Network security threat monitoring method and system based on artificial intelligence

Abstract

The invention discloses a network security threat monitoring method and system based on artificial intelligence, and relates to the technical field of digital information transmission, and the method comprises the steps: obtaining data of a plurality of data sources in a network environment, carrying out the multi-level data fusion of the data through an artificial intelligence model, and forming unified data representation; the artificial intelligence model comprises at least one selective fusion layer, and features are extracted from different data sources and are jointly expressed; based on a data fusion result, performing anomaly detection by adopting an unsupervised learning method; and modeling the network flow data into a graph structure according to the detected abnormal behavior, and analyzing the graph structure by adopting a graph neural network GNN. According to the method, the technical problems of difficulty in multi-dimensional data fusion, delay in threat detection, insufficient response capability and the like in the existing network security protection technology are solved.

Description

Technical Field

[0001] The present invention relates to the field of digital information transmission technology, and in particular to a network security threat monitoring method and system based on artificial intelligence. Background Art

[0002] With the rapid development of information technology, network security issues have become increasingly prominent. Especially in the context of the widespread application of technologies such as cloud computing, big data, and the Internet of Things, the methods and means of network attacks have become increasingly complex. Traditional network security protection systems usually rely on static rules and signature libraries. Although they can deal with known attacks, they are slow to respond to new and variant attack methods and lack sufficient response capabilities. In addition, when dealing with large-scale and highly complex network environments, existing security systems show the shortcomings of large response lags and poor adaptability. In particular, the processing of heterogeneous information from multiple data sources, real-time threat detection, and rapid response are still bottlenecks that are difficult to break through with existing technologies. Summary of the invention

[0003] In view of the above existing problems, the present invention is proposed.

[0004] Therefore, the present invention provides a network security threat monitoring method based on artificial intelligence, which can solve the technical problems existing in the existing network security protection technology, such as the difficulty of multi-dimensional data fusion, threat detection delay and insufficient response capability. First, the present invention proposes a multi-level data fusion technology based on artificial intelligence, which can efficiently fuse information from multiple heterogeneous data sources such as network traffic, endpoint logs, system calls, etc. into a unified feature representation, providing accurate basic data for subsequent threat detection and analysis. Secondly, the graph structure of network traffic is analyzed by the graph neural network (GNN) model, which can capture the complex interaction relationship between nodes, thereby identifying potential network threats. Third, the present invention adopts a federated learning framework to realize distributed network security protection. Each distributed node can collaboratively train the global model while maintaining data privacy, thereby improving the adaptability and robustness of network protection. Finally, through the generation and adjustment of adaptive security protection strategies, the present invention can automatically adjust the protection measures according to the real-time threat prediction results and optimize the security defense of the network.

[0005] In order to solve the above technical problems, the present invention provides the following technical solution, a network security threat monitoring method based on artificial intelligence, comprising:

[0006] Acquire data from multiple data sources in a network environment, and perform multi-level data fusion on the data through an artificial intelligence model to form a unified data representation, wherein the artificial intelligence model includes at least one selective fusion layer, extracts features from different data sources and represents them jointly;

[0007] Based on the data fusion results, anomaly detection is performed using unsupervised learning methods;

[0008] Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and the graph neural network GNN is used to analyze the graph structure.

[0009] As a preferred solution of the artificial intelligence-based network security threat monitoring method described in the present invention, the multiple data source data include network traffic data, endpoint logs, application logs, system call data, user behavior data and file access data, and the data source data is synchronously collected by the data acquisition module and transmitted to the corresponding module.

[0010] As a preferred solution of the network security threat monitoring method based on artificial intelligence described in the present invention, wherein: the unified data representation includes, after the feature extraction is completed, the selective fusion layer fuses the features of different data sources, and the fusion methods include weighted average, connection and dynamic fusion based on attention mechanism; wherein, the weighted average method weightedly combines the features according to the weights of different data sources, the connection method splices the feature vectors of different data sources together to form a new feature vector, and the fusion based on the attention mechanism combines the features by adaptively learning the importance of each data source; the specific representation is as follows:

[0011] From each data source Extract features from the dataset and use different deep learning models for feature extraction:

[0012] ;

[0013] in, Extract features for specific data sources; is the feature representation vector of the nth data source; is the nth data source; is the total number of data sources;

[0014] Since features from different data sources may have different dimensions, dimension alignment is required;

[0015] Assuming that the feature dimensions are inconsistent, we can Resize to the same dimensions , and obtain the feature representation of unified dimension :

[0016] ;

[0017] in, Represents a fully connected layer, which adjusts feature vectors of different dimensions to dimensions ;

[0018] In the selective fusion layer, there are three fusion methods: weighted average, concatenation, and weighted fusion based on attention mechanism;

[0019] The weighted average fusion includes the unified dimension feature representation of each data source Perform weighted averaging to obtain the fused features :

[0020] ;

[0021] in, is the weight coefficient of the nth data source and satisfies ;

[0022] Connection fusion includes concatenating the feature vectors of each data source to form a new feature vector :

[0023] ;

[0024] Among them, the concatenation operation concatenates each feature vector together in dimension to generate a new feature vector; Indicates a connection operation;

[0025] The weighted fusion based on the attention mechanism includes first calculating each The attention weight , through the scoring function Calculate the importance of each feature:

[0026] ;

[0027] in, Indicates the importance of each feature while ensuring the normalization of the weights so that the sum of all weights is 1; Represents the attention weight of the nth data source;

[0028] Use the attention weights to weight the features and get the final fused features. :

[0029] ;

[0030] After selective fusion, the feature vector It is a unified representation of the characteristics of each data source, which serves as the input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation.

[0031] As a preferred solution of the network security threat monitoring method based on artificial intelligence described in the present invention, wherein: the anomaly detection includes, first, assuming that the input data is , mapped to the latent space by the encoder ,in , d is the data dimension, w is the dimension of the latent space dimension;

[0032] Use autoencoder to train input data The encoder maps the input to the latent space , and then the latent representation is reconstructed through the decoder;

[0033] The encoder’s mapping is represented as:

[0034] ;

[0035] in, is the i-th input data, is the latent space representation of the i-th input data after passing through the encoder, is the encoder function, are the parameters of the encoder;

[0036] The decoder reconstruction is represented as:

[0037] ;

[0038] The decoder reconstructs the representation in the latent space Generate reconstruction number is the decoder function, are the parameters of the decoder; is the reconstruction result of the i-th data;

[0039] By calculating the error between the input data and the reconstructed result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection;

[0040] The reconstruction error is:

[0041] ;

[0042] Input data by calculation and the reconstruction results The square of the Euclidean distance between them gives the reconstruction error ;

[0043] Based on the comparison between the reconstruction error and the threshold, it is judged whether there is an abnormality. If it is greater than the preset threshold, the data point is considered abnormal;

[0044] Abnormal judgment:

[0045] ;

[0046] in, is the preset reconstruction error threshold, It is the tolerance threshold of the error. If the reconstruction error exceeds this threshold, it is judged as abnormal.

[0047] As a preferred solution of the network security threat monitoring method based on artificial intelligence described in the present invention, the anomaly detection includes, after detecting abnormal data, further analyzing the relationship of the abnormal data through a graph neural network, and using the graph convolution operation of the graph neural network to update the representation of each node in the graph. The graph convolution operation is specifically as follows:

[0048] ;

[0049] in, Is a node In the The representation in the iterations is Is a node In the The representation in the iterations is It is the edge The weight of Is a node The degree, Is a node The set of neighbor nodes of is the activation function;

[0050] Through multiple iterations, the representation of the node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows:

[0051] ;

[0052] like:

[0053] ;

[0054] in, represents the change in the representation of node i between the kth iteration and the k-1th iteration; Is the set change threshold. If the change represented by the node exceeds the threshold , then the node is considered an abnormal node;

[0055] If there is a problem with the node anomaly detection result, the anomaly is detected by the change of the edge weight in the graph. The abnormal edge determination is as follows:

[0056] ;

[0057] like:

[0058] ;

[0059] in, Represents edge The change in weights between two iterations; is the threshold of edge weight change. If the edge weight change exceeds the threshold, the edge is considered abnormal.

[0060] Combined with the representation of nodes and edges learned by the graph neural network, the abnormal patterns of the entire network are globally identified;

[0061] After the graph neural network iterates and updates the node representation multiple times, the representation of the entire graph is obtained. , Contains the representation of all nodes, as follows:

[0062] ;

[0063] in, It is Node representation of the entire graph after iterations.

[0064] As a preferred solution of the network security threat monitoring method based on artificial intelligence described in the present invention, wherein: the network traffic data is modeled as a graph structure, including using a graph neural network GNN to analyze the graph structure, the nodes in the graph structure represent different devices or entities in the network, the edges represent the communication paths between the devices, and the graph neural network GNN is used to learn the interaction relationship between the nodes and the network traffic characteristics, and analyze potential network threats;

[0065] The graph neural network GNN iteratively updates the representation of nodes in the graph, captures the dependencies between nodes, and identifies abnormal patterns in data streams, including unauthorized data access or malicious activities.

[0066] As a preferred solution of the network security threat monitoring method based on artificial intelligence described in the present invention, wherein: the analysis of the graph structure includes, on the basis of the analysis of the graph structure, further performing threat prediction through the joint representation of multimodal features, and based on the threat prediction results, using a federated learning framework for distributed network security protection, the federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to the central server for aggregation, and a global model is generated to improve the network protection effect;

[0067] Based on the obtained global model and the update results of the local model, an adaptive security protection strategy is generated, where the adaptive security protection strategy is used to adjust network firewall rules, access rights, and initiate defense measures against detected threats.

[0068] As a preferred solution of the artificial intelligence-based network security threat monitoring system described in the present invention, it includes: a data acquisition module, a data transmission module, an algorithm processing module and a security protection module; the data acquisition module is used to collect data information; the data transmission module is used to transmit and interact with data information; the algorithm processing module is used to process the collected data and match the corresponding operation strategy; the security protection module is used to adjust network firewall rules, access rights and initiate defense measures against detected threats.

[0069] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of a network security threat monitoring method based on artificial intelligence.

[0070] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of a network security threat monitoring method based on artificial intelligence are implemented.

[0071] Beneficial effects of the present invention: The artificial intelligence-based network security threat monitoring method and system provided by the present invention effectively integrates a variety of heterogeneous data sources through multi-level data fusion technology, significantly improving the accuracy and comprehensiveness of threat detection. Combined with the graph neural network (GNN) to model the graph structure of network traffic, it is possible to deeply understand the communication mode of each device in the network and timely discover potential abnormal behaviors and security threats. Utilizing the federated learning framework, the present invention ensures data privacy while realizing distributed collaborative training and improving the generalization ability of the security model. Finally, combined with the adaptive security protection strategy, it is possible to dynamically adjust network protection measures according to real-time threat prediction results and optimize the network's defense response capabilities. Through this comprehensive security protection method, the real-time response capability, adaptability and protection effect of the network security system can be significantly improved, and the increasingly complex network security threats can be effectively responded to. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0073] Figure 1 A flowchart of a network security threat monitoring method based on artificial intelligence is provided for one embodiment of the present invention.

[0074] Figure 2A schematic diagram of a module of an artificial intelligence-based network security threat monitoring system provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0075] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0076] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0077] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0078] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0079] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0080] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0081] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides a network security threat monitoring method based on artificial intelligence, comprising:

[0082] S1: Acquire data from multiple data sources in a network environment, and perform multi-level data fusion on the data through an artificial intelligence model to form a unified data representation. The artificial intelligence model includes at least one selective fusion layer, which extracts features from different data sources and represents them jointly.

[0083] S2: Based on the data fusion results, anomaly detection is performed using unsupervised learning methods.

[0084] S3: Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and the graph neural network GNN is used to analyze the graph structure.

[0085] The multiple data source data include network traffic data, endpoint logs, application logs, system call data, user behavior data and file access data, and the data source data are synchronously collected by the data collection module and transmitted to the corresponding module.

[0086] The unified data representation includes that after feature extraction is completed, the selective fusion layer fuses the features of different data sources, and the fusion methods include weighted average, connection and dynamic fusion based on attention mechanism; among them, the weighted average method will weightedly combine the features according to the weights of different data sources, the connection method will splice the feature vectors of different data sources together to form a new feature vector, and the fusion based on attention mechanism will combine the features by adaptively learning the importance of each data source; the specific representation is as follows:

[0087] From each data source Extract features from the dataset and use different deep learning models for feature extraction:

[0088] ;

[0089] in, Extract features for specific data sources; is the feature representation vector of the nth data source; is the nth data source; is the total number of data sources;

[0090] Since features from different data sources may have different dimensions, dimension alignment is required;

[0091] Assuming that the feature dimensions are inconsistent, we can Resize to the same dimensions , and obtain the feature representation of unified dimension :

[0092] ;

[0093] in, Represents a fully connected layer, which adjusts feature vectors of different dimensions to dimensions ;

[0094] In the selective fusion layer, there are three fusion methods: weighted average, concatenation, and weighted fusion based on attention mechanism;

[0095] The weighted average fusion includes the unified dimension feature representation of each data source Perform weighted averaging to obtain the fused features :

[0096] ;

[0097] in, is the weight coefficient of the nth data source and satisfies ;

[0098] Connection fusion includes concatenating the feature vectors of each data source to form a new feature vector :

[0099] ;

[0100] Among them, the concatenation operation concatenates each feature vector together in dimension to generate a new feature vector; Indicates a connection operation;

[0101] The weighted fusion based on the attention mechanism includes first calculating each The attention weight , through the scoring function Calculate the importance of each feature:

[0102] ;

[0103] in, Indicates the importance of each feature while ensuring the normalization of the weights so that the sum of all weights is 1; Represents the attention weight of the nth data source;

[0104] Use the attention weights to weight the features and get the final fused features. :

[0105] ;

[0106] After selective fusion, the feature vector It is a unified representation of the characteristics of each data source, which serves as the input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation.

[0107] The anomaly detection includes, first, assuming that the input data is , mapped to the latent space by the encoder ,in , d is the data dimension, w is the dimension of the latent space dimension;

[0108] Use autoencoder to train input data The encoder maps the input to the latent space , and then the latent representation is reconstructed through the decoder;

[0109] The encoder’s mapping is represented as:

[0110] ;

[0111] in, is the i-th input data, is the latent space representation of the i-th input data after passing through the encoder, is the encoder function, are the parameters of the encoder;

[0112] The decoder reconstruction is represented as:

[0113] ;

[0114] The decoder reconstructs the representation in the latent space Generate reconstruction number is the decoder function, are the parameters of the decoder; is the reconstruction result of the i-th data;

[0115] By calculating the error between the input data and the reconstructed result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection;

[0116] The reconstruction error is:

[0117] ;

[0118] Input data by calculation and the reconstruction results The square of the Euclidean distance between them gives the reconstruction error ;

[0119] Based on the comparison between the reconstruction error and the threshold, it is judged whether there is an abnormality. If it is greater than the preset threshold, the data point is considered abnormal;

[0120] Abnormal judgment:

[0121] ;

[0122] in, is the preset reconstruction error threshold, It is the tolerance threshold of the error. If the reconstruction error exceeds this threshold, it is judged as abnormal.

[0123] The anomaly detection includes, after detecting the abnormal data, further analyzing the relationship of the abnormal data through the graph neural network, and using the graph convolution operation of the graph neural network to update the representation of each node in the graph. The graph convolution operation is as follows:

[0124] ;

[0125] in, Is a node In the The representation in the iterations is Is a node In the The representation in the iterations is It is the edge The weight of Is a node The degree, Is a node The set of neighbor nodes of is the activation function;

[0126] Through multiple iterations, the representation of the node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows:

[0127] ;

[0128] like:

[0129] ;

[0130] in, represents the change in the representation of node i between the kth iteration and the k-1th iteration; Is the set change threshold. If the change represented by the node exceeds the threshold , then the node is considered an abnormal node;

[0131] If there is a problem with the node anomaly detection result, the anomaly is detected by the change of the edge weight in the graph. The abnormal edge determination is as follows:

[0132] ;

[0133] like:

[0134] ;

[0135] in, Represents edge The change in weights between two iterations; is the threshold of edge weight change. If the edge weight change exceeds the threshold, the edge is considered abnormal.

[0136] Combined with the representation of nodes and edges learned by the graph neural network, the abnormal patterns of the entire network are globally identified;

[0137] After the graph neural network iterates and updates the node representation multiple times, the representation of the entire graph is obtained. , Contains the representation of all nodes, as follows:

[0138] ;

[0139] in, It is Node representation of the entire graph after iterations.

[0140] Modeling the network traffic data into a graph structure includes analyzing the graph structure using a graph neural network (GNN), wherein nodes in the graph structure represent different devices or entities in the network, edges represent communication paths between devices, and the graph neural network (GNN) is used to learn the interaction relationship between nodes and network traffic characteristics, and analyze potential network threats;

[0141] The graph neural network GNN iteratively updates the representation of nodes in the graph, captures the dependencies between nodes, and identifies abnormal patterns in data streams, including unauthorized data access or malicious activities.

[0142] The analysis of the graph structure includes, based on the analysis of the graph structure, further performing threat prediction through the joint representation of multimodal features, and based on the threat prediction results, using a federated learning framework for distributed network security protection, wherein the federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to a central server for aggregation to generate a global model to improve the network protection effect;

[0143] Based on the obtained global model and the update results of the local model, an adaptive security protection strategy is generated, where the adaptive security protection strategy is used to adjust network firewall rules, access rights, and initiate defense measures against detected threats.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0145] Example 2

[0146] Reference Figure 2 , as another embodiment of the present invention, provides a network security threat monitoring system based on artificial intelligence, which is as follows:

[0147] The monitoring system includes a data acquisition module, a data transmission module, an algorithm processing module and a security protection module; the data acquisition module is used to collect data information; the data transmission module is used to transmit and interact with data information; the algorithm processing module is used to process the collected data and match the corresponding operation strategy; the security protection module is used to adjust network firewall rules, access rights and initiate defense measures against detected threats.

[0148] Example 3

[0149] The third embodiment of the present invention is different from the first two embodiments in that:

[0150] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0151] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0152] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0153] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0154] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0155] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A network security threat monitoring method based on artificial intelligence, characterized in that: include, Acquire data from multiple data sources in a network environment, and perform multi-level data fusion on the data through an artificial intelligence model to form a unified data representation, wherein the artificial intelligence model includes at least one selective fusion layer, extracts features from different data sources and represents them jointly; Based on the data fusion results, anomaly detection is performed using unsupervised learning methods; Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and the graph neural network GNN is used to analyze the graph structure.

2. The network security threat monitoring method based on artificial intelligence according to claim 1, characterized in that: The multiple data source data include network traffic data, endpoint logs, application logs, system call data, user behavior data and file access data, and the data source data are synchronously collected by the data collection module and transmitted to the corresponding module.

3. The network security threat monitoring method based on artificial intelligence as claimed in claim 2, characterized in that: The unified data representation includes that after feature extraction is completed, the selective fusion layer fuses the features of different data sources, and the fusion methods include weighted average, connection and dynamic fusion based on attention mechanism; among them, the weighted average method will weightedly combine the features according to the weights of different data sources, the connection method will splice the feature vectors of different data sources together to form a new feature vector, and the fusion based on attention mechanism will combine the features by adaptively learning the importance of each data source; the specific representation is as follows: From each data source Extract features from the dataset and use different deep learning models for feature extraction: ； in, Extract features for specific data sources; is the feature representation vector of the nth data source; is the nth data source; is the total number of data sources; Since features from different data sources may have different dimensions, dimension alignment is required; Assuming that the feature dimensions are inconsistent, we can Resize to the same dimensions , and obtain the feature representation of unified dimension : ； in, Represents a fully connected layer, which adjusts feature vectors of different dimensions to dimensions ; In the selective fusion layer, there are three fusion methods: weighted average, concatenation, and weighted fusion based on attention mechanism; The weighted average fusion includes the unified dimension feature representation of each data source Perform weighted averaging to obtain the fused features : ； in, is the weight coefficient of the nth data source and satisfies ; Connection fusion includes concatenating the feature vectors of each data source to form a new feature vector : ； Among them, the concatenation operation concatenates each feature vector together in dimension to generate a new feature vector; Indicates a connection operation; The weighted fusion based on the attention mechanism includes first calculating each The attention weight , through the scoring function Calculate the importance of each feature: ； in, Indicates the importance of each feature while ensuring the normalization of the weights so that the sum of all weights is 1; Represents the attention weight of the nth data source; Use the attention weights to weight the features and get the final fused features. : ； After selective fusion, the feature vector It is a unified representation of the characteristics of each data source, which serves as the input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation.

4. The network security threat monitoring method based on artificial intelligence as claimed in claim 3, characterized in that: The anomaly detection includes, first, assuming that the input data is , mapped to the latent space by the encoder ,in , d is the data dimension, w is the dimension of the latent space dimension; Use autoencoder to train input data The encoder maps the input to the latent space , and then the latent representation is reconstructed through the decoder; The encoder’s mapping is represented as: ； in, is the i-th input data, is the latent space representation of the i-th input data after passing through the encoder, is the encoder function, are the parameters of the encoder; The decoder reconstruction is represented as: ； The decoder reconstructs the representation in the latent space Generate reconstruction number is the decoder function, are the parameters of the decoder; is the reconstruction result of the i-th data; By calculating the error between the input data and the reconstructed result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection; The reconstruction error is: ； Input data by calculation and the reconstruction results The square of the Euclidean distance between them gives the reconstruction error ; Based on the comparison between the reconstruction error and the threshold, it is judged whether there is an abnormality. If it is greater than the preset threshold, the data point is considered abnormal; Abnormal judgment: ； in, is the preset reconstruction error threshold, It is the tolerance threshold of the error. If the reconstruction error exceeds this threshold, it is judged as abnormal.

5. The network security threat monitoring method based on artificial intelligence as claimed in claim 4, characterized in that: The anomaly detection includes, after detecting the abnormal data, further analyzing the relationship of the abnormal data through the graph neural network, and using the graph convolution operation of the graph neural network to update the representation of each node in the graph. The graph convolution operation is as follows: ； in, Is a node In the The representation in the iterations is, Is a node In the The representation in the iterations is, It is the edge The weight of Is a node The degree, Is a node The set of neighbor nodes of is the activation function; Through multiple iterations, the representation of the node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows: ； like: ； in, represents the change in the representation of node i between the kth iteration and the k-1th iteration; Is the set change threshold. If the change represented by the node exceeds the threshold , then the node is considered an abnormal node; If there is a problem with the node anomaly detection result, the anomaly is detected by the change of the edge weight in the graph. The abnormal edge determination is as follows: ； like: ； in, Represents edge The change in weights between two iterations; is the threshold of edge weight change. If the edge weight change exceeds the threshold, the edge is considered abnormal. Combined with the representation of nodes and edges learned by the graph neural network, the abnormal patterns of the entire network are globally identified; After the graph neural network iterates and updates the node representation multiple times, the representation of the entire graph is obtained. , Contains the representation of all nodes, as follows: ； in, It is Node representation of the entire graph after iterations.

6. The network security threat monitoring method based on artificial intelligence as claimed in claim 5, characterized in that: Modeling the network traffic data into a graph structure includes analyzing the graph structure using a graph neural network (GNN), wherein nodes in the graph structure represent different devices or entities in the network, edges represent communication paths between devices, and the graph neural network (GNN) is used to learn the interaction relationship between nodes and network traffic characteristics, and analyze potential network threats; The graph neural network GNN iteratively updates the representation of nodes in the graph, captures the dependencies between nodes, and identifies abnormal patterns in data streams, including unauthorized data access or malicious activities.

7. The network security threat monitoring method based on artificial intelligence according to claim 6, characterized in that: The analysis of the graph structure includes, based on the analysis of the graph structure, further performing threat prediction through the joint representation of multimodal features, and based on the threat prediction results, using a federated learning framework for distributed network security protection, wherein the federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to a central server for aggregation to generate a global model to improve the network protection effect; Based on the obtained global model and the update results of the local model, an adaptive security protection strategy is generated, where the adaptive security protection strategy is used to adjust network firewall rules, access rights, and initiate defense measures against detected threats.

8. A system using the network security threat monitoring method based on artificial intelligence as claimed in any one of claims 1 to 7, characterized in that: Including data acquisition module, data transmission module, algorithm processing module and security protection module; The data acquisition module is used to collect data information; The data transmission module is used to transmit and interact with data information; The algorithm processing module is used to process the collected data and match the corresponding operation strategy; The security protection module is used to adjust network firewall rules, access permissions and initiate defense measures against detected threats.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images