Network security automatic early warning method and device based on artificial intelligence, and electronic equipment

Abstract

The invention relates to the field of network security, and particularly discloses a network security automatic early warning method and device based on artificial intelligence, and electronic equipment, and the method comprises the steps: firstly obtaining historical intrusion event data, a network security data set and current network situation data, then carrying out the feature extraction and correlation analysis of the three data through employing a deep learning technology, and obtaining an early warning result; and finally, through a classifier, whether a network security early warning alarm is sent out is judged, so that potential security threats are judged, early warning is sent out in time, and more effective security decisions and response strategies are made.

Description

Technical Field

[0001] The present application relates to the field of network security, and more specifically, to an artificial intelligence-based network security automatic early warning method, device and electronic equipment. Background Art

[0002] Cybersecurity is the practice and technology of protecting computer systems, networks and their data from attacks, damage or unauthorized access. It involves multi-faceted strategies, including firewalls, encryption, authentication and user education, to ensure the confidentiality, integrity and availability of information. As digitalization accelerates, cybersecurity becomes increasingly important and a key factor in protecting personal privacy and business secrets.

[0003] In the field of network security, the technologies for preventing, detecting and responding to intrusions have received extensive attention. However, current defense mechanisms are all passive technologies that can only respond after an attack occurs.

[0004] Therefore, an artificial intelligence-based automatic network security early warning method, device and electronic device are desired. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiments of this application provide an artificial intelligence-based network security automatic early warning method, device and electronic device, which first obtains historical intrusion event data, network security data set and current network situation data, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally uses a classifier to determine whether to issue a network security early warning alarm, thereby determining potential security threats, issuing early warnings in a timely manner, and making more effective security decisions and response strategies.

[0006] According to one aspect of the present application, there is provided an artificial intelligence-based network security automatic early warning method, which includes:

[0007] Obtain historical intrusion event data, network security data sets, and current network situation data;

[0008] Extracting a network security multimodal information association feature vector and a current network situation text semantic feature vector from the historical intrusion event data, the network security data set and the current network situation data;

[0009] Based on the network security multimodal information association feature vector and the current network situation text semantic feature vector, it is determined whether to issue a network security early warning alarm.

[0010] According to another aspect of the present application, there is provided an artificial intelligence-based network security automatic early warning device, which includes:

[0011] The network security data acquisition module is used to obtain historical intrusion event data, network security data sets and current network situation data;

[0012] A network security data processing module, used to extract network security multimodal information association feature vectors and current network situation text semantic feature vectors from the historical intrusion event data, the network security data set and the current network situation data;

[0013] The network security early warning alarm judgment module is used to judge whether to issue a network security early warning alarm based on the network security multimodal information association feature vector and the current network situation text semantic feature vector.

[0014] According to another aspect of the present application, there is provided an electronic device, comprising: a processor; and a memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the above-mentioned artificial intelligence-based automatic network security early warning device.

[0015] Compared with the prior art, the present application provides an artificial intelligence-based network security automatic early warning method, device and electronic device, which first obtains historical intrusion event data, network security data sets and current network situation data, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally uses a classifier to determine whether to issue a network security early warning alarm, thereby judging potential security threats, issuing early warnings in a timely manner, and making more effective security decisions and response strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0017] Figure 1 The present invention is a flowchart of an automatic network security early warning method based on artificial intelligence according to an embodiment of the present application.

[0018] Figure 2 The present invention is a flowchart of extracting features from the historical intrusion event data to obtain a global feature vector of the historical intrusion event in the artificial intelligence-based automatic network security early warning method according to an embodiment of the present application.

[0019] Figure 3The present invention is a flowchart of extracting features from the network security data set to obtain a network security data text understanding feature vector in the artificial intelligence-based network security automatic early warning method according to an embodiment of the present application.

[0020] Figure 4 The present invention is a flowchart of extracting features from the current network situation data in the artificial intelligence-based automatic network security early warning method according to an embodiment of the present application to obtain a semantic feature vector of the current network situation text.

[0021] Figure 5 It is a block diagram of an artificial intelligence-based automatic network security early warning device according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0023] Figure 1 Flowchart of the network security automatic early warning method based on artificial intelligence according to the embodiment of the present application. Figure 1 As shown, according to the embodiment of the present application, the artificial intelligence-based automatic network security early warning method includes: S110, acquiring historical intrusion event data, a network security data set and current network situation data; S120, extracting a network security multimodal information associated feature vector and a current network situation text semantic feature vector from the historical intrusion event data, the network security data set and the current network situation data; S130, judging whether to issue a network security early warning alarm based on the network security multimodal information associated feature vector and the current network situation text semantic feature vector.

[0024] In the above-mentioned artificial intelligence-based network security automatic early warning method, the step S110 obtains historical intrusion event data, network security data set and current network situation data. It should be understood that network security aims to protect computer systems, networks and their data from attack, damage or unauthorized access. It covers a variety of strategies and technical means, including firewalls, encryption measures, identity authentication and user training, with the goal of maintaining the confidentiality, integrity and availability of information. With the acceleration of digital transformation, the importance of network security has become increasingly prominent, becoming an important guarantee for protecting personal privacy and corporate secrets. In the field of network security, technologies for preventing, detecting and responding to intrusions have received widespread attention. However, most of the current defense mechanisms are passive and need to react only after the attack occurs, which is not timely and effective enough when dealing with rapidly evolving network threats. Therefore, in the technical solution of the present application, historical intrusion event data, network security data set and current network situation data are obtained, and combined with deep learning technology, potential security threats are evaluated to determine whether to issue a network security early warning alarm, so that an alarm can be issued in time, thereby formulating more effective security decisions and response strategies.

[0025] Specifically, historical intrusion event data provides a detailed record of past cyber attacks, including information such as attacker behavior patterns, attack methods, and vulnerability of victim systems. These data help security experts analyze and understand the evolution of attacks, identify attackers' common methods and the weaknesses they target. Network security data sets usually include various malware samples, phishing websites, vulnerability information, and user behavior data. These data sets can not only be used for the development and testing of security tools, but also help researchers evaluate the effectiveness of different security strategies. Current network situation data reflects the real-time network security status, including detected attack activities, network traffic anomalies, vulnerability exploitation, etc. The real-time and dynamic nature of this type of data enables security teams to quickly identify and respond to potential network threats. By combining historical data, network security data sets, and current network situation data, organizations can form a comprehensive security situation awareness system. This system not only enhances the ability to prevent known threats, but also improves the ability to adapt to new attacks.

[0026] In the above-mentioned artificial intelligence-based automatic network security early warning method, the step S120 extracts network security multimodal information association feature vectors and current network situation text semantic feature vectors from the historical intrusion event data, the network security data set and the current network situation data. It should be understood that extracting multimodal information association feature vectors and text semantic feature vectors from historical intrusion event data, network security data sets and current network situation data can help achieve more intelligent network security protection. This comprehensive analysis can not only provide more comprehensive situation awareness, but also provide rich training data for machine learning models, improving the model's prediction ability and response speed. By continuously optimizing the extraction and application of these feature vectors, organizations can continuously improve their perception and response capabilities of network security situations, and effectively respond to complex and changing network security threats.

[0027] In a specific embodiment of the present application, the step S120 includes: performing feature extraction on the historical intrusion event data to obtain a global feature vector of the historical intrusion events; performing feature extraction on the network security data set to obtain a network security data text understanding feature vector; associating the historical intrusion event global feature vector and the network security data text understanding feature vector to obtain the network security multimodal information association feature vector; performing feature extraction on the current network situation data to obtain the current network situation text semantic feature vector.

[0028] It should be understood that historical intrusion event data contains a wealth of attack information, including the attacker's behavior, the tools used, the attack path, the vulnerability of the victim system, and the final impact. By extracting features from this data, a series of representative features can be extracted, such as the attack type (such as phishing, denial of service attacks, etc.), attack duration, attack frequency, and impact range. These features can form a global feature vector that reflects the overall characteristics and trends of past attacks, thus providing a basis for subsequent analysis and decision-making.

[0029] Furthermore, network security datasets usually contain a large amount of unstructured text information, such as security reports, intrusion detection logs, malware descriptions, network traffic logs, and security bulletins. These texts contain rich information about security events, but due to their diverse forms and large scale, manual processing is inefficient. Through feature extraction, these text data can be converted into feature vectors, which can be effectively used in machine learning or data analysis models. The process of extracting text understanding feature vectors includes extracting key words, phrases, topics from these unstructured data, and modeling semantic relationships, which allows machines to understand and process this information. Here, feature extraction can simplify and summarize a large amount of information. Text understanding feature vectors can help security systems identify key security threat signals from complex information and filter out important events or patterns.

[0030] Furthermore, the global feature vector of historical intrusion events provides structured information about past attack behaviors, including attack types, patterns, affected systems and their vulnerabilities. On the other hand, the network security data text understanding feature vector extracts important security event information from a large amount of unstructured text, such as attack descriptions, situational context, and related security reports. By associating these two feature vectors, information complementarity and enhancement can be achieved. This combination not only enables the model to learn richer features, but also helps it respond more quickly to new attacks based on historical patterns and current situations.

[0031] In particular, current network situation data usually contains rich unstructured text information, such as security reports, log files, social media discussions, network announcements, and user feedback. These text information not only reflects the real-time dynamics in the network environment, but also contains contextual information related to security incidents. Through feature extraction, these unstructured texts can be converted into structured semantic feature vectors, allowing computers to process and analyze these data more effectively. Specifically, through natural language processing (NLP) technology, keywords, phrases, and topics in the text can be extracted to reveal important information such as potential attack activities, affected systems, and attackers' intentions. This information helps security experts understand the possible risks in the current network environment more quickly and respond in a timely manner.

[0032] Figure 2 The flowchart is a method for extracting features from the historical intrusion event data to obtain a global feature vector of the historical intrusion event in the network security automatic early warning method based on artificial intelligence according to an embodiment of the present application. Figure 2As shown, in a specific embodiment of the present application, feature extraction is performed on the historical intrusion event data to obtain a global feature vector of the historical intrusion event, including: S210, resampling the historical intrusion event data to obtain historical intrusion event resampled data; S220, passing the historical intrusion event resampled data through a historical intrusion event resampled data generator based on an adversarial generative network to obtain historical intrusion event balanced text data; S230, passing the historical intrusion event balanced text data through a historical intrusion event balanced text context semantic encoder to obtain the global feature vector of the historical intrusion event.

[0033] It should be understandable that historical intrusion event data may be unbalanced. That is, many types of network attacks occur less frequently, resulting in an imbalance in the ratio of positive and negative samples in the data set. If the original data is used directly for analysis, the model may tend to learn more frequent attack patterns and ignore rare but equally important attack types. Through resampling, the number of different types of events can be balanced and the model's ability to identify various types of attacks can be enhanced. For example, oversampling technology can increase the number of minority class samples, while undersampling can reduce the number of majority class samples, thereby achieving data balance. Specifically, the network security environment is dynamically changing, and the attack patterns and characteristics in different time periods may be very different. Through resampling, a specific time window can be selected from the historical data to obtain the characteristics and patterns within a certain period. This method makes the data set more timely and representative, which helps to capture the true state of current network threats.

[0034] Furthermore, although the use of resampling technology can balance the data to a certain extent, it sometimes causes loss or duplication of information, making it difficult to fully capture the characteristics of minority class events. In the technical solution of the present application, the generative adversarial network is trained through two competing networks (generator and discriminator). The generator is responsible for generating new samples similar to the training data, while the discriminator is responsible for determining whether the sample is real data or generated data. Through this adversarial process, the generator continuously optimizes the samples it generates, so that the generated data is closer to the real attack events in terms of characteristics. This method can not only generate text data, but also introduce rich semantic features into the text, making the generated data more authentic and effective. In this way, the method based on the adversarial generative network can effectively increase the number of minority class samples by generating new data instances, thereby improving this imbalance problem.

[0035] Furthermore, after being processed by the Generative Adversarial Network (GAN), the balanced text data of historical intrusion events has good diversity and representativeness. However, these text data are often unstructured, and it may be difficult to extract useful information directly for analysis. Therefore, the use of contextual semantic encoders can transform these unstructured text data into structured feature vectors, so that the model can understand and process the semantic information therein. Among them, contextual semantic encoders (such as models based on the Transformer architecture) have a powerful ability to capture contextual relationships and deep semantic features in text. By encoding balanced text data, the model can identify the relationship between different events and the characteristics of various attack modes. This ability enables the encoder to not only understand a single event, but also take into account the correlation between events to generate a global feature vector. Specifically, the historical invasion event balanced text data is segmented to obtain a historical invasion word sequence; the embedding layer of the historical invasion event balanced text context semantic encoder is used to map each historical invasion word in the historical invasion word sequence into a word embedding vector to obtain a sequence of historical invasion word embedding vectors; the converter-based Bert model of the historical invasion event balanced text context semantic encoder is used to perform global context semantic encoding on the sequence of historical invasion word embedding vectors to obtain multiple historical invasion feature vectors; and the multiple historical invasion feature vectors are cascaded to obtain the global feature vector of the historical invasion event.

[0036] Figure 3 The present invention is a flowchart of extracting features from the network security data set to obtain a network security data text understanding feature vector in the network security automatic warning method based on artificial intelligence according to an embodiment of the present application. Figure 3 As shown, in a specific embodiment of the present application, feature extraction is performed on the network security data set to obtain a network security data text understanding feature vector, including: S310, word segmentation is performed on the network security data set and a network security data item embedding encoder is used to obtain a sequence of network security data item embedding vectors; S320, the sequence of network security data item embedding vectors is passed through a network security data item multi-scale neighborhood feature extraction module to obtain the network security data text understanding feature vector.

[0037] It should be understood that network security datasets often contain a large amount of unstructured data, such as log files, attack descriptions, user behavior records, etc. These data are in different and complex forms, and it may be difficult to extract useful information directly for analysis. Therefore, it is necessary to perform word segmentation. The word segmentation process divides text data into meaningful units (such as words, phrases, etc.), making subsequent processing more efficient and accurate. Through word segmentation, the main content and structure in the data can be understood more clearly. The data after word segmentation needs to be further processed by the network security data item embedding encoder. The embedding encoder can convert the text after word segmentation into a low-dimensional dense vector. This vectorized representation can not only capture the semantic information of a single data item, but also take into account their contextual relationship in the entire dataset. For example, in an attack log, the same word may have different meanings in different contexts. The embedding encoder can learn these subtle differences through training, thereby generating a more accurate vector representation. The serialization of the embedded vector also enables the model to use sequence data for time series analysis, thereby improving the ability to identify and predict attack behaviors.

[0038] Furthermore, the embedding vector of cybersecurity data items is essentially a high-dimensional, dense representation of the original data, which can effectively capture the semantic features in the text. However, feature extraction at a single scale may not fully reflect the complex relationships and subtle differences in the data. For example, in an attack log, some attack patterns may appear very similar in a local context, but have significantly different features in a global context. The multi-scale neighborhood feature extraction module considers information at different scales simultaneously, allowing the model to comprehensively consider local and global features, thereby more comprehensively understanding the text content. Among them, the multi-scale feature extraction module can process the embedding vector through different convolution kernels or filters to extract information at different levels. For example, small-scale features may focus on the subtle relationship between words, while large-scale features can identify patterns at the sentence or paragraph level. This hierarchical feature extraction can improve the depth of understanding of cybersecurity data and enable the model to identify complex attack patterns. Specifically, the network security data item multi-scale neighborhood feature extraction module includes: a first convolution layer, a second convolution layer parallel to the first convolution layer, and a cascade layer connected to the first convolution layer and the second convolution layer, wherein the first convolution layer uses a one-dimensional convolution kernel with a first scale, and the second convolution layer uses a one-dimensional convolution kernel with a second scale. More specifically, the first convolution layer of the network security data item multi-scale neighborhood feature extraction module is used to perform one-dimensional convolution encoding on the input data to obtain a first-scale feature vector; the second convolution layer of the network security data item multi-scale neighborhood feature extraction module is used to perform one-dimensional convolution encoding on the input data to obtain a second-scale feature vector; the first-scale feature vector and the second-scale feature vector are cascaded to obtain the network security data text understanding feature vector.

[0039] In a specific embodiment of the present application, the historical intrusion event global feature vector and the network security data text understanding feature vector are associated to obtain the network security multimodal information associated feature vector, including: obtaining the historical intrusion event global feature vector and the network security data text understanding feature vector in array form; serializing the historical intrusion event global feature vector and the network security data text understanding feature vector into byte streams respectively, and saving them to files; reading the serialized historical intrusion event global feature vector and the serialized network security data text understanding feature vector from the file using the ObjectInputStream mechanism; after reading the serialized historical intrusion event global feature vector and the serialized network security data text understanding feature vector, calculating the product of the historical intrusion event global feature vector and the network security data text understanding feature vector to obtain the network security multimodal information associated feature vector; serializing the calculated network security multimodal information associated feature vector and saving it to a file.

[0040] It should be understood that ObjectInputStream is a class in the Java standard library that is used to read objects from an input stream. It is used in conjunction with ObjectOutputStream to implement object serialization and deserialization. The main advantage of ObjectInputStream is that it can efficiently read complex data structures such as objects, arrays, and collections, and can automatically handle object reference relationships to ensure data integrity and consistency. In addition, ObjectInputStream also supports custom serialization logic, allowing developers to perform additional processing when reading objects, thereby improving the flexibility and scalability of the code.

[0041] Part of the deployment code is shown below.

[0042]

[0043]

[0044] In this way, a method for calculating network security multimodal information association feature vectors is implemented, which mainly uses Java's serialization mechanism (ObjectInputStream and ObjectOutputStream) to handle the reading and saving of feature vectors. It includes data preparation, serialization of feature vectors, reading of serialized data, calculation of products, and result saving. Specifically, the global feature vectors of historical intrusion events and the network security data text understanding feature vectors are obtained in array form, and are serialized into byte streams and saved to files. Then, ObjectOutputStream is used to serialize the feature vectors into byte streams and save them to files. Next, ObjectInputStream is used to read the serialized feature vectors from the file. This step ensures that the feature vectors can be transmitted and shared between different systems or processes. Further, by traversing the two feature vectors and calculating their element-by-element product, a new network security multimodal information association feature vector is obtained. This step is the core of the entire method and ensures the effective fusion of feature vectors. Finally, the calculated multimodal information association feature vector is serialized and saved to a file for subsequent use. This step ensures the persistent storage of the calculation results.

[0045] In this way, the automatic calculation and storage of network security multimodal information correlation feature vectors are realized. By using Java's serialization mechanism, the code can efficiently process large-scale feature vector data to ensure data integrity and consistency. Through the serialization and deserialization mechanism, the code can efficiently read and save feature vectors, reducing the overhead of data transmission and storage. The code realizes the effective fusion of different feature vectors by element-by-element product. This feature is particularly important in practical applications, especially when large amounts of data need to be stored and analyzed for a long time. The code has a clear structure and simple logic, and is easy to expand and maintain. For example, the robustness of the code can be improved by adding exception handling logic, or the calculation efficiency can be improved by optimizing the calculation logic. Through Java's serialization mechanism, the automatic calculation and storage of network security multimodal information correlation feature vectors are realized, which has the advantages of high efficiency, flexibility, and persistence, and provides strong technical support for network security analysis.

[0046] Figure 4 The present invention is a flowchart of extracting features from the current network situation data to obtain the semantic feature vector of the current network situation text in the network security automatic early warning method based on artificial intelligence according to an embodiment of the present application. Figure 4 As shown, in a specific embodiment of the present application, feature extraction is performed on the current network situation data to obtain the current network situation text semantic feature vector, including: S410, passing the current network situation data through a converter-based current network situation data semantic encoder to obtain multiple current network situation text feature vectors; S420, splicing the multiple current network situation text feature vectors to obtain the current network situation text semantic feature vector.

[0047] It should be understood that network situation data is usually unstructured text, containing rich semantic information. Traditional feature extraction methods often require manual feature design, which is not only time-consuming but also easy to miss important information. The encoder based on the converter can automatically extract features, adapt to various forms of text data, and ensure that key information is effectively captured. Among them, the converter-based model (such as BERT, GPT, etc.) has a strong contextual understanding ability. The converter architecture can effectively capture the relationship between words in the data through the self-attention mechanism, and thus better understand the overall semantics of the text. In the network situation data, the contextual relationship between different data items (such as log information, alarms, etc.) is often complex and diverse. The use of the converter can more comprehensively extract key information and obtain accurate text feature vectors. Specifically, the embedding layer of the current network situation data semantic encoder based on the converter is used to convert the current network situation data into an embedding vector to obtain a sequence of network situation embedding vectors; the converter-based Bert model of the current network situation data semantic encoder based on the converter is used to encode the sequence of network situation embedding vectors based on global context semantics to obtain multiple current network situation text feature vectors.

[0048] Furthermore, transformer-based models (such as BERT, GPT, etc.) have strong context understanding capabilities. The transformer architecture can effectively capture the relationship between words in the data through the self-attention mechanism, thereby better understanding the overall semantics of the text. In network situation data, the contextual relationships between different data items (such as log information, alerts, etc.) are often complex and diverse. Using transformers can more comprehensively extract key information and obtain accurate text feature vectors.

[0049] In the above-mentioned network security automatic early warning method based on artificial intelligence, the step S130 determines whether to issue a network security early warning alarm based on the network security multimodal information association feature vector and the current network situation text semantic feature vector. It should be understood that the network security multimodal information association feature vector represents information from different data sources and types, including but not limited to network traffic, system logs, user behavior, and external threat intelligence. By integrating these multimodal information, the security system can obtain a more comprehensive network situation view. Each type of information provides a unique perspective. On the other hand, the current network situation text semantic feature vector focuses on analyzing and understanding the semantic information implicit in the network situation data. Through natural language processing technology, feature vectors extracted from security events, alarms, and logs can identify potential threat patterns and attack features. When these two feature vectors are combined together, the system can perform a deeper level of association analysis. Thereby achieving more accurate threat identification and response, thereby enhancing the overall network security protection effect.

[0050] In a specific embodiment of the present application, the step S130 includes: fusing the network security multimodal information association feature vector and the current network situation text semantic feature vector to obtain a warning alarm judgment classification feature vector; performing entropy degradation maximization optimization based on wandering pattern simulation on the warning alarm judgment classification feature vector to obtain a sparse optimized warning alarm judgment classification feature vector; passing the sparse optimized warning alarm judgment classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue a network security warning alarm.

[0051] It should be understood that the fusion of these two feature vectors can form a deeper and richer semantic representation in the classification feature vector. Such fusion enables the system to more effectively utilize the advantages of multiple data sources, thereby improving the ability to detect network threats.

[0052] In particular, in the technical solution of the present application, the early warning alarm judgment classification feature vector is usually generated through multiple steps, including historical intrusion event feature extraction, network security data text understanding feature extraction, and current network situation feature fusion. These features carry a large amount of contextual information and semantic associations. In this way, when the dimension of the early warning alarm judgment classification feature vector is high, it may contain some highly correlated or repeated features. The classifier may rely too much on these redundant features during the training process, resulting in invalid reinforcement of the features during the learning process, reducing the generalization ability of the model. In this case, even if there is valid information in the early warning alarm judgment classification feature vector, the model may confuse it with redundant information, making it difficult for the classifier to make an accurate judgment. Further, when features from different sources are fused, the semantic association between features may cause interference. In particular, when features come from different data sets, the scale, distribution and meaning between features may be very different, which may cause the classifier to be unable to correctly identify which features are really important during learning. In this case, the model may learn some noise or irrelevant features, while ignoring the core discriminant features, resulting in the model showing overfitting in practical applications, and then mistakenly identifying some features as important features, affecting the accuracy of network security early warning alarms. Therefore, in the technical solution of the present application, the early warning alarm judgment classification feature vector is optimized by entropy degradation maximization based on walk pattern simulation to obtain a sparse optimized early warning alarm judgment classification feature vector.

[0053] Among them, the early warning alarm judgment classification feature vector is subjected to entropy degradation maximization optimization based on walk pattern simulation to obtain a sparse optimized early warning alarm judgment classification feature vector, including: extracting each row vector of the learning parameter matrix in the classifier as a set of intrusion warning learning parameter row vectors; calculating the intrusion warning entropy degradation maximization simulation value between the early warning alarm judgment classification feature vector and each intrusion warning learning parameter row vector in the set of intrusion warning learning parameter row vector to obtain a set of intrusion warning entropy degradation maximization simulation values; based on the comparison between each intrusion warning entropy degradation maximization simulation value in the set of intrusion warning entropy degradation maximization simulation values ​​and a preset threshold, the learning parameter matrix is ​​gated and pruned to obtain an intrusion warning learning parameter entropy degradation optimization matrix; the early warning alarm judgment classification feature vector is matrix-multiplied with the intrusion warning learning parameter entropy degradation optimization matrix to obtain the sparse optimized early warning alarm judgment classification feature vector.

[0054] The optimization steps are specifically expressed as follows:

[0055] P={p1,p2,...,p i ,...,p n}

[0056]

[0057] w i =mask(D i )

[0058]

[0059] P s ={w1·p1,w2·p2,...,w i ·p i ,...,w n ·p n}

[0060]

[0061] Among them, P is the set of row vectors of intrusion warning learning parameters, {…} is a set operation, p1, p2, p i 、p n are the eigenvalues ​​of the first, second, i-th, and n-th intrusion warning learning parameter row vectors in the set of intrusion warning learning parameter row vectors, respectively. i is the ith intrusion warning entropy degradation maximization simulation value in the set of intrusion warning entropy degradation maximization simulation values, max is the maximum value function, D(v1,p i ) represents the calculation of vectors v1 and p iThe Euclidean distance between them, v1 is the early warning alarm classification feature vector, p i T is the transposed vector of the row vector of the i-th intrusion warning learning parameter, L is the length of the feature vector, is matrix multiplication, w1, w2, w i 、w n are the first, second, i-th, and n-th learning parameter mask values, respectively. Mask is the mask operation, θ represents the preset threshold, and P s is the entropy degradation optimization matrix of intrusion warning learning parameters, and v1' is the sparse optimization warning alarm judgment classification feature vector.

[0062] In the technical solution of the present application, it is taken into consideration that in the process of inputting the warning alarm judgment classification feature vector into the learning parameter matrix of the classifier to obtain the classification result of whether to issue a network security warning alarm, there is a mismatch between the structure of the learning parameter matrix itself and the warning alarm judgment classification feature vector, that is, the learning parameter matrix has structural redundancy and information confusion relative to the warning alarm judgment classification feature vector, which may cause feature redundancy or noise in the classification result of whether to issue a network security warning alarm, resulting in model overfitting.

[0063] Based on this, in the technical solution of the present application, the early warning alarm judgment classification feature vector is optimized for entropy degradation maximization based on the simulation of the walking mode, which uses the early warning alarm judgment classification feature vector as the walking node, and uses the feature distribution between the early warning alarm judgment classification feature vector and each row vector in the learning parameter matrix to simulate the walking mode, and uses the distance topology between the early warning alarm judgment classification feature vector and each row vector in the learning parameter matrix as the walking map. In this way, the walking result of the walking node in the specific walking mode on the walking map is used to obtain the intrusion warning entropy degradation maximization simulation value. Furthermore, based on the comparison between each intrusion warning entropy degradation maximization simulation value in the set of the intrusion warning entropy degradation maximization simulation value and the preset threshold, the part of the learning parameter matrix that has no significant contribution to the input data representation and may even introduce noise or redundant information is screened out. Specifically, based on the comparison result, the learning parameter matrix is ​​gated and pruned to obtain the intrusion warning learning parameter entropy degradation optimization matrix. Finally, the structurally optimized learning parameter matrix is ​​used as a feature modulation unit to linearly modulate the early warning alarm judgment classification feature vector to obtain the sparse optimized early warning alarm judgment classification feature vector.

[0064] Furthermore, by learning from a large amount of historical data, the classifier can establish a relationship model between features and attack types, and then accurately classify the input sparse optimization warning alarm judgment classification feature vector. Among them, the classification results may include multiple categories of normal or attack. It is of great significance to use the classification results to determine whether to issue a network security warning alarm. When the classifier identifies potential attack behaviors or abnormal activities, the system can respond in time and issue a warning. This real-time warning mechanism can help the network security team quickly identify and handle security incidents, thereby minimizing the possible losses.

[0065] In summary, the embodiment of the present application first obtains historical intrusion event data, network security data sets and current network situation data, and then uses deep learning technology to perform feature extraction and correlation analysis on the three, and finally uses a classifier to determine whether to issue a network security early warning alarm, thereby judging potential security threats, issuing early warnings in a timely manner, and making more effective security decisions and response strategies.

[0066] Figure 5 FIG. 1 is a block diagram of an artificial intelligence-based network security automatic early warning device according to an embodiment of the present application. Figure 5 As shown, according to the artificial intelligence-based automatic network security early warning device 100 according to the embodiment of the present application, it includes: S110, a network security data acquisition module 110, which is used to acquire historical intrusion event data, a network security data set and current network situation data; a network security data processing module 120, which is used to extract network security multimodal information association feature vectors and current network situation text semantic feature vectors from the historical intrusion event data, the network security data set and the current network situation data; a network security early warning alarm judgment module 130, which is used to judge whether to issue a network security early warning alarm based on the network security multimodal information association feature vector and the current network situation text semantic feature vector.

[0067] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned artificial intelligence-based network security automatic early warning device have been referred to above. Figures 1 to 4 The invention has been introduced in detail in the description of the artificial intelligence-based network security automatic early warning method, and therefore, its repeated description will be omitted.

[0068] As described above, the network security automatic early warning device 100 based on artificial intelligence according to the embodiment of the present application can be implemented in various terminal devices. In one example, the network security automatic early warning device 100 based on artificial intelligence can be integrated into the terminal device as a software module and / or a hardware module. For example, the network security automatic early warning device 100 based on artificial intelligence can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the network security automatic early warning device 100 based on artificial intelligence can also be one of the many hardware modules of the terminal device.

[0069] Alternatively, in another example, the artificial intelligence-based automatic network security early warning device 100 and the terminal device may also be separate devices, and the artificial intelligence-based automatic network security early warning device 100 may be connected to the terminal device via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0070] The various methods / implementations described in this specification may be used alone or in combination, and may be switched during execution. In addition, the processing steps, sequences, flow charts, etc. of the various methods / implementations described in this specification may be changed in order as long as there is no contradiction. For example, with respect to the methods described in this specification, various step units are given in an exemplary order, and are not limited to the specific order given.

[0071] The phrase "based on" used in this specification does not mean "only based on" unless otherwise specified in other paragraphs. In other words, the phrase "based on" means both "only based on" and "at least based on".

[0072] Any reference to a unit using the names "first", "second", etc. used in this specification does not fully limit the number or order of these units. These names may be used in this specification as a convenient method to distinguish between two or more units. Therefore, a reference to a first unit and a second unit does not mean that only two units can be used or that the first unit must precede the second unit in some form.

[0073] When the terms "including", "comprising", and their variations are used in this specification or claims, these terms are open ended like the term "having". Furthermore, the term "or" used in this specification or claims is not an exclusive or.

[0074] Those skilled in the art will appreciate that various aspects of the present application may be illustrated and described by a number of patentable categories or situations, including any new and useful process, machine, product or combination of substances, or any new and useful improvements thereto. Accordingly, various aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may all be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". In addition, various aspects of the present application may be represented as a computer product located in one or more computer-readable media, which includes computer-readable program code.

[0075] Those skilled in the art will appreciate that various aspects of the present application may be illustrated and described by a number of patentable categories or situations, including any new and useful process, machine, product or combination of substances, or any new and useful improvements thereto. Accordingly, various aspects of the present application may be performed entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. The above hardware or software may all be referred to as "data blocks", "modules", "engines", "units", "components" or "systems". In addition, various aspects of the present application may be represented as a computer product located in one or more computer-readable media, which includes computer-readable program code.

[0076] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present disclosure belongs. It should also be understood that terms such as those defined in common dictionaries should be interpreted as having a meaning consistent with their meaning in the context of the relevant technology and should not be interpreted in an idealized or highly formal sense, unless explicitly defined as such herein.

[0077] The present invention has been described in detail above, but it is obvious to those skilled in the art that the present invention is not limited to the embodiments described in this specification. The present invention can be implemented as a modification and variation without departing from the purpose and scope of the present invention as determined by the description of the claims. Therefore, the description of this specification is for the purpose of illustration and does not have any restrictive meaning for the present invention.

Claims

1. An automatic network security early warning method based on artificial intelligence, characterized in that: include: Obtain historical intrusion event data, network security data sets, and current network situation data; Extracting a network security multimodal information association feature vector and a current network situation text semantic feature vector from the historical intrusion event data, the network security data set and the current network situation data; Based on the network security multimodal information association feature vector and the current network situation text semantic feature vector, it is determined whether to issue a network security early warning alarm.

2. The method for automatic network security early warning based on artificial intelligence according to claim 1 is characterized in that: Extracting a network security multimodal information association feature vector and a current network situation text semantic feature vector from the historical intrusion event data, the network security data set, and the current network situation data, including: Performing feature extraction on the historical intrusion event data to obtain a global feature vector of the historical intrusion event; Performing feature extraction on the network security data set to obtain a network security data text understanding feature vector; Associating the historical intrusion event global feature vector with the network security data text understanding feature vector to obtain the network security multimodal information association feature vector; Feature extraction is performed on the current network situation data to obtain a semantic feature vector of the current network situation text.

3. The method for automatic network security early warning based on artificial intelligence according to claim 2 is characterized in that: Performing feature extraction on the historical intrusion event data to obtain a global feature vector of the historical intrusion event includes: Resampling the historical intrusion event data to obtain historical intrusion event resampled data; The historical intrusion event resampled data is passed through a historical intrusion event resampled data generator based on a generative adversarial network to obtain historical intrusion event balanced text data; The historical invasion event balanced text data is passed through a historical invasion event balanced text context semantic encoder to obtain the historical invasion event global feature vector.

4. The method for automatic network security early warning based on artificial intelligence according to claim 3 is characterized in that: Performing feature extraction on the network security data set to obtain a network security data text understanding feature vector includes: Segmenting the network security data set and passing it through a network security data item embedding encoder to obtain a sequence of network security data item embedding vectors; The sequence of network security data item embedding vectors is passed through a network security data item multi-scale neighborhood feature extraction module to obtain the network security data text understanding feature vector.

5. The method for automatic network security early warning based on artificial intelligence according to claim 4 is characterized in that: Associating the historical intrusion event global feature vector with the network security data text understanding feature vector to obtain the network security multimodal information association feature vector, including: Obtain the global feature vector of historical intrusion events and the feature vector of network security data text understanding in array form; Serializing the historical intrusion event global feature vector and the network security data text understanding feature vector into byte streams respectively, and saving them into files; Use ObjectInputStream mechanism to read serialized global feature vectors of historical intrusion events and serialized text comprehension feature vectors of network security data from files; After reading the serialized global feature vector of historical intrusion events and the serialized text understanding feature vector of network security data, the product of the global feature vector of historical intrusion events and the text understanding feature vector of network security data is calculated to obtain a network security multimodal information association feature vector; The calculated network security multimodal information correlation feature vector is serialized and saved into a file.

6. The method for automatic network security early warning based on artificial intelligence according to claim 5 is characterized in that: Extracting features from the current network situation data to obtain a semantic feature vector of the current network situation text includes: Passing the current network situation data through a current network situation data semantic encoder based on a converter to obtain a plurality of current network situation text feature vectors; The multiple current network situation text feature vectors are concatenated to obtain the current network situation text semantic feature vector.

7. The method for automatic network security early warning based on artificial intelligence according to claim 6 is characterized in that: Based on the network security multimodal information association feature vector and the current network situation text semantic feature vector, determining whether to issue a network security early warning alarm includes: Fusion of the network security multimodal information association feature vector and the current network situation text semantic feature vector to obtain a warning alarm judgment classification feature vector; Performing entropy degradation maximization optimization based on walk pattern simulation on the early warning alarm judgment classification feature vector to obtain a sparse optimized early warning alarm judgment classification feature vector; The sparse optimized early warning alarm judgment classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to determine whether to issue a network security early warning alarm.

8. The method for automatic network security early warning based on artificial intelligence according to claim 7 is characterized in that: The early warning alarm judgment classification feature vector is optimized by entropy degradation maximization based on walk pattern simulation to obtain a sparse optimized early warning alarm judgment classification feature vector, including: Extracting each row vector of the learning parameter matrix in the classifier as a set of intrusion warning learning parameter row vectors; Calculating the intrusion warning entropy degradation maximization simulation value between the early warning alarm judgment classification feature vector and each intrusion warning learning parameter row vector in the set of intrusion warning learning parameter row vectors to obtain a set of intrusion warning entropy degradation maximization simulation values; Based on the comparison between each intrusion warning entropy degradation maximization simulation value in the set of intrusion warning entropy degradation maximization simulation values ​​and a preset threshold, the learning parameter matrix is ​​gated and pruned to obtain an intrusion warning learning parameter entropy degradation optimization matrix; The early warning alarm judgment classification feature vector is matrix-multiplied with the intrusion warning learning parameter entropy degradation optimization matrix to obtain the sparse optimization early warning alarm judgment classification feature vector.

9. An artificial intelligence-based network security automatic early warning device, characterized in that: include: The network security data acquisition module is used to obtain historical intrusion event data, network security data sets and current network situation data; A network security data processing module, used to extract network security multimodal information association feature vectors and current network situation text semantic feature vectors from the historical intrusion event data, the network security data set and the current network situation data; The network security early warning alarm judgment module is used to judge whether to issue a network security early warning alarm based on the network security multimodal information association feature vector and the current network situation text semantic feature vector.

10. The artificial intelligence-based network security automatic early warning device according to claim 9 is characterized in that: Network security data processing module, including: Performing feature extraction on the historical intrusion event data to obtain a global feature vector of the historical intrusion event; Performing feature extraction on the network security data set to obtain a network security data text understanding feature vector; Associating the historical intrusion event global feature vector with the network security data text understanding feature vector to obtain the network security multimodal information association feature vector; Feature extraction is performed on the current network situation data to obtain a semantic feature vector of the current network situation text.

Images