Network security situation dynamic defense decision-making method and system based on AI

Abstract

The invention relates to the field of network security, in particular to a network security situation dynamic defense decision-making method and system based on AI, and the method comprises the steps: obtaining network flow data in real time, and extracting a target feature of the network flow data; according to an extraction result, judging whether the target feature meets a condition of an abnormal feature or not; when the target feature meets the condition of the abnormal feature, intercepting the network flow data; when the target feature does not meet the condition of the abnormal feature, inputting the network traffic data into a preset situation analysis model, and predicting a change feature of the network traffic data through the situation analysis model; judging whether the network flow data meets a defense condition or not according to a prediction result; and when the network flow data meets a defense condition, executing a defense strategy based on a judgment result. Through the situation analysis model, the current traffic abnormity can be identified, the future traffic change trend can be predicted, defense measures can be taken in advance, and the attack risk is reduced.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to an AI-based network security situation dynamic defense decision-making method and system. Background Art

[0002] Cybersecurity posture refers to the overall status of an organization or system in terms of cybersecurity, including the security, stability and reliability of its network. It reflects the organization's defense capabilities against cyberattacks, vulnerabilities, threats and risks, as well as its response speed and recovery capabilities in the face of these challenges. The assessment of cybersecurity posture is an ongoing process that requires organizations to continuously monitor and improve their cybersecurity measures to adapt to the ever-changing cyber threat environment. Through effective cybersecurity posture management, organizations can reduce cyber risks.

[0003] Existing technologies usually make judgments based on predefined static abnormal features. This feature relies on a fixed understanding of normal behavior, which leads to limitations in the system's response to abnormal traffic. With the dynamic changes in user behavior and network environment, these static features may not cover all potential abnormal situations, resulting in missed reports. For example, in some cases, network traffic may appear normal for a short period of time, but may then turn into attack behavior. Therefore, the static judgment of existing technologies is difficult to effectively monitor sudden changes in traffic patterns, and may fail to issue an alarm in the early stages of an attack, delaying the response time and increasing the risk of the system being attacked.

[0004] Therefore, the prior art has defects and needs to be improved. Summary of the invention

[0005] In order to solve one or several problems in the prior art, the main purpose of this application is to provide an AI-based network security situation dynamic defense decision-making method and system.

[0006] In order to achieve the above-mentioned invention object, the present application proposes an AI-based network security situation dynamic defense decision-making method, the method comprising:

[0007] Acquire network traffic data in real time and extract target features of the network traffic data;

[0008] According to the extracted result, determining whether the target feature meets the condition of abnormal feature;

[0009] When the target feature meets the condition of abnormal feature, intercepting the network traffic data is executed;

[0010] When the target feature does not meet the condition of the abnormal feature, the network traffic data is input into a preset situation analysis model, and the change feature of the network traffic data is predicted by the situation analysis model;

[0011] Determining whether the network traffic data meets the defense conditions according to the prediction result;

[0012] When the network traffic data meets the defense conditions, the defense strategy is executed based on the judgment result.

[0013] The embodiment of the present application also provides an AI-based network security situation dynamic defense decision-making system, including:

[0014] An acquisition module, used to acquire network flow data in real time and extract target features of the network flow data;

[0015] A first judgment module, used to judge whether the target feature meets the condition of abnormal feature according to the extraction result;

[0016] An interception module, used for intercepting the network traffic data when the target feature meets the condition of abnormal feature;

[0017] A prediction module, used for inputting the network traffic data into a preset situation analysis model when the target feature does not meet the condition of the abnormal feature, and predicting the change characteristics of the network traffic data through the situation analysis model;

[0018] A second judgment module is used to judge whether the network traffic data meets the defense conditions according to the prediction result;

[0019] The defense module is used to execute the defense strategy based on the judgment result when the network traffic data meets the defense conditions.

[0020] The present application also provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of any one of the above methods when executing the computer program.

[0021] The present application also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any of the above-mentioned methods are implemented.

[0022] The AI-based network security situation dynamic defense decision-making method and system of the embodiment of the present application analyzes and identifies the dynamic characteristics of network traffic in real time, rather than relying on static predefined characteristics. This dynamic analysis method can adapt to the ever-changing user behavior and network environment, and improves the ability to respond to abnormal traffic. By extracting key features and applying advanced machine learning algorithms, it is possible to more accurately determine whether the traffic is abnormal, reducing the risk of false positives and false negatives. When abnormal traffic is detected, the interception strategy can be executed immediately to prevent the spread of the attack. Through the situation analysis model, not only can the current traffic anomaly be identified, but also the future traffic change trend can be predicted, so that defensive measures can be taken in advance to reduce the risk of being attacked. The system's defense strategy can be dynamically adjusted according to the real-time analysis results and predicted data to ensure that it can respond quickly and effectively when facing new attack patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] Figure 1 A flowchart of a method for dynamic defense decision-making of network security situation based on AI according to an embodiment of the present application;

[0024] Figure 2 A flowchart of a method for dynamic defense decision-making of network security situation based on AI according to an embodiment of the present application;

[0025] Figure 3 This is a schematic block diagram of the structure of an AI-based network security situation dynamic defense decision-making system according to an embodiment of the present application;

[0026] Figure 4 A schematic block diagram of the structure of a computer device according to an embodiment of the present application.

[0027] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0028] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0029] Reference Figure 1 In an embodiment of the present application, a method for dynamic defense decision-making of network security situation based on AI is provided, and the method comprises:

[0030] S1. Acquire network traffic data in real time and extract target features of the network traffic data;

[0031] S2. judging whether the target feature meets the condition of abnormal feature according to the extraction result;

[0032] S3. When the target feature meets the condition of abnormal feature, intercepting the network traffic data;

[0033] S4. When the target feature does not meet the condition of the abnormal feature, the network traffic data is input into a preset situation analysis model, and the change feature of the network traffic data is predicted by the situation analysis model;

[0034] S5. judging whether the network traffic data meets the defense conditions according to the prediction result;

[0035] S6. When the network traffic data meets the defense conditions, a defense strategy is executed based on the judgment result.

[0036] As described in steps S1-S2 above, network monitoring tools and traffic collection devices are used to capture all data packets passing through the network in real time. These data packets can be data of various protocols such as HTTP requests, DNS queries, FTP transmissions, etc. Real-time data acquisition can provide a basis for subsequent analysis and ensure that the defense system has a comprehensive understanding of the current network environment. If a large number of abnormal requests appear in the network (such as the same IP sending multiple requests in a short period of time), the system can respond quickly and intercept them. Extract key features from the captured data, such as traffic rate, number of connections, packet size, source IP address, destination IP address, protocol used, etc. Feature extraction usually involves feature selection and feature engineering to ensure that the selected features can effectively represent the normal behavior of network traffic. The extracted features help to quickly identify potential abnormal behavior and provide support for subsequent judgments. The extracted features can include the number of requests from a specific IP address within an hour. If the number of requests from the IP address is found to surge in a short period of time, the system can mark it as suspicious.

[0037] As described in the above steps S3-S4, the extracted target features are judged according to the predefined abnormal feature conditions (such as traffic rate exceeding the normal range, frequent connection attempts, etc.). This process usually involves threshold setting, using statistical methods (such as Z-score) or machine learning-based models to identify anomalies. By judging whether the abnormal conditions are met, network attacks can be responded to quickly to avoid potential losses. If a user initiates 100 login attempts in one minute, and under normal circumstances the user has a maximum of 10 attempts per minute, the system will consider this a brute force attack and take measures. Once it is confirmed that the traffic data meets the conditions of the abnormal features, the system will automatically execute the interception strategy (such as blocking suspicious IPs, restricting access to specific ports, etc.) to prevent the attack from spreading further. Real-time interception can effectively reduce the impact of attacks on the system and protect network resources from being abused. If the traffic of a certain IP address is identified as abnormal and meets the interception conditions, the system can directly block all access requests from the IP address, thereby preventing further intrusion by the attacker. When the target feature does not meet the abnormal feature conditions, the data is input into the situation analysis model. This model is usually trained based on a machine learning algorithm and can identify the subtle differences between normal and abnormal traffic. Through in-depth analysis of traffic, the model can predict traffic trends and help identify potential risks in advance. If the system detects that traffic has a small fluctuation in a specific period of time, the situation analysis model can combine historical data to predict the next possible traffic changes, so as to make defensive preparations in advance. The situation analysis model is used to perform time series analysis and trend forecasting on traffic data to predict the changing characteristics of traffic in the future. Accurate predictions can help the security team prepare for response and formulate defense strategies in advance. If the model predicts that traffic will increase sharply in the next few hours, the system can proactively increase resources or adjust firewall rules to deal with possible DDoS attacks.

[0038] As described in the above steps S5-S6, by analyzing the prediction results, it is determined whether the traffic data meets the set defense conditions (for example, the traffic is above a certain threshold, or a specific behavior pattern occurs). It can ensure the timeliness and effectiveness of defense measures and avoid taking unnecessary measures when the traffic is normal. If the traffic predicted by the model may exceed the normal threshold in the next period of time, the system will start the defense strategy in advance, such as limiting the access rate of certain IPs. According to the above judgment results, the corresponding defense strategy is automatically executed, such as adjusting firewall rules, enabling traffic restrictions, blocking suspicious connections, etc. Effectively reduce or eliminate potential security threats and protect network security. When the traffic is abnormal and meets the defense conditions, the system can limit the access frequency from specific IPs, or temporarily shut down certain services to ensure the stability and security of the overall system.

[0039] As mentioned above, by analyzing and identifying the dynamic characteristics of network traffic in real time, rather than relying on static predefined characteristics. This dynamic analysis method can adapt to the ever-changing user behavior and network environment, and improve the ability to respond to abnormal traffic. By extracting key features and applying advanced machine learning algorithms, it is possible to more accurately determine whether the traffic is abnormal, reducing the risk of false positives and false negatives. When abnormal traffic is detected, the interception strategy can be immediately executed to prevent the spread of the attack. Through the situation analysis model, not only can the current traffic anomaly be identified, but also the future traffic change trend can be predicted, so that defensive measures can be taken in advance to reduce the risk of being attacked. The system's defense strategy can be dynamically adjusted based on real-time analysis results and predicted data to ensure that it can respond quickly and effectively when facing new attack patterns.

[0040] Reference Figure 2 In one embodiment, the network traffic data is input into a preset situation analysis model, and the change characteristics of the network traffic data are predicted by the situation analysis model. The method includes:

[0041] S41, parsing the network traffic data to obtain behavior characteristics of the network traffic data, wherein the behavior characteristics include traffic size, access frequency, protocol type, and traffic source;

[0042] S42, obtaining historical normal behavior features, performing deviation value identification between the historical normal behavior features and the behavior features, and extracting identification results;

[0043] S43, based on time series analysis, performing model identification on the deviation value of the network traffic data, wherein the model identification includes periodicity, burstiness and stability of the deviation value;

[0044] S44, inputting the identified pattern result, deviation value and the network traffic data into the situation analysis model, and using the situation analysis model to predict the change characteristics of the network traffic data within a preset time to obtain a situation prediction result.

[0045] As described in the above steps, by monitoring network traffic, behavioral features are extracted, where traffic size: refers to the amount of data transmitted through the network in a specific time period, usually in bytes. Access frequency: the number of requests for a specific resource within a certain period of time. Protocol type: identifies the network protocol used (such as HTTP, FTP, etc.). Traffic source: the source address of the traffic, which is an IP address. Assume that a certain IP address initiates a large number of HTTP requests in a short period of time, and the traffic size is significantly higher than usual. This may indicate abnormal behavior, such as network attacks or crawler behavior. By analyzing these features, the basic status of network traffic can be fully understood. This process collects normal traffic feature data in the past and establishes a normal behavior baseline. By comparing the current traffic behavior with historical data, abnormal deviations are identified. If historical data shows that the access frequency of a certain IP in a specific time period is usually 10 times per minute, and the current access frequency suddenly increases to 100 times per minute, the system will mark this as a deviation value. By comparing with historical normal behavior features, potential abnormal traffic can be effectively identified, providing a basis for further analysis. Deviation values ​​are identified by calculating the deviation between historical normal behavior features and current behavior features. Common deviation identification methods include statistical methods such as standard deviation and z-score. The threshold is set to the mean of historical behavior plus or minus two standard deviations. If the current traffic characteristics exceed this range, it will be marked as abnormal. This process can quickly screen out possible attacks or abnormal behaviors, allowing the security team to focus on the parts that are most likely to threaten network security. Apply time series analysis methods (such as ARIMA model, seasonal decomposition, etc.) to the deviation values ​​to identify their change patterns and analyze their periodicity, burstiness and stability characteristics. Periodicity: Identify repeated patterns of traffic within a specific time interval (such as weekly peaks). Burstiness: Identify sudden surges or decreases in traffic, which are usually related to attack activities. Stability: Analyze whether the traffic remains at a certain stable level. If obvious periodic changes in traffic are found within a certain period of time, it may mean regular system maintenance or backup activities. Through time series analysis, the system can accurately identify the regular characteristics of traffic changes and provide a basis for predicting future traffic. The identified pattern results and deviation values ​​are input into the preset situation analysis model, which uses machine learning or deep learning algorithms to train based on existing data to perform trend prediction. If the model is trained based on past network traffic data, it can predict whether the traffic will exceed the normal range in a certain period of time in the future, or predict that a certain type of attack will occur. The ultimate goal of this step is to provide insights into future network traffic characteristics through prediction results, so that the network security team can deploy defensive measures in advance and reduce potential risks.

[0046] In one embodiment, before the step of executing the defense strategy based on the judgment result, the method includes:

[0047] Identify attack features of the network traffic data according to the prediction results;

[0048] Pre-formulate a layered defense strategy based on the attack characteristics;

[0049] When the network traffic data meets the defense conditions, the network traffic data is defended by the layered defense strategy.

[0050] As mentioned above, by analyzing network traffic data, characteristics related to known attack patterns or abnormal behaviors are identified. For example, a surge in traffic in a short period of time (such as a DDoS attack). For example, a certain IP address frequently accesses multiple ports or accesses non-public resources. Use non-standard or unexpected protocols for communication (such as UDP port scanning). Suppose a certain IP is monitored to send more than 1,000 requests in one minute, and normal traffic usually does not exceed 50 requests. This abnormal traffic feature can be regarded as a potential DDoS attack. By accurately identifying attack characteristics, the security system can quickly detect potential threats and provide a basis for subsequent defense strategy formulation. This process helps to respond to and mitigate the impact of attacks on the network in a timely manner. Based on the identified attack characteristics, a layered defense strategy is formulated. These strategies usually include multiple layers to achieve multiple protections: such as firewall settings, intrusion detection systems (IDS) and intrusion prevention systems (IPS) to block known attacks. It may include network segmentation: dividing the network into multiple areas to limit the movement of attackers in the network. Application layer protection: implementing security policies for specific applications (such as web applications), monitoring and filtering traffic. If the detected attack signature is a large number of requests from a specific IP, the defense strategy may include temporarily blocking the IP while increasing monitoring of the area. A layered defense strategy can provide stronger security and reduce the risk of single points of failure. For example, if the perimeter defense is breached, the internal network segmentation can still protect internal resources. In addition, layered defense can flexibly respond to different types of attacks and ensure multiple protections. When the network traffic data meets the preset defense conditions, the corresponding layered defense strategy is automatically executed. The steps of defense execution may include real-time monitoring and response: automatically monitoring network traffic and triggering preset defense strategies. Traffic limiting: limiting or isolating suspicious traffic to ensure normal operation of the network. Alerts and reports: while implementing defense measures, sending alert information to the administrator for further analysis and response. If the system detects that the number of requests from a certain IP address exceeds the preset threshold within a specified time, the firewall rule is immediately activated to temporarily block the access of the IP. Through automated defense execution, network security management can achieve rapid response and reduce the delay of manual intervention, thereby effectively mitigating the impact of attacks on the system. This rapid response capability is particularly important for responding to rapidly changing network threats.

[0051] In one embodiment, after the step of predicting the change characteristics of the network traffic data by the situation analysis model, the method further includes:

[0052] Real-time analysis of whether there is a delay in the output of the prediction results by the situation analysis model;

[0053] When there is a delay in the time when the situation analysis model outputs the prediction result, obtaining the propagation parameters of the network traffic data;

[0054] Analyzing the cause of the delay according to the propagation parameters and the delay time of the situation analysis model;

[0055] Generate a delay strategy based on the delay cause.

[0056] As mentioned above, timely response is key in network security. By analyzing the time delay of the model output in real time, the system can determine the validity of the prediction results. If there is a delay in the output, it may mean that the network environment or traffic status has changed, affecting the accuracy of the prediction. For example, during the peak period of network attacks, if the delay in the output of the prediction results increases significantly, it may indicate that the attack traffic is changing rapidly and the system needs to re-evaluate its security strategy. Timely identification of prediction delays can help the system quickly adjust the protection strategy and reduce potential risks. Ensure that decisions are based on the latest data rather than outdated prediction results. When a delay is detected, the system actively obtains the propagation parameters of the network traffic, such as traffic rate, delay time, packet loss rate, etc. These parameters are crucial for analyzing traffic changes and potential problems. Assuming that a network traffic suddenly increases during the peak period, by obtaining the propagation parameters, the system can find the sharp increase in traffic rate and the increase in delay, which may indicate a DDoS attack. Understanding the propagation parameters can help identify the root cause of the problem. Provide the necessary background information for in-depth analysis of the cause of the delay. Combining the propagation parameters with the delay time, the system analyzes the root cause of the delay. For example, if the traffic rate increases and the delay time is long, it may indicate network congestion or malicious attacks. If it is found that the network traffic suddenly increases at a certain node and the delay time is consistent with this, then the system can reasonably infer that the node may be under attack or bottlenecked. It can more clearly identify whether the delay is caused by network congestion, malicious attacks, or other reasons, or the current network traffic data is new traffic data, which will also cause delays. Provide a basis for formulating targeted defense strategies. Once the cause of the delay is determined, the system will generate a corresponding delay strategy based on the analysis results. These strategies may include current limiting, priority scheduling, or blocking specific traffic. If it is determined that the delay is caused by abnormal traffic from a specific IP address, the system can generate a strategy to limit the request frequency of the IP, thereby alleviating the impact on the network. According to different delay causes, the system can take targeted measures to improve the security and stability of the network. Through effective delay strategies, normal users' access is ensured to be unaffected, thereby improving the overall user experience.

[0057] In one embodiment, the method of generating a delay strategy based on the delay cause includes:

[0058] When the delay reason is that the network traffic data is traffic data accessed for the first time;

[0059] Limiting the propagation speed of the network traffic data, and inputting the behavior characteristics of the network traffic data into a preset traffic modeler in real time, and simulating the change characteristics of the network traffic data through the traffic simulator;

[0060] Determining whether the network traffic data meets the defense conditions according to the simulated change characteristics;

[0061] When the network traffic data meets the defense conditions, the defense strategy is executed.

[0062] As mentioned above, when the system detects that network traffic data is accessed for the first time, limiting its propagation speed is to prevent potential malicious activities (such as DDoS attacks or crawler behavior). First-time access traffic is usually unstable and may represent unknown traffic patterns, which will cause delays in the prediction model when analyzing and predicting. Assuming a new user visits the website, the system will observe the user's traffic characteristics. If the user sends a large number of requests in a short period of time, the system will automatically limit its request rate to prevent it from affecting the experience of other normal users. By limiting the first-time access traffic, resource overload can be effectively avoided. The success rate of potential attacks is reduced, thereby enhancing the security of the network. Inputting the behavioral characteristics of network traffic data into the preset traffic modeler in real time can help the system establish a deep understanding of the current traffic. The traffic modeler will learn and adjust based on historical data and real-time traffic characteristics. In real-time monitoring, if the traffic modeler identifies an abnormal traffic pattern from a certain IP address (such as an abnormal increase in request frequency), it can be marked and processed immediately. Real-time input of feature data allows the system to adapt to traffic changes more quickly and improve protection effects. Through real-time analysis by the modeler, abnormal traffic can be discovered and responded to in a timely manner. Traffic simulators use input real-time data to simulate and predict the changing characteristics of network traffic. This can help the system understand how traffic behaves in different situations so that it can make better defense decisions. If the simulation results show that a certain traffic pattern may cause network congestion, the system can take measures in advance (such as flow control or scheduling) to avoid potential problems. By predicting traffic changes, the system can proactively prevent problems instead of responding passively. Rationally allocate network resources based on simulation results to improve overall performance. Based on the changing characteristics of traffic simulation, the system will determine whether the current traffic data meets the preset defense conditions. Defense conditions may be based on multiple factors such as traffic rate, request frequency, source IP, etc. If the simulation shows that the traffic rate exceeds the set threshold and the behavior characteristics of the traffic are similar to known attack patterns, the system will consider that the traffic needs to be defended. Ensure that only traffic that is a real threat is defended to avoid accidental harm to normal users. Effectively identify and respond to malicious traffic, thereby enhancing the overall security of the network. Once it is determined that the traffic meets the defense conditions, the system will execute the corresponding defense strategy, which may include flow control, blocking IP, adjusting traffic routing, etc. If the traffic of an IP is determined to be malicious, the system can immediately blacklist the IP address to prevent it from continuing to send requests. It can respond to and handle security threats in the shortest possible time to ensure network security. It can also protect the access experience of normal users through effective defense measures.

[0063] In one embodiment, the method further comprises:

[0064] Obtaining historical behavior characteristics of the network traffic data;

[0065] Combine current behavior characteristics with historical behavior characteristics to identify the changing trend of current behavior characteristics;

[0066] Determine whether the change trend is within a preset change range;

[0067] When the change trend is not within a preset change range, verifying user information of the network traffic data;

[0068] Determining whether the user information is consistent with historical user information;

[0069] If the user information is inconsistent with the historical user information, it is determined that the network traffic data is abnormal;

[0070] Based on the result of the judgment, the network traffic data is intercepted.

[0071] As mentioned above, the system collects and stores historical data on network traffic, including each user's traffic pattern, access time, common services, packet size, etc. These data are used to extract features such as average traffic, access frequency, peak traffic, etc. through statistical analysis, data mining and other technologies. By understanding the historical behavior characteristics, that is, this network traffic data is not the traffic data of the first access, the system can establish a "normal" behavior baseline for the user, providing a basis for subsequent anomaly detection. If a user usually accesses between 9:00 and 17:00 on weekdays, the system can set a normal behavior model. If a large amount of data transmission suddenly occurs late at night, the system will be able to quickly identify this anomaly. The system monitors the current network traffic in real time and compares its characteristics with historical characteristics. By calculating the difference, the trend of changes in traffic patterns (such as a sharp increase or decrease in traffic) is identified. Identifying the trend of changes helps to quickly capture potential attacks or abnormal activities. If a user's traffic per hour is about 100MB under normal circumstances, and the current hourly traffic suddenly reaches 1GB, the system can quickly identify this significant increase and trigger an alarm. The system sets a preset range of changes to define what is a "normal" fluctuation. For example, traffic can fluctuate within a range of ±20%. If it exceeds this range, it is considered an anomaly. Ensure that only true anomalies are marked as alarms to avoid false alarms. Suppose a user's normal traffic fluctuation range is set to 500MB±100MB. If the traffic reaches 700MB at a certain moment, the system will determine that this change exceeds the preset range and conduct further verification. If an abnormal change is detected, the system will check the user information of the traffic data, such as IP address, login method, geographic location, etc., to confirm the validity of the user's identity. By verifying user information, false alarms can be reduced and security can be improved. If a user's traffic suddenly appears in an unusual location (such as abroad), the system will require verification of the user's identity to prevent abnormal activities of the stolen account. The system will compare the current user information with the historical records to check the validity and consistency of the login information. If there is inconsistency, subsequent security measures will be triggered. Ensure that the user's identity is not forged and increase the system's sensitivity to abnormal traffic. If a user has logged in in China in the past, and suddenly there is a login attempt from another country, the system will regard it as a potential risk and mark it as an anomaly. If the user information is found to be inconsistent, the system will determine whether the traffic data is abnormal based on the preset anomaly definition. If the anomaly is confirmed, security measures will be triggered. This step is key to anomaly detection and helps identify potential attacks or unauthorized access. If the login information of an account is shown to be from a new geographical location and the traffic volume increases abnormally, the system will mark the traffic as suspicious and may intercept or further inspect it. Once the traffic is determined to be abnormal, the system will take measures to intercept the traffic to prevent it from posing a potential threat to the network.This may include blocking IP addresses, suspending user accounts, etc. By timely intercepting abnormal traffic, the system can protect network resources and prevent data leakage or service interruption. If a large amount of traffic from a suspicious user is detected, the system can immediately block access to the IP address, reduce the impact on other users, and ensure the security of the overall network.

[0072] In one embodiment, the layered defense strategy is one or more of a network layer interception strategy, a transport layer interception strategy, or an application layer interception strategy. The network layer interception strategy mainly relies on firewalls and routers to identify and block suspicious traffic by analyzing and filtering IP data packets. For example, network devices can set rules to prevent specific traffic from entering or leaving the network based on information such as source IP address, target IP address, port number, etc. If a certain IP address frequently sends a large number of data packets, the firewall can set rules to automatically intercept traffic from the IP to prevent DDoS attacks. The transport layer interception strategy focuses on TCP and UDP protocols and analyzes the status of connection requests and data packets. By detecting abnormal connection establishment requests (such as SYNFlood attacks), measures can be taken to limit or intercept these connections. When the system detects a large number of SYN requests in a short period of time, additional connection requests can be rejected through the TCP connection restriction strategy, thereby reducing the risk of being attacked. It can effectively prevent service unavailability caused by abnormal behavior of the transport layer and ensure the availability of network services. By analyzing traffic patterns, the rules of the transport layer can be adjusted to optimize network performance. Application layer interception strategies directly target specific application protocols (such as HTTP, FTP, etc.), analyze data packet contents through deep packet inspection (DPI), identify and block malicious requests or data leaks. For example, a Web Application Firewall (WAF) can identify attack patterns such as SQL injection and cross-site scripting, and intercept these requests. If a request contains suspicious SQL statements, WAF can identify the pattern and reject the request to prevent the database from being attacked.

[0073] The AI-based network security situation dynamic defense decision-making method of this application analyzes and identifies the dynamic characteristics of network traffic in real time instead of relying on static predefined characteristics. This dynamic analysis method can adapt to the ever-changing user behavior and network environment, and improves the responsiveness to abnormal traffic. By extracting key features and applying advanced machine learning algorithms, it is possible to more accurately determine whether the traffic is abnormal, reducing the risk of false positives and false negatives. When abnormal traffic is detected, the interception strategy can be executed immediately to prevent the spread of the attack. Through the situation analysis model, not only can the current traffic anomalies be identified, but also the future traffic change trends can be predicted, so that defensive measures can be taken in advance to reduce the risk of being attacked. The system's defense strategy can be dynamically adjusted according to real-time analysis results and predicted data to ensure that it can respond quickly and effectively when facing new attack patterns.

[0074] Reference Figure 3 In an embodiment of the present application, a network security situation dynamic defense decision system based on AI is also provided, including:

[0075] Acquisition module 1, used to acquire network flow data in real time and extract target features of the network flow data;

[0076] A first judgment module 2, used to judge whether the target feature meets the condition of abnormal feature according to the extraction result;

[0077] An interception module 3, used for intercepting the network traffic data when the target feature meets the condition of abnormal feature;

[0078] Prediction module 4, used for inputting the network traffic data into a preset situation analysis model when the target feature does not meet the condition of abnormal feature, and predicting the change feature of the network traffic data through the situation analysis model;

[0079] A second judgment module 5 is used to judge whether the network traffic data meets the defense conditions according to the prediction result;

[0080] The defense module 6 is used to execute the defense strategy based on the judgment result when the network traffic data meets the defense conditions.

[0081] As described above, it can be understood that the various components of the AI-based network security situation dynamic defense decision-making system proposed in this application can realize the functions of any one of the AI-based network security situation dynamic defense decision-making methods described above, and the specific structure will not be repeated.

[0082] Reference Figure 4 In an embodiment of the present application, a computer device is also provided. The computer device may be a server, and its internal structure may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, a network interface and a database connected through a system bus. Among them, the processor designed by the computer is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as monitoring data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a dynamic defense decision-making method for network security situation based on AI is implemented.

[0083] The above-mentioned processor executes the above-mentioned AI-based network security situation dynamic defense decision-making method, including: acquiring network traffic data in real time, and extracting target features of the network traffic data; judging whether the target features meet the conditions of abnormal features based on the extraction results; when the target features meet the conditions of abnormal features, intercepting the network traffic data; when the target features do not meet the conditions of abnormal features, inputting the network traffic data into a preset situation analysis model, and predicting the change characteristics of the network traffic data through the situation analysis model; judging whether the network traffic data meets the defense conditions based on the prediction results; when the network traffic data meets the defense conditions, executing the defense strategy based on the judgment results.

[0084] The above-mentioned AI-based network security situation dynamic defense decision-making method analyzes and identifies the dynamic characteristics of network traffic in real time instead of relying on static predefined characteristics. This dynamic analysis method can adapt to the ever-changing user behavior and network environment, and improves the ability to respond to abnormal traffic. By extracting key features and applying advanced machine learning algorithms, it is possible to more accurately determine whether the traffic is abnormal, reducing the risk of false positives and false negatives. When abnormal traffic is detected, the interception strategy can be immediately executed to prevent the spread of the attack. Through the situation analysis model, not only can the current traffic anomaly be identified, but also the future traffic change trend can be predicted, so that defensive measures can be taken in advance to reduce the risk of being attacked. The system's defense strategy can be dynamically adjusted based on real-time analysis results and predicted data to ensure that it can respond quickly and effectively when facing new attack patterns.

[0085] An embodiment of the present application also provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, an AI-based network security situation dynamic defense decision-making method is implemented, including the following steps: acquiring network traffic data in real time, and extracting target features of the network traffic data; judging whether the target features meet the conditions of abnormal features based on the extraction results; intercepting the network traffic data when the target features meet the conditions of abnormal features; inputting the network traffic data into a preset situation analysis model when the target features do not meet the conditions of abnormal features, and predicting the change characteristics of the network traffic data through the situation analysis model; judging whether the network traffic data meets the defense conditions based on the prediction results; and executing a defense strategy based on the judgment results when the network traffic data meets the defense conditions.

[0086] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0087] It should be noted that, in this article, the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, device, article or method including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, device, article or method. In the absence of further restrictions, an element defined by the sentence "includes a ..." does not exclude the existence of other identical elements in the process, device, article or method including the element.

[0088] The above description is only a preferred embodiment of the present application, and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A dynamic defense decision-making method for network security situation based on AI, characterized in that: The method comprises: Acquire network traffic data in real time and extract target features of the network traffic data; According to the extracted result, determining whether the target feature meets the condition of abnormal feature; When the target feature meets the condition of abnormal feature, intercepting the network traffic data is executed; When the target feature does not meet the condition of the abnormal feature, the network traffic data is input into a preset situation analysis model, and the change feature of the network traffic data is predicted by the situation analysis model; Determining whether the network traffic data meets the defense conditions according to the prediction result; When the network traffic data meets the defense conditions, the defense strategy is executed based on the judgment result.

2. The AI-based network security situation dynamic defense decision-making method according to claim 1 is characterized in that: The method of inputting the network traffic data into a preset situation analysis model and predicting the change characteristics of the network traffic data by using the situation analysis model comprises: Parsing the network traffic data to obtain behavior characteristics of the network traffic data, wherein the behavior characteristics include traffic size, access frequency, protocol type, and traffic source; Acquire historical normal behavior features, perform deviation value identification between the historical normal behavior features and the behavior features, and extract identification results; Based on time series analysis, model identification is performed on the deviation value of the network traffic data, wherein the model identification includes periodicity, burstiness and stability of the deviation value; The identified pattern result and the deviation value of the network traffic data are input into the situation analysis model, and the change characteristics of the network traffic data within a preset time are predicted by the situation analysis model to obtain the situation prediction result.

3. The AI-based network security situation dynamic defense decision-making method according to claim 2 is characterized in that: Before the step of executing the defense strategy based on the judgment result, the method includes: Identify attack features of the network traffic data according to the prediction results; Pre-formulate a layered defense strategy based on the attack characteristics; When the network traffic data meets the defense conditions, the network traffic data is defended by the layered defense strategy.

4. The AI-based network security situation dynamic defense decision-making method according to claim 2 is characterized in that: After the step of predicting the change characteristics of the network traffic data by the situation analysis model, the method further includes: Real-time analysis of whether there is a delay in the output of the prediction results by the situation analysis model; When there is a delay in the time when the situation analysis model outputs the prediction result, obtaining the propagation parameters of the network traffic data; Analyzing the cause of the delay according to the propagation parameters and the delay time of the situation analysis model; Generate a delay strategy based on the delay cause.

5. The AI-based network security situation dynamic defense decision-making method according to claim 4 is characterized in that: The method of generating a delay strategy based on the delay cause comprises: When the delay reason is that the network traffic data is traffic data accessed for the first time; Limiting the propagation speed of the network traffic data, and inputting the behavior characteristics of the network traffic data into a preset traffic modeler in real time, and simulating the change characteristics of the network traffic data through the traffic simulator; Determining whether the network traffic data meets the defense conditions according to the simulated change characteristics; When the network traffic data meets the defense conditions, the defense strategy is executed.

6. The AI-based network security situation dynamic defense decision-making method according to claim 1 is characterized in that: The method further comprises: Obtaining historical behavior characteristics of the network traffic data; Combine current behavior characteristics with historical behavior characteristics to identify the changing trend of current behavior characteristics; Determine whether the change trend is within a preset change range; When the change trend is not within a preset change range, verifying user information of the network traffic data; Determining whether the user information is consistent with historical user information; If the user information is inconsistent with the historical user information, it is determined that the network traffic data is abnormal; Based on the result of the judgment, the network traffic data is intercepted.

7. The AI-based network security situation dynamic defense decision-making method according to claim 3 is characterized in that: The layered defense strategy is one or more of a network layer interception strategy, a transport layer interception strategy, or an application layer interception strategy.

8. An AI-based network security situation dynamic defense decision-making system, characterized in that: include: An acquisition module, used to acquire network flow data in real time and extract target features of the network flow data; A first judgment module, used to judge whether the target feature meets the condition of abnormal feature according to the extraction result; An interception module, used for intercepting the network traffic data when the target feature meets the condition of abnormal feature; A prediction module, used for inputting the network traffic data into a preset situation analysis model when the target feature does not meet the condition of the abnormal feature, and predicting the change characteristics of the network traffic data through the situation analysis model; A second judgment module is used to judge whether the network traffic data meets the defense conditions according to the prediction result; The defense module is used to execute the defense strategy based on the judgment result when the network traffic data meets the defense conditions.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images