Intelligent scanning method and system for network security vulnerabilities based on artificial intelligence technology
Through the intelligent scanning method of network security vulnerability based on artificial intelligence, using deep learning models and continuous learning mechanisms, the problem of poor coverage and accuracy of traditional vulnerability scanning tools is solved, and more efficient vulnerability identification and APT response capabilities are achieved.
Patent Information
- Application Number
- CN202411574395.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-06
- Publication Date
- 2025-02-11
AI Technical Summary
Traditional vulnerability scanning tools have poor coverage and accuracy during vulnerability scanning and are difficult to effectively deal with advanced persistent threats (APTs).
Adopt the intelligent scanning method of network security vulnerabilities based on artificial intelligence technology. By obtaining historical vulnerability data and security logs, extracting vulnerability features as samples, conducting deep learning model training, designing continuous learning mechanisms, updating threat databases and defense strategies in real time, and improving vulnerability scanning coverage and accuracy, and effectively respond to APT.
It significantly improves the accuracy of vulnerability scanning, reduces false alarms and missed reports, can better respond to advanced persistent threats, and provides more comprehensive and efficient network security protection.
Smart Images
Figure CN119420555A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network security vulnerability intelligent scanning method and system based on artificial intelligence technology. Background Art
[0002] Network security vulnerability scanning is a critical process for identifying and fixing potential security threats in network systems. With the advancement of technology and the increase in digitalization, the operations of enterprises and organizations are increasingly dependent on the Internet and network systems. This makes network security an important part of ensuring data integrity, protecting privacy, and maintaining business continuity. Effective vulnerability scanning can not only prevent data leaks and service interruptions, but also reduce economic losses and reputation damage caused by security incidents.
[0003] Although existing vulnerability scanning technologies provide a certain degree of security, they still have problems with insufficient coverage and accuracy, as well as poor ability to deal with advanced persistent threats (APTs).
[0004] Coverage and accuracy issues:
[0005] Traditional vulnerability scanning tools: Many traditional vulnerability scanning tools rely on signature databases of known vulnerabilities. This approach often does not work well for new or unknown vulnerabilities because they cannot identify new vulnerabilities that do not have previous signatures.
[0006] Rule-based scanning systems: Systems that rely on fixed rules or patterns are prone to miss atypical vulnerability manifestations, such as complex buffer overflows or SQL injection attacks, leading to false positives and false negatives.
[0007] Shortcomings of dealing with APT:
[0008] Static analysis tools: Although static analysis tools can find vulnerabilities without executing code, they often lack sufficient response capabilities when facing APT attacks that require feedback from the execution environment. Such attacks usually appear to be normal operations and only trigger malicious behavior under certain conditions.
[0009] Signature-based intrusion detection systems: These systems are usually not sensitive enough to abnormal patterns in user behavior and network traffic, and have difficulty identifying subtle abnormal behaviors caused by APTs.
[0010] In view of the shortcomings of the existing technology, the present invention proposes a network security vulnerability intelligent scanning method and system based on artificial intelligence technology. The system uses deep learning and machine learning models to not only improve the coverage and accuracy of vulnerability scanning, but also effectively identify and respond to advanced persistent threats. By integrating multi-model collaboration, behavior analysis, anomaly detection and adaptive defense mechanisms, the system can update the threat database in real time and automatically adjust the defense strategy, thereby providing more comprehensive and efficient security protection for the network environment. Summary of the invention
[0011] In view of the above-mentioned problems, the present invention is proposed.
[0012] Therefore, the problem to be solved by the present invention is that traditional vulnerability scanning tools have poor coverage and accuracy when scanning vulnerabilities, and are insufficient in dealing with APT attacks.
[0013] To solve the above technical problems, the present invention provides the following technical solutions: an intelligent scanning method for network security vulnerabilities based on artificial intelligence technology, which includes obtaining historical vulnerability data and security logs, and extracting vulnerability features therein as samples; performing model training based on the samples to obtain a vulnerability scanning model, and designing a continuous learning mechanism to ensure continuous updating of the vulnerability scanning model; using the vulnerability scanning model to perform behavioral analysis on the system to be scanned to obtain all potential vulnerabilities of the system; filling the potential vulnerabilities, and attacking the system based on simulated attack scenarios of the potential vulnerabilities to determine whether effective filling has been achieved.
[0014] As a preferred solution of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in the present invention, wherein: the extraction of vulnerability features as samples includes extracting abnormal code paths and memory access pattern feature vectors in historical vulnerability data and security logs using a feature extraction formula, and taking the feature vectors as samples. The feature extraction formula is expressed as:
[0015]
[0016] Among them, F(x) represents the feature vector, x represents the input data set, N represents the total amount of data in the data set, and x i represents the i-th data in the data set, μ represents the mean of x, and σ represents the standard deviation of x. Expressed as entropy calculation function, It is represented as an anomaly detection function based on graph theory; the entropy calculation function The formula used to represent the information complexity of a sample is:
[0017]
[0018] Among them, K represents the number of all possible categories, that is, x i The total number of different code paths or memory access patterns that may belong to, p k Represented as data point x i The probability of appearing in the k-th type of pattern; the anomaly detection function based on graph theory Used to represent x i The degree of abnormality in the code structure or memory access pattern is expressed as,
[0019]
[0020] Among them, T(x i ) is represented by the data point x i The number of triangles formed with its neighboring data points, d(x i ) is represented by the data point x i The degree of x i The number of directly connected data points.
[0021] As a preferred solution of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in the present invention, wherein: the vulnerability scanning model obtained by model training based on samples includes taking the obtained feature vector as a sample, and training the model with the sample based on the deep learning model to obtain the vulnerability scanning model represented as:
[0022]
[0023] Among them, P represents the probability of vulnerability, σ represents the Sigmoid activation function, which is used in the output layer to map the result to the interval [0, 1], J represents the total number of neurons in the hidden layer, and w j is the weight connecting the jth hidden layer neuron and the output neuron, I is the total number of input features, and v ij Represented as the concatenated input feature F i (x) and the weight of the jth hidden neuron, F i (x) is represented as the i-th feature extracted from the feature vector F(x), b j is represented as the bias term of the jth hidden layer neuron, and c is represented as the bias term of the output layer.
[0024] As a preferred solution of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in the present invention, wherein: the continuous learning mechanism includes that after the vulnerability scanning model is built, the system continuously collects new data samples from network traffic, system logs and user feedback; adopts an online learning algorithm to adjust the model parameters in real time to adapt to new data samples; the system continuously monitors the performance of the model including the accuracy and recall rate of the vulnerability scanning model, and when the model performance does not meet the preset requirements, the system retrains the model; the adjustment of the model parameters includes updating the vulnerability scanning model parameters in real time based on the online gradient descent method, and the formula is expressed as follows:
[0025]
[0026] Among them, θ t+1 Represented as the model parameter at time t+1, θ t Represented as the model parameter at time t, η t Expressed as the learning rate at time t, Expressed as the loss function l with respect to the parameter θ t In the new data sample (x t ,y t ), the gradient on x t Represented as the feature vector of the latest data point received at time t, y t Represented as x t The corresponding true value; the retraining includes starting the retraining mechanism when the model performance does not meet the preset requirements, and the formula is expressed as:
[0027]
[0028] Among them, θ new is represented as the new model parameter, θ is represented as the parameter of the original vulnerability scanning model, argmin θ It is expressed as a mathematical operation to find the value of θ that minimizes the expression in brackets. n is the window size, which specifies the number of data points considered during the retraining process. l(θ,x m ,y m ) is expressed as a loss function, which is used to evaluate the model prediction x under the parameter θ. m The output and the true label y m The error between them, λ is represented as the regularization parameter, ‖θ‖ 2 Expressed as the square of the L2 norm of θ.
[0029] As a preferred solution of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in the present invention, wherein: the behavioral analysis includes static analysis and dynamic analysis; the static analysis is to scan the program using a vulnerability scanning model without executing the program to obtain potential vulnerabilities; the dynamic analysis is to scan the program using a vulnerability scanning model when executing the program to obtain potential vulnerabilities.
[0030] As a preferred solution of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in the present invention, the simulated attack scenario includes, based on the scanned potential vulnerabilities, formulating attack strategies for the potential vulnerabilities to attack the system.
[0031] As a preferred solution of the intelligent scanning method for network security vulnerabilities based on artificial intelligence technology described in the present invention, the judgment of whether effective filling is achieved includes, after simulating attacks using different attack strategies, judging whether the system is successfully defended. If successful, it indicates that the vulnerability filling is effective. If failed, it indicates that the vulnerability filling is invalid and it is necessary to re-formulate the filling strategy until the defense is successful.
[0032] Another object of the present invention is to provide a network security vulnerability intelligent scanning system based on artificial intelligence technology, which can scan the system to obtain potential vulnerabilities and provide feedback to fill the vulnerabilities.
[0033] To solve the above technical problems, the present invention provides the following technical solutions: a system for an intelligent scanning method for network security vulnerabilities based on artificial intelligence technology, comprising: a sample collection module, a model construction module, a scanning module and a repair and feedback module; the sample collection module obtains historical vulnerability data and security logs, and extracts vulnerability features therein as samples; the model construction module performs model training based on the samples to obtain a vulnerability scanning model, and designs a continuous learning mechanism to ensure continuous updating of the vulnerability scanning model; the scanning module uses the vulnerability scanning model to perform behavioral analysis on the system to be scanned to obtain all potential vulnerabilities of the system; the repair and feedback module fills the potential vulnerabilities, and attacks the system based on simulated attack scenarios of the potential vulnerabilities to determine whether effective filling is achieved.
[0034] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned network security vulnerability intelligent scanning method based on artificial intelligence technology are implemented.
[0035] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned network security vulnerability intelligent scanning method based on artificial intelligence technology.
[0036] The beneficial effects of the present invention are as follows: the deep learning model trained by the present invention using historical vulnerability data and security event logs can identify complex vulnerability patterns and attack vectors, significantly improve the accuracy of vulnerability scanning and reduce false positives and negatives.
[0037] Through the online learning mechanism, the model of the present invention can be updated and adapted to new data and threat environments in real time, maintaining the timeliness and accuracy of vulnerability identification capabilities, better responding to advanced persistent threats (APTs), and continuously monitoring model performance. When necessary, retraining is performed to respond to new vulnerabilities and complex attack patterns.
[0038] The present invention uses AI to generate simulated attack scenarios based on potential vulnerabilities. The system can continuously test and evaluate the effectiveness of security measures and optimize defense strategies based on feedback. BRIEF DESCRIPTION OF THE DRAWINGS
[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work. Among them:
[0040] Figure 1 This is a flow chart of the intelligent scanning method for network security vulnerabilities based on artificial intelligence technology in Example 1.
[0041] Figure 2 This is a module structure diagram of the network security vulnerability intelligent scanning system based on artificial intelligence technology in Example 3. DETAILED DESCRIPTION
[0042] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.
[0043] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.
[0044] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and which provides a network security vulnerability intelligent scanning method based on artificial intelligence technology, including: Figure 1 As shown:
[0045] Step 1: Obtain historical vulnerability data and security logs, and extract vulnerability features as samples.
[0046] Using the feature extraction formula, we extract the feature vectors of abnormal code paths and memory access patterns in historical vulnerability data and security logs, and use the feature vectors as samples. The feature extraction formula is expressed as:
[0047]
[0048] Among them, F(x) represents the feature vector, x represents the input data set, N represents the total amount of data in the data set, and x i represents the i-th data in the data set, μ represents the mean of x, and σ represents the standard deviation of x. Expressed as entropy calculation function, Represented as an anomaly detection function based on graph theory.
[0049] Entropy calculation function The formula used to represent the information complexity of a sample is:
[0050]
[0051] Among them, K represents the number of all possible categories, that is, x i The total number of different code paths or memory access patterns that may belong to, p k Represented as data point x i The probability of appearing in the k-th category pattern.
[0052] Anomaly detection function based on graph theory Used to represent x i The degree of abnormality in the code structure or memory access pattern is expressed as,
[0053]
[0054] Among them, T(x i ) is represented by the data point x i The number of triangles formed with its neighboring data points, d(x i ) is represented by the data point x i The degree of x i The number of directly connected data points.
[0055] Step 2: Perform model training based on samples to obtain a vulnerability scanning model, and design a continuous learning mechanism to ensure continuous updating of the vulnerability scanning model.
[0056] The obtained feature vector is used as a sample. Based on the deep learning model, the model is trained with the sample to obtain the vulnerability scanning model represented as:
[0057]
[0058] Among them, P represents the probability of vulnerability, σ represents the Sigmoid activation function, which is used in the output layer to map the result to the interval [0, 1], J represents the total number of neurons in the hidden layer, and w j is represented by the weight connecting the jth hidden layer neuron and the output neuron, I is represented by the total number of input features, and v ij Represented as the concatenated input feature F i (x) and the weight of the jth hidden neuron, F i (x) is represented as the i-th feature extracted from the feature vector F(x), b j is represented as the bias term of the jth hidden layer neuron, and c is represented as the bias term of the output layer.
[0059] After the vulnerability scanning model is built, the system continuously collects new data samples from network traffic, system logs and user feedback.
[0060] Using online learning algorithms, model parameters are adjusted in real time to adapt to new data samples.
[0061] The system continuously monitors the performance of the model, including the accuracy and recall rate of the vulnerability scanning model. When the model performance does not meet the preset requirements, the system retrains the model.
[0062] Adjusting the model parameters includes updating the vulnerability scanning model parameters in real time based on the online gradient descent method. The formula is expressed as:
[0063]
[0064] Among them, θ t+1 Represented as the model parameter at time t+1, θ t Represented as the model parameter at time t, η t Expressed as the learning rate at time t, Expressed as the loss function l with respect to the parameter θ t In the new data sample (x t ,y t ), the gradient on x t Represented as the feature vector of the latest data point received at time t, y t Represented as x t The corresponding true value.
[0065] Retraining includes starting the retraining mechanism when the model performance does not meet the preset requirements. The formula is:
[0066]
[0067] Among them, θ new is represented as the new model parameter, θ is represented as the parameter of the original vulnerability scanning model, argmin θIt is expressed as a mathematical operation to find the value of θ that minimizes the expression in brackets. n is the window size, which specifies the number of data points considered during the retraining process. l(θ,x m ,y m ) is expressed as a loss function, which is used to evaluate the model prediction x under the parameter θ. m The output and the true label y m The error between them, λ is represented as a regularization parameter used to control model complexity and prevent overfitting. Its value determines the influence of the regularization term, ‖θ‖ 2 Expressed as the square of the L2 norm of θ, it is used as a regular term to penalize excessively large weight values, which helps the generalization of the model.
[0068] Step 3: Use the vulnerability scanning model to perform behavioral analysis on the system to be scanned to obtain all potential vulnerabilities of the system.
[0069] Behavioral analysis includes static analysis and dynamic analysis. Static analysis is to scan the program using a vulnerability scanning model without executing the program to obtain potential vulnerabilities.
[0070] Dynamic analysis is to use the vulnerability scanning model to scan the program when the program is executed to obtain potential vulnerabilities.
[0071] Step 4: Fill potential vulnerabilities and simulate attack scenarios based on potential vulnerabilities to attack the system to determine whether effective filling has been achieved.
[0072] Based on the potential vulnerabilities scanned, formulate attack strategies targeting the potential vulnerabilities to attack the system.
[0073] After using different attack strategies to simulate attacks, determine whether the system is successfully defended. If successful, it means that the vulnerability filling is effective. If failed, it means that the vulnerability filling is ineffective and a new filling strategy needs to be formulated until the defense is successful. Combined with attack data and simulation results, the scanning model and defense strategy are continuously optimized.
[0074] Embodiment 2 is the second embodiment of the present invention, which is different from the first embodiment in that: the network security vulnerability intelligent scanning method based on artificial intelligence technology also includes: in order to verify and illustrate the technical effects adopted in this method, this embodiment adopts the traditional technical scheme and the method of the present invention for comparative testing, and compares the test results by means of scientific argumentation to verify the real effect of this method.
[0075] 1. Experimental objectives
[0076] Verify the advantages of the present invention over the prior art in terms of vulnerability identification accuracy, false alarm rate, missed alarm rate, and response time.
[0077] 2. Experimental Methods
[0078] Dataset selection: Select public cybersecurity vulnerability datasets, such as CVE details, vulnerability exploit databases, and various real-world security logs.
[0079] Model training: Use the same data set to train the AI model proposed in this invention and several existing network security scanning tools. (Prior art solution A: Scanning mode that relies on a signature database of known vulnerabilities. Prior art solution B: System that relies on fixed rules or patterns. Prior art solution C: Static analysis tool.)
[0080] Test environment: Run these systems in the same network environment and configuration, and collect their responses to the same set of test data.
[0081] 3. Comparative indicators
[0082] Accuracy, False Positive Rate (FPR), False Negative Rate (FNR), Response Time, and System Adaptability.
[0083] 4. Data display: Compare the performance of the method of the present invention with other existing technical solutions in the above indicators. The obtained experimental data are shown in Table 1.
[0084] Table 1: Experimental data comparison table
[0085]
[0086]
[0087] Accuracy: By integrating deep learning and machine learning, the method of the present invention can more accurately identify complex vulnerability patterns, thus showing higher accuracy than existing technologies.
[0088] False alarm rate and missed alarm rate: By using continuous learning mechanism and advanced behavior analysis, the method of the present invention reduces false alarms and missed alarms and improves the reliability of security defense.
[0089] Response time: The method of the present invention improves response efficiency and reduces processing time by optimizing algorithms and data processing procedures.
[0090] System adaptability: Due to the characteristics of online learning and real-time model updating, the method of the present invention can quickly adapt to new threat environments and data changes, showing higher system adaptability.
[0091] Example 3, reference Figure 2, which is the third embodiment of the present invention, and is different from the previous two embodiments in that: a system of a network security vulnerability intelligent scanning method based on artificial intelligence technology, including a sample collection module, a model construction module, a scanning module and a repair and feedback module; the sample collection module obtains historical vulnerability data and security logs, and extracts vulnerability features therein as samples; the model construction module performs model training based on the samples to obtain a vulnerability scanning model, and designs a continuous learning mechanism to ensure continuous updating of the vulnerability scanning model; the scanning module uses the vulnerability scanning model to perform behavioral analysis on the system to be scanned to obtain all potential vulnerabilities of the system; the repair and feedback module fills the potential vulnerabilities, and attacks the system based on the potential vulnerabilities simulating attack scenarios to determine whether effective filling is achieved.
[0092] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.
[0093] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.
[0094] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.
[0095] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.
[0096] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.
Claims
1. A network security vulnerability intelligent scanning method based on artificial intelligence technology, characterized by: include, Obtain historical vulnerability data and security logs, and extract vulnerability features as samples; The vulnerability scanning model is obtained by model training based on samples, and a continuous learning mechanism is designed to ensure the continuous update of the vulnerability scanning model; Use the vulnerability scanning model to analyze the behavior of the scanned system and obtain all potential vulnerabilities of the system; Fill potential vulnerabilities and simulate attack scenarios based on potential vulnerabilities to attack the system to determine whether effective filling has been achieved.
2. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 1, characterized in that: The extracting of vulnerability features as samples includes extracting abnormal code paths and memory access pattern feature vectors in historical vulnerability data and security logs using a feature extraction formula, and taking the feature vectors as samples. The feature extraction formula is expressed as: Among them, F(x) represents the feature vector, x represents the input data set, N represents the total amount of data in the data set, and x i represents the i-th data in the data set, μ represents the mean of x, and σ represents the standard deviation of x. Expressed as entropy calculation function, Represented as an anomaly detection function based on graph theory; The entropy calculation function The formula used to represent the information complexity of a sample is: Among them, K represents the number of all possible categories, that is, x i The total number of different code paths or memory access patterns that may belong to, p k Represented as data point x i The probability of appearing in the k-th pattern; The graph-based anomaly detection function Used to represent x i The degree of abnormality in the code structure or memory access pattern is expressed as, Among them, T(x i ) is represented by the data point x i The number of triangles formed with its neighboring data points, d(x i ) is represented by the data point x i The degree of x i The number of directly connected data points.
3. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 2, characterized in that: The sample-based model training to obtain the vulnerability scanning model includes taking the obtained feature vector as a sample, and training the model with the sample based on the deep learning model to obtain the vulnerability scanning model represented as: Among them, P represents the probability of vulnerability, σ represents the Sigmoid activation function, which is used in the output layer to map the result to the interval [0, 1], J represents the total number of neurons in the hidden layer, and w j is represented by the weight connecting the jth hidden layer neuron and the output neuron, I is represented by the total number of input features, and v ij Represented as the concatenated input feature F i (x) and the weight of the jth hidden neuron, F i (x) is represented as the i-th feature extracted from the feature vector F(x), b j is represented as the bias term of the jth hidden layer neuron, and c is represented as the bias term of the output layer.
4. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 3 is characterized by: The continuous learning mechanism includes that after the vulnerability scanning model is built, the system continuously collects new data samples from network traffic, system logs and user feedback; Adopt online learning algorithms to adjust model parameters in real time to adapt to new data samples; The system continuously monitors the performance of the model, including the accuracy and recall rate of the vulnerability scanning model. When the model performance does not meet the preset requirements, the system retrains the model; The adjusting model parameters includes updating the vulnerability scanning model parameters in real time based on the online gradient descent method, which is expressed as: Among them, θ t+1 Represented as the model parameter at time t+1, θ t Represented as the model parameter at time t, η t Expressed as the learning rate at time t, Expressed as a loss function About parameter θ t In the new data sample (x t ,y t ), the gradient on x t Represented as the feature vector of the latest data point received at time t, y t Represented as x t The corresponding true value; The retraining includes starting the retraining mechanism when the model performance does not meet the preset requirements. The formula is expressed as: Among them, θ new is represented as the new model parameter, θ is represented as the parameter of the original vulnerability scanning model, argmin θ It is represented as a mathematical operation to find the value of θ that minimizes the expression in brackets. n is the window size, which specifies the number of data points to consider during the retraining process. It is expressed as a loss function, which is used to evaluate the model prediction x under the parameter θ. m The output and the true label y m The error between them, λ is represented as the regularization parameter, ‖θ‖ 2 Expressed as the square of the L2 norm of θ.
5. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 4, characterized in that: The behavior analysis includes static analysis and dynamic analysis; The static analysis is to scan the program using a vulnerability scanning model without executing the program to obtain potential vulnerabilities; The dynamic analysis is to scan the program using a vulnerability scanning model when the program is executed to obtain potential vulnerabilities.
6. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 5, characterized in that: The simulated attack scenario includes, based on the potential vulnerabilities scanned, formulating an attack strategy targeting the potential vulnerabilities to attack the system.
7. The network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in claim 6, characterized in that: The determination of whether effective filling is achieved includes, after simulating attacks using different attack strategies, determining whether the system is successfully defended. If successful, it indicates that the vulnerability filling is effective. If unsuccessful, it indicates that the vulnerability filling is invalid and a new filling strategy needs to be formulated until the defense is successful.
8. A system using the network security vulnerability intelligent scanning method based on artificial intelligence technology as claimed in any one of claims 1 to 7, characterized in that: It includes sample collection module, model building module, scanning module and repair and feedback module; The sample collection module obtains historical vulnerability data and security logs, and extracts vulnerability features therein as samples; The model building module performs model training based on samples to obtain a vulnerability scanning model, and designs a continuous learning mechanism to ensure continuous updating of the vulnerability scanning model; The scanning module uses the vulnerability scanning model to perform behavioral analysis on the system to be scanned to obtain all potential vulnerabilities of the system; The repair and feedback module fills the potential loopholes and attacks the system based on the potential loopholes by simulating attack scenarios to determine whether effective filling is achieved.
9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in any one of claims 1 to 7 are implemented.
10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security vulnerability intelligent scanning method based on artificial intelligence technology described in any one of claims 1 to 7 are implemented.