An artificial intelligence-based network link security management method

Abstract

The application discloses a network link security management method based on artificial intelligence and relates to the technical field of network security management, which comprises the following steps: when receiving a data file from a sending end in a network receiving link, acquiring first parameter data of the sending end to generate sending characteristics and a fingerprint mark, and performing security check on the fingerprint mark; after the check, packing the data file and the fingerprint mark to generate a to-be-transmitted file; when the to-be-transmitted file passes through an intermediate node of a network transmission link, recording second parameter data of the intermediate node, gradually generating a dynamic path mark and inputting the dynamic path mark; when the file is transmitted to a receiving end, acquiring a complete dynamic path mark, performing abnormal analysis on the path mark according to a preset abnormal analysis algorithm, and if an abnormality is detected, generating an abnormal signal and issuing an alarm. Through the sending fingerprint mark, the dynamic path mark and real-time monitoring, the adaptability of a network environment is improved, and abnormalities in a transmission path are accurately detected.

Description

Technical Field

[0001] This invention relates to the field of network security management technology, specifically to a network security management method based on artificial intelligence. Background Technology

[0002] With the rapid development of the Internet and the Internet of Things (IoT), the security and reliability of network data transmission have become increasingly prominent issues, especially in scenarios involving the transmission of sensitive information. Ensuring the security and stability of data transmission paths is crucial. Existing network security management methods mainly rely on fixed paths or static security detection mechanisms. These methods typically detect anomalies through simple monitoring of nodes and paths, but they are clearly insufficient in the face of the dynamic changes in modern network environments. Specifically, traditional methods have problems in the following aspects: Lack of dynamism: Most existing methods are based on static path marking and security detection, which cannot respond to dynamic changes in transmission paths in real time. When network node load or transmission latency fluctuates, existing methods often fail to accurately identify potential risks, leading to security vulnerabilities; Insufficient accuracy in path anomaly detection: Existing path marking technologies fail to fully consider real-time state changes of network nodes, resulting in insufficient accuracy in anomaly detection. In complex network environments, subtle changes in node states can accumulate into significant risks, but traditional methods cannot accurately capture and identify them; Delayed security response: Due to the lack of real-time monitoring and analysis of transmission nodes, traditional security management methods often fail to respond promptly after detecting potential security threats, which may lead to serious consequences such as data leakage or transmission interruption. Summary of the Invention

[0003] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a network link security management method based on artificial intelligence to solve the above-mentioned technical problems.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a network link security management method based on artificial intelligence, comprising:

[0005] When the network receiving link receives a data file sent by the sending end, it obtains the first parameter data of the sending end, constructs a sending feature based on the first parameter data, and generates a sending fingerprint mark based on the sending feature.

[0006] The fingerprint mark is subjected to security verification. After the security verification is passed, the data file and the fingerprint mark are packaged to generate a file to be transmitted.

[0007] When the network transmission link receives the file to be transmitted, it generates a blank dynamic path marker. Whenever the file to be sent passes through an intermediate transmission node, it records the second parameter data of the intermediate transmission node, generates a dynamic path marker based on the second parameter data, and inputs the dynamic path marker.

[0008] When the file to be transmitted is transmitted to the receiving end, the dynamic path marker is obtained, and the dynamic path marker is analyzed for anomalies according to the preset anomaly analysis algorithm. When an anomaly is found, an anomaly signal is generated and an alarm is triggered.

[0009] The present invention is further configured such that the first parameter data of the transmitting end includes the transmitting end identification number, geographical location, transmission frequency, transmission time interval, transmission speed and network latency, wherein the geographical location includes longitude and latitude.

[0010] The present invention is further configured to construct transmission features based on the first parameter data, including: calculating location change features based on the current geographical location and the geographical location of the last transmission, wherein the location change features are zero when there is no previous transmission; calculating transmission behavior features based on transmission frequency and transmission time interval; and calculating transmission environment features based on transmission speed and network latency.

[0011] A spatial feature vector is constructed using three dimensions: location change features, sending behavior features, and sending environment features. A sending fingerprint value is calculated, and the spatial feature vector and the sending fingerprint value are hashed to generate a sending fingerprint tag.

[0012] The present invention is further configured such that the calculation logic for the position change feature is as follows: ,in, For location change characteristics, and The latitude and longitude of the current geographic location and the last sent geographic location. The longitude of the current geographical location and the geographical location of the last transmission is used; the calculation logic for the transmission behavior characteristics is as follows: ,in, To send behavioral characteristics, For transmission frequency, The transmission time interval; the calculation logic for the transmission environment characteristics is as follows: ,in, To send environmental characteristics, For sending speed, This is due to network latency.

[0013] The present invention further comprises normalizing the transmission behavior features and transmission environment features, and constructing a spatial feature vector with position change features, transmission behavior features, and transmission environment features as three dimensions. The spatial feature vector is represented as follows: , Given a spatial feature vector, the calculation logic for sending fingerprint values ​​is as follows: ,in, To send fingerprint values, Let be the magnitude of the vector. Let the dimension be the vector. For the first Feature values ​​in each dimension For the first Adjustment parameters for each dimension, This is the symbol for cumulative product.

[0014] The present invention is further configured to perform security verification on the fingerprint mark, including: hashing and decrypting the transmitted fingerprint mark to obtain a spatial feature vector and a transmitted fingerprint value; calculating a verification transmitted fingerprint value based on the spatial feature vector; generating a verification transmitted fingerprint mark by hashing the spatial feature vector and the verification transmitted fingerprint value; comparing whether the transmitted fingerprint mark and the verification transmitted fingerprint mark are consistent; and when they are consistent, the security verification is passed.

[0015] The present invention is further configured such that the second parameter data of the intermediate transmission node includes the intermediate transmission node identification number, node load, network bandwidth utilization rate, and transmission time interval;

[0016] The process of generating dynamic path markers based on the second parameter data includes: constructing a dynamic path set using the intermediate transmission node identification number as a unique identifier and node load, network bandwidth utilization, and transmission time interval as attributes, and setting the dynamic path set as a dynamic path marker.

[0017] The present invention is further configured to perform anomaly analysis on the dynamic path markers according to a preset anomaly analysis algorithm, and generate an anomaly signal and issue an alarm when an anomaly is found, including:

[0018] According to the transmission order, a transmission list is generated based on the intermediate transmission node identification number, where the previous intermediate transmission node identification number points to the next intermediate transmission node identification number.

[0019] Check the transmission chain for loop links. If a loop exists, generate an abnormal signal and issue an alarm.

[0020] The path consistency index is calculated based on node load, network bandwidth utilization, and transmission time interval.

[0021] The abnormal characteristics of a path are calculated based on the path consistency index. When the abnormal characteristics of a path exceed a preset threshold, an abnormal signal is generated and an alarm is triggered.

[0022] The present invention is further configured such that the calculation logic of the path consistency index is as follows: ,in, This is the path consistency index. This represents the number of intermediate transmission nodes. For the first The node load of each intermediate transmission node For the first Network bandwidth utilization of intermediate transmission nodes For the first The and the first The transmission time interval of each intermediate transmission node It is zero.

[0023] The present invention is further configured such that the calculation logic for the path anomaly features is as follows: ,in, This indicates path anomaly characteristics.

[0024] This invention provides a network link security management method based on artificial intelligence. The method involves: when a network receiving link receives a data file sent by a sending end, acquiring the sending end's first parameter data, constructing a sending feature based on the first parameter data, and generating a sending fingerprint based on the sending feature; performing security verification on the fingerprint, and after passing the security verification, packaging the data file and the fingerprint to generate a file to be transmitted; when a network transmission link receives the file to be transmitted, generating a blank dynamic path marker; recording the second parameter data of each intermediate transmission node as the file passes through it, generating a dynamic path marker based on the second parameter data, and inputting the dynamic path marker; when the file to be transmitted reaches the receiving end, acquiring the dynamic path marker, performing anomaly analysis on the dynamic path marker according to a preset anomaly analysis algorithm, and generating an anomaly signal and issuing an alarm when an anomaly is found. The beneficial effects include:

[0025] 1. Enhance the uniqueness and security of data transmission: By generating unique transmission characteristics and further generating a transmission fingerprint, the unique identifier of the sender can be effectively prevented from being tampered with or forged, thereby enhancing the uniqueness and security of data transmission.

[0026] 2. Dynamic Path Marking and Real-time Monitoring: By generating dynamic path markers based on primary parameters such as the geographical location of transmission nodes, transmission frequency, transmission speed, and network latency, real-time monitoring of the network transmission path is achieved. Compared to traditional static path marking methods, this invention can more flexibly adapt to dynamic changes in the network environment, promptly detect potential anomalies in the path, and improve the security of network transmission.

[0027] 3. Precise Anomaly Detection and Alarm: This invention utilizes intelligent path marking and computational logic to achieve precise detection of transmission path anomalies. By comparing the real-time status of transmission nodes with path consistency indicators, anomaly signals can be quickly generated and alarms triggered when anomalies are detected. Compared to traditional methods, this invention offers higher anomaly detection accuracy, effectively reducing the risk of data leakage or transmission interruption due to delayed security detection.

[0028] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0029] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings:

[0030] Figure 1 The flowchart illustrates an artificial intelligence-based network link security management method as an exemplary embodiment of the present invention. Detailed Implementation

[0031] The embodiments of the present invention will be described below with reference to the accompanying drawings and preferred embodiments. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be understood that the preferred embodiments are only for illustrating the present invention and not for limiting the scope of protection of the present invention.

[0032] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0033] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.

[0034] A network security management method based on artificial intelligence, such as Figure 1 As shown, it includes:

[0035] When the network receiving link receives a data file sent by the sending end, it obtains the first parameter data of the sending end, constructs a sending feature based on the first parameter data, and generates a sending fingerprint mark based on the sending feature.

[0036] The fingerprint mark is subjected to security verification. After the security verification is passed, the data file and the fingerprint mark are packaged to generate a file to be transmitted.

[0037] When the network transmission link receives the file to be transmitted, it generates a blank dynamic path marker. Whenever the file to be sent passes through an intermediate transmission node, it records the second parameter data of the intermediate transmission node, generates a dynamic path marker based on the second parameter data, and inputs the dynamic path marker.

[0038] When the file to be transmitted is transmitted to the receiving end, the dynamic path marker is obtained, and the dynamic path marker is analyzed for anomalies according to the preset anomaly analysis algorithm. When an anomaly is found, an anomaly signal is generated and an alarm is triggered.

[0039] The present invention further specifies that the first parameter data of the sending end includes a sending end identification number, geographical location, sending frequency, sending time interval, sending speed, and network latency, wherein the geographical location includes longitude and latitude. Specifically, the sending end identification number is a code or mark that uniquely identifies the sending end device, used to distinguish different sending ends, and serves as a unique ID or serial number for the sending end device, ensuring that each sending end has a unique identity in the network, which helps to track and verify the legitimacy of the data source; the geographical location includes longitude and latitude information, used to accurately locate the geographical coordinates of the sending end; the sending frequency refers to the number of times the sending end sends data within a certain period of time, used to describe the frequency of data transmission; the sending time interval refers to the time interval between each data transmission, used to measure the temporal regularity of data transmission; the sending speed refers to the speed at which the data file is transmitted over the network, reflecting the real-time rate of data transmission by the sending end; and the network latency refers to the time delay in the process of data transmission from the sending end to the receiving end, reflecting the speed of network response.

[0040] The present invention is further configured to construct transmission features based on the first parameter data, including: calculating location change features based on the current geographical location and the geographical location of the last transmission, wherein the location change feature is zero when there is no previous transmission; calculating transmission behavior features based on transmission frequency and transmission time interval; and calculating transmission environment features based on transmission speed and network latency; the present invention is further configured to have the following calculation logic for the location change features: ,in, For location change characteristics, and The latitude and longitude of the current geographic location and the last sent geographic location. This refers to the longitude of the current geographical location and the geographical location of the last transmission. Specifically, the location change feature is used to measure the change in the current geographical location of the sender compared to the geographical location of the last transmission. This is achieved by calculating the change in distance between the two geographical locations, and then... Reducing the change to within 1 provides an effective method to track changes in the sender's geographical location. It can detect the sender's location offset or geographical anomalies in real time during data transmission, thus improving the accuracy of path tracking.

[0041] The calculation logic for sending behavioral characteristics is as follows: ,in, To send behavioral characteristics, For transmission frequency, The sending time interval is used to quantify the sending behavior characteristics by using the relationship between sending frequency and time interval. The fluctuation and regularity of sending behavior are described by combining sine and logarithmic functions. By combining the relationship between sending frequency and time interval, it is possible to better identify whether there is abnormal behavior of the sending end during transmission, such as excessively frequent data transmission or abnormal time intervals, which helps to detect abnormal transmission behavior in a timely manner.

[0042] The calculation logic for sending environmental features is as follows: ,in, To send environmental characteristics, For sending speed, This refers to network latency. Specifically, the transmission environment characteristics are analyzed by comparing network latency with transmission speed to measure the environmental state of data transmission. By taking the logarithm of the latency-to-speed ratio, the impact of changes in the network environment on data transmission stability can be reflected.

[0043] A spatial feature vector is constructed using location change features, transmission behavior features, and transmission environment features as three dimensions. A transmission fingerprint value is calculated, and the spatial feature vector and the transmission fingerprint value are hashed to generate a transmission fingerprint marker. The invention further involves normalizing the transmission behavior features and transmission environment features, and constructing a spatial feature vector using location change features, transmission behavior features, and transmission environment features as three dimensions. The spatial feature vector is represented as follows: , Given a spatial feature vector, the calculation logic for sending fingerprint values ​​is as follows: ,in, To send fingerprint values, Let be the magnitude of the vector. Let the dimension be the vector. For the first Feature values ​​in each dimension For the first Adjustment parameters for each dimension, This is the cumulative product symbol. Specifically, the adjustment parameter is used to adjust the feature contribution of this dimension, enhancing the flexibility of the calculation. Its value range is [0,1], and the sum of all adjustment parameters is 1. The features of the three dimensions are combined to construct a spatial feature vector, and the transmitted fingerprint value is generated using this spatial feature vector. Through the comprehensive fusion of spatial features, a multi-dimensional feature characterization of the transmitting end is achieved, making the feature information of the transmitting end more comprehensive and accurate.

[0044] The present invention is further configured to perform security verification on the fingerprint mark, including: hashing and decrypting the transmitted fingerprint mark to obtain a spatial feature vector and a transmitted fingerprint value; calculating a verification transmitted fingerprint value based on the spatial feature vector; generating a verification transmitted fingerprint mark by hashing the spatial feature vector and the verification transmitted fingerprint value; comparing whether the transmitted fingerprint mark and the verification transmitted fingerprint mark are consistent; if they are consistent, the security verification passes. Specifically, firstly, the transmitted fingerprint mark is hashed and decrypted to obtain the spatial feature vector and the transmitted fingerprint value constructed by the sender. The spatial feature vector represents the features of the sender in three dimensions, while the transmitted fingerprint value is a unique identifier calculated based on these features. Based on the decrypted spatial feature vector, the verification transmitted fingerprint value is recalculated. The calculation formula is the same as the original logic for constructing the transmitted fingerprint value, that is, using the feature magnitude and the cumulative effect of features in each dimension to calculate the verification transmitted fingerprint value. The recalculated spatial feature vector and the verification transmitted fingerprint value are hashed to generate a verification transmitted fingerprint mark, the purpose of which is to generate a unique verification mark using the same hash algorithm. The original transmitted fingerprint mark is compared with the regenerated verification transmitted fingerprint mark. If the two match, it means that the spatial characteristics of the data and the sent fingerprint value have not changed during the transmission process, and the security verification has passed.

[0045] The present invention further specifies that the second parameter data of the intermediate transmission node includes an intermediate transmission node identification number, node load, network bandwidth utilization, and transmission time interval. Specifically, the intermediate transmission node identification number is a code or mark used to uniquely identify the intermediate transmission node. Each intermediate transmission node has a unique identification number, including the node's MAC address, device ID, or other unique network identifier, used to identify and track the location and identity of each intermediate node in the transmission path. Node load refers to the processing load currently borne by the intermediate transmission node, reflecting the node's resource usage. Network bandwidth utilization refers to the ratio between the network bandwidth used by the intermediate transmission node and its total bandwidth, used to reflect the degree of network resource utilization by the node during data transmission. The transmission time interval refers to the time interval between the intermediate transmission node processing and forwarding data packets, representing the waiting time of data at that node. The shorter the transmission time interval, the higher the node's processing efficiency and the faster the data transmission speed; conversely, if the transmission time interval is long, it may indicate that the node's processing speed is slow or there is queuing.

[0046] The dynamic path marker is generated based on the second parameter data, including: constructing a dynamic path set using the intermediate transmission node identification number as a unique identifier and node load, network bandwidth utilization, and transmission time interval as attributes, and setting the dynamic path set as the dynamic path marker. Specifically, the dynamic path marker, through the combination of the unique identification number and status attributes of the intermediate nodes, can accurately record the information of all nodes through which the data passes. The dynamic path marker not only records the nodes in the path but also includes the status information of the nodes, thus comprehensively reflecting the real-time situation during network transmission. By constructing a dynamic path set, the status changes of each node can be monitored in real time, anomalies in the transmission process can be detected in a timely manner, and the transparency of the transmission path and the security of data transmission can be improved.

[0047] The present invention is further configured to perform anomaly analysis on the dynamic path markers according to a preset anomaly analysis algorithm, and generate an anomaly signal and issue an alarm when an anomaly is found, including:

[0048] According to the transmission order, a transmission list is generated based on the intermediate transmission node identification number, where the previous intermediate transmission node identification number points to the next intermediate transmission node identification number.

[0049] The system checks the transmission list for loops. If a loop is found, an anomaly signal is generated, triggering an alarm. Specifically, by constructing a transmission list and detecting loops within it, cyclic redundancy and infinite loops in data transmission can be effectively prevented. This is done by traversing the transmission list to check for loops where a node points to a previously existing node. The detection process involves the following steps: Fast and Slow Pointer Method: Two pointers are used, a fast pointer and a slow pointer. The fast pointer moves two nodes at a time, while the slow pointer moves one node at a time. If a loop exists in the list, the fast pointer will eventually meet the slow pointer. When a loop is detected in the transmission list, an anomaly signal is immediately generated, triggering an alarm. The purpose of generating the anomaly signal is to notify the system that data may be in an infinite loop or misrouting during transmission, thus preventing data from endlessly looping in the network, wasting network resources, or causing system crashes.

[0050] The path consistency index is calculated based on node load, network bandwidth utilization, and transmission time interval; the present invention further specifies that the calculation logic of the path consistency index is as follows: ,in, This is the path consistency index. This represents the number of intermediate transmission nodes. For the first The node load of each intermediate transmission node For the first Network bandwidth utilization of intermediate transmission nodes For the first The and the first The transmission time interval of each intermediate transmission node The value is zero. Specifically, the path consistency index measures the state consistency of each intermediate transmission node during data transmission. By combining the load of each node, network bandwidth utilization, and transmission time interval, a comprehensive path consistency index is generated, reflecting the stability and consistency of the transmission path. It comprehensively considers multi-dimensional node characteristics to ensure the completeness of these characteristics. Furthermore, nodes with high loads may experience increased data transmission latency or data loss; higher bandwidth utilization may lead to slower data transmission speeds, thus affecting the overall transmission efficiency of the path. Bandwidth utilization reflects the network resource usage of a node; transmission latency directly affects the time it takes for data to travel from one node to another. Through comprehensive analysis of these three dimensions, the network status of each node in the path can be fully reflected, ensuring that path consistency characteristics do not depend on a single factor. The computational logic employs a nonlinear function to combine node load, bandwidth utilization, and transmission delay, enhancing the sensitivity and uniqueness of path consistency characteristics. In the computational logic, the nonlinear relationship between the ratio of node load and bandwidth utilization, as well as the delay, makes the path consistency characteristics not merely a simple combination of node characteristics, but rather a comprehensive feature value generated through the mutual influence between these node characteristics. For example, when a node has a high load and a low bandwidth utilization, the ratio of load to bandwidth will be large, causing the output of the sine function to approach its limit.

[0051] The path anomaly characteristics are calculated based on the path consistency index. When the path anomaly characteristics exceed a preset threshold, an anomaly signal is generated, and an alarm is triggered. The invention is further configured such that the calculation logic for the path anomaly characteristics is as follows: ,in, Specifically, path anomaly features quantify the deviation of each intermediate transmission node from its expected state, thereby determining the stability of the transmission path. The aim is to identify and quantify anomalies in the path so that the system can generate anomaly signals and issue alarms in a timely manner. Path anomaly features are generated through the complex ratio differences between path consistency features and the latency and load of each node. This feature measures the degree of deviation of each node's state from overall consistency, ensuring that the anomaly feature value can sensitively reflect path inconsistencies under different node states.

[0052] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0053] It should be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0054] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0055] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0056] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0057] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0058] In the several embodiments provided in this application, it should be understood that the disclosed system can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0059] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0060] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0061] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0062] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A network security management method based on artificial intelligence, characterized in that, include: When the network receiving link receives a data file sent by the sending end, it obtains the first parameter data of the sending end, constructs a sending feature based on the first parameter data, and generates a sending fingerprint mark based on the sending feature. The fingerprint mark is subjected to security verification. After the security verification is passed, the data file and the fingerprint mark are packaged to generate a file to be transmitted. When the network transmission link receives the file to be transmitted, it generates a blank dynamic path marker. Whenever the file to be sent passes through an intermediate transmission node, it records the second parameter data of the intermediate transmission node, generates a dynamic path marker based on the second parameter data, and inputs the dynamic path marker. When the file to be transmitted is transmitted to the receiving end, the dynamic path marker is obtained, and the dynamic path marker is analyzed for anomalies according to the preset anomaly analysis algorithm. When an anomaly is found, an anomaly signal is generated and an alarm is triggered.

2. The network link security management method based on artificial intelligence according to claim 1, characterized in that, The first parameter data of the sender includes the sender identification number, geographical location, transmission frequency, transmission time interval, transmission speed and network latency, where the geographical location includes longitude and latitude.

3. The network link security management method based on artificial intelligence according to claim 2, characterized in that, Constructing transmission features based on the first parameter data includes: calculating location change features based on the current geographical location and the geographical location of the last transmission; when there is no previous transmission, the location change feature is zero; calculating transmission behavior features based on transmission frequency and transmission time interval; and calculating transmission environment features based on transmission speed and network latency. A spatial feature vector is constructed using three dimensions: location change features, sending behavior features, and sending environment features. A sending fingerprint value is calculated, and the spatial feature vector and the sending fingerprint value are hashed to generate a sending fingerprint tag.

4. The network link security management method based on artificial intelligence according to claim 3, characterized in that, The calculation logic for position change characteristics is as follows: ,in, For location change characteristics, and The latitude and longitude of the current geographic location and the last sent geographic location. The longitude of the current geographical location and the geographical location of the last transmission is used; the calculation logic for the transmission behavior characteristics is as follows: ,in, To send behavioral characteristics, For transmission frequency, The transmission time interval; the calculation logic for the transmission environment characteristics is as follows: ,in, To send environmental characteristics, For sending speed, This is due to network latency.

5. The network link security management method based on artificial intelligence according to claim 4, characterized in that, Normalize the transmission behavior features and transmission environment features, and construct a spatial feature vector with location change features, transmission behavior features, and transmission environment features as three dimensions. The spatial feature vector is represented as: , Given a spatial feature vector, the calculation logic for sending fingerprint values ​​is as follows: ,in, To send fingerprint values, Let be the magnitude of the vector. Let the dimension be the vector. For the first Feature values ​​in each dimension For the first Adjustment parameters in each dimension, This is the symbol for cumulative product.

6. The network link security management method based on artificial intelligence according to claim 1, characterized in that, The security verification of the fingerprint mark includes: hashing and decrypting the transmitted fingerprint mark to obtain a spatial feature vector and a transmitted fingerprint value; calculating a verification transmitted fingerprint value based on the spatial feature vector; generating a verification transmitted fingerprint mark by hashing the spatial feature vector and the verification transmitted fingerprint value; comparing whether the transmitted fingerprint mark and the verification transmitted fingerprint mark are consistent; if they are consistent, the security verification is passed.

7. The network link security management method based on artificial intelligence according to claim 1, characterized in that, The second parameter data of the intermediate transmission node includes the intermediate transmission node identification number, node load, network bandwidth utilization, and transmission time interval; The process of generating dynamic path markers based on the second parameter data includes: constructing a dynamic path set using the intermediate transmission node identification number as a unique identifier and node load, network bandwidth utilization, and transmission time interval as attributes, and setting the dynamic path set as a dynamic path marker.

8. The network link security management method based on artificial intelligence according to claim 7, characterized in that, The dynamic path markers are analyzed for anomalies according to a preset anomaly analysis algorithm. When an anomaly is found, an anomaly signal is generated and an alarm is triggered, including: According to the transmission order, a transmission list is generated based on the intermediate transmission node identification number, where the previous intermediate transmission node identification number points to the next intermediate transmission node identification number. Check the transmission chain for loop links. If a loop exists, generate an abnormal signal and issue an alarm. The path consistency index is calculated based on node load, network bandwidth utilization, and transmission time interval. The abnormal characteristics of a path are calculated based on the path consistency index. When the abnormal characteristics of a path exceed a preset threshold, an abnormal signal is generated and an alarm is triggered.

9. A network link security management method based on artificial intelligence according to claim 8, characterized in that, The calculation logic for the path consistency index is as follows: ,in, This is the path consistency index. This represents the number of intermediate transmission nodes. For the first The node load of each intermediate transmission node For the first Network bandwidth utilization of intermediate transmission nodes For the first The and the first The transmission time interval of each intermediate transmission node It is zero.

10. A network link security management method based on artificial intelligence according to claim 9, characterized in that, The calculation logic for the path anomaly features is as follows: ,in, This indicates path anomaly characteristics.

Images