A risk screening and analysis method for network correlation data based on neural network

Abstract

The present invention relates to the field of risk screening and analysis of network-related data, and in particular to a method for risk screening and analysis of network-related data based on a neural network, including: collecting real-time network-related data to establish fixed-related features and time-sharing related features of the real-time network-related data respectively; using the fixed-related features and time-sharing related features to establish a potential risk analysis model for network-related data based on a neural network; using the potential risk analysis model for network-related data to obtain risk screening and analysis results for network-related data, thereby improving the efficiency and accuracy of risk screening, and using an advanced neural network model to process and analyze network-related data. First, the original data is pre-processed in depth to ensure data quality, and then the intrinsic features of the data are extracted and expanded through the powerful learning ability of the neural network, and the accuracy and reliability of the analysis results are ensured.

Description

Technical Field

[0001] The present invention relates to the field of network-related data risk screening and analysis, and in particular to a network-related data risk screening and analysis method based on a neural network. Background Art

[0002] Network security is fundamentally about ensuring the security of information in cyberspace. This is not only about data confidentiality, but also about data integrity, availability, and authenticity. The hardware devices of the network system, the software programs running, and the data stored must be properly protected to prevent them from being damaged by malicious attacks, accidents, or internal errors. Traditional solutions only start from a specific perspective and lack holistic consideration of all data types associated with network information. Summary of the invention

[0003] In view of the shortcomings of the prior art, the present invention provides a network association data risk screening and analysis method based on a neural network, which establishes a network association data analysis model with a stable and reliable structure through a neural network and quickly outputs the final risk analysis screening results.

[0004] To achieve the above object, the present invention provides a network association data risk screening and analysis method based on a neural network, comprising:

[0005] S1. Collect real-time network correlation data and establish fixed correlation features and time-sharing correlation features of the real-time network correlation data respectively;

[0006] S2, using the fixed correlation features and the time-sharing correlation features to establish a potential risk analysis model for network correlation data based on a neural network;

[0007] S3. Obtaining a network-associated data risk screening analysis result using the network-associated data potential risk analysis model.

[0008] Preferably, the collecting of real-time network correlation data and establishing fixed correlation features and time-sharing correlation features of the real-time network correlation data respectively include:

[0009] S1-1, obtain real-time network type data, real-time network communication volume, real-time interface information and real-time line architecture to establish real-time network related data;

[0010] S1-2, obtaining the current time as the feature calibration time t;

[0011] S1-3, using the real-time network type data of the real-time network association data to obtain the real-time network type data at the feature calibration time t, time t+1 and time t+2 according to the feature calibration time t to establish a real-time network type data sequence;

[0012] S1-4, using the real-time network communication volume of the real-time network association data to obtain the real-time network communication volume at the characteristic calibration time t, the real-time network communication volume at the time t+1 and the time t+2 according to the characteristic calibration time t to establish a real-time network communication volume sequence;

[0013] S1-5, using the real-time interface information of the real-time network associated data to establish a real-time network distributed line architecture according to the corresponding real-time line architecture as a fixed associated feature of the real-time network associated data;

[0014] S1-6. Utilize the real-time network type data sequence and the real-time network communication volume sequence as time-sharing association features of the real-time network association data.

[0015] Furthermore, using the fixed correlation features and the time-sharing correlation features to establish a potential risk analysis model for network correlation data based on a neural network includes:

[0016] S2-1, using the fixed association features to establish an association risk analysis model for real-time network association data based on a neural network;

[0017] S2-2, using the time-sharing correlation features to establish a continuous risk assessment model for real-time network correlation data based on a neural network;

[0018] S2-3. Utilize the real-time network association data association risk analysis model and the continuous risk assessment model as a network association data potential risk analysis model.

[0019] Furthermore, establishing a correlation risk analysis model for real-time network correlation data based on a neural network using the fixed correlation features includes:

[0020] S2-1-1, acquiring corresponding historical fixed associated features according to the fixed associated features to establish a first training set;

[0021] S2-1-2, establishing a first verification set and a second verification set respectively according to the historical network type data sequence and the historical network communication volume sequence corresponding to the time-sharing association characteristics;

[0022] S2-1-3, using the first training set as input, the data flow direction and the amount of data passing through each node corresponding to the first training set as output, establishing a hidden layer structure based on the amount of non-endpoint data, and training based on a neural network to obtain a basic association risk analysis model;

[0023] S2-1-4, determine whether the model output of the basic association risk analysis model corresponds to the first verification set, if so, execute S2-1-5, otherwise, update the first training set using the historical fixed association features corresponding to the first verification set that do not correspond to the model output, and return to S2-1-1;

[0024] S2-1-5, determine whether the model output of the basic association risk analysis model corresponds to the second verification set, if so, use the basic association risk analysis model as the association risk analysis model of the real-time network association data, otherwise, obtain the historical fixed association features corresponding to the second verification set that do not correspond to the model output as the training set to be updated, and execute S2-1-6;

[0025] S2-1-6. Determine whether the training set to be updated has the same subset as the first training set. If so, use the same subset as the update of the first training set and return to S2-1-3. Otherwise, use the training set to be updated to join the first training set as the update of the first training set and return to S2-1-3.

[0026] Furthermore, using the time-sharing correlation feature to establish a continuous risk assessment model for real-time network correlation data based on a neural network includes:

[0027] S2-2-1, establishing a first data set according to the historical network type data sequence of the time-sharing association characteristics;

[0028] S2-2-2, establishing a second data set based on the historical network communication volume sequence of the time-sharing correlation characteristics;

[0029] S2-2-3, obtaining the corresponding historical network distributed line architecture as a second verification set according to the fixed association feature;

[0030] S2-2-4, using the first data set as input and the second data set at the time corresponding to the first data set as output, establishing a basic continuous risk assessment model based on a neural network;

[0031] S2-2-5, determine whether the model output of the basic continuous risk assessment model corresponds to the second verification set, if so, use the basic continuous risk assessment model as the continuous risk assessment model of the real-time network associated data, otherwise, obtain the historical network type data sequence and the historical network communication volume sequence corresponding to the second verification set that do not correspond to the model output, respectively establish the first data set to be verified and the second data set to be verified, and execute S2-2-6;

[0032] S2-2-6, determine whether the first data set to be verified and the first data set have duplicate subsets, if so, execute S2-2-7, otherwise, use the first data set to be verified and the second data set to be verified to update the first data set and the second data set respectively, and return to S2-2-4;

[0033] S2-2-7. Determine whether there is a duplicate subset between the second data set to be verified and the second data set. If so, return to S2-2-4; otherwise, return to S1-5.

[0034] Furthermore, the network-related data risk screening analysis results obtained by using the network-related data potential risk analysis model include:

[0035] S3-1, using the association risk analysis model of the network association data potential risk analysis model to obtain the association risk analysis results of the real-time network association data;

[0036] S3-2, using the continuous risk assessment model of the network-related data potential risk analysis model to obtain continuous risk assessment results of real-time network-related data;

[0037] S3-3. Perform risk classification assessment using the associated risk analysis results of the real-time network associated data and the continuous risk assessment results to obtain a network associated data risk screening analysis result.

[0038] Further, obtaining the correlation risk analysis result of the real-time network correlation data by using the correlation risk analysis model of the network correlation data potential risk analysis model includes:

[0039] S3-1-1, using the real-time line architecture of the real-time network associated data to input the associated risk analysis model of the potential risk analysis model of the network associated data to obtain the output result of the associated risk analysis model of the real-time network associated data;

[0040] S3-1-2, determining whether the output result of the correlation risk analysis model of the real-time network correlation data corresponds to the real-time network type data of the real-time network correlation data, if so, executing S3-1-3, otherwise, the correlation risk analysis result of the real-time network correlation data is that there is a risk;

[0041] S3-1-3. Determine whether the output result of the association risk analysis model of the real-time network association data corresponds to the real-time network communication volume of the real-time network association data. If so, the association risk analysis result of the real-time network association data is normal; otherwise, the association risk analysis result of the real-time network association data is that there is a risk.

[0042] Further, obtaining the continuous risk assessment result of the real-time network associated data by using the continuous risk assessment model of the network associated data potential risk analysis model includes:

[0043] S3-2-1, using the network type data sequence of the real-time network association data to input the continuous risk assessment model of the network association data potential risk analysis model to obtain the output result of the continuous risk assessment model of the real-time network association data;

[0044] S3-2-2, determining whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time interface information of the real-time network associated data, if so, executing S3-2-2, otherwise, the continuous risk assessment result is that there is a risk;

[0045] S3-2-3. Determine whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time line architecture of the real-time network associated data. If so, the continuous risk assessment result is normal; otherwise, the continuous risk assessment result is that there is a risk.

[0046] Further, the risk screening analysis results of the network association data obtained by performing risk classification assessment processing using the association risk analysis results of the real-time network association data and the continuous risk assessment results include:

[0047] S3-3-1, judging whether the number of training times of the potential risk analysis model of the network association data at the current moment is less than 5, if so, proceeding to S3-3-2, otherwise, abandoning the risk classification assessment process, and outputting the risk classification assessment process result of the real-time network association data as risk;

[0048] S3-3-2, judging whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both normal, if so, the risk classification assessment processing result of the real-time network associated data is normal, otherwise, executing S3-3-3;

[0049] S3-3-3, determine whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both at risk, if so, the risk classification assessment result of the real-time network associated data is abnormal, and execute S3-3-4;

[0050] S3-3-4. Determine whether the associated risk analysis result of the real-time network associated data indicates that there is a risk. If so, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the associated risk analysis result corresponding to the real-time network type data and real-time network communication volume. Otherwise, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the continuous risk assessment result corresponding to the real-time interface information and real-time line architecture.

[0051] Compared with the closest prior art, the present invention has the following beneficial effects:

[0052] In order to improve the efficiency and accuracy of risk screening, advanced neural network models are used to process and analyze network-related data. First, the raw data is preprocessed in depth to ensure data quality, and then the intrinsic characteristics of the data are extracted and expanded through the powerful learning ability of the neural network. This process not only includes the structured processing of data, but also involves the intelligent analysis of unstructured data, such as text, images, and sounds. In the model training stage, cross-validation is used to ensure the generalization ability of the model. It not only improves the efficiency of risk screening, but also ensures the accuracy and reliability of the analysis results, providing strong data support for decision makers. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a flow chart of a network association data risk screening and analysis method based on neural network provided by the present invention. DETAILED DESCRIPTION

[0054] The specific implementation modes of the present invention will be further described in detail below in conjunction with the accompanying drawings.

[0055] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0056] Embodiment 1:

[0057] The present invention provides a network association data risk screening and analysis method based on neural network. Figure 1 As shown, including:

[0058] S1. Collect real-time network correlation data and establish fixed correlation features and time-sharing correlation features of the real-time network correlation data respectively;

[0059] S2, using the fixed correlation features and the time-sharing correlation features to establish a potential risk analysis model for network correlation data based on a neural network;

[0060] S3. Obtaining a network-associated data risk screening analysis result using the network-associated data potential risk analysis model.

[0061] S1 specifically includes:

[0062] S1-1, obtain real-time network type data, real-time network communication volume, real-time interface information and real-time line architecture to establish real-time network related data;

[0063] S1-2, obtaining the current time as the feature calibration time t;

[0064] S1-3, using the real-time network type data of the real-time network association data to obtain the real-time network type data at the feature calibration time t, time t+1 and time t+2 according to the feature calibration time t to establish a real-time network type data sequence;

[0065] S1-4, using the real-time network communication volume of the real-time network association data to obtain the real-time network communication volume at the characteristic calibration time t, the real-time network communication volume at the time t+1 and the time t+2 according to the characteristic calibration time t to establish a real-time network communication volume sequence;

[0066] S1-5, using the real-time interface information of the real-time network associated data to establish a real-time network distributed line architecture according to the corresponding real-time line architecture as a fixed associated feature of the real-time network associated data;

[0067] S1-6. Utilize the real-time network type data sequence and the real-time network communication volume sequence as time-sharing association features of the real-time network association data.

[0068] S2 specifically includes:

[0069] S2-1, using the fixed association features to establish an association risk analysis model for real-time network association data based on a neural network;

[0070] S2-2, using the time-sharing correlation features to establish a continuous risk assessment model for real-time network correlation data based on a neural network;

[0071] S2-3. Utilize the real-time network association data association risk analysis model and the continuous risk assessment model as a network association data potential risk analysis model.

[0072] S2-1 specifically includes:

[0073] S2-1-1, acquiring corresponding historical fixed associated features according to the fixed associated features to establish a first training set;

[0074] S2-1-2, establishing a first verification set and a second verification set respectively according to the historical network type data sequence and the historical network communication volume sequence corresponding to the time-sharing association characteristics;

[0075] S2-1-3, using the first training set as input, the data flow direction and the amount of data passing through each node corresponding to the first training set as output, establishing a hidden layer structure based on the amount of non-endpoint data, and training based on a neural network to obtain a basic association risk analysis model;

[0076] S2-1-4, determine whether the model output of the basic association risk analysis model corresponds to the first verification set, if so, execute S2-1-5, otherwise, update the first training set using the historical fixed association features corresponding to the first verification set that do not correspond to the model output, and return to S2-1-1;

[0077] S2-1-5, determine whether the model output of the basic association risk analysis model corresponds to the second verification set, if so, use the basic association risk analysis model as the association risk analysis model of the real-time network association data, otherwise, obtain the historical fixed association features corresponding to the second verification set that do not correspond to the model output as the training set to be updated, and execute S2-1-6;

[0078] S2-1-6. Determine whether the training set to be updated has the same subset as the first training set. If so, use the same subset as the update of the first training set and return to S2-1-3. Otherwise, use the training set to be updated to join the first training set as the update of the first training set and return to S2-1-3.

[0079] S2-2 specifically includes:

[0080] S2-2-1, establishing a first data set according to the historical network type data sequence of the time-sharing association characteristics;

[0081] S2-2-2, establishing a second data set based on the historical network communication volume sequence of the time-sharing correlation characteristics;

[0082] S2-2-3, obtaining a corresponding historical network distributed line architecture as a second verification set according to the fixed association feature;

[0083] S2-2-4, using the first data set as input and the second data set at the time corresponding to the first data set as output, establishing a basic continuous risk assessment model based on a neural network;

[0084] S2-2-5, determine whether the model output of the basic continuous risk assessment model corresponds to the second verification set, if so, use the basic continuous risk assessment model as the continuous risk assessment model of the real-time network associated data, otherwise, obtain the historical network type data sequence and the historical network communication volume sequence corresponding to the second verification set that do not correspond to the model output, respectively establish the first data set to be verified and the second data set to be verified, and execute S2-2-6;

[0085] S2-2-6, determine whether the first data set to be verified and the first data set have duplicate subsets, if so, execute S2-2-7, otherwise, use the first data set to be verified and the second data set to be verified to update the first data set and the second data set respectively, and return to S2-2-4;

[0086] S2-2-7. Determine whether there is a duplicate subset between the second data set to be verified and the second data set. If so, return to S2-2-4; otherwise, return to S1-5.

[0087] S3 specifically includes:

[0088] S3-1, using the association risk analysis model of the network association data potential risk analysis model to obtain the association risk analysis results of the real-time network association data;

[0089] S3-2, using the continuous risk assessment model of the network-related data potential risk analysis model to obtain continuous risk assessment results of real-time network-related data;

[0090] S3-3. Perform risk classification assessment using the associated risk analysis results of the real-time network associated data and the continuous risk assessment results to obtain a network associated data risk screening analysis result.

[0091] S3-1 specifically includes:

[0092] S3-1-1, using the real-time line architecture of the real-time network associated data to input the associated risk analysis model of the potential risk analysis model of the network associated data to obtain the output result of the associated risk analysis model of the real-time network associated data;

[0093] S3-1-2, determining whether the output result of the correlation risk analysis model of the real-time network correlation data corresponds to the real-time network type data of the real-time network correlation data, if so, executing S3-1-3, otherwise, the correlation risk analysis result of the real-time network correlation data is that there is a risk;

[0094] S3-1-3. Determine whether the output result of the association risk analysis model of the real-time network association data corresponds to the real-time network communication volume of the real-time network association data. If so, the association risk analysis result of the real-time network association data is normal; otherwise, the association risk analysis result of the real-time network association data is that there is a risk.

[0095] S3-2 specifically includes:

[0096] S3-2-1, using the network type data sequence of the real-time network association data to input the continuous risk assessment model of the network association data potential risk analysis model to obtain the output result of the continuous risk assessment model of the real-time network association data;

[0097] S3-2-2, determining whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time interface information of the real-time network associated data, if so, executing S3-2-2, otherwise, the continuous risk assessment result is that there is a risk;

[0098] S3-2-3. Determine whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time line architecture of the real-time network associated data. If so, the continuous risk assessment result is normal; otherwise, the continuous risk assessment result is that there is a risk.

[0099] S3-3 specifically includes:

[0100] S3-3-1, judging whether the number of training times of the potential risk analysis model of the network association data at the current moment is less than 5, if so, proceeding to S3-3-2, otherwise, abandoning the risk classification assessment process, and outputting the risk classification assessment process result of the real-time network association data as risk;

[0101] S3-3-2, judging whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both normal, if so, the risk classification assessment processing result of the real-time network associated data is normal, otherwise, executing S3-3-3;

[0102] S3-3-3, determine whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both at risk, if so, the risk classification assessment result of the real-time network associated data is abnormal, and execute S3-3-4;

[0103] S3-3-4. Determine whether the associated risk analysis result of the real-time network associated data indicates that there is a risk. If so, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the associated risk analysis result corresponding to the real-time network type data and real-time network communication volume. Otherwise, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the continuous risk assessment result corresponding to the real-time interface information and real-time line architecture.

[0104] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] The present invention is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0106] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0107] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A network association data risk screening and analysis method based on neural network, characterized in that: include: S1. Collect real-time network correlation data and establish fixed correlation features and time-sharing correlation features of the real-time network correlation data respectively; S1-1, obtain real-time network type data, real-time network communication volume, real-time interface information and real-time line architecture to establish real-time network related data; S1-2, obtaining the current time as the feature calibration time t; S1-3, using the real-time network type data of the real-time network association data to obtain the real-time network type data at the feature calibration time t, time t+1 and time t+2 according to the feature calibration time t to establish a real-time network type data sequence; S1-4, using the real-time network communication volume of the real-time network association data to obtain the real-time network communication volume at the characteristic calibration time t, the real-time network communication volume at the time t+1 and the time t+2 according to the characteristic calibration time t to establish a real-time network communication volume sequence; S1-5, using the real-time interface information of the real-time network associated data to establish a real-time network distributed line architecture according to the corresponding real-time line architecture as a fixed associated feature of the real-time network associated data; S1-6, using the real-time network type data sequence and the real-time network communication volume sequence as time-sharing association features of real-time network association data; S2, using the fixed correlation features and the time-sharing correlation features to establish a potential risk analysis model for network correlation data based on a neural network; S2-1, using the fixed association features to establish an association risk analysis model for real-time network association data based on a neural network; S2-2, using the time-sharing correlation features to establish a continuous risk assessment model for real-time network correlation data based on a neural network; S2-3, using the association risk analysis model and continuous risk assessment model of the real-time network association data as a potential risk analysis model for network association data; S3. Obtaining a network-associated data risk screening analysis result using the network-associated data potential risk analysis model.

2. A method for risk screening and analysis of network association data based on neural network as claimed in claim 1, characterized in that: Using the fixed association features to establish an association risk analysis model for real-time network association data based on a neural network includes: S2-1-1, acquiring corresponding historical fixed associated features according to the fixed associated features to establish a first training set; S2-1-2, establishing a first verification set and a second verification set respectively according to the historical network type data sequence and the historical network communication volume sequence corresponding to the time-sharing association characteristics; S2-1-3, using the first training set as input, the data flow direction and the amount of data passing through each node corresponding to the first training set as output, establishing a hidden layer structure based on the amount of non-endpoint data, and training based on a neural network to obtain a basic association risk analysis model; S2-1-4, determine whether the model output of the basic association risk analysis model corresponds to the first verification set, if so, execute S2-1-5, otherwise, update the first training set using the historical fixed association features corresponding to the first verification set that do not correspond to the model output, and return to S2-1-1; S2-1-5, determine whether the model output of the basic association risk analysis model corresponds to the second verification set, if so, use the basic association risk analysis model as the association risk analysis model of the real-time network association data, otherwise, obtain the historical fixed association features corresponding to the second verification set that do not correspond to the model output as the training set to be updated, and execute S2-1-6; S2-1-6. Determine whether the training set to be updated has the same subset as the first training set. If so, use the same subset as the update of the first training set and return to S2-1-3. Otherwise, use the training set to be updated to join the first training set as the update of the first training set and return to S2-1-3.

3. A method for risk screening and analysis of network association data based on neural network as claimed in claim 2, characterized in that: The continuous risk assessment model of real-time network correlation data is established based on a neural network using the time-sharing correlation feature, including: S2-2-1, establishing a first data set according to the historical network type data sequence of the time-sharing association characteristics; S2-2-2, establishing a second data set based on the historical network communication volume sequence of the time-sharing correlation characteristics; S2-2-3, obtaining the corresponding historical network distributed line architecture as a second verification set according to the fixed association feature; S2-2-4, using the first data set as input and the second data set at the time corresponding to the first data set as output, establishing a basic continuous risk assessment model based on a neural network; S2-2-5, determine whether the model output of the basic continuous risk assessment model corresponds to the second verification set, if so, use the basic continuous risk assessment model as the continuous risk assessment model of the real-time network associated data, otherwise, obtain the historical network type data sequence and the historical network communication volume sequence corresponding to the second verification set that do not correspond to the model output, respectively establish the first data set to be verified and the second data set to be verified, and execute S2-2-6; S2-2-6, determine whether the first data set to be verified and the first data set have duplicate subsets, if so, execute S2-2-7, otherwise, use the first data set to be verified and the second data set to be verified to update the first data set and the second data set respectively, and return to S2-2-4; S2-2-7. Determine whether there is a duplicate subset between the second data set to be verified and the second data set. If so, return to S2-2-4; otherwise, return to S1-5.

4. The method for risk screening and analysis of network association data based on neural network according to claim 1, characterized in that: The network-related data risk screening analysis results obtained by using the network-related data potential risk analysis model include: S3-1, using the association risk analysis model of the network association data potential risk analysis model to obtain the association risk analysis results of the real-time network association data; S3-2, using the continuous risk assessment model of the network-related data potential risk analysis model to obtain continuous risk assessment results of real-time network-related data; S3-3. Perform risk classification assessment using the associated risk analysis results of the real-time network associated data and the continuous risk assessment results to obtain a network associated data risk screening analysis result.

5. The method for risk screening and analysis of network association data based on neural network as claimed in claim 4, characterized in that: The method of obtaining the correlation risk analysis result of the real-time network correlation data by using the correlation risk analysis model of the network correlation data potential risk analysis model includes: S3-1-1, using the real-time line architecture of the real-time network associated data to input the associated risk analysis model of the potential risk analysis model of the network associated data to obtain the output result of the associated risk analysis model of the real-time network associated data; S3-1-2, determining whether the output result of the correlation risk analysis model of the real-time network correlation data corresponds to the real-time network type data of the real-time network correlation data, if so, executing S3-1-3, otherwise, the correlation risk analysis result of the real-time network correlation data is that there is a risk; S3-1-3. Determine whether the output result of the association risk analysis model of the real-time network association data corresponds to the real-time network communication volume of the real-time network association data. If so, the association risk analysis result of the real-time network association data is normal; otherwise, the association risk analysis result of the real-time network association data is that there is a risk.

6. A method for risk screening and analysis of network association data based on neural network as claimed in claim 5, characterized in that: The continuous risk assessment results of real-time network associated data are obtained by using the continuous risk assessment model of the network associated data potential risk analysis model, including: S3-2-1, using the network type data sequence of the real-time network association data to input the continuous risk assessment model of the network association data potential risk analysis model to obtain the output result of the continuous risk assessment model of the real-time network association data; S3-2-2, determining whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time interface information of the real-time network associated data, if so, executing S3-2-2, otherwise, the continuous risk assessment result is that there is a risk; S3-2-3. Determine whether the output result of the continuous risk assessment model of the real-time network associated data corresponds to the real-time line architecture of the real-time network associated data. If so, the continuous risk assessment result is normal; otherwise, the continuous risk assessment result is that there is a risk.

7. The method for risk screening and analysis of network association data based on neural network according to claim 6, characterized in that: The risk screening analysis results of the network association data obtained by performing risk classification assessment processing using the association risk analysis results of the real-time network association data and the continuous risk assessment results include: S3-3-1, judging whether the number of training times of the potential risk analysis model of the network association data at the current moment is less than 5, if so, proceeding to S3-3-2, otherwise, abandoning the risk classification assessment process, and outputting the risk classification assessment process result of the real-time network association data as risk; S3-3-2, judging whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both normal, if so, the risk classification assessment processing result of the real-time network associated data is normal, otherwise, executing S3-3-3; S3-3-3, determine whether the associated risk analysis result and the continuous risk assessment result of the real-time network associated data are both at risk, if so, the risk classification assessment result of the real-time network associated data is abnormal, and execute S3-3-4; S3-3-4. Determine whether the associated risk analysis result of the real-time network associated data indicates that there is a risk. If so, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the associated risk analysis result corresponding to the real-time network type data and real-time network communication volume. Otherwise, the risk screening analysis result of the network associated data indicates that there is a risk, and outputs the continuous risk assessment result corresponding to the real-time interface information and real-time line architecture.

Images