A cyber security intelligent decision body method and system

Abstract

The present application belongs to the technical field of network security, and specifically relates to a network security intelligent decision-making body method and system. The method receives and analyzes log, traffic or alarm information in the network through an analysis body, and outputs attack behavior characteristics. An AI intelligent decision-making body evaluates the value of multiple possible protection strategies based on the output of the analysis body, and selects the optimal strategy. An execution body executes the corresponding response action according to the strategy selected by the AI intelligent decision-making body. The method introduces automation and intelligent elements, aiming to comprehensively optimize the event response process. By constructing a "command + AI intelligent decision-making + execution" architecture level, the method can automatically analyze log, traffic or alarm information in the network, identify attack behavior characteristics, and evaluate the value of multiple possible protection strategies based on the information, and finally select the optimal strategy. This method not only can significantly improve the response speed, but also can ensure the accuracy and rationality of the decision, thereby effectively improving the overall efficiency of network security protection.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of network security, and particularly relates to a network security intelligent decision-making body method and system. BACKGROUND

[0002] With the rapid development of the Internet, network security problems have become increasingly serious. Traditionally, enterprises and organizations rely on firewalls, intrusion detection systems (IDS), antivirus software and other means to protect their network environment from external attacks and internal threats. However, in the face of evolving complex network attack patterns such as zero-day attacks, advanced persistent threats (APT), etc., these traditional protection measures gradually reveal their limitations.

[0003] The existing network security protection system mainly relies on the static defense mechanism of the pre-defined rule set. For example, the firewall blocks unauthorized network traffic by setting access control lists (ACL); the intrusion detection system uses signature matching algorithm to identify known attack patterns; and the antivirus software relies on regular updates of the virus feature library to detect malicious software. Although the above methods can resist routine security threats to some extent, they are often inadequate for unknown or variant forms of attacks. In particular, when encountering new attacks, traditional methods usually require manual intervention for configuration adjustment or policy update, which not only increases the response time, but also easily leads to misjudgment or false negatives due to human factors.

[0004] In addition, in terms of incident response, the security team faces a huge amount of alarm information every day, which must be screened out to truly high-risk level alarms and quickly respond. This process highly depends on the professional knowledge and personal experience of security analysts, but due to the increasing complexity of network environment, manual processing is difficult to guarantee the response efficiency and accuracy, thereby affecting the effectiveness of the entire incident response process.

[0005] In summary, the key technical problem existing at present is: how to achieve fast and accurate security decision-making in a complex network environment to cope with new and unknown network attacks, while reducing the dependence on manpower and improving the speed and quality of incident response. SUMMARY

[0006] The purpose of the present application is to provide a network security intelligent decision-making body method, which can not only significantly improve the response speed, but also ensure the accuracy and rationality of the decision-making, thereby effectively improving the overall effectiveness of network security protection to solve the problems raised in the background technology.

[0007] To achieve the above purpose, the present application provides a network security intelligent decision-making body method, comprising:

[0008] The analysis body receives and analyzes log, traffic or alarm information in the network, and outputs attack behavior characteristics; the AI intelligent decision body evaluates the value of multiple possible protection strategies based on the output of the analysis body, and selects the optimal strategy; the execution body executes the corresponding response action according to the strategy selected by the AI intelligent decision body.

[0009] Preferably, the analysis body receives and analyzes log, traffic or alarm information in the network, and outputs attack behavior characteristics, including:

[0010] Attack understanding and tracing are performed using machine learning algorithms and association analysis techniques, and an attack chain model is constructed;

[0011] An attack prediction model is constructed, and the historical attack data x is encoded by a variational autoencoder to obtain the distribution parameters of the hidden variable z: mean and standard deviation , and z is indirectly sampled from N(0, 1) by using the reparameterization trick to sample ε from the standard normal distribution N(0, 1);

[0012] The decoder maps the hidden variable z back to the original data space, while predicting the attributes y of the next attack, and adopts the maximum evidence lower bound ELBO optimization model parameters θ and φ, and combines the prediction error to form the final loss function L.

[0013] Preferably, the attack prediction model is:

[0014] The distribution parameters of the hidden variable z output by the encoder are as follows:

[0015] ;

[0016] The reparameterization process is as follows:

[0017] ~N(0, 1);

[0018] The decoder reconstructs the input data and predicts the attributes of the next attack as follows:

[0019] ;

[0020] In the formula, is the parameter of the decoder, and are conditionally independent under the condition that is the parameter of the encoder, and are calculated by a neural network.

[0021] Preferably, the AI intelligent decision body uses a value-based decision model, including: ​

[0022] Criteria evaluation: a value function ), quantifying actions Under criteria values;

[0023] Integrated value calculation: for each action , calculate the integrated value ), considering multiple criteria and their weights;

[0024] Optimal action selection: select the action with the highest integrated value as the optimal decision.

[0025] Preferably, the integrated value calculation model is specifically:

[0026] ;

[0027] where m is the number of criteria, is the weight of the criterion , which reflects the relative importance of the criterion in decision-making, and the sum of all weights is equal to 1.

[0028] Preferably, the optimal action selection is specifically:

[0029] , where A represents the set of alternative actions, represents the optimal action, and argmax is used to find the action that maximizes the integrated value function ; ; represents the action is an element in the set of alternative actions A.

[0030] Preferably, the method further comprises:

[0031] Data preparation: collect the actions taken and the results after the actions;

[0032] Experience replay: store data to the experience replay buffer;

[0033] Apply the policy gradient loss algorithm and the value network loss algorithm to update the model parameters.

[0034] Preferably, the policy gradient loss algorithm is:

[0035] ;

[0036] where, : used to measure the performance of the policy network; : expected operator; : represents the state is the state distribution from the policy under is a state distribution determined by a policy . : represents an action is sampled from a policy network with parameters . is a function that takes a state as input and outputs a probability distribution over actions. : the probability that the policy network chooses action in state . : the log probability that the policy network chooses action in state . : advantage function, which measures how much better it is to take action in state than the average.

[0037] Preferably, the value network loss algorithm is:

[0038] .

[0039] : value network loss algorithm, which measures the performance of the value network. : expected operator, which denotes taking the expectation over a random variable. : represents that state s, action a, immediate reward r and next state s' are sampled from an experience replay buffer D, D is a dataset storing the history of the interaction between the agent and the environment, used for training the value network. : the output of the value network in state s, which represents an estimate of the value of state s. : target value. : discount factor, a number between 0 and 1.

[0040] In another aspect, the present application provides a network security intelligent decision-making system, comprising:

[0041] an analysis module for receiving and analyzing log, traffic or alarm information in the network through the analysis body, and outputting attack behavior characteristics;

[0042] a decision-making module for selecting an optimal strategy from a plurality of protection strategies based on the attack behavior characteristics through the AI intelligent decision-making body;

[0043] an execution module for executing a response action corresponding to the optimal strategy according to the optimal strategy through the execution body.

[0044] The technical effects and advantages of the present application: the network security intelligent decision-making body method provided by the present application has the following advantages compared with the prior art:

[0045] The present method introduces automation and intelligent elements, aiming to comprehensively optimize the event response process. By constructing a "command + AI intelligent decision-making + execution" architecture level, the present application can automatically analyze the log, traffic or alarm information in the network, identify attack behavior characteristics, and evaluate the value of multiple possible protection strategies based on these information, and finally select the optimal strategy. The execution body automatically executes the corresponding response action according to the selected strategy, without the need for a large amount of manual intervention. This method not only can significantly improve the response speed, but also can ensure the accuracy and rationality of the decision-making, thereby effectively improving the overall efficiency of network security protection. BRIEF DESCRIPTION OF DRAWINGS

[0046] Figure 1 The flowchart of the network security intelligent decision-making body method of the present application;

[0047] Figure 2 The AI security intelligent decision-making body hierarchical architecture diagram of the present application;

[0048] Figure 3 The principle diagram of the AI security intelligent decision-making body of the present application;

[0049] Figure 4 The block diagram of the network security intelligent decision-making body system of the present application. DETAILED DESCRIPTION

[0050] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. The specific embodiments described herein are only used to explain the present application, and are not used to limit the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0051] The present application provides a network security intelligent decision-making body method as shown in Figure 1 , comprising:

[0052] Step 1: receiving and analyzing the log, traffic or alarm information in the network through the analysis body, identifying and outputting the attack behavior characteristics;

[0053] Analysis body: This function builds an efficient and intelligent attack understanding and prediction analysis system. The core is to comprehensively grasp the nature, stage and severity of the attack by deeply analyzing the logs, traffic or alarms to be processed, and rely on multi-dimensional knowledge base and multi-dimensional data resources to trace the source of the attack and predict future attack trends, so as to provide comprehensive information support for decision makers at the strategic level.

[0054] Attack understanding and tracing: Combine original system logs and full traffic data, use machine learning algorithms and association analysis techniques to deeply mine attack behavior characteristics such as attack path, intrusion method and affected resources to achieve deep understanding of attack behavior. Attack tracing: Based on the timestamp, IP address, session identifier and other information in the log, use backtracking technology to identify and locate the attack source and infected machines, build an attack chain model, and reveal the propagation path and impact range of the attack.

[0055] Attack prediction: Extract key features such as attack frequency, attack type distribution, target preference, etc. from historical attack data to construct a feature vector. Apply neural variational inference algorithm to establish an attack event prediction model to predict the type, time and severity of the next attack.

[0056] In some embodiments, the analysis body receives and analyzes log, traffic or alarm information in the network, and outputs attack behavior characteristics, including:

[0057] Use machine learning algorithms and association analysis techniques for attack understanding and tracing, and build an attack chain model;

[0058] Build an attack prediction model, encode the historical attack data x through a variational autoencoder to obtain the distribution parameters of the latent variable z: mean And standard deviation And use the reparameterization trick to sample ε from the standard normal distribution N(0, 1) to indirectly sample z from it;

[0059] The decoder maps the latent variable z back to the original data space while predicting the attributes y of the next attack. The maximum evidence lower bound ELBO optimization model parameters θ and φ are adopted, and the prediction error is combined to form the final loss function L.

[0060] Further, x represents the observed historical attack data, including attack frequency, attack type distribution, target preference and other features. z represents the latent variable, representing the potential structure of the data. y represents the attributes of the next attack, including attack type, time and severity.

[0061] The attack prediction model is:

[0062] The distribution parameters of the latent variable z output by the encoder are as follows:

[0063] ;

[0064] The reparameterization procedure is as follows:

[0065] N(0, 1); by sampling from the standard normal distribution to indirectly sample from while keeping the gradients computable.

[0066] The decoder reconstructs the input data and predicts the attributes of the next attack as follows:

[0067] ;

[0068] where is the parameter of the decoder, and are conditionally independent given is the parameter of the encoder, and are computed by neural networks. The model parameters

[0069] and are optimized by maximizing the evidence lower bound (ELBO):

[0070] )

[0071] where: is the expectation of the reconstruction error and the prediction error, representing the log-likelihood expectation of the data and the prediction given the latent variable is the KL divergence, measuring the difference between the distribution output by the encoder and the prior distribution is the standard normal distribution. The final loss function combines the ELBO and the prediction error as follows:

[0072]

[0073] , is a hyperparameter that regulates the weight of the prediction error. is the prediction error, is the predicted value output by the decoder, i.e., the predicted result of the type, time, and severity of the next attack.

[0074] ​​​​Step two: AI intelligent decision body based on the output of analysis body, evaluate the value of multiple possible protection strategies, select the optimal strategy; security intelligent agent decision in network security incident response covers three core operations: one is analysis body, that is, to judge the attack state (in progress or completed), attack analysis and tracing; two is AI decision body, according to the result of attack analysis understanding, comprehensive consideration of current network environment, decision target, defense cost and other factors, generate protection strategy and select the optimal strategy; three is the execution body, according to the strategy generated by decision, decide the final response action, such as attack mitigation, cut off communication, attack tracing, vulnerability repair and Trojan removal, etc., as shown in Figure 2 、 Figure 3

[0075] The AI intelligent decision body uses a value-based decision model, including:

[0076] Criterion evaluation: a value function ), quantifying the value of action under criterion ;

[0077] Comprehensive value calculation: for each action , calculate the comprehensive value ), considering multiple criteria and their weights;

[0078] Optimal action selection: select the action with the highest comprehensive value as the optimal decision.

[0079] The comprehensive value calculation model is specifically:

[0080] ;

[0081] Where m is the number of criteria, is the weight of criterion , which reflects the relative importance of the criterion in decision making, and the sum of all weights is equal to 1.

[0082] The optimal action selection is specifically:

[0083] , where A represents the set of alternative actions, represents the optimal action, and argmax is used to find the action that maximizes the comprehensive value function ; represents action is an element in the set of alternative actions A.

[0084] ​Specifically, the AI intelligent decision body is an AI intelligent decision model based on value, which selects the optimal decision by evaluating the value of different strategies. The value function of this method model will consider multiple criteria such as safety, economic cost, human cost, etc., and quantify the comprehensive value of each action. Specifically as follows:

[0085] Alternative set: Let be the set of all possible alternative strategies.

[0086] Criteria set: Let be the set of criteria for evaluating actions, where represents safety, represents economic cost, represents human cost, and so on.

[0087] Weight set: Let be the set of weights for criteria, where indicates the relative importance of criterion , and .

[0088] The decision evaluation process of the decision body is as follows:

[0089] Criteria evaluation: For each action and criterion , define a value function ) to quantify the value of action under criterion , specifically as follows:

[0090] ;

[0091] In this model:

[0092] : Learning rate, a parameter between 0 and 1, used to control the speed of new information covering old information. Smaller values mean slower learning process, while larger values may lead to instability in the learning process.

[0093] : Immediate reward obtained after performing action under criterion . This reward can be positive, negative, or zero, indicating beneficial, harmful, or no effect, respectively.

[0094] : Discount factor, a parameter between 0 and 1, used to determine the current value of future rewards. Values closer to 0 indicate more emphasis on immediate rewards, while values closer to 1 indicate more emphasis on future rewards. ​Values, on the other hand, are more concerned with long-term returns.

[0095] : The best action to take in the next state The maximum value of represents the new criterion context that is transferred to after performing the action .

[0096] : The value of taking action in the next state.

[0097] Step 3: The executor executes the response action according to the strategy selected by the AI intelligent decision-making body.

[0098] Specifically, in this method, a large model is used to fine-tune its parameters to ensure that the model can accurately determine whether the selected action is optimal. This method uses a large pre-trained model combined with a deep reinforcement learning framework. The large model is used to process complex network state information, while the deep learning framework is used to optimize the action selection strategy.

[0099] Data Preparation: Prepare the actions to be taken and the results after the actions (such as whether the attack was successfully defended).

[0100] Experience Replay: Store the collected data in an experience replay buffer. Experience replay helps break the correlation between data and improves the stability of training.

[0101] Sample a batch of "state-action" pairs from the experience replay buffer.

[0102] Use the policy network to calculate the probability of selecting these actions in these states .

[0103] Calculate the advantage function , which measures the advantage of taking action a relative to the average level.

[0104] Calculate the loss as follows:

[0105] ;

[0106] where, : is used to measure the performance of the policy network. By minimizing this loss function, the policy network can learn a better action selection strategy.

[0107] : The expected operator, which represents taking the expectation of a random variable, is used to sample the state and action according to the distribution of the policy and calculate the average loss on these samples.

[0108] : represents the state is the state distribution from the policy is a state distribution determined by the policy , which reflects the states the policy may encounter when executed in the environment.

[0109] : represents the action is sampled from the policy network with parameters . is a function that takes the state as input and outputs a probability distribution over actions.

[0110] : probability that the policy network chooses action in state .

[0111] : log probability that the policy network chooses action in state . In this algorithm, the log probability is used to amplify the importance of actions that have a small probability but can lead to high returns.

[0112] : advantage function that measures how much better it is to take action in state than the average. Helps the policy network distinguish which actions are better than average and which are worse.

[0113] Update the parameters of the policy network using an optimization algorithm to minimize the loss function.

[0114] ④ Apply the value network loss algorithm:

[0115] Sample a batch of state transition tuples from the experience replay buffer.

[0116] Compute the value of state s and the value of the next state using the value network .

[0117] Compute the loss based on the target value and the current value as follows:

[0118] ​​

[0119] where:

[0120] : Value network loss algorithm to measure the performance of the value network. By minimizing the loss function, the value network can estimate the value of a state more accurately.

[0121] : Expectation operator to represent taking the expectation of a random variable. Used to calculate the average loss for samples drawn from the experience replay buffer D.

[0122] : Represents that the state s, action a, immediate reward r, and next state s' are sampled from the experience replay buffer D. D is a dataset that stores the history of the agent interacting with the environment, used to train the value network.

[0123] : Value network Output at state s, representing the estimate of the value of state s.

[0124] : Target value, which is the sum of the immediate reward and the discounted value of the next state . The discount factor is used to balance the importance of immediate rewards and future rewards.

[0125] : Discount factor, a number between 0 and 1. It determines the weight of future rewards in the current decision. A larger value makes the model focus more on long-term rewards, which helps the strategy plan for the long term; a smaller value makes the model pay more attention to short-term rewards.

[0126] Update the parameters of the value network using optimization algorithms to minimize the loss function.

[0127] Also includes large model evaluation and fine-tuning, including: data preparation: collect the actions taken and the results after the actions; experience replay: store data to the experience replay buffer; apply the policy gradient loss algorithm and the value network loss algorithm to update the model parameters. To ensure the optimality of the model, continuously fine-tune the large model:

[0128] During the fine-tuning process, freeze some parameters of the pre-trained model to prevent them from being destroyed.

[0129] According to the need for parameter adjustment, modify the structure of the pre-trained model, such as adding or deleting layers, to adapt to new tasks.

[0130] Adjust hyperparameters such as learning rate, batch size, optimization algorithm, etc.

[0131] The model is trained using a dataset related to the current task, and the model parameters are updated through a backpropagation algorithm.

[0132] During the training process, the performance of the model on the validation set is regularly evaluated, and the hyperparameters or model structure are adjusted based on the evaluation results.

[0133] Through the minimization of policy gradient loss algorithm and value network loss algorithm, the policy network and value network can work together to optimize the decision-making ability of AI agents.

[0134] The selected strategy is issued to the relevant security protection equipment or system, and its execution effect is monitored in real time. At the same time, communication with the analysis body is maintained to adjust the strategy in a timely manner to respond to new attack changes.

[0135] On the other hand, the present application proposes a network security intelligent decision-making system, as shown in Figure 4 , comprising:

[0136] The analysis module is used to analyze the log, traffic or alarm information in the network received by the analysis body, identify and output the attack behavior characteristics.

[0137] The decision-making module is used to select the optimal strategy from multiple protection strategies based on the attack behavior characteristics by the AI intelligent decision-making body.

[0138] The execution module is used to execute the response action corresponding to the optimal strategy according to the optimal strategy by the execution body.

[0139] In addition, the analysis module, decision-making module and execution module described above are also used to perform other steps of the network security intelligent decision-making method described above when executed, which will not be described here.

[0140] In summary, the present application introduces automation and intelligent elements to comprehensively optimize the incident response process. By building a "command + AI intelligent decision-making + execution" architecture level, the present application can automatically analyze the log, traffic or alarm information in the network, identify attack behavior characteristics, and evaluate the value of multiple possible protection strategies based on these information, and finally select the optimal strategy. The execution body automatically executes the corresponding response action according to the selected strategy without the need for a large amount of manual intervention. This method not only significantly improves the response speed, but also ensures the accuracy and rationality of the decision-making, thereby effectively improving the overall efficiency of network security protection.

[0141] Finally, it should be noted that the above only describes the preferred embodiments of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art will appreciate that the technical solutions described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalent features, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for intelligent decision-making in network security, characterized in that, include: The analyzer receives and analyzes logs, traffic, and alerts from the network to identify and output attack behavior characteristics, specifically including: Machine learning algorithms and correlation analysis techniques are used to understand and trace attacks, and attack chain models are constructed. An attack prediction model is constructed, and the distribution parameters of the latent variable z are obtained by encoding historical attack data x using a variational autoencoder: mean. and standard deviation And by using the reparameterization technique, ε is sampled from the standard normal distribution N(0,1) to indirectly sample z from it; The decoder maps the latent variable z back to the original data space and predicts the attribute y of the next attack. It optimizes the model parameters θ and φ by maximizing the lower bound of evidence using ELBO and combines the prediction error to form the final loss function L. The construction of the attack prediction model includes: The distribution parameters of the latent variable z output by the encoder are as follows: The reparameterization process is as follows: ~N(0,1) The decoder reconstructs the input data and predicts the attributes of the next attack as follows: in, These are the decoder parameters. and In the given Under the condition that they are independent, These are encoder parameters. and It was obtained through neural network calculations; Based on the characteristics of the attack behavior, the AI-powered intelligent decision-making system selects the optimal strategy from multiple protection strategies. The executor executes the response action corresponding to the optimal strategy according to the optimal strategy; The AI-powered intelligent decision-making body uses a value-based decision-making model, including: Constructing a value function ), quantification of actions In the guidelines The value below; For each action Calculate the corresponding comprehensive value (This involves considering multiple criteria and their weights.) Choose the action with the highest overall value as the optimal decision; The comprehensive value calculation model includes: ； Where m is the number of criteria. It is a standard The weights are such that the sum of all weights equals 1; The selection of the action with the highest overall value as the optimal decision includes: Where A represents the set of alternative actions, This represents the optimal action, and argmax is used to find the action that maximizes the overall value function. Actions that reach the maximum value ; Indicates action It is an element in the set of alternative actions A; The method further includes: collecting data on actions taken and the results of those actions; storing the results data in an experience replay buffer; and updating model parameters by applying a policy gradient loss algorithm and a value network loss algorithm. The policy gradient loss algorithm is as follows: in, Used to measure the performance of policy networks; : Expectation operator; : Indicates state From strategy State distribution under It is a strategy The determined state distribution; : Indicates an action From the parameter is Policy network Obtained from sampling, It is a state Given an input, output a function that distributes the probability of actions. Policy Network In state Select action The probability of; Policy Network In state Select action The logarithm of the probability; Advantage function: used to measure the advantage in a state Take action below Advantages relative to the average level; The value network loss algorithm is as follows: in, Value network loss algorithm, used to measure the performance of value networks; The expectation operator indicates that the expectation of a random variable is taken. : This indicates that the state s, action a, immediate reward r, and next state s' are sampled from the experience replay buffer D, which is a dataset that stores the history of the agent's interaction with the environment and is used to train the value network; Value Network The output in state s represents an estimate of the value of state s; Target value; Discount factor: A number between 0 and 1.

2. A network security intelligent decision-making system implementing the method as described in claim 1, characterized in that, include: The analysis module is used to receive and analyze logs, traffic, or alarm information in the network through the analysis body, and to identify and output attack behavior characteristics; The decision-making module is used to select the optimal strategy from multiple protection strategies based on the attack behavior characteristics through an AI intelligent decision-making body; The execution module is used to execute the response action corresponding to the optimal strategy through the execution body.

Images