Internet security management and control system based on AI

Abstract

The invention relates to network security management, and particularly discloses an Internet security management and control system based on AI, which comprises a data collection module used for collecting logs and data traffic of network equipment, a server and an application program in real time; the data preprocessing module is used for cleaning, formatting and classifying the collected data so as to extract related features; the intelligent analysis module is used for analyzing the preprocessed data based on a machine learning algorithm and a deep learning algorithm, and comparing analysis results in an expert knowledge base so as to identify potential danger codes; and the decision-making and response module automatically generates response measures according to the obtained danger codes, and the response measures comprise alarm giving, affected system isolation and access control enhancement. The problem that a traditional security system often depends on fixed rules and patches to cope with known threats is solved, and self-adaptive recognition and coping of novel threats are achieved through machine learning and deep learning algorithms.

Description

Technical Field

[0001] The present invention relates to network security management, and in particular to an AI-based Internet security management and control system. Background Art

[0002] With the rapid development of Internet technology, network security issues have become increasingly prominent. Network attacks, data leaks, system crashes and other incidents have occurred frequently, causing serious losses to individuals, enterprises and countries. Therefore, effective Internet security management and control is of great significance to maintaining the stability of the network environment and protecting user privacy and property safety.

[0003] Publication (announcement) number: CN105575019A, Publication (announcement) date: 2016-05-11, an anti-intrusion security monitoring device is disclosed, including a pulse electronic fence system, a transmitting controller, an information transmission cable and a security monitoring terminal, the pulse electronic fence system includes a pulse electronic fence host, a front detection fence connected to the pulse electronic fence host, and a warning stick and a GPS unit installed on the front detection fence; the transmitting controller includes a signal multiplexer connected to the pulse electronic fence host, an intelligent processing controller connected to the signal multiplexer, and a first network port and a buzzer connected to the intelligent processing controller; the security monitoring terminal includes a microprocessor controller, and a second network port, a memory and a monitor connected to the microprocessor controller, and the first network port and the second network port exchange information data through an information transmission cable. The present invention can reduce the patrol workload of police officers, and can send out an alarm signal to remind staff to pay attention to repairs to prevent monitoring failures.

[0004] Publication (announcement) number: CN117811802A, publication (announcement) date: 2024-04-02, a network security monitoring system is disclosed, the system comprising: an information processing module for collecting and processing confirmed or suspected attack information data; a model training module for training an attack information recognition model according to the attack information data; a security monitoring module for connecting network interaction information to a corresponding network system according to the prediction results of the attack information recognition model, and initiating a corresponding level of early warning; a model optimization module for analyzing attack information data and optimizing the system model; the present invention uses an attack information recognition model to identify and divert network interaction information, and performs data collection and behavior analysis on attack information through a comprehensive honeypot system that combines a low-interaction honeypot and a partially activated high-interaction honeypot. Compared with the traditional honeypot system, the present invention saves human resources and computer resources while improving the efficiency of system monitoring and processing network attacks.

[0005] In the prior art including the above-mentioned patents, many programs and algorithms at this stage are based on specific algorithm cores and cannot flexibly change and adapt to potential dangers. Therefore, patches are added to new and existing dangers. It is impossible to make corresponding flexible changes according to changes in network status. Therefore, background personnel are required to conduct real-time monitoring and timely correction generation to fix this vulnerability. Summary of the invention

[0006] The purpose of the present invention is to provide an AI-based Internet security management and control system to solve the above problems.

[0007] In order to achieve the above-mentioned purpose, the present invention provides the following technical solution: an AI-based Internet security management and control system, comprising:

[0008] Data collection module, which is used to collect logs and data traffic of network devices, servers and applications in real time;

[0009] Data preprocessing module, used to clean, format and classify the collected data to extract relevant features;

[0010] Intelligent analysis module, which analyzes pre-processed data based on machine learning algorithms and deep learning algorithms, and compares the analysis results with the expert knowledge base to identify potentially dangerous codes;

[0011] The decision-making and response module automatically generates response measures according to the acquired dangerous code, and the response measures include issuing an alarm, isolating the affected system and enhancing access control.

[0012] Preferably, the data collection module comprises:

[0013] Traffic monitoring unit, capable of capturing and recording data packets on the network, including source IP, destination IP, port number, protocol type, and transmitted data content;

[0014] Intrusion detection identification unit, based on the log activity of the IDS application, to identify potential malicious behavior in the log activity;

[0015] The user behavior analysis unit obtains unauthorized access and data leakage attempts in daily user access behavior.

[0016] Preferably, the data cleaning in the data preprocessing module includes: preliminary screening and classification of the acquired log data, and then implementing it through keyword filtering, regular expression matching, etc., to quickly identify entries that may contain sensitive or dangerous information;

[0017] Duplicate or redundant entries were identified and removed to ensure that the data analyzed were unique and accurate.

[0018] Preferably, the data preprocessing module performs formatting and classification on the cleaned data, including: identifying the format of the analyzed data, converting the data in different formats into a standard format, and then arranging the data in a certain order according to the logical relationship of the data;

[0019] Based on the autoencoder feature extraction method and convolutional neural network, the above-arranged data is extracted and mapped to the [0,1] interval. Then, potential threats should be identified with the help of the knowledge of security experts through automatic analysis of difficult-to-judge data.

[0020] Preferably, the machine learning algorithm is a logistic regression algorithm, and the deep learning algorithm uses a long short-term memory network LSTM.

[0021] Preferably, the establishment of the intelligent analysis model in the intelligent analysis module includes:

[0022] Extract key features from the arranged data given by the data preprocessing module and construct new features as needed;

[0023] Convert characteristic semi-structured or unstructured log data into a structured format;

[0024] For log security analysis tasks, we then automatically learn the feature representations and potential regularities in the log data;

[0025] Divide the preprocessed log data into training set and test set;

[0026] The selected model is trained using the training set data, and during the training process, the model parameters are adjusted.

[0027] Preferably, the trained intelligent analysis model is evaluated using test set data, the false alarm rate and false negative rate of the model are analyzed through a confusion matrix, and unimportant features are removed to reduce noise and improve the generalization ability of the model.

[0028] In the above technical solution, the present invention provides an AI-based Internet security management and control system, which has the following beneficial effects:

[0029] 1. It can capture the logs and data traffic of network devices, servers and applications in real time to ensure seamless coverage and immediate response of security monitoring. Then, by using advanced machine learning and deep learning algorithms, it can quickly process massive data and identify potential security threats, greatly shortening the time window for threat detection.

[0030] 2. Unlike traditional security systems based on static rules or patches, this system can dynamically learn and adapt to changes in network status, automatically identify and respond to new threats, and continuously optimize security policies without human intervention. And through comparison and verification of expert knowledge bases, the system can continuously improve its ability to identify complex threats and achieve truly intelligent security management and control.

[0031] 3. Deep cleaning and feature extraction of raw data effectively reduces the interference of noise data and improves the accuracy of analysis results. Based on complex algorithm models, it can accurately identify potential dangerous codes, reduce false positives and false negatives, and provide a reliable basis for safety decisions.

[0032] 4. It can automatically generate and execute response measures, such as issuing alarms, isolating affected systems, and enhancing access control, realizing the automation and efficient coordination of security incident processing, which not only reduces the workload of security personnel, but also improves the speed and efficiency of emergency response, ensuring the continuity and stability of network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0034] Figure 1 Provide a module diagram for an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of a data collection module provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] like Figure 1 As shown, an AI-based Internet security management and control system includes:

[0038] Data collection module, which is used to collect logs and data traffic of network devices, servers and applications in real time;

[0039] Data preprocessing module, used to clean, format and classify the collected data to extract relevant features;

[0040] Intelligent analysis module, which analyzes pre-processed data based on machine learning algorithms and deep learning algorithms, and compares the analysis results with the expert knowledge base to identify potentially dangerous codes;

[0041] The decision and response module automatically generates response measures based on the acquired dangerous codes. The response measures include issuing alarms, isolating affected systems, and enhancing access controls.

[0042] In the embodiment, the machine learning algorithm is a logistic regression algorithm, and the deep learning algorithm uses a long short-term memory network LSTM.

[0043] The above technology is different from traditional security systems based on static rules or patches. The system can dynamically learn and adapt to changes in network status, automatically identify and respond to new threats, and continuously optimize security policies without human intervention. And through the comparison and verification of expert knowledge bases, the system can continuously improve its ability to identify complex threats and achieve true intelligent security management and control. It can also automatically generate and execute response measures, such as issuing alarms, isolating affected systems, and enhancing access control, realizing the automation and efficient coordination of security incident processing, which not only reduces the workload of security personnel, but also improves the speed and efficiency of emergency response, ensuring the continuity and stability of network security.

[0044] Example 2

[0045] Combination Figure 2 It can be seen that the data collection module in the above embodiment includes:

[0046] Traffic monitoring unit, which can capture and record data packets on the network, including source IP, destination IP, port number, protocol type and transmitted data content;

[0047] Intrusion detection identification unit, based on the log activity of the IDS application, to identify potential malicious behavior in the log activity;

[0048] The user behavior analysis unit obtains unauthorized access and data leakage attempts in daily user access behavior.

[0049] The above technologies can capture the logs and data traffic of network devices, servers and applications in real time, ensuring seamless coverage and immediate response of security monitoring. Then, by using advanced machine learning and deep learning algorithms, they can quickly process massive amounts of data, identify potential security threats, and greatly shorten the time window for threat detection.

[0050] Example 3

[0051] Based on the first embodiment, the data cleaning in the data preprocessing module recorded in this example includes: preliminary screening and classification of the acquired log data, and then implementing it through keyword filtering, regular expression matching, etc., to quickly identify entries that may contain sensitive or dangerous information;

[0052] Duplicate or redundant entries were identified and removed to ensure that the data analyzed were unique and accurate.

[0053] In the above embodiment, the original data is deeply cleaned and features are extracted, which effectively reduces the interference of noise data and improves the accuracy of the analysis results.

[0054] Example 4

[0055] Based on the first embodiment, the data preprocessing module recorded in this example performs formatting and classification on the cleaned data, including: identifying the format of the analyzed data, converting the data of different formats into a standard format, and then arranging the data in a certain order according to the logical relationship of the data;

[0056] Based on the autoencoder feature extraction method and convolutional neural network, the above-arranged data is extracted and mapped to the [0,1] interval. Then, potential threats should be identified with the help of the knowledge of security experts through automatic analysis of difficult-to-judge data.

[0057] Example 4

[0058] Based on the first embodiment, the establishment of the intelligent analysis model in the intelligent analysis module recorded in this example includes:

[0059] Extract key features from the permutation data given by the data preprocessing module and construct new features as needed;

[0060] Convert characteristic semi-structured or unstructured log data into a structured format;

[0061] For log security analysis tasks, we then automatically learn the feature representations and potential regularities in the log data;

[0062] Divide the preprocessed log data into training set and test set;

[0063] The selected model is trained using the training set data, and during the training process, the model parameters are adjusted.

[0064] Furthermore, the trained intelligent analysis model is evaluated using the test set data, the false alarm rate and false negative rate of the model are analyzed through the confusion matrix, and unimportant features are removed to reduce noise and improve the generalization ability of the model.

[0065] The above technology, based on complex algorithm models, can accurately identify potentially dangerous codes, reduce false positives and missed positives, and provide a reliable basis for security decision-making.

[0066] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0067] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0068] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0069] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0070] The present invention uses specific embodiments to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0071] The embodiments of the present application also provide a specific implementation of an electronic device capable of implementing all steps of the method in the above embodiments, and the electronic device specifically includes the following contents:

[0072] Processor, memory, communications interface and bus;

[0073] Wherein, the processor, memory, and communication interface communicate with each other via the bus;

[0074] The processor is used to call the computer program in the memory, and when the processor executes the computer program, all the steps in the method in the above embodiment are implemented.

[0075] The embodiments of the present application also provide a computer-readable storage medium capable of implementing all the steps of the method in the above embodiments, wherein a computer program is stored on the computer-readable storage medium, and when the computer program is executed by a processor, all the steps of the method in the above embodiments are implemented.

[0076] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the hardware + program embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Although the embodiment of this specification provides the method operation steps described in the embodiment or flow chart, more or less operation steps can be included based on conventional or non-creative means. The order of steps listed in the embodiment is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiment or the accompanying drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or device including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or device. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or device including the elements. For the convenience of description, the above device is described by dividing it into various modules according to its functions. Of course, when implementing the embodiments of this specification, the functions of each module can be implemented in the same one or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the coupling or direct coupling or communication connection between each other shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms. The present invention is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiments of the present invention. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the process Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0077] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, the embodiments of this specification may be in the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes. Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts refer to the partial description of the method embodiment. In the description of this specification, the description of the reference term "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the embodiment of this specification.

[0078] In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradicting each other. The above is only an embodiment of the embodiment of this specification and is not intended to limit the embodiment of this specification. For those skilled in the art, the embodiment of this specification may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiment of this specification shall be included in the scope of the claims of the embodiment of this specification.

Claims

1. An AI-based Internet security management and control system, characterized in that: include: Data collection module, which is used to collect logs and data traffic of network devices, servers and applications in real time; Data preprocessing module, used to clean, format and classify the collected data to extract relevant features; Intelligent analysis module, which analyzes pre-processed data based on machine learning algorithms and deep learning algorithms, and compares the analysis results with the expert knowledge base to identify potentially dangerous codes; The decision-making and response module automatically generates response measures according to the acquired dangerous code, and the response measures include issuing an alarm, isolating the affected system and enhancing access control.

2. According to claim 1, an AI-based Internet security management and control system is characterized in that: The data collection module comprises: Traffic monitoring unit, capable of capturing and recording data packets on the network, including source IP, destination IP, port number, protocol type, and transmitted data content; Intrusion detection identification unit, based on the log activity of the IDS application, to identify potential malicious behavior in the log activity; The user behavior analysis unit obtains unauthorized access and data leakage attempts in daily user access behavior.

3. According to the AI-based Internet security management and control system of claim 1, it is characterized in that: The data cleaning in the data preprocessing module includes: preliminary screening and classification of the acquired log data, and then implementing it through keyword filtering, regular expression matching, etc., to quickly identify entries that may contain sensitive or dangerous information; Duplicate or redundant entries were identified and removed to ensure that the data analyzed were unique and accurate.

4. According to the AI-based Internet security management and control system of claim 1, it is characterized in that: The data preprocessing module performs formatting and classification on the cleaned data, including: identifying the format of the analyzed data, converting the data in different formats into a standard format, and then arranging the data in a certain order according to the logical relationship of the data; Based on the autoencoder feature extraction method and convolutional neural network, the above-arranged data is extracted and mapped to the [0,1] interval. Then, potential threats should be identified with the help of the knowledge of security experts through automatic analysis of difficult-to-judge data.

5. The AI-based Internet security management and control system according to claim 1 is characterized in that: The machine learning algorithm is a logistic regression algorithm, while the deep learning algorithm uses a long short-term memory network LSTM.

6. The AI-based Internet security management and control system according to claim 1 is characterized in that: The establishment of the intelligent analysis model in the intelligent analysis module includes: Extract key features from the arranged data given by the data preprocessing module and construct new features as needed; Convert characteristic semi-structured or unstructured log data into a structured format; For log security analysis tasks, we then automatically learn the feature representations and potential regularities in the log data; Divide the preprocessed log data into training set and test set; The selected model is trained using the training set data, and during the training process, the model parameters are adjusted.

7. The AI-based Internet security management and control system according to claim 6 is characterized in that: The trained intelligent analysis model is evaluated using the test set data, the false alarm rate and false negative rate of the model are analyzed through the confusion matrix, and unimportant features are removed to reduce noise and improve the generalization ability of the model.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the AI-based Internet security management and control system according to any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the AI-based Internet security management and control system described in any one of claims 1 to 7 are implemented.

Images