Network security strategy generation method and system based on AI big model

Abstract

The present invention relates to the field of Internet of Things security, and specifically to a network security strategy generation method and system based on an AI large model. The method first includes a scenario library of historical security events and a strategy library containing various strategies, and simultaneously obtains the pending security events currently received by the network, and based on the data information of each dimension, performs scenario matching analysis on the pending security events and historical security events, and screens out similar security events of the pending security events from all historical security events, and uses the constructed weak classifier on the target dimension to iteratively train the historical security events to obtain the criticality of the target dimension, and based on the screening of each key dimension, further performs scenario matching analysis on the pending security events and similar security events, thereby generating a strategy set for the pending security events. The present invention can eliminate the interference of redundant dimensions on the scenario matching of network security events and improve the effect of security strategy generation.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Things security, and in particular to a network security strategy generation method and system based on an AI big model. Background Art

[0002] In the field of IoT security, traditional defense measures such as firewalls and intrusion detection systems have been unable to cope with the ever-evolving network threats. These threats include but are not limited to advanced persistent threats, zero-day vulnerability exploits, and targeted attacks against specific organizations, which seriously threaten the security of IoT. Therefore, it is necessary to generate corresponding security strategies to deal with these threats and maintain network health.

[0003] In the related technology, the security events currently received by the network are usually matched with historical security events, and the strategies of historical security events with similar scenarios to the current security events are used as strategies to resolve the current network security events. However, since network security events usually have a large number of features in different dimensions, the presence of some redundant dimensions will reduce the effect of scene matching between the current network security events and historical security events, thereby resulting in poor security policy generation effect. Summary of the invention

[0004] In order to solve the technical problem that the presence of some redundant dimensional features will reduce the effect of scene matching between current network security events and historical security events, thereby resulting in poor security policy generation effect, the purpose of the present invention is to provide a network security policy generation method and system based on an AI large model, and the technical solutions adopted are as follows:

[0005] The present invention proposes a network security strategy generation method based on an AI big model, the method comprising:

[0006] Acquire a scenario library and a policy library about network security, wherein the scenario library includes multiple historical security events, and simultaneously acquire pending security events currently received by the network, wherein both the pending security events and the historical security events include data information of multiple dimensions;

[0007] According to the difference in the data information of each dimension between the security event to be processed and each historical security event, the scene similarity of each historical security event is obtained; based on the scene similarity, similar security events of the security event to be processed are screened out from all historical security events, and similar security events and non-similar security events are marked differently to obtain labels of historical security events;

[0008] Take any dimension as the target dimension, and take the decision tree about the target dimension constructed through all historical security events as a weak classifier; perform iterative training on the labeled historical security events based on the weak classifier to obtain the classification accuracy of each iteration process; determine whether to terminate the iterative training based on the difference in the classification accuracy between each iteration process and the previous iteration process, and obtain the criticality of the target dimension based on the classification accuracy of the last iteration process, the difference in the classification accuracy between the last iteration process and the first iteration process, and the number of iterative training; filter out the key dimensions from all dimensions based on the criticality of each dimension and the number of similar security events to the security event to be processed;

[0009] According to the difference in the data information of each key dimension between each similar security event and the security event to be processed, a similar scenario set of the security event to be processed is obtained; based on the similar scenario set, a policy set of the security event to be processed is selected from the policy library.

[0010] Furthermore, obtaining the scene similarity of each historical security event includes:

[0011] Based on the form of data information of each dimension, all dimensions are divided into statistical feature dimensions and content feature dimensions, wherein the data information of the statistical feature dimensions is in numerical form, and the data information of the content feature dimensions is in text form;

[0012] The security event to be processed or any historical security event is taken as the target security event, and the vector composed of data information of each statistical feature dimension of the target security event is taken as the first feature vector of the target security event;

[0013] Using the bag-of-words model, the data information of each content feature dimension of the target security event is processed to obtain the second feature vector of the target security event;

[0014] The absolute value of the cosine similarity of the first feature vector between the security event to be processed and each historical security event is used as the first similarity of each historical security event, and the absolute value of the cosine similarity of the second feature vector between the security event to be processed and each historical security event is used as the second similarity of each historical security event;

[0015] An average value of the first similarity and the second similarity is used as the scene similarity of each historical security event.

[0016] Furthermore, based on the scenario similarity, screening out similar security events to the security event to be processed from all historical security events includes:

[0017] The historical security events whose scenario similarity is greater than a preset first similarity threshold are used as similar security events to the security event to be processed.

[0018] Furthermore, obtaining the classification accuracy of each iteration process includes:

[0019] Use the Adaboost algorithm and weak classifiers to classify historical security events with labels, and obtain correctly classified historical security events in each iteration;

[0020] The number of historical security events correctly classified in each iteration process is taken as the numerator, the number of all historical security events is taken as the denominator, and the ratio is taken as the classification accuracy rate of each iteration process.

[0021] Furthermore, judging whether to terminate the iterative training according to the difference in classification accuracy between each iterative process and the previous iterative process includes:

[0022] If the absolute value of the difference between the classification accuracy of each iteration process and the previous iteration process is less than a preset judgment threshold, the iterative training is terminated; otherwise, the iterative training is continued.

[0023] Furthermore, the criticality of obtaining the target dimension includes:

[0024] The reciprocal of the absolute value of the difference between the classification accuracy of the last iteration process and the first iteration process is used as the first key parameter of the target dimension;

[0025] The inverse of the number of iterative training is used as the second key parameter of the target dimension;

[0026] The classification accuracy of the last iteration process, the sum of the first key parameter and the second key parameter of the target dimension are normalized to obtain the criticality of the target dimension.

[0027] Furthermore, screening out key dimensions from all dimensions includes:

[0028] The number of similar security incidents to the security incident to be processed is used as the numerator, the number of all historical security incidents is used as the denominator, and the ratio is used as the similar scenario ratio value of the security incident to be processed;

[0029] Calculate the weight parameter of the security event to be processed, the calculation formula of the weight parameter is: w=1-P, where w represents the weight parameter of the security event to be processed, and P represents the similar scene ratio value of the security event to be processed;

[0030] Round up the product of the weight parameter and the number of all dimensions to obtain the minimum number of dimensions;

[0031] Taking any multiple dimensions as a dimension group, wherein the number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions;

[0032] The average value of the criticality of all dimensions in each dimension group is taken as the overall criticality of each dimension group;

[0033] All dimensions in the dimension group corresponding to the maximum value of the overall criticality are taken as key dimensions.

[0034] Furthermore, obtaining a similar scene set of the security event to be processed includes:

[0035] Based on the calculation method of the scenario similarity of each historical security event, the scenario similarity parameter of each similar security event is calculated according to the difference of the data information of each key dimension between the security event to be processed and the similar security event;

[0036] A set of similar security events whose scenario similarity parameters are greater than a preset second similarity threshold is used as a similar scenario set of the security event to be processed.

[0037] Furthermore, the selecting a policy set for the security event to be processed from the policy library based on the similar scenario set includes:

[0038] In the policy library, policies for solving all historical security events in the similar scenario set are selected, and a set consisting of all the selected policies is used as a policy set for the security event to be processed.

[0039] The present invention also proposes a network security policy generation system based on an AI big model, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements any one of the steps of a network security policy generation method based on an AI big model when executing the computer program.

[0040] The present invention has the following beneficial effects:

[0041] The present invention takes into account that the characteristics of some redundant dimensions of network security events will reduce the effect of scene matching between the current network security events and the historical security events, thereby resulting in poor security policy generation effect. Therefore, the scene library and policy library about network security are first obtained, and the pending security events currently received by the network are obtained. Considering that the strategy for solving the pending security events is unknown, while the strategy for solving the historical security events is known, and the information data of each dimension of the network security events reflects the characteristics of the security events, the difference in data information of each dimension between the pending security events and the historical security events can be first analyzed, and the similarity between each historical security event and the pending security events can be reflected by the scene similarity, thereby screening out similar security events of the pending security events, and the scenes of similar security events and the pending security events are relatively similar. Similarly, a similar scenario set of the security event to be processed can be further constructed from similar security events, so as to effectively generate a strategy for the security event to be processed. Considering that the above steps directly use data information of all dimensions to perform scenario matching analysis on the security event to be processed and the historical security events, and there are many redundant dimensions in all dimensions, and the importance of different dimensions in the scenario matching process is different, the present invention analyzes the target dimension, and iteratively trains the labeled historical security events through the constructed weak classifier to obtain the classification accuracy of each iteration process, and reflects the importance of the target dimension in the scenario matching through the obtained criticality, and screens out the key dimensions to eliminate the interference of redundant dimensions on the scenario matching, and then effectively generates a strategy set for the security event to be processed through the constructed similar scenario set of the security event to be processed. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flowchart of a network security strategy generation method based on an AI big model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the following is a detailed description of the network security strategy generation method and system based on the AI ​​big model proposed by the present invention, its specific implementation method, structure, features and effects, in combination with the accompanying drawings and preferred embodiments. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics in one or more embodiments may be combined in any suitable form.

[0045] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0046] The following is a detailed description of a specific solution of a network security strategy generation method and system based on an AI big model provided by the present invention in conjunction with the accompanying drawings.

[0047] See also Figure 1 , which shows a flow chart of a network security strategy generation method based on an AI big model provided by an embodiment of the present invention, the method comprising:

[0048] Step S1: Obtain a scenario library and a policy library about network security. The scenario library includes multiple historical security events. At the same time, obtain the pending security events currently received by the network. Both the pending security events and the historical security events include data information in multiple dimensions.

[0049] During the security maintenance of the Internet of Things, the network system is usually able to receive a large number of network security events and adopt corresponding security strategies to deal with various network security events. Therefore, the embodiment of the present invention first uses the Bert-BiLSTM-CRF algorithm in the AI ​​big model to extract a large number of historical security events from the network, and uses all historical security events to build a corresponding scenario library. At the same time, the strategies used to solve each historical security event are used to build a corresponding policy library. There is a mutual connection between the historical security events in the scenario library and the strategies in the policy library. That is to say, for a certain historical security event in the scenario library, there is a corresponding strategy for solving the historical security event in the policy library. The Bert-BiLSTM-CRF algorithm is a technical means well known to those skilled in the art and will not be elaborated here.

[0050] At the same time, the network will also actively receive new network security events. The embodiment of the present invention regards the new network security events received by the network as pending security events. Subsequently, the pending security events and historical security events can be analyzed for scene matching, so as to effectively generate strategies for solving the pending security events. It should be noted that for network security events such as pending security events and historical security events, there are a large number of different dimensional features, such as traffic size, number of connections, number of failed logins, access mode, file access behavior and other dimensions, and data information of different dimensions is usually expressed in two forms: numerical form and text form. For example, the data information of traffic size and number of connections is expressed in numerical form, while the data information of access mode is expressed in text form.

[0051] Step S2: According to the differences in data information of each dimension between the security event to be processed and each historical security event, the scene similarity of each historical security event is obtained; based on the scene similarity, similar security events of the security event to be processed are screened out from all historical security events, and similar security events and non-similar security events are marked differently to obtain labels of historical security events.

[0052] Since the strategy for resolving pending security incidents is unknown, while the strategy for resolving historical security incidents is known, the purpose of an embodiment of the present invention is to use a known strategy to resolve pending security incidents. Therefore, it is necessary to perform a similarity analysis on the pending security incidents and the historical security incidents in the scenario library, that is, a scenario matching analysis, so that the strategy of the historical security incidents with similar scenario characteristics to the pending security incident can be used to resolve the pending security incident. Therefore, the difference in data information in each dimension between the pending security incident and each historical security incident can be first analyzed, and the obtained scenario similarity can be used to reflect the degree of similarity between the pending security incident and each historical security incident regarding the network security scenario. Subsequently, similar security incidents to the pending security incident can be preliminarily screened out from the historical security incidents based on the scenario similarity.

[0053] Preferably, in one embodiment of the present invention, the method for obtaining the scene similarity of each historical security event specifically includes:

[0054] First of all, since network security incidents are composed of characteristics of multiple dimensions, and the data information of each dimension is mainly in two forms, namely text form and numerical form, in the subsequent process of quantitative analysis of network security incidents, it is necessary to divide all dimensions into two dimension types based on the form of data information of each dimension, namely statistical feature dimension and content feature dimension, among which the data information of statistical feature dimension is in numerical form, and the data information of content feature dimension is in text form.

[0055] Then, the security event to be processed or any historical security event is taken as the target security event. Since the data information of the statistical feature dimension is in numerical form, the vector composed of the data information of each statistical feature dimension of the target security event can be directly used as the first feature vector of the target security event. For example, the statistical feature dimensions of the target security event include traffic size, number of connections, and number of failed login attempts, and the corresponding data information are 1, 2, and 3 respectively, then the first feature vector of the target security event is (1,2,3).

[0056] Since the data information of the content feature dimension is in text form, the bag-of-words model in the AI ​​big model can be used to realize the quantitative processing of the data information of the content feature dimension. The bag-of-words model is used to process the data information of each content feature dimension of the target security event to obtain the second feature vector of the target security event. The bag-of-words model is a technical means well known to those skilled in the art and will not be elaborated here. The first feature vector and the second feature vector of the security event to be processed and each historical security event can be obtained by the same method as above.

[0057] Furthermore, the absolute value of the cosine similarity of the first eigenvector between the security event to be processed and each historical security event can be used as the first similarity of each historical security event, and the absolute value of the cosine similarity of the second eigenvector between the security event to be processed and each historical security event can be used as the second similarity of each historical security event. The greater the first similarity and the second similarity, the more similar the scenarios presented by the security event to be processed and each historical security event are. Therefore, the first similarity and the second similarity can be combined, and the average of the first similarity and the second similarity can be used as the scenario similarity of each historical security event.

[0058] In other embodiments of the present invention, the first similarity of each historical security event can be calculated by analyzing the Euclidean distance or Manhattan distance of the first feature vector between the security event to be processed and each historical security event, and the second similarity of each historical security event can be calculated by analyzing the Euclidean distance or Manhattan distance of the second feature vector between the security event to be processed and each historical security event. For example, the calculated Euclidean distance or Manhattan distance can be negatively correlated to calculate the first similarity and the second similarity, and the average values ​​of the first similarity and the second similarity can be normalized to obtain the scene similarity of each historical security event.

[0059] As an example, in one embodiment of the present invention, the expression of the scene similarity of each historical security event may be specifically, for example, as follows:

[0060]

[0061] Among them, A nrepresents the scene similarity of the nth historical security event; C (n,1) represents the cosine similarity of the first feature vector between the security event to be processed and the nth historical security event; C (n,2) represents the cosine similarity of the second feature vector between the security event to be processed and the nth historical security event; |C (n,1) | represents the first similarity of the nth historical security event; |C (n,2) | represents the second similarity of the nth historical security event.

[0062] The greater the scenario similarity, the more similar the network security scenarios between each historical security event and the security event to be processed are. Therefore, based on the scenario similarity, similar security events to the security event to be processed can be preliminarily screened out from all historical security events. Subsequently, through dimensionality reduction analysis, a similar scenario set of the security event to be processed can be further constructed from similar security events, thereby more effectively generating strategies for the security event to be processed.

[0063] Preferably, in one embodiment of the present invention, historical security events whose scene similarity is greater than a preset first similarity threshold are used as similar security events to the security event to be processed, wherein the value range of the preset first similarity threshold is (0.5, 1). In one embodiment of the present invention, the preset first similarity threshold is set to 0.6. The specific value of the preset first similarity threshold can also be set by the implementer according to the specific implementation scenario, and is not limited here.

[0064] Similar security events are obtained through the above process. At this time, there are two types of historical security events in the scenario library, namely similar security events and dissimilar security events. The embodiment of the present invention marks the similar security events and dissimilar security events in the scenario library differently, so as to obtain the label of each historical security event. The constructed weak classifier can be used to iteratively classify the labeled historical security events in the subsequent process, so as to achieve dimensionality reduction processing for network security event scenario matching analysis, eliminate the influence of redundant dimensions on scenario matching, and improve the effect of final policy generation. Among them, 1 and -1 can be used for marking processing, for example, similar security events in the scenario library are marked as 1, and dissimilar security events are marked as -1. At this time, the label of each historical security event is 1 or -1. The historical security event with a label of 1 indicates that the historical security event is a similar security event to the security event to be processed, and the historical security event with a label of -1 indicates that the historical security event is a dissimilar security event to the security event to be processed. Other marking methods can also be used in other embodiments of the present invention, which are not limited here.

[0065] Step S3: Take any dimension as the target dimension, and take the decision tree about the target dimension constructed through all historical security events as a weak classifier; perform iterative training on the labeled historical security events based on the weak classifier to obtain the classification accuracy of each iteration process; determine whether to terminate the iterative training based on the difference in classification accuracy between each iteration process and the previous iteration process, and obtain the criticality of the target dimension based on the classification accuracy of the last iteration process, the difference in classification accuracy between the last iteration process and the first iteration process, and the number of iterative training; filter out the key dimensions from all dimensions based on the criticality of each dimension and the number of similar security events to the security event to be processed.

[0066] Since there are many redundant dimensions in all dimensions, and different dimensions have different importance in the scene matching process between the security events to be processed and the historical security events, and the above steps directly use the data information of all dimensions to perform scene matching analysis between the security events to be processed and the historical security events, the redundant dimensions will reduce the accuracy of the scene matching between the security events to be processed and the historical security events, resulting in poor effect of the strategy generation for the security events to be processed. Therefore, it is necessary to analyze the importance of each dimension in the scene matching between the security events to be processed and the historical security events in the future, so as to select the key dimensions and eliminate the influence of the redundant dimensions on the scene matching.

[0067] The embodiment of the present invention first analyzes any dimension, takes any dimension as the target dimension, then constructs a decision tree about the target dimension through all historical security events in the scenario library, and uses the constructed decision tree about the target dimension as a weak classifier, wherein the decision tree construction method is a technical means well known to technical personnel in this field, which is not limited here, and is usually constructed by constructing a single-layer decision tree, that is, a decision tree stump, which is used as a weak classifier, and then the labeled historical security events can be iteratively trained based on the weak classifier to obtain the classification accuracy of each iterative process, and according to the difference in classification accuracy between each iterative process and the previous iterative process, it is determined whether to terminate the iterative training, and the number of iterative training is recorded, and subsequently, based on the classification accuracy of each iterative process and the number of iterative training, the importance of the target dimension in the scene matching between the security event to be processed and the historical security event can be analyzed, thereby eliminating the influence of redundant dimensions.

[0068] Preferably, in one embodiment of the present invention, the method for obtaining the classification accuracy of each iteration process specifically includes:

[0069] First, the Adaboost algorithm is used, and a weak classifier is used to classify the labeled historical security events to obtain the historical security events correctly classified in each iteration process. The Adaboost algorithm is a technical means well known to those skilled in the art and will not be described here. Then, the number of historical security events correctly classified in each iteration process is used as the numerator, the number of all historical security events is used as the denominator, and the ratio is used as the classification accuracy of each iteration process.

[0070] As an example, in one embodiment of the present invention, the expression of the classification accuracy rate of each iteration process can be specifically, for example, as follows:

[0071]

[0072] Among them, T i represents the classification accuracy of the i-th iteration process; K i represents the historical security events correctly classified during the i-th iteration; N represents the number of all historical security events in the scenario library.

[0073] Preferably, in one embodiment of the present invention, the method for determining whether to terminate iterative training specifically includes:

[0074] In the process of iterative training of labeled historical security events using the Adaboost algorithm, when the change in the classification accuracy of each iteration process relative to the previous iteration process is small, it indicates that the iterative training has reached a convergence effect. Therefore, when the absolute value of the difference in the classification accuracy between each iteration process and the previous iteration process is less than the preset judgment threshold, it indicates that the training has reached convergence. At this time, the iterative training is terminated. Otherwise, it is considered that convergence has not been reached, and the iterative training continues. The value range of the preset judgment threshold is (0, 0.1). In one embodiment of the present invention, the preset judgment threshold is set to 0.05. The specific value of the preset judgment threshold can also be set by the implementer according to the specific implementation scenario, which is not limited here.

[0075] It should be noted that the first iteration process does not exist in the previous iteration process, so the implementation of the present invention starts from the second iteration process to determine whether to terminate the iteration, that is, after the iteration is terminated, there are at least two iteration processes.

[0076] After iterative training of historical security events using weak classifiers about the target dimension, the higher the classification accuracy of the last iteration process, the smaller the difference in classification accuracy between the last iteration process and the first iteration process, and the fewer the number of iterative training times, the more important the target dimension is in the scene matching analysis between the security events to be processed and the historical security events. Therefore, the classification accuracy of the last iteration process, the difference in classification accuracy between the last iteration process and the first iteration process, and the number of iterative training times can be analyzed. The importance of the target dimension in the scene matching analysis between the security events to be processed and the historical security events can be reflected by the obtained criticality. Subsequently, the key dimensions can be selected based on the criticality, thereby improving the effect of strategy generation for the security events to be processed.

[0077] Preferably, in one embodiment of the present invention, the method for obtaining the criticality of the target dimension specifically includes:

[0078] The reciprocal of the absolute value of the difference in classification accuracy between the last iteration process and the first iteration process is used as the first key parameter of the target dimension, and the reciprocal of the number of iterative training times is used as the second key parameter of the target dimension. The classification accuracy of the last iteration process, the first key parameter of the target dimension and the sum of the second key parameter are normalized to obtain the criticality of the target dimension.

[0079] In one embodiment of the present invention, the normalization processing can be specifically, for example, maximum and minimum value normalization processing, and the normalization in subsequent steps can all adopt maximum and minimum value normalization processing. In other embodiments of the present invention, other normalization methods can be selected according to the specific range of numerical values, which will not be described in detail.

[0080] As an example, in one embodiment of the present invention, the expression of the criticality of the target dimension may be specifically, for example, as follows:

[0081]

[0082] Among them, G represents the criticality of the target dimension; T′ represents the classification accuracy of the last iteration process; T1 represents the classification accuracy of the first iteration process; M represents the number of iterative training; The first key parameter representing the target dimension; Represents the second key parameter of the target dimension; norm() represents the normalization function.

[0083] The criticality of each dimension can be obtained by the same method as above.

[0084] Considering that the network security scenario shown by the pending security incident is a niche scenario that does not occur frequently, more dimensions are needed to perform scenario matching analysis to ensure that effective security policies can be generated for the pending security incidents in niche scenarios. Whether the network security scenario shown by the pending security incident is a niche scenario can be reflected by the number of similar security incidents to the pending security incident in the scenario library. The fewer the number of similar security incidents, the network security scenario shown by the pending security incident is a niche scenario. Otherwise, it means that the network security scenario shown by the pending security incident is a frequently occurring mass scenario. Therefore, the number of similar security incidents to the pending security incident can be analyzed, and the criticality of each dimension can be combined to screen out key dimensions from all dimensions and eliminate the influence of redundant dimensions on subsequent analysis.

[0085] Preferably, in one embodiment of the present invention, the method for obtaining the criticality of the target dimension specifically includes:

[0086] First, the number of similar security events to the security event to be processed is used as the numerator, the number of all historical security events is used as the denominator, and the ratio is used as the similar scenario ratio value of the security event to be processed. A small similar scenario ratio value indicates that the security event to be processed is a niche scenario and requires more dimensions for subsequent analysis. Therefore, the difference between the value 1 and the similar scenario ratio value can be used as the weight parameter of the security event to be processed, and the product of the weight parameter and the number of all dimensions is rounded up to obtain the minimum number of dimensions.

[0087] As an example, in one embodiment of the present invention, the expression of the minimum number of dimensions may be specifically, for example:

[0088]

[0089] Among them, F min represents the minimum number of dimensions; E represents the number of similar security events to be processed; N represents the number of all historical security events in the scenario library; Indicates the ratio of similar scenarios of security incidents to be processed; It represents the weight parameter of the security events to be processed; H represents the number of all dimensions.

[0090] Then, any multiple dimensions are taken as a dimension group. The number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions. For example, if the number of all dimensions is 5 and the minimum number of dimensions is 4, then any 4 dimensions can be taken as a dimension group, and any 5 dimensions can be taken as a dimension group.

[0091] Furthermore, the average value of the criticality of all dimensions in each dimension group can be used as the overall criticality of each dimension group. The larger the overall criticality, the more critical the dimensions contained in the dimension group. Therefore, all dimensions in the dimension group corresponding to the maximum value of the overall criticality can be used as key dimensions.

[0092] At this point, the key dimensions for scene matching between pending security events and historical security events have been obtained. Subsequently, analysis can be performed on the key dimensions to construct a similar scene set of the pending security events among similar security events of the pending security events, thereby improving the effect of scene matching between the pending security events and historical security events, and further improving the effect of generating strategies for the pending security events.

[0093] Step S4: according to the difference of the data information of each key dimension between each similar security event and the security event to be processed, a similar scenario set of the security event to be processed is obtained; based on the similar scenario set, a policy set of the security event to be processed is selected from the policy library.

[0094] Since key dimensions are very important in the scene matching between the security incident to be processed and the historical security incidents, we can further study the differences in data information of each key dimension between the security incident to be processed and similar security incidents, and screen similar security incidents again to construct a similar scene set of the security incident to be processed. Subsequently, we can use the similar scene set to effectively generate a policy set for the security incident to be processed.

[0095] Preferably, in one embodiment of the present invention, the method for acquiring a similar scene set of a security event to be processed specifically includes:

[0096] Similar to the method of calculating scene similarity in the above step S2, first, based on the form of the data information of each key dimension, all key dimensions are divided into statistical feature key dimensions and content feature key dimensions. The data information of the statistical feature key dimensions is in numerical form, and the data information of the content feature key dimensions is in text form.

[0097] The security event to be processed or any similar security event is taken as the security event to be tested, and the vector composed of the data information of the key dimensions of the statistical features of the security event to be tested is taken as the third feature vector of the target security event. The bag-of-words model is used to process the data information of the key dimensions of the content features of the security event to be tested to obtain the fourth feature vector of the security event to be tested.

[0098] The absolute value of the cosine similarity of the third eigenvector between the pending security event and each similar security event is used as the third similarity of each similar security event. The absolute value of the cosine similarity of the fourth eigenvector between the pending security event and each similar security event is used as the fourth similarity of each similar security event. The average value of the third similarity and the fourth similarity is used as the scene similarity parameter of each similar security event.

[0099] The larger the scenario similarity parameter is, the closer each similar security event is to the scenario represented by the security event to be processed. Therefore, the set of similar security events whose scenario similarity parameters are greater than the preset second similarity threshold can be used as the similar scenario set of the security event to be processed, where the value range of the preset second similarity threshold is (0.5, 1). In one embodiment of the present invention, the preset second similarity threshold is set to 0.8. The specific value of the preset second similarity threshold can also be set by the implementer according to the specific implementation scenario, and is not limited here.

[0100] As an example, in one embodiment of the present invention, the expression of the scenario similarity parameter of each similar security event may be specifically, for example, as follows:

[0101]

[0102] Among them, B r represents the scenario similarity parameter of the rth similar security event; D (r,3) represents the cosine similarity of the third feature vector between the security event to be processed and the rth similar security event; D (r,4) represents the cosine similarity of the fourth eigenvector between the security event to be processed and the rth similar security event; |D (r,3) | represents the third similarity of the rth similar security event; |D (r,4) | represents the fourth similarity of the rth similar security event.

[0103] The similar scenario set includes historical security events with scenarios similar to those presented by the security event to be processed. Therefore, based on the similar scenario set, a policy set for the security event to be processed can be selected from the policy library.

[0104] Preferably, in one embodiment of the present invention, the method for obtaining a policy set for a security event to be processed specifically includes:

[0105] Since the policy library and the scenario library are interconnected, that is, the policy library contains policies for resolving historical security incidents, policies for resolving all historical security incidents in a similar scenario set can be selected from the policy library, and the set consisting of all selected policies can be used as the policy set for the security incidents to be processed, thereby achieving effective generation of policies for the security incidents to be processed.

[0106] After constructing a policy set for the security incidents to be handled, the policy set can be used to generate corresponding scripts to resolve the security incidents that currently occur in the Internet of Things.

[0107] An embodiment of the present invention provides a network security policy generation system based on an AI big model, the system comprising a memory, a processor and a computer program, wherein the memory is used to store the corresponding computer program, the processor is used to run the corresponding computer program, and when the computer program runs in the processor, it can implement the method described in steps S1 to S4.

[0108] It should be noted that the sequence of the above embodiments of the present invention is for description only and does not represent the advantages and disadvantages of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0109] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referenced to each other, and each embodiment focuses on the differences from other embodiments.

Claims

1. A network security strategy generation method based on AI big model, characterized in that: The method comprises: Acquire a scenario library and a policy library about network security, wherein the scenario library includes multiple historical security events, and simultaneously acquire pending security events currently received by the network, wherein both the pending security events and the historical security events include data information of multiple dimensions; Compare the data information of each key dimension of the security event to be processed with the data information of each key dimension of the historical security event to obtain the difference of the data information, and obtain the scene similarity of each historical security event according to the difference; based on the scene similarity, filter out similar security events of the security event to be processed from all historical security events, and mark the similar security events and dissimilar security events differently to obtain the labels of the historical security events; Take any dimension as the target dimension, and take the decision tree about the target dimension constructed through all historical security events as a weak classifier; perform iterative training on the labeled historical security events based on the weak classifier to obtain the classification accuracy of each iteration process; determine whether to terminate the iterative training based on the difference in the classification accuracy between each iteration process and the previous iteration process, and obtain the criticality of the target dimension based on the classification accuracy of the last iteration process, the difference in the classification accuracy between the last iteration process and the first iteration process, and the number of iterative training; filter out the key dimensions from all dimensions based on the criticality of each dimension and the number of similar security events to the security event to be processed; Compare each key dimension data information of similar security events with each key dimension data information of the security event to be processed to obtain the difference between the data information, and obtain a similar scenario set of the security event to be processed based on the difference; based on the similar scenario set, select a policy set for the security event to be processed from the policy library.

2. According to the method for generating network security strategy based on AI big model in claim 1, it is characterized in that: The step of obtaining the scene similarity of each historical security event includes: Based on the form of data information of each dimension, all dimensions are divided into statistical feature dimensions and content feature dimensions, wherein the data information of the statistical feature dimensions is in numerical form, and the data information of the content feature dimensions is in text form; The security event to be processed or any historical security event is taken as the target security event, and the vector composed of data information of each statistical feature dimension of the target security event is taken as the first feature vector of the target security event; Using the bag-of-words model, the data information of each content feature dimension of the target security event is processed to obtain the second feature vector of the target security event; The absolute value of the cosine similarity of the first feature vector between the security event to be processed and each historical security event is used as the first similarity of each historical security event, and the absolute value of the cosine similarity of the second feature vector between the security event to be processed and each historical security event is used as the second similarity of each historical security event; An average value of the first similarity and the second similarity is used as the scene similarity of each historical security event.

3. According to the method for generating network security strategy based on AI big model in claim 1, it is characterized in that: The similar security events of the security event to be processed are screened out from all historical security events based on the scenario similarity, including: The historical security events whose scenario similarity is greater than a preset first similarity threshold are used as similar security events to the security event to be processed.

4. According to the method for generating network security strategy based on AI big model in claim 1, it is characterized in that: The classification accuracy of each iteration process is obtained as follows: Use the Adaboost algorithm and weak classifiers to classify historical security events with labels, and obtain correctly classified historical security events in each iteration; The number of historical security events correctly classified in each iteration process is taken as the numerator, the number of all historical security events is taken as the denominator, and the ratio is taken as the classification accuracy rate of each iteration process.

5. According to the method for generating network security strategy based on AI big model in claim 1, it is characterized in that: The determining whether to terminate the iterative training according to the difference in classification accuracy between each iterative process and the previous iterative process includes: If the absolute value of the difference between the classification accuracy of each iteration process and the previous iteration process is less than a preset judgment threshold, the iterative training is terminated; otherwise, the iterative training is continued.

6. According to the method of claim 1, the network security strategy generation method based on the AI ​​big model is characterized in that: The criticality of obtaining the target dimension includes: The reciprocal of the absolute value of the difference between the last iteration process and the first iteration process is used as the first key parameter of the target dimension; The inverse of the number of iterative training is used as the second key parameter of the target dimension; The classification accuracy of the last iteration process, the sum of the first key parameter and the second key parameter of the target dimension are normalized to obtain the criticality of the target dimension.

7. According to claim 1, a network security strategy generation method based on AI big model is characterized in that: The key dimensions screened out from all dimensions include: The number of similar security incidents to the security incident to be processed is used as the numerator, the number of all historical security incidents is used as the denominator, and the ratio is used as the similar scenario ratio value of the security incident to be processed; Calculate the weight parameter of the security event to be processed, and the calculation formula of the weight parameter is: ,in, Indicates the weight parameter of the security event to be processed. Indicates the ratio of similar scenarios of security incidents to be processed; Round up the product of the weight parameter and the number of all dimensions to obtain the minimum number of dimensions; Taking any multiple dimensions as a dimension group, wherein the number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions; The average value of the criticality of all dimensions in each dimension group is taken as the overall criticality of each dimension group; All dimensions in the dimension group corresponding to the maximum value of the overall criticality are taken as key dimensions.

8. According to claim 2, a network security strategy generation method based on AI big model is characterized in that: The similar scenario set of the security event to be processed is obtained including: Based on the calculation method of the scenario similarity of each historical security event, each key dimension data information of the security event to be processed is compared with each key dimension data information of the historical security event to obtain the difference of the data information, and the scenario similarity parameter of each similar security event is calculated according to the difference; A set of similar security events whose scenario similarity parameters are greater than a preset second similarity threshold is used as a similar scenario set of the security event to be processed.

9. The method for generating network security strategies based on AI big model according to claim 1 is characterized in that: The step of selecting a policy set for the security event to be processed from the policy library based on the similar scenario set includes: In the policy library, policies for solving all historical security events in the similar scenario set are selected, and a set consisting of all the selected policies is used as a policy set for the security event to be processed.

10. A network security policy generation system based on an AI big model, the system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images