Network security threat detection and defense system based on artificial intelligence

Abstract

The invention discloses a network security threat detection and defense system based on artificial intelligence, and relates to the technical field of network security, and the system comprises a first detection module which is used for collecting a plurality of network data sources in real time and generating a standardized real-time feature vector, the second detection module periodically collects various historical data sources and generates baseline feature vectors capable of representing normal network behaviors. According to the detection system, similarity comparison is carried out on the real-time feature vector and the baseline feature vector, so that whether obvious deviation exists or not is quickly judged, and network threat detection of a known type is realized; after high-dimensional features are extracted from the real-time feature vector and the baseline feature vector respectively, similarity comparison is carried out on output high-dimensional vectors again, and detection of unknown types of network threats is achieved; a defense system correspondingly executes limiting or blocking operation according to a detected judgment result of a known type of threat and an unknown type of threat.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an artificial intelligence-based network security threat detection and defense system. Background Art

[0002] With the popularization of the Internet and the development of information technology, network security issues are becoming increasingly severe, and various network attack methods are emerging in an endless stream. Especially in the current university network environment, the main types of threats faced are diverse and complex.

[0003] Traditional network security defense measures, such as firewalls, intrusion detection systems, and intrusion prevention systems, are mainly based on designated defenses against known types of network threats. However, these methods have limited defensive effects against unknown threats, and are prone to errors when used in network detection and defense in colleges and universities. Because college networks have a large number of users and types of devices with diverse behaviors, the unknown types of network threats that appear are also more diverse. Traditional defense detection systems and defense systems are mostly limited to known types of network threat attacks, and are prone to false positives or omissions for a variety of unknown types of network threats. Summary of the invention

[0004] 1) Technical issues solved

[0005] The present invention provides an artificial intelligence-based network security threat detection and defense system to solve the problems that the existing network threat detection and defense systems are limited to known attacks, have limited defense effects against unknown threats, and are prone to missed reports and false reports.

[0006] 2) Technical solution

[0007] To achieve the above object, the present invention provides the following technical solution: a network security threat detection system based on artificial intelligence, comprising:

[0008] The first detection module is used to collect data sources in real time, including network traffic data, system logs and user activity data, clean the collected data sources and unify their formats, extract data features by analyzing network behaviors, and generate standardized real-time feature vectors;

[0009] The second detection module is used to periodically collect historical record data of the data source, perform data cleaning and format unification on the collected historical record data, extract data features by analyzing network behavior, and generate a standardized historical feature vector;

[0010] The plurality of historical feature vectors collected and generated within a continuous period of time are sequentially entered into a time window in chronological order, and statistical analysis is performed on all the historical feature vectors within the time window to generate a feature baseline vector representing normal network behavior;

[0011] A first judgment module, used for receiving the real-time feature vector transmitted by the first detection module in real time, and receiving the historical feature vector transmitted by the second detection module, and calculating the similarity score between a new real-time feature vector and a feature baseline vector each time a new real-time feature vector is received; wherein, when the similarity score is lower than a preset threshold, it is determined that a network threat occurs; when the calculated similarity score is within a preset threshold interval, the currently calculated real-time feature vector and feature baseline vector are output;

[0012] The second judgment module is used to receive the currently calculated real-time feature vector and feature baseline vector output by the first judgment module, and construct two sub-networks with shared weights through artificial intelligence, and input the received real-time feature vector and feature baseline vector into a corresponding sub-network for operation. Each sub-network outputs a vector after operation, and calculates the similarity scores of the output vectors corresponding to the two sub-networks. When the similarity scores are lower than a preset threshold, it is determined that a network threat occurs.

[0013] Furthermore, the real-time feature vector and the historical feature vector have the same vector dimension.

[0014] Furthermore, the data cleaning and format unification of the first detection module and the second detection module ensure that the data collected from multiple data sources can be subsequently processed in a unified format, and the data cleaning includes removing duplicate data, filling missing values, processing and detecting outliers, formatting timestamps, and removing noise;

[0015] The format unification includes normalizing the cleaned data.

[0016] Furthermore, the user activity data includes network traffic patterns, protocol usage, user behavior patterns, and system log patterns.

[0017] Furthermore, the data features extracted by the first detection module and the second detection module include statistical features, time series features, protocol frequency features and user behavior features.

[0018] Furthermore, the time length of the time window in the second detection module is dynamically updated;

[0019] Based on the time window after each update, according to the time order of the historical feature vectors generated after the second detection module periodically collects historical data, when the time window is full of historical feature vectors again, the mean of the data of the corresponding dimensions of all historical feature vectors in the window are calculated respectively, and the calculated mean of each dimension of data constitutes the new baseline feature vector.

[0020] Furthermore, a similarity threshold and a threshold interval are set in the first judgment module. Whenever a new real-time feature vector enters the first judgment module, the first judgment module performs a cosine similarity calculation on the feature baseline vector and the real-time feature vector to obtain a similarity score thereof;

[0021] When the similarity score exceeds the preset similarity threshold, it indicates that the deviation is very small and is determined to be a non-threatening anomaly;

[0022] When the similarity score is lower than the preset similarity threshold, it is determined that a known type of threat anomaly occurs;

[0023] When the similarity score is within the preset threshold range, the currently calculated real-time feature vector and feature baseline vector are transmitted to the second judgment module for further judgment.

[0024] An artificial intelligence-based network security threat defense system, comprising:

[0025] A detection and judgment module, wherein the detection and judgment module is configured to be able to execute any of the above-mentioned operation methods in the network security threat detection system;

[0026] The first response module receives the judgment result of the occurrence of known types of threat anomalies and executes the blocking strategy operation;

[0027] The first response module receives the judgment result of the occurrence of an unknown type of threat anomaly and executes the restriction policy operation.

[0028] 3) Beneficial effects:

[0029] Compared with the prior art, the invention has the following beneficial effects:

[0030] The detection system of the present invention learns the characteristic patterns that can represent normal behavior in historical data, and compares the similarity with the real-time network behavior collected in real time, so as to quickly determine whether there is an obvious deviation and realize the detection of known types of network threats;

[0031] For those with small deviations, we extract high-dimensional features to capture deep behavioral patterns and then perform similarity comparison again to detect unknown types of network threats.

[0032] Its defense system performs restriction or blocking operations accordingly based on the results of the known and unknown types of threats detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A principle block diagram of a network security threat detection system based on artificial intelligence provided by an embodiment of the present invention;

[0034] Figure 2 A principle block diagram of a network security threat defense system based on artificial intelligence provided by an embodiment of the present invention;

[0035] In the figure:

[0036] 101, first detection module; 102, second detection module; 103, first judgment module; 104, second judgment module;

[0037] 201, detection and judgment module; 202, first response module; 203, second response module. DETAILED DESCRIPTION

[0038] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0039] In the description of the present invention, it should be understood that the terms "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside" and "outside" etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the present invention.

[0040] In addition, the terms “first”, “second”, etc., if used, are merely used to distinguish between the descriptions and should not be understood as indicating or implying relative importance.

[0041] It should be noted that, in the absence of conflict, the features in the embodiments of the present invention may be combined with each other.

[0042] The threats faced by university networks are wide-ranging, complex, and constantly changing with the development of networks and attack technologies. The following are the main existing threat types and their manifestations.

[0043] 1. Distributed Denial of Service Attack: A large amount of false traffic occupies bandwidth resources, causing network congestion or paralysis. Common forms include UDP Flood, SYN Flood, HTTP Flood, etc., which can easily cause the teaching system, online examination system or scientific research resources to be interrupted due to overload.

[0044] 2. Phishing: Using fake login pages or malicious links to obtain teachers’ and students’ accounts and passwords. After the accounts are stolen, the attackers can use resources to send spam emails or invade internal systems.

[0045] 3. Malware transmission: Trojans, ransomware, viruses, etc. are spread through email, file sharing or external storage devices, which may cause loss of teaching resources or data leakage, and even interrupt experiments.

[0046] 4. Zero-day attack: An attack that exploits undisclosed vulnerabilities in a system or software. Attackers usually target scientific research servers or laboratories with open ports. This can lead to intellectual property leakage or theft of scientific research results.

[0047] Current network threat detection and defense systems rely on known attack pattern libraries, such as signature rules, and are unable to identify unknown threats. Most threat detection systems that rely on known attack pattern libraries are prone to misjudge legitimate but baseline-deviant behaviors as threats. The diversity of users in colleges and universities will cause the false alarm rate to further increase, and the current corresponding defense systems are mostly passive responses, making it difficult to respond to dynamic threats in a timely manner.

[0048] In view of the above shortcomings, the inventors have designed a network security threat detection and defense system based on artificial intelligence. The detection system learns the characteristic patterns that can represent normal behavior in historical data, and then compares the similarity with the collected real-time network behavior, so as to quickly determine whether there is an obvious deviation and realize the detection of known types of network threats; for those with deviations but small deviations, the high-dimensional features are extracted to capture the deep-level behavior patterns, and then the similarity is compared again to realize the detection of unknown types of network threats. The defense system performs corresponding restrictions or blocking operations based on the judgment results of the known and unknown types of threats detected.

[0049] Specifically, refer to Figure 1 The principle block diagram of a network security threat detection system based on artificial intelligence is shown, in which the first detection module 101 is mainly responsible for real-time collection of multiple data sources, including network traffic data, system logs and user behavior data. The main goal of this module is to instantly obtain and process these data, and convert them into standardized real-time feature vectors that can represent current behavior, so as to facilitate subsequent comparative analysis with standardized feature vectors representing normal network behavior. It is understandable that this module needs to have high-frequency real-time requirements, so data cleaning, format unification and standardization are crucial to the subsequent feature extraction process.

[0050] Specifically, data collection can be achieved through traffic monitoring tools deployed on network nodes or devices. For example, traffic analysis tools on gateways, switches or routers collect network traffic data in real time, and the data content includes IP address, port, protocol type, traffic rate, data packet content, session time, etc. System logs include operating system logs, application logs, security logs, etc., which can be collected in real time through log collection tools, such as Syslog, Windows Event Viewer, etc. These logs provide detailed records of system operation, which helps to understand the system status and the activities of users and applications. User behavior data is collected through tools that monitor user activities. For example, the UAM (User Activity Monitoring) system can obtain user login information, operation records, access behavior, file activity, input and output operations, etc. in real time.

[0051] The purpose of cleaning the various data collected above is to remove irrelevant, duplicate or erroneous data and retain useful signals. The specific operations of cleaning include removing records with inconsistent formats, such as removing invalid data with inconsistent timestamp formats. It also includes removing abnormal data points collected, such as packets lost during transmission and incomplete system logs. For missing values ​​collected, it is necessary to fill in or delete the missing key information. Ensure the uniformity of fields in all data sources by standardizing field names and structures, for example, converting the timestamp format in all logs to a unified format.

[0052] Since the sources of data are diverse and the data formats of different sources are inconsistent, it is necessary to unify the formats of the various data after cleaning.

[0053] Specifically, it includes: standardizing the fields of network traffic, system logs, and user behavior data to unify all data into a specific structure or model; converting field units and dimensions to ensure that each data item has a consistent format, for example, unifying protocol field names, unifying time units, and converting different IP address representations to achieve consistency; converting different types of data, such as qualitative data and quantitative data, into a format suitable for model input.

[0054] Data in a unified format is still raw data, which contains various and complex dimensions. Therefore, the data in a unified format needs to be converted again into a form that can show multiple network characteristics and facilitate subsequent comparative calculations. In an embodiment of the present invention, real-time network data in a unified format is converted into a standardized feature vector by extracting core information and removing redundancy. In addition, it can be understood that the historical data collected later that can represent normal network behavior also needs to be converted into a standardized feature vector after relevant processing, so as to achieve comparison by calculating similarity to determine whether an abnormality has occurred.

[0055] On the basis of the above, each dimension of the feature vector corresponds to a certain statistical characteristic or index of the real-time collected network data. Specifically, in some feasible embodiments of the present invention, the collected real-time network data includes:

[0056] Network traffic data: number of packets per second, traffic proportion of various protocols (such as HTTP, DNS, etc.), average packet size;

[0057] System log data: CPU usage (percentage), memory usage (percentage), number of error logs per unit time;

[0058] User behavior data: user request login frequency (number of requests per unit time), resource access concentration (the proportion of a certain resource being accessed).

[0059] The above data is cleaned and formatted, that is, missing values, duplicate values, and obvious abnormal values ​​(such as negative values) are removed, and each data source is stored according to predefined fields and types, such as converting all timestamps to a standard format and making all numerical units consistent. After data cleaning and formatting, key features are extracted as required.

[0060] For example:

[0061] Traffic characteristics: total traffic, peak traffic, average packet size;

[0062] Log features: error rate, keyword frequency;

[0063] User behavior characteristics: login frequency, number of resource accesses.

[0064] After extracting the features as described above, feature standardization is performed. In some embodiments of the present invention, normalization processing is performed to map the feature values ​​to the interval of 0 and 1.

[0065] Combine each extracted feature into a vector of fixed dimension:

[0066] Feature vector = [traffic feature, log feature, user behavior feature]

[0067] How to collect and obtain network data that can represent normal network behavior and convert it into a standardized feature vector. In some feasible embodiments of the present invention, based on the work of the first detection module 101, reference Figure 1 , a second detection module 102 is also provided. The purpose of the second detection module 102 is to periodically collect historical data sources. The types of data sources collected are the same as above, including network traffic, system logs, and user behavior data. These data are used to build a feature baseline that can represent normal network behavior, and the feature baseline of normal behavior provides a comparative reference for detecting anomalies. It should be noted that the data type and quantity collected by the second detection module 102 are consistent with the data type and quantity collected by the first detection module 101.

[0068] Regarding how to obtain historical data, specifically, historical traffic data can be obtained regularly through long-running traffic monitoring tools. These data include IP traffic statistics, protocol distribution, traffic peaks, etc. over the past period of time. Historical logs are periodically collected from target devices such as servers and applications through log management systems. These logs record system operation status, error information, abnormal events, etc. By analyzing user behavior records over the past period of time, data such as user login time, operation records, and behavior patterns are collected.

[0069] After the second detection module 102 collects historical data, the data also needs to be cleaned and formatted in a unified manner, and the mode of data cleaning and formatting is the same as that of the first detection module 101 .

[0070] After the second detection module 102 performs data cleaning and format unification, the data is converted into a standardized historical feature vector after feature extraction. This step is similar to the operation of generating a real-time feature vector by the first detection module 101. Because the collection and conversion of historical feature vectors is periodic, that is, within a period of time, there are multiple historical feature vectors collected and converted. Because a representative feature vector is selected to perform similarity comparison calculation with the real-time feature vector, in some feasible embodiments of the present invention, a baseline feature vector is constructed to reflect the normal network behavior pattern as a judgment standard.

[0071] Specifically, a statistical analysis is performed on a set of historical feature vectors within a period of time, such as calculating a mean, a variance, a distribution parameter, etc., so as to generate a baseline feature vector.

[0072] It should be noted that the dimensions of the real-time feature vector and the baseline feature vector are consistent, because the real-time feature vector and the baseline feature vector are compared through similarity calculation, such as using Euclidean distance, cosine similarity and other methods, which require the vectors to be in the same dimensional space.

[0073] For example:

[0074] Real-time feature vector

[0075] =[current traffic rate, current error rate, current user access interval, current protocol distribution

[0076] Real-time feature vector

[0077] =[Historical traffic rate average, historical error rate average, historical access interval average, historical protocol distribution average

[0078] Furthermore, consider that the normal behavior of a system may change over time, for example:

[0079] Behavioral patterns during certain peak network traffic periods;

[0080] User behavior patterns are different on weekdays and weekends.

[0081] If the baseline feature vector remains unchanged, the detection system will misjudge normal changes as abnormal behavior.

[0082] Based on the above considerations, in some embodiments of the present invention, the statistical parameters of the baseline characteristics are recalculated using the historical feature vectors in the long time window, and the old baseline feature vectors are overwritten with the new statistical parameters to generate an updated baseline, that is, the detected historical feature vectors enter the time window in sequence according to the time sequence, and multiple historical feature vectors are counted in the time window to obtain the baseline feature vector. At the end of each long time window, the baseline is updated with the latest historical data to ensure that the baseline can reflect the current "normal" state.

[0083] The similarity calculation between the real-time feature vector and the baseline feature vector is performed in the first judgment module 103. For details, refer to Figure 1 , the first judgment module 103 receives the real-time feature vectors sent from the first detection module 101, and receives the baseline feature vectors sent from the second detection module 102. The similarity calculation of the first judgment module 103 mainly measures the difference between the real-time feature vector and the baseline feature vector, and then determines whether there is an abnormality. Regarding the calculation of similarity, the cosine similarity or Euclidean distance of the two vectors can be calculated, and the specific calculation method is not limited in the present invention.

[0084] After similarity calculation, when the similarity between real-time features and baseline features is lower than the set threshold, the current behavior can be marked as abnormal behavior, providing a basis for judgment for subsequent defense modules.

[0085] Furthermore, the above steps are to detect known types of cyber threats, because the baseline features are obtained through the analysis of historical data, which represent normal behavior patterns. The baseline feature vector captures the behavior of the system under "normal" circumstances, and any deviation from this baseline may be considered anomaly.

[0086] If the real-time feature vector has a low similarity to the baseline feature vector, the preset threshold can be used to determine whether the behavior belongs to a known attack pattern. For example, if a traffic pattern, a log feature, or a behavior pattern is similar to a known attack feature, it can be identified as a known threat.

[0087] Understandably, this approach can help the system quickly detect attack patterns that have appeared in history and have clear characteristics.

[0088] On this basis, how to judge the attack mode of unknown types and the trigger conditions for detecting network threats of unknown attack types are as follows.

[0089] Set a similarity threshold and a threshold range:

[0090] If the similarity score between the real-time feature vector and the baseline feature vector exceeds the preset similarity threshold, it means that the deviation is very small and is directly considered as normal behavior without further analysis.

[0091] If the preliminary similarity score is lower than the preset similarity threshold, such as 0.6, it is directly judged as an anomaly of a known type without entering the sub-network for processing.

[0092] If the preliminary similarity falls within a "suspicious interval", that is, the similarity score is within the preset threshold interval, such as [0.4, 0.6], it will be further analyzed.

[0093] Regarding how to conduct further threat detection analysis, specifically, in some embodiments of the present invention, in the second judgment module 104, by constructing two sub-networks with shared weights, the real-time feature vector and the baseline feature vector whose similarity scores are within a preset threshold range are respectively input into the two sub-networks.

[0094] Specifically, two sub-networks are constructed using deep learning methods. The twin network consists of two sub-networks, and the weights of these two sub-networks are shared, which means that they will use the same parameters for calculation.

[0095] Here, two sub-networks are used to process different input data, one for the baseline feature vector and the other for the real-time feature vector. Since their weights are shared, the two sub-networks will process the two different inputs under the same architecture. The two sub-networks will process the baseline feature vector and the real-time feature vector respectively. Their purpose is to map each vector to an embedding space, which can transform each vector into a representation in a high-dimensional space, and each outputs a high-dimensional feature vector, where each dimension is the result of the deep mapping of the input feature or a newly generated feature. The sub-networks with shared weights are constructed to run the baseline feature vector and the real-time feature vector respectively, which are used to analyze more complex patterns, discover unknown attack types, and even identify potential threats based on the deep patterns of the data without clear attack features.

[0096] The high-dimensional feature vectors output by each sub-network are used to calculate the similarity of the two high-dimensional vectors again, and a threshold is set. If the calculated similarity score is lower than the preset threshold, it is determined that an abnormality has occurred, that is, an unknown type of network threat has occurred.

[0097] More specifically, below is a simplified Python code that simulates how to use sub-networks with shared weights to calculate similarity to determine abnormal behavior.

[0098]

[0099]

[0100]

[0101] After threat detection, the design and implementation of defense measures are crucial, which can effectively deal with network threats and reduce potential losses. In the network security threat detection system based on artificial intelligence, the execution of defense measures is closely related to the first judgment module 103 and the second judgment module 104.

[0102] Combined with the above, specific, reference Figure 2 After the detection and judgment module 201 performs the above operations, it detects that the similarity score between the real-time feature vector and the baseline feature vector is lower than the preset similarity threshold, and the first response module 202 triggers an early warning, and determines that it is a known type of network threat, performs a blocking operation, directly cuts off the communication between the threat source and the protected system, and completely terminates the possibility of threatening behavior.

[0103] After the detection and judgment module 201 performs the above operations, it detects that the similarity score between the real-time feature vector and the baseline feature vector is within the preset similarity interval, and detects that after running through two sub-networks with shared weights, the similarity score between the output high-dimensional real-time feature vector and the baseline feature vector is lower than the preset threshold. The second response module 202 is started to perform a restriction operation, that is, not completely cutting off its interaction with the system, and subsequently sends a request to the administrator to perform monitoring and evaluation of unknown threats, so as to effectively manage the risks of unknown threats.

[0104] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. The patent protection scope of the present invention shall be based on the claims. All equivalent structural changes made using the contents of the description and drawings of the present invention should also be included in the protection scope of the present invention.

Claims

1. A network security threat detection system based on artificial intelligence, characterized in that: include: The first detection module is used to collect data sources in real time, including network traffic data, system logs and user activity data, clean the collected data sources and unify their formats, extract data features by analyzing network behaviors, and generate standardized real-time feature vectors; The second detection module is used to periodically collect historical record data of the data source, perform data cleaning and format unification on the collected historical record data, extract data features by analyzing network behavior, and generate a standardized historical feature vector; The plurality of historical feature vectors collected and generated within a continuous period of time are sequentially entered into a time window in chronological order, and statistical analysis is performed on all the historical feature vectors within the time window to generate a feature baseline vector representing normal network behavior; A first judgment module, used for receiving the real-time feature vector transmitted by the first detection module in real time, and receiving the historical feature vector transmitted by the second detection module, and calculating the similarity score between a new real-time feature vector and a feature baseline vector each time a new real-time feature vector is received; wherein, when the similarity score is lower than a preset threshold, it is determined that a network threat occurs; when the calculated similarity score is within a preset threshold interval, the currently calculated real-time feature vector and feature baseline vector are output; The second judgment module is used to receive the currently calculated real-time feature vector and feature baseline vector output by the first judgment module, and construct two sub-networks with shared weights through artificial intelligence, and input the received real-time feature vector and feature baseline vector into a corresponding sub-network for operation. Each sub-network outputs a vector after operation, and calculates the similarity scores of the output vectors corresponding to the two sub-networks. When the similarity scores are lower than a preset threshold, it is determined that a network threat occurs.

2. The network security threat detection system based on artificial intelligence according to claim 1 is characterized in that: The real-time feature vector and the historical feature vector have the same vector dimension.

3. The network security threat detection system based on artificial intelligence according to claim 2 is characterized in that: The data cleaning and format unification of the first detection module and the second detection module ensure that the data collected from multiple data sources can be subsequently processed in a unified format, and the data cleaning includes removing duplicate data, filling missing values, processing and detecting outliers, formatting timestamps, and removing noise; The format unification includes normalizing the cleaned data.

4. The network security threat detection system based on artificial intelligence according to claim 3 is characterized in that: The user activity data includes network traffic patterns, protocol usage, user behavior patterns, and system log patterns.

5. The network security threat detection system based on artificial intelligence according to claim 4 is characterized in that: The data features extracted by the first detection module and the second detection module include statistical features, time series features, protocol frequency features and user behavior features.

6. The network security threat detection system based on artificial intelligence according to claim 5 is characterized in that: The time length of the time window in the second detection module is dynamically updated; Based on the time window after each update, according to the time order of the historical feature vectors generated after the second detection module periodically collects historical data, when the time window is full of historical feature vectors again, the mean of the data of the corresponding dimensions of all historical feature vectors in the window are calculated respectively, and the calculated mean of each dimension of data constitutes the new baseline feature vector.

7. The network security threat detection system based on artificial intelligence according to claim 6 is characterized in that: The first judgment module is provided with a similarity threshold and a threshold interval. Whenever a new real-time feature vector enters the first judgment module, the first judgment module performs a cosine similarity calculation on the feature baseline vector and the real-time feature vector to obtain a similarity score thereof; When the similarity score exceeds the preset similarity threshold, it indicates that the deviation is very small and is determined to be a non-threatening anomaly; When the similarity score is lower than the preset similarity threshold, it is determined that a known type of threat anomaly occurs; When the similarity score is within the preset threshold range, the currently calculated real-time feature vector and feature baseline vector are transmitted to the second judgment module for further judgment.

8. An artificial intelligence-based network security threat defense system, characterized in that: include: A detection and judgment module, wherein the detection and judgment module is configured to be able to execute the operation method in the network security threat detection system according to any one of claims 1 to 7; The first response module receives the judgment result of the occurrence of known types of threat anomalies and executes the blocking strategy operation; The first response module receives the judgment result of the occurrence of an unknown type of threat anomaly and executes the restriction policy operation.

Images