detection and response system corresponds one-to-one to the AI-enhanced network security situation anomaly detection and response method in the above embodiment. The AI-enhanced network security situation anomaly detection and response system includes:

[0114] The data acquisition module is used to obtain the current abnormal monitoring data of the monitoring terminal when receiving the abnormal prompt message sent by the monitoring terminal; different monitoring terminals are used to monitor different types of network abnormalities;

[0115] An anomaly recognition module is used to send the acquired anomaly monitoring data to a pre-trained anomaly recognition model, and the anomaly recognition model identifies the anomaly type to which the anomaly monitoring data belongs;

[0116] An association module is used to obtain the associated monitoring data of other monitoring terminals associated with the abnormal type based on the identified abnormal type through preset association rules, and package it with the abnormal monitoring data and send it to the preset abnormal analysis model;

[0117] The anomaly analysis module is used for the anomaly analysis model to determine and output the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and associated monitoring data.

[0118] Optionally, the anomaly identification module includes:

[0119] The interval collection submodule is used to set the time interval for sending abnormal monitoring data. The abnormal monitoring data received in the same time interval are sent to the abnormal recognition model at the same time, and the abnormal type corresponding to each abnormal monitoring data is identified;

[0120] The priority association submodule is used to, if the identified abnormality types include more than two, use the preset association rules to prioritize whether the abnormality monitoring data are associated.

[0121] The feature extraction submodule is used for the anomaly recognition model to extract several data features from the received anomaly monitoring data;

[0122] The logic judgment submodule is used to judge whether the current data characteristics meet the decision conditions of the abnormal type based on the preset logic judgment rules;

[0123] The judgment submodule is used to immediately output the abnormal type to which the current abnormal monitoring data belongs if the current data feature meets the decision conditions of the abnormal type;

[0124] The jump submodule is used to jump to the next data feature to be judged based on the logical judgment rules if the current data feature does not meet the decision conditions of the abnormal type.

[0125] Optionally, associated modules include:

[0126] The factor association submodule is used to determine whether there is a pre-set association factor for the abnormal type. If so, other associated monitoring terminals are obtained through the association factor.

[0127] A timestamp submodule, used to identify the timestamp information of the abnormal monitoring data corresponding to the current abnormal type;

[0128] A time association submodule, for extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and timestamp association rules;

[0129] The data sending submodule is used to package the abnormal monitoring data and the associated monitoring data and send them to the abnormal analysis model.

[0130] Optionally, the time-related submodule includes:

[0131] A time input unit is used to record the time when the abnormal monitoring data of the monitoring end is obtained, that is, the timestamp information, as the data for inputting the timestamp association rule;

[0132] The association calculation unit is used to identify the time difference information of data transmission between the monitoring terminal that sends the abnormal prompt message and other associated monitoring terminals through the timestamp association rule; and extract the associated monitoring data of other associated monitoring terminals through the timestamp information and the time difference information.

[0133] Optionally, the exception analysis module includes:

[0134] The factor judgment submodule is used for the common analysis model to retrieve all the cause information associated with the abnormal monitoring data from the preset database;

[0135] The anomaly identification submodule is used for the anomaly analysis model to identify whether the associated monitoring data is abnormal;

[0136] The association judgment submodule is used to filter out the cause information associated with the associated monitoring data from the cause information when the associated monitoring data is abnormal, and send it to the user end as abnormal cause information; when the associated monitoring data is normal, filter out the cause information only associated with the abnormal monitoring data from the cause information, and send it to the user end as abnormal cause information.

[0137] For the specific definition of an AI-enhanced network security situation anomaly detection and response system, please refer to the definition of an AI-enhanced network security situation anomaly detection and response method above, which will not be repeated here. Each module in the above-mentioned AI-enhanced network security situation anomaly detection and response system can be implemented in whole or in part through software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0138] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, a network interface and a database connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an AI-enhanced network security situation anomaly detection and response method is implemented.

[0139] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, an AI-enhanced network security situation anomaly detection and response method is implemented.

[0140] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, an AI-enhanced network security situation anomaly detection and response method is implemented.

[0141] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0142] Those skilled in the art can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. In actual applications, the above-mentioned functions can be distributed and completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above.

[0143] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. An AI-enhanced network security situation anomaly detection and response method, characterized by: When receiving an abnormal prompt message sent by a monitoring terminal, the current abnormal monitoring data of the monitoring terminal is obtained; different monitoring terminals are used to monitor different types of network abnormalities; The acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs; Based on the identified anomaly type, the associated monitoring data of other monitoring terminals associated with the anomaly type is obtained through the preset association rules, and is packaged with the abnormal monitoring data and sent to the preset anomaly analysis model; The anomaly analysis model determines and outputs the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and associated monitoring data.

2. According to claim 1, an AI-enhanced network security situation anomaly detection and response method is characterized in that: Based on the identified abnormal type, the associated monitoring data of other monitoring terminals associated with the abnormal type are obtained through preset association rules, and packaged with the abnormal monitoring data and sent to the preset abnormal analysis model, including: Determine whether there is a pre-set correlation factor for the abnormal type. If so, obtain other associated monitoring terminals through the correlation factor. Identify the timestamp information of the abnormal monitoring data corresponding to the current abnormal type; Extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and timestamp association rules; The abnormal monitoring data and the associated monitoring data are packaged and sent to the abnormal analysis model.

3. According to claim 1, an AI-enhanced network security situation anomaly detection and response method is characterized in that: The acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs, including: The anomaly recognition model extracts several data features from the received anomaly monitoring data; Based on the preset logical judgment rules, determine whether the current data characteristics meet the decision conditions of the abnormal type; If the current data features meet the decision conditions of the abnormal type, the abnormal recognition model immediately outputs the abnormal type to which the current abnormal monitoring data belongs; If the current data feature does not meet the decision conditions of the abnormal type, it jumps to the next data feature to be judged based on the logical judgment rules.

4. According to claim 1, an AI-enhanced network security situation anomaly detection and response method is characterized in that: The acquired abnormal monitoring data is sent to a pre-trained abnormal recognition model, and the abnormal recognition model identifies the abnormal type to which the abnormal monitoring data belongs, including: Set the time interval for sending abnormal monitoring data. The abnormal monitoring data received in the same time interval are sent to the abnormal recognition model at the same time, and the abnormal types corresponding to the abnormal monitoring data are identified; If the identified abnormality types include more than two, the preset association rule will first determine whether the abnormal monitoring data are associated.

5. According to claim 2, an AI-enhanced network security situation anomaly detection and response method is characterized in that: The extracting associated monitoring data of other associated monitoring terminals based on the identified timestamp information and the timestamp association rule includes: Record the time when the abnormal monitoring data of the monitoring end is obtained, that is, the timestamp information, as the data for inputting the timestamp association rule; Through the timestamp association rule, the time difference information of data transmission between the monitoring terminal that sends the abnormal prompt message and other associated monitoring terminals is identified; The associated monitoring data of other associated monitoring terminals are extracted through the timestamp information and the time difference information.

6. The AI-enhanced network security situation anomaly detection and response method according to claim 1 is characterized in that: The abnormal analysis model determines and outputs the abnormal cause information of the current network security to the user end based on the current abnormal monitoring data and the associated monitoring data, including: The abnormal analysis model retrieves all cause information associated with abnormal monitoring data from the preset database; The anomaly analysis model identifies whether the associated monitoring data is abnormal; When the associated monitoring data is abnormal, the cause information associated with the associated monitoring data is screened out from the cause information and sent to the user end as the abnormal cause information.

7. The AI-enhanced network security situation anomaly detection and response method according to claim 6 is characterized in that: The abnormal analysis model determines and outputs abnormal cause information of current network security to the user end based on the current abnormal monitoring data and the associated monitoring data, and also includes: When the associated monitoring data is normal, the cause information only associated with the abnormal monitoring data is filtered out from the cause information and sent to the user end as the abnormal cause information.

8. An AI-enhanced network security situation anomaly detection and response system, characterized in that: include: A data acquisition module is used to acquire the current abnormal monitoring data of the monitoring terminal when receiving an abnormal prompt message sent by the monitoring terminal; Different monitoring terminals are used to monitor different types of network anomalies; An anomaly recognition module is used to send the acquired anomaly monitoring data to a pre-trained anomaly recognition model, and the anomaly recognition model identifies the anomaly type to which the anomaly monitoring data belongs; An association module is used to obtain the associated monitoring data of other monitoring terminals associated with the abnormal type based on the identified abnormal type through preset association rules, and package it with the abnormal monitoring data and send it to the preset abnormal analysis model; The anomaly analysis module is used for the anomaly analysis model to determine and output the anomaly cause information of the current network security to the user end based on the current anomaly monitoring data and associated monitoring data.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the AI-enhanced network security situation anomaly detection and response method as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of an AI-enhanced network security situation anomaly detection and response method as described in any one of claims 1 to 7 are implemented.

Images