Network security monitoring system and method based on artificial intelligence technology

Abstract

The invention belongs to the field of network security, relates to a data analysis technology, is used for solving the problem that optimization decision analysis cannot be carried out when network security abnormity is monitored in the prior art, and particularly relates to a network security monitoring system and method based on an artificial intelligence technology. The safety monitoring platform is in communication connection with a protection monitoring module, a safety analysis module, an experience analysis module and a database; the protection monitoring module is used for carrying out network security protection monitoring analysis: marking a network subjected to security monitoring as an analysis object, carrying out statistics on security events of the analysis object in an analysis period and obtaining a monitoring coefficient of the analysis object; according to the method, the security event processing state of the network can be analyzed, comprehensive analysis is carried out by combining the processing value of the dangerous object in the analysis period and the risk values in all the monitoring periods to obtain the risk control coefficient, and decision analysis is carried out on the network security optimization direction of the dangerous object according to the risk control coefficient.

Description

Technical Field

[0001] The present invention belongs to the field of network security and relates to data analysis technology, specifically to a network security monitoring system and method based on artificial intelligence technology. Background Art

[0002] Network security means that the hardware, software and data of the network system are protected from damage, change or leakage due to accidental or malicious reasons, and the system runs continuously, reliably and normally without interruption of network services.

[0003] The invention patent with announcement number CN112600805B discloses a network security supervision platform, which realizes real-time monitoring of access terminal identity, network traffic parameters and behavior status parameters, so that abnormal situations existing in the network operation process can be discovered in time, providing guarantee for the safe operation of the network; however, the supervision platform cannot perform optimization decision analysis when network security anomalies are detected, and cannot timely screen out security protection links that need to be optimized, resulting in the network security monitoring system being unable to be quickly upgraded and optimized.

[0004] In view of the above technical problems, this application proposes a solution. Summary of the invention

[0005] The purpose of the present invention is to provide a network security monitoring system and method based on artificial intelligence technology, which is used to solve the problem that the existing technology cannot perform optimized decision analysis when network security anomalies are detected;

[0006] The technical problem to be solved by the present invention is: how to provide a network security monitoring system and method based on artificial intelligence technology that can perform optimized decision analysis when network security anomalies are detected.

[0007] The purpose of the present invention can be achieved through the following technical solutions:

[0008] A network security monitoring system based on artificial intelligence technology includes a security monitoring platform, wherein the security monitoring platform is communicatively connected to a protection monitoring module, a security analysis module, an experience analysis module, and a database;

[0009] The protection monitoring module is used to perform network security protection monitoring and analysis: the network to be security monitored is marked as an analysis object, a monitoring cycle is generated, security events occurring in the analysis object during the analysis cycle are counted and a monitoring coefficient JC of the analysis object is obtained; and the monitoring coefficient JC is used to determine whether the security protection status of the analysis object during the monitoring cycle meets the requirements.

[0010] The security analysis module is used to perform security event processing status analysis: determine whether the processing status of the dangerous object for the security event meets the requirements, and perform network security optimization analysis if it does not meet the requirements.

[0011] The experience analysis module is used for service experience analysis: obtaining the throughput data TT, bandwidth data DK and delay data YC of the dangerous object during the monitoring period; and performing numerical calculation to obtain the service coefficient FW of the dangerous object during the monitoring period; summing and averaging the service coefficient FW of the dangerous object in all monitoring periods to obtain the service performance value, performing variance calculation on the service coefficient FW of the dangerous object in all monitoring periods to obtain the service fluctuation value, and judging whether the service experience of the dangerous object meets the requirements through the service performance value and the service fluctuation value.

[0012] Furthermore, the process of obtaining the monitoring coefficient JC of the analysis object includes: security events include malicious program attacks, security vulnerabilities and traffic attacks, and the number of malicious program attacks, security vulnerabilities and traffic attacks occurring in the analysis object during the analysis period are marked as malicious program data EC, vulnerability data LD and traffic attack data LG respectively; the monitoring coefficient JC of the analysis object during the monitoring period is obtained by the formula JC = (m1×EC+m2×LD+m3×LG) / YH, wherein m1, m2 and m3 are all proportional coefficients, and m1>m2>m3>1, and YH is the number of registered users of the analysis object.

[0013] Furthermore, the specific process of determining whether the safety protection status of the analysis object during the monitoring period meets the requirements includes: obtaining the monitoring threshold JCmax through the database, and comparing the monitoring coefficient JC of the analysis object during the monitoring period with the monitoring threshold JCmax: if the monitoring coefficient JC is less than the monitoring threshold JCmax, then it is determined that the safety protection status of the analysis object during the monitoring period meets the requirements, and the corresponding analysis object is marked as a safe object; if the monitoring coefficient JC is greater than or equal to the monitoring threshold JCmax, then it is determined that the safety protection status of the analysis object during the monitoring period does not meet the requirements, and the corresponding analysis object is marked as a dangerous object.

[0014] Furthermore, the specific process of determining whether the processing status of the dangerous object for the security incident meets the requirements includes: marking the sum of the number of leaked data bytes, the number of tampered data bytes, and the number of lost data bytes of the dangerous object during the analysis period as the processing value of the dangerous object, obtaining the processing threshold through the database, and comparing the processing value of the dangerous object with the processing threshold: if the processing value is less than the processing threshold, it is determined that the processing status of the dangerous object for the security incident meets the requirements; if the processing value is greater than or equal to the processing threshold, it is determined that the processing status of the dangerous object for the security incident does not meet the requirements.

[0015] Furthermore, the specific process of network security optimization analysis includes: marking L1 seconds after the time point when a security incident occurs in the dangerous object within the analysis period as a monitoring period, marking the sum of the number of data bytes leaked, the number of data bytes tampered, and the number of data bytes lost of the dangerous object within the monitoring period as the risk value of the monitoring period, summing the risk values ​​of all monitoring periods within the monitoring period to obtain a risk manifestation value, marking the ratio of the risk manifestation value to the processing value as the risk control coefficient of the dangerous object, obtaining the risk control threshold through the database, and comparing the risk control coefficient of the dangerous object with the risk control threshold: if the risk control coefficient is less than the risk control threshold, a scanning optimization signal is generated and the scanning optimization signal is sent to the mobile terminal of the administrator through the security monitoring platform; if the risk control coefficient is greater than or equal to the risk control threshold, a processing optimization signal is generated and the processing optimization signal is sent to the mobile terminal of the administrator through the security monitoring platform.

[0016] Furthermore, the throughput data TT is the minimum value of the maximum data rate received per second when the dangerous object performs network data transmission during the monitoring period, the bandwidth data DK is the minimum number of bits transmitted per second when the dangerous object performs network data transmission during the monitoring period, and the delay data YC is the maximum value of the time used for transmission in the transmission medium when the dangerous object performs network data transmission during the monitoring period.

[0017] Furthermore, the specific process of determining whether the service experience of the dangerous object meets the requirements includes: obtaining the service performance threshold and the service fluctuation threshold through the database, and comparing the service performance value and the service fluctuation value of the dangerous object with the service performance threshold and the service fluctuation threshold respectively: if the service performance value is less than the service performance threshold and the service fluctuation value is less than the service fluctuation threshold, then it is determined that the service experience of the dangerous object meets the requirements; otherwise, it is determined that the service experience of the dangerous object does not meet the requirements, and a service optimization signal is generated and sent to the mobile terminal of the manager through the security monitoring platform.

[0018] The network security monitoring method based on artificial intelligence technology includes the following steps:

[0019] Step 1: Conduct security protection monitoring and analysis on the network;

[0020] Step 2: Analyze the processing status of security incidents;

[0021] Step 3: Generate a scanning optimization signal or a processing optimization signal according to the numerical value of the risk control coefficient and send it to the mobile terminal of the manager;

[0022] Step 4: Analyze the service experience of the network.

[0023] The present invention has the following beneficial effects:

[0024] 1. The protection monitoring module can be used to monitor and analyze the network security protection. Multiple network security parameters of the analysis object can be obtained through periodic monitoring, and comprehensive analysis and calculation can be performed to obtain the monitoring coefficient. The security protection status of the analysis object can be evaluated and differentiated according to the monitoring coefficient.

[0025] 2. The security analysis module can be used to analyze the security event processing status of the network, and the risk control coefficient can be obtained by combining the processing value of the dangerous object in the analysis cycle and the risk value in all monitoring periods. According to the risk control coefficient, decision analysis can be made on the network security optimization direction of the dangerous object;

[0026] 3. The experience analysis module can be used to analyze the service experience of the network, and a comprehensive analysis and calculation of multiple network transmission performance parameters of dangerous objects during the monitoring period can be performed to obtain the service coefficient. The service coefficient can be used to evaluate the impact of data transmission performance when a network security incident occurs to the dangerous object, and the necessity of optimization can be analyzed from the user's perspective. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0028] Figure 1 is a system block diagram of Embodiment 1 of the present invention;

[0029] Figure 2 This is a flow chart of the method of Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0030] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] Embodiment 1: Figure 1 As shown, the network security monitoring system based on artificial intelligence technology includes a security monitoring platform, and the security monitoring platform is communicatively connected with a protection monitoring module, a security analysis module, an experience analysis module and a database.

[0032] The protection monitoring module is used to perform network security protection monitoring and analysis: the network to be monitored is marked as an analysis object, a monitoring cycle is generated, and security events occurring in the analysis object during the analysis cycle are counted. Security events include malicious program attacks, security vulnerabilities, and traffic attacks. The number of malicious program attacks, security vulnerabilities, and traffic attacks occurring in the analysis object during the analysis cycle are marked as malicious program data EC, vulnerability data LD, and traffic attack data LG, respectively; the monitoring coefficient JC of the analysis object during the monitoring cycle is obtained through the formula JC=(m1×EC+m2×LD+m3×LG) / YH, where m1, m2, and m3 are all proportional coefficients, and m1>m2>m3>1, and YH is the number of registered users of the analysis object; the monitoring threshold JCmax is obtained through the database, and the number of malicious program attacks, security vulnerabilities, and traffic attacks occurring in the analysis object during the monitoring cycle is marked as malicious program data EC, vulnerability data LD, and traffic attack data LG, respectively. The monitoring coefficient JC during the period is compared with the monitoring threshold JCmax: if the monitoring coefficient JC is less than the monitoring threshold JCmax, it is determined that the security protection status of the analysis object during the monitoring period meets the requirements, and the corresponding analysis object is marked as a safe object; if the monitoring coefficient JC is greater than or equal to the monitoring threshold JCmax, it is determined that the security protection status of the analysis object during the monitoring period does not meet the requirements, the corresponding analysis object is marked as a dangerous object, and a security analysis signal and an experience analysis signal are generated and sent to the security analysis module and the experience analysis module respectively through the security monitoring platform; multiple network security parameters of the analysis object are obtained in a periodic monitoring manner, and comprehensive analysis and calculation are performed to obtain the monitoring coefficient, and the security protection status of the analysis object is evaluated and differentiated according to the monitoring coefficient.

[0033] The security analysis module is used to analyze the security incident processing status: the sum of the number of data bytes leaked, the number of data bytes tampered, and the number of data bytes lost of the dangerous object during the analysis period is marked as the processing value of the dangerous object, the processing threshold is obtained through the database, and the processing value of the dangerous object is compared with the processing threshold: if the processing value is less than the processing threshold, it is determined that the processing status of the dangerous object for the security incident meets the requirements; if the processing value is greater than or equal to the processing threshold, it is determined that the processing status of the dangerous object for the security incident does not meet the requirements, and L1 seconds after the time point when the security incident occurs in the dangerous object during the analysis period is marked as the monitoring period, and the sum of the number of data bytes leaked, the number of data bytes tampered, and the number of data bytes lost by the dangerous object during the monitoring period is marked as the risk value of the monitoring period, and the monitoring period is The risk values ​​of all monitoring periods are summed up to obtain the risk expression value, the ratio of the risk expression value to the processing value is marked as the risk control coefficient of the dangerous object, the risk control threshold is obtained through the database, and the risk control coefficient of the dangerous object is compared with the risk control threshold: if the risk control coefficient is less than the risk control threshold, a scanning optimization signal is generated and the scanning optimization signal is sent to the manager's mobile terminal through the security monitoring platform; if the risk control coefficient is greater than or equal to the risk control threshold, a processing optimization signal is generated and the processing optimization signal is sent to the manager's mobile terminal through the security monitoring platform; a comprehensive analysis is performed on the processing value of the dangerous object in the analysis period and the risk value in all monitoring periods to obtain the risk control coefficient, and a decision analysis is performed on the network security optimization direction of the dangerous object based on the risk control coefficient.

[0034] The experience analysis module is used for service experience analysis: obtaining the throughput data TT, bandwidth data DK and delay data YC of the dangerous object during the monitoring period; the throughput data TT is the minimum value of the maximum data rate received per second when the dangerous object performs network data transmission during the monitoring period, the bandwidth data DK is the minimum value of the number of bits transmitted per second when the dangerous object performs network data transmission during the monitoring period, and the delay data YC is the maximum value of the time used for transmission in the transmission medium when the dangerous object performs network data transmission during the monitoring period; the service coefficient FW of the dangerous object during the monitoring period is obtained by the formula FW=k1×TT+k2×DK-k3×YC, where k1, k2 and k3 are all proportional coefficients, and k1>k2>k3>1; the service coefficient FW of the dangerous object in all monitoring periods is summed and averaged to obtain the service performance value, and the dangerous The service coefficient FW of the dangerous object in all monitoring periods is used for variance calculation to obtain the service fluctuation value, and the service performance threshold and service fluctuation threshold are obtained through the database. The service performance value and service fluctuation value of the dangerous object are compared with the service performance threshold and service fluctuation threshold respectively: if the service performance value is less than the service performance threshold and the service fluctuation value is less than the service fluctuation threshold, it is determined that the service experience of the dangerous object meets the requirements; otherwise, it is determined that the service experience of the dangerous object does not meet the requirements, and a service optimization signal is generated and sent to the mobile terminal of the manager through the security monitoring platform; a comprehensive analysis and calculation of multiple network transmission performance parameters of the dangerous object in the monitoring period are performed to obtain the service coefficient, and the service coefficient is used to evaluate the degree of impact on the data transmission performance when a network security incident occurs to the dangerous object, and the necessity of optimization is analyzed from the user's perspective.

[0035] Embodiment 2: Figure 2 As shown, the network security monitoring method based on artificial intelligence technology includes the following steps:

[0036] Step 1: Perform security protection monitoring and analysis on the network: Mark the network to be monitored as the analysis object, generate a monitoring cycle, count the security events that occur in the analysis object during the analysis cycle and obtain the monitoring coefficient JC. The analysis object is marked as a safe object or a dangerous object based on the monitoring coefficient JC;

[0037] Step 2: Analyze the processing status of the security incident: mark the sum of the number of leaked data bytes, the number of tampered data bytes, and the number of lost data bytes of the dangerous object during the analysis period as the processing value of the dangerous object, and mark the monitoring period when the processing value is not less than the processing threshold;

[0038] Step 3: Sum the risk values ​​of all monitoring periods within the monitoring cycle to obtain the risk performance value, mark the ratio of the risk performance value to the treatment value as the risk control coefficient of the dangerous object, generate a scanning optimization signal or a processing optimization signal through the risk control coefficient and send it to the mobile terminal of the manager;

[0039] Step 4: Analyze the service experience of the network: obtain the throughput data TT, bandwidth data DK and delay data YC of the dangerous object during the monitoring period and perform numerical calculations to obtain the service coefficient FW. Perform numerical calculations on the service coefficient FW of all monitoring periods to obtain the service performance value and service fluctuation value. Determine whether the service experience of the dangerous object meets the requirements based on the service performance value and service fluctuation value.

[0040] The network security monitoring system and method based on artificial intelligence technology, when working, marks the network to be monitored as an analysis object, generates a monitoring cycle, counts the security events that occur in the analysis object during the analysis cycle and obtains the monitoring coefficient JC, and marks the analysis object as a safe object or a dangerous object through the monitoring coefficient JC; marks the sum of the number of data bytes leaked, the number of data bytes tampered, and the number of data bytes lost of the dangerous object during the analysis cycle as the processing value of the dangerous object, and marks the monitoring period when the processing value is not less than the processing threshold; sums the risk values ​​of all monitoring periods within the monitoring cycle to obtain a risk performance value, marks the ratio of the risk performance value to the processing value as the risk control coefficient of the dangerous object, generates a scanning optimization signal or a processing optimization signal through the risk control coefficient and sends it to the mobile phone terminal of the administrator; obtains the throughput data TT, bandwidth data DK, and delay data YC of the dangerous object during the monitoring period and performs numerical calculations to obtain the service coefficient FW, performs numerical calculations on the service coefficients FW of all monitoring periods to obtain service performance values ​​and service fluctuation values, and judges whether the service experience of the dangerous object meets the requirements based on the service performance value and the service fluctuation value.

[0041] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

[0042] The above formulas are obtained by collecting a large amount of data for software simulation and selecting a formula close to the real value. The coefficients in the formula are set by technicians in this field according to the actual situation; such as: formula JC = (m1×EC+m2×LD+m3×LG) / YH; technicians in this field collect multiple groups of sample data and set corresponding monitoring coefficients for each group of sample data; substitute the set monitoring coefficients and the collected sample data into the formula, any three formulas constitute a three-variable linear equation group, screen the calculated coefficients and take the average, and obtain the values ​​of m1, m2 and m3 as 3.58, 2.63 and 2.12 respectively;

[0043] The size of the coefficient is to quantify each parameter to obtain a specific value for subsequent comparison. The size of the coefficient depends on the amount of sample data and the initial setting of the corresponding monitoring coefficient for each set of sample data by technical personnel in this field; as long as it does not affect the proportional relationship between the parameter and the quantified value, such as the monitoring coefficient is proportional to the value of the process data.

[0044] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0045] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A network security monitoring system based on artificial intelligence technology, characterized by: It includes a security monitoring platform, which is communicatively connected to a protection monitoring module, a security analysis module, an experience analysis module and a database; The protection monitoring module is used to perform network security protection monitoring and analysis: marking the network to be monitored as an analysis object, generating a monitoring cycle, and counting the security events that occur in the analysis object during the analysis cycle to obtain a monitoring coefficient JC of the analysis object; The monitoring coefficient JC is used to determine whether the safety protection status of the analysis object during the monitoring period meets the requirements; The security analysis module is used to analyze the security incident processing status: determine whether the processing status of the dangerous object for the security incident meets the requirements, and perform network security optimization analysis if it does not meet the requirements; The experience analysis module is used for service experience analysis: obtaining throughput data TT, bandwidth data DK and delay data YC of the dangerous object during the monitoring period; And perform numerical calculation to obtain the service coefficient FW of the dangerous object during the monitoring period; sum and average the service coefficient FW of the dangerous object in all monitoring periods to obtain the service performance value; perform variance calculation on the service coefficient FW of the dangerous object in all monitoring periods to obtain the service fluctuation value; judge whether the service experience of the dangerous object meets the requirements through the service performance value and service fluctuation value.

2. The network security monitoring system based on artificial intelligence technology according to claim 1 is characterized in that: The process of obtaining the monitoring coefficient JC of the analysis object includes: security events include malicious program attacks, security vulnerabilities and traffic attacks, and the number of malicious program attacks, security vulnerabilities and traffic attacks occurring in the analysis object during the analysis period are marked as malicious program data EC, vulnerability data LD and traffic attack data LG respectively; the monitoring coefficient JC of the analysis object during the monitoring period is obtained by the formula JC = (m1×EC+m2×LD+m3×LG) / YH, where m1, m2 and m3 are all proportional coefficients, and m1>m2>m3>1, and YH is the number of registered users of the analysis object.

3. The network security monitoring system based on artificial intelligence technology according to claim 2 is characterized in that: The specific process of determining whether the safety protection status of the analysis object during the monitoring period meets the requirements includes: obtaining the monitoring threshold JCmax through the database, and comparing the monitoring coefficient JC of the analysis object during the monitoring period with the monitoring threshold JCmax: if the monitoring coefficient JC is less than the monitoring threshold JCmax, it is determined that the safety protection status of the analysis object during the monitoring period meets the requirements, and the corresponding analysis object is marked as a safe object; if the monitoring coefficient JC is greater than or equal to the monitoring threshold JCmax, it is determined that the safety protection status of the analysis object during the monitoring period does not meet the requirements, and the corresponding analysis object is marked as a dangerous object.

4. The network security monitoring system based on artificial intelligence technology according to claim 3 is characterized in that: The specific process of determining whether the processing status of a dangerous object for a security incident meets the requirements includes: marking the sum of the number of leaked data bytes, the number of tampered data bytes, and the number of lost data bytes of the dangerous object during the analysis period as the processing value of the dangerous object, obtaining a processing threshold through a database, and comparing the processing value of the dangerous object with the processing threshold: if the processing value is less than the processing threshold, then it is determined that the processing status of the dangerous object for the security incident meets the requirements; if the processing value is greater than or equal to the processing threshold, then it is determined that the processing status of the dangerous object for the security incident does not meet the requirements.

5. The network security monitoring system based on artificial intelligence technology according to claim 4 is characterized in that: The specific process of network security optimization analysis includes: marking L1 seconds after the time point when a security incident occurs in the dangerous object within the analysis period as the monitoring period, marking the sum of the number of data bytes leaked, the number of data bytes tampered, and the number of data bytes lost of the dangerous object during the monitoring period as the risk value of the monitoring period, summing the risk values ​​of all monitoring periods in the monitoring period to obtain the risk manifestation value, marking the ratio of the risk manifestation value to the processing value as the risk control coefficient of the dangerous object, obtaining the risk control threshold through the database, and comparing the risk control coefficient of the dangerous object with the risk control threshold: if the risk control coefficient is less than the risk control threshold, a scanning optimization signal is generated and the scanning optimization signal is sent to the mobile terminal of the administrator through the security monitoring platform; if the risk control coefficient is greater than or equal to the risk control threshold, a processing optimization signal is generated and the processing optimization signal is sent to the mobile terminal of the administrator through the security monitoring platform.

6. The network security monitoring system based on artificial intelligence technology according to claim 5 is characterized in that: The throughput data TT is the minimum value of the maximum data rate received per second when the dangerous object performs network data transmission during the monitoring period. The bandwidth data DK is the minimum number of bits transmitted per second when the dangerous object performs network data transmission during the monitoring period. The delay data YC is the maximum value of the time used for transmission in the transmission medium when the dangerous object performs network data transmission during the monitoring period.

7. The network security monitoring system based on artificial intelligence technology according to claim 6 is characterized in that: The specific process of determining whether the service experience of the dangerous object meets the requirements includes: obtaining the service performance threshold and the service fluctuation threshold through the database, and comparing the service performance value and the service fluctuation value of the dangerous object with the service performance threshold and the service fluctuation threshold respectively: if the service performance value is less than the service performance threshold and the service fluctuation value is less than the service fluctuation threshold, then it is determined that the service experience of the dangerous object meets the requirements; otherwise, it is determined that the service experience of the dangerous object does not meet the requirements, and a service optimization signal is generated and sent to the mobile terminal of the manager through the security monitoring platform.

8. A network security monitoring method based on artificial intelligence technology, characterized in that: The following steps are involved: Step 1: Conduct security protection monitoring and analysis on the network; Step 2: Analyze the processing status of security incidents; Step 3: Generate a scanning optimization signal or a processing optimization signal according to the numerical value of the risk control coefficient and send it to the mobile terminal of the manager; Step 4: Analyze the service experience of the network.

Images