Sensitive information system security situation intelligent monitoring method based on AI

Abstract

The invention relates to the technical field of sensitive information system security monitoring, in particular to an AI-based sensitive information system security situation intelligent monitoring method, which comprises the following steps of: determining a network operation evaluation value by monitoring a throughput smooth value, a delay fluctuation value and an abnormal flow value of a network layer; a user behavior evaluation value is determined by monitoring a behavior influence value of a user layer, an external environment evaluation value is determined by monitoring a vulnerability fluctuation value and an attack intensity value of an external layer, a security value of a system is determined by integrating the evaluation values of the three layers, then security value data of a time sequence is extracted, a security trend coefficient is calculated and compared with a threshold value, and the security trend coefficient is calculated. The method comprises the following steps: detecting safety abnormity, if abnormity is detected, calling related safety state parameters, calculating a trend coefficient, comparing the trend coefficient with a corresponding abnormity contrast interval, and generating an early warning signal, so that intelligent real-time monitoring and early warning of the safety situation of the sensitive information system are realized, and the safety and stability of the system are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of security monitoring of sensitive information systems, and specifically to an AI-based intelligent monitoring method for the security situation of sensitive information systems. Background Art

[0002] With the acceleration of the informatization process, sensitive information systems in various industries have become the key support for the core operations of enterprises. These systems carry a large amount of core data, involving important links such as enterprise production, operation, and decision-making. However, with the increasing complexity of the network environment and the diversification of external attack methods, traditional security protection mechanisms (such as permission-based access control or static rule protection) are difficult to fully respond to modern threats. The main problems are as follows: 1. Traditional systems have limited monitoring capabilities for abnormal network operation, abnormal user behavior, and changes in the external environment, making it difficult to detect potential threat signals in a timely manner; 2. Security status assessment is usually limited to monitoring at a single level, and fails to achieve multi-dimensional dynamic comprehensive analysis of the network layer, user layer, and external layer; 3. Lack of long-term analysis and prediction of the operating trends of sensitive information systems, making it difficult to detect potential risks early and provide timely warnings and treatments; In order to solve the above defects, a technical solution is now provided. Summary of the invention

[0003] The purpose of this invention is to solve the limitations of traditional security protection mechanisms, which are unable to dynamically evaluate security situations in real time and accurately predict potential threats through multi-level data collection and comprehensive analysis, and to propose an AI-based intelligent monitoring method for the security situation of sensitive information systems.

[0004] The purpose of the present invention can be achieved through the following technical solutions: The AI-based intelligent monitoring method for security situation of sensitive information systems includes the following steps: Collect various types of information and send them to the cloud database for storage; By monitoring the network operation status information of the network layer, the throughput smoothing value, delay fluctuation value and abnormal traffic value are obtained, thereby determining the network operation evaluation value; By monitoring the user behavior status information of the user layer, the behavior impact value is obtained, thereby determining the user behavior evaluation value; By monitoring the external environment status information of the external layer, the vulnerability fluctuation value and attack strength value are obtained, thereby determining the external environment assessment value; Based on the network operation evaluation value, user behavior evaluation value and external environment evaluation value, the security value is determined; Extract the safety values ​​of different unit time periods within a period of time as the safety value data for a period of time, determine the safety trend coefficient based on the safety value data for a period of time, and compare and analyze the safety trend coefficient with the safety trend threshold to determine whether to generate a safety abnormality signal; If a safety abnormality signal is captured, the safety status parameters of different unit time periods within a period of time are retrieved respectively as the safety status parameter data for a period of time. The corresponding trend coefficient is determined based on the safety status parameter data for a period of time, and the trend coefficient is substituted into the corresponding abnormal control interval for comparative analysis, thereby generating a corresponding early warning signal.

[0005] Furthermore, the network operation status information of the network layer is monitored, and the specific process is as follows: Capture the throughput corresponding to the network layer in a unit time period, and use time as the horizontal axis and throughput as the vertical axis to establish a two-dimensional dynamic system of throughput. Use the point plotting curve construction method to plot the throughput on the two-dimensional dynamic system of throughput, thereby obtaining a throughput waveform curve. Obtain all inflection points of the throughput waveform curve, calculate the curvature values ​​of the inflection points, and perform mean calculation and analysis on the curvature values ​​of all inflection points to obtain the throughput smoothing value wy1; Capture the delay corresponding to the network layer within a unit time period, and calculate its standard deviation to obtain the delay fluctuation value wy2; Randomly select n2 monitoring time points within the unit time period, and obtain the total traffic volume of the network layer at the corresponding monitoring time point, and compare and analyze the total traffic volume at each monitoring time point with the set total traffic volume threshold. When the total traffic volume is less than the set total traffic volume threshold or the total traffic volume is greater than the set total traffic volume threshold, the total traffic volume at the corresponding monitoring time point is marked as an abnormal state, and the proportion of the n2 monitoring time points marked as abnormal states is calculated, and it is marked as the abnormal traffic value wy3.

[0006] Furthermore, the specific process of determining the network operation evaluation value is as follows: The values ​​of throughput smoothing value wy1, delay fluctuation value wy2 and abnormal traffic value wy3 are extracted and normalized according to the formula: , and obtain the network operation evaluation value δ1, where η1, η2 and η3 represent the set weight coefficients respectively, and η1<η2<η3.

[0007] Furthermore, the user behavior status information of the user layer is monitored, and the specific process is as follows: Capture the user behavior status information corresponding to the user layer in a unit time period. The user behavior status information includes the absence time, access path deviation value and login deviation value. The time away from the system refers to the total time that the user does not perform any operation and keeps the system session open. The access path deviation value refers to the value calculated by using a sequence matching algorithm to compare the user's current access path sequence with the historical regular access path sequence; The login deviation value refers to the value calculated by the machine learning model by combining the user's current login behavior characteristics with the historical feature patterns; At the same time, the user's authority level is obtained, and the user's behavior status information is substituted into the calculation formula corresponding to the authority level to obtain the behavior impact value, wherein the authority level includes first-level authority, second-level authority and third-level authority.

[0008] Furthermore, the specific process of determining the user behavior evaluation value is as follows: Compare and analyze the user's behavior impact value with a preset behavior impact threshold. When the user's behavior impact value is greater than or equal to the preset behavior impact threshold, the user is determined to be in an abnormal state. Otherwise, the user is determined to be in a normal state. The number of users who are judged to be in abnormal state in the first-level authority, second-level authority and third-level authority is counted respectively, thereby obtaining the first-level abnormal number value, the second-level abnormal number value and the third-level abnormal number value, and marking them as sanm1, sanm2 and sanm3 respectively, according to the formula: , and obtain the user behavior evaluation value δ2, where η4, η5 and η6 represent the set weight coefficients respectively, and η4>η5>η6.

[0009] Furthermore, the external environment status information of the external layer is monitored, and the specific process is as follows: Capture the vulnerability number data corresponding to the external layer in a unit time period, and extract the maximum vulnerability number, the middle vulnerability number, and the minimum vulnerability number from the vulnerability number data to calculate the average value, and obtain the average vulnerability number as the reference vulnerability number corresponding to the external layer in a unit time period; Based on the maximum number of vulnerabilities, the middle number of vulnerabilities, the minimum number of vulnerabilities and the reference number of vulnerabilities, the vulnerability fluctuation value wj1 is determined; Capture the attack data corresponding to the external layer within a unit time period, and extract the list of all malicious attack IP addresses from the attack data; Count the number of foreign malicious attack IPs and domestic malicious attack IPs within a unit time period; Based on the number of foreign malicious attack IPs, the number of domestic malicious attack IPs, the foreign attack frequency and the domestic attack frequency, the attack strength value wj2 is determined.

[0010] Furthermore, the specific process of determining the external environment assessment value is as follows: Extract the values ​​of vulnerability fluctuation value wj1 and attack strength value wj2 for normalization according to the formula: , and obtain the external environment evaluation value δ3, where η7 and η8 represent the set weight coefficients respectively, and η7<η8.

[0011] Furthermore, the specific process of determining the safety value is as follows: By extracting the network operation evaluation value δ1, user behavior evaluation value δ2 and external environment evaluation value δ3 in the security status parameters within a unit time period, normalization is performed according to the formula: , and obtain the safety value AQP, where γ1, γ2 and γ3 represent the preset proportional factors respectively.

[0012] Furthermore, the specific process of determining the safety trend coefficient is as follows: The safety value data of a period of time are sorted in chronological order to obtain a safety value sequence. The safety value sequence is decomposed in time series based on the STL time series decomposition method to obtain the slope of the trend item as the safety trend coefficient.

[0013] Furthermore, the specific process of generating the corresponding warning signal is as follows: Substituting the network operation trend coefficient into the abnormal network operation trend control interval for comparative analysis, when the network operation trend coefficient is in the preset abnormal network operation trend control interval, the network operation of the network layer is marked as abnormal network operation, and a network early warning signal is generated, and at the same time, it is sent to the display terminal in the form of text; When the network operation trend coefficient is not in the preset abnormal network operation trend control interval, the user behavior trend coefficient is retrieved, and the user behavior trend coefficient is substituted into the abnormal user behavior trend control interval for comparative analysis. When the user behavior trend coefficient is in the preset abnormal user behavior trend control interval, the user behavior of the user layer is marked as abnormal user behavior, and a user behavior warning signal is generated, and at the same time, it is sent to the display terminal in the form of text; When the user behavior trend coefficient is not in the preset abnormal user behavior trend control interval, the external environment trend coefficient is called up, and the external environment trend coefficient is substituted into the abnormal external environment trend control interval for comparative analysis; when the external environment trend coefficient is in the preset abnormal external environment trend control interval, the external environment of the external layer is calibrated as an abnormal external environment, and an external environment warning signal is generated, and at the same time, it is sent to the display terminal in the form of text.

[0014] Compared with the known prior art, the technical solution provided by the present invention has the following beneficial effects: 1. The present invention, by monitoring the multi-dimensional information of the network layer, user layer and external layer, combined with AI technology, can efficiently analyze and process massive data, and quickly identify potential security threats. In terms of monitoring and evaluating the network operation status, the method constructs a two-dimensional dynamic model of throughput, and realizes intelligent status monitoring and comprehensive evaluation by calculating the throughput smoothing value, delay fluctuation value and abnormal traffic value. At the same time, differentiated evaluation strategies are adopted for user behavior status information of different authority levels to ensure the accuracy of the evaluation results. In the external environment monitoring, the differences in malicious attacks at home and abroad are fully considered, thereby achieving not only comprehensive coverage and comprehensive evaluation of the security situation of sensitive information systems, but also significantly improving the breadth of security monitoring and the depth and accuracy of evaluation, providing strong data support for the security situation monitoring of the system.

[0015] 2. The present invention extracts security value data of different unit time periods within a period of time, and adopts the STL time series decomposition method to quickly calculate the security trend coefficient to determine whether it is necessary to generate a security anomaly signal. After capturing the security anomaly signal, the security status parameters of different unit time periods within a period of time are extracted again, and the corresponding trend coefficient is extracted using the STL time series decomposition method. The coefficient is compared and analyzed with the preset abnormal control interval, and finally a corresponding early warning signal is generated, thereby realizing dynamic evaluation and prediction of the security situation, and being able to perceive and generate early warnings in time before risks occur. This not only shortens the early warning response time, but also significantly improves the accuracy and practicality of the early warning signal, and enhances the dynamic evaluation and prediction capabilities of the security situation of sensitive information systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 It is a flowchart of the overall method of the present invention. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, the AI-based intelligent monitoring method for security situation of sensitive information systems includes the following steps: A1. Collect network operation status information, personnel behavior status information, storage status information and external environment status information, and send each type of information to the cloud database for storage; It should be noted that network operation status information includes: throughput, latency and total traffic; personnel behavior status information includes: absence time, access path deviation value and login deviation value; external environment status information includes: vulnerability quantity data and attack data.

[0020] A2. By monitoring the network operation status information of the network layer, the network operation status of the network layer is analyzed and processed. The specific operation process is as follows: The unit time period is equally divided into i monitoring time points, where i=1, 2, 3…n, and n represents the total number of monitoring time point numbers; Capture the throughput corresponding to the network layer in a unit time period, and use time as the horizontal axis and throughput as the vertical axis to establish a two-dimensional dynamic system of throughput. Use the method of plotting curves to plot the throughput at i monitoring time points on the two-dimensional dynamic system of throughput, thereby obtaining a throughput waveform curve. Get all the inflection points of the throughput waveform curve and record them as j, where j=1, 2, 3…n1, n1 includes n, and calculate the curvature values ​​of the j inflection points, and perform mean calculation and analysis on the curvature values ​​of the j inflection points according to the formula: , and obtain the throughput smoothing value wy1, where gd j Represents the curvature value of each inflection point; It should be pointed out that throughput refers to the number of successfully transmitted data packets, and the curvature value reflects the degree of curvature of the curve at a certain inflection point. The calculation formula for the curvature value is: ,in, The first derivative of the curve, that is, the slope, reflects the speed of change of the curve. It represents the second derivative of the curve, that is, the rate of change of the slope, reflecting the curvature of the curve; Capture the delay corresponding to the network layer in a unit time period and calculate its standard deviation according to the formula: , and obtain the delay fluctuation value wy2, where represents the delay of the ith monitoring time point, Represents the average value of all data, that is, the average value of the network layer delay in a unit time period; Randomly select n2 monitoring time points within the unit time period, and obtain the total traffic volume of the network layer at the corresponding monitoring time point, and compare and analyze the total traffic volume at each monitoring time point with the set total traffic volume threshold. When the total traffic volume is less than the set total traffic volume threshold or the total traffic volume is greater than the set total traffic volume threshold, the total traffic volume at the corresponding monitoring time point is marked as an abnormal state, and the proportion of the n2 monitoring time points marked as abnormal states is calculated and marked as the abnormal traffic value wy3; The values ​​of throughput smoothing value wy1, delay fluctuation value wy2 and abnormal traffic value wy3 are extracted and normalized according to the formula: , and obtain the network operation evaluation value δ1, where η1, η2 and η3 represent the set weight coefficients respectively, and η1<η2<η3.

[0021] A3. By monitoring the user behavior status information of the user layer, the user behavior status of the user layer is analyzed and processed. The specific operation process is as follows: Capture the user behavior status information corresponding to the user layer in the unit time period, the user behavior status information includes the absence time ks, the access path deviation value fz and the login deviation value dz; The time away from the system refers to the total time that the user keeps the system session open without performing any operation (such as mouse movement, click, keyboard input, etc.) after logging into the system. The access path deviation value refers to the degree of deviation between the resource path accessed by the user in the system and the historical conventional access path. The specific solution is: Get the user's current access path sequence P current And the historical regular access path sequence P normal , and the user's current access path sequence P current The historical regular access path sequence P normal Calculated by sequence matching algorithm (such as the longest common subsequence LCS), the specific expression is: , get the difference between the two as the access path deviation value; The login deviation value refers to the degree of deviation between the user's current login behavior and his / her historical normal login mode. The specific solution is: obtain the user's current login behavior feature Lcurrent and the historical feature pattern Lnormal, and calculate the user's current login behavior feature Lcurrent and the historical feature pattern Lnormal through a machine learning model (such as a decision tree algorithm). The specific expression is: , get the difference between the two as the login deviation value; At the same time, the user's permission level is obtained. The permission level includes first-level permission, second-level permission and third-level permission. If the user's permission level is first-level permission, the user's behavior status information is substituted into the calculation formula (1). If the user's permission level is second-level permission, the user's behavior status information is substituted into the calculation formula (2). If the user's permission level is third-level permission, the user's behavior status information is substituted into the calculation formula (3). According to the formula: , get the behavior impact value yxz, where e represents a natural constant, f1, f2, f3, f4, f5, f6, f7, f8 and f9 represent set weight coefficients, and f1>f2>f3, f4>f5>f6, f7>f8>f9, f1+f2+f3>f4+f5+f6>f7+f8+f9, qx1, qx2 and qx3 represent set authority level coefficients, and qx1>qx2>qx3; Compare and analyze the user's behavior impact value with a preset behavior impact threshold. When the user's behavior impact value is greater than or equal to the preset behavior impact threshold, the user is determined to be in an abnormal state. When the user's behavior impact value is less than the preset behavior impact threshold, the user is determined to be in a normal state. The number of users who are judged to be in abnormal state in the first-level authority, second-level authority and third-level authority is counted respectively, thereby obtaining the first-level abnormal number value, the second-level abnormal number value and the third-level abnormal number value, and marking them as sanm1, sanm2 and sanm3 respectively, according to the formula: , and obtain the user behavior evaluation value δ2, where η4, η5 and η6 represent the set weight coefficients respectively, and η4>η5>η6.

[0022] A4. By monitoring the external environment status information of the external layer, the external environment status of the external layer is analyzed and processed. The specific operation process is as follows: Capture the vulnerability number data corresponding to the external layer in a unit time period, and extract the maximum vulnerability number, the middle vulnerability number, and the minimum vulnerability number from the vulnerability number data to calculate the average value, and obtain the average vulnerability number as the reference vulnerability number corresponding to the external layer in a unit time period; The maximum number of vulnerabilities, the middle number of vulnerabilities, the minimum number of vulnerabilities, and the reference number of vulnerabilities are marked as kd max , kd mzn , kd min and kd * , where the median number of vulnerabilities is to sort the vulnerability data corresponding to the external layer in a unit time period in order from large to small, and extract the number of vulnerabilities corresponding to the median as the median number of vulnerabilities; According to the formula: , and obtain the vulnerability fluctuation value wj1, where q1, q2 and q3 represent the set correction coefficients respectively; Capture the attack data corresponding to the external layer within a unit time period, and extract all malicious attack IP address lists from the attack data. According to the geographical information of the IP address (such as through the IP address library or GeoIP service), the IP addresses are divided into two categories: foreign malicious attack IP address list ip_foreign={ip1, ip2, ...}, domestic malicious attack IP address list ip_domestic={ip1, ip2, ...}; Count the number of IP addresses in the two categories within a unit time period and get the number of foreign malicious attack IPs N foreign And the number of domestic malicious attack IPs N domestic ; The attack frequencies of the two categories in a unit time period are calculated. The specific calculation formula is: , and obtain the foreign attack frequency F foreign and domestic attack frequency F domestic , where f0 represents the number of foreign malicious attack IP addresses, do represents the number of domestic malicious attack IP addresses, and F ipfo Indicates a foreign malicious attack IP address fo The number of attacks, F ipdo Indicates domestic malicious attack IP address do Number of attacks; According to the formula: , get the attack strength value wj2, where p1, p2, p3, and p4 represent the weight coefficients of the proportion of foreign malicious attack IPs, the proportion of foreign attack frequency, the proportion of domestic malicious attack IPs, and the proportion of domestic attack frequency, respectively, and p1<p2, p3<p4, p1+p2>p3+p4, b1 and b2 represent the proportion coefficients of the foreign attack assessment index and the domestic attack assessment index, respectively, and b1>b2; Extract the values ​​of vulnerability fluctuation value wj1 and attack strength value wj2 for normalization according to the formula: , and obtain the external environment evaluation value δ3, where η7 and η8 represent the set weight coefficients respectively, and η7<η8.

[0023] A5. By monitoring the security status parameters, the security trend status within a period of time is analyzed and processed. The security status parameters include the network operation evaluation value, the user behavior evaluation value and the external environment evaluation value. The specific operation process is as follows: By extracting the network operation evaluation value δ1, user behavior evaluation value δ2 and external environment evaluation value δ3 in the security status parameters within a unit time period, normalization is performed according to the formula: , and obtain the safety value AQP, where γ1, γ2 and γ3 represent the preset proportional factors respectively; Extract the safety values ​​of different unit time periods within a period of time as the safety value data for a period of time, and determine the safety trend coefficient based on the safety value data for a period of time; In an embodiment of the present invention, determining a safety trend coefficient according to safety value data for a period of time includes: sorting the safety value data for a period of time in a time series order to obtain a safety value sequence, performing time series decomposition on the safety value sequence based on an STL time series decomposition method, and obtaining a slope of a trend item as a safety trend coefficient; Among them, the seasonal and trend decomposition using Loess (STL) method is a time series decomposition technique that uses robust local weighted regression as a smoothing method, which can decompose the time series into corresponding trend terms, seasonal terms and residual terms. The STL time series decomposition method is a time series decomposition method well known in the art and will not be described in detail. By performing STL time series decomposition on the safety value sequence, the corresponding trend item curve is obtained. Subsequently, the slope of the trend item is used as the safety trend coefficient. Since the trend item can represent the overall trend of the corresponding time series, the slope of the trend item can represent the change trend of the safety value data for a period of time. Therefore, the safety trend coefficient can represent the change trend of the safety value data for a period of time. The safety trend coefficient is compared and analyzed with the preset safety trend threshold. When the safety trend coefficient is less than the preset safety trend threshold, a safety abnormal signal is generated; otherwise, a safety normal signal is generated.

[0024] A6. If a security anomaly signal is captured, the network operation evaluation values ​​of different unit time periods within a period of time are retrieved as the network operation evaluation value data for a period of time, and the network operation trend coefficient is determined based on the network operation evaluation value data for a period of time; Substitute the network operation trend coefficient into the abnormal network operation trend control interval for comparative analysis. When the network operation trend coefficient is in the preset abnormal network operation trend control interval, the network operation of the network layer is marked as abnormal network operation, and a network early warning signal is generated. At the same time, the text "the current system network layer has an abnormal trend and needs maintenance" is sent to the display terminal for display explanation; When the network operation trend coefficient is not in the preset abnormal network operation trend control interval, the user behavior evaluation values ​​of different unit time periods within a period of time are retrieved as the user behavior evaluation value data for a period of time, and the user behavior trend coefficient is determined according to the user behavior evaluation value data for a period of time; Substituting the user behavior trend coefficient into the abnormal user behavior trend control interval for comparative analysis, when the user behavior trend coefficient is in the preset abnormal user behavior trend control interval, the user behavior of the user layer is marked as abnormal user behavior, and a user behavior warning signal is generated. At the same time, the text "the current system user layer has an abnormal trend and needs maintenance" is sent to the display terminal for display explanation; When the user behavior trend coefficient is not in the preset abnormal user behavior trend control interval, the external environment evaluation values ​​of different unit time periods within a period of time are retrieved as the external environment evaluation value data for a period of time, and the external environment trend coefficient is determined according to the external environment evaluation value data for a period of time; Substitute the external environment trend coefficient into the abnormal external environment trend control interval for comparative analysis. When the external environment trend coefficient is in the preset abnormal external environment trend control interval, the external environment of the external layer is marked as an abnormal external environment, and an external environment early warning signal is generated. At the same time, the text "the current system external layer has an abnormal trend and requires maintenance" is sent to the display terminal for display; It should be noted that the calculation method of the network operation trend coefficient, the user behavior trend coefficient and the external environment trend coefficient is the same as the calculation method of the security trend coefficient.

[0025] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. An AI-based intelligent monitoring method for security situation of sensitive information systems, including collecting various types of information and sending them to a cloud database for storage, characterized in that: By monitoring the network operation status information of the network layer, the throughput smoothing value, delay fluctuation value and abnormal traffic value are obtained, thereby determining the network operation evaluation value; By monitoring the user behavior status information of the user layer, the behavior impact value is obtained, thereby determining the user behavior evaluation value; By monitoring the external environment status information of the external layer, the vulnerability fluctuation value and attack strength value are obtained, thereby determining the external environment assessment value; Based on the network operation evaluation value, user behavior evaluation value and external environment evaluation value, the security value is determined; Extract the safety values ​​of different unit time periods within a period of time as the safety value data for a period of time, determine the safety trend coefficient based on the safety value data for a period of time, and compare and analyze the safety trend coefficient with the safety trend threshold to determine whether to generate a safety abnormality signal; If a safety abnormality signal is captured, the safety status parameters of different unit time periods within a period of time are retrieved respectively as the safety status parameter data for a period of time. The corresponding trend coefficient is determined based on the safety status parameter data for a period of time, and the trend coefficient is substituted into the corresponding abnormal control interval for comparative analysis, thereby generating a corresponding early warning signal.

2. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: Monitor the network operation status information of the network layer. The specific process is as follows: Capture the throughput corresponding to the network layer in a unit time period, and use time as the horizontal axis and throughput as the vertical axis to establish a two-dimensional dynamic system of throughput. Use the point plotting curve construction method to plot the throughput on the two-dimensional dynamic system of throughput, thereby obtaining a throughput waveform curve. Obtain all inflection points of the throughput waveform curve, calculate the curvature values ​​of the inflection points, and perform mean calculation and analysis on the curvature values ​​of all inflection points to obtain the throughput smoothing value wy1; Capture the delay corresponding to the network layer within a unit time period, and calculate its standard deviation to obtain the delay fluctuation value wy2; Randomly select n2 monitoring time points within the unit time period, and obtain the total traffic volume of the network layer at the corresponding monitoring time point, and compare and analyze the total traffic volume at each monitoring time point with the set total traffic volume threshold. When the total traffic volume is less than the set total traffic volume threshold or the total traffic volume is greater than the set total traffic volume threshold, the total traffic volume at the corresponding monitoring time point is marked as an abnormal state, and the proportion of the n2 monitoring time points marked as abnormal states is calculated, and it is marked as the abnormal traffic value wy3.

3. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 2 is characterized in that: The specific process of determining the network operation evaluation value is as follows: The values ​​of throughput smoothing value wy1, delay fluctuation value wy2 and abnormal traffic value wy3 are extracted and normalized according to the formula: , and obtain the network operation evaluation value δ1, where η1, η2 and η3 represent the set weight coefficients respectively, and η1<η2<η3.

4. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: Monitor the user behavior status information at the user layer. The specific process is as follows: Capture the user behavior status information corresponding to the user layer in a unit time period. The user behavior status information includes the absence time, access path deviation value and login deviation value. The time away from the system refers to the total time that the user does not perform any operation and keeps the system session open. The access path deviation value refers to the value calculated by using a sequence matching algorithm to compare the user's current access path sequence with the historical regular access path sequence; The login deviation value refers to the value calculated by the machine learning model by combining the user's current login behavior characteristics with the historical feature patterns; At the same time, the user's authority level is obtained, and the user's behavior status information is substituted into the calculation formula corresponding to the authority level to obtain the behavior impact value, where the authority level includes first-level authority, second-level authority and third-level authority.

5. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 4 is characterized in that: The specific process of determining the user behavior evaluation value is as follows: Compare and analyze the user's behavior impact value with a preset behavior impact threshold. When the user's behavior impact value is greater than or equal to the preset behavior impact threshold, the user is determined to be in an abnormal state; otherwise, the user is determined to be in a normal state. The number of users who are judged to be in abnormal state in the first-level authority, second-level authority and third-level authority is counted respectively, thereby obtaining the first-level abnormal number value, the second-level abnormal number value and the third-level abnormal number value, and marking them as sanm1, sanm2 and sanm3 respectively, according to the formula: , and obtain the user behavior evaluation value δ2, where η4, η5 and η6 represent the set weight coefficients respectively, and η4>η5>η6.

6. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: Monitor the external environment status information of the external layer. The specific process is as follows: Capture the vulnerability number data corresponding to the external layer in a unit time period, and extract the maximum vulnerability number, the middle vulnerability number, and the minimum vulnerability number from the vulnerability number data to calculate the average value, and obtain the average vulnerability number as the reference vulnerability number corresponding to the external layer in a unit time period; Based on the maximum number of vulnerabilities, the middle number of vulnerabilities, the minimum number of vulnerabilities and the reference number of vulnerabilities, the vulnerability fluctuation value wj1 is determined; Capture the attack data corresponding to the external layer within a unit time period, and extract the list of all malicious attack IP addresses from the attack data; Count the number of foreign malicious attack IPs and domestic malicious attack IPs within a unit time period; Based on the number of foreign malicious attack IPs, the number of domestic malicious attack IPs, the foreign attack frequency and the domestic attack frequency, the attack strength value wj2 is determined.

7. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 6 is characterized in that: The specific process of determining the external environment assessment value is as follows: Extract the values ​​of vulnerability fluctuation value wj1 and attack strength value wj2 for normalization according to the formula: , and obtain the external environment evaluation value δ3, where η7 and η8 represent the set weight coefficients respectively, and η7<η8.

8. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: The specific process of determining the safety value is as follows: By extracting the network operation evaluation value δ1, user behavior evaluation value δ2 and external environment evaluation value δ3 in the security status parameters within a unit time period, normalization is performed according to the formula: , and obtain the safety value AQP, where γ1, γ2 and γ3 represent the preset proportional factors respectively.

9. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: The specific process of determining the safety trend factor is as follows: The safety value data of a period of time are sorted in chronological order to obtain a safety value sequence. The safety value sequence is decomposed in time series based on the STL time series decomposition method to obtain the slope of the trend item as the safety trend coefficient.

10. The AI-based intelligent monitoring method for security situation of sensitive information systems according to claim 1 is characterized in that: The specific process of generating the corresponding warning signal is as follows: Substituting the network operation trend coefficient into the abnormal network operation trend control interval for comparative analysis, when the network operation trend coefficient is in the preset abnormal network operation trend control interval, the network operation of the network layer is marked as abnormal network operation, and a network early warning signal is generated, and at the same time, it is sent to the display terminal in the form of text; When the network operation trend coefficient is not in the preset abnormal network operation trend control interval, the user behavior trend coefficient is retrieved, and the user behavior trend coefficient is substituted into the abnormal user behavior trend control interval for comparative analysis. When the user behavior trend coefficient is in the preset abnormal user behavior trend control interval, the user behavior of the user layer is marked as abnormal user behavior, and a user behavior warning signal is generated, and at the same time, it is sent to the display terminal in the form of text; When the user behavior trend coefficient is not in the preset abnormal user behavior trend control interval, the external environment trend coefficient is called up, and the external environment trend coefficient is substituted into the abnormal external environment trend control interval for comparative analysis; when the external environment trend coefficient is in the preset abnormal external environment trend control interval, the external environment of the external layer is calibrated as an abnormal external environment, and an external environment warning signal is generated, and at the same time, it is sent to the display terminal in the form of text.

Images