Network security situation awareness and early warning system and method based on artificial intelligence

Abstract

The invention discloses a network security situation awareness and early warning system and method based on artificial intelligence, relates to the technical field of network security situation awareness and early warning, and solves the technical problem that the early warning precision is not high due to the fact that the influence of changes of an encryption traffic proportion and encryption strength on network security monitoring is not considered in the prior art. The method comprises the following steps: acquiring network data in a network in a preset time period; calculating a network security evaluation coefficient based on the network security data; determining whether to send early warning information based on the network security evaluation coefficient and a preset network security threshold; training an artificial intelligence model based on the historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model; predicting the network security data based on the network security evaluation coefficient prediction model; whether early warning is carried out or not is judged based on the prediction result and a preset network security threshold value, the network is processed based on the early warning information, and the technical problem is solved.

Description

Technical Field

[0001] The present invention belongs to the field of network security situation awareness and early warning, and specifically relates to a network security situation awareness and early warning system and method based on artificial intelligence. Background Art

[0002] With the rapid development of the Internet, network security threats are becoming increasingly complex and changeable. Traditional security defense methods can no longer effectively respond to new security challenges such as advanced persistent threats (APTs) and zero-day vulnerability attacks.

[0003] The prior art (the invention application with the publication number CN118075005A) discloses a network security situation perception and early warning method and system based on big data, the method includes obtaining the network operation data of the current network event and performing data integration and cleaning processing to obtain network security situation information, analyzing the network security situation information and then performing security situation assessment processing on the current network event to obtain security assessment information of the current network event, tracing the information source of the security assessment information with risks, and identifying the attack threat level of the security assessment information, constructing a security situation model of the current network event according to the attack threat level of each network security situation, combining the relevant historical attack event data to perform network security development trend perception processing, extracting the possible risk hidden danger data according to the risk perception result and generating the corresponding risk early warning information, thereby improving the network security situation perception and the timeliness of early warning. However, the prior art does not take into account the impact of changes in the proportion of encrypted traffic and encryption strength on network security monitoring. A sudden increase in the proportion of encrypted traffic may indicate that unknown malicious activities are occurring. Changes in encryption strength can help identify password downgrade attacks, that is, attackers attempt to reduce the encryption strength to a level that is easy to crack; and the prior art uses a single data to perform early warning monitoring on network security, and the accuracy of the early warning is obviously not high.

[0004] Therefore, the present invention solves the above-mentioned problems by proposing a network security situation awareness and early warning system and method based on artificial intelligence. Summary of the invention

[0005] The present invention aims to solve at least one of the technical problems existing in the prior art; to this end, the present invention proposes an artificial intelligence-based network security situation awareness and early warning system and method to solve the problem that the prior art does not take into account the impact of changes in the proportion of encrypted traffic and encryption strength on network security monitoring. A sudden increase in the proportion of encrypted traffic may indicate that unknown malicious activities are occurring, and changes in encryption strength can help identify password downgrade attacks, that is, attackers attempt to reduce the encryption strength to a level that is easy to crack; and the prior art uses a single piece of data to perform early warning monitoring on network security, and the accuracy of the early warning is obviously not high.

[0006] To achieve the above-mentioned purpose, the first aspect of the present invention provides a network security situation awareness and early warning system based on artificial intelligence, including: a data acquisition module, a data analysis module, a data prediction module and a data early warning module;

[0007] Data acquisition module: used to obtain network data in the network within a preset time period;

[0008] Data analysis module: calculates network security assessment coefficients based on network security data; and,

[0009] Based on the network security assessment coefficient and the preset network security threshold, determine whether to send an early warning message; if yes, send an early warning message to the client; if no, continue to monitor and judge;

[0010] Data prediction module: training an artificial intelligence model based on historical network security data and corresponding network security assessment coefficients to obtain a network security assessment coefficient prediction model; and,

[0011] Predict network security data based on the network security assessment coefficient prediction model to obtain prediction results;

[0012] Data warning module: determines whether to issue a warning based on the prediction results and the preset network security threshold; if yes, sends the warning information to the client; if no, continues to monitor and judge; and,

[0013] Process the network based on the early warning information.

[0014] Preferably, the data analysis module communicates with and / or is electrically connected to the data acquisition module and the data prediction module respectively; the data early warning module communicates with and / or is electrically connected to the data prediction module.

[0015] Preferably, the obtaining of network data in the network within a preset time period includes:

[0016] The network data in the network within a preset time period is collected in real time through the data collection equipment; wherein the network data includes: the proportion of encrypted traffic in the network, the key length and the number of login failures; wherein the preset time period is set according to the requirements of the actual network security monitoring; the proportion of encrypted traffic refers to the ratio of encrypted traffic to total traffic.

[0017] It should be noted that the encrypted traffic refers to the data packets transmitted in the network that are encrypted to protect the privacy and integrity of the data;

[0018] The key length refers to the number of bits of the key used to encrypt and decrypt data. The longer the key length, the higher the encryption strength.

[0019] Preferably, the calculating of the network security assessment coefficient based on the network security data includes:

[0020] The proportion of encrypted traffic in the network is marked as LB, the key length is marked as E, and the number of login failures is marked as N;

[0021] By formula:

[0022] P=A×exp[(LB-ZLB)^2 / (ZLB^2)]+B×exp(-E / E+1)+C×tanh(N)×ln(N+1)

[0023] The network security assessment coefficient is calculated; where P is the network security assessment coefficient, ZLB is the proportion of encrypted traffic under normal network operation, A, B, and C are proportional coefficients, tanh(*) is the hyperbolic tangent function, and ln(*) is the logarithmic function with the natural number e as the base.

[0024] It should be noted that the proportion of encrypted traffic under normal network operation refers to the proportion of encrypted traffic under normal user use.

[0025] Preferably, the determining whether to send warning information based on the network security assessment coefficient and a preset network security threshold includes:

[0026] Determine whether the network security assessment coefficient is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge; among which, the preset network security threshold is set according to the actual network type and requirements.

[0027] The present invention collects network data in the network within a preset time period in real time through a data collection device; calculates a network security evaluation coefficient based on the network security data; and determines whether to send an early warning message based on the network security evaluation coefficient and a preset network security threshold, thereby solving the problem that the prior art does not take into account the impact of changes in the proportion of encrypted traffic and encryption strength on network security monitoring, and the prior art uses a single data to perform early warning monitoring on network security, resulting in low accuracy of the early warning.

[0028] Preferably, the training of the artificial intelligence model based on historical network security data and corresponding network security assessment coefficients includes:

[0029] Integrate the historical network security data at the initial moment and the corresponding network security assessment coefficient as standard input data, and integrate the historical network security data at the preset prediction moment and the corresponding network security assessment coefficient as standard output data;

[0030] An artificial intelligence model is trained based on standard input data and standard output data to obtain a network security assessment coefficient prediction model; wherein the artificial intelligence model includes: a convolutional neural network or a deep belief network.

[0031] It should be noted that the historical network security data refers to the historical data of collected network security data.

[0032] Preferably, the predicting of network security data based on the network security assessment coefficient prediction model includes:

[0033] The network security data collected in real time and the corresponding network security assessment coefficient obtained by calculation are input into the network security assessment coefficient prediction model to obtain the prediction result; wherein the prediction result includes: the network security data at the preset prediction time and the corresponding network security assessment coefficient.

[0034] Preferably, judging whether to issue an early warning based on the prediction result and a preset network security threshold includes:

[0035] Determine whether the network security assessment coefficient at the preset prediction moment is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge.

[0036] Preferably, the processing of the network based on the early warning information includes:

[0037] Build a knowledge graph and search for the corresponding warning type in the knowledge graph based on the warning information; among them, historical warning types include: abnormal encrypted traffic ratio, abnormal key length, and abnormal number of login failures;

[0038] S1: By extracting the network security assessment coefficient and warning type corresponding to the historical network security data from the historical warning records;

[0039] S2: Extracting entities related to network security from historical warning records through natural language processing technology; the entities include: warning type, historical network security data and corresponding network security assessment coefficient;

[0040] S3: Extract the relationship between entities;

[0041] S4: Map entities and relationships into a graph using graph database technology to obtain a knowledge graph; graph database technologies include Neo4j or Dgraph;

[0042] S5: Matching the corresponding warning type in the knowledge graph based on the network security assessment coefficient corresponding to the received warning information;

[0043] S5: Process the network based on the matched warning type.

[0044] It should be noted that the historical warning record refers to the warning information generated based on historical network security data, and the warning processing record obtained by processing the warning information; the association relationship assigned between entities refers to the logical relationship or semantic relationship between entities.

[0045] The present invention constructs a knowledge graph and extracts entities and their associations from historical warning records through natural language processing technology, so as to realize efficient processing of the network based on warning information, which is beneficial to quickly identify and respond to network security threats. By mapping the entities in historical warning records and the logical or semantic relationships between them into the knowledge graph, the processing speed and accuracy of new warning information can be improved, which not only helps to take targeted measures in a timely manner to reduce or eliminate security risks, but also promotes the overall understanding and prediction of network security situation, thereby enhancing the effectiveness and responsiveness of the network security protection system.

[0046] The second aspect of the present invention provides a network security situation awareness and early warning method based on artificial intelligence, comprising:

[0047] Step 1: Obtain network data in the network within a preset time period;

[0048] Step 2: Calculate the network security assessment coefficient based on network security data;

[0049] Step 3: Determine whether to send an early warning message based on the network security assessment coefficient and the preset network security threshold; if yes, send the early warning message to the client; if no, continue to monitor and judge;

[0050] Step 4: Train the artificial intelligence model based on historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model;

[0051] Step 5: Predict the network security data based on the network security assessment coefficient prediction model to obtain the prediction results;

[0052] Step 6: Determine whether to issue an early warning based on the prediction results and the preset network security threshold; if yes, send the early warning information to the client; if no, continue to monitor and judge;

[0053] Step 7: Process the network based on the warning information.

[0054] Compared with the prior art, the present invention has the following beneficial effects:

[0055] 1. The prior art does not take into account the impact of changes in the proportion of encrypted traffic and encryption strength on network security monitoring. A sudden increase in the proportion of encrypted traffic may indicate that unknown malicious activities are occurring, and changes in encryption strength can help identify password downgrade attacks, i.e., attackers attempt to reduce the encryption strength to a level that is easy to crack; and the prior art uses a single piece of data to perform early warning monitoring of network security, and it is clear that the accuracy of the early warning is not high; the present invention uses a data acquisition device to collect network data in the network within a preset time period in real time; and calculates a network security assessment coefficient based on network security data, thereby solving the above problems.

[0056] 2. The present invention obtains a network security assessment coefficient prediction model by training an artificial intelligence model based on historical network security data and corresponding network security assessment coefficients; and predicts network security data based on the network security assessment coefficient prediction model to obtain prediction results; determines whether to issue an early warning based on the prediction results and a preset network security threshold; and effectively improves the initiative and efficiency of network security protection by identifying potential network threats in advance and taking preventive measures before security incidents occur. At the same time, by automatically monitoring and predicting network risks, the need for manual intervention is reduced, and the response speed and accuracy are improved, thereby better ensuring the stable operation of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 A schematic diagram of a system module according to an embodiment of the present invention;

[0059] Figure 2 A schematic diagram of a specific process of an embodiment of the present invention;

[0060] Figure 3 Schematic diagram of the method steps of an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0062] See also Figure 1-Figure 2 , the first aspect of the present invention provides an artificial intelligence-based network security situation awareness and early warning system, including: a data acquisition module, a data analysis module, a data prediction module and a data early warning module;

[0063] Data acquisition module: used to obtain network data in the network within a preset time period;

[0064] Data analysis module: calculates network security assessment coefficients based on network security data; and,

[0065] Based on the network security assessment coefficient and the preset network security threshold, determine whether to send an early warning message; if yes, send an early warning message to the client; if no, continue to monitor and judge;

[0066] Get network data in the network within a preset time period, including:

[0067] The network data in the network within a preset time period is collected in real time through the data collection equipment; wherein the network data includes: the proportion of encrypted traffic in the network, the key length and the number of login failures; wherein the preset time period is set according to the requirements of the actual network security monitoring; the proportion of encrypted traffic refers to the ratio of encrypted traffic to total traffic.

[0068] The network security assessment coefficient is calculated based on network security data, including:

[0069] The proportion of encrypted traffic in the network is marked as LB, the key length is marked as E, and the number of login failures is marked as N;

[0070] By formula:

[0071] P=A×exp[(LB-ZLB)^2 / (ZLB^2)]+B×exp(-E / E+1)+C×tanh(N)×ln(N+1)

[0072] The network security assessment coefficient is calculated; where P is the network security assessment coefficient, ZLB is the proportion of encrypted traffic under normal network operation, A, B, and C are proportional coefficients, tanh(*) is the hyperbolic tangent function, and ln(*) is the logarithmic function with the natural number e as the base.

[0073] Determine whether to send warning information based on the network security assessment coefficient and the preset network security threshold, including:

[0074] Determine whether the network security assessment coefficient is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge; among which, the preset network security threshold is set according to the actual network type and requirements.

[0075] For example: 1. Data acquisition module;

[0076] Preset time period: Set to collect data once every hour.

[0077] Network data:

[0078] Encrypted traffic ratio (LB): Use network monitoring tools (such as Wireshark or dedicated logging equipment) to collect network traffic information and count the ratio of encrypted traffic to total traffic. For example, in a certain hour, encrypted traffic accounts for 60% of the total traffic, that is, LB = 0.6.

[0079] Key length (E): Usually, the key length is defined in the network configuration and can be obtained by querying the server certificate or encryption settings. Assume that the network uses a 256-bit AES key, so E = 256.

[0080] Number of failed login attempts (N): The number of failed login attempts can be obtained by viewing the log file of the login system. Assuming there are 10 failed login attempts within an hour, then N = 10.

[0081] 2. Data analysis module;

[0082] Calculate the network security assessment coefficient (P):

[0083] By formula:

[0084] P=A×exp[(LB-ZLB)^2 / (ZLB^2)]+B×exp(-E / E+1)+C×tanh(N)×ln(N+1) calculates the network security assessment coefficient;

[0085] Assumed coefficients: Assume that the proportional coefficients A = 0.8, B = 0.7, and C = 0.5. In addition, assume that the encrypted traffic ratio ZLB = 0.5 under normal network operation.

[0086] Substituting the data into the formula, we get P≈2.3;

[0087] Assume that the preset network security threshold is 3.0;

[0088] Since P≈2.3 is less than the preset network security threshold of 3.0, no warning information is sent and monitoring and judgment continue;

[0089] If P is greater than the preset network security threshold, an early warning message is sent to the client.

[0090] Encrypted Traffic Percentage (LB): A sudden increase or decrease in the percentage of encrypted traffic may indicate that attackers are using encrypted channels to hide their activities.

[0091] Key Length (E): The longer the key length, the stronger the encryption; reduced encryption used by encrypted traffic may indicate that an attacker is attempting to bypass security measures.

[0092] Failed Logins (N): A high number of failed logins may mean someone is trying to illegally access the system.

[0093] Data prediction module: training an artificial intelligence model based on historical network security data and corresponding network security assessment coefficients to obtain a network security assessment coefficient prediction model; and predicting network security data based on the network security assessment coefficient prediction model to obtain prediction results;

[0094] Data warning module: determines whether to issue a warning based on the prediction results and the preset network security threshold; if yes, sends the warning information to the client; if not, continues to monitor and judge; and processes the network based on the warning information.

[0095] Training AI models based on historical cybersecurity data and corresponding cybersecurity assessment coefficients, including:

[0096] Integrate the historical network security data at the initial moment and the corresponding network security assessment coefficient as standard input data, and integrate the historical network security data at the preset prediction moment and the corresponding network security assessment coefficient as standard output data;

[0097] An artificial intelligence model is trained based on standard input data and standard output data to obtain a network security assessment coefficient prediction model; wherein the artificial intelligence model includes: a convolutional neural network or a deep belief network.

[0098] Predict network security data based on the network security assessment coefficient prediction model, including:

[0099] The network security data collected in real time and the corresponding network security assessment coefficient obtained by calculation are input into the network security assessment coefficient prediction model to obtain the prediction result; wherein the prediction result includes: the network security data at the preset prediction time and the corresponding network security assessment coefficient.

[0100] Determine whether to issue an early warning based on the prediction results and the preset network security threshold, including:

[0101] Determine whether the network security assessment coefficient at the preset prediction moment is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge.

[0102] Process the network based on the warning information, including:

[0103] Build a knowledge graph and search for the corresponding warning type in the knowledge graph based on the warning information; among them, historical warning types include: abnormal encrypted traffic ratio, abnormal key length, and abnormal number of login failures;

[0104] S1: By extracting the network security assessment coefficient and warning type corresponding to the historical network security data from the historical warning records;

[0105] S2: Extracting entities related to network security from historical warning records through natural language processing technology; the entities include: warning type, historical network security data and corresponding network security assessment coefficient;

[0106] S3: Extract the relationship between entities;

[0107] S4: Map entities and relationships into a graph using graph database technology to obtain a knowledge graph; graph database technologies include Neo4j or Dgraph;

[0108] S5: Matching the corresponding warning type in the knowledge graph based on the network security assessment coefficient corresponding to the received warning information;

[0109] S5: Process the network based on the matched warning type.

[0110] For example: Assume a small enterprise network environment, and use a simple linear regression model as an artificial intelligence model for prediction. The details are as follows:

[0111] 1. Data prediction module;

[0112] Historical data: Historical network security data within the past week and the corresponding network security assessment coefficients will be used as the training set.

[0113] Artificial Intelligence Model: Uses convolutional neural networks to predict future cybersecurity assessment coefficients.

[0114] 2. Example description;

[0115] Assume the following historical data:

[0116] Time cycle: Data is collected once an hour, 24 hours a day.

[0117] Encrypted traffic ratio (LB): fluctuates from 50% to 70%.

[0118] Key length (E): remains unchanged at 256 bits.

[0119] Number of failed login attempts (N): fluctuates between 5 and 25.

[0120] Network security assessment coefficient (P): calculated through the network security assessment coefficient.

[0121] 3. Training data;

[0122] Standard input data: LB, E, N at the initial moment and the corresponding network security assessment coefficient.

[0123] Standard output data: LB, E, N and corresponding network security assessment coefficient at the preset prediction time.

[0124] 4. Build a training set;

[0125] Assume that the training data samples are as shown in the following table:

[0126] time LB E N P 00:00 0.55 256 5 1.9 01:00 0.62 256 10 2.2 02:00 0.65 256 15 2.5 … … … … …

[0127] 5. Train artificial intelligence models;

[0128] The above data is input into the model and the model is trained to learn the relationship between LB, E, N and P.

[0129] 6. Prediction process;

[0130] Real-time collected network security data: Assume that at 12:00, the collected data is LB=0.68, E=256, N=25, and P=3.5.

[0131] Prediction: Input this data into the trained model to predict future network security assessment coefficients.

[0132] 7.Data early warning module;

[0133] Preset network security threshold: Assume the threshold is 3.0. When the predicted P value exceeds 3.0, an alert is triggered.

[0134] Warning message: If the P value exceeds 3.0, a warning message is sent to the administrator.

[0135] Since P=3.5>preset network security threshold 3.0, an early warning message is sent to the client.

[0136] To better understand this process, we can construct a specific example scenario. Suppose we have an enterprise's network security system that ensures network security by monitoring network traffic and other key indicators. The following is an example based on the above process:

[0137] 8. Process the network based on the warning information;

[0138] Building a knowledge graph:

[0139] Entities are extracted from historical warning records, including warning types (such as abnormal encrypted traffic ratio, abnormal key length, abnormal number of login failures), historical network security data, and corresponding network security assessment coefficients.

[0140] Natural language processing techniques are used to extract the relationships between these entities.

[0141] Use graph database technology (such as Neo4j) to map these entities and relationships into a knowledge graph.

[0142] Alert type matching:

[0143] When new warning information is received, the network security assessment coefficient in the information is used to search for similar historical cases in the knowledge graph.

[0144] Find the warning type that best matches the current warning information.

[0145] Treatment measures:

[0146] Take appropriate measures based on the matched warning type, such as:

[0147] If the proportion of encrypted traffic is abnormal, you may need to check for unknown encrypted malware activities.

[0148] If the key length is abnormal, the key management strategy may need to be reviewed.

[0149] If the number of failed logins is abnormal, you may need to strengthen the authentication mechanism.

[0150] See also Figure 3 The second aspect of the present invention provides a network security situation awareness and early warning method based on artificial intelligence, including:

[0151] Step 1: Obtain network data in the network within a preset time period;

[0152] Step 2: Calculate the network security assessment coefficient based on network security data;

[0153] Step 3: Determine whether to send an early warning message based on the network security assessment coefficient and the preset network security threshold; if yes, send the early warning message to the client; if no, continue to monitor and judge;

[0154] Step 4: Train the artificial intelligence model based on historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model;

[0155] Step 5: Predict the network security data based on the network security assessment coefficient prediction model to obtain the prediction results;

[0156] Step 6: Determine whether to issue an early warning based on the prediction results and the preset network security threshold; if yes, send the early warning information to the client; if no, continue to monitor and judge;

[0157] Step 7: Process the network based on the warning information.

[0158] Part of the data in the above formula is calculated by removing the dimension and taking its numerical value. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset network security thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0159] Working principle of the present invention:

[0160] The present invention obtains network data in the network within a preset time period; calculates a network security assessment coefficient based on the network security data; determines whether to send an early warning message based on the network security assessment coefficient and a preset network security threshold; if yes, sends an early warning message to the client; if no, continuously monitors and determines; trains an artificial intelligence model based on historical network security data and corresponding network security assessment coefficients to obtain a network security assessment coefficient prediction model; predicts network security data based on the network security assessment coefficient prediction model to obtain a prediction result; determines whether to issue an early warning based on the prediction result and a preset network security threshold; if yes, sends an early warning message to the client; if no, continuously monitors and determines; processes the network based on the early warning information, thereby solving the problem that the prior art does not take into account the impact of changes in the proportion of encrypted traffic and encryption strength on network security monitoring, a sudden increase in the proportion of encrypted traffic may indicate that unknown malicious activities are occurring, and changes in encryption strength can help identify password downgrade attacks, that is, attackers attempt to reduce the encryption strength to a level that is easy to crack; and the prior art uses a single piece of data to perform early warning monitoring on network security, but the accuracy of the early warning is obviously not high.

[0161] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. The network security situation awareness and early warning system based on artificial intelligence is characterized by: include: Data collection module, data analysis module, data prediction module and data early warning module; Data acquisition module: used to obtain network data in the network within a preset time period; Data analysis module: Calculate the network security assessment coefficient based on network security data; as well as, Determine whether to send warning information based on the network security assessment coefficient and the preset network security threshold; If yes, a warning message is sent to the client; If not, continue to monitor and judge; Data prediction module: trains the artificial intelligence model based on historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model; as well as, Predict network security data based on the network security assessment coefficient prediction model to obtain prediction results; Data warning module: determines whether to issue a warning based on the prediction results and the preset network security threshold; If yes, a warning message is sent to the client; If not, continue to monitor and judge; as well as, Process the network based on the early warning information.

2. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The data analysis module communicates with and / or is electrically connected to the data acquisition module and the data prediction module respectively; the data early warning module communicates with and / or is electrically connected to the data prediction module.

3. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The obtaining of network data in the network within a preset time period includes: The network data in the network within a preset time period is collected in real time through the data collection equipment; wherein the network data includes: the proportion of encrypted traffic in the network, the key length and the number of login failures; wherein the preset time period is set according to the requirements of the actual network security monitoring; the proportion of encrypted traffic refers to the ratio of encrypted traffic to total traffic.

4. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The network security assessment coefficient is calculated based on the network security data, including: The proportion of encrypted traffic in the network is marked as LB, the key length is marked as E, and the number of login failures is marked as N; By formula: P=A×exp[(LB-ZLB)^2 / (ZLB^2)]+B×exp(-E / E+1)+C×tanh(N)×ln(N+1) The network security assessment coefficient is calculated; where P is the network security assessment coefficient, ZLB is the proportion of encrypted traffic under normal network operation, A, B, and C are proportional coefficients, tanh(*) is the hyperbolic tangent function, and ln(*) is the logarithmic function with the natural number e as the base.

5. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The determining whether to send warning information based on the network security assessment coefficient and the preset network security threshold includes: Determine whether the network security assessment coefficient is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge; among which, the preset network security threshold is set according to the actual network type and requirements.

6. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The training of the artificial intelligence model based on historical network security data and corresponding network security assessment coefficients includes: Integrate the historical network security data at the initial moment and the corresponding network security assessment coefficient as standard input data, and integrate the historical network security data at the preset prediction moment and the corresponding network security assessment coefficient as standard output data; An artificial intelligence model is trained based on standard input data and standard output data to obtain a network security assessment coefficient prediction model; wherein the artificial intelligence model includes: a convolutional neural network or a deep belief network.

7. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The predicting of network security data based on the network security assessment coefficient prediction model includes: The network security data collected in real time and the corresponding network security assessment coefficient obtained by calculation are input into the network security assessment coefficient prediction model to obtain the prediction result; wherein the prediction result includes: the network security data at the preset prediction time and the corresponding network security assessment coefficient.

8. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The determining whether to issue an early warning based on the prediction result and the preset network security threshold includes: Determine whether the network security assessment coefficient at the preset prediction moment is greater than the preset network security threshold; if yes, generate warning information; if not, continue to detect and judge.

9. The network security situation awareness and early warning system based on artificial intelligence according to claim 1 is characterized in that: The processing of the network based on the early warning information includes: Build a knowledge graph and search for the corresponding warning type in the knowledge graph based on the warning information; among them, historical warning types include: abnormal encrypted traffic ratio, abnormal key length, and abnormal number of login failures; S1: By extracting the network security assessment coefficient and warning type corresponding to the historical network security data from the historical warning records; S2: Extracting entities related to network security from historical warning records through natural language processing technology; the entities include: warning type, historical network security data and corresponding network security assessment coefficient; S3: Extract the relationship between entities; S4: Map entities and relationships into a graph using graph database technology to obtain a knowledge graph; graph database technologies include Neo4j or Dgraph; S5: Matching the corresponding warning type in the knowledge graph based on the network security assessment coefficient corresponding to the received warning information; S5: Process the network based on the matched warning type.

10. A network security situation awareness and early warning method based on artificial intelligence, applied to a network security situation awareness and early warning system based on artificial intelligence according to any one of claims 1 to 9, characterized in that: include: Step 1: Obtain network data in the network within a preset time period; Step 2: Calculate the network security assessment coefficient based on network security data; Step 3: Determine whether to send warning information based on the network security assessment coefficient and the preset network security threshold; If yes, a warning message is sent to the client; If not, continue to monitor and judge; Step 4: Train the artificial intelligence model based on historical network security data and the corresponding network security assessment coefficient to obtain a network security assessment coefficient prediction model; Step 5: Predict the network security data based on the network security assessment coefficient prediction model to obtain the prediction results; Step 6: Determine whether to issue an early warning based on the prediction results and the preset network security threshold; If yes, a warning message is sent to the client; If not, continue to monitor and judge; Step 7: Process the network based on the warning information.

Images