AI-driven information security big data supervision method and system

Abstract

The invention discloses an AI-driven information security big data supervision method and system, and relates to the technical field of data supervision. Comprising the following steps: receiving data streams from different sources in real time, preprocessing the data streams, performing multi-dimensional dynamic label processing, and storing the data streams in different nodes in a distributed manner; calling an adaptive AI model for the distributed storage data in real time, and automatically adjusting parameters of the adaptive AI model based on the traffic change condition; when the adaptive AI model monitors an abnormal data stream, performing secondary intelligent grading analysis, and judging the type, the source and the potential threat level of the abnormality; when a high-risk anomaly is detected, an event-driven response mechanism is automatically triggered; and an event response result and a processing state are fed back to the adaptive AI model, and learning parameters and decision logic of the model are optimized. Under the support of multi-dimensional dynamic label processing, mass data streams can be flexibly and efficiently processed.

Description

Technical Field

[0001] The present invention relates to the field of data supervision technology, and in particular to an AI-driven information security big data supervision method and system. Background Art

[0002] With the rapid development of information technology and the acceleration of the dataization process, the amount of global data has exploded. Information security big data supervision technology has become the core content of data security management, and has been widely used in many key fields such as network security, financial security, and industrial control systems. Traditional information security technology mainly relies on static rules and feature matching methods to monitor network traffic and data access behavior. With the growth of data volume, the diversification of data sources, and the increasing complexity of attack methods, traditional monitoring methods have gradually become unable to cope with the potential complex threats in massive data streams.

[0003] In recent years, information security big data supervision methods based on artificial intelligence (AI) have emerged and received widespread attention. By combining multi-dimensional dynamic label information, AI-driven information security supervision technology can conduct in-depth analysis of various abnormal behaviors in data streams.

[0004] However, current AI-driven technologies have certain limitations in large-scale distributed data storage environments. In particular, it is difficult to automatically adjust model parameters based on traffic changes at different nodes, resulting in poor adaptability of the model to real-time anomalies. At the same time, existing technical means often lack an automated feedback mechanism for events when triggering response mechanisms for high-risk anomalies, making it impossible to continuously optimize model parameters and decision logic, resulting in poor response effects when facing new threats. Summary of the invention

[0005] In view of the problems existing in the current AI driving technology, the present invention is proposed.

[0006] Therefore, the present invention aims to solve the problem that the prior art has insufficient adaptability and real-time response capability to abnormal behavior monitoring in complex environments.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In the first aspect, an embodiment of the present invention provides an AI-driven information security big data supervision method, which includes receiving data streams from different sources in real time, preprocessing the data streams, and performing multi-dimensional dynamic label processing, and distributed storage in different nodes; calling an adaptive AI model for the distributed stored data in real time, and automatically adjusting the parameters of the adaptive AI model based on traffic changes; when the adaptive AI model detects abnormal data streams, performing secondary intelligent hierarchical analysis to determine the type, source and potential threat level of the anomaly; when a high-risk anomaly is detected, automatically triggering an event-driven response mechanism; and feeding back the event response results and processing status to the adaptive AI model to optimize the model's learning parameters and decision logic.

[0009] As a preferred solution of the AI-driven information security big data supervision method described in the present invention, the multi-dimensional dynamic label processing includes: defining data source labels, time labels and sensitivity level labels, assigning each data stream to a corresponding label group, and recording them through a distributed storage system; on the basis of basic labels, dynamic label assignment is performed according to the traffic fluctuations of the data stream during transmission to form traffic dynamic labels; on the basis of the traffic dynamic labels, geographic location labels and associated risk labels are added, and labels are assigned according to the geographical location of the data source and historical risk indicators; after the above label assignments are completed, a multi-dimensional label information set is called; when calling the multi-dimensional label information, data flow positioning of potential risk clusters is achieved according to risk levels and geographic locations.

[0010] As a preferred solution of the AI-driven information security big data supervision method described in the present invention, the multidimensional label information set includes a basic label set, a traffic change label, a geographic location label, and an associated risk label; the basic label set includes a data source label, a time label, and a sensitivity level label.

[0011] As a preferred solution of the AI-driven information security big data supervision method described in the present invention, the real-time calling of the adaptive AI model for the distributed storage data and the automatic adjustment of the model parameters based on the traffic changes include the following operation steps: calling the multidimensional label information set from the distributed storage node in real time, introducing the data flow into the edge computing node according to the traffic changes and the dynamic factors in the multidimensional label, and performing preliminary filtering and processing on the low-risk data flow at the edge; for the high-priority data flow, by calling the adaptive AI model, the current label data is used as the input of the adaptive AI model, the current data environment changes are automatically identified, and the preliminary parameters of the adaptive AI model are adjusted; the adaptive AI model combines the sensitivity level and associated risk information in the label to perform risk grading operations on the data flow, determine the preliminary risk level of the data flow, and grade and optimize the model detection accuracy based on the preliminary risk level; the preliminarily screened high-risk data flow is introduced into the hierarchical anomaly detection, and the anomaly detection logic of different depths is called according to the risk level, and the data flow is fine-grained. Analysis, identify potential subtle abnormal patterns or abnormal associations across data flows.

[0012] As a preferred solution of the AI-driven information security big data supervision method of the present invention, the calling of anomaly detection logic of different depths according to risk level includes: introducing multi-level detection logic for high-risk data streams, and setting levels, each layer corresponding to different detection depths and algorithms; extracting features for each detection layer; using correlation detection to analyze the correlation between different data streams at the high level, wherein the correlation formula is expressed as:

[0013]

[0014] Among them, ρ x,y is the correlation coefficient between data streams x and y, cov(x,y) is the covariance, σ x and σ y are the standard deviations of the two data streams respectively.

[0015] As a preferred solution of the AI-driven information security big data supervision method described in the present invention, the secondary intelligent hierarchical analysis includes: preliminarily classifying the data stream; performing correlation analysis on the abnormal data stream after the preliminary classification, deeply mining the abnormal events in combination with the cross-stream label information, and automatically identifying the potential risk sources behind the abnormal events and the associated abnormal behavior patterns from the label association relationship; after completing the correlation analysis, the abnormal events are graded according to the risk level, using a fine-grained multi-dimensional dynamic label weight adjustment mechanism; according to the graded label weights, the detection and analysis depth of the adaptive AI model is adjusted in real time.

[0016] As a preferred solution of the AI-driven information security big data supervision method of the present invention, the association analysis includes: comparing the multi-dimensional labels of the abnormal data flow with the labels of other flow data, and calculating the label similarity:

[0017]

[0018] Among them, ρ ass (x, y) is the label similarity score, which is used for correlation determination. i and i is the i-th label score of data stream x and y, μ x and μ y is the label mean of data streams x and y, and n represents the number of label samples; the formula for adjusting the multi-dimensional dynamic label weight is:

[0019] ω adj =ω ini +λΔR risk

[0020] Among them, ω adj is the adjusted label weight, ω ini is the initial weight of the label, λ is the dynamic adjustment coefficient, ΔR risk is the risk level difference, that is, the difference between the current risk level and the basic level; the adaptive adjustment formula of the detection and analysis depth is as follows:

[0021]

[0022] Among them, d depth is the analysis depth of the current detection, d base is the basic detection depth, k is the detection depth adjustment coefficient, is the sum of the total label weights, which is used to standardize the analysis depth, and m represents the number of data label types.

[0023] In the second aspect, an embodiment of the present invention provides an AI-driven information security big data supervision system, which includes: a data stream processing module, which is used to receive data streams from different sources in real time, pre-process the data streams, and perform multi-dimensional dynamic label processing, and store them in different nodes in a distributed manner; an adaptive AI model calling module, which is used to call the adaptive AI model in real time for the distributed stored data, and automatically adjust the parameters of the adaptive AI model based on the traffic changes; an anomaly monitoring and intelligent grading analysis module, which is used to perform secondary intelligent grading analysis when the adaptive AI model detects abnormal data streams, and determine the type, source and potential threat level of the anomaly; an event response mechanism triggering module, which is used to automatically trigger an event-driven response mechanism when a high-risk anomaly is detected; a feedback and optimization module, which is used to feed back the event response results and processing status to the adaptive AI model, and optimize the learning parameters and decision logic of the model.

[0024] In a third aspect, an embodiment of the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program instructions are executed by the processor, the steps of the AI-driven information security big data supervision method as described in the first aspect of the present invention are implemented.

[0025] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program instructions are executed by a processor, the steps of the AI-driven information security big data supervision method as described in the first aspect of the present invention are implemented.

[0026] The beneficial effects of the present invention are as follows: the present invention calls the adaptive AI model in real time for distributed stored data, dynamically adjusts the model parameters based on traffic fluctuations, and preliminarily realizes edge filtering of low-risk data and focused analysis of high-risk data. By dynamically adjusting the model parameters and detection accuracy, resource consumption is reduced while ensuring detection efficiency, making risk management more targeted and responsive. With the support of multi-dimensional dynamic label processing, the present invention can flexibly and efficiently process massive data streams, while ensuring accurate identification and rapid response to high-risk events, thereby realizing full life cycle security management. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0028] Figure 1 Flowchart of the big data regulatory approach for AI-driven information security.

[0029] Figure 2 This is a structural diagram of the AI-driven information security big data supervision system. DETAILED DESCRIPTION

[0030] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0031] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0032] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0033] Example 1

[0034] Reference Figure 1-2 , which is the first embodiment of the present invention, and provides an AI-driven information security big data supervision method, such as Figure 1 As shown, including,

[0035] S1: Receive data streams from different sources in real time, pre-process the data, perform multi-dimensional dynamic label processing, and store them in different nodes in a distributed manner.

[0036] First, data streams from different sources are received and preprocessing operations are performed, including basic operations such as unifying the format of the data stream, noise filtering, and data cleaning to ensure that the data meets the format requirements of subsequent label processing; at the same time, the data is preliminarily labeled according to the source to distinguish the basic data stream of multi-dimensional labels.

[0037] After the data stream is preprocessed, labels are assigned based on static features such as data source, time, and sensitivity level. First, define data source labels, time labels, and sensitivity level labels. Each data stream is assigned to a corresponding label group and recorded through a distributed storage system to achieve basic classification management.

[0038] Based on the basic label, according to the traffic fluctuation of the data flow during transmission, dynamic label assignment is performed to form a dynamic traffic label. Define the traffic fluctuation threshold. If the traffic fluctuation of the data flow exceeds the preset threshold, add a traffic change label to the data flow. This label is used to mark abnormal traffic fluctuations in real time so that it can be processed first when there is high traffic fluctuation.

[0039] Furthermore, based on regional characteristics and associated risk levels, geographic location tags and associated risk tags are added to the data stream to achieve the integration of multi-dimensional tag information. When calling multi-dimensional tag information, potential risk cluster data streams can be directly located based on risk and location. The specific operations are as follows:

[0040] On the basis of dynamic traffic labels, geographic location labels and associated risk labels are added, and labels are assigned according to the geographical location of the data source and historical risk indicators. If the data flow comes from a high-risk area or a sensitive location (such as an IP address in a specific area of ​​the world), relevant labels are added to it and stored in distributed nodes.

[0041] After the above label assignments are completed, the multi-dimensional label information set is called, including the basic label set (data source label, time label and sensitivity level label), traffic change label, geographic location label and associated risk label. When calling the multi-dimensional label information, the data flow of the potential risk cluster is located according to the risk level and geographic location. This multi-dimensional label information set enables high-risk and regional cluster data flows to be identified preferentially by the system, facilitating subsequent analysis and response.

[0042] It should be noted that dynamic processing can provide a more detailed control of the relevance and potential risks of data, and support more efficient classification and rapid extraction operations. For example, during the peak period of cyber attacks, the system can quickly aggregate data with high-risk labels and prioritize them. Dynamic labeling can achieve more flexible hierarchical retrieval, and can adaptively adjust label dimensions when data flows fluctuate frequently, enabling adaptive data management in different time periods and scenarios.

[0043] S2: Call the adaptive AI model in real time for distributed storage data and automatically adjust the model parameters based on traffic changes.

[0044] S2.1: Call the multi-dimensional label information set from the distributed storage node in real time, introduce the data flow into the edge computing node according to the traffic changes and the dynamic factors in the multi-dimensional label, and perform preliminary filtering and processing on the low-risk data flow at the edge, including:

[0045] A sliding window is set to calculate the statistical characteristics of the traffic. At each time point, the mean and standard deviation of the traffic are calculated, and the traffic status is judged according to the set risk threshold θ, including low-risk data flows and high-risk data flows. If the data flow meets the low-risk condition, it will be introduced into the edge computing node for processing.

[0046] S2.2: For high-priority data streams, the adaptive AI model is called to use label data such as current traffic fluctuations and geographical characteristics as model input to automatically identify changes in the current data environment and adjust the initial parameters of the model.

[0047] Scoring and identifying high-priority data flows based on traffic type, urgency, etc., converting traffic fluctuations and regional characteristics into feature vectors X input =[Δx(t), L(t), T(t)], where L(t) is the geographical feature, T(t) is the time feature, and Δx(t) is the flow rate change rate.

[0048] Use an adaptive learning algorithm (such as the adaptive gradient method) to adjust the model parameters θ in real time:

[0049]

[0050] Among them, ηt is the learning rate and ΔL is the gradient of the current loss function.

[0051] S2.3: The adaptive AI model combines the sensitivity level and associated risk information in the label to perform risk classification operations on the data flow, determine the preliminary risk level of the data flow, and optimize the model detection accuracy based on the level. For example, high-risk data will use a high-precision analysis mode, while low-risk data will use a low-precision analysis mode.

[0052] The process of determining the preliminary risk level of data flow is as follows:

[0053] R(X)=ω1S+ω2S

[0054] Among them, S is the sensitivity level, A is the associated risk information, and ω1 and ω2 are weight coefficients.

[0055] The data stream is graded according to the risk value R(X) and the set primary and secondary thresholds, and the model detection accuracy is graded and optimized based on the grade.

[0056] S2.4: Introduce the initially screened high-risk data streams into hierarchical anomaly detection, call anomaly detection logic of different depths according to the risk level, perform fine-grained analysis on the data stream, and further identify potential subtle abnormal patterns or abnormal correlations across data streams.

[0057] Among them, multi-level detection logic is introduced for high-risk data flows. Set the levels, and each level corresponds to different detection depths and algorithms, such as:

[0058] First level: preliminary screening using statistical methods (such as Z-Score test);

[0059] Second layer: using model-based detection (such as isolation forest);

[0060] The third layer: Use deep learning models (such as LSTM, Autoencoder).

[0061] Introducing feature extraction methods for each detection layer, such as using convolutional neural networks (CNNs) to extract data stream features;

[0062] In the deep risk detection model (e.g., the third layer), an abnormal pattern recognition module across data streams is added, and correlation detection (such as Pearson correlation coefficient, Granger causality, etc.) is used to analyze the correlation between different data streams. The correlation formula can be expressed as:

[0063]

[0064] Among them, ρ x,y is the correlation coefficient between data streams x and y, cov(x,y) is the covariance, σ x and σ y are the standard deviations of the two data streams respectively.

[0065] It can be seen that before the data enters the main system, it is initially filtered through the edge computing nodes to divert noise data or low-risk information flows, ensuring that the main system only receives high-priority or potentially high-risk data. The filtering mechanism of the edge computing nodes can effectively reduce the load on the main system, improve processing efficiency, reduce redundant analysis time for non-essential data, and improve resource utilization.

[0066] In the anomaly detection stage, a "hierarchical anomaly detection" method is introduced to adjust the detection accuracy in real time according to the risk level. For example, only basic analysis is performed on low-level abnormal events, while in-depth analysis is used for high-level events. Through dynamic accuracy adjustment, the detection quality of high-level anomalies can be prioritized when resources are tight, making the processing strategy more flexible and adaptable, and avoiding the waste of system resources caused by full and detailed analysis.

[0067] S3: When the adaptive AI model detects an abnormal data flow, it conducts a secondary intelligent hierarchical analysis to determine the type of anomaly, possible source, and potential threat level.

[0068] S3.1: After detecting a data stream with a high-risk label, the adaptive AI model preliminarily classifies the data stream based on labels such as the sensitivity level, geographical characteristics, and traffic fluctuations of the abnormal data to determine its possible anomaly type and threat level.

[0069] S3.2: After the initial classification, the abnormal data stream is subjected to correlation analysis, and the abnormal events are deeply mined in combination with the cross-stream label information. The potential risk sources and associated abnormal behavior patterns behind the abnormal events are automatically identified from the label association relationship. The specific operations are as follows:

[0070] Compare the multi-dimensional labels of abnormal data streams with labels of other stream data and calculate label similarity to identify potential cross-data stream correlations and identify possible risk sources. The label similarity is calculated as follows:

[0071]

[0072] Among them, ρ ass (x, y) is the label similarity score, which is used for correlation determination. i and i is the i-th label score of data stream x and y, μ x and μ y is the label mean of data streams x and y, and n represents the number of labeled samples.

[0073] Combined with the relevant information of cross-stream labels, the behavioral characteristics in abnormal events are deeply mined, and based on the relationship patterns between cross-stream labels, the abnormal behavior patterns associated with the data streams are extracted to construct a cross-stream abnormal event portrait.

[0074] S3.3: After completing the association analysis, abnormal events are graded according to risk levels, using a fine-grained multi-dimensional dynamic label weight adjustment mechanism, where the multi-dimensional dynamic label weight adjustment formula is:

[0075] ω adj =ω ini +λΔR risk

[0076] Among them, ω adj is the adjusted label weight, ω ini is the initial weight of the label, λ is the dynamic adjustment coefficient, ΔR risk It is the risk level difference, that is, the difference between the current risk level and the basic level.

[0077] The weight of high-risk data labels is further increased through a multi-dimensional dynamic label weight adjustment mechanism, so that high-risk abnormal events have a higher priority in subsequent feedback.

[0078] S3.4: According to the weight of the classified labels, the detection and analysis depth of the model is adjusted in real time, and the multi-dimensional labels and the classified analysis results are transmitted to the anomaly monitoring and intelligent classified analysis module to optimize the label adaptability of subsequent detections and realize a two-way dynamic label feedback mechanism.

[0079] Preferably, the detection and analysis depth adaptive adjustment formula is as follows:

[0080]

[0081] Among them, d depth is the analysis depth of the current detection, d base is the basic detection depth, k is the detection depth adjustment coefficient, is the sum of the total label weights, which is used to standardize the analysis depth, and m represents the number of data label types.

[0082] It should be noted that the two-way feedback mechanism enables the system to be more accurate in detecting anomalies and respond quickly to changing label combinations, thereby improving recognition accuracy and the speed of risk assessment.

[0083] Moreover, through the analysis of fine-grained associations, the system can discover more potential security threats, especially early signs of risk. For example, discovering abnormal access patterns in different areas may indicate a complex distributed attack.

[0084] S4: Automatically trigger an event-driven response mechanism when a high-risk anomaly is detected.

[0085] When the adaptive AI model detects a high-risk abnormal event, it automatically triggers an event-driven response. Based on the risk level of the abnormal event, the data stream is isolated to an independent storage area and the relevant data stream is encrypted to prevent the potential risk from spreading.

[0086] After the isolation is completed, the system dynamically generates an event notification based on the tag weight, and sends detailed information of the high-risk event to the designated security team through the automatic alarm system. The notification contains event tag information, risk level, location, etc., so that the security team can quickly understand and respond. It also automatically records key data of the event, including occurrence time, data source, tag information, isolation status, etc., and generates a detailed event log, which is classified and stored by timestamp and tag index to provide comprehensive data information for subsequent analysis and review.

[0087] Finally, based on the risk level of the incident, an analysis report is automatically generated, including the potential threats of the incident, associated tag information, response process, etc. The report displays various indicators in a graphical form to facilitate quick understanding and decision-making, and is sent directly to system administrators and relevant security response teams.

[0088] S5: Feedback the incident response results and processing status to the adaptive AI model to optimize the model’s learning parameters and decision logic, ensuring that the system’s ability to handle similar threats continues to improve.

[0089] Specifically, after completing the event response, the system synchronizes the feedback data of the event back to the adaptive AI model, and dynamically adjusts the model's parameters and detection logic through feedback of risk labels, response results and other data to optimize the system's response capabilities and continuously improve the automatic response effect to high-risk events.

[0090] Furthermore, this embodiment also provides an AI-driven information security big data supervision system, including:

[0091] The data stream processing module is used to receive data streams from different sources in real time, pre-process the data streams, perform multi-dimensional dynamic label processing, and store them in different nodes in a distributed manner;

[0092] An adaptive AI model calling module is used to call the adaptive AI model in real time for distributed stored data and automatically adjust the parameters of the adaptive AI model based on traffic changes;

[0093] The abnormal monitoring and intelligent hierarchical analysis module is used to perform secondary intelligent hierarchical analysis when the adaptive AI model detects abnormal data flow, and determine the type, source and potential threat level of the abnormality;

[0094] The event response mechanism trigger module is used to automatically trigger the event-driven response mechanism when a high-risk anomaly is detected;

[0095] The feedback and optimization module is used to feed back the event response results and processing status to the adaptive AI model to optimize the learning parameters and decision logic of the model.

[0096] This embodiment also provides a computer device, which is suitable for the AI-driven information security big data supervision method, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute computer-executable instructions to implement the AI-driven information security big data supervision method proposed in the above embodiment.

[0097] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0098] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for realizing AI-driven information security big data supervision as proposed in the above embodiment is implemented.

[0099] In summary, the present invention calls the adaptive AI model in real time for distributed stored data, dynamically adjusts the model parameters based on traffic fluctuations, and preliminarily realizes edge filtering of low-risk data and focused analysis of high-risk data. By dynamically adjusting model parameters and detection accuracy, resource consumption is reduced while ensuring detection efficiency, making risk management more targeted and responsive. With the support of multi-dimensional dynamic label processing, the present invention can flexibly and efficiently process massive data streams, while ensuring accurate identification and rapid response to high-risk events, thereby realizing full life cycle security management.

[0100] Example 2

[0101] Referring to Table 1, which is the second embodiment of the present invention, this embodiment provides an AI-driven information security big data supervision method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through simulation experiments.

[0102] The experimental objects are various data flow sources, including enterprise intranet, external API interfaces, open network resources, etc. The test system is distributed on multiple nodes to simulate different network data flow inputs and implement data classification management through distributed storage and labeling strategies. The specific steps are as follows:

[0103] The data stream in the simulation environment is input into the system. The data sources are diverse, including intranet access data, external API data, and open network traffic. After the data is formatted and denoised, label assignment is performed. According to the source, the data stream is assigned a source label (such as "intranet", "API", "public network"), a time label, and a sensitivity label, and is distributed and stored in the nodes.

[0104] After the initial labeling, the flow fluctuation threshold is set according to the real-time flow fluctuation (for example, the threshold is set to 30Mbps). When the data flow fluctuation exceeds this value, the system automatically adds a "flow change" label to facilitate the identification of abnormal high flow fluctuations. At the same time, according to the geographical source of the data and the associated risk information, the "geographic location" and "associated risk" labels are assigned. If the data flow comes from a specific sensitive area (such as an IP address located in a high-risk country), the risk label is automatically added.

[0105] Call multi-dimensional label data on distributed nodes, and call AI models to perform real-time parameter adjustments based on traffic conditions. Low-risk data flows are filtered through edge computing nodes to avoid excessive system load; for high-priority data flows, the AI ​​model converts traffic volatility and regional characteristics into feature vectors, and uses adaptive learning algorithms to optimize model parameters in real time and dynamically adapt to changes in data flows.

[0106] For high-risk data streams identified by the adaptive AI model, the system further analyzes the anomalies through a multi-layer anomaly detection model. Data of different risk levels call detection algorithms of different depths, using statistical detection, isolation forest model and LSTM deep learning model to analyze layer by layer, identify potential abnormal patterns and perform cross-data stream correlation analysis to deeply explore the source of the anomaly.

[0107] After the anomaly classification is completed, the detection depth is optimized in real time through the two-way label weight adjustment mechanism to ensure that high-risk data has priority in subsequent processing, and the model detection parameters are dynamically adjusted to adapt to the changing multi-dimensional label combination to achieve rapid response to high-priority data streams. The following table shows the label assignment and risk identification of various data streams in the experiment:

[0108] Table 1 Label assignment and risk identification of various data flows

[0109]

[0110] Through the analysis of the data in Table 1, it can be seen that the combination of the multi-dimensional labeling strategy and the adaptive AI model in the present invention has shown significant advantages in data flow classification and anomaly identification. Compared with the traditional single static labeling method, dynamic label assignment allows the system to adjust the label weight according to real-time traffic fluctuations and risk levels. Especially in the case of high traffic fluctuations, by automatically identifying the risks associated with traffic change labels and regions, the system can locate potential abnormal data sets more quickly. For example, in this experiment, the high-risk IP data flow derived from public network resources has a traffic fluctuation of up to 70Mbps and comes from sensitive areas (such as Russia). Through the dynamic processing of the multi-dimensional labels of the present invention, the data flow is preferentially marked as high risk, and a hierarchical detection model is introduced for in-depth analysis. In the traditional model, such high-frequency fluctuating data streams may be delayed in processing due to the lack of an immediate label adjustment mechanism, resulting in a slower response time for anomaly detection.

[0111] In addition, the adaptive AI model automatically adjusts the detection accuracy in high-risk data streams, ensuring high-precision recognition of complex abnormal patterns, while adopting a low-precision, low-resource occupancy model in low-risk data streams, significantly improving the efficiency of system resource utilization. Especially during peak traffic periods, this combination of dynamic classification and multi-layer detection enables the system to adjust the accuracy and priority of the model in real time, while ensuring efficient processing and reducing the system redundancy burden.

[0112] Through the analysis of the above experimental data, it can be concluded that the present invention has stronger flexibility and adaptability in data flow labeling and risk identification, which can significantly improve the system's response speed and processing accuracy to abnormal data, while reducing the overall computing resource occupancy.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An AI-driven information security big data supervision method, characterized by: include, Receive data streams from different sources in real time, pre-process the data streams, perform multi-dimensional dynamic label processing, and store them in different nodes in a distributed manner; Invoke the adaptive AI model in real time for distributed storage data, and automatically adjust the parameters of the adaptive AI model based on traffic changes; When the adaptive AI model detects an abnormal data flow, it performs a secondary intelligent hierarchical analysis to determine the type, source and potential threat level of the abnormality; Automatically trigger event-driven response mechanisms when high-risk anomalies are detected; The event response results and processing status are fed back to the adaptive AI model to optimize the model's learning parameters and decision logic.

2. The AI-driven information security big data supervision method according to claim 1, characterized in that: The multi-dimensional dynamic label processing includes: Define data source labels, time labels, and sensitivity level labels, assign each data stream to a corresponding label group, and record them through a distributed storage system; Based on the basic label, dynamic label assignment is performed according to the traffic fluctuation of the data flow during transmission to form a dynamic traffic label. On the basis of the traffic dynamic labels, geographic location labels and associated risk labels are added, and labels are assigned according to the geographical location of the data source and historical risk indicators; After the above label assignment is completed, call the multi-dimensional label information set; When the multi-dimensional tag information is called, data flow positioning of potential risk clusters is achieved according to risk levels and geographical locations.

3. The AI-driven information security big data supervision method according to claim 2, characterized in that: The multi-dimensional tag information set includes a basic tag set, a traffic change tag, a geographic location tag, and an associated risk tag; The basic label set includes data source labels, time labels and sensitivity level labels.

4. The AI-driven information security big data supervision method according to claim 3, characterized in that: The real-time calling of the adaptive AI model for distributed storage data and the automatic adjustment of the model parameters based on traffic changes include the following steps: Call multi-dimensional label information sets from distributed storage nodes in real time, introduce data streams into edge computing nodes based on traffic changes and dynamic factors in multi-dimensional labels, and perform preliminary filtering on low-risk data streams at the edge. For high-priority data streams, the adaptive AI model is called, the current label data is used as the input of the adaptive AI model, the current data environment changes are automatically identified, and the preliminary parameters of the adaptive AI model are adjusted; The adaptive AI model combines the sensitivity level and associated risk information in the label to perform risk grading operations on the data flow, determine the preliminary risk level of the data flow, and perform graded optimization of the model detection accuracy based on the preliminary risk level; The high-risk data streams that have been initially screened are introduced into hierarchical anomaly detection. Anomaly detection logic of different depths is called according to the risk level. Fine-grained analysis is performed on the data stream to identify potential subtle abnormal patterns or abnormal correlations across data streams.

5. The AI-driven information security big data supervision method according to claim 4, characterized in that: The abnormal detection logic of calling different depths according to risk level includes: Introduce multi-level detection logic for high-risk data flows and set levels, with each level corresponding to different detection depths and algorithms; Extract features for each detection layer; For high-level additions, correlation detection is used to analyze the correlation between different data streams, where the correlation formula is expressed as: Among them, ρ x,y is the correlation coefficient between data streams x and y, cov(x,y) is the covariance, σ x and σ y are the standard deviations of the two data streams respectively.

6. The AI-driven information security big data supervision method according to claim 5, characterized in that: The secondary intelligent classification analysis includes: Perform preliminary classification of data streams; Performing correlation analysis on the abnormal data streams after the preliminary classification, performing in-depth mining on abnormal events in combination with cross-stream label information, and automatically identifying potential risk sources and associated abnormal behavior patterns behind abnormal events from label association relationships; After completing the association analysis, abnormal events are graded according to risk levels, using a fine-grained multi-dimensional dynamic label weight adjustment mechanism; According to the graded label weights, the detection and analysis depth of the adaptive AI model is adjusted in real time.

7. The AI-driven information security big data supervision method according to claim 6, characterized in that: The association analysis includes: Compare the multi-dimensional labels of the abnormal data stream with the labels of other stream data and calculate the label similarity: Among them, ρ ass (x, y) is the label similarity score, which is used for correlation determination. i and i is the i-th label score of data stream x and y, μ x and μ y is the label mean of data streams x and y, and n represents the number of label samples; The formula for adjusting the multi-dimensional dynamic label weight is: oh adj =ω ini +λΔR risk Among them, ω adj is the adjusted label weight, ω ini is the initial weight of the label, λ is the dynamic adjustment coefficient, ΔR risk is the risk level difference, that is, the difference between the current risk level and the basic level; The adaptive adjustment formula of the detection and analysis depth is as follows: Among them, d depth is the analysis depth of the current detection, d base is the basic detection depth, k is the detection depth adjustment coefficient, is the sum of the total label weights, which is used to standardize the analysis depth, and m represents the number of data label types.

8. An AI-driven information security big data supervision system, based on the AI-driven information security big data supervision method according to any one of claims 1 to 7, characterized in that: Also includes, The data stream processing module is used to receive data streams from different sources in real time, pre-process the data streams, perform multi-dimensional dynamic label processing, and store them in different nodes in a distributed manner; An adaptive AI model calling module is used to call the adaptive AI model in real time for distributed stored data and automatically adjust the parameters of the adaptive AI model based on traffic changes; The abnormal monitoring and intelligent hierarchical analysis module is used to perform secondary intelligent hierarchical analysis when the adaptive AI model detects abnormal data flow, and determine the type, source and potential threat level of the abnormality; The event response mechanism trigger module is used to automatically trigger the event-driven response mechanism when a high-risk anomaly is detected; The feedback and optimization module is used to feed back the event response results and processing status to the adaptive AI model to optimize the learning parameters and decision logic of the model.

Images