Network security threat situation assessment system based on AI technology

Abstract

The invention relates to the technical field of network security threats, in particular to a network security threat situation assessment system based on the AI technology, which comprises the following steps: analyzing access data when a system crashes in a historical period to obtain a bandwidth crash threshold, setting a bandwidth efficiency early warning value based on the bandwidth crash threshold, and judging whether the system crashes or not based on the bandwidth efficiency early warning value. In a monitoring period, access data obtained in real time are analyzed, threat signals are generated, an early warning area curve is analyzed based on the threat signals, a linear performance value is obtained, the change type of the early warning area curve is judged based on the linear performance value, and an applicable prediction model is constructed based on the change type of the early warning area curve. According to the invention, countdown early warning display can be carried out on the residual duration when the bandwidth efficiency value reaches the bandwidth collapse threshold, the situation of system failure or performance reduction caused by the bandwidth efficiency problem can be prevented in advance, the operation stability of the whole network system is effectively improved, and the risk of system collapse is reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security threat technology, and in particular to a network security threat situation assessment system based on AI technology. Background Art

[0002] In today's digital age, the stable operation of network systems affects many aspects. For enterprises, system crashes may mean serious consequences such as loss of orders, decreased customer satisfaction, and damaged business reputation. For public service areas, such as government systems and medical information systems, system failures may affect social order and people's normal lives.

[0003] In the past, network management was mostly done after the fact, that is, the causes were found and the faults were repaired only after the system had already experienced problems such as freezing and crashing. There was a lack of early and dynamic analysis and early warning mechanisms for network operation conditions, which would directly lead to an increase in the network security threat index after a network crash. There was also a lack of quantitative analysis of the relationship between network bandwidth and the number of visitors, and effective measures could not be taken to prevent problems before they occurred, resulting in a damaged user experience and an increase in enterprise operating costs due to frequent fault repairs.

[0004] To this end, we propose a network security threat system based on AI technology. Summary of the invention

[0005] The object of the present invention is to provide an integrated and efficient method for oxidatively removing hypophosphorous acid from chemical plating wastewater, so as to solve at least one of the above-mentioned problems of the prior art.

[0006] Threat assessment module: Analyze the access data when the system crashes in the historical period to obtain the bandwidth crash threshold. Based on the bandwidth crash threshold, set the bandwidth efficiency warning value. Based on the bandwidth efficiency warning value, analyze the access data obtained in real time during the monitoring period to obtain the threat assessment value. If the threat assessment value is greater than the threat assessment threshold, a threat signal is generated. Among them, access data includes network bandwidth and number of visitors; Linear analysis module: Based on the threat signal, the warning area curve is analyzed to obtain a linear performance value. If the linear performance value is greater than the linear performance threshold, it means that the change type of the warning area curve is linear. If the linear performance value is less than or equal to the linear performance threshold, it means that the change type of the warning area curve is non-linear. Prediction model selection and analysis module: Based on the change type of the warning area curve, an applicable prediction model is constructed, and based on the prediction model, the predicted bandwidth efficiency value is analyzed and obtained; Approaching situation analysis module: During the forecast period, the bandwidth efficiency value is continuously monitored in real time, and the bandwidth efficiency value monitored in real time is compared and analyzed with the forecast bandwidth efficiency value at different time nodes to obtain the approaching situation value. If the approaching situation value is greater than the approaching situation threshold, an approaching signal is generated; if the approaching situation value is less than or equal to the approaching situation threshold, a non-approaching signal is generated. Based on the approaching signal, a countdown warning display is performed; Control analysis module: Based on the non-approach signal, the non-approach performance value is analyzed. If the non-approach performance value is greater than the non-approach performance threshold, an adjustment signal is generated. Based on the adjustment signal, a countdown warning display is performed.

[0007] Beneficial effects of the present invention: 1. The present invention is based on analyzing the access data when the system crashes in the historical period to obtain the bandwidth collapse threshold, and based on the bandwidth collapse threshold, sets the bandwidth efficiency warning value. Based on the bandwidth efficiency warning value, within the monitoring period, the real-time acquired network bandwidth and the corresponding number of visitors are analyzed to obtain a threat assessment value. If the threat assessment value is greater than the threat assessment threshold, a threat signal is generated. The present invention dynamically analyzes the network operation status before the system crashes and evaluates the possibility of network security threats, which is conducive to optimizing the user experience, timely discovering risks, and avoiding the occurrence of system freezes or even crashes due to an increase in the number of visitors.

[0008] 2. Based on the threat signal, the warning area curve is analyzed to obtain a linear performance value, and the change type of the warning area curve is determined based on the linear performance value. Based on the change type of the warning area curve, an applicable prediction model is constructed, and based on the prediction model, a predicted bandwidth efficiency value is analyzed to obtain a predicted bandwidth efficiency value. During the prediction period, the bandwidth efficiency value is continuously monitored in real time, and the real-time monitored bandwidth efficiency value is compared and analyzed with the predicted bandwidth efficiency value at different time nodes to obtain a situation approach value. If the situation approach value is greater than the situation approach threshold, an approach signal is generated, and a countdown warning display is performed based on the approach signal. The present invention can display a countdown warning of the remaining time for the bandwidth efficiency value to reach the bandwidth collapse threshold through the analysis, prediction, monitoring and warning process, so as to prevent system failures or performance degradation caused by bandwidth efficiency problems in advance, effectively improve the stability of the operation of the entire network system, and reduce the risk of system collapse.

[0009] 3. Based on the non-approaching signal, a non-approaching performance value is analyzed and obtained. If the non-approaching performance value is greater than the non-approaching performance threshold, an adjustment signal is generated. Based on the adjustment signal, a countdown warning display is performed. When the bandwidth efficiency values ​​at different time nodes do not approach the predicted bandwidth efficiency value, the present invention analyzes whether the degree to which the bandwidth efficiency values ​​at different time nodes do not approach the predicted bandwidth efficiency value is similar. If so, the bandwidth collapse threshold is adjusted according to the overall degree of non-approaching, and is input into the model to accurately predict the remaining time for the bandwidth efficiency value to reach the bandwidth collapse threshold. When the actual bandwidth efficiency value and the predicted bandwidth efficiency value are not approaching, the input of the bandwidth collapse threshold is changed to accurately realize the remaining time for the predicted bandwidth efficiency value to reach the bandwidth collapse threshold, which is conducive to the stable operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0011] Figure 1 This is a schematic diagram of the structure of a network security threat situation assessment system based on AI technology provided in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the structure of a network security threat situation assessment device based on AI technology provided in Embodiment 4 of the present invention; Figure 3 It is a structural schematic diagram of an electronic device according to an embodiment of the present invention.

[0012] Figure numbers: 3, computer device; 301, processor; 302, memory; 303, computer program. DETAILED DESCRIPTION

[0013] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0014] Embodiment 1 Figure 1A flowchart of a network security threat situation assessment system based on AI technology is provided for the first embodiment of the present invention. The embodiment of the present invention can be applied to the situation where the system crashes due to the increase in the number of visitors. The network security threat situation assessment system based on AI technology can be executed by a network security threat situation assessment method based on AI technology. The network security threat situation assessment system based on AI technology can be implemented by software and hardware. The network security threat situation assessment system based on AI technology can be configured in a network security threat situation assessment device based on AI technology. Optionally, a network security threat situation assessment device based on AI technology can be an electronic device, which can be a notebook, a desktop computer, a smart tablet, etc., and the embodiment of the present invention does not limit this.

[0015] like Figure 1 As shown, an embodiment of the present invention provides a network security threat situation assessment system based on AI technology, which specifically includes: Threat assessment module: Analyze the access data when the system crashes in the historical period to obtain the bandwidth crash threshold. Based on the bandwidth crash threshold, set the bandwidth efficiency warning value. Based on the bandwidth efficiency warning value, analyze the access data obtained in real time during the monitoring period to obtain the threat assessment value. If the threat assessment value is greater than the threat assessment threshold, a threat signal is generated. Among them, access data includes network bandwidth and number of visitors; It should be noted that the bandwidth efficiency warning value is greater than the bandwidth collapse threshold DX 阈 ; Get the network bandwidth and number of visitors when the system crashed during the historical period; It should be noted that in Linux systems, command line tools such as iftop, nload, and ifstat are used to monitor network bandwidth in real time, and record and save the information in logs before the system crashes. After the system crashes, logs should be collected as soon as possible, and the network bandwidth and number of visitors at the time of the system crash can be counted by analyzing the logs. The network bandwidth and the number of visitors when the system crashes are processed by ratio to obtain the bandwidth crash value; For example, the network bandwidth of the system is 1000Mbps, which can support 5 users to conduct network activities at the same time under normal circumstances. Assume that when the network crashes, there are 10 users accessing at the same time. The ratio of network bandwidth to the number of users is 1000Mbps / 10 people = 100Mbps / person, that is, bandwidth crash value = 100Mbps / person; The bandwidth collapse threshold DX is obtained by summing up and averaging all bandwidth collapse values ​​when the system crashes in the historical period. 阈 ; During the monitoring period, the monitoring period is divided into several monitoring time points, the network bandwidth and the corresponding number of visitors at the monitoring time points are obtained in real time, and the network bandwidth and the corresponding number of visitors at the monitoring time points are processed by ratio to obtain the bandwidth efficiency value; Construct a bandwidth efficiency value variation curve in a two-dimensional coordinate system, where time is the x-axis and the y-axis is the bandwidth efficiency value; The bandwidth efficiency warning value is marked in the two-dimensional coordinate system, and a straight line parallel to the x-axis is drawn through the marked point to mark it as the bandwidth efficiency warning line; Set the bandwidth collapse threshold DX 阈 Marking is done in a two-dimensional coordinate system, and a straight line parallel to the x-axis is drawn through the marked point, marking it as the bandwidth collapse line; If the bandwidth efficiency value is less than the bandwidth efficiency warning value, no processing is performed and real-time monitoring continues; If the bandwidth efficiency value is greater than the bandwidth efficiency warning value and less than the bandwidth collapse threshold DX 阈 , then an analysis signal is generated; Based on the analysis signal, the curve segment below the bandwidth efficiency warning line in the bandwidth efficiency change curve is marked as the warning zone curve, and the bandwidth efficiency value in the warning zone curve is obtained and marked as DX; Obtain the duration corresponding to the warning area curve, perform ratio processing on the duration corresponding to the warning area curve and the duration corresponding to the monitoring period, and obtain the time duration ratio SC; The bandwidth efficiency value DX and the time duration ratio SC in the warning area curve are processed by the formula: The threat assessment value YB is calculated, where s1 and s2 are preset proportional coefficients, N represents the total number of bandwidth efficiency values ​​in the warning area curve, s1 takes a value of 1.656, and s2 takes a value of 1.669; It should be noted that the threat assessment value is obtained by processing the over-limit value DP and the time duration ratio SC. The over-limit value DP reflects the deviation of the warning area curve from the bandwidth collapse line. The smaller the deviation, the closer the warning area curve is to the bandwidth collapse line, and the greater the threat to the system. The time duration ratio SC reflects the duration of the warning area curve exceeding the bandwidth efficiency warning line. The longer the duration, the greater the threat to the system. Compare the threat assessment value to the threat assessment threshold: If the threat assessment value is greater than the threat assessment threshold, it means that the possibility of network security threat is high during the monitoring period, and a threat signal is generated; If the threat assessment value is less than or equal to the threat assessment threshold, it means that the possibility of network security threat during the monitoring period is low, and a non-threat signal is generated; The technical solution of the embodiment of the present invention is mainly as follows: analyzing the access data when the system crashes in the historical period to obtain the bandwidth crash threshold, setting the bandwidth efficiency warning value based on the bandwidth crash threshold, and analyzing the network bandwidth and the corresponding number of visitors acquired in real time within the monitoring period based on the bandwidth efficiency warning value to obtain a threat assessment value. If the threat assessment value is greater than the threat assessment threshold, a threat signal is generated. The present invention dynamically analyzes the network operation status before the system crashes and evaluates the possibility of network security threats, which is conducive to optimizing the user experience, timely discovering risks, and avoiding the occurrence of system freezes or even crashes due to an increase in the number of visitors.

[0016] Embodiment 2 like Figure 1 As shown, an embodiment of the present invention provides a network security threat situation assessment system based on AI technology, which specifically includes the following steps: Linear analysis module: Based on the threat signal, the warning area curve is analyzed to obtain a linear performance value. If the linear performance value is greater than the linear performance threshold, it means that the change type of the warning area curve is linear. Obtain the corresponding warning area curve, divide the warning area curve into warning area curve segments with equal horizontal lengths, obtain the slope values ​​of the warning area curve segments, mark the warning area curve segments with negative slope values ​​as negative slope curve segments, count the number of negative slope curve segments in the warning area curve segments, mark them as the total number of negative slope curve segments, perform ratio processing on the total number of negative slope curve segments and the total number of warning area curve segments, and obtain the negative slope curve segment number ratio FQ; Connect the two end points of the warning area curve with a straight line to obtain a change reference line, measure the overlap length between the warning area curve and the change reference line, and perform ratio processing with the length of the change reference line to obtain the situation overlap value BH; The negative slope curve segment number ratio FQ and the situation overlap value BH are processed by data, and the formula is: The linear performance value XB is calculated, where a1 and a2 are both preset proportional coefficients, a1 is 0.568, and a2 is 0.631; Compare the linear performance value to the linear performance threshold: If the linear performance value is greater than the linear performance threshold, it means that the change type of the warning area curve changes linearly; If the linear performance value is less than or equal to the linear performance threshold, it means that the curve change type of the warning area is nonlinear; Prediction model selection and analysis module: Based on the change type of the warning area curve, an applicable prediction model is constructed, and based on the prediction model, the predicted bandwidth efficiency value is analyzed and obtained; All bandwidth efficiency values ​​of the warning zone curve are integrated into a data set as a training data set. If the change type of the warning zone curve is linear, a linear regression model is selected as a prediction model based on AI technology. If the change type of the warning zone curve is nonlinear, a random forest network model is selected as a prediction model based on AI technology. The prediction model is trained using the training data set to obtain a trained prediction model. Set the bandwidth collapse threshold DX 阈 Input into the prediction model to obtain the bandwidth efficiency value reaching the bandwidth collapse threshold DX 阈 The time point is marked as the arrival time point, and the difference between the arrival time point and the current time point is processed to obtain the bandwidth efficiency value reaching the bandwidth collapse threshold DX 阈 The remaining time is calculated, and the time period corresponding to the remaining time is marked as the prediction period; Input different time nodes within the prediction period into the prediction model to obtain the predicted bandwidth efficiency values ​​at different time nodes within the prediction period; Approaching situation analysis module: During the forecast period, the bandwidth efficiency value is continuously monitored in real time, and the bandwidth efficiency value monitored in real time is compared and analyzed with the forecast bandwidth efficiency value at different time nodes to obtain the approaching situation value. If the approaching situation value is greater than the approaching situation threshold, an approaching signal is generated; if the approaching situation value is less than or equal to the approaching situation threshold, a non-approaching signal is generated. Based on the approaching signal, a countdown warning display is performed; Specifically, within the prediction period, a monitoring period is preset, wherein the time length corresponding to the preset monitoring period is less than the time length corresponding to the prediction period; Obtain the bandwidth efficiency values ​​monitored in real time at different time nodes during the preset monitoring period, and compare them with the predicted bandwidth efficiency values ​​at different time nodes. Specifically: Based on any time point; If the bandwidth efficiency value at the time node is not equal to the predicted bandwidth efficiency value, the time node is marked as a different time node; If the bandwidth efficiency value at a time node is not equal to the predicted bandwidth efficiency value, the time node is marked as the same time node; Count the total number of time nodes and the number of different time nodes within the preset monitoring period, and perform ratio processing on the number of different time nodes and the total number of time nodes within the preset monitoring period to obtain the situation deviation number ratio BT; Obtain the bandwidth efficiency values ​​of different time nodes, perform difference processing with the predicted bandwidth efficiency values ​​of different time nodes, and take the absolute value of the difference to obtain the bandwidth efficiency value deviation of different time nodes, perform ratio processing on the bandwidth efficiency value deviation of different time nodes and the predicted bandwidth efficiency value of different time nodes to obtain the bandwidth efficiency value deviation ratio of different time nodes, sum and average the bandwidth efficiency value deviation ratios of all different time nodes to obtain the situation deviation degree value BJ; The situation deviation quantity ratio BT and the situation deviation degree value BJ are processed by data, and the formula is: The situation approach value TQ is obtained, where m1 and m2 are both preset proportional coefficients, m1 is 1.967, and m2 is 1.905; Compare the situation approach value to the situation approach threshold: If the trend approach value is greater than the trend approach threshold, it means that the bandwidth efficiency value change trend during the monitoring period is close to the predicted bandwidth efficiency value change trend, and an approach signal is generated; If the trend approach value is less than or equal to the trend approach threshold, it means that the bandwidth efficiency value change trend during the monitoring period is not close to the predicted bandwidth efficiency value change trend, and a non-approach signal is generated; Based on the approaching signal, the bandwidth efficiency value reaches the bandwidth collapse threshold DX 阈 The remaining time is counted down and warned; The technical solution of the embodiment of the present invention is mainly as follows: based on the threat signal, the warning area curve is analyzed to obtain a linear performance value, based on the linear performance value, the change type of the warning area curve is judged, based on the change type of the warning area curve, an applicable prediction model is constructed, based on the prediction model, a predicted bandwidth efficiency value is analyzed, and within the prediction period, the bandwidth efficiency value is continuously monitored in real time, and the real-time monitored bandwidth efficiency value is compared and analyzed with the predicted bandwidth efficiency value at different time nodes to obtain a situation approach value, if the situation approach value is greater than the situation approach threshold, an approach signal is generated, and a countdown warning display is performed based on the approach signal. The present invention can perform a countdown warning display on the remaining time for the bandwidth efficiency value to reach the bandwidth collapse threshold, and can prevent system failures or performance degradation caused by bandwidth efficiency problems in advance, effectively improve the stability of the operation of the entire network system, and reduce the risk of system collapse.

[0017] Embodiment 3 like Figure 1 As shown, an embodiment of the present invention provides a network security threat situation assessment method based on AI technology, which specifically includes the following steps: Control analysis module: Based on the non-approaching signal, the non-approaching performance value is analyzed. If the non-approaching performance value is greater than the non-approaching performance threshold, an adjustment signal is generated. Based on the adjustment signal, a countdown warning display is performed; Based on the non-approaching signal, the bandwidth efficiency values ​​of different time nodes monitored in real time during the prediction period are obtained, and the difference between the bandwidth efficiency values ​​and the predicted bandwidth efficiency values ​​is processed to obtain the bandwidth efficiency deviation value; Count the number of nodes with positive bandwidth efficiency deviation values ​​and the number of nodes with negative bandwidth efficiency deviation values. If the number of nodes with positive bandwidth efficiency deviation values ​​is greater than the number of nodes with negative bandwidth efficiency deviation values, mark the nodes with positive bandwidth efficiency deviation values ​​as target nodes. If the number of nodes with positive bandwidth efficiency deviation values ​​is less than the number of nodes with negative bandwidth efficiency deviation values, mark the nodes with negative bandwidth efficiency deviation values ​​as target nodes. If the number of nodes with positive bandwidth efficiency deviation values ​​is the same as the number of nodes with negative bandwidth efficiency deviation values, it means that the bandwidth efficiency values ​​at different time points are not close to the predicted bandwidth efficiency values, and the analysis is stopped. Count the number of target nodes and compare it with the number of nodes at different times to get the target node number ratio MS; Integrate all bandwidth efficiency deviation values ​​into a bandwidth efficiency deviation data group, calculate the variance of the bandwidth efficiency deviation values ​​in the bandwidth efficiency deviation data group, and mark it as FC; The target node number ratio MS and the variance FC of the bandwidth efficiency deviation value in the bandwidth efficiency deviation data group are processed by the formula: The non-approaching performance value FB is calculated, where n1 and n2 are both preset proportional coefficients, n1 is 1.913, and n2 is 1.444; Compare the non-approaching performance value to the non-approaching performance threshold: If the non-approaching performance value is greater than the non-approaching performance threshold, it means that the bandwidth efficiency values ​​at different time nodes are not approaching the predicted bandwidth efficiency value to a similar degree, and an adjustment signal is generated; If the non-approaching performance value is less than or equal to the non-approaching performance threshold, it means that the bandwidth efficiency values ​​of different time nodes are not close to the predicted bandwidth efficiency value, and no processing is performed; Based on the adjustment signal, the bandwidth efficiency deviation values ​​of all target nodes are summed and averaged to obtain the target bandwidth efficiency difference mean. If the target bandwidth efficiency difference mean is positive, the bandwidth collapse threshold DX is set to 阈 The difference between the target bandwidth efficiency difference mean is processed to obtain the adjusted bandwidth collapse threshold, and the value prediction model is re-entered to re-obtain the remaining time. If the target bandwidth efficiency difference mean is negative, the bandwidth collapse threshold DX is increased. 阈 The adjusted bandwidth collapse threshold is obtained by summing the absolute value of the target bandwidth efficiency difference mean, and then re-entering the value prediction model to obtain the remaining time. The remaining time obtained again will be displayed as a countdown warning; The technical solution of the embodiment of the present invention is: based on the non-approaching signal, a non-approaching performance value is analyzed and obtained; if the non-approaching performance value is greater than the non-approaching performance threshold, an adjustment signal is generated; based on the adjustment signal, a countdown warning display is performed; when the bandwidth efficiency values ​​at different time nodes do not approach the predicted bandwidth efficiency value, the present invention analyzes whether the degree to which the bandwidth efficiency values ​​at different time nodes do not approach the predicted bandwidth efficiency value is similar; if so, the bandwidth collapse threshold is adjusted according to the overall degree of non-approaching, and is input into the model to accurately predict the remaining time for the bandwidth efficiency value to reach the bandwidth collapse threshold; when the actual bandwidth efficiency value and the predicted bandwidth efficiency value are not approaching each other, the input of the bandwidth collapse threshold is changed to accurately realize the remaining time for the predicted bandwidth efficiency value to reach the bandwidth collapse threshold, which is beneficial to the stable operation of the system.

[0018] Embodiment 4 like Figure 2 As shown, an embodiment of the present invention provides a network security threat situation assessment method based on AI technology, which specifically includes the following steps: Step 1: Analyze the access data when the system crashes in the historical period to obtain the bandwidth crash threshold. Based on the bandwidth crash threshold, set the bandwidth efficiency warning value. Based on the bandwidth efficiency warning value, analyze the real-time network bandwidth and the corresponding number of visitors during the monitoring period to obtain the threat assessment value. If the threat assessment value is greater than the threat assessment threshold, generate a threat signal. Among them, access data includes network bandwidth and number of visitors; Step 2: Based on the threat signal, the warning area curve is analyzed to obtain a linear performance value. If the linear performance value is greater than the linear performance threshold, it means that the change type of the warning area curve is linear. If the linear performance value is less than or equal to the linear performance threshold, it means that the change type of the warning area curve is non-linear. Step 3: Based on the change type of the warning area curve, build an applicable prediction model, and analyze and obtain the predicted bandwidth efficiency value based on the prediction model; Step 4: During the forecast period, the bandwidth efficiency value is continuously monitored in real time, and the real-time monitored bandwidth efficiency value is compared and analyzed with the forecast bandwidth efficiency value at different time nodes to obtain the situation approaching value. If the situation approaching value is greater than the situation approaching threshold, an approaching signal is generated; if the situation approaching value is less than or equal to the situation approaching threshold, a non-approaching signal is generated, and a countdown warning display is performed based on the approaching signal; Step 5: Based on the non-approaching signal, a non-approaching performance value is analyzed and obtained. If the non-approaching performance value is greater than the non-approaching performance threshold, an adjustment signal is generated. Based on the adjustment signal, a countdown warning display is performed.

[0019] Embodiment 5 Reference Figure 3The embodiment of the present invention further provides a computer device 3, comprising: a memory 302 and a processor 301 and a computer program 303 stored in the memory 302. When the computer program 303 is executed on the processor 301, a network security threat situation assessment system based on AI technology as described in any one of the above systems is implemented.

[0020] The computer device 3 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will appreciate that Figure 3 It is only an example of computer device 3 and does not constitute a limitation on computer device 3. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components, for example, it may also include input and output devices, network access devices, etc.

[0021] The processor 301 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0022] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may also be an external storage device of the computer device 3, such as a plug-in hard disk, a smart memory card (SmartMediaCard, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 3. Further, the memory 302 may also include both an internal storage unit of the computer device 3 and an external storage device. The memory 302 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program, etc. The memory 302 may also be used to temporarily store data that has been output or is to be output.

[0023] Embodiment 6 An embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, a network security threat situation assessment system based on AI technology as described in any of the above systems is implemented.

[0024] In this embodiment, if the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above-mentioned various method embodiments can be implemented. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, USB flash drive, mobile hard disk, disk or optical disk. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electric carrier signals and telecommunication signals.

[0025] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0026] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0027] In the embodiments disclosed in the present application, it should be understood that the disclosed apparatus / terminal equipment and method can be implemented in other ways. For example, the apparatus / terminal equipment embodiments described above are merely illustrative. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. One point, the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, which may be electrical, mechanical or other forms.

[0028] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0029] The above formulas are all dimensionless and numerical calculations. The formula is a formula for the most recent real situation obtained by collecting a large amount of data and performing software simulation. The preset parameters in the formula are set by technicians in this field according to actual conditions.

[0030] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A network security threat situation assessment system based on AI technology, characterized in that: include: Threat assessment module: Analyze the access data when the system crashes in the historical period to obtain the bandwidth crash threshold. Based on the bandwidth crash threshold, set the bandwidth efficiency warning value. Based on the bandwidth efficiency warning value, analyze the access data obtained in real time during the monitoring period to obtain the threat assessment value. If the threat assessment value is greater than the threat assessment threshold, a threat signal is generated. Among them, access data includes network bandwidth and number of visitors; Linear analysis module: Based on the threat signal, the warning area curve is analyzed to obtain a linear performance value. If the linear performance value is greater than the linear performance threshold, it means that the change type of the warning area curve is linear. If the linear performance value is less than or equal to the linear performance threshold, it means that the change type of the warning area curve is non-linear. Prediction model selection and analysis module: Based on the change type of the warning area curve, an applicable prediction model is constructed, and based on the prediction model, the predicted bandwidth efficiency value is analyzed and obtained; Approaching situation analysis module: During the forecast period, the bandwidth efficiency value is continuously monitored in real time, and the bandwidth efficiency value monitored in real time is compared and analyzed with the forecast bandwidth efficiency value at different time nodes to obtain the approaching situation value. If the approaching situation value is greater than the approaching situation threshold, an approaching signal is generated; if the approaching situation value is less than or equal to the approaching situation threshold, a non-approaching signal is generated. Based on the approaching signal, a countdown warning display is performed; Control analysis module: Based on the non-approach signal, the non-approach performance value is analyzed. If the non-approach performance value is greater than the non-approach performance threshold, an adjustment signal is generated. Based on the adjustment signal, a countdown warning display is performed.

2. According to the network security threat situation assessment system based on AI technology in claim 1, it is characterized in that: The threat assessment value is obtained in the following manner: Get the network bandwidth and number of visitors when the system crashed during the historical period; The network bandwidth and the number of visitors during the system crash in the historical period are processed to obtain the bandwidth crash value; The bandwidth collapse threshold DX is obtained by summing up and averaging all bandwidth collapse values ​​when the system crashes in the historical period. 阈 ; Obtain the network bandwidth and number of visitors in real time during the monitoring period, and analyze to obtain the bandwidth efficiency value DX and the time duration ratio SC; The bandwidth efficiency value DX and the time duration ratio SC in the warning area curve are processed by the formula: The threat assessment value YB is calculated, where s1 and s2 are preset proportional coefficients, and N represents the total number of bandwidth efficiency values ​​in the warning area curve.

3. According to claim 2, a network security threat situation assessment system based on AI technology is characterized in that: The method for obtaining the over-limit degree value DP and the time duration ratio SC is as follows: During the monitoring period, the monitoring period is divided into several monitoring time points, the network bandwidth and the corresponding number of visitors at the monitoring time points are obtained in real time, and the network bandwidth and the corresponding number of visitors at the monitoring time points are processed by ratio to obtain the bandwidth efficiency value; Based on the bandwidth efficiency value, a bandwidth efficiency value change curve is constructed; Based on the bandwidth efficiency warning value, a bandwidth efficiency warning line is constructed; Based on bandwidth collapse threshold DX 阈 , construct bandwidth collapse line; If the bandwidth efficiency value is greater than the bandwidth efficiency warning value and less than the bandwidth collapse threshold, an analysis signal is generated; Based on the analysis signal, the curve segment below the bandwidth efficiency warning line in the bandwidth efficiency change curve is marked as the warning zone curve, and the bandwidth efficiency value in the warning zone curve is obtained and marked as DX; The duration corresponding to the warning area curve is obtained, and the duration corresponding to the warning area curve is ratio-processed with the duration corresponding to the monitoring period to obtain the time duration ratio SC.

4. According to claim 3, a network security threat situation assessment system based on AI technology is characterized in that: The linear performance value XB is obtained as follows: By analyzing the early warning area curve, we can obtain the negative slope curve segment number ratio FQ and the situation overlap value BH; The negative slope curve segment number ratio FQ and the situation overlap value BH are processed by data, and the formula is: The linear performance value XB is calculated, where a1 and a2 are both preset proportional coefficients.

5. According to claim 4, a network security threat situation assessment system based on AI technology is characterized in that: The method for obtaining the negative slope curve segment quantity ratio FQ and the situation overlap value BH is as follows: Obtain the corresponding warning area curve, divide the warning area curve into warning area curve segments with equal horizontal lengths, obtain the slope values ​​of the warning area curve segments, mark the warning area curve segments with negative slope values ​​as negative slope curve segments, count the number of negative slope curve segments in the warning area curve segments, mark them as the total number of negative slope curve segments, perform ratio processing on the total number of negative slope curve segments and the total number of warning area curve segments, and obtain the negative slope curve segment number ratio FQ; Connect the two end points of the warning area curve with a straight line to obtain the change reference line, measure the overlap length between the warning area curve and the change reference line, and perform ratio processing with the length of the change reference line to obtain the situation overlap value BH.

6. According to the network security threat situation assessment system based on AI technology in claim 3, it is characterized in that: The method for obtaining the predicted bandwidth efficiency value is as follows: All bandwidth efficiency values ​​of the warning area curve are integrated into a data set as a training data set. If the change type of the warning area curve is linear, a linear regression model is selected as a prediction model. If the change type of the warning area curve is nonlinear, a random forest network model is selected as a prediction model. The prediction model is trained using the training data set to obtain a trained prediction model. The bandwidth collapse threshold is input into the prediction model to obtain the time point when the bandwidth efficiency value reaches the bandwidth collapse threshold, and is marked as the arrival time point. The arrival time point is subjected to difference processing with the current time point to obtain the remaining time for the bandwidth efficiency value to reach the bandwidth collapse threshold, and the time period corresponding to the remaining time is marked as the prediction period; Different time nodes within the prediction period are input into the prediction model to obtain the predicted bandwidth efficiency values ​​of different time nodes within the prediction period.

7. The network security threat situation assessment system based on AI technology according to claim 1 is characterized in that: The method for obtaining the situation approach value is as follows: During the forecast period, a monitoring period is preset, and the bandwidth efficiency values ​​monitored in real time at different time nodes during the preset monitoring period are analyzed to obtain the situation deviation quantity ratio BT and the situation deviation degree value BJ; The situation deviation quantity ratio BT and the situation deviation degree value BJ are processed by data, and the formula is: The situation approach value TQ is obtained, wherein m1 and m2 are both preset proportional coefficients.

8. The network security threat situation assessment system based on AI technology according to claim 7 is characterized in that: The method for obtaining the situation deviation quantity ratio BT and the situation deviation degree value BJ is as follows: Obtain the bandwidth efficiency values ​​monitored in real time at different time nodes during the preset monitoring period, and compare them with the predicted bandwidth efficiency values ​​at different time nodes. Specifically: Based on any time point; If the bandwidth efficiency value at the time node is not equal to the predicted bandwidth efficiency value, the time node is marked as a different time node; If the bandwidth efficiency value at a time node is not equal to the predicted bandwidth efficiency value, the time node is marked as the same time node; Count the total number of time nodes and the number of different time nodes within the preset monitoring period, and perform ratio processing on the number of different time nodes and the total number of time nodes within the preset monitoring period to obtain the situation deviation number ratio BT; The bandwidth efficiency values ​​of different time nodes are obtained, and the difference is processed with the predicted bandwidth efficiency values ​​of different time nodes, and the absolute value of the difference is taken to obtain the bandwidth efficiency value deviation of different time nodes, and the bandwidth efficiency value deviation of different time nodes is processed with the predicted bandwidth efficiency value of different time nodes to obtain the bandwidth efficiency value deviation ratio of different time nodes, and the bandwidth efficiency value deviation ratios of all different time nodes are summed and averaged to obtain the situation deviation degree value BJ.

9. The network security threat situation assessment system based on AI technology according to claim 1 is characterized in that: The non-approaching performance value is obtained in the following manner: The target node number ratio MS and the variance FC of the bandwidth efficiency deviation value in the bandwidth efficiency deviation data group are processed by the formula: The non-approaching performance value FB is calculated, wherein n1 and n2 are both preset proportional coefficients; The target node number ratio MS and the variance FC of the bandwidth efficiency deviation value in the bandwidth efficiency deviation data group are obtained as follows: Obtain the bandwidth efficiency values ​​of different time nodes monitored in real time during the prediction period, and perform subtraction processing on the bandwidth efficiency values ​​from the predicted bandwidth efficiency values ​​to obtain the bandwidth efficiency deviation value; Count the number of nodes with positive bandwidth efficiency deviation values ​​and the number of nodes with negative bandwidth efficiency deviation values. If the number of nodes with positive bandwidth efficiency deviation values ​​is greater than the number of nodes with negative bandwidth efficiency deviation values, mark the nodes with positive bandwidth efficiency deviation values ​​as target nodes. If the number of nodes with positive bandwidth efficiency deviation values ​​is less than the number of nodes with negative bandwidth efficiency deviation values, mark the nodes with negative bandwidth efficiency deviation values ​​as target nodes. If the number of nodes with positive bandwidth efficiency deviation values ​​is the same as the number of nodes with negative bandwidth efficiency deviation values, it means that the bandwidth efficiency values ​​at different time points are not close to the predicted bandwidth efficiency values, and the analysis is stopped. Count the number of target nodes and compare it with the number of nodes at different times to get the target node number ratio MS; All bandwidth efficiency deviation values ​​are integrated into a bandwidth efficiency deviation data group, and the variance of the bandwidth efficiency deviation values ​​in the bandwidth efficiency deviation data group is calculated and marked as FC.

10. The network security threat situation assessment system based on AI technology according to claim 9 is characterized in that: The warning display mode based on the control signal is: The bandwidth efficiency deviation values ​​of all target nodes are summed and averaged to obtain the target bandwidth efficiency difference mean. If the target bandwidth efficiency difference mean is positive, the bandwidth collapse threshold DX is increased. 阈 The difference between the target bandwidth efficiency difference mean is processed to obtain the adjusted bandwidth collapse threshold, and the value prediction model is re-entered to re-obtain the remaining time. If the target bandwidth efficiency difference mean is negative, the bandwidth collapse threshold DX is increased. 阈 The adjusted bandwidth collapse threshold is obtained by summing the absolute value of the target bandwidth efficiency difference mean, and then re-entering the value prediction model to obtain the remaining time. The remaining time obtained is sent to the display system for countdown warning display.

Images