Network security intelligent decision-making body method and system

Abstract

The invention belongs to the technical field of network security, and particularly relates to a network security intelligent decision-making body method and system, and the method comprises the steps: receiving and analyzing logs, traffic or alarm information in a network through an analysis body, and outputting attack behavior characteristics; the AI intelligent decision-making body evaluates the values of various possible protection strategies based on the output of the analysis body, and selects an optimal strategy; and the executor executes a corresponding response action according to the strategy selected by the AI intelligent decision-making body. According to the method, automatic and intelligent elements are introduced, and the event response process is comprehensively optimized. By constructing an architecture level of'command + AI intelligent decision-making + execution ', logs, traffic or alarm information in a network can be automatically analyzed, attack behavior characteristics can be identified, values of various possible protection strategies are evaluated based on the information, and finally an optimal strategy is selected. According to the method, the response speed can be remarkably improved, and the accuracy and reasonability of decision making can be ensured, so that the overall efficiency of network security protection is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular relates to a network security intelligent decision-making method and system. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly severe. Traditionally, enterprises and organizations rely on firewalls, intrusion detection systems (IDS), antivirus software and other means to protect their network environment from external attacks and internal threats. However, in the face of evolving complex network attack patterns, such as zero-day attacks and advanced persistent threats (APT), these traditional protection measures have gradually exposed their limitations.

[0003] The existing network security protection system mainly relies on static defense mechanisms with predefined rule sets. For example, firewalls block unauthorized network traffic by setting access control lists (ACLs); intrusion detection systems use signature matching algorithms to identify known attack patterns; and antivirus software relies on regularly updating virus signature libraries to detect malware. Although the above methods can resist conventional security threats to a certain extent, they are often powerless against unknown or mutated attacks. In particular, when encountering new types of attacks, traditional methods usually require manual intervention to adjust configurations or update policies, which not only increases response time, but is also prone to misjudgment or omissions due to human factors.

[0004] In addition, in terms of incident response, the security team faces a huge amount of alert information every day, and must filter out the truly high-risk alerts and respond quickly. This process is highly dependent on the professional knowledge and personal experience of security analysts, but due to the increasingly complex network environment, manual processing methods are difficult to ensure response efficiency and accuracy, thus affecting the effectiveness of the entire incident response process.

[0005] To sum up, the key technical issue currently exists is: how to achieve fast and accurate security decisions in a complex network environment to deal with new and unknown network attacks, while reducing dependence on manpower and improving the speed and quality of incident response. Summary of the invention

[0006] The purpose of the present invention is to provide a network security intelligent decision-making method, which can not only significantly improve the response speed, but also ensure the accuracy and rationality of the decision, thereby effectively improving the overall effectiveness of network security protection to solve the problems raised in the above background technology.

[0007] To achieve the above object, the present invention provides a network security intelligent decision-making method, comprising: The analysis body receives and analyzes logs, traffic or alarm information in the network and outputs attack behavior characteristics; the AI ​​intelligent decision-making body evaluates the value of multiple possible protection strategies based on the output of the analysis body and selects the optimal strategy; the execution body executes corresponding response actions according to the strategy selected by the AI ​​intelligent decision-making body.

[0008] Preferably, the receiving and analyzing of logs, traffic or alarm information in the network by the analysis body and outputting attack behavior characteristics include: Use machine learning algorithms and correlation analysis techniques to understand and trace attacks and build attack chain models; Construct an attack prediction model and encode the historical attack data x through the variational autoencoder to obtain the distribution parameter of the latent variable z: mean and standard deviation , and indirectly sample z from it by sampling ε from the standard normal distribution N(0,1) using the reparameterization technique; The decoder maps the latent variable z back to the original data space and predicts the attribute y of the next attack. It optimizes the model parameters θ and φ by maximizing the evidence lower bound ELBO and combines the prediction error to form the final loss function L.

[0009] Preferably, the attack prediction model is: The distribution parameters of the encoder output latent variable z are as follows: ; The reparameterization process is as follows: ~N(0,1); The decoder reconstructs the input data and predicts the properties of the next attack as follows: ; In the formula, are the decoder parameters, and In a given is conditionally independent under the condition that are the parameters of the encoder, and It is calculated through a neural network.

[0010] Preferably, the AI ​​intelligent decision-making body uses a value-based decision-making model, including: Criteria Evaluation: A Value Function ), quantized action In the guidelines The value of Comprehensive value calculation: For each action , calculate the comprehensive value ), considering multiple criteria and their weights; Optimal action selection: Select the action with the highest comprehensive value as the optimal decision.

[0011] Preferably, the comprehensive value calculation model is specifically: ; Where m is the number of criteria, It is a criterion The weight of the criterion reflects the relative importance of the criterion in decision making, and the sum of all weights is equal to 1.

[0012] Preferably, the optimal action selection is specifically: , where A represents the set of alternative actions, represents the optimal action, argmax is used to find the comprehensive value function Maximum action ; Indicates action is an element in the alternative action set A.

[0013] Preferably, the method further comprises: Data preparation: Collect the actions taken and the results after the actions; Experience replay: store data in the experience replay buffer; Apply the policy gradient loss algorithm and the value network loss algorithm to update the model parameters.

[0014] Preferably, the policy gradient loss algorithm is: ; in, : Used to measure the performance of the policy network; : Expectation operator; : Indicates status From the strategy The state distribution under It is a strategy The state distribution of the decision; : Indicates an action From the parameter Strategy Network The sample obtained from It is a state is a function that takes as input a probability distribution of the output action; : Policy Network In Status Next select action The probability of : Policy Network In Status Next select action The logarithm of the probability of : Advantage function, used to measure the state Take action Advantages over the average.

[0015] Preferably, the value network loss algorithm is: ; : Value network loss algorithm, used to measure the performance of value networks; : Expectation operator, which means taking the expectation of a random variable; : Indicates that the state s, action a, immediate reward r and next state s' are sampled from the experience replay buffer D, which is a dataset that stores the interaction history between the agent and the environment and is used to train the value network; :Value Network The output in state s represents the estimate of the value of state s; : target value; : Discount factor, a number between 0 and 1.

[0016] On the other hand, the present invention provides a network security intelligent decision-making system, comprising: An analysis module is used to receive and analyze logs, traffic or alarm information in the network through an analysis body, and output attack behavior characteristics; A decision-making module, used to select an optimal strategy from a plurality of protection strategies based on the attack behavior characteristics through an AI intelligent decision-making body; The execution module is used to execute a response action corresponding to the optimal strategy according to the optimal strategy through an execution body.

[0017] Technical effects and advantages of the present invention: Compared with the prior art, the network security intelligent decision-making method proposed by the present invention has the following advantages: This method introduces automation and intelligent elements, aiming to comprehensively optimize the incident response process. By constructing an architectural hierarchy of "command + AI intelligent decision-making + execution", the present invention can automatically analyze logs, traffic or alarm information in the network, identify attack behavior characteristics, and evaluate the value of multiple possible protection strategies based on this information, and finally select the optimal strategy. The executor automatically executes the corresponding response actions according to the selected strategy without a lot of manual intervention. This method can not only significantly improve the response speed, but also ensure the accuracy and rationality of the decision, thereby effectively improving the overall effectiveness of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of the network security intelligent decision-making method of the present invention; Figure 2 This is a hierarchical architecture diagram of the AI ​​security intelligent decision-making body of the present invention; Figure 3 This is a schematic diagram of the AI ​​security intelligent decision-making body of the present invention; Figure 4 It is a block diagram of the network security intelligent decision-making system of the present invention. DETAILED DESCRIPTION

[0019] The following will be combined with the accompanying drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. The specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0020] The present invention provides Figure 1 A network security intelligent decision-making method is shown, comprising: Step 1: Receive and analyze logs, traffic or alarm information in the network through the analysis body, identify and output attack behavior characteristics; Analysis body: This function builds an efficient and intelligent attack understanding and prediction analysis system. Its core is to comprehensively grasp the nature, stage and severity of the attack through in-depth analysis of the logs, traffic or alarms to be processed, and to trace the source of the attack and predict future attack trends based on multi-dimensional knowledge base and multi-dimensional data resources, thereby providing decision makers with comprehensive information support at the strategic level.

[0021] Attack understanding and tracing: Combining the original system logs with the full traffic data, using machine learning algorithms and correlation analysis techniques, we can deeply explore the characteristics of attack behaviors, such as attack paths, intrusion methods, and affected resources, to achieve a deep understanding of attack behaviors. Attack tracing: Based on the timestamp, IP address, session ID and other information in the logs, we use backtracking technology to identify and locate the attack source and infected machines, build an attack chain model, and reveal the propagation path and impact range of the attack.

[0022] Attack prediction: Extract key features from historical attack data, such as attack frequency, attack type distribution, target preference, etc., and construct feature vectors. Apply the neural variational inference algorithm to establish an attack event prediction model to predict the type, time, and severity of the next attack.

[0023] In some embodiments, the receiving and analyzing of logs, traffic or alarm information in the network by the analysis body and outputting attack behavior characteristics include: Use machine learning algorithms and correlation analysis techniques to understand and trace attacks and build attack chain models; Construct an attack prediction model and encode the historical attack data x through the variational autoencoder to obtain the distribution parameter of the latent variable z: mean and standard deviation , and indirectly sample z from it by sampling ε from the standard normal distribution N(0,1) using the reparameterization technique; The decoder maps the latent variable z back to the original data space and predicts the attribute y of the next attack. It optimizes the model parameters θ and φ by maximizing the evidence lower bound ELBO and combines the prediction error to form the final loss function L.

[0024] Furthermore, x represents the observed historical attack data, including attack frequency, attack type distribution, target preference and other characteristics. z represents the latent variable, which represents the potential structure of the data. y represents the attributes of the next attack, including attack type, time and severity.

[0025] The attack prediction model is: The distribution parameters of the encoder output latent variable z are as follows: ; The reparameterization process is as follows: ~N(0,1); by sampling from a standard normal distribution Indirectly from Medium Sampling , while keeping the gradient computable.

[0026] The decoder reconstructs the input data and predicts the properties of the next attack as follows: ; In the formula, are the decoder parameters, and In a given is conditionally independent under the condition that are the parameters of the encoder, and It is calculated through a neural network.

[0027] Optimize model parameters by maximizing the evidence lower bound and : ) in: is the expectation of the reconstruction error and prediction error, indicating that given the latent variable Next, data and prediction The expected log-likelihood of . ) is the KL divergence, which measures the distribution of the encoder output and the prior distribution The difference between is a standard normal distribution.

[0028] The final loss function combines ELBO and prediction error as follows: , is a hyperparameter that adjusts the prediction error weight. is the prediction error, It is the predicted value output by the decoder, that is, the prediction result of the type, time and severity of the next attack.

[0029] Step 2: The AI ​​intelligent decision-making body evaluates the value of multiple possible protection strategies based on the output of the analysis body and selects the optimal strategy; the decision-making of the security intelligent body covers three core operations in the network security incident response: the first is the analysis body, which determines the attack status (ongoing or completed), conducts attack analysis and tracing; the second is the AI ​​decision-making body, which generates protection strategies and selects the optimal strategy based on the results of attack analysis and understanding, comprehensively considers factors such as the current network environment, decision-making goals, and defense costs; the third is the execution body, which determines the final response action based on the strategy generated by the decision, such as attack mitigation, communication disconnection, attack tracing, vulnerability patching, and Trojan removal, etc. Figure 2 , Figure 3 shown.

[0030] The AI ​​intelligent decision-making body uses a value-based decision-making model, including: Criteria Evaluation: A Value Function ), quantized action In the guidelines The value of Comprehensive value calculation: For each action , calculate the comprehensive value ), considering multiple criteria and their weights; Optimal action selection: Select the action with the highest comprehensive value as the optimal decision.

[0031] The comprehensive value calculation model is specifically as follows: ; Where m is the number of criteria, It is a criterion The weight of the criterion reflects the relative importance of the criterion in decision making, and the sum of all weights is equal to 1.

[0032] The optimal action selection is specifically: , where A represents the set of alternative actions, represents the optimal action, argmax is used to find the comprehensive value function Maximum action ; Indicates action is an element in the alternative action set A.

[0033] Specifically, the AI ​​intelligent decision-making body is a value-based AI intelligent decision-making model that selects the optimal decision by evaluating the value of different strategies. The value function of this method model will comprehensively consider multiple criteria, such as safety, economic cost, human cost, etc., to quantify the comprehensive value of each action. The details are as follows: Alternative solution set: , is the set of all possible alternative strategies.

[0034] Criteria set: , is a set of criteria for evaluating actions, where Represents safety, Represents economic cost, represents human cost, and so on.

[0035] Weight set: is the weight set of the criteria, where Representation Guidelines the relative importance of .

[0036] The decision-making evaluation process of the decision-making body is as follows: Criteria Evaluation: For each action and guidelines , define a value function ), to quantify the action In the guidelines The following values ​​are as follows: ; In this model: : Learning rate, a parameter between 0 and 1 that controls how quickly new information covers old information. Smaller A value of means a slower learning process, while a larger Values ​​may lead to instability in the learning process.

[0037] : In the guidelines Next action The immediate reward obtained after the action. This reward can be positive, negative, or zero, indicating a beneficial, harmful, or no effect, respectively.

[0038] : Discount factor, a parameter between 0 and 1, used to determine the current value of future rewards. Values ​​closer to 1 indicate more emphasis on immediate rewards. Value places more emphasis on long-term returns.

[0039] : The best action to take in the next state Here is the maximum value. Indicates that an action is being performed The new guideline context to which it is transferred.

[0040] : Take action in the next state value.

[0041] Step 3: The execution body performs corresponding response actions according to the strategy selected by the AI ​​intelligent decision-making body.

[0042] Specifically, this method uses a large model to fine-tune its parameters to ensure that the model can accurately determine whether the selected action is optimal. This method uses a large pre-trained model and combines it with a deep reinforcement learning framework. The large model is used to process complex network state information, while the deep learning framework is used to optimize the action selection strategy.

[0043] Data preparation: the actions to be taken and the results after the actions (such as whether the attack is successfully defended).

[0044] Experience replay: Store the collected data in the experience replay buffer. Experience replay helps break the correlation between data and improve the stability of training.

[0045] Sample a batch of state-action pairs from the experience replay buffer .

[0046] Using the Policy Network Calculate the probability of choosing these actions in these states .

[0047] Calculate the advantage function , which measures the advantage of taking action a relative to the average level.

[0048] Calculate the loss as follows: ; in, : Used to measure the performance of the policy network. By minimizing this loss function, the policy network can learn a better action selection strategy.

[0049] : Expectation operator, which means taking the expectation of random variables. It is used to adjust the state and action according to the strategy The loss is then averaged over these samples.

[0050] : Indicates status From the strategy The state distribution under It is a strategy The state distribution of the decision, which reflects the policy The states that may be encountered when executing in the environment.

[0051] : Indicates an action From the parameter Strategy Network obtained by sampling in . It is a state is a function that takes as input y and outputs the probability distribution of actions.

[0052] : Policy Network In Status Next select action probability.

[0053] : Policy Network In Status Next select action In this algorithm, log probability is used to amplify the importance of actions that have a small probability but may bring high rewards.

[0054] : Advantage function, used to measure the state Take action Advantage relative to the average. Helps the policy network distinguish which actions are better than the average and which are worse than the average.

[0055] Update the parameters of the policy network using an optimization algorithm , to minimize the loss function.

[0056] ④ Application value network loss algorithm: Sample a batch of state transition tuples from the experience replay buffer .

[0057] Using the Value Network Calculate the value of state s and the next state The value of .

[0058] The loss is calculated based on the target value and the current value as follows:

[0059] in: : Value network loss algorithm, which is used to measure the performance of the value network. By minimizing the loss function, the value network can estimate the value of the state more accurately.

[0060] : Expectation operator, which means taking the expectation of a random variable. It is used to calculate the average loss of samples sampled from the experience replay buffer D.

[0061] : Indicates that the state s, action a, immediate reward r and next state s' are sampled from the experience replay buffer D. D is a dataset that stores the history of interactions between the agent and the environment and is used to train the value network.

[0062] :Value Network The output in state s represents the estimate of the value of state s.

[0063] : Target value, which is the immediate reward and the discounted next state value The sum of . Discount factor Used to balance the importance of immediate rewards and future rewards.

[0064] : Discount factor, a number between 0 and 1. It determines the weight of future rewards in current decisions. Larger The value makes the model pay more attention to long-term rewards and helps long-term planning of strategies; smaller The lower value makes the model focus more on short-term rewards.

[0065] Use optimization algorithms to update the parameters of the value network , to minimize the loss function.

[0066] It also includes large model evaluation and fine-tuning, including: data preparation: collecting actions taken and the results after the actions; experience replay: storing data in the experience replay buffer; applying the policy gradient loss algorithm and the value network loss algorithm to update the model parameters. In order to ensure the optimal model, the large model is continuously fine-tuned: During the fine-tuning process, some parameters of the pre-trained model are frozen to prevent them from being corrupted.

[0067] According to the needs of parameter adjustment, the structure of the pre-trained model is modified, such as adding or deleting layers, to adapt to new tasks.

[0068] Adjust hyperparameters such as learning rate, batch size, optimization algorithm, etc.

[0069] The model is trained using a dataset related to the current task and the model parameters are updated through the back-propagation algorithm.

[0070] During the training process, the performance of the model on the validation set is regularly evaluated, and the hyperparameters or model structure are adjusted based on the evaluation results.

[0071] By minimizing the policy gradient loss algorithm and the value network loss algorithm, the policy network and the value network can work together to optimize the decision-making ability of the AI ​​agent.

[0072] The selected strategy is sent to the relevant security protection equipment or system, and its execution effect is monitored in real time. At the same time, communication with the analysis body is maintained to adjust the strategy in time to deal with new attack changes.

[0073] On the other hand, the present invention proposes a network security intelligent decision-making system, such as Figure 4 As shown, including: An analysis module is used to receive and analyze logs, traffic or alarm information in the network through an analysis body, identify and output attack behavior characteristics; A decision-making module, used to select an optimal strategy from a plurality of protection strategies based on the attack behavior characteristics through an AI intelligent decision-making body; The execution module is used to execute a response action corresponding to the optimal strategy according to the optimal strategy through an execution body.

[0074] In addition, the above-mentioned analysis module, decision module, and execution module are also used to execute other steps of the above-mentioned network security intelligent decision-making method when executed, which will not be described one by one here.

[0075] In summary, the present invention introduces automation and intelligent elements, aiming to comprehensively optimize the incident response process. By constructing an architectural hierarchy of "command + AI intelligent decision-making + execution", the present invention can automatically analyze logs, traffic or alarm information in the network, identify attack behavior characteristics, and evaluate the value of multiple possible protection strategies based on this information, and finally select the optimal strategy. The executor automatically executes the corresponding response action according to the selected strategy without a lot of manual intervention. This method can not only significantly improve the response speed, but also ensure the accuracy and rationality of the decision, thereby effectively improving the overall effectiveness of network security protection.

[0076] Finally, it should be noted that the above is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, it is still possible for those skilled in the art to modify the technical solutions described in the aforementioned embodiments or to make equivalent substitutions for some of the technical features therein. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A network security intelligent decision-making method, characterized in that: include: Receive and analyze logs, traffic or alarm information in the network through the analysis body, identify and output attack behavior characteristics; The AI ​​intelligent decision-making body selects the best strategy from multiple protection strategies based on the characteristics of the attack behavior; The execution body executes a response action corresponding to the optimal strategy according to the optimal strategy.

2. A network security intelligent decision-making method according to claim 1, characterized in that: The analysis body receives and analyzes logs, traffic or alarm information in the network and outputs attack behavior characteristics, including: Use machine learning algorithms and correlation analysis techniques to understand and trace attacks and build attack chain models; Construct an attack prediction model and encode the historical attack data x through the variational autoencoder to obtain the distribution parameter of the latent variable z: mean and standard deviation , and indirectly sample z from it by sampling ε from the standard normal distribution N(0,1) using the reparameterization technique; The decoder maps the latent variable z back to the original data space and predicts the attribute y of the next attack. It optimizes the model parameters θ and φ by maximizing the evidence lower bound ELBO and combines the prediction error to form the final loss function L.

3. A network security intelligent decision-making method according to claim 2, characterized in that: The constructing of the attack prediction model comprises: The distribution parameters of the encoder output latent variable z are as follows: The reparameterization process is as follows: ~N(0,1) The decoder reconstructs the input data and predicts the properties of the next attack as follows: in, are the decoder parameters, and In a given is conditionally independent under the condition that are the parameters of the encoder, and It is calculated through a neural network.

4. A network security intelligent decision-making method according to claim 3, characterized in that: The AI ​​intelligent decision-making body uses a value-based decision-making model, including: Constructing the value function ), quantized action In the guidelines The value of For each action , calculate the corresponding comprehensive value ), considering multiple criteria and their weights; Select the action with the highest comprehensive value as the optimal decision.

5. A network security intelligent decision-making method according to claim 4, characterized in that: The comprehensive value calculation model includes: ； Where m is the number of criteria, It is a criterion The sum of all weights is equal to 1.

6. A network security intelligent decision-making method according to claim 5, characterized in that: The step of selecting the action with the highest comprehensive value as the optimal decision includes: Among them, A represents the set of alternative actions, represents the optimal action, argmax is used to find the comprehensive value function Maximum action ; Indicates action is an element in the alternative action set A.

7. A network security intelligent decision-making method according to claim 6, characterized in that: The method further comprises: Collect data on actions taken and the results of those actions; Storing the result data in an experience playback buffer; Apply the policy gradient loss algorithm and the value network loss algorithm to update the model parameters.

8. A network security intelligent decision-making method according to claim 7, characterized in that: The policy gradient loss algorithm is: in, : Used to measure the performance of the policy network; : Expectation operator; : Indicates status From the strategy The state distribution under It is a strategy The state distribution of the decision; : Indicates an action From the parameter Strategy Network The sample obtained from It is a state is a function that takes as input a probability distribution of an action; : Policy Network In Status Next select action probability; : Policy Network In Status Next select action The logarithm of the probability of : Advantage function, used to measure the state Take action Advantages over the average.

9. A network security intelligent decision-making method according to claim 8, characterized in that: The value network loss algorithm is: in, : Value network loss algorithm, used to measure the performance of value networks; : Expectation operator, which means taking the expectation of a random variable; : Indicates that the state s, action a, immediate reward r and next state s' are sampled from the experience replay buffer D, which is a dataset that stores the interaction history between the agent and the environment and is used to train the value network; :Value Network The output in state s represents the estimate of the value of state s; : target value; : Discount factor, a number between 0 and 1.

10. A network security intelligent decision-making system for implementing the method according to any one of claims 1 to 9, characterized in that: include: An analysis module is used to receive and analyze logs, traffic or alarm information in the network through an analysis body, identify and output attack behavior characteristics; A decision-making module, used to select an optimal strategy from a plurality of protection strategies based on the attack behavior characteristics through an AI intelligent decision-making body; The execution module is used to execute a response action corresponding to the optimal strategy according to the optimal strategy through an execution body.

Images