AI-based information security dynamic analysis system and method

Abstract

The invention relates to the technical field of information security, and discloses an AI-based information security dynamic analysis system and method, and the system comprises an instruction driving module, a data driving module and a dynamic analysis module which are in communication connection in sequence, and an analysis log module which is in communication connection with the instruction driving module, the data driving module and the dynamic analysis module. The method corresponds to the system. According to the invention, systematic integration and collaboration of an information security dynamic analysis process are realized; an analysis rule is continuously updated based on a time sequence, so that the system can timely adapt to the change of a safe environment, and accurate analysis is carried out according to the change; through monitoring of the security nodes and intelligent instruction generation, rapid decision making and action taking can be ensured at the key nodes, by means of recording and logic presentation of the operation process, traceability of system operation and continuous optimization of security strategies are achieved, accuracy and timeliness of dynamic analysis of information security and overall protection efficiency are greatly improved, and the system has a wide application prospect. And complex and changeable network security threats can be effectively dealt with.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to an AI-based information security dynamic analysis system and method. Background Art

[0002] With the development of information security analysis technology, traditional technology faces many difficulties and limitations, which are specifically manifested in the following aspects: 1. Traditional information security analysis system architecture often lacks systematic integration, and the connections between various functional modules are loose, resulting in poor information transmission, low analysis efficiency and prone to security vulnerabilities; 2. Its analysis rules are updated lagging behind, and are mostly statically set. They cannot be adjusted in real time based on the passage of time, dynamic changes in data, and evolution of the network environment, making it difficult to cope with new threats and complex and ever-changing attack methods. 3. When dealing with critical security scenarios, traditional technologies lack accurate decision-making trigger mechanisms and often suffer serious losses due to decision delays; 4. The generation of instructions is single and overly dependent on preset programs or manual experience. It is unable to integrate the advantages of automation strategies and manual intervention, and it is difficult to quickly generate flexible and practical response instructions. 5. Traditional analysis systems record the operation process briefly and lack effective logical organization, which is not conducive to post-event review and strategy optimization.

[0003] Chinese patent number CN202411195991.3 discloses an AI-based network security situation analysis and prediction method and system, but the invention only uses the AI ​​model to analyze data thresholds and performs poorly in information security analysis.

[0004] In summary, a new AI-based technical solution for information security dynamic analysis is urgently needed to solve the above technical problems. Summary of the invention

[0005] The purpose of this application is to provide an AI-based information security dynamic analysis system and method to solve the technical problems raised in the above background technology.

[0006] To achieve the above objectives, this application discloses the following technical solutions: In a first aspect, the present application discloses an AI-based information security dynamic analysis system, the system comprising: an instruction driving module, a data driving module and a dynamic analysis module that are sequentially communicatively connected, and an analysis log module that is communicatively connected to the instruction driving module, the data driving module and the dynamic analysis module; When the AI-based information security dynamic analysis system is running, the data-driven module continuously updates the analysis rules of the dynamic analysis module based on the time series, the dynamic analysis module performs dynamic analysis based on the updated analysis rules, and when the data-driven module detects a security node, the data-driven module sends an instruction request to the instruction-driven module, the instruction-driven module generates a dynamic instruction based on the instruction request and returns it to the data-driven module, the data-driven module executes the dynamic instruction, and the dynamic analysis module performs dynamic analysis based on the execution result of the dynamic instruction; wherein, the analysis rules are used to control the dynamic analysis of the dynamic analysis module, the security node is a node where the dynamic analysis is in a decision-making state, the instruction request is used to characterize the decision-making needs, and the dynamic instruction is used to respond to the security node; at the same time, the analysis log module records the operation process of the instruction-driven module, the data-driven module and the dynamic analysis module, and generates an analysis log, which is used to characterize the operation logic of the AI-based information security dynamic analysis system.

[0007] Preferably, the analysis rules include at least data screening rules, behavior pattern recognition rules, risk level determination rules and association analysis rules; wherein the data screening rules are used to screen out data related to security analysis; the behavior pattern recognition rules are used to judge normal behavior and abnormal behavior; the risk level determination rules set different risk level assessment standards and conduct assessments based on different determination factors; and the association analysis rules are used to explore the connections between different security data.

[0008] Preferably, the safety node at least includes an abnormal threshold triggering node; When the data driving module detects that the preset security indicator does not meet the preset abnormal threshold, it determines that the abnormal threshold trigger node is reached, and the security indicator at least includes the network traffic fluctuation amplitude, system resource utilization rate and number of login failures.

[0009] Preferably, the security node includes at least a new threat intelligence matching node; When the data-driven module receives new threat intelligence and it matches the current dynamic analysis, it is determined that a new threat intelligence matching node has been reached, and the threat intelligence includes at least new malware features and specific hacker organization activity pattern information.

[0010] Preferably, the security node at least includes a rule conflict analysis node; When the new rule conflicts with the original rule in the process of updating the analysis rule by the data driving module and the conflict threshold is not satisfied, it is determined that the analysis rule conflict node is reached, and the conflict at least includes inconsistent judgments on the same behavior and logical contradictions of the rules; A preset analysis rule conflict determination formula is used to determine whether a new rule conflicts with an existing rule and does not satisfy a conflict threshold. The analysis rule conflict determination formula is specifically: in, is the preset conflict function, when The new analysis rules and When the existing analysis rules conflict , is the number of new analysis rules for the node, is the number of original analysis rules of the node, is the calculated node conflict degree index; when , it is determined that there is a conflict between the new rule and the original rule that does not meet the conflict threshold. is the conflict threshold.

[0011] Preferably, the security node at least includes an analysis rule fuzzy node; When the data-driven module updates the analysis rules and there are fuzzy analysis rules, and complex scenarios that do not support the current dynamic analysis are determined to have reached the analysis rule fuzzy node, and the complex scenarios at least include mixed attack scenarios and security incidents involving multiple unknown technologies.

[0012] Preferably, the instruction driving module generates a dynamic instruction including: calling a pre-stored response strategy library, matching a response strategy based on the instruction request and generating an automatic instruction, wherein the response strategy library includes a plurality of processing solutions for different security node types; The instruction driving module generating dynamic instructions also includes receiving manual instructions of human intervention; The dynamic instructions include automatic instructions and manual instructions.

[0013] Preferably, the analysis log module records the operation process of the instruction driving module, the data driving module and the dynamic analysis module based on a time series, extracts the operation logic of the operation process using feature extraction technology, and converts the operation logic into an analysis log using natural language technology.

[0014] Preferably, the dynamic analysis module comprises a threat detection unit, a risk assessment unit and an event response unit which are communicatively connected in sequence; The threat detection unit, the risk assessment unit and the event response unit perform threat detection, risk assessment and event response correspondingly based on the analysis rules.

[0015] In a second aspect, the present application discloses an AI-based information security dynamic analysis method, which is applicable to the AI-based information security dynamic analysis system as described above, and the method comprises: S1: continuously updating the analysis rules of the dynamic analysis module based on a time series; wherein the analysis rules are used to control the dynamic analysis of the dynamic analysis module; S2: Perform dynamic analysis based on the updated analysis rules; S3: When a safety node is detected, an instruction request is issued, and a dynamic instruction is generated based on the instruction request; wherein the safety node is a node that needs to be decided in the dynamic analysis; S4: Execute the dynamic instruction, and perform dynamic analysis based on the execution result of the dynamic instruction; wherein the instruction request is used to characterize the demand for decision-making, and the dynamic instruction is used to respond to the security node; S5: Record S1 to S4 and generate an analysis log. The analysis log is used to characterize the operation logic of S1 to S4.

[0016] Beneficial effects: The AI-based information security dynamic analysis system and method of the present application realizes the systematic integration and efficient coordination of the information security dynamic analysis process. The data-driven module continuously updates the analysis rules based on the time series, so that the system can adapt to the changes in the security environment in a timely manner, and the dynamic analysis module conducts precise analysis accordingly. The effective monitoring of security nodes and the intelligent instruction generation of the instruction-driven module ensure that decisions can be made and actions can be taken quickly at key nodes. With the help of the detailed recording and logical presentation of the operation process by the analysis log module, the traceability of system operation and the continuous optimization of security strategies are realized, which greatly improves the accuracy, timeliness and overall protection effectiveness of information security dynamic analysis, and effectively responds to complex and changing network security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without paying any creative work.

[0018] Figure 1 A structural block diagram of an AI-based information security dynamic analysis system provided in an embodiment of the present application; Figure 2 A structural block diagram of a dynamic analysis module of an AI-based information security dynamic analysis system provided in an embodiment of the present application; Figure 3 A flowchart of the AI-based information security dynamic analysis method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0019] The technical solutions in the embodiments of the present application are described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0020] In this article, the term "comprising" is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprising..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0021] The first aspect of this embodiment discloses Figure 1 An AI-based information security dynamic analysis system is shown, the system comprising: an instruction drive module, a data drive module and a dynamic analysis module that are sequentially communicatively connected, and an analysis log module that is communicatively connected to the instruction drive module, the data drive module and the dynamic analysis module; When the AI-based information security dynamic analysis system is running, the data-driven module continuously updates the analysis rules of the dynamic analysis module based on the time series, the dynamic analysis module performs dynamic analysis based on the updated analysis rules, and when the data-driven module detects a security node, the data-driven module sends an instruction request to the instruction-driven module, the instruction-driven module generates a dynamic instruction based on the instruction request and returns it to the data-driven module, the data-driven module executes the dynamic instruction, and the dynamic analysis module performs dynamic analysis based on the execution result of the dynamic instruction; wherein, the analysis rules are used to control the dynamic analysis of the dynamic analysis module, the security node is a node where the dynamic analysis is in the process of making a decision, the instruction request is used to characterize the decision-making needs, and the dynamic instruction is used to respond to the security node; at the same time, the analysis log module records the operation process of the instruction-driven module, the data-driven module and the dynamic analysis module, and generates an analysis log, which is used to characterize the operation logic of the AI-based information security dynamic analysis system.

[0022] Through the above, this embodiment realizes the systematic integration and efficient coordination of the information security dynamic analysis process. The data-driven module continuously updates the analysis rules based on the time series, so that the system can adapt to the changes in the security environment in a timely manner, and the dynamic analysis module conducts precise analysis accordingly. The effective monitoring of security nodes and the intelligent instruction generation of the instruction-driven module ensure that decisions can be made and actions can be taken quickly at key nodes. With the help of the detailed recording and logical presentation of the operation process by the analysis log module, the traceability of system operation and the continuous optimization of security strategies are realized, which greatly improves the accuracy, timeliness and overall protection effectiveness of information security dynamic analysis, and effectively responds to complex and changing network security threats.

[0023] Specifically, the analysis rules include at least data screening rules, behavior pattern recognition rules, risk level determination rules and association analysis rules; among them, the data screening rules are used to screen out data related to security analysis; the behavior pattern recognition rules are used to judge normal behavior and abnormal behavior; the risk level determination rules set different risk level assessment standards and evaluate based on different determination factors; the association analysis rules are used to explore the connections between different security data.

[0024] It should be noted that the analysis rules of this embodiment are obtained by refining based on existing information security analysis rules.

[0025] Through the above, this embodiment realizes the accurate processing and deep mining of massive security data. The data screening rules efficiently screen key data, the behavior pattern recognition rules accurately distinguish normal and abnormal behaviors, the risk level determination rules dynamically assess risks, and the association analysis rules mine data connections, so as to comprehensively and meticulously control the security situation, timely detect potential threats, and provide a solid and reliable basis for subsequent decision-making and response, enhance the adaptability and effectiveness of dynamic information security analysis in different scenarios, and improve the accuracy and reliability of overall security protection.

[0026] Specifically, the safety node includes at least an abnormal threshold trigger node; When the data driving module detects that the preset security indicators do not meet the preset abnormal threshold, it determines that the abnormal threshold trigger node is reached. The security indicators include at least the network traffic fluctuation range, system resource utilization rate and number of login failures.

[0027] Through the above, this embodiment utilizes the precise definition and monitoring of the abnormal threshold trigger node to achieve rapid early warning and response to abnormal network security conditions. Through the real-time monitoring of security indicators such as network traffic fluctuation amplitude, system resource utilization rate and number of login failures by the data-driven module, once the preset abnormal threshold is not met, it is determined that the abnormal threshold trigger node has been reached. The system can quickly start a targeted analysis and response process, block potential attacks in time, and control security risks within the minimum range, effectively avoiding serious security accidents caused by the spread of abnormal conditions, ensuring the stable operation and data security of the information system, and improving the timeliness and efficiency of information security dynamic analysis in responding to sudden abnormalities. In a simple example, when there is an abnormal threshold trigger node, a dynamic instruction to expand the data collection range is generated, thereby providing more analysis data for the processing of abnormal thresholds.

[0028] Specifically, the security node includes at least a new threat intelligence matching node; When the data-driven module receives new threat intelligence and it matches the current dynamic analysis, it determines that the new threat intelligence matching node has been reached. The threat intelligence includes at least new malware features and specific hacker organization activity pattern information.

[0029] Through the above, this embodiment uses the setting and judgment mechanism of the new threat intelligence matching node to achieve the keen capture and effective prevention of new security threats. When the data-driven module receives new threat intelligence such as new malware features and specific hacker organization activity pattern information and successfully matches it with the current dynamic analysis, the system can respond quickly, adjust the analysis strategy and protection measures in time according to the characteristics of the threat intelligence, and lay out the response plan in advance to effectively resist the invasion of new threats, fill the shortcomings of traditional information security analysis in dealing with unknown threats, enhance the foresight and adaptability of information security dynamic analysis to emerging security challenges, and maintain the security and integrity of the information system. In a simple example, when there is a new threat intelligence matching node, a dynamic instruction to update the threat detection database is generated, thereby updating the threat features in the threat detection database. In the next threat detection cycle, the expanded threat detection database is used for threat detection, thereby improving the quality of threat detection.

[0030] Specifically, the security node includes at least an analysis rule conflict node; When a new rule conflicts with an original rule in the process of updating the analysis rule of the data-driven module and the conflict threshold is not satisfied, it is determined that the analysis rule conflict node is reached. The conflict at least includes inconsistent judgments on the same behavior and logical contradictions of the rules. The preset analysis rule conflict determination formula is used to determine whether there is a conflict between the new rule and the original rule that does not meet the conflict threshold. The analysis rule conflict determination formula is specifically: in, is the preset conflict function, when The new analysis rules and When the existing analysis rules conflict , is the number of new analysis rules for the node, is the number of original analysis rules of the node, is the calculated node conflict degree index; when , it is determined that there is a conflict between the new rule and the original rule that does not meet the conflict threshold. is a conflict threshold, which is an empirical value of the conflict situation set based on common sense known to those skilled in the art.

[0031] Through the above, this embodiment uses the judgment formula and processing mechanism of the analysis rule conflict node to achieve effective maintenance of the internal consistency and stability of the analysis rule system. In the process of updating the analysis rules in the data-driven module, with the help of the preset analysis rule conflict judgment formula, it is accurately judged whether there is a conflict between the new rule and the original rule, such as inconsistent judgments on the same behavior or logical contradictions in the rules. Once a conflict is found and exceeds the conflict threshold, the system can take correction or adjustment measures in time to ensure the accuracy and reliability of the analysis rules, avoid analysis errors and security vulnerabilities caused by rule conflicts, and ensure that the dynamic analysis of information security is carried out according to a stable and reasonable rule system, thereby improving the quality and credibility of the overall analysis.

[0032] Specifically, the security node includes at least an analysis rule fuzzy node; When the data-driven module updates the analysis rules and there is fuzzy analysis rules, and complex scenarios that do not support the current dynamic analysis are determined to have reached the analysis rule fuzzy node. The complex scenarios at least include mixed attack scenarios and security incidents involving multiple unknown technologies.

[0033] Through the above, this embodiment uses the determination and response strategy of fuzzy nodes of analysis rules to optimize the adaptability of analysis rules in complex security scenarios. When the data-driven module updates the analysis rules, if the rules are fuzzy and do not support the current dynamic analysis due to complex situations such as mixed attack scenarios or security incidents involving multiple unknown technologies, the system can promptly identify and initiate the corresponding processing mechanism, such as further refining the rules or introducing special response strategies, so that the analysis rules can better meet the needs of complex scenarios, improve the effectiveness and flexibility of dynamic analysis of information security in complex and changing environments, and ensure that the system can still maintain good analysis and protection capabilities when facing special security challenges.

[0034] As a preferred implementation of this embodiment, this embodiment uses the analysis rule fuzzy determination formula to determine whether there is a complex scenario where the analysis rule is fuzzy and does not support the current dynamic analysis. The analysis rule fuzzy determination formula is specifically: in, is the number of scenes, For history-based analysis rules For the scene The fitness obtained by fitting the adaptation situation is is the calculated node fuzziness index, when When determining that there are complex scenarios where the analysis rules are ambiguous and do not support the current dynamic analysis, It is an empirical value of the fuzzy situation set based on common sense known to those skilled in the art.

[0035] It should be noted that this embodiment utilizes the division of abnormal threshold trigger nodes, new threat intelligence matching nodes, analysis rule conflict nodes and analysis rule fuzzy nodes to achieve accurate detection of nodes for information security analysis, thereby generating dynamic instructions. It can be understood that in the prior art, the use of analysis rules is mostly static, and even if there is dynamic, it is a mechanical replacement of analysis rules. This embodiment is based on the design of an instruction-driven module to achieve intelligent update of analysis rules. Based on existing AI technology, the update of analysis rules used by the dynamic analysis module is achieved through automatic instructions or manual instructions, thereby improving the quality of information security analysis.

[0036] Specifically, the instruction driving module generates dynamic instructions including: calling a pre-stored response strategy library, matching response strategies based on instruction requests and generating automatic instructions, the response strategy library including multiple processing solutions for different security node types; The instruction driving module generates dynamic instructions and also includes receiving manual instructions of human intervention; Dynamic instructions include automatic instructions and manual instructions.

[0037] Through the above, this embodiment uses the multiple ways of generating dynamic instructions by the instruction driving module to achieve flexible decision-making and efficient execution of security nodes. The instruction driving module can call the pre-stored response strategy library to generate automatic instructions based on instruction request matching, and can also receive manual instructions of human intervention. This instruction generation mode combining automation and manual work gives full play to the high efficiency of intelligent systems and the unique advantages of human experience, making the generated dynamic instructions more in line with actual security conditions and needs, and can quickly and accurately take corresponding actions under different types of security nodes, improving the decision-making quality and execution efficiency of information security dynamic analysis when dealing with complex security incidents, and enhancing the overall response capability and adaptability of the system.

[0038] Specifically, the analysis log module records the operation process of the instruction driving module, the data driving module and the dynamic analysis module based on the time series, uses feature extraction technology to extract the operation logic of the operation process, and uses natural language technology to convert the operation logic into an analysis log.

[0039] It should be noted that this embodiment uses existing feature extraction technology and natural language technology to achieve the logical presentation of the operation process.

[0040] Through the above, this embodiment utilizes the recording and conversion functions of the analysis log module to achieve a comprehensive presentation and effective use of the operating logic of the information security dynamic analysis system. The analysis log module fully records the operation process of the instruction drive module, the data drive module and the dynamic analysis module based on the time series, accurately extracts the operation logic through feature extraction technology, and then converts it into a clear and easy-to-understand analysis log with the help of natural language technology. This not only facilitates security management personnel to conduct post-audits and reviews, gain an in-depth understanding of the system operation status, discover potential problems and room for improvement, but also provides a strong basis for the continuous optimization of security strategies, improves the manageability and sustainable development capabilities of the information security dynamic analysis system, and promotes the continuous improvement of the overall security protection level.

[0041] Specifically, Figure 2 As shown, the dynamic analysis module includes a threat detection unit, a risk assessment unit, and an event response unit that are sequentially communicatively connected; The threat detection unit, risk assessment unit and incident response unit perform threat detection, risk assessment and incident response correspondingly based on the analysis rules.

[0042] Through the above, this embodiment utilizes the architectural design of the threat detection unit, risk assessment unit and event response unit that are sequentially connected in the dynamic analysis module to achieve refined division of labor and efficient collaboration of the information security dynamic analysis function. The threat detection unit is sensitive to potential threats based on the analysis rules, the risk assessment unit makes scientific risk level determinations based on the detection results, and the event response unit quickly takes appropriate response measures based on the assessment results, making the dynamic analysis process smoother and more orderly, improving the accuracy and timeliness of information security dynamic analysis, and being able to quickly and effectively perform full-process processing when facing security threats, enhancing the overall security protection capabilities of the system and the efficiency of responding to complex security incidents.

[0043] The second aspect of this embodiment discloses Figure 3 An AI-based information security dynamic analysis method is shown, which is applicable to the AI-based information security dynamic analysis system as described above, and the method includes: S1: Continuously updating the analysis rules of the dynamic analysis module based on the time series; wherein the analysis rules are used to control the dynamic analysis of the dynamic analysis module; S2: Dynamic analysis based on updated analysis rules; S3: When a safety node is detected, a command request is issued, and a dynamic command is generated based on the command request; wherein the safety node is a node that needs to be decided in the dynamic analysis; S4: Execute dynamic instructions and perform dynamic analysis based on the execution results of the dynamic instructions; wherein the instruction request is used to characterize the decision-making requirements, and the dynamic instruction is used to respond to the security node; S5: Record S1 to S4 and generate an analysis log. The analysis log is used to characterize the operation logic of S1 to S4.

[0044] It should be noted that the AI-based information security dynamic analysis method of this embodiment corresponds to the aforementioned AI-based information security dynamic analysis system. Therefore, the contents not specifically described in the AI-based information security dynamic analysis method of this embodiment may include but are not limited to function definitions, working principles, and technical effects, etc., and may refer to the records of the aforementioned AI-based information security dynamic analysis system, and this text will not go into details here.

[0045] In summary, the AI-based information security dynamic analysis system and method of this embodiment realizes the systematic integration and efficient coordination of the information security dynamic analysis process. The data-driven module continuously updates the analysis rules based on the time series, so that the system can adapt to the changes in the security environment in a timely manner, and the dynamic analysis module conducts precise analysis accordingly. The effective monitoring of security nodes and the intelligent instruction generation of the instruction-driven module ensure that decisions can be made and actions can be taken quickly at key nodes. With the help of the detailed recording and logical presentation of the operation process by the analysis log module, the traceability of system operation and the continuous optimization of security strategies are realized, which greatly improves the accuracy, timeliness and overall protection effectiveness of information security dynamic analysis, and effectively responds to complex and changing network security threats.

[0046] In the embodiments provided in the present application, it should be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, code, or any appropriate combination thereof. For hardware implementation, the processor can be implemented in one or more of the following units: an application-specific integrated circuit (ASIC), a digital signal processor (DSP), a digital signal processing device (DSPD), a programmable logic device (PLD), a field programmable gate array (FPGA), a processor, a controller, a microcontroller, a microprocessor, other electronic units designed to implement the functions described herein, or a combination thereof. For software implementation, part or all of the processes of the embodiment can be completed by instructing the relevant hardware through a computer program. When implemented, the above program can be stored in a computer-readable storage medium or transmitted as one or more instructions or codes on a computer-readable storage medium. Computer-readable storage media include computer storage media and communication media, wherein the communication medium includes any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that can be accessed by a computer. Computer-readable storage media can include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer.

[0047] Finally, it should be noted that the above is only a preferred embodiment of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. An AI-based information security dynamic analysis system, characterized in that: The system comprises: an instruction driving module, a data driving module and a dynamic analysis module which are sequentially connected in communication, and an analysis log module which is connected in communication with the instruction driving module, the data driving module and the dynamic analysis module; When the AI-based information security dynamic analysis system is running, the data-driven module continuously updates the analysis rules of the dynamic analysis module based on the time series, the dynamic analysis module performs dynamic analysis based on the updated analysis rules, and when the data-driven module detects a security node, the data-driven module sends an instruction request to the instruction-driven module, the instruction-driven module generates a dynamic instruction based on the instruction request and returns it to the data-driven module, the data-driven module executes the dynamic instruction, and the dynamic analysis module performs dynamic analysis based on the execution result of the dynamic instruction; wherein, the analysis rules are used to control the dynamic analysis of the dynamic analysis module, the security node is a node where the dynamic analysis is in a decision-making state, the instruction request is used to characterize the decision-making needs, and the dynamic instruction is used to respond to the security node; at the same time, the analysis log module records the operation process of the instruction-driven module, the data-driven module and the dynamic analysis module, and generates an analysis log, which is used to characterize the operation logic of the AI-based information security dynamic analysis system.

2. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The analysis rules include at least data screening rules, behavior pattern recognition rules, risk level determination rules and association analysis rules; wherein the data screening rules are used to screen out data related to security analysis; the behavior pattern recognition rules are used to judge normal behavior and abnormal behavior; the risk level determination rules set different risk level assessment standards and conduct assessments based on different determination factors; and the association analysis rules are used to mine the connections between different security data.

3. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The safety node at least includes an abnormal threshold trigger node; When the data driving module detects that the preset security indicator does not meet the preset abnormal threshold, it determines that the abnormal threshold trigger node is reached, and the security indicator at least includes the network traffic fluctuation amplitude, system resource utilization rate and number of login failures.

4. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The security node includes at least a new threat intelligence matching node; When the data-driven module receives new threat intelligence and it matches the current dynamic analysis, it is determined that a new threat intelligence matching node has been reached, and the threat intelligence includes at least new malware features and specific hacker organization activity pattern information.

5. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The security node at least includes a rule conflict analysis node; When the new rule conflicts with the original rule in the process of updating the analysis rule by the data driving module and the conflict threshold is not satisfied, it is determined that the analysis rule conflict node is reached, and the conflict at least includes inconsistent judgments on the same behavior and logical contradictions of the rules; A preset analysis rule conflict determination formula is used to determine whether a new rule conflicts with an existing rule and does not satisfy a conflict threshold. The analysis rule conflict determination formula is specifically: in, is the preset conflict function, when The new analysis rules and When the existing analysis rules conflict , is the number of new analysis rules for the node, is the number of original analysis rules of the node, is the calculated node conflict degree index; when , it is determined that there is a conflict between the new rule and the original rule that does not meet the conflict threshold. is the conflict threshold.

6. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The security node at least includes an analysis rule fuzzy node; When the data-driven module updates the analysis rules and there are fuzzy analysis rules, and complex scenarios that do not support the current dynamic analysis are determined to have reached the analysis rule fuzzy node, and the complex scenarios at least include mixed attack scenarios and security incidents involving multiple unknown technologies.

7. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The instruction driving module generates a dynamic instruction including: calling a pre-stored response strategy library, matching a response strategy based on the instruction request and generating an automatic instruction, wherein the response strategy library includes a plurality of processing solutions for different security node types; The instruction driving module generating dynamic instructions also includes receiving manual instructions of human intervention; The dynamic instructions include automatic instructions and manual instructions.

8. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The analysis log module records the operation process of the instruction driving module, the data driving module and the dynamic analysis module based on time series, extracts the operation logic of the operation process using feature extraction technology, and converts the operation logic into an analysis log using natural language technology.

9. The AI-based information security dynamic analysis system according to claim 1 is characterized in that: The dynamic analysis module includes a threat detection unit, a risk assessment unit and an event response unit which are communicatively connected in sequence; The threat detection unit, the risk assessment unit and the event response unit perform threat detection, risk assessment and event response correspondingly based on the analysis rules.

10. An AI-based information security dynamic analysis method, the method is applicable to the AI-based information security dynamic analysis system according to any one of claims 1 to 9, characterized in that: The method includes: S1: continuously updating the analysis rules of the dynamic analysis module based on a time series; wherein the analysis rules are used to control the dynamic analysis of the dynamic analysis module; S2: Perform dynamic analysis based on the updated analysis rules; S3: When a safety node is detected, an instruction request is issued, and a dynamic instruction is generated based on the instruction request; wherein the safety node is a node that needs to be decided in the dynamic analysis; S4: Execute the dynamic instruction, and perform dynamic analysis based on the execution result of the dynamic instruction; wherein the instruction request is used to characterize the demand for decision-making, and the dynamic instruction is used to respond to the security node; S5: Record S1 to S4 and generate an analysis log. The analysis log is used to characterize the operation logic of S1 to S4.

Images