A network security vulnerability detection method and system based on artificial intelligence

Abstract

The present application provides a network security vulnerability detection method and system based on artificial intelligence, which relates to the field of network security and is used to solve the problems of poor accuracy in network security vulnerability detection and low response effectiveness in the prior art. The method includes: constructing a network multi-layer graphic model; using different identification methods to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model; combining the contextual information of the suspected network security vulnerability, dynamically evaluating multiple indicators of the suspected network security vulnerability, and determining whether the suspected network security vulnerability is a real network security vulnerability based on the evaluation results; combining a multi-level response planning system to generate an initial security response strategy corresponding to a real network security vulnerability, and combining historical response effects and user feedback information to optimize the initial security response strategy to obtain a target security response strategy. The technical solution provided by the present application improves the accuracy of network security vulnerability detection and the effectiveness of response.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a network security vulnerability detection method and system based on artificial intelligence. Background Art

[0002] Network security detection is an important means to ensure that network systems are protected from various threats and attacks. With the rapid development of information technology, the network environment is becoming increasingly complex, and traditional rule-based detection methods are gradually unable to cope with the ever-changing new threats. Therefore, the introduction of artificial intelligence and machine learning technology has become a key trend in modern network security detection.

[0003] Existing network security detection methods, based on artificial intelligence technology, learn normal behavior patterns from historical data and identify abnormal activities, implement real-time monitoring and automatic response mechanisms, quickly block potential threats, and improve the effectiveness of network security detection to a certain extent.

[0004] However, existing network security detection methods cannot adapt to scenario changes, resulting in poor accuracy in network security vulnerability detection and low response effectiveness. Summary of the invention

[0005] The embodiments of the present application provide a network security vulnerability detection method and system based on artificial intelligence, so as to solve the problems of poor accuracy and low response effectiveness of network security vulnerability detection in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a network security vulnerability detection method based on artificial intelligence, comprising:

[0007] Based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence, a hierarchical modeling method is used to build a multi-layer network graph model that reflects the current network status of the target system; the multiple layers include the physical layer, transport layer, application layer and user behavior layer;

[0008] Different identification methods are used to identify different types of suspected network security vulnerabilities in the network multi-layer graph model;

[0009] Combined with the context information of the suspected network security vulnerability, dynamically evaluate multiple indicators of the suspected network security vulnerability to obtain a multi-indicator dynamic evaluation result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result, where the multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment;

[0010] A reinforcement learning algorithm is used in combination with a multi-level response planning system to generate an initial security response strategy corresponding to a real network security vulnerability. The initial security response strategy is optimized based on historical response effects and user feedback information to obtain a target security response strategy.

[0011] Optionally, combining the context information of the suspected network security vulnerability, dynamically evaluating multiple indicators of the suspected network security vulnerability to obtain a multiple indicator dynamic evaluation result, and determining whether the suspected network security vulnerability is a real network security vulnerability according to the multiple indicator dynamic evaluation result includes:

[0012] Based on the contextual information of suspected network security vulnerabilities and the types of suspected network security vulnerabilities, a graph neural network is used to extract vulnerability features from the network multi-layer graph model and determine the vulnerability features as the current state;

[0013] Construct an evaluation indicator selection action library, where each evaluation indicator selection action in the evaluation indicator selection action library is used to select at least two indicators from among actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree, and concealment;

[0014] Based on the vulnerability assessment reward function, the deep Q network is used to select the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability from the assessment indicator selection action library, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result;

[0015] Use virtual reality technology to display multi-indicator dynamic assessment results and the formation process of suspected network security vulnerabilities in different regions;

[0016] Obtain the user's identification information of the suspected network security vulnerability, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result and the identification information, combined with known network security vulnerability features and the vulnerability knowledge graph constructed by the expert system.

[0017] Optionally, based on the vulnerability assessment reward function, the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability is selected from the assessment indicator selection action library using a deep Q network, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result, including:

[0018] Based on multiple objectives, a vulnerability assessment reward function is constructed. The multiple objectives include: risk reduction degree, propagation control effect, business impact degree and resource consumption;

[0019] Based on the correlation between the indicators in the evaluation indicator selection action and the types of suspected network security vulnerabilities, the reward value of the evaluation indicator selection action is calculated using the vulnerability assessment reward function, and the evaluation indicator selection action with the highest reward value is determined as the optimal evaluation indicator selection action;

[0020] Execute the optimal evaluation index selection action, use the indicator fusion evaluation function corresponding to the optimal evaluation index selection action, calculate the multi-indicator dynamic evaluation result, and the value of the parameter in the indicator fusion evaluation function is dynamically adjusted according to the reward feedback information during the execution of the optimal evaluation index selection action.

[0021] Optionally, the vulnerability assessment reward function takes the following formula:

[0022] ;

[0023] in, Select actions for evaluation metrics, Select the reward value of the action for the evaluation metric, is the first balancing parameter that controls the relative importance between the linear combination and the MLP output, , It is goals, Indicates The weight of the target Over time and the types of suspected cybersecurity breaches Dynamic adjustment of changes, represents a multi-layer perceptron, , , and They are risk reduction degree, propagation control effect, business impact degree and resource consumption. is the second equilibrium parameter, , Indicates Another weight for the target Over time and the types of suspected cybersecurity breaches Dynamic adjustment of changes, Is a nonlinear activation function used to increase the nonlinear characteristics of the model. is the normalization factor.

[0024] Optionally, virtual reality technology is used to display the dynamic evaluation results of multiple indicators and the formation process of suspected network security vulnerabilities by region, including:

[0025] Obtaining a user personalized display requirement text, and dividing the display interface into a first area and a second area according to the area division preference in the user personalized display requirement text;

[0026] According to the indicator display preference in the user's personalized display requirement text, the multi-indicator dynamic evaluation results are displayed in the first area, and according to the animation display preference in the user's personalized display requirement text, the formation process of the suspected network security vulnerability is displayed in the second area.

[0027] Optionally, the identifying different types of suspected network security vulnerabilities in the network multi-layer graphic model using different identification methods includes:

[0028] Adopting the physical layer vulnerability detection method, based on the physical layer data in the network multi-layer graph model, abnormal traffic monitoring, hardware status monitoring and intrusion detection system integration are carried out to identify physical layer vulnerabilities;

[0029] The transport layer vulnerability detection method is used to perform protocol consistency check, port scanning, service fingerprint identification and reconstruction error analysis based on the transport layer data in the network multi-layer graph model to identify transport layer vulnerabilities;

[0030] Adopt application layer vulnerability detection method, based on the application layer data in the network multi-layer graph model, perform static code analysis, dynamic application security testing and program abuse detection to identify application layer vulnerabilities;

[0031] Adopting the user behavior layer vulnerability detection method, based on the user behavior layer data in the network multi-layer graph model, user behavior analysis, authentication log analysis and permission abuse detection are performed to identify user behavior layer vulnerabilities;

[0032] A cross-layer vulnerability detection method is adopted to perform cross-layer attack detection, cross-layer behavior pattern recognition and unknown vulnerability feature recognition based on the cross-layer data in the network multi-layer graph model to identify cross-layer vulnerabilities.

[0033] Optionally, the cross-layer vulnerability detection method is used to perform cross-layer attack detection, cross-layer behavior pattern recognition, and unknown vulnerability feature recognition based on cross-layer data in the network multi-layer graph model to identify cross-layer vulnerabilities, including:

[0034] In combination with the attention mechanism, based on the cross-layer data in the network multi-layer graphic model, a key layer pair is identified, wherein the key layer pair includes two adjacent layers;

[0035] Perform cross-layer attack detection, cross-layer behavior pattern recognition, and unknown vulnerability feature recognition on the key layer pairs to obtain cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results;

[0036] Verify the accuracy of cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results. When all results have been verified, identify cross-layer vulnerabilities based on the cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results.

[0037] In a second aspect, an embodiment of the present application provides a network security vulnerability detection system based on artificial intelligence, including:

[0038] A construction module is used to construct a multi-layered network graph model reflecting the current network status of the target system using a hierarchical modeling method based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data, and external threat intelligence; the multiple layers include the physical layer, the transport layer, the application layer, and the user behavior layer;

[0039] An identification module, used to identify different types of suspected network security vulnerabilities in a network multi-layer graphic model using different identification methods;

[0040] A dynamic assessment module is used to dynamically assess multiple indicators of a suspected network security vulnerability in combination with contextual information of the suspected network security vulnerability to obtain a multi-indicator dynamic assessment result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic assessment result. The multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment;

[0041] The generation optimization module is used to use a reinforcement learning algorithm, combined with a multi-level response planning system, to generate an initial security response strategy corresponding to a real network security vulnerability, and to optimize the initial security response strategy in combination with historical response effects and user feedback information to obtain a target security response strategy.

[0042] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an artificial intelligence-based network security vulnerability detection method as described in any one of the first aspects.

[0043] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements an artificial intelligence-based network security vulnerability detection method as described in any one of the first aspects.

[0044] In summary, in an embodiment of the present application, a network security vulnerability detection method based on artificial intelligence is provided, including: based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence, a hierarchical modeling method is used to construct a network multi-layer graph model for reflecting the current network status of the target system; the multiple layers include a physical layer, a transport layer, an application layer and a user behavior layer; different identification methods are used to identify different types of suspected network security vulnerabilities in the network multi-layer graph model; combined with the contextual information of the suspected network security vulnerability, multiple indicators of the suspected network security vulnerability are dynamically evaluated to obtain a multi-indicator dynamic evaluation result, and whether the suspected network security vulnerability is a real network security vulnerability is determined according to the multi-indicator dynamic evaluation result, and the multiple indicators include actual risk level, propagation capability, impact range, impact duration, repair difficulty, business impact degree and concealment; a reinforcement learning algorithm is used, combined with a multi-level response planning system, to generate an initial security response strategy corresponding to the real network security vulnerability, and the initial security response strategy is optimized in combination with historical response effects and user feedback information to obtain a target security response strategy.

[0045] Beneficial effects of this application:

[0046] The embodiments of the present application optimize the response strategy through multi-level modeling, multi-index dynamic evaluation and reinforcement learning algorithm, thereby improving the accuracy, efficiency and response quality of detection, while reducing operating costs and enhancing the adaptability of the network security vulnerability detection system, thereby ensuring the security and stability of the network system.

[0047] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0049] Figure 1 A flowchart of a network security vulnerability detection method based on artificial intelligence provided in an embodiment of the present application;

[0050] Figure 2 A schematic diagram of the structure of a network security vulnerability detection system based on artificial intelligence provided in an embodiment of the present application;

[0051] Figure 3 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0052] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0053] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The sequence numbers of the operations, such as 11, 12, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to different types.

[0054] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0055] Figure 1 A flowchart of a network security vulnerability detection method based on artificial intelligence is provided in an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0056] Step S11, based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence, a hierarchical modeling method is used to construct a network multi-layer graphic model that reflects the current network status of the target system; the multiple layers include a physical layer, a transport layer, an application layer and a user behavior layer.

[0057] Among them, the target system refers to the network system that needs to be tested for network security vulnerabilities. The network topology can reflect the connection relationship between each node (such as server, router, switch, etc.) in the network system, and help understand the overall architecture and data flow path of the network system. The communication mode between nodes can explain how data is exchanged between different nodes in the network system, including the protocols, ports and service types used, which can be used to identify normal and abnormal communication behaviors. Real-time traffic data can reflect the data flow transmitted in the current network system, including information such as packet size, frequency, source address, destination address, etc., which is used to monitor network activities in real time and capture abnormal traffic patterns. Multi-source security log data can be security logs from multiple sources, including firewall logs, intrusion detection system logs, application logs, etc., providing historical security event records, which can assist in analyzing and verifying suspected network security vulnerabilities. External threat intelligence is information about known threats obtained from external channels, such as malicious address lists, vulnerability databases, etc., which is used to enhance detection capabilities and help identify new or unknown threats. Hierarchical modeling method is a modeling method that decomposes a complex network system into multiple levels in a hierarchical manner, and each level is responsible for processing a specific type of interaction relationship. In this embodiment, a multi-layer graphical model reflecting the current network status of the target system can be constructed. The network multi-layer graph model is a graphical representation containing multiple layers. Each layer represents a different aspect of the network system (such as the physical layer, transport layer, application layer, and user behavior layer), and represents the relationship between them through edges and nodes. It comprehensively displays the network status and supports multi-level security analysis.

[0058] Step S12: using different identification methods to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model.

[0059] Among them, identification methods are methods and technologies used to detect and identify potential security vulnerabilities, including machine learning, rule matching, anomaly detection, etc., to ensure the comprehensiveness and accuracy of detection.

[0060] Optionally, the embodiments of the present application may use different identification methods (such as machine learning, rule matching, anomaly detection, etc.) to identify different types of security vulnerabilities at different levels in the network multi-layer graph model. For example, hardware failures may be identified at the physical layer, traffic anomalies may be identified at the transport layer, software vulnerabilities may be identified at the application layer, and abnormal user behavior may be identified at the user behavior layer.

[0061] Step S13: Combine the context information of the suspected network security vulnerability, dynamically evaluate multiple indicators of the suspected network security vulnerability, obtain the multi-indicator dynamic evaluation result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result. The multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment.

[0062] Among them, context information is background information related to suspected network security vulnerabilities, including time, location, environment and other factors, combined with multi-indicator evaluation to improve the accuracy and reliability of the evaluation results. Multi-indicator dynamic evaluation refers to a comprehensive evaluation of multiple key indicators of suspected network security vulnerabilities, and dynamically adjusts the evaluation criteria according to actual conditions to ensure the rationality and pertinence of the evaluation results.

[0063] Step S14: Use a reinforcement learning algorithm in combination with a multi-level response planning system to generate an initial security response strategy corresponding to a real network security vulnerability. Combine historical response effects and user feedback information to optimize the initial security response strategy and obtain a target security response strategy.

[0064] Among them, the reinforcement learning algorithm is a machine learning method that continuously optimizes strategies through a trial-and-error process to maximize cumulative rewards, generate and optimize initial security response strategies, and ensure the effectiveness and adaptability of the response. The multi-level response planning system is a response planning framework that comprehensively considers the needs of different levels, ensuring that the most appropriate response measures can be taken in different scenarios, and formulating and optimizing security response strategies. The initial security response strategy is a preliminary response plan generated based on the preliminary evaluation results. It usually needs to be further optimized as the basis for the response, ensuring a rapid response while providing a reference for subsequent optimization. The target security response strategy is the final security response plan after optimization. It combines historical response effects and user feedback information to ensure the best response effect. As the final executed response strategy, it ensures the security and stability of the target system.

[0065] By executing steps S11 to S14, the embodiment of the present application integrates multiple data sources to construct a multi-level graphical model to ensure that the current state of the network can be fully reflected. Different identification methods are used to identify vulnerabilities for network models at different levels to ensure that all possible threat points are covered and to reduce missed reports and false positives. Combined with the contextual information of suspected network security vulnerabilities, multiple key indicators are dynamically evaluated to ensure the scientificity and reliability of the evaluation results and avoid the one-sidedness of a single indicator. Through the reinforcement learning algorithm, security response strategies are generated and optimized to ensure the effectiveness and adaptability of the response. At the same time, combined with historical response effects and user feedback information, the adaptive ability of the network security vulnerability detection system and its ability to respond to unknown threats are enhanced.

[0066] How to use different identification methods to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model is the key to accurately identifying real network security vulnerabilities. Therefore, the embodiment of the present application can refine step S12. In an optional embodiment, step S12, using different identification methods to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model, includes:

[0067] Step 121, using the physical layer vulnerability detection method, based on the physical layer data in the network multi-layer graphic model, abnormal traffic monitoring, hardware status monitoring and intrusion detection system integration are performed to identify physical layer vulnerabilities. Among them, abnormal traffic monitoring refers to identifying data flows that do not conform to normal behavior patterns by analyzing network traffic data, which may indicate potential security threats or attack activities. Abnormal traffic monitoring results include abnormal data packet size, frequency, source address, destination address, etc. Hardware status monitoring refers to real-time monitoring of the operating status of physical devices (such as servers, routers, switches), including temperature, power status, hardware failures, etc., to ensure that the hardware devices are in good working condition and to promptly discover and handle hardware problems. Intrusion detection system integration is used to integrate the functions of the intrusion detection system into the physical layer vulnerability detection method, and use the security event records provided by the intrusion detection system to assist in detecting physical layer vulnerabilities. Therefore, this embodiment can combine the intrusion detection system log and real-time monitoring data to improve the accuracy and comprehensiveness of physical layer vulnerability detection.

[0068] Step 122, using a transport layer vulnerability detection method, based on the transport layer data in the network multi-layer graphic model, protocol consistency check, port scanning and service fingerprint identification and reconstruction error analysis are performed to identify transport layer vulnerabilities. Among them, the protocol consistency check verifies whether the use of transport layer protocols, such as the Transmission Control Protocol (TCP), the Internet Protocol (IP), etc., complies with standard specifications to ensure the security and reliability of the communication process. Optionally, this embodiment can check the consistency of key fields such as the protocol message format, sequence number, checksum, etc. Port scanning and service fingerprint identification refer to scanning open ports and services to identify the service type and version information running on the target system, help discover potential known vulnerabilities and service configuration errors, and provide clues for subsequent attacks. Reconstruction error analysis can refer to: reconstructing the transport layer data based on a machine learning model, and calculating the error between the actual data and the reconstructed data to identify abnormal situations, which is suitable for detecting abnormal behaviors in covert channels and encrypted traffic.

[0069] Step 123, using an application layer vulnerability detection method, based on the application layer data in the network multi-layer graph model, static code analysis, dynamic application security testing and program abuse detection are performed to identify application layer vulnerabilities. Among them, static code analysis refers to reviewing the application code through static analysis tools to find potential security vulnerabilities and coding errors. Optionally, static code analysis includes syntax checking, logic error detection, dependency library analysis, etc. Dynamic application security testing can refer to evaluating the security of the application at runtime through simulated attacks and interactive testing. Dynamic application security testing includes penetration testing, fuzz testing, input validation testing, etc. Program abuse detection is used to identify whether the application is used maliciously, such as attacks through application abuse, Structured Query Language (SQL) injection, etc., so the application interface call pattern can be monitored to detect abnormal request frequencies and parameter combinations.

[0070] Step 124, using a user behavior layer vulnerability detection method, based on the user behavior layer data in the network multi-layer graph model, user behavior analysis, identity authentication log analysis and permission abuse detection are performed to identify user behavior layer vulnerabilities. Among them, user behavior analysis refers to modeling and analyzing the user's behavior pattern in the network to identify abnormal behaviors, such as abnormal login time, access frequency, etc. Optionally, this embodiment can use a machine learning algorithm to capture user behavior characteristics, establish a behavioral baseline, and detect behaviors that deviate from the baseline. Identity authentication log analysis refers to analyzing the logs of the identity authentication system to identify potential authentication failures, brute force cracking attempts and other abnormal behaviors. Identity authentication log analysis includes a comprehensive analysis of information such as the number of login attempts, geographic location, and timestamp. Permission abuse detection is used to detect whether a user or program has exceeded its proper authority and performed operations that should not be performed. Permission abuse detection includes monitoring of file access rights, database query rights, system command execution rights, etc.

[0071] Step 125, using a cross-layer vulnerability detection method, based on the cross-layer data in the network multi-layer graph model, cross-layer attack detection, cross-layer behavior pattern recognition and unknown vulnerability feature recognition are performed to identify cross-layer vulnerabilities. Among them, cross-layer attack detection refers to the identification of complex attack behaviors across multiple network layers (such as physical layer, transport layer, application layer). This embodiment combines data at different levels to capture associated behaviors in a multi-stage attack chain. Cross-layer behavior pattern recognition can be used to identify behavior patterns across multiple network layers, especially abnormal patterns that may cause security threats. Optionally, this embodiment uses machine learning and graph neural networks to capture long-term dependencies in cross-layer interactions. Unknown vulnerability feature recognition is to identify new vulnerability features that have not yet been recorded or disclosed through unsupervised learning and transfer learning. Unknown vulnerability feature recognition includes clustering analysis, anomaly detection and other technologies, which can be used to capture unknown but suspicious behavior patterns.

[0072] As a possible implementation method, step 125 adopts a cross-layer vulnerability detection method to perform cross-layer attack detection, cross-layer behavior pattern recognition, and unknown vulnerability feature recognition based on cross-layer data in the network multi-layer graph model to identify cross-layer vulnerabilities, including:

[0073] Step a1, in combination with the attention mechanism, based on the cross-layer data in the network multi-layer graphic model, identify key layer pairs, and the key layer pairs include two adjacent layers. Among them, the attention mechanism is a technology that simulates the human attention selection mechanism and is used to highlight the most relevant parts of the input data. In cross-layer data processing, this embodiment ensures that the model focuses on the most relevant information and improves detection accuracy by assigning different weights to data at different levels. A key layer pair refers to a pair of adjacent layers selected in a network multi-layer graphic model, and the interaction between them is considered to be critical to security assessment. In this embodiment, the selection of key layer pairs can be based on historical data and domain expert knowledge to ensure that important cross-layer interaction relationships are captured.

[0074] Step a2: Perform cross-layer attack detection, cross-layer behavior pattern recognition and unknown vulnerability feature recognition on key layer pairs to obtain cross-layer attack detection results, cross-layer behavior pattern recognition results and unknown vulnerability feature recognition results.

[0075] Step a3: Verify the accuracy of the cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results. If all results are verified, identify cross-layer vulnerabilities based on the cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results. Verify the accuracy to ensure the correctness and reliability of the detection results and avoid false positives and negatives. In this embodiment, the detection results can be reconfirmed through a variety of methods (such as expert system evaluation, machine learning model evaluation, cross-validation, etc.) to ensure that they are consistent with the actual situation.

[0076] By executing steps a1 to a3, the embodiment of the present application ensures that the model can focus on the most relevant cross-layer data through the attention mechanism, thereby improving the accuracy and efficiency of detection. The selection of key layer pairs is dynamically adjusted according to real-time data, thereby enhancing the flexibility and adaptability of the network security vulnerability detection system. Cross-layer attack detection can identify complex attack behaviors across multiple levels, thereby improving overall security. Cross-layer behavior pattern recognition captures associated behaviors in multi-stage attack chains, thereby enhancing the comprehensiveness of detection. Unknown vulnerability feature recognition identifies new vulnerabilities that have not yet been recorded or disclosed through unsupervised learning and transfer learning, thereby enhancing the adaptive capabilities of the network security vulnerability detection system. The detection results are reconfirmed through a variety of methods to ensure their correctness and reliability, and to avoid false positives and false negatives. User feedback information is recorded for continuous optimization of verification models and rules, forming a closed-loop optimization mechanism, and continuously improving the performance of the network security vulnerability detection system. Combined with expert systems and machine learning models, the detection results are comprehensively evaluated to ensure that the vulnerabilities finally confirmed are real, thereby taking effective countermeasures.

[0077] By executing steps 121 to 125, the embodiment of the present application ensures the security and stability of physical devices through hardware status monitoring and intrusion detection system integration. Abnormal traffic monitoring can promptly detect and respond to potential DDoS attacks or other large-scale traffic anomalies. Protocol consistency check ensures the security and reliability of transport layer communication. Port scanning and service fingerprinting help to discover potential known vulnerabilities and service configuration errors. Reconstruction error analysis can identify abnormal behavior in encrypted traffic and improve the depth of detection. Static code analysis can discover potential security vulnerabilities in the development stage and reduce risks after going online. Dynamic application security testing ensures the security of applications at runtime and covers more attack surfaces. Program abuse detection can identify and prevent improper operations of malicious users or programs and protect system resources. User behavior analysis establishes a user behavior baseline and improves the accuracy of identifying abnormal behavior. Authentication log analysis can promptly detect and prevent attacks such as brute force cracking. Permission abuse detection ensures that users and programs can only operate within their proper permissions to prevent unauthorized behavior. Cross-layer attack detection can identify complex attack behaviors across multiple levels and improve overall security. Cross-layer behavior pattern recognition captures associated behaviors in multi-stage attack chains and enhances the comprehensiveness of detection. Unknown vulnerability feature recognition can identify new vulnerabilities that have not been recorded or disclosed through unsupervised learning and transfer learning, thereby enhancing the adaptive capabilities of network security vulnerability detection systems.

[0078] In some possible embodiments, step S13, combining the context information of the suspected network security vulnerability, dynamically evaluating multiple indicators of the suspected network security vulnerability to obtain a multi-indicator dynamic evaluation result, and determining whether the suspected network security vulnerability is a real network security vulnerability according to the multi-indicator dynamic evaluation result, includes:

[0079] Step 131: Based on the context information of the suspected network security vulnerability and in combination with the type of the suspected network security vulnerability, a graph neural network is used to extract vulnerability features from the network multi-layer graph model, and the vulnerability features are determined as the current state.

[0080] Step 132: construct an evaluation indicator selection action library, where each evaluation indicator selection action in the evaluation indicator selection action library is used to select at least two indicators from among actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment.

[0081] Step 133: Based on the vulnerability assessment reward function, the deep Q network is used to select the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability from the assessment indicator selection action library, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result.

[0082] As a possible embodiment, step 133, based on the vulnerability assessment reward function, uses a deep Q network to select an optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability from an assessment indicator selection action library, executes the optimal assessment indicator selection action, and obtains a multi-indicator dynamic assessment result, including:

[0083] Step b1: Based on multiple objectives, a vulnerability assessment reward function is constructed. The multiple objectives include: risk reduction degree, propagation control effect, business impact degree and resource consumption. Among them, the vulnerability assessment reward function is a mathematical model used to quantify the evaluation indicator selection action. It comprehensively considers multiple objectives, including risk reduction degree, propagation control effect, business impact degree and resource consumption. Among them, the risk reduction degree is used to measure the correlation between the evaluation indicator selection action and the risk brought by the potential threat. The propagation control effect is used to determine the correlation between the evaluation indicator selection action and the propagation speed. The business impact degree is used to ensure that the evaluation indicator selection action does not cause excessive interference to the daily operations of the enterprise. Resource consumption includes the human, material and time costs required to implement the evaluation indicator selection action.

[0084] Step b2: Based on the correlation between the indicators in the evaluation indicator selection action and the type of suspected network security vulnerability, the reward value of the evaluation indicator selection action is calculated using the vulnerability evaluation reward function, and the evaluation indicator selection action with the highest reward value is determined as the optimal evaluation indicator selection action. It should be understood that too many evaluation indicators are likely to waste computing resources, and too few evaluation indicators cannot correctly reflect the evaluation results. Based on this, this embodiment uses a deep Q network to select evaluation indicators through a vulnerability evaluation reward function.

[0085] Among them, the vulnerability assessment reward function can be expressed as follows:

[0086] ;

[0087] in, Select actions for evaluation metrics, Select the reward value of the action for the evaluation metric, is the first balancing parameter that controls the relative importance between the linear combination and the MLP output, , It is goals, Indicates The weight of the target Over time and the types of suspected cybersecurity breaches Dynamic adjustment of changes, represents a multi-layer perceptron, , , and They are risk reduction degree, propagation control effect, business impact degree and resource consumption. is the second equilibrium parameter, , Indicates Another weight for the target Over time and the types of suspected cybersecurity breaches Dynamic adjustment of changes, Is a nonlinear activation function used to increase the nonlinear characteristics of the model. is the normalization factor.

[0088] In this embodiment, by introducing four different evaluation objectives, the effect of an evaluation indicator selection action can be comprehensively measured to ensure that all dimensions are fully considered. This multi-objective evaluation method can more accurately reflect the actual effect of security response. and The two parameters allow the importance of each goal to be dynamically adjusted according to the time and the type of suspected cybersecurity vulnerability, which means that the system can flexibly adjust the weights of each goal according to the actual situation, so as to better adapt to the changing security environment. For example, when dealing with an emergency vulnerability, more attention may be paid to the effect of risk reduction and propagation control; while in daily maintenance, more attention may be paid to the degree of business impact and resource consumption. The first balance parameter is used to control the relative importance between the linear combination part and the output of the multilayer perceptron. By adjusting the first balance parameter, the best balance point can be found between the simple weighted summation and the complex nonlinear model, which not only improves the flexibility of the model, but also enhances its adaptability to complex scenarios. The nonlinear activation function increases the expressive power of the model, allowing it to capture more complex patterns and relationships, which is particularly important for dealing with cybersecurity issues with high uncertainty and complexity, because linear models may not be able to fully describe the behavioral characteristics in these cases. The introduction of the normalization factor ensures that the final reward value range is reasonable and will not be distorted due to some items being too large or too small, which helps to maintain the consistency and comparability of the evaluation results and makes the comparison between actions selected by different evaluation indicators more fair and just. The second balance parameter is used to control the relative importance between the linear combination part and the constant term (i.e., the normalization factor) in the denominator. This mechanism further enhances the flexibility of the model and ensures that the reward function can maintain appropriate sensitivity and stability in different situations.

[0089] In summary, the vulnerability assessment reward function significantly enhances the accuracy, flexibility and adaptability of the assessment by means of comprehensive multi-objective assessment, dynamic weight adjustment, balancing linear combination and nonlinear model output, introducing nonlinear activation function, normalization processing and setting the second balance parameter. This method can not only measure the effect of security response more comprehensively, but also flexibly adjust the evaluation criteria according to actual conditions, thus providing strong support for network security management. In addition, it also ensures the consistency and comparability of the evaluation results through normalization processing, providing a reliable basis for decision makers.

[0090] Step b3, execute the optimal evaluation index selection action, use the index fusion evaluation function corresponding to the optimal evaluation index selection action, calculate the multi-indicator dynamic evaluation result, and the value of the parameter in the index fusion evaluation function is dynamically adjusted according to the reward feedback information during the execution of the optimal evaluation index selection action. Among them, the reward feedback information refers to the difference between the actual result obtained after executing the evaluation index selection action and the expected goal. For example, a positive reward can be obtained by successfully blocking an attack attempt; conversely, if an operation causes an unexpected service interruption, a negative reward will be generated. The index fusion evaluation function is used to fuse multiple indicator evaluation results to obtain a multi-indicator dynamic evaluation result. This function not only relies on statically set parameters, but also can dynamically adjust parameter values ​​according to the reward feedback information collected during the actual execution process, so as to more accurately capture the true effect of the evaluation index selection action.

[0091] By executing steps b1 to b3, the embodiment of the present application reduces the time cost of manual judgment by automatically screening out the optimal evaluation index selection action, thereby improving the speed and accuracy of emergency response; introduces a dynamic weight adjustment mechanism to make the evaluation more in line with actual needs and avoids deviations caused by fixed parameter settings; with the help of the recycling of reward feedback information, a closed-loop control system is formed to continuously optimize the evaluation model and its application strategy, thereby promoting the iterative upgrade of the entire security management process; in the face of increasingly complex network threat situations, this method can flexibly respond to different types of security challenges, ensure that reasonable and effective responses can be made in various situations, and provide solid technical support for automated and intelligent management in the field of network security.

[0092] Step 134: Use virtual reality technology to display the dynamic evaluation results of multiple indicators and the formation process of suspected network security vulnerabilities in different regions. Virtual reality technology may refer to the use of computers to generate a three-dimensional environment in which users can immerse themselves and interact with it through special equipment (such as head-mounted displays). In the field of network security, virtual reality technology can be used to simulate complex network environments to help security experts conduct training, testing or evaluation.

[0093] As a possible implementation method, step 134, using virtual reality technology to display the multi-indicator dynamic evaluation results and the formation process of suspected network security vulnerabilities in different regions, includes:

[0094] Step c1, obtaining the user's personalized display requirement text, and dividing the display interface into the first area and the second area according to the area division preference in the user's personalized display requirement text. Personalized display requirement text refers to a content description customized according to the user's specific requirements, including but not limited to interface layout, data display method, and animation effect. This embodiment allows the system to adjust its output form according to the preferences of different users. Area division preference refers to the user's choice of how to divide the screen space to suit their work habits. For example, some users may prefer horizontal division, while others prefer vertical division.

[0095] Step c2: Display the multi-indicator dynamic evaluation results in the first area according to the indicator display preference in the user's personalized display requirement text, and display the formation process of suspected network security vulnerabilities in the second area according to the animation display preference in the user's personalized display requirement text. The multi-indicator dynamic evaluation results refer to the results of real-time monitoring and evaluation of network security status from multiple dimensions (such as actual risk level, propagation capability, impact range, etc.). These indicators can help decision makers fully understand the current security situation. The formation process of suspected network security vulnerabilities refers to the reproduction of conditions and steps that may lead to security vulnerabilities through simulation or retrospective analysis, which is very important for understanding how vulnerabilities occur and how to prevent similar incidents in the future. Indicator display preference refers to the user's choice of which security indicators should be displayed first and their presentation methods (charts, numbers, color coding, etc.). Animation display preference refers to the user's choice of the presentation method (speed, degree of detail, etc.) of dynamic content (such as attack path demonstration, system response time change, etc.).

[0096] Exemplarily, after the user launches the application, they will first be directed to a settings interface where they can enter their personalized display requirements text, specify the type of information they want to see (such as high-priority alerts, traffic patterns, etc.), and the desired visual style (such as dark mode vs. light mode). Next, the system automatically configures the interface layout based on the user's input. For example, if the user selects horizontal separation, the upper half of the interface will be used to display the results of multi-indicator dynamic assessments, and the lower half will be used to play animations of suspected network security vulnerabilities. When users enter the main interface, they will find themselves in a virtual space consisting of two major parts. On the left is a real-time updated security status dashboard, and on the right is a small theater that vividly reproduces historical events or simulates potential threat scenarios. Users can interact with these two areas through gestures or voice commands to gain a deeper understanding of the stories behind each element.

[0097] By executing steps c1 to c2, the embodiment of the present application allows users to customize the interface and information flow, ensuring that everyone can find the work mode that suits them best and improving work efficiency. When users feel that they have a certain degree of control over the environment, they tend to be more engaged in the task. This personalized setting helps to stimulate users' interest in exploring more functions. Reasonable space allocation allows important information to be highlighted and secondary information will not be ignored, thereby achieving efficient information exchange. Combining quantitative analysis with qualitative observation provides users with a comprehensive perspective, allowing them to fully consider all relevant factors before making key judgments.

[0098] In summary, by introducing virtual reality technology and personalized customization options, not only the accuracy and efficiency of network security assessment work are improved, but also the user's operating experience is greatly enriched. This method is not only suitable for professional security analysts, but can also be used as a new means of education and training to help more people understand complex network security concepts.

[0099] Step 135: Obtain the user's identification information of the suspected network security vulnerability, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation results and the identification information, combined with the known network security vulnerability features and the vulnerability knowledge graph constructed by the expert system.

[0100] By executing steps 131 to 135, the embodiment of the present application can effectively extract vulnerability features from the network multi-layer graph model by analyzing the context information of the suspected network security vulnerability and considering its type. These features include not only code snippets or configuration errors directly related to the vulnerability, but also a wider range of influencing factors, such as system environment, user behavior patterns, etc. Finally, the extracted features are used to define the current state. In order to better deal with different types of security threats, each evaluation indicator selection action is associated with at least two evaluation indicators, such as actual risk level and propagation capability, or repair difficulty and business impact, etc. Such a design ensures that for each possible threat scenario, there is a corresponding strategy to be taken. Based on the deep Q network, the best evaluation indicator selection action for a specific type of suspected vulnerability can be found. The method can automatically learn which evaluation indicator selection actions have performed well in the past and apply this experience to future decision-making processes. In this way, not only can the appropriate action plan be determined quickly and accurately, but also the performance of the system can be continuously improved, making it more intelligent and efficient over time. This embodiment provides a novel and intuitive way to present complex multi-indicator dynamic evaluation results and the development history of suspected vulnerabilities. Users can adjust the layout of the display interface according to their personal preferences, so that important information is clear at a glance. At the same time, by animating the process of how a suspected vulnerability is formed, security analysts can have a deeper understanding of the nature of the problem and develop more effective defense measures. In addition, this immersive experience can also be used for training purposes, allowing novices to get started with complex security tasks more quickly. Collect user opinions on suspected vulnerabilities and combine them with all previously obtained information to determine whether the suspected vulnerability actually exists. This process not only relies on automated tools and technologies, but also requires the integration of human professional judgment to ensure the accuracy of the final conclusion. In this way, the false alarm rate can be reduced while speeding up the response time to security incidents that really need attention.

[0101] Figure 2 A schematic diagram of the structure of a network security vulnerability detection system based on artificial intelligence provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the system includes:

[0102] Construction module 21 is used to construct a network multi-layer graphical model that reflects the current network status of the target system based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence using a hierarchical modeling method; the multiple layers include a physical layer, a transport layer, an application layer and a user behavior layer.

[0103] The identification module 22 is used to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model by using different identification methods.

[0104] The dynamic assessment module 23 is used to dynamically assess multiple indicators of the suspected network security vulnerability in combination with the context information of the suspected network security vulnerability, obtain the multi-indicator dynamic assessment result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic assessment result. The multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment.

[0105] The generation optimization module 24 is used to use a reinforcement learning algorithm, combined with a multi-level response planning system, to generate an initial security response strategy corresponding to a real network security vulnerability, and to optimize the initial security response strategy in combination with historical response effects and user feedback information to obtain a target security response strategy.

[0106] Figure 2 The network security vulnerability detection system based on artificial intelligence can perform Figure 1 The implementation principle and technical effects of the network security vulnerability detection method based on artificial intelligence described in the illustrated embodiment will not be described in detail. The specific manner in which each module and unit performs operations in the network security vulnerability detection system based on artificial intelligence in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0107] In one possible design, Figure 2 The network security vulnerability detection system based on artificial intelligence of the embodiment shown can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32 .

[0108] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0109] The processing component 32 is used to: construct a network multi-layer graphic model that reflects the current network status of the target system based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence using a hierarchical modeling method; the multiple layers include a physical layer, a transport layer, an application layer and a user behavior layer; use different identification methods to identify different types of suspected network security vulnerabilities in the network multi-layer graphic model; combine the context information of the suspected network security vulnerabilities to dynamically evaluate multiple indicators of the suspected network security vulnerabilities to obtain a multi-indicator dynamic evaluation result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result, and the multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment; use a reinforcement learning algorithm, combined with a multi-level response planning system, to generate an initial security response strategy corresponding to the real network security vulnerability, and combine the historical response effect and user feedback information to optimize the initial security response strategy to obtain a target security response strategy.

[0110] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0111] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as random access memory (RAM), static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0112] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0113] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0114] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0115] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0116] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 The illustrated embodiment is an artificial intelligence-based network security vulnerability detection method.

[0117] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0118] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0119] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0120] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network security vulnerability detection method based on artificial intelligence, characterized in that: include: Based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data and external threat intelligence, a hierarchical modeling method is used to build a multi-layer network graph model that reflects the current network status of the target system; the multiple layers include the physical layer, transport layer, application layer and user behavior layer; Different identification methods are used to identify different types of suspected network security vulnerabilities in the network multi-layer graph model; Combined with the context information of the suspected network security vulnerability, dynamically evaluate multiple indicators of the suspected network security vulnerability to obtain a multi-indicator dynamic evaluation result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result, where the multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment; Using reinforcement learning algorithm, combined with a multi-level response planning system, to generate an initial security response strategy corresponding to a real network security vulnerability, and combining historical response effects and user feedback information to optimize the initial security response strategy and obtain the target security response strategy; The dynamically evaluating multiple indicators of the suspected network security vulnerability in combination with the context information of the suspected network security vulnerability to obtain a multiple indicator dynamic evaluation result, and determining whether the suspected network security vulnerability is a real network security vulnerability according to the multiple indicator dynamic evaluation result, includes: Based on the contextual information of suspected network security vulnerabilities and the types of suspected network security vulnerabilities, a graph neural network is used to extract vulnerability features from the network multi-layer graph model and determine the vulnerability features as the current state; Construct an evaluation indicator selection action library, where each evaluation indicator selection action in the evaluation indicator selection action library is used to select at least two indicators from among actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree, and concealment; Based on the vulnerability assessment reward function, the deep Q network is used to select the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability from the assessment indicator selection action library, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result; Use virtual reality technology to display multi-indicator dynamic assessment results and the formation process of suspected network security vulnerabilities in different regions; Obtaining identification information of a suspected network security vulnerability from a user, and determining whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result and the identification information, combined with known network security vulnerability features and a vulnerability knowledge graph constructed by an expert system; The different identification methods used to identify different types of suspected network security vulnerabilities in the network multi-layer graph model include: Adopting the physical layer vulnerability detection method, based on the physical layer data in the network multi-layer graph model, abnormal traffic monitoring, hardware status monitoring and intrusion detection system integration are carried out to identify physical layer vulnerabilities; The transport layer vulnerability detection method is used to perform protocol consistency check, port scanning, service fingerprint identification and reconstruction error analysis based on the transport layer data in the network multi-layer graph model to identify transport layer vulnerabilities; Adopt application layer vulnerability detection method, based on the application layer data in the network multi-layer graph model, perform static code analysis, dynamic application security testing and program abuse detection to identify application layer vulnerabilities; Adopting the user behavior layer vulnerability detection method, based on the user behavior layer data in the network multi-layer graph model, user behavior analysis, authentication log analysis and permission abuse detection are performed to identify user behavior layer vulnerabilities; A cross-layer vulnerability detection method is adopted to perform cross-layer attack detection, cross-layer behavior pattern recognition and unknown vulnerability feature recognition based on cross-layer data in the network multi-layer graph model to identify cross-layer vulnerabilities.

2. The method according to claim 1, characterized in that The vulnerability assessment reward function is based on the deep Q network, and the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability is selected from the assessment indicator selection action library, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result, including: Based on multiple objectives, a vulnerability assessment reward function is constructed. The multiple objectives include: risk reduction degree, propagation control effect, business impact degree and resource consumption; Based on the correlation between the indicators in the evaluation indicator selection action and the types of suspected network security vulnerabilities, the reward value of the evaluation indicator selection action is calculated using the vulnerability assessment reward function, and the evaluation indicator selection action with the highest reward value is determined as the optimal evaluation indicator selection action; Execute the optimal evaluation index selection action, use the indicator fusion evaluation function corresponding to the optimal evaluation index selection action, calculate the multi-indicator dynamic evaluation result, and the value of the parameter in the indicator fusion evaluation function is dynamically adjusted according to the reward feedback information during the execution of the optimal evaluation index selection action.

3. The method according to claim 2, characterized in that The vulnerability assessment reward function uses the following formula: ； in, Select actions for evaluation metrics, Select the reward value of the action for the evaluation metric, is the first balancing parameter that controls the relative importance between the linear combination and the MLP output, , It is goals, Indicates The weight of the target Over time and the types of suspected cybersecurity breaches Dynamic adjustment of changes, represents a multi-layer perceptron, , , and They are risk reduction degree, propagation control effect, business impact degree and resource consumption. is the second equilibrium parameter, , Indicates Another weight for the target Over time Dynamically adjust according to changes in the types of suspected network security vulnerabilities, Is a nonlinear activation function used to increase the nonlinear characteristics of the model. is the normalization factor.

4. The method according to claim 1, characterized in that Use virtual reality technology to display multi-indicator dynamic assessment results and the formation process of suspected network security vulnerabilities in different regions, including: Obtaining a user personalized display requirement text, and dividing the display interface into a first area and a second area according to the area division preference in the user personalized display requirement text; According to the indicator display preference in the user's personalized display requirement text, the multi-indicator dynamic evaluation results are displayed in the first area, and according to the animation display preference in the user's personalized display requirement text, the formation process of the suspected network security vulnerability is displayed in the second area.

5. The method according to claim 1, characterized in that: The cross-layer vulnerability detection method is used to detect cross-layer attacks, identify cross-layer behavior patterns, and identify unknown vulnerability features based on cross-layer data in a multi-layer network graph model to identify cross-layer vulnerabilities, including: In combination with the attention mechanism, based on the cross-layer data in the network multi-layer graphic model, a key layer pair is identified, wherein the key layer pair includes two adjacent layers; Perform cross-layer attack detection, cross-layer behavior pattern recognition, and unknown vulnerability feature recognition on the key layer pairs to obtain cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results; Verify the accuracy of cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results. When all results have been verified, identify cross-layer vulnerabilities based on the cross-layer attack detection results, cross-layer behavior pattern recognition results, and unknown vulnerability feature recognition results.

6. A network security vulnerability detection system based on artificial intelligence, characterized in that: include: A construction module is used to construct a multi-layered network graph model reflecting the current network status of the target system using a hierarchical modeling method based on the network topology of the target system, the communication mode between nodes in the target system, real-time traffic data, multi-source security log data, and external threat intelligence; the multiple layers include the physical layer, the transport layer, the application layer, and the user behavior layer; An identification module, used to identify different types of suspected network security vulnerabilities in a network multi-layer graphic model using different identification methods; A dynamic assessment module is used to dynamically assess multiple indicators of a suspected network security vulnerability in combination with contextual information of the suspected network security vulnerability to obtain a multi-indicator dynamic assessment result, and determine whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic assessment result. The multiple indicators include actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree and concealment; Generate an optimization module, which is used to generate an initial security response strategy corresponding to a real network security vulnerability by using a reinforcement learning algorithm and combining a multi-level response planning system, and optimize the initial security response strategy by combining historical response effects and user feedback information to obtain a target security response strategy; The dynamically evaluating multiple indicators of the suspected network security vulnerability in combination with the context information of the suspected network security vulnerability to obtain a multiple indicator dynamic evaluation result, and determining whether the suspected network security vulnerability is a real network security vulnerability according to the multiple indicator dynamic evaluation result, includes: Based on the contextual information of suspected network security vulnerabilities and the types of suspected network security vulnerabilities, a graph neural network is used to extract vulnerability features from the network multi-layer graph model and determine the vulnerability features as the current state; Construct an evaluation indicator selection action library, where each evaluation indicator selection action in the evaluation indicator selection action library is used to select at least two indicators from among actual risk level, propagation capability, impact scope, impact duration, repair difficulty, business impact degree, and concealment; Based on the vulnerability assessment reward function, the deep Q network is used to select the optimal assessment indicator selection action corresponding to the type of suspected network security vulnerability from the assessment indicator selection action library, and the optimal assessment indicator selection action is executed to obtain a multi-indicator dynamic assessment result; Use virtual reality technology to display multi-indicator dynamic assessment results and the formation process of suspected network security vulnerabilities in different regions; Obtaining identification information of a suspected network security vulnerability from a user, and determining whether the suspected network security vulnerability is a real network security vulnerability based on the multi-indicator dynamic evaluation result and the identification information, combined with known network security vulnerability features and a vulnerability knowledge graph constructed by an expert system; The different identification methods used to identify different types of suspected network security vulnerabilities in the network multi-layer graph model include: Adopting the physical layer vulnerability detection method, based on the physical layer data in the network multi-layer graph model, abnormal traffic monitoring, hardware status monitoring and intrusion detection system integration are carried out to identify physical layer vulnerabilities; The transport layer vulnerability detection method is used to perform protocol consistency check, port scanning, service fingerprint identification and reconstruction error analysis based on the transport layer data in the network multi-layer graph model to identify transport layer vulnerabilities; Adopt application layer vulnerability detection method, based on the application layer data in the network multi-layer graph model, perform static code analysis, dynamic application security testing and program abuse detection to identify application layer vulnerabilities; Adopting the user behavior layer vulnerability detection method, based on the user behavior layer data in the network multi-layer graph model, user behavior analysis, authentication log analysis and permission abuse detection are performed to identify user behavior layer vulnerabilities; A cross-layer vulnerability detection method is adopted to perform cross-layer attack detection, cross-layer behavior pattern recognition and unknown vulnerability feature recognition based on the cross-layer data in the network multi-layer graph model to identify cross-layer vulnerabilities.

7. A computing device, characterized in that It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement an artificial intelligence-based network security vulnerability detection method as described in any one of claims 1-5.

8. A computer storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a computer, an artificial intelligence-based network security vulnerability detection method as described in any one of claims 1 to 5 is implemented.

Images