Cloud platform network security threat intelligent detection system based on AI

Abstract

The invention discloses an AI-based cloud platform network security threat intelligent detection system, which belongs to the technical field of cloud platform security, detects cloud platform network security threats by introducing an AI model so as to realize high-speed detection, and compared with the prior art, adopts a spatial multi-point interaction algorithm to train the AI model so as to realize high-speed detection. The global convergence capability of the algorithm can be effectively improved, and the convergence capability of the algorithm can also be effectively improved, so that the detection accuracy of the network security threats of the cloud platform is improved, and the security protection capability of the cloud platform is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the field of cloud platform security technology, and specifically relates to an AI-based cloud platform network security threat intelligent detection system. Background Art

[0002] Cloud platform network security threats refer to various security risks and attack methods targeting cloud computing environments, which may cause damage to the data, applications and infrastructure of cloud service providers and cloud service users. With the rapid development of cloud computing technology, more and more enterprises and individuals are migrating their businesses to cloud platforms. However, the security issues of cloud platforms are becoming increasingly prominent, and security incidents such as hacker attacks and data leaks are frequent. Traditional network security protection methods have problems such as low detection rate, high false alarm rate and slow response speed when dealing with complex and changeable network attacks. Summary of the invention

[0003] The present invention provides an AI-based cloud platform network security threat intelligent detection system to solve the technical problems of low detection rate and high false alarm rate in the prior art.

[0004] An AI-based cloud platform network security threat intelligent detection system, including a training data acquisition module, an AI training optimization module, a cloud platform real-time data acquisition module, and a security threat detection module; The training data acquisition module is used to acquire a training data set input by a staff member through human-computer interaction or a training data set from a designated data source; The AI ​​training optimization module is used to build an AI model, and train the AI ​​model using a spatial multi-point interaction algorithm based on the training data set obtained by the training data acquisition module to obtain the trained AI model; The cloud platform real-time data collection module is used to collect real-time network traffic data corresponding to the cloud platform during the operation of the cloud platform; The security threat detection module is used to schedule the trained AI model to identify real-time network traffic data and determine the intelligent detection results of network security threats on the cloud platform.

[0005] Further, it also includes: an intelligent threat processing module; The intelligent threat processing module is used to manage and control users who generate network security threats when it is determined that the cloud platform network security threat intelligent detection results meet preset threat processing conditions.

[0006] Furthermore, it also includes: an intelligent threat warning module; The intelligent threat warning module is used to generate threat warning information when it is determined that the intelligent detection results of the cloud platform network security threat meet the preset threat processing conditions, and transmit the threat warning information to the device designated by the staff to realize intelligent threat warning.

[0007] Furthermore, an AI model is constructed, and according to the training data set obtained by the training data acquisition module, a spatial multi-point interaction algorithm is used to train the AI ​​model to obtain the trained AI model, including: Construct a convolutional neural network model to obtain an AI model, and use a dynamic reverse learning initialization strategy to initialize the model parameters of the AI ​​model to obtain multiple different model parameter individuals; According to the training data set obtained by the training data acquisition module, the fitness corresponding to each model parameter individual is obtained, and according to the fitness corresponding to the model parameter individual, the optimal parameter individual and the historical optimal value corresponding to each model parameter individual are determined; According to the optimal parameter individual, the model parameter individual is searched in the global space by using the crossover mutation strategy to obtain the model parameter individual after the global space search; According to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, the global optimal point information interaction strategy is used to conduct the optimal region guided search for the model parameter individuals after the global space search, and the model parameter individuals after the optimal region guided search are obtained; Adopting the individual information interaction strategy to search the neighborhood information of the model parameter individuals after the optimal area guided search, the model parameter individuals after the neighborhood information search are obtained; Adopting the pole adaptive control strategy to perform adaptive local search on the model parameter individuals after the neighborhood information search, and obtaining the model parameter individuals after the adaptive local search; Repeat the crossover mutation strategy, global optimal point information interaction strategy, individual information interaction strategy and extreme point adaptive control strategy until the maximum number of training times is reached. The final parameters of the AI ​​model are determined individually based on the model parameters after the last adaptive local search to obtain the trained AI model.

[0008] Furthermore, a dynamic reverse learning initialization strategy is used to initialize the model parameters of the AI ​​model to obtain multiple different model parameter individuals, including: Initialize the model parameters of the AI ​​model using a mixed mapping initialization method to obtain multiple initial parameter individuals; wherein each initial parameter individual includes part or all of the model parameters of the AI ​​model; The reverse learning individual corresponding to the initial parameter individual is obtained as follows: ;in, Indicates iInitial parameter individuals, i =1,2,…,I, I represents the total number of model parameter individuals. represents the upper limit individual corresponding to the initial parameter individual, represents the lower limit individual corresponding to the initial parameter individual, Represents the initial parameter individual The corresponding reverse learning individuals; According to the reverse learning individual corresponding to the initial parameter individual, the dynamic relative number individual corresponding to the initial parameter individual is obtained as follows: ;in, Represents the initial parameter individual The corresponding dynamic relative number of individuals, Represents the preset weight coefficient, represents the first random number between (0,1), Represents the second random number between (0,1); The fitness of the initial parameter individual, the fitness of the reverse learning individual and the fitness of the dynamic relative number individual are obtained, and the I individuals with the largest fitness are selected as multiple different model parameter individuals.

[0009] Furthermore, according to the optimal parameter individual, a crossover mutation strategy is used to perform a global space search on the model parameter individual, and the model parameter individual after the global space search is obtained, including: According to the optimal parameter individuals, the model parameter individuals are crossed as follows: ; in, Indicates t During the training process j The model parameter individual d Dimension parameters, j =1,2,…,I, I represents the total number of model parameter individuals. d =1,2,…,D, where D represents the total dimension of the individual parameters of the model. Indicates j The crossover value of the d-th dimension parameter of the individual model parameters, that is, j The crossover individual corresponding to the model parameter individual d Dimension parameters, represents the optimal parameter individual d Dimension parameters, represents the third random number between (0,1), represents the fourth random number between (0,1), represents the fifth random number between (0,1), Indicates the tth training process jThe d-th dimension parameter of the historical optimal value corresponding to each model parameter individual; The model parameters are mutated individually as follows: ; in, represents the d-th dimension parameter of the upper limit individual, The lower limit individual d Dimension parameters, express A random number between Indicates j The variation value of the d-th dimension parameter of the model parameter individual, that is, j The d-th dimension parameter of the variant individual corresponding to the model parameter individual, Represents the sixth random number between (0,1); For the j The model parameter individual d Dimension Parameters , using the model parameter individual d Original parameters Get the first fitness corresponding to the model parameter individual; use the first fitness of the crossover individual d Dimension Parameters Get the second fitness corresponding to the model parameter individual; use the first fitness of the variant individual d Dimension Parameters Get the third fitness of the model parameter individual; Determine the maximum value among the first fitness, the second fitness and the third fitness, obtain the target fitness, and use the parameter corresponding to the target fitness as the first parameter of the model parameter individual. d Dimension parameters, and go through the j All parameters of the model parameter individuals are obtained to obtain the model parameter individuals after global space search.

[0010] Furthermore, according to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, the global optimal point information interaction strategy is adopted to perform the optimal region guided search on the model parameter individuals after the global space search, and the model parameter individuals after the optimal region guided search are obtained, including: Based on the current number of training times, the first update factor and the second update factor are obtained as follows: as well as ;in, represents the first update factor, represents the second update factor, Indicates m The fitness of the model parameter individuals after the global space search, represents the noise value, and Set to 0.0001; represents the first control factor and is set to 0.01; Indicates t +1 second control factor during training, Indicates t The second control factor in the training process, and , the initial value of the second control factor is set to 0.01; Indicates the preset maximum number of training times. represents the first guided strength factor, and ; represents the second guided strength factor, and Set to 0.1; According to the optimal parameter individual, the historical optimal value corresponding to the model parameter individual, the first update factor and the second update factor, the optimal region guided search is performed on the model parameter individual after the global space search, and the model parameter individual after the optimal region guided search is obtained as follows: ; in, represents the model parameter individual after the mth global space search during the tth training process, and m =1,2,…,I, I represents the total number of model parameter individuals. represents the model parameter individual after the optimal region guided search , represents the seventh random number between (0,1), represents the eighth random number between (0,1), Represents the model parameter individual The corresponding historical optimal value is represents the optimal parameter individual.

[0011] Furthermore, the individual information interaction strategy is used to perform neighborhood information search on the model parameter individuals after the optimal region guided search, and the model parameter individuals after the neighborhood information search are obtained, including: For any model parameter individual after the optimal region guided search, a different model parameter individual is randomly matched to the model parameter individual to obtain the information interaction individual corresponding to each model parameter individual; According to the information interaction individuals corresponding to the model parameter individuals and the second update factor, the model parameter individuals after the optimal area guided search are searched for neighborhood information, and the model parameter individuals after the neighborhood information search are obtained as follows: ; in, Indicates tDuring the training process n The model parameter individuals after the optimal region guided search, and n =1,2,…,I, I represents the total number of model parameter individuals. Represents the model parameter individual after neighborhood information search , represents the ninth random number between (0,1), Represents the model parameter individual Corresponding information interaction individuals.

[0012] Furthermore, the pole adaptive control strategy is used to perform adaptive local search on the model parameter individuals after the neighborhood information search, and the model parameter individuals after the adaptive local search are obtained, including: According to the model parameter individuals after the neighborhood information search, determine the worst parameter individual and the fitness corresponding to the worst parameter individual; According to the worst parameter individual and the fitness corresponding to the worst parameter individual, the model parameter individual after the neighborhood information search is adaptively searched locally, and the model parameter individual after the adaptive local search is obtained as follows: ; in, Indicates t During the training process k The model parameter individuals after neighborhood information search, Represents the model parameter individual after adaptive local search , k =1,2,…,I, I represents the total number of model parameter individuals. represents the tenth random number between (-1,1), represents the worst parameter individual, represents the fitness of the individual with the worst parameters, Represents the model parameter individual The corresponding fitness.

[0013] Furthermore, the trained AI model is scheduled to identify real-time network traffic data to determine the intelligent detection results of cloud platform network security threats, including: using real-time network traffic data as input to the trained AI model to obtain the intelligent detection results of cloud platform network security threats; wherein, the intelligent detection results of cloud platform network security threats include the existence of threats or the absence of threats.

[0014] The present invention provides an AI-based cloud platform network security threat intelligent detection system, which detects cloud platform network security threats by introducing an AI model, thereby achieving high-speed detection. Compared with the existing technology, the spatial multi-point interaction algorithm is used to train the AI ​​model, which can not only effectively improve the global convergence ability of the algorithm, but also effectively improve the convergence ability of the algorithm, thereby improving the accuracy of cloud platform network security threat detection and effectively improving the security protection capability of the cloud platform. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0016] Figure 1 A schematic diagram of the structure of an AI-based cloud platform network security threat intelligent detection system provided in an embodiment of the present invention.

[0017] Figure 2 A schematic diagram of a process for obtaining an AI model after training provided in an embodiment of the present invention.

[0018] Among them, 101-training data acquisition module, 102-AI training optimization module, 103-cloud platform real-time data collection module, 104-security threat detection module, 105-intelligent threat processing module, and 106-intelligent threat warning module.

[0019] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0020] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0021] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0022] like Figure 1 As shown, an AI-based cloud platform network security threat intelligent detection system provided by an embodiment of the present invention includes a training data acquisition module 101, an AI training optimization module 102, a cloud platform real-time data collection module 103 and a security threat detection module 104; The training data acquisition module 101 is used to acquire a training data set input by a staff member through human-computer interaction or a training data set from a specified data source; The training data set may be the KDD Cup 1999 data, or it may be a training data set consisting of some network traffic data collected by the staff themselves and the labels of the network traffic data.

[0023] The AI ​​training optimization module 102 is used to build an AI (Artificial Intelligence) model, and train the AI ​​model using a spatial multi-point interaction algorithm according to the training data set obtained by the training data acquisition module to obtain a trained AI model; In the prior art, only the structural improvement of the AI ​​model is often focused on, so the conventional gradient descent algorithm is used to optimize the model parameters of the AI ​​model, which often leads to falling into the local optimum during the model parameter optimization process, and ultimately causes the AI ​​model to be unable to effectively detect network security threats on the cloud platform. Therefore, an embodiment of the present invention provides a spatial multi-point interaction algorithm to train the AI ​​model, which can effectively improve the global optimization effect and optimization speed of the algorithm on the model parameters, and ultimately improve the accuracy and speed of cloud platform network security threat detection.

[0024] The cloud platform real-time data collection module 103 is used to collect real-time network traffic data corresponding to the cloud platform during the operation of the cloud platform; Whether it is a training data set or real-time network traffic data corresponding to the cloud platform, it can be normalized and converted into the input form corresponding to the AI ​​model before entering the AI ​​model, so as to ensure data training and recognition.

[0025] The security threat detection module 104 is used to schedule the trained AI model to identify real-time network traffic data and determine the intelligent detection results of network security threats on the cloud platform.

[0026] The intelligent detection results of cloud platform network security threats can include the existence of threats or the absence of threats. When threats exist, intervention can be made to ensure the network security of the cloud platform.

[0027] The present invention provides an AI-based cloud platform network security threat intelligent detection system, which detects cloud platform network security threats by introducing an AI model, thereby achieving high-speed detection. Compared with the existing technology, the spatial multi-point interaction algorithm is used to train the AI ​​model, which can not only effectively improve the global convergence ability of the algorithm, but also effectively improve the convergence ability of the algorithm, thereby improving the accuracy of cloud platform network security threat detection and effectively improving the security protection capability of the cloud platform.

[0028] In the embodiment of the present invention, it also includes: an intelligent threat processing module 105; The intelligent threat processing module 105 is used to manage and control users who generate network security threats when it is determined that the cloud platform network security threat intelligent detection result meets the preset threat processing conditions.

[0029] For example, if a threat is detected when a user is accessing the cloud platform, the corresponding user can be prohibited from accessing the cloud platform for a period of time. If the number of prohibitions exceeds a preset threshold, the corresponding user will be added to the blacklist to ensure the security of the cloud platform.

[0030] In the embodiment of the present invention, it also includes: an intelligent threat warning module 106; The intelligent threat warning module 106 is used to generate threat warning information when it is determined that the cloud platform network security threat intelligent detection result meets the preset threat processing conditions, and transmit the threat warning information to the device designated by the staff to realize intelligent threat warning.

[0031] The threat warning information can be text warning information or sound and light warning information. The text warning information can be transmitted to the mobile device designated by the staff, and the sound and light warning information can be transmitted to the sound and light warning device designated by the staff, so that the staff can quickly check the abnormalities and ensure the network security of the cloud platform.

[0032] like Figure 2 As shown, an AI model is constructed, and according to the training data set obtained by the training data acquisition module, a spatial multi-point interaction algorithm is used to train the AI ​​model to obtain the trained AI model, including: S201, constructing a convolutional neural network model to obtain an AI model, and using a dynamic reverse learning initialization strategy to initialize the model parameters of the AI ​​model to obtain a plurality of different model parameter individuals; It is worth noting that in addition to using convolutional neural networks to build AI models, other neural networks can also be used to build AI models.

[0033] S202, obtaining the fitness corresponding to each model parameter individual according to the training data set obtained by the training data acquisition module, and determining the optimal parameter individual and the historical optimal value corresponding to each model parameter individual according to the fitness corresponding to the model parameter individual; For example, the loss function value (such as the cross entropy loss function value) corresponding to the individual model parameter can be obtained according to the training data set obtained by the training data acquisition module, and then the fitness corresponding to the individual model parameter can be obtained by adding the loss function value to a very small constant value (such as 0.001).

[0034] S203, performing a global space search on the model parameter individuals according to the optimal parameter individuals and using a crossover mutation strategy to obtain the model parameter individuals after the global space search; S204, according to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, adopt the global optimal point information interaction strategy to perform an optimal region guided search on the model parameter individuals after the global space search, and obtain the model parameter individuals after the optimal region guided search; S205, using an individual information interaction strategy to perform neighborhood information search on the model parameter individuals after the optimal region guided search, to obtain the model parameter individuals after the neighborhood information search; S206, using a pole adaptive control strategy to perform an adaptive local search on the model parameter individuals after the neighborhood information search, to obtain the model parameter individuals after the adaptive local search; S207. Repeat the crossover mutation strategy, the global optimal point information interaction strategy, the individual information interaction strategy and the extreme point adaptive control strategy until the maximum number of training times is reached. The final parameters of the AI ​​model are determined individually according to the model parameters after the last adaptive local search to obtain the trained AI model.

[0035] Optionally, after executing the crossover mutation strategy, the global optimal point information interaction strategy, the individual information interaction strategy and the extreme point adaptive control strategy, the individual model parameters may be out of bounds (such as setting the out-of-bounds parameter to its closest limit), thereby ensuring that the algorithm is always effective.

[0036] In an embodiment of the present invention, a dynamic reverse learning initialization strategy is used to initialize the model parameters of the AI ​​model to obtain a plurality of different model parameter individuals, including: The model parameters of the AI ​​model are initialized using a mixed mapping initialization method to obtain multiple initial parameter individuals; wherein each initial parameter individual includes part or all of the model parameters of the AI ​​model; for example, the model parameters of the AI ​​model may be part or all of the connection weights between the network layers of the AI ​​model.

[0037] The reverse learning individual corresponding to the initial parameter individual is obtained as follows: ;in, Indicates i Initial parameter individuals, i =1,2,…,I, I represents the total number of model parameter individuals. represents the upper limit individual corresponding to the initial parameter individual, represents the lower limit individual corresponding to the initial parameter individual, Represents the initial parameter individual The corresponding reverse learning individuals; According to the reverse learning individual corresponding to the initial parameter individual, the dynamic relative number individual corresponding to the initial parameter individual is obtained as follows: ;in, Represents the initial parameter individual The corresponding dynamic relative number of individuals, Represents the preset weight coefficient, represents the first random number between (0,1), Represents the second random number between (0,1); The fitness of the initial parameter individual, the fitness of the reverse learning individual and the fitness of the dynamic relative number individual are obtained, and the I individuals with the largest fitness are selected as multiple different model parameter individuals.

[0038] The dynamic reverse learning initialization strategy provided by the embodiment of the present invention can not only make the algorithm more evenly distributed in the solution space, but also effectively improve the position of the model parameter individuals in the solution control room, thereby improving the search speed of the algorithm.

[0039] In the embodiment of the present invention, according to the optimal parameter individual, a crossover mutation strategy is used to perform a global space search on the model parameter individual to obtain the model parameter individual after the global space search, including: According to the optimal parameter individuals, the model parameter individuals are crossed as follows: ; in, Indicates t During the training process j The model parameter individual d Dimension parameters, j =1,2,…,I, I represents the total number of model parameter individuals. d =1,2,…,D, where D represents the total dimension of the individual parameters of the model. Indicates j The crossover value of the d-th dimension parameter of the individual model parameters, that is, j The crossover individual corresponding to the model parameter individual d Dimension parameters, represents the optimal parameter individual d Dimension parameters, represents the third random number between (0,1), represents the fourth random number between (0,1), represents the fifth random number between (0,1), Indicates the tth training process j The d-th dimension parameter of the historical optimal value corresponding to each model parameter individual; The model parameters are mutated individually as follows: ; in, represents the d-th dimension parameter of the upper limit individual, The lower limit individual d Dimension parameters, express A random number between Indicates j The variation value of the d-th dimension parameter of the model parameter individual, that is, j The d-th dimension parameter of the variant individual corresponding to the model parameter individual, Represents the sixth random number between (0,1); For the j The model parameter individual d Dimension Parameters , using the model parameter individual d Original parameters Get the first fitness corresponding to the model parameter individual; use the first fitness of the crossover individual d Dimension Parameters Get the second fitness corresponding to the model parameter individual; use the first fitness of the variant individual d Dimension Parameters Get the third fitness of the model parameter individual; Determine the maximum value among the first fitness, the second fitness and the third fitness, obtain the target fitness, and use the parameter corresponding to the target fitness as the first parameter of the model parameter individual. d Dimension parameters, and go through the j All parameters of the model parameter individuals are obtained to obtain the model parameter individuals after global space search.

[0040] For example, for j The first dimension parameters of the model parameter individuals are first determined while keeping the parameters of the model parameter individuals unchanged; the first dimension parameters of the crossover individuals are used to replace the first fitness of the model parameter individuals. j After determining the first dimension parameters of the model parameter individuals, the second fitness corresponding to the model parameter individuals is determined; the first dimension parameters of the mutated individuals are used to replace the first dimension parameters of the j After the first dimension parameters of the model parameter individuals, the third fitness of the model parameter individuals is determined; if the first fitness is the largest, the first j The first dimension parameters of the model parameter individuals are taken as the first dimension parameters of the crossover individuals; if the second fitness is the largest, the first dimension parameters of the crossover individuals are taken as the first dimension parameters of the model parameter individuals, that is, the first dimension parameters of the model parameter individuals after the global space search; if the third fitness is the largest, the first dimension parameters of the mutation individuals are taken as the first dimension parameters of the model parameter individuals, that is, the first dimension parameters of the model parameter individuals after the global space search.

[0041] The crossover mutation strategy provided by the embodiment of the present invention can not only effectively improve the global search capability of the algorithm, but also ensure the search speed of the algorithm, thereby improving the search effect of the algorithm.

[0042] In the embodiment of the present invention, according to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, the global optimal point information interaction strategy is adopted to perform the optimal region guided search on the model parameter individuals after the global space search, and the model parameter individuals after the optimal region guided search are obtained, including: Based on the current number of training times, the first update factor and the second update factor are obtained as follows: as well as ; in, represents the first update factor, represents the second update factor, Indicates m The fitness of the model parameter individuals after the global space search, represents the noise value, and Set to 0.0001; represents the first control factor and is set to 0.01; Indicates t +1 second control factor during training, Indicates t The second control factor in the training process, and , the initial value of the second control factor is set to 0.01; Indicates the preset maximum number of training times. represents the first guided strength factor, and ; represents the second guided strength factor, and Set to 0.1; According to the optimal parameter individual, the historical optimal value corresponding to the model parameter individual, the first update factor and the second update factor, the optimal region guided search is performed on the model parameter individual after the global space search, and the model parameter individual after the optimal region guided search is obtained as follows: ; in, represents the model parameter individual after the mth global space search during the tth training process, and m =1,2,…,I, I represents the total number of model parameter individuals. represents the model parameter individual after the optimal region guided search , represents the seventh random number between (0,1), represents the eighth random number between (0,1), Represents the model parameter individual The corresponding historical optimal value is represents the optimal parameter individual.

[0043] The global optimal point information interaction strategy provided by the embodiment of the present invention can enable the model parameter vector to learn the optimal position information, so as to effectively search for the optimal area and improve the search speed of the algorithm.

[0044] In the embodiment of the present invention, the individual information interaction strategy is used to perform neighborhood information search on the model parameter individuals after the optimal area guided search, and the model parameter individuals after the neighborhood information search are obtained, including: For any model parameter individual after the optimal region guided search, a different model parameter individual is randomly matched to the model parameter individual to obtain the information interaction individual corresponding to each model parameter individual; According to the information interaction individuals corresponding to the model parameter individuals and the second update factor, the model parameter individuals after the optimal area guided search are searched for neighborhood information, and the model parameter individuals after the neighborhood information search are obtained as follows: ; in, Indicates t During the training process n The model parameter individuals after the optimal region guided search, and n =1,2,…,I, I represents the total number of model parameter individuals. Represents the model parameter individual after neighborhood information search , represents the ninth random number between (0,1), Represents the model parameter individual Corresponding information interaction individuals.

[0045] The individual information interaction strategy provided by the embodiment of the present invention can effectively search the areas between individuals, thereby increasing the search of unfamiliar areas, reducing collisions during the search process, and improving the traversal of the solution space. It can not only effectively improve the global search capability of the algorithm, but also improve the search accuracy in the later stage of the algorithm.

[0046] In an embodiment of the present invention, a pole adaptive control strategy is used to perform an adaptive local search on individual model parameters after neighborhood information search, and the individual model parameters after the adaptive local search are obtained, including: According to the model parameter individuals after the neighborhood information search, determine the worst parameter individual and the fitness corresponding to the worst parameter individual; According to the worst parameter individual and the fitness corresponding to the worst parameter individual, the model parameter individual after the neighborhood information search is adaptively searched locally, and the model parameter individual after the adaptive local search is obtained as follows: ;in, Indicates t During the training process k The model parameter individuals after neighborhood information search, Represents the model parameter individual after adaptive local search , k =1,2,…,I, I represents the total number of model parameter individuals. represents the tenth random number between (-1,1), represents the worst parameter individual, represents the fitness of the individual with the worst parameters, Represents the model parameter individual The corresponding fitness.

[0047] The pole adaptive control strategy provided by the embodiment of the present invention can effectively keep the individual model parameters away from the currently known worst position, and can effectively ensure the search speed of the algorithm.

[0048] Through the above four strategies, the global optimal parameters of the AI ​​model can be effectively searched, thereby improving the AI ​​model's learning ability for the training data set and ultimately improving the detection accuracy of network security threats on the cloud platform.

[0049] In an embodiment of the present invention, the trained AI model is scheduled to identify real-time network traffic data and determine the intelligent detection results of cloud platform network security threats, including: using real-time network traffic data as the input of the trained AI model to obtain the intelligent detection results of cloud platform network security threats; wherein the intelligent detection results of cloud platform network security threats include the presence or absence of threats.

[0050] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. An AI-based cloud platform network security threat intelligent detection system, characterized in that: It includes training data acquisition module, AI training optimization module, cloud platform real-time data collection module and security threat detection module; The training data acquisition module is used to acquire a training data set input by a staff member through human-computer interaction or a training data set from a designated data source; The AI ​​training optimization module is used to build an AI model, and train the AI ​​model using a spatial multi-point interaction algorithm based on the training data set obtained by the training data acquisition module to obtain the trained AI model; The cloud platform real-time data collection module is used to collect real-time network traffic data corresponding to the cloud platform during the operation of the cloud platform; The security threat detection module is used to schedule the trained AI model to identify real-time network traffic data and determine the intelligent detection results of network security threats on the cloud platform.

2. The AI-based cloud platform network security threat intelligent detection system according to claim 1 is characterized in that: Also includes: Intelligent threat processing module; The intelligent threat processing module is used to manage and control users who generate network security threats when it is determined that the cloud platform network security threat intelligent detection results meet preset threat processing conditions.

3. The AI-based cloud platform network security threat intelligent detection system according to claim 1 is characterized in that: Also includes: Intelligent threat warning module; The intelligent threat warning module is used to generate threat warning information when it is determined that the intelligent detection results of the cloud platform network security threat meet the preset threat processing conditions, and transmit the threat warning information to the device designated by the staff to realize intelligent threat warning.

4. The AI-based cloud platform network security threat intelligent detection system according to any one of claims 1 to 3, characterized in that: Construct an AI model, and train the AI ​​model using a spatial multi-point interaction algorithm based on the training data set obtained by the training data acquisition module to obtain the trained AI model, including: Construct a convolutional neural network model to obtain an AI model, and use a dynamic reverse learning initialization strategy to initialize the model parameters of the AI ​​model to obtain multiple different model parameter individuals; According to the training data set obtained by the training data acquisition module, the fitness corresponding to each model parameter individual is obtained, and according to the fitness corresponding to the model parameter individual, the optimal parameter individual and the historical optimal value corresponding to each model parameter individual are determined; According to the optimal parameter individual, the model parameter individual is searched in the global space by using the crossover mutation strategy to obtain the model parameter individual after the global space search; According to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, the global optimal point information interaction strategy is used to conduct the optimal region guided search for the model parameter individuals after the global space search, and the model parameter individuals after the optimal region guided search are obtained; Adopting the individual information interaction strategy to search the neighborhood information of the model parameter individuals after the optimal area guided search, the model parameter individuals after the neighborhood information search are obtained; Adopting the pole adaptive control strategy to perform adaptive local search on the model parameter individuals after the neighborhood information search, and obtaining the model parameter individuals after the adaptive local search; Repeat the crossover mutation strategy, global optimal point information interaction strategy, individual information interaction strategy and extreme point adaptive control strategy until the maximum number of training times is reached. The final parameters of the AI ​​model are determined individually based on the model parameters after the last adaptive local search to obtain the trained AI model.

5. The AI-based cloud platform network security threat intelligent detection system according to claim 4 is characterized in that: The model parameters of the AI ​​model are initialized using a dynamic reverse learning initialization strategy to obtain multiple different model parameter individuals, including: Initialize the model parameters of the AI ​​model using a mixed mapping initialization method to obtain multiple initial parameter individuals; wherein each initial parameter individual includes part or all of the model parameters of the AI ​​model; The reverse learning individual corresponding to the initial parameter individual is obtained as follows: ;in, Indicates i Initial parameter individuals, i =1,2,…,I, I represents the total number of model parameter individuals. represents the upper limit individual corresponding to the initial parameter individual, represents the lower limit individual corresponding to the initial parameter individual, Represents the initial parameter individual The corresponding reverse learning individuals; According to the reverse learning individual corresponding to the initial parameter individual, the dynamic relative number individual corresponding to the initial parameter individual is obtained as follows: ;in, Represents the initial parameter individual The corresponding dynamic relative number of individuals, Represents the preset weight coefficient, represents the first random number between (0,1), Represents the second random number between (0,1); The fitness of the initial parameter individual, the fitness of the reverse learning individual and the fitness of the dynamic relative number individual are obtained, and the I individuals with the largest fitness are selected as multiple different model parameter individuals.

6. The AI-based cloud platform network security threat intelligent detection system according to claim 4 is characterized in that: According to the optimal parameter individual, the crossover mutation strategy is used to search the model parameter individual in the global space, and the model parameter individual after the global space search is obtained, including: According to the optimal parameter individuals, the model parameter individuals are crossed as follows: ； in, Indicates t During the training process j The model parameter individual d Dimension parameters, j =1,2,…,I, I represents the total number of model parameter individuals. d =1,2,…,D, where D represents the total dimension of the individual parameters of the model. Indicates j The crossover value of the d-th dimension parameter of the individual model parameters, that is, j The crossover individual corresponding to the model parameter individual d Dimension parameters, represents the optimal parameter individual d Dimension parameters, represents the third random number between (0,1), represents the fourth random number between (0,1), represents the fifth random number between (0,1), Indicates the tth training process j The d-th dimension parameter of the historical optimal value corresponding to each model parameter individual; The model parameters are mutated individually as follows: ； in, represents the d-th dimension parameter of the upper limit individual, The lower limit individual d Dimension parameters, express A random number between Indicates j The variation value of the d-th dimension parameter of the model parameter individual, that is, j The d-th dimension parameter of the variant individual corresponding to the model parameter individual, Represents the sixth random number between (0,1); For the j The model parameter individual d Dimension Parameters , using the model parameter individual d Original parameters Get the first fitness corresponding to the model parameter individual; use the first fitness of the crossover individual d Dimension Parameters Get the second fitness corresponding to the model parameter individual; use the first fitness of the variant individual d Dimension Parameters Get the third fitness of the model parameter individual; Determine the maximum value among the first fitness, the second fitness and the third fitness, obtain the target fitness, and use the parameter corresponding to the target fitness as the first parameter of the model parameter individual. d Dimension parameters, and go through the j All parameters of the model parameter individuals are obtained to obtain the model parameter individuals after global space search.

7. The AI-based cloud platform network security threat intelligent detection system according to claim 6 is characterized in that: According to the historical optimal values ​​corresponding to the optimal parameter individuals and the model parameter individuals, the global optimal point information interaction strategy is used to conduct an optimal region guided search for the model parameter individuals after the global space search, and the model parameter individuals after the optimal region guided search are obtained, including: Based on the current number of training times, the first update factor and the second update factor are obtained as follows: as well as ;in, represents the first update factor, represents the second update factor, Indicates m The fitness of the model parameter individuals after the global space search, represents the noise value, and Set to 0.0001; represents the first control factor and is set to 0.01; Indicates t +1 second control factor during training, Indicates t The second control factor in the training process, and , the initial value of the second control factor is set to 0.01; Indicates the preset maximum number of training times. represents the first guided strength factor, and ; represents the second guided strength factor, and Set to 0.1; According to the optimal parameter individual, the historical optimal value corresponding to the model parameter individual, the first update factor and the second update factor, the optimal region guided search is performed on the model parameter individual after the global space search, and the model parameter individual after the optimal region guided search is obtained as follows: ； in, represents the model parameter individual after the mth global space search during the tth training process, and m =1,2,…,I, I represents the total number of model parameter individuals. represents the model parameter individual after the optimal region guided search , represents the seventh random number between (0,1), represents the eighth random number between (0,1), Represents the model parameter individual The corresponding historical optimal value is represents the optimal parameter individual.

8. The AI-based cloud platform network security threat intelligent detection system according to claim 7 is characterized in that: The individual information interaction strategy is used to perform neighborhood information search on the model parameter individuals after the optimal area guided search, and the model parameter individuals after the neighborhood information search are obtained, including: For any model parameter individual after the optimal region guided search, a different model parameter individual is randomly matched to the model parameter individual to obtain the information interaction individual corresponding to each model parameter individual; According to the information interaction individuals corresponding to the model parameter individuals and the second update factor, the model parameter individuals after the optimal area guided search are searched for neighborhood information, and the model parameter individuals after the neighborhood information search are obtained as follows: ； in, Indicates t During the training n The model parameter individuals after the optimal region guided search, and n =1,2,…,I, I represents the total number of model parameter individuals. Represents the model parameter individual after neighborhood information search , represents the ninth random number between (0,1), Represents the model parameter individual Corresponding information interaction individuals.

9. The AI-based cloud platform network security threat intelligent detection system according to claim 8 is characterized in that: The pole adaptive control strategy is used to perform adaptive local search on the model parameter individuals after the neighborhood information search, and the model parameter individuals after the adaptive local search are obtained, including: According to the model parameter individuals after the neighborhood information search, determine the worst parameter individual and the fitness corresponding to the worst parameter individual; According to the worst parameter individual and the fitness corresponding to the worst parameter individual, the model parameter individual after the neighborhood information search is adaptively searched locally, and the model parameter individual after the adaptive local search is obtained as follows: ； in, Indicates t During the training process k The model parameter individuals after neighborhood information search, Represents the model parameter individual after adaptive local search , k =1,2,…,I, I represents the total number of model parameter individuals. represents the tenth random number between (-1,1), represents the worst parameter individual, represents the fitness of the individual with the worst parameters, Represents the model parameter individual The corresponding fitness.

10. The AI-based cloud platform network security threat intelligent detection system according to claim 1 is characterized in that: The trained AI model is scheduled to identify real-time network traffic data and determine the intelligent detection results of cloud platform network security threats, including: using real-time network traffic data as input to the trained AI model to obtain the intelligent detection results of cloud platform network security threats; wherein the intelligent detection results of cloud platform network security threats include the presence or absence of threats.

Images