A method and system for monitoring cybersecurity threats based on artificial intelligence

Abstract

This invention discloses an artificial intelligence-based network security threat monitoring method and system, relating to the field of digital information transmission technology. The method includes: acquiring data from multiple data sources in a network environment; performing multi-level data fusion using an artificial intelligence model to form a unified data representation; the artificial intelligence model including at least one selective fusion layer, which extracts features from different data sources and jointly represents them; performing anomaly detection using an unsupervised learning method based on the data fusion results; and modeling network traffic data into a graph structure based on the detected abnormal behavior, and analyzing the graph structure using a graph neural network (GNN). This method solves the technical problems of multi-dimensional data fusion difficulties, threat detection delays, and insufficient response capabilities in existing network security protection technologies.

Description

Technical Field

[0001] This invention relates to the field of digital information transmission technology, and in particular to a method and system for monitoring network security threats based on artificial intelligence. Background Technology

[0002] With the rapid development of information technology, cybersecurity issues have become increasingly prominent. Especially with the widespread application of technologies such as cloud computing, big data, and the Internet of Things, cyberattacks have become increasingly complex. Traditional cybersecurity protection systems typically rely on static rules and signature databases. While they can handle known attacks, they are slow to react to new and variant attack methods and lack sufficient countermeasures. Furthermore, existing security systems exhibit significant lag and poor adaptability when dealing with large-scale, highly complex network environments. In particular, the processing of heterogeneous information from multiple data sources, real-time threat detection, and rapid response remain bottlenecks that current technologies struggle to overcome. Summary of the Invention

[0003] In view of the aforementioned existing problems, the present invention is proposed.

[0004] Therefore, this invention provides an artificial intelligence-based network security threat monitoring method that addresses technical challenges in existing network security protection technologies, such as difficulties in multi-dimensional data fusion, threat detection delays, and insufficient response capabilities. First, this invention proposes an AI-based multi-layered data fusion technology that efficiently integrates information from various heterogeneous data sources, such as network traffic, endpoint logs, and system calls, into a unified feature representation, providing accurate foundational data for subsequent threat detection and analysis. Second, by analyzing the graph structure of network traffic using a graph neural network (GNN) model, it can capture complex interactions between nodes, thereby identifying potential network threats. Third, this invention employs a federated learning framework to achieve distributed network security protection. Distributed nodes can collaboratively train the global model while maintaining data privacy, thus improving the adaptability and robustness of network protection. Finally, through the generation and adjustment of adaptive security protection strategies, this invention can automatically adjust protection measures based on real-time threat prediction results, optimizing network security defense.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a network security threat monitoring method based on artificial intelligence, comprising:

[0006] Data from multiple data sources in a network environment is acquired, and the data is fused at multiple levels through an artificial intelligence model to form a unified data representation. The artificial intelligence model includes at least one selective fusion layer, which extracts features from different data sources and jointly represents them.

[0007] Based on the data fusion results, an unsupervised learning method is used for anomaly detection;

[0008] Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and a graph neural network (GNN) is used to analyze the graph structure.

[0009] As a preferred embodiment of the AI-based network security threat monitoring method of the present invention, the multiple data sources include network traffic data, endpoint logs, application logs, system call data, user behavior data, and file access data, and the data sources are synchronously collected and transmitted to the corresponding modules through the data acquisition module.

[0010] As a preferred embodiment of the AI-based cybersecurity threat monitoring method described in this invention, the unified data representation includes, after feature extraction, a selective fusion layer fusing features from different data sources. The fusion methods include weighted averaging, concatenation, and dynamic fusion based on an attention mechanism. Specifically, the weighted averaging method combines features according to the weights of different data sources; the concatenation method joins feature vectors from different data sources to form a new feature vector; and the attention-based fusion adaptively learns the importance of each data source to combine features. The specific implementation is as follows:

[0011] From each data source Feature extraction is performed using different deep learning models:

[0012] ;

[0013] in, A feature extraction function for a specific data source; This is the feature representation vector of the nth data source; This is the nth data source; The total number of data sources;

[0014] Since features from different data sources may have different dimensions, dimension alignment is required.

[0015] Assuming the feature dimensions are inconsistent, then by each feature Adjust to the same dimension To obtain a feature representation with a unified dimension :

[0016] ;

[0017] in, This represents a fully connected layer that adjusts feature vectors of different dimensions to a single dimension. ;

[0018] In the selective fusion layer, there are three fusion methods: weighted average, connection, and attention-based weighted fusion.

[0019] The weighted average fusion includes a unified dimension feature representation for each data source. Perform a weighted average to obtain the fused features. :

[0020] ;

[0021] in, Let be the weight coefficient of the nth data source, and satisfy . ;

[0022] The concatenation and fusion process involves concatenating the feature vectors from each data source to form a new feature vector. :

[0023] ;

[0024] The concatenation operation joins the feature vectors together in terms of dimensions to generate a new feature vector. Indicates a connection operation;

[0025] Attention-based weighted fusion includes first calculating each attention weights Through the scoring function Calculate the importance of each feature:

[0026] ;

[0027] in, This indicates the importance of each feature while ensuring the weights are normalized so that the sum of all weights is 1; This represents the attention weight of the nth data source;

[0028] The features are weighted and summed using attention weights to obtain the final fused features. :

[0029] ;

[0030] The feature vector obtained after selective fusion It is a unified representation of the characteristics of various data sources, serving as input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation.

[0031] As a preferred embodiment of the artificial intelligence-based network security threat monitoring method described in this invention, the anomaly detection includes, firstly, assuming the input data is... Mapped to the latent space by the encoder ,in d represents the data dimension, and w represents the dimension of the potential space.

[0032] Use an autoencoder to process the input data. The encoder processes the input, mapping it to the latent space. Then the latent representation is reconstructed through the decoder;

[0033] The encoder's mapping is represented as:

[0034] ;

[0035] in, It is the i-th input data. It is the latent space representation obtained after the i-th input data is processed by the encoder. It is an encoder function. These are the encoder parameters;

[0036] The decoder's reconstruction is represented as:

[0037] ;

[0038] The decoder reconstructs the representation in the latent space. Generate reconstruction number It is a function of the decoder. These are the parameters of the decoder; It is the reconstruction result of the i-th data;

[0039] By calculating the error between the input data and the reconstruction result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection;

[0040] The reconstruction error is:

[0041] ;

[0042] By calculating the input data and reconstruction results The square of the Euclidean distance between them yields the reconstruction error. ;

[0043] The presence of anomalies is determined by comparing the reconstruction error with a threshold. If the reconstruction error... If the value exceeds the preset threshold, the data point is considered abnormal.

[0044] Anomaly detection:

[0045] ;

[0046] in, It is a preset reconstruction error threshold. This is the tolerance threshold for errors. If the reconstruction error exceeds this threshold, it is judged as abnormal.

[0047] As a preferred embodiment of the AI-based cybersecurity threat monitoring method of the present invention, the anomaly detection includes, after detecting abnormal data, further analyzing the relationships between the abnormal data through a graph neural network, and updating the representation of each node in the graph using graph convolution operations of the graph neural network. The graph convolution operation is as follows:

[0048] ;

[0049] in, It is a node In the The representation in the next iteration. It is a node In the The representation in the next iteration. It is the edge The weight, It is a node The degree, It is a node The set of neighboring nodes, It is an activation function;

[0050] Through multiple iterations, the representation of a node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows:

[0051] ;

[0052] like:

[0053] ;

[0054] in, This represents the change in the representation of node i between the k-th iteration and the (k-1)-th iteration; This is a set threshold for changes; if the change represented by a node exceeds the threshold... If so, the node is considered an abnormal node;

[0055] If the node anomaly detection result is problematic, the anomaly is detected by the change in edge weights in the graph. The specific determination of anomaly edges is as follows:

[0056] ;

[0057] like:

[0058] ;

[0059] in, Representing an edge The change of weights between two iterations; It is the threshold for changes in edge weights. If the change in edge weights exceeds the threshold, the edge is considered to be abnormal.

[0060] By combining the node and edge representations learned from the graph neural network, abnormal patterns in the entire network are identified globally.

[0061] After the graph neural network iterates and updates the node representations multiple times, it obtains the representation of the entire graph. , The representation including all nodes is as follows:

[0062] ;

[0063] in, It is the first The node representation of the entire graph after the next iteration.

[0064] As a preferred embodiment of the AI-based network security threat monitoring method of the present invention, the step of modeling network traffic data into a graph structure includes using a graph neural network (GNN) to analyze the graph structure. The nodes in the graph structure represent different devices or entities in the network, and the edges represent communication paths between devices. The GNN is used to learn the interaction relationships between nodes and network traffic characteristics to analyze potential network threats.

[0065] The graph neural network (GNN) captures the dependencies between nodes by iteratively updating the representations of nodes in the graph, and identifies abnormal patterns in the data stream, including unauthorized data access or malicious activities.

[0066] As a preferred embodiment of the AI-based network security threat monitoring method of the present invention, the graph structure analysis includes, based on the graph structure analysis, further threat prediction through joint representation of multimodal features, and based on the threat prediction results, distributed network security protection is performed using a federated learning framework. The federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to the central server for aggregation to generate a global model to improve the network protection effect.

[0067] Based on the obtained global and local model update results, an adaptive security protection strategy is generated. This adaptive security protection strategy is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

[0068] As a preferred embodiment of the AI-based network security threat monitoring system of the present invention, it includes: a data acquisition module, a data transmission module, an algorithm processing module, and a security protection module; the data acquisition module is used to collect data information; the data transmission module is used to transmit and interact with the data information; the algorithm processing module is used to process the collected data and match corresponding operation strategies; the security protection module is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

[0069] A computer device includes a memory and a processor, the memory storing a computer program, characterized in that the processor executes the computer program to implement the steps of an artificial intelligence-based network security threat monitoring method.

[0070] A computer-readable storage medium having a computer program stored thereon, characterized in that, when the computer program is executed by a processor, it implements the steps of an artificial intelligence-based network security threat monitoring method.

[0071] The beneficial effects of this invention are as follows: The AI-based network security threat monitoring method and system provided by this invention effectively integrates multiple heterogeneous data sources through multi-layered data fusion technology, significantly improving the accuracy and comprehensiveness of threat detection. By combining graph neural networks (GNNs) to model the graph structure of network traffic, it can deeply understand the communication patterns of various devices in the network and promptly detect potential abnormal behaviors and security threats. Utilizing a federated learning framework, this invention ensures data privacy while achieving distributed collaborative training, improving the generalization ability of the security model. Finally, combined with adaptive security protection strategies, it can dynamically adjust network protection measures based on real-time threat prediction results, optimizing the network's defense response capabilities. Through this comprehensive security protection method, the real-time response capability, adaptability, and protection effectiveness of network security systems can be significantly improved, effectively addressing increasingly complex network security threats. Attached Figure Description

[0072] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0073] Figure 1 This is a schematic diagram of a network security threat monitoring method based on artificial intelligence, provided as an embodiment of the present invention.

[0074] Figure 2This is a schematic diagram of a network security threat monitoring system based on artificial intelligence, provided as an embodiment of the present invention. Detailed Implementation

[0075] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0076] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0077] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0078] This invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of this invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not adhering to the usual scale. Furthermore, the schematic diagrams are merely examples and should not be construed as limiting the scope of protection of this invention. In actual fabrication, the three-dimensional spatial dimensions of length, width, and depth should be included.

[0079] Furthermore, in the description of this invention, it should be noted that the terms "upper," "lower," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used solely for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. In addition, the terms "first," "second," or "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0080] Unless otherwise explicitly specified and limited, the terms "installation," "connection," and "joining" in this invention should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; similarly, they can refer to mechanical connections, electrical connections, or direct connections, or indirect connections through an intermediate medium, or internal connections between two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0081] Example 1, referring to Figure 1 This is the first embodiment of the present invention, which provides an artificial intelligence-based network security threat monitoring method, including:

[0082] S1: Acquire data from multiple data sources in the network environment, and perform multi-level data fusion through an artificial intelligence model to form a unified data representation. The artificial intelligence model includes at least one selective fusion layer, which extracts features from different data sources and jointly represents them.

[0083] S2: Based on the data fusion results, an unsupervised learning method is used for anomaly detection.

[0084] S3: Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and a graph neural network (GNN) is used to analyze the graph structure.

[0085] The multiple data sources include network traffic data, endpoint logs, application logs, system call data, user behavior data, and file access data. The data sources are collected synchronously by the data acquisition module and transmitted to the corresponding modules.

[0086] The unified data representation includes a selective fusion layer that fuses features from different data sources after feature extraction. Fusion methods include weighted averaging, concatenation, and attention-based dynamic fusion. Specifically, the weighted averaging method combines features according to the weights of different data sources; the concatenation method joins feature vectors from different data sources to form a new feature vector; and attention-based fusion adaptively learns the importance of each data source to combine features. The details are as follows:

[0087] From each data source Feature extraction is performed using different deep learning models:

[0088] ;

[0089] in, A feature extraction function for a specific data source; This is the feature representation vector of the nth data source; This is the nth data source; The total number of data sources;

[0090] Since features from different data sources may have different dimensions, dimension alignment is required.

[0091] Assuming the feature dimensions are inconsistent, then by each feature Adjust to the same dimension To obtain a feature representation with a unified dimension :

[0092] ;

[0093] in, This represents a fully connected layer that adjusts feature vectors of different dimensions to a single dimension. ;

[0094] In the selective fusion layer, there are three fusion methods: weighted average, connection, and attention-based weighted fusion.

[0095] The weighted average fusion includes a unified dimension feature representation for each data source. Perform a weighted average to obtain the fused features. :

[0096] ;

[0097] in, Let be the weight coefficient of the nth data source, and satisfy . ;

[0098] The concatenation and fusion process involves concatenating the feature vectors from each data source to form a new feature vector. :

[0099] ;

[0100] The concatenation operation joins the feature vectors together in terms of dimensions to generate a new feature vector. Indicates a connection operation;

[0101] Attention-based weighted fusion includes first calculating each attention weights Through the scoring function Calculate the importance of each feature:

[0102] ;

[0103] in, This indicates the importance of each feature while ensuring the weights are normalized so that the sum of all weights is 1; This represents the attention weight of the nth data source;

[0104] The features are weighted and summed using attention weights to obtain the final fused features. :

[0105] ;

[0106] The feature vector obtained after selective fusion It is a unified representation of the characteristics of various data sources, serving as input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation.

[0107] The anomaly detection includes, firstly, assuming the input data is... Mapped to the latent space by the encoder ,in d represents the data dimension, and w represents the dimension of the potential space.

[0108] Use an autoencoder to process the input data. The encoder processes the input, mapping it to the latent space. Then the latent representation is reconstructed through the decoder;

[0109] The encoder's mapping is represented as:

[0110] ;

[0111] in, It is the i-th input data. It is the latent space representation obtained after the i-th input data is processed by the encoder. It is an encoder function. These are the encoder parameters;

[0112] The decoder's reconstruction is represented as:

[0113] ;

[0114] The decoder reconstructs the representation in the latent space. Generate reconstruction number It is a function of the decoder. These are the parameters of the decoder; It is the reconstruction result of the i-th data;

[0115] By calculating the error between the input data and the reconstruction result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection;

[0116] The reconstruction error is:

[0117] ;

[0118] By calculating the input data and reconstruction results The square of the Euclidean distance between them yields the reconstruction error. ;

[0119] The presence of anomalies is determined by comparing the reconstruction error with a threshold. If the reconstruction error... If the value exceeds the preset threshold, the data point is considered abnormal.

[0120] Anomaly detection:

[0121] ;

[0122] in, It is a preset reconstruction error threshold. This is the tolerance threshold for errors. If the reconstruction error exceeds this threshold, it is judged as abnormal.

[0123] The anomaly detection includes, after detecting abnormal data, further analyzing the relationships between the abnormal data using a graph neural network, and updating the representation of each node in the graph using graph convolution operations of the graph neural network. The graph convolution operation is as follows:

[0124] ;

[0125] in, It is a node In the The representation in the next iteration. It is a node In the The representation in the next iteration. It is the edge The weight, It is a node The degree, It is a node The set of neighboring nodes, It is an activation function;

[0126] Through multiple iterations, the representation of a node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows:

[0127] ;

[0128] like:

[0129] ;

[0130] in, This represents the change in the representation of node i between the k-th iteration and the (k-1)-th iteration; This is a set threshold for changes; if the change represented by a node exceeds the threshold... If so, the node is considered an abnormal node;

[0131] If the node anomaly detection result is problematic, the anomaly is detected by the change in edge weights in the graph. The specific determination of anomaly edges is as follows:

[0132] ;

[0133] like:

[0134] ;

[0135] in, Representing an edge The change of weights between two iterations; It is the threshold for changes in edge weights. If the change in edge weights exceeds the threshold, the edge is considered to be abnormal.

[0136] By combining the node and edge representations learned from the graph neural network, abnormal patterns in the entire network are identified globally.

[0137] After the graph neural network iterates and updates the node representations multiple times, it obtains the representation of the entire graph. , The representation including all nodes is as follows:

[0138] ;

[0139] in, It is the first The node representation of the entire graph after the next iteration.

[0140] The step of modeling network traffic data as a graph structure includes using a graph neural network (GNN) to analyze the graph structure. The nodes in the graph structure represent different devices or entities in the network, and the edges represent communication paths between devices. The GNN is used to learn the interaction relationships between nodes and network traffic characteristics to analyze potential network threats.

[0141] The graph neural network (GNN) captures the dependencies between nodes by iteratively updating the representations of nodes in the graph, and identifies abnormal patterns in the data stream, including unauthorized data access or malicious activities.

[0142] The graph structure analysis includes, based on the graph structure analysis, further threat prediction through joint representation of multimodal features, and based on the threat prediction results, distributed network security protection using a federated learning framework. The federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to the central server for aggregation to generate a global model to improve the network protection effect.

[0143] Based on the obtained global and local model update results, an adaptive security protection strategy is generated. This adaptive security protection strategy is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

[0144] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

[0145] Example 2

[0146] Reference Figure 2 In another embodiment of the present invention, an artificial intelligence-based network security threat monitoring system is provided, as detailed below:

[0147] The monitoring system includes a data acquisition module, a data transmission module, an algorithm processing module, and a security protection module. The data acquisition module is used to collect data information. The data transmission module is used to transmit and interact with the data information. The algorithm processing module is used to process the collected data and match corresponding operation strategies. The security protection module is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

[0148] Example 3

[0149] The third embodiment of the present invention differs from the first two embodiments in that:

[0150] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0151] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0152] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0153] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0154] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0155] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A cybersecurity threat monitoring method based on artificial intelligence, characterized in that: include, Data from multiple data sources in a network environment is acquired, and the data is fused at multiple levels through an artificial intelligence model to form a unified data representation. The artificial intelligence model includes at least one selective fusion layer, which extracts features from different data sources and jointly represents them. Based on the data fusion results, an unsupervised learning method is used for anomaly detection; Based on the detected abnormal behavior, the network traffic data is modeled as a graph structure, and a graph neural network (GNN) is used to analyze the graph structure. The unified data representation includes a selective fusion layer that fuses features from different data sources after feature extraction. Fusion methods include weighted averaging, concatenation, and attention-based dynamic fusion. Specifically, the weighted averaging method combines features according to the weights of different data sources; the concatenation method joins feature vectors from different data sources to form a new feature vector; and attention-based fusion adaptively learns the importance of each data source to combine features. The details are as follows: From each data source Feature extraction is performed using different deep learning models: ； in, A feature extraction function for a specific data source; This is the feature representation vector of the nth data source; This is the nth data source; The total number of data sources; Since features from different data sources may have different dimensions, dimension alignment is required. Assuming the feature dimensions are inconsistent, then by each feature Adjust to the same dimension To obtain a feature representation with a unified dimension : ； in, This represents a fully connected layer that adjusts feature vectors of different dimensions to a single dimension. ; In the selective fusion layer, there are three fusion methods: weighted average, connection, and attention-based weighted fusion. The weighted average fusion includes a unified dimension feature representation for each data source. Perform a weighted average to obtain the fused features. : ； in, Let be the weight coefficient of the nth data source, and satisfy . ; The concatenation and fusion process involves concatenating the feature vectors from each data source to form a new feature vector. : ； The concatenation operation joins the feature vectors together in terms of dimensions to generate a new feature vector. Indicates a connection operation; Attention-based weighted fusion includes first calculating each attention weights Through the scoring function Calculate the importance of each feature: ； in, This indicates the importance of each feature while ensuring the weights are normalized so that the sum of all weights is 1; This represents the attention weight of the nth data source; The features are weighted and summed using attention weights to obtain the final fused features. : ； The feature vector obtained after selective fusion It is a unified representation of the characteristics of various data sources, serving as input for subsequent tasks, namely anomaly detection, threat analysis, and protection strategy generation; The anomaly detection includes, firstly, assuming the input data is... Mapped to the latent space by the encoder ,in d represents the data dimension, and w represents the dimension of the potential space. Use an autoencoder to process the input data. The encoder processes the input, mapping it to the latent space. Then the latent representation is reconstructed through the decoder; The encoder's mapping is represented as: ； in, It is the i-th input data. It is the latent space representation obtained after the i-th input data is processed by the encoder. It is an encoder function. These are the encoder parameters; The decoder's reconstruction is represented as: ； The decoder reconstructs the representation in the latent space. Generate reconstruction number It is a function of the decoder. These are the parameters of the decoder; It is the reconstruction result of the i-th data; By calculating the error between the input data and the reconstruction result, it is determined whether there is abnormal behavior, which serves as the basis for anomaly detection; The reconstruction error is: ； By calculating the input data and reconstruction results The square of the Euclidean distance between them yields the reconstruction error. ; The presence of anomalies is determined by comparing the reconstruction error with a threshold. If the reconstruction error... If the value exceeds the preset threshold, the data point is considered abnormal. Anomaly detection: ； in, It is a preset reconstruction error threshold. This is the tolerance threshold for errors. If the reconstruction error exceeds this threshold, it is judged as abnormal. The anomaly detection includes, after detecting abnormal data, further analyzing the relationships between the abnormal data using a graph neural network, and updating the representation of each node in the graph using graph convolution operations of the graph neural network. The graph convolution operation is as follows: ； in, It is a node In the The representation in the next iteration. It is a node In the The representation in the next iteration. It is the edge The weight, It is a node The degree, It is a node The set of neighboring nodes, It is an activation function; Through multiple iterations, the representation of a node is continuously updated. If the representation of a node changes more than a preset range between two iterations, the node is considered to have abnormal behavior. The abnormal node is determined as follows: ； like: ； in, This represents the change in the representation of node i between the k-th iteration and the (k-1)-th iteration; This is a set threshold for changes; if the change represented by a node exceeds the threshold... If so, the node is considered an abnormal node; If the node anomaly detection result is problematic, the anomaly is detected by the change in edge weights in the graph. The specific determination of anomaly edges is as follows: ； like: ； in, Representing an edge The change in weights between two iterations; It is the threshold for changes in edge weights. If the change in edge weights exceeds the threshold, the edge is considered to be abnormal. By combining the node and edge representations learned from the graph neural network, abnormal patterns in the entire network are identified globally. After the graph neural network iterates and updates the node representations multiple times, it obtains the representation of the entire graph. , The representation including all nodes is as follows: ； in, It is the first The node representation of the entire graph after the next iteration; The step of modeling network traffic data as a graph structure includes using a graph neural network (GNN) to analyze the graph structure. The nodes in the graph structure represent different devices or entities in the network, and the edges represent communication paths between devices. The GNN is used to learn the interaction relationships between nodes and network traffic characteristics to analyze potential network threats. The graph neural network (GNN) captures the dependencies between nodes and identifies abnormal patterns in the data stream by iteratively updating the representation of nodes in the graph. These abnormal patterns include unauthorized data access or malicious activities. The graph structure analysis includes, based on the graph structure analysis, further threat prediction through joint representation of multimodal features, and based on the threat prediction results, distributed network security protection using a federated learning framework. The federated learning framework is trained through local models of multiple distributed nodes, and the local model updates are uploaded to the central server for aggregation to generate a global model to improve the network protection effect. Based on the obtained global and local model update results, an adaptive security protection strategy is generated. This adaptive security protection strategy is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

2. The artificial intelligence-based network security threat monitoring method as described in claim 1, characterized in that: The multiple data sources include network traffic data, endpoint logs, application logs, system call data, user behavior data, and file access data. The data sources are collected synchronously by the data acquisition module and transmitted to the corresponding modules.

3. A system employing an artificial intelligence-based network security threat monitoring method as described in any one of claims 1 to 2, characterized in that: It includes a data acquisition module, a data transmission module, an algorithm processing module, and a security protection module; The data acquisition module is used to collect data information; The data transmission module is used for transmitting and interacting with data information; The algorithm processing module is used to process the collected data and match corresponding operation strategies; The security protection module is used to adjust network firewall rules, access permissions, and initiate defense measures against detected threats.

4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 2.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 2.

Images