Real-time tracking and tracing method and system for security incidents based on artificial intelligence

Abstract

The present invention relates to the field of security event tracking, and specifically to a method and system for real-time tracking and tracing of security events based on artificial intelligence, comprising: a port switching module, a traffic tracking module, a disk pointer module, a memory stack module and an attack clustering module, wherein the port switching module is used for structuring a server database and outputting a threat model, the traffic tracking module is used for tracking access traffic, the disk pointer module is used for encapsulating temporary data packets, the memory stack module is used for storing temporary data packets and pointers in a stack form, and the attack clustering module is used for clustering abnormal pointer clusters and identifying homologous attack traffic. The present invention can help trace the identity and attack path of the attacker, while reducing the repeated generation of security logs, improving the working efficiency of the security event protection system, helping to improve the efficiency and accuracy of real-time tracking and tracing of security events, and strengthening network security protection and emergency response capabilities.

Description

Technical Field

[0001] The present invention relates to the field of security incident tracking, and specifically to a method and system for real-time tracking and tracing of security incidents based on artificial intelligence. Background Art

[0002] A security incident refers to any activity or event that may pose a threat to a computer system or cause potential risks, such as abnormal access, network attacks, data theft, etc. Monitoring, recording and tracking security incidents can promptly detect, identify and respond to security incidents to ensure the security of systems and data.

[0003] Existing security incident protection mechanisms cluster and identify the sources of possible attack behaviors by recording and analyzing access logs of abnormal traffic. However, such protection mechanisms generate a large number of security event logs and information, which sometimes leads to information overload, reduces security protection efficiency, causes missed reports and false alarms, and lacks effective response measures for some attack behaviors that can interfere with log generation.

[0004] In addition, the existing security protection system has a certain tracking lag. When a security incident is discovered through log analysis and other means, the data and structure within the system may have been tampered with. Since the attacker's specific operations cannot be identified, the data cannot be recovered, which increases the loss of the attack and fails to effectively protect the computer system. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for real-time tracking and tracing of security incidents based on artificial intelligence to solve the problems raised in the above-mentioned background technology.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: a real-time tracking and tracing system for security events based on artificial intelligence, comprising: a port switching module, a traffic tracking module, a disk pointer module, a memory stack module and an attack clustering module;

[0007] The port switching module is used to structure the server database, partition the database storage space according to the storage data type, each partition is managed by an independent server node, and the server access port is used as the starting access node of the traffic, and the historical security log is identified by using the pattern recognition network, and the threat model is output. The port inputs the traffic characteristics of the access traffic into the threat model, outputs the threat coefficient, and uses the threat coefficient as the first element of the feature sequence of the access traffic;

[0008] The traffic tracking module is used to generate different affine algorithms for each server node. The fixed parameters in the algorithm are determined by the system clock. When the access traffic passes through a node, it needs to provide a feature sequence before being allowed to access. After processing the feature sequence using the node's affine algorithm, a new feature sequence is generated until the traffic accesses the data in the node.

[0009] The disk pointer module is used to record the operation behavior of the traffic on the node without actually changing the database content when the traffic copies, downloads and modifies the node data. After the operation is completed, all the operation behaviors of this traffic are encapsulated into a temporary data packet and stored in an independent disk space;

[0010] The memory stack module is used to store temporary data packets in an independent disk, and generate a pointer to a disk storage location from a characteristic sequence of access traffic, determine the storage location of the temporary data packet in the disk area according to the pointer length, pointer value and node data type, store them sequentially in a stack form, and return the address of the temporary data packet storage to the access traffic. After the access traffic access source submits the storage address through the trust proxy node, the node executes the temporary data packet file in the address stack in sequence;

[0011] The attack clustering module is used to determine that a security incident has occurred when continuous verification errors or stack overflows, cluster all pointers pointing to the abnormal stack, and according to the clustering results, the attack pointers within the clustering range are treated as the same family attack pointers. After clearing the stack, the access traffic involved in the security incident is tracked through the feature sequence corresponding to the cluster center pointer.

[0012] Further, the port switching module includes: a node fixing unit, a traffic switching unit and a threat model unit;

[0013] The node fixing unit is used to structure the data storage of the server and generate a server node network, wherein the input and output ends of the server node network are both network access port nodes;

[0014] The traffic exchange unit is used to build a data transmission link between nodes so that traffic flows in each server node;

[0015] The threat model unit is used to analyze the traffic characteristics of threat traffic in historical security logs using a pattern recognition network, and the traffic characteristics include: IP address, domain name, data volume, access direction and directional slice data.

[0016] Further, the traffic tracking module includes: an algorithm generalization unit and a node imprint unit;

[0017] The algorithm generalization unit is used to set an independent affine algorithm at each node, and determine the fixed parameter value in the algorithm by the system clock;

[0018] The node imprint unit is used to obtain the characteristic sequence of the access traffic and output the result after the characteristic sequence is processed by the algorithm.

[0019] Further, the disk pointer module includes: a behavior recording unit and a temporary file unit;

[0020] The behavior recording unit is used to record the operation process of the traffic when the access traffic copies, downloads and modifies the node, and compile the process into digital instructions;

[0021] The temporary file unit is used to generate a temporary data packet according to all operations performed on the node by the access traffic, and all digital instructions are stored in the temporary data packet.

[0022] Further, the memory stack module includes: an independent disk unit, a stack storage unit and an address return unit;

[0023] The independent disk unit is used to set an independent storage space in the server to store temporary data packets and access flow pointers;

[0024] The stack storage unit is used to stack and store temporary traffic packets for the same node within a unit cycle, and to sequentially execute instructions in the temporary traffic packets after the cycle ends;

[0025] The address returning unit is used to return the disk storage location to the access address after the temporary traffic packet is stored in the independent disk.

[0026] Further, the attack clustering module includes: a data collision unit and a pointer clustering unit;

[0027] The data collision unit is used to verify the sensitivity of the modification operation in the stack by using the system firewall, and when continuous verification failures or stack overflows within a unit cycle occur, it is determined to be a security event;

[0028] The pointer clustering unit is used to cluster the pointers pointing to the abnormal stack when a security event occurs, and identify the same-source attack traffic according to the clustering result.

[0029] The real-time tracking and tracing method of security incidents based on artificial intelligence includes the following steps:

[0030] Step S1. Node the services provided by the server, store service data separately in each node, and build data transmission links between nodes to generate a node network, with the network communication port as the starting node for the node network to receive access traffic;

[0031] Step S2. Use the pattern recognition network to analyze the historical security logs and output the threat model. After the starting node receives the access traffic, it inputs the traffic characteristics of the access traffic into the threat model and uses the output value as the initial key for the traffic to pass through the next node.

[0032] Step S3. Set an independent affine algorithm for each node, and use the node clock to determine the variable parameter value in the algorithm. After the traffic submits the key to the node, the node processes the key according to the affine algorithm and generates a new key from the processing result;

[0033] Step S4. When the access traffic copies, downloads and modifies the node data, no data is actually returned, only the operation process of the traffic is recorded, and the operation process is compiled into a temporary file containing digital instructions, which is stored in a separate disk in a stacked form, and a pointer to the disk storage location is generated by the key of the access traffic;

[0034] Step S5. The temporary files in the stack are executed after being verified by the system firewall in turn. When the verification fails continuously or the stack overflows within a unit period, it is judged that a security incident has occurred, and the pointers pointing to the abnormal stack are clustered. The traffic pointers within the clustering range identify the same-source attack traffic, and the flow trajectory of the attack traffic in the node is restored according to the key.

[0035] Further, step S1 includes:

[0036] Step S11. Format the node database when the server is restarted, partition the data in the database according to the type of corresponding service, and the partitions are independent of each other. Establish an access interface in each partition to form a point-to-point bidirectional transmission link with the corresponding service node;

[0037] Step S12. Establish a data transmission link between each server node, use the communication interface between the server and the outside world as the starting node of the node network, and use the encryption level as the minimum distance between the node and the communication port of the remaining nodes to generate a node network.

[0038] Further, step S2 includes:

[0039] Step S21. Obtaining historical security logs from the server security system, wherein the historical security logs record the traffic characteristics and attack intensity of the attack traffic, wherein the traffic characteristics include: the IP address, domain name, data volume, encryption level of access data, and traffic slice width of the traffic;

[0040] Step S22. Using a pattern recognition network, the traffic characteristics are used as input variables and the attack intensity is used as output to perform pattern fitting to obtain a threat model for access traffic. The selected pattern recognition network includes: a multi-layer perceptron (MLP), a convolutional neural network (CNN), a long short-term memory network (LSTM) and an autoencoder network (Autoencoder);

[0041] Step S23. After the starting node of the server receives an external access request, it inputs the traffic characteristics of the access traffic into the threat model. After obtaining the output result, it sets the initial key of the access traffic to [N, P], where N is the number of the starting node and P is the output result of the threat model.

[0042] Further, step S3 includes:

[0043] Step S31. Set the affine algorithm F in each node i (u,v), where i is the node number, u is the traffic key, and v is the node clock. The affine algorithm for the corresponding node is generated according to the standard affine table:

[0044]

[0045] Among them, A1, A2, ...A n+1 represents 1 to n+1 bits of output key, n is the length of the traffic key, x is a constant, and x∈{1, 2, …, n+1}, D i is the scaling factor of the node, u y represents the y-th traffic key, and specifies u n+1 =1,v (n-y) Represents the nyth data generated by the node clock;

[0046] Step S32. When access traffic passes through a node, it is necessary to provide a key to the node before being granted access, and use the node's affine algorithm to process the traffic key. The processing result is used as a new traffic key to record the access traffic.

[0047] Further, step S4 includes:

[0048] Step S41. When traffic accesses node data, the key of the traffic is downloaded to the node, and the copying, downloading and modifying operations of the traffic on the node data are recorded. The operation process of the traffic is recorded. After each operation, the operation behavior is compiled into a digital instruction until the traffic stops accessing the server;

[0049] Step S42. Generate a temporary file for all operations performed on the traffic node, wherein the temporary file stores all digital instructions compiled during the traffic access node process;

[0050] Step S43. Divide the server disk into independent areas, store the temporary files generated by the node in the unit period in the independent disk space in sequence in a stack format, and use the traffic key as a pointer to the temporary file storage address, and return the temporary file storage location and estimated execution time to the source device of the access traffic.

[0051] Further, step S5 includes:

[0052] Step S51. After the cycle ends, temporary files are extracted from the bottom of the stack in sequence, and the extracted temporary files are submitted to the firewall for verification. After the verification passes, all instructions in the temporary files are executed. When the verification fails continuously or the stack overflows within a unit cycle, it is determined that a security event has occurred, and the stack where the security event occurred is regarded as an abnormal stack;

[0053] Step S52: Cluster all pointers to the exception stack:

[0054]

[0055] Among them, s k represents the clustering standard deviation of the kth cluster, r represents the clustering radius, B represents the number of pointers, represents the number of clusters in the tth pointer, WE k Represents the number of cluster centers, Min k represents the minimum value of k that satisfies the conditions;

[0056] Step S53. The range of the cluster radius r around the cluster center pointer WE is taken as the cluster range. The traffic corresponding to the pointer within the cluster range is the homologous attack traffic. The pointer of each attack traffic is restored to the key. After inverse transformation, the server node through which the attack traffic passes is obtained.

[0057] Compared with the prior art, the beneficial effects achieved by the present invention are:

[0058] 1. The present invention can node the access process, and the nodes generate different affine algorithms according to the characteristics of the stored data. When the access request copies, downloads and modifies the node data, all input signals point to the operation node as pointers, and the nodes through which the traffic passes can be recorded on the access pointer, which can help trace the identity and attack path of the attacker, while reducing the repeated generation of security logs and improving the working efficiency of the security incident protection system.

[0059] 2. When dealing with data operation behaviors, the present invention does not actually output the database content, but encapsulates the request data into a data packet and stores it in the event pool, determines the data packet storage location according to the pointer length, pointer value and node data type, verifies and executes events in sequence according to the stack order of the event pool, and realizes security management without modifying the actual data, further strengthening network security defense measures and improving the security of the system.

[0060] 3. After a security incident occurs, the present invention can cluster all pointers pointing to the exception stack, track the access traffic involved in the security incident according to the clustering results, and classify the attack pointers within the clustering range as the same family of attack pointers, which helps to improve the efficiency and accuracy of real-time tracking and tracing of security incidents, and enhance network security protection and emergency response capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0062] Figure 1 It is a structural schematic diagram of the artificial intelligence-based real-time tracking and tracing system for security incidents of the present invention;

[0063] Figure 2 It is a schematic diagram of the steps of the method for real-time tracking and tracing of security incidents based on artificial intelligence of the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] See also Figure 1 ,The present invention provides a technical solution: a real-time tracking and tracing system for security events based on artificial intelligence, including: a port switching module, a traffic tracking module, a disk pointer module, a memory stack module and an attack clustering module;

[0066] The port switching module is used to structure the server database, partition the database storage space according to the storage data type, each partition is managed by an independent server node, and the server access port is used as the starting access node of the traffic, and the historical security log is identified by using the pattern recognition network, and the threat model is output. The port inputs the traffic characteristics of the access traffic into the threat model, outputs the threat coefficient, and uses the threat coefficient as the first element of the feature sequence of the access traffic;

[0067] The port switching module includes: a node fixing unit, a traffic switching unit and a threat model unit;

[0068] The node fixing unit is used to structure the data storage of the server and generate a server node network, wherein the input and output ends of the server node network are both network access port nodes;

[0069] The traffic exchange unit is used to build a data transmission link between nodes so that traffic flows in each server node;

[0070] The threat model unit is used to analyze the traffic characteristics of threat traffic in historical security logs using a pattern recognition network, and the traffic characteristics include: IP address, domain name, data volume, access direction and directional slice data.

[0071] The traffic tracking module is used to generate different affine algorithms for each server node. The fixed parameters in the algorithm are determined by the system clock. When the access traffic passes through a node, it needs to provide a feature sequence before being allowed to access. After processing the feature sequence using the node's affine algorithm, a new feature sequence is generated until the traffic accesses the data in the node.

[0072] The traffic tracking module includes: an algorithm generalization unit and a node imprint unit;

[0073] The algorithm generalization unit is used to set an independent affine algorithm at each node, and determine the fixed parameter value in the algorithm by the system clock;

[0074] The node imprint unit is used to obtain the characteristic sequence of the access traffic and output the result after the characteristic sequence is processed by the algorithm.

[0075] The disk pointer module is used to record the operation behavior of the traffic on the node without actually changing the database content when the traffic copies, downloads and modifies the node data. After the operation is completed, all the operation behaviors of this traffic are encapsulated into a temporary data packet and stored in an independent disk space;

[0076] The disk pointer module includes: a behavior recording unit and a temporary file unit;

[0077] The behavior recording unit is used to record the operation process of the traffic when the access traffic copies, downloads and modifies the node, and compile the process into digital instructions;

[0078] The temporary file unit is used to generate a temporary data packet according to all operations performed on the node by the access traffic, and all digital instructions are stored in the temporary data packet.

[0079] The memory stack module is used to store temporary data packets in an independent disk, and generate a pointer to a disk storage location from a characteristic sequence of access traffic, determine the storage location of the temporary data packet in the disk area according to the pointer length, pointer value and node data type, store them sequentially in a stack form, and return the address of the temporary data packet storage to the access traffic. After the access traffic access source submits the storage address through the trust proxy node, the node executes the temporary data packet file in the address stack in sequence;

[0080] The memory stack module includes: an independent disk unit, a stack storage unit and an address return unit;

[0081] The independent disk unit is used to set an independent storage space in the server to store temporary data packets and access flow pointers;

[0082] The stack storage unit is used to stack and store temporary traffic packets for the same node within a unit cycle, and to sequentially execute instructions in the temporary traffic packets after the cycle ends;

[0083] The address returning unit is used to return the disk storage location to the access address after the temporary traffic packet is stored in the independent disk.

[0084] The attack clustering module is used to determine that a security incident has occurred when continuous verification errors or stack overflows, cluster all pointers pointing to the abnormal stack, and according to the clustering results, the attack pointers within the clustering range are treated as the same family attack pointers. After clearing the stack, the access traffic involved in the security incident is tracked through the feature sequence corresponding to the cluster center pointer.

[0085] The attack clustering module includes: a data collision unit and a pointer clustering unit;

[0086] The data collision unit is used to verify the sensitivity of the modification operation in the stack by using the system firewall, and when continuous verification failures or stack overflows within a unit cycle occur, it is determined to be a security event;

[0087] The pointer clustering unit is used to cluster the pointers pointing to the abnormal stack when a security event occurs, and identify the same-source attack traffic according to the clustering result.

[0088] The real-time tracking and tracing method of security incidents based on artificial intelligence includes the following steps:

[0089] Step S1. Node the services provided by the server, store service data separately in each node, and build data transmission links between nodes to generate a node network, with the network communication port as the starting node for the node network to receive access traffic;

[0090] Step S1 includes:

[0091] Step S11. Format the node database when the server is restarted, partition the data in the database according to the type of corresponding service, and the partitions are independent of each other. Establish an access interface in each partition to form a point-to-point bidirectional transmission link with the corresponding service node;

[0092] Step S12. Establish a data transmission link between each server node, use the communication interface between the server and the outside world as the starting node of the node network, and use the encryption level as the minimum distance between the node and the communication port of the remaining nodes to generate a node network.

[0093] Step S2. Use the pattern recognition network to analyze the historical security logs and output the threat model. After the starting node receives the access traffic, it inputs the traffic characteristics of the access traffic into the threat model and uses the output value as the initial key for the traffic to pass through the next node.

[0094] Step S2 includes:

[0095] Step S21. Obtaining historical security logs from the server security system, wherein the historical security logs record the traffic characteristics and attack intensity of the attack traffic, wherein the traffic characteristics include: the IP address, domain name, data volume, encryption level of access data, and traffic slice width of the traffic;

[0096] Step S22. Using a pattern recognition network, the traffic characteristics are used as input variables and the attack intensity is used as output to perform pattern fitting to obtain a threat model for access traffic. The selected pattern recognition network includes: a multi-layer perceptron (MLP), a convolutional neural network (CNN), a long short-term memory network (LSTM) and an autoencoder network (Autoencoder);

[0097] Step S23. After the starting node of the server receives an external access request, it inputs the traffic characteristics of the access traffic into the threat model. After obtaining the output result, it sets the initial key of the access traffic to [N, P], where N is the number of the starting node and P is the output result of the threat model.

[0098] Step S3. Set an independent affine algorithm for each node, and use the node clock to determine the variable parameter value in the algorithm. After the traffic submits the key to the node, the node processes the key according to the affine algorithm and generates a new key from the processing result;

[0099] Step S3 includes:

[0100] Step S31. Set the affine algorithm F in each node i (u,v), where i is the node number, u is the traffic key, and v is the node clock. The affine algorithm for the corresponding node is generated according to the standard affine table:

[0101]

[0102] Among them, A1, A2, ...A n+1 represents 1 to n+1 bits of output key, n is the length of the traffic key, x is a constant, and x∈{1, 2, …, n+1}, D i is the scaling factor of the node, u y represents the y-th traffic key, and specifies u n+1 =1,v (n-y) Represents the nyth data generated by the node clock;

[0103] Step S32. When access traffic passes through a node, it is necessary to provide a key to the node before being granted access, and use the node's affine algorithm to process the traffic key. The processing result is used as a new traffic key to record the access traffic.

[0104] Step S4. When the access traffic copies, downloads and modifies the node data, no data is actually returned, only the operation process of the traffic is recorded, and the operation process is compiled into a temporary file containing digital instructions, which is stored in a separate disk in a stacked form, and a pointer to the disk storage location is generated by the key of the access traffic;

[0105] Step S4 includes:

[0106] Step S41. When traffic accesses node data, the key of the traffic is downloaded to the node, and the copying, downloading and modifying operations of the traffic on the node data are recorded. The operation process of the traffic is recorded. After each operation, the operation behavior is compiled into a digital instruction until the traffic stops accessing the server;

[0107] Step S42. Generate a temporary file for all operations performed on the traffic node, wherein the temporary file stores all digital instructions compiled during the traffic access node process;

[0108] Step S43. Divide the server disk into independent areas, store the temporary files generated by the node in the unit period in the independent disk space in sequence in a stack format, and use the traffic key as a pointer to the temporary file storage address, and return the temporary file storage location and estimated execution time to the source device of the access traffic.

[0109] Step S5. The temporary files in the stack are executed after being verified by the system firewall in turn. When the verification fails continuously or the stack overflows within a unit period, it is judged that a security incident has occurred, and the pointers pointing to the abnormal stack are clustered. The traffic pointers within the clustering range identify the same-source attack traffic, and the flow trajectory of the attack traffic in the node is restored according to the key.

[0110] Step S5 includes:

[0111] Step S51. After the cycle ends, temporary files are extracted from the bottom of the stack in sequence, and the extracted temporary files are submitted to the firewall for verification. After the verification passes, all instructions in the temporary files are executed. When the verification fails continuously or the stack overflows within a unit cycle, it is determined that a security event has occurred, and the stack where the security event occurred is regarded as an abnormal stack;

[0112] Step S52: Cluster all pointers to the exception stack:

[0113]

[0114] Among them, s k represents the clustering standard deviation of the kth cluster, r represents the clustering radius, B represents the number of pointers, represents the number of clusters in the tth pointer, WE k Represents the number of cluster centers, Min k represents the minimum value of k that satisfies the conditions;

[0115] Step S53. The range of the cluster radius r around the cluster center pointer WE is taken as the cluster range. The traffic corresponding to the pointer within the cluster range is the homologous attack traffic. The pointer of each attack traffic is restored to the key. After inverse transformation, the server node through which the attack traffic passes is obtained.

[0116] Example: When range traffic accesses the server from port 2, the port obtains the traffic characteristics of the access traffic, inputs the threat model, and the output result is 5. The initial key of the traffic is set to [2,5]. After the key passes through the first node, the key becomes [2,3,1]. After passing through the second node, the key becomes [6,4,7,3]. The traffic accesses the second node and modifies the data in the node. The system records the modification operation and compiles it into a temporary file stored in the stack. The stack instruction is executed after the 10s cycle ends. The modification command is executed after the firewall confirms that the modification is risk-free.

[0117] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0118] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A real-time tracking and tracing method for security incidents based on artificial intelligence, characterized in that: The method comprises the following steps: Step S1. Node the services provided by the server, store service data in each node separately, and build data transmission links between nodes to generate a node network, with the communication interface between the server and the outside world as the starting node for the node network to receive access traffic; Step S2. Use the pattern recognition network to perform pattern analysis on historical security logs and output a threat model. The threat model takes traffic characteristics as input and attack strength as output. After the starting node receives the access traffic, the traffic characteristics of the access traffic are input into the threat model, and the output value is used as the initial key for the traffic to pass through the next node; Step S3. Set an independent affine algorithm for each node, and use the node clock to determine the variable parameter value in the algorithm. After the traffic submits the key to the node, the node processes the key according to the affine algorithm and generates a new key from the processing result; Step S4. When the access traffic copies, downloads and modifies the node data, no data is actually returned, only the operation process of the traffic is recorded, and the operation process is compiled into a temporary file containing digital instructions, which is stored in a separate disk in a stacked form, and a pointer to the disk storage location is generated by the key of the access traffic; Step S5. The temporary files in the stack are executed after being verified by the system firewall in sequence. When the verification fails continuously or the stack overflows within a unit period, it is judged that a security incident has occurred, and the pointers pointing to the abnormal stack are clustered. The traffic pointers in the clustering range identify the same-source attack traffic, and the flow track of the attack traffic in the node is restored according to the key; Step S3 includes: Step S31. Set the affine algorithm F in each node i (u,v), where i is the node number, u is the traffic key, and v is the node clock. The affine algorithm for the corresponding node is generated according to the standard affine table: ； Among them, A1, A2, ...A n+1 represents 1 to n+1 bits of output key, n is the length of the traffic key, x is a constant, and x∈{1, 2, …, n+1}, D i is the scaling factor of the node, u y represents the y-th traffic key, and specifies u n+1 =1,v (n-y) Represents the nyth data generated by the node clock; Step S32. When access traffic passes through a node, it is necessary to provide a key to the node before being granted access, and use the node's affine algorithm to process the traffic key. The processing result is used as a new traffic key to record the access traffic.

2. The method for real-time tracking and tracing of security incidents based on artificial intelligence according to claim 1 is characterized in that: Step S1 includes: Step S11. Format the node database when the server is restarted, partition the data in the database according to the type of corresponding service, and the partitions are independent of each other. Establish an access interface in each partition to form a point-to-point bidirectional transmission link with the corresponding service node; Step S12. Establish a data transmission link between each server node, take the communication interface between the server and the outside world as the starting node of the node network, and the remaining nodes use the encryption level as the minimum distance between the node and the communication port to generate a node network; Step S2 includes: Step S21. Obtaining a historical security log from the server security system, wherein the historical security log records the traffic characteristics and attack intensity of the attack traffic, wherein the traffic characteristics include: the IP address, domain name, data volume, encryption level of access data, and traffic slice width of the traffic; Step S22. Using a pattern recognition network, taking traffic characteristics as input variables and attack intensity as output, pattern fitting is performed to obtain a threat model for access traffic. The selected pattern recognition network includes: a multi-layer perceptron, a convolutional neural network, a long short-term memory network, and an autoencoder network; Step S23. After the starting node of the server receives an external access request, it inputs the traffic characteristics of the access traffic into the threat model. After obtaining the output result, it sets the initial key of the access traffic to [N, P], where N is the number of the starting node and P is the output result of the threat model.

3. The method for real-time tracking and tracing of security incidents based on artificial intelligence according to claim 2 is characterized in that: Step S4 includes: Step S41. When traffic accesses node data, the key of the traffic is downloaded to the node, and the copying, downloading and modifying operations of the traffic on the node data are recorded. The operation process of the traffic is recorded. After each operation, the operation behavior is compiled into a digital instruction until the traffic stops accessing the server; Step S42. Generate a temporary file for all operations performed on the traffic node, wherein the temporary file stores all digital instructions compiled during the traffic access node process; Step S43. Divide the server disk into independent areas, store the temporary files generated by the node in the unit period in the independent disk space in sequence in a stack format, and use the traffic key as a pointer to the temporary file storage address, and return the temporary file storage location and estimated execution time to the source device of the access traffic.

4. The method for real-time tracking and tracing of security incidents based on artificial intelligence according to claim 3 is characterized in that: Step S5 includes: Step S51. After the cycle ends, temporary files are extracted from the bottom of the stack in sequence, and the extracted temporary files are submitted to the firewall for verification. After the verification passes, all instructions in the temporary files are executed. When the verification fails continuously or the stack overflows within a unit cycle, it is determined that a security event has occurred, and the stack where the security event occurred is regarded as an abnormal stack; Step S52: Cluster all pointers to the exception stack: ； Among them, s k represents the clustering standard deviation of the kth cluster, r represents the clustering radius, B represents the number of pointers, represents the number of clusters in the tth pointer, WE k Represents the number of cluster centers, Min k represents the minimum value of k that satisfies the conditions; Step S53. The range of the cluster radius r around the cluster center pointer WE is taken as the cluster range. The traffic corresponding to the pointer within the cluster range is the homologous attack traffic. The pointer of each attack traffic is restored to the key. After inverse transformation, the server node through which the attack traffic passes is obtained.

5. A system for real-time tracking and tracing of security incidents based on artificial intelligence, wherein the system executes the method for real-time tracking and tracing of security incidents based on artificial intelligence as described in claim 1, characterized in that: The system includes the following modules: a port switching module, a traffic tracking module, a disk pointer module, a memory stack module and an attack clustering module; The port switching module is used to structure the server database, partition the database storage space according to the storage data type, each partition is managed by an independent server node, and the server's access port is used as the starting access node of the traffic, and the historical security log is identified by using the pattern recognition network, and the threat model is output. The port inputs the traffic characteristics of the access traffic into the threat model, outputs the attack intensity, and uses the attack intensity as the first element of the feature sequence of the access traffic; The traffic tracking module is used to generate different affine algorithms for each server node. The fixed parameters in the algorithm are determined by the system clock. When the access traffic passes through a node, it needs to provide a feature sequence before being allowed to access. After processing the feature sequence using the node's affine algorithm, a new feature sequence is generated until the traffic accesses the data in the node. The disk pointer module is used to record the operation behavior of the traffic on the node without actually changing the database content when the traffic copies, downloads and modifies the node data. After the operation is completed, all the operation behaviors of this traffic are encapsulated into a temporary data packet and stored in an independent disk space; The memory stack module is used to store temporary data packets in an independent disk, and generate a pointer to a disk storage location from a characteristic sequence of access traffic, determine the storage location of the temporary data packet in the disk area according to the pointer length, pointer value and node data type, store them sequentially in a stack form, and return the address of the temporary data packet storage to the access traffic. After the access traffic access source submits the storage address through the trust proxy node, the node executes the temporary data packet file in the address stack in sequence; The attack clustering module is used to use the system firewall to verify the sensitivity of modification operations in the stack. When continuous verification failures occur or the stack overflows within a unit period, it is judged as a security incident, and all pointers pointing to the abnormal stack are clustered. According to the clustering results, the attack pointers within the clustering range are treated as the same family attack pointers. After the stack is cleared, the access traffic involved in the security incident is tracked through the feature sequence corresponding to the cluster center pointer.

6. The artificial intelligence-based real-time security incident tracking and tracing system according to claim 5 is characterized by: The port switching module includes: a node fixing unit, a traffic switching unit and a threat model unit; The node fixing unit is used to structure the data storage of the server and generate a server node network, wherein the input and output ends of the server node network are both network access port nodes; The traffic exchange unit is used to build a data transmission link between nodes so that traffic flows in each server node; The threat model unit is used to analyze the traffic characteristics of threat traffic in historical security logs using a pattern recognition network, and the traffic characteristics include: IP address, domain name, data volume, access direction and directional slice data.

7. The artificial intelligence-based real-time security incident tracking and tracing system according to claim 6 is characterized by: The traffic tracking module includes: an algorithm generalization unit and a node imprint unit; The algorithm generalization unit is used to set an independent affine algorithm at each node, and determine the fixed parameter value in the algorithm by the system clock; The node imprint unit is used to obtain a characteristic sequence of access traffic and output a result after the characteristic sequence is processed by an algorithm; The disk pointer module includes: a behavior recording unit and a temporary file unit; The behavior recording unit is used to record the operation process of the traffic when the access traffic copies, downloads and modifies the node, and compile the process into digital instructions; The temporary file unit is used to generate a temporary data packet according to all operations performed on the node by the access traffic, and all digital instructions are stored in the temporary data packet.

8. The artificial intelligence-based real-time security incident tracking and tracing system according to claim 7 is characterized by: The memory stack module includes: an independent disk unit, a stack storage unit and an address return unit; The independent disk unit is used to set an independent storage space in the server to store temporary data packets and access flow pointers; The stack storage unit is used to stack and store temporary traffic packets for the same node within a unit cycle, and to sequentially execute instructions in the temporary traffic packets after the cycle ends; The address returning unit is used to return the disk storage location to the access address after the temporary traffic packet is stored in the independent disk.

9. The artificial intelligence-based real-time security incident tracking and tracing system according to claim 8 is characterized by: The attack clustering module includes: a data collision unit and a pointer clustering unit; The data collision unit is used to verify the sensitivity of the modification operation in the stack by using the system firewall, and when continuous verification failures or stack overflows within a unit cycle occur, it is determined to be a security event; The pointer clustering unit is used to cluster the pointers pointing to the abnormal stack when a security event occurs, and identify the same-source attack traffic according to the clustering result.

Images