Network security operation and maintenance and dynamic emergency management method and system for machine learning applications

Abstract

The present invention discloses a network security operation and maintenance and dynamic emergency management method and system for machine learning applications, which relates to the field of network security technology, including collecting traffic data and operation logs from networks and terminal devices, integrating external security threat intelligence, cleaning and standardizing the collected data, extracting key security features from preprocessed data; using the extracted key security features to identify compound threats composed of a combination of multiple attack methods or threat factors; using the extracted key security features and compound threats to build a machine learning model and train it; using the trained model to monitor network behavior in real time, to give immediate warnings for abnormal activities, and based on the warning information, to execute corresponding emergency measures to quickly respond to identified threats. The present invention enhances the integrity of data and the accuracy of analysis, lays a solid foundation for subsequent threat identification, and improves the system's ability to identify and respond to complex security threats such as APT.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security operation and maintenance and dynamic emergency management method and system for machine learning applications. Background Art

[0002] With the rapid development of information technology, the importance of network security has become increasingly prominent. In recent years, the methods of network attacks have become increasingly complex and varied, from simple virus infections to large-scale phishing, ransomware attacks, and advanced persistent threats (APT). Machine learning technology has been widely used in network security defense systems due to its excellent data processing and pattern recognition capabilities, especially in anomaly detection, threat intelligent identification, and behavior analysis. However, existing machine learning applications mostly rely on static models and predefined threat indicators. When faced with dynamically changing network threats, they are often difficult to adapt to new security threat scenarios in a timely manner due to insufficient flexibility in response.

[0003] The main drawbacks of current network security machine learning solutions are their inherent reactive security strategies and limited adaptability. Although known threats can be identified, the detection capabilities of zero-day attacks and unknown threats are still insufficient. In addition, existing systems also have obvious shortcomings in real-time data processing and compound threat identification. These systems often lack effective dynamic learning and adjustment mechanisms, and cannot quickly adapt to the constantly changing network environment and threat behaviors. This leads to frequent delays in response to complex attack scenarios, and the processing process lacks specificity and personalization, and cannot fully cover various potential security risks.

[0004] Designed to address these deficiencies in the prior art. By introducing a dynamic machine learning model and a real-time threat assessment mechanism, the present invention can not only promptly identify and respond to emerging network threats, but also intelligently adjust and optimize according to real-time data fluidity and the dynamic nature of threats. In addition, by introducing compound threat identification and multi-level emergency response strategies, the system's defense capabilities and emergency response speed for complex threat scenarios are enhanced. It not only improves the automation and intelligence level of network security defense, but also significantly improves the timeliness and effectiveness of defense measures, providing a new dynamic emergency management strategy for network security operations and maintenance. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is: how to solve the problem that existing methods cannot achieve rapid adaptation to continuously changing network environments and threat behaviors.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a network security operation and maintenance and dynamic emergency management method using machine learning, comprising: collecting traffic data and operation logs from the network and terminal devices, integrating external security threat intelligence, cleaning and standardizing the collected data, and extracting key security features from the preprocessed data; using the extracted key security features to identify composite threats composed of a combination of multiple attack methods or threat factors; using the extracted key security features and composite threats to build a machine learning model and train it; using the trained model to monitor network behavior in real time, issue immediate warnings for abnormal activities, and based on the warning information, execute corresponding emergency measures to quickly respond to identified threats.

[0008] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of the machine learning application described in the present invention, wherein: the traffic data includes network traffic logs, application layer data, packet size and transmission frequency; the operation logs include system logs, application logs and security logs; the key security features include network traffic features, operation log features and threat intelligence features.

[0009] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of the machine learning application of the present invention, the compound threat includes identifying a specific threat type according to key security features, inputting the extracted key security features x into the model, using a multi-layer perceptron structure with multiple hidden layers, each layer including a nonlinear activation function, expressed as:

[0010]

[0011] Among them, z 1 is the output of the first hidden layer, ReLU is the activation function, W 1 is the weight of the first hidden layer, b 1 is the bias of the first hidden layer, z 2 is the output of the second hidden layer, W 2 is the weight of the second hidden layer, b 2 is the bias of the second hidden layer, z m is the output of the mth hidden layer, W m is the weight of the mth hidden layer, b m is the bias of the mth hidden layer; the output layer uses the Sigmoid activation function to output the probability p of the existence of the i-th threat i , expressed as:

[0012] p i =σ(W out z m +b out )

[0013] Among them, p iis the probability of the existence of the ith threat, σ is the activation function, W out is the weight of the output layer, b out is the bias of the output layer.

[0014] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of machine learning application of the present invention, the composite threat also includes dynamically adjusting the weight of each threat, and the composite threat probability calculated by combining different threats through a combination function is expressed as:

[0015] P = f(w 1 ·p 1 ,w 2 ·p 2 ,…,w n ·p n )

[0016] Where P is the composite threat probability, w 1 is the weight of the first threat, w 2 is the weight of the second threat, w n is the weight of the nth threat; the dynamic adjustment of the weight of each threat includes adjusting the weight by the F1 score of each threat, which is expressed as:

[0017]

[0018] Among them, w i is the weight of the ith threat, α is the adjustment parameter, n is the total number of threats, F1 i is the F1 score of the ith threat, F1 j is the F1 score of the jth threat; the combined function is expressed as:

[0019]

[0020] Among them, f(w 1 ·p 1 ,w 2 ·p 2 ,…,w n ·p n ) is the combination function and b is the bias.

[0021] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of machine learning application described in the present invention, the machine learning model includes taking the probability of each threat and the probability of compound threat as input, introducing an attention layer, using the attention weight to weight the probability of each threat, generating a weighted threat probability sum, combining the weighted threat probability sum and the compound threat probability, making a decision through a nonlinear transformation layer, using the sigmoid function to transform the decision layer output, and predicting the probability of a threat event.

[0022] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of machine learning application of the present invention, the attention layer is represented as:

[0023]

[0024] Among them, a i is the attention weight, LeakyReLU is the activation function, [;] is the connection operation, W a is the weight matrix of the attention layer, b a is the bias vector of the attention layer; the sum of threat probabilities is expressed as:

[0025]

[0026] in, is the weighted sum of threat probabilities; the decision-making of the nonlinear transformation layer is expressed as:

[0027]

[0028] Among them, Z is the output of the decision layer, tanh is the hyperbolic tangent activation function, and W d is the weight matrix of the decision layer, b d is the bias vector of the decision layer; the probability of predicting the threat event is expressed as:

[0029]

[0030] in, is the probability of a threat event; the training includes calculating the model output and the loss L total , calculate the gradient of the loss function with respect to each parameter, and update the model parameters using the selected optimization algorithm, expressed as:

[0031]

[0032] in, is the cross entropy loss function, y is the true value, L total is the total loss function including the regularization term, λ is the regularization strength, θ u is the model parameter, θ new is the updated parameter, θ old is the parameter before update, η is the learning rate, Adam is the result of applying the Adam optimizer to the gradient of the loss function, is the gradient of the loss function with respect to the parameter θ.

[0033] As a preferred solution of the network security operation and maintenance and dynamic emergency management method of the machine learning application described in the present invention, the early warning includes setting a low threshold value of threat events, a medium threshold value of threat events and a high threshold value of threat events. If the probability of a threat event is lower than the low threshold value of a threat event, it is set as a low-level alarm, recorded, notified for analysis and inspection, and the low-level alarm is reviewed regularly to analyze whether there is an escalation trend; if the probability of a threat event is greater than or equal to the low threshold value of a threat event and less than the medium threshold value of a threat event, it is set as a medium-low alarm, and an automatic script is started to perform a more detailed data analysis of suspicious activities, send an early warning, evaluate the situation and prepare to take further measures; if the probability of a threat event is greater than or equal to the medium threshold value of a threat event and less than the high threshold value of a threat event, it is set as a medium-high alarm, and an immediate review is conducted, temporary access restrictions are imposed on suspicious devices or accounts to prevent the spread of potential security incidents, and security is re-verified; if the probability of a threat event is greater than or equal to the high threshold value of a threat event, it is set as a high-level alarm, and the affected systems and networks are automatically isolated, automated defense measures are executed, crisis response is activated, and emergency intervention and problem solving are performed.

[0034] Another object of the present invention is to provide a system for network security operation and maintenance and dynamic emergency management methods for machine learning applications, which can solve the network security operation and maintenance and dynamic emergency management problems of machine learning applications by constructing a network security operation and maintenance and dynamic emergency management system.

[0035] To solve the above technical problems, the present invention provides the following technical solutions: a network security operation and maintenance and dynamic emergency management system using machine learning, comprising a data acquisition module, a compound threat identification module, a model building training module and an early warning response module; the data acquisition module is used to collect traffic data and operation logs from the network and terminal devices, and integrate external security threat intelligence, clean and standardize the collected data, and extract key security features from the pre-processed data; the compound threat identification module is used to use the extracted key security features to identify compound threats composed of a combination of multiple attack methods or threat factors; the model building training module is used to use the extracted key security features and compound threats to build a machine learning model and train it; the early warning response module is used to use the trained model to monitor network behavior in real time, issue immediate early warnings for abnormal activities, and based on the early warning information, execute corresponding emergency measures to quickly respond to identified threats.

[0036] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the network security operation and maintenance and dynamic emergency management method of the machine learning application as described above are implemented.

[0037] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the network security operation and maintenance and dynamic emergency management method of the machine learning application as described above.

[0038] The beneficial effects of the present invention are as follows: the network security operation and maintenance and dynamic emergency management method of machine learning applications provided by the present invention enhances the integrity of data and the accuracy of analysis by integrating internal and external security data, laying a solid foundation for subsequent threat identification, extracting key security features, and identifying complex threats, thereby improving the system's ability to identify and respond to complex security threats such as APT. The trained machine learning model monitors network behavior in real time, and quickly executes early warning and emergency measures when anomalies are detected, greatly improving response speed and processing efficiency. It not only enhances the active defense and foresight of network security, but also optimizes the security operation and maintenance process. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0040] Figure 1 A flowchart of a network security operation and maintenance and dynamic emergency management method for machine learning applications provided in the first embodiment of the present invention.

[0041] Figure 2 A structural diagram of a network security operation and maintenance and dynamic emergency management system for machine learning applications provided in the second embodiment of the present invention. DETAILED DESCRIPTION

[0042] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0043] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0044] Example 1, reference Figure 1, which is the first embodiment of the present invention, and provides a network security operation and maintenance and dynamic emergency management method for machine learning applications, including: collecting traffic data and operation logs from networks and terminal devices, and integrating external security threat intelligence, cleaning and standardizing the collected data, and extracting key security features from the pre-processed data; using the extracted key security features to identify compound threats composed of multiple attack methods or threat factors; using the extracted key security features and compound threats to build a machine learning model and train it; using the trained model to monitor network behavior in real time, issue immediate warnings for abnormal activities, and based on the warning information, execute corresponding emergency measures to quickly respond to identified threats.

[0045] S1. Collect traffic data and operation logs from the network and terminal devices, integrate external security threat intelligence, clean and standardize the collected data, and extract key security features from the pre-processed data.

[0046] Traffic data includes network traffic logs, application layer data, packet size, and transmission frequency.

[0047] Network traffic log: records the details of all packets entering and leaving the network, such as source address, destination address, port number, protocol type, timestamp, etc.

[0048] Application layer data: Traffic data involving specific applications, including HTTP requests, DNS queries, etc.

[0049] Operation logs include system logs, application logs, and security logs.

[0050] System log: records operating system events such as logins, system errors, configuration changes, etc.

[0051] Application log: records application operation details, such as user behavior, transaction records, error reports, etc.

[0052] Security logs: especially logs that record security events, such as alarms from firewalls and intrusion detection systems.

[0053] External security threat intelligence includes threat information from network security organizations or service providers, including known malicious IP addresses, domain names, URLs, etc., as well as the latest vulnerabilities, attack methods, malware features, etc.

[0054] Key security features include network traffic features, operation log features, and threat intelligence features.

[0055] Network traffic characteristics: total traffic volume, average packet size, traffic peak time, uneven traffic distribution, etc.

[0056] Traffic anomalies of special protocols or ports: For example, a sudden increase in traffic on a specific port that is often used for malicious activities.

[0057] Operation log characteristics: number of failed logins, abnormal login time or location, privilege escalation behavior, etc.; frequency and sequence of system command usage, especially calls to sensitive commands.

[0058] Threat intelligence characteristics: frequency of communication with known malicious domain names or IP addresses; number of attack attempts against newly discovered vulnerabilities.

[0059] S2. Use the extracted key security features to identify compound threats composed of multiple attack methods or threat factors.

[0060] According to the key security features, the specific threat type is identified, and the extracted key security features x are input into the model. A multi-layer perceptron structure is used, with multiple hidden layers, each layer including a nonlinear activation function, which is expressed as:

[0061]

[0062] Among them, z 1 is the output of the first hidden layer, ReLU is the activation function, W 1 is the weight of the first hidden layer, b 1 is the bias of the first hidden layer, z 2 is the output of the second hidden layer, W 2 is the weight of the second hidden layer, b 2 is the bias of the second hidden layer, z m is the output of the mth hidden layer, W m is the weight of the mth hidden layer, b m is the bias of the mth hidden layer.

[0063] The output layer uses the Sigmoid activation function to output the probability p of the existence of the i-th threat i , expressed as:

[0064] p i =σ(W out z m +b out )

[0065] Among them, p i is the probability of the existence of the ith threat, σ is the activation function, W out is the weight of the output layer, b out is the bias of the output layer.

[0066] The weight of each threat is dynamically adjusted, and the composite threat probability calculated by combining different threats through the combination function is expressed as:

[0067] P = f(w1 ·p 1 ,w 2 ·p 2 ,…,w n ·p n )

[0068] Where P is the composite threat probability, w 1 is the weight of the first threat, w 2 is the weight of the second threat, w n is the weight of the nth threat.

[0069] The weight is adjusted by the F1 score of each threat, expressed as:

[0070]

[0071] Among them, w i is the weight of the ith threat, α is a tuning parameter used to control the influence of the performance score in the dynamic weight calculation, n is the total number of threats, and F1 i is the F1 score of the ith threat, F1 j is the F1 score of the jth threat; is the sum of the performance indices of all threats, used to normalize the weights, exp(α·F1 i ) is the result of converting the performance index into exponential form.

[0072] The combined function is expressed as:

[0073]

[0074] Among them, f(w 1 ·p 1 ,w 2 ·p 2 ,…,w n ·p n ) is a combination function used to calculate the final composite threat probability, and b is a bias used to adjust the threshold in the combined probability calculation, which can be adjusted based on the data set during the model tuning process.

[0075] S3. Use the extracted key security features and compound threats to build and train machine learning models.

[0076] The probability of each threat and the probability of the compound threat are used as input, and an attention layer is introduced. The probability of each threat is weighted using the attention weight to generate a weighted sum of threat probabilities. The weighted sum of threat probabilities and the compound threat probability are combined, and a decision is made through a nonlinear transformation layer. The sigmoid function is used to transform the decision layer output to predict the probability of a threat event.

[0077] The attention layer is represented as:

[0078]

[0079] Among them, a i is the attention weight, which indicates the importance of the ith threat under the current network security situation, LeakyReLU is the activation function, [;] is the connection operation used to merge information in a vector or matrix, and W a is the weight matrix of the attention layer, b a is the bias vector of the attention layer.

[0080] The sum of threat probabilities is expressed as:

[0081]

[0082] in, is the weighted sum of threat probabilities.

[0083] The decision making of the nonlinear transformation layer is expressed as:

[0084]

[0085] Among them, Z is the output of the decision layer, tanh is the hyperbolic tangent activation function, and W d is the weight matrix of the decision layer, b d is the bias vector of the decision layer.

[0086] The probability of predicting a threat event is expressed as:

[0087]

[0088] in, is the probability of a threat event.

[0089] Calculate model output and loss L total , calculate the gradient of the loss function with respect to each parameter, and update the model parameters using the selected optimization algorithm, expressed as:

[0090]

[0091] in, is the cross entropy loss function, which represents the difference between the model output and the true label, y is the true value, L total is the total loss function including the regularization term, λ is the regularization strength, θ u is the model parameter, θ new is the updated parameter, θ old is the parameter before update, η is the learning rate, Adam is the result of applying the Adam optimizer to the gradient of the loss function, is the gradient of the loss function with respect to the parameter θ.

[0092] S4. Use the trained model to monitor network behavior in real time, issue immediate warnings for abnormal activities, and execute corresponding emergency measures to quickly respond to identified threats based on the warning information.

[0093] Set the low threshold, medium threshold and high threshold of threat events. If the probability of a threat event is lower than the low threshold, set it as a low-level alarm, record it, notify for analysis and inspection, and regularly review the low-level alarm to analyze whether there is an escalation trend; if the probability of a threat event is greater than or equal to the low threshold and less than the medium threshold, set it as a medium-low alarm, start the automatic script to conduct more detailed data analysis of suspicious activities, send an early warning, evaluate the situation and prepare to take further measures; if the probability of a threat event is greater than or equal to the medium threshold and less than the high threshold, set it as a medium-high alarm, conduct an immediate review, implement temporary access restrictions on suspicious devices or accounts to prevent the spread of potential security events, and re-verify security; if the probability of a threat event is greater than or equal to the high threshold, set it as a high-level alarm, automatically isolate the affected systems and networks to prevent any potential attack spread, and execute automated defense measures, such as closing the threatened ports and executing security patches and updates. Activate crisis response for emergency intervention and problem solving.

[0094] Example 2, reference Figure 2 , which is the second embodiment of the present invention, is different from the previous embodiment in that it provides a network security operation and maintenance and dynamic emergency management system using machine learning applications, including: a data acquisition module, a complex threat identification module, a model building training module and an early warning response module.

[0095] The data collection module is used to collect traffic data and operation logs from the network and terminal devices, integrate external security threat intelligence, clean and standardize the collected data, and extract key security features from the pre-processed data.

[0096] The compound threat identification module is used to identify compound threats composed of multiple attack methods or threat factors by using the extracted key security features.

[0097] The model building and training module is used to build and train machine learning models using the extracted key security features and compound threats.

[0098] The early warning response module is used to use the trained model to monitor network behavior in real time, issue immediate early warnings for abnormal activities, and execute corresponding emergency measures to quickly respond to identified threats based on the early warning information.

[0099] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0100] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0101] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0102] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0103] Embodiment 3 is the third embodiment of the present invention. It is different from the first two embodiments in that it is used to verify the technical effects adopted in the present invention so as to verify the real effects of the method.

[0104] Build a simulated enterprise network, including multiple servers, terminal devices, switches and routers. Threat types include traditional virus attacks, phishing, ransomware attacks and complex APT attacks. Use network traffic monitoring tools and logging systems to collect data.

[0105] The traditional method is to use a network security defense system based on static rules and predefined threat indicators. The method of the present invention and the traditional method are used to perform simulation experiments simultaneously.

[0106] This embodiment uses the traditional method and the method of the present invention to perform detection simultaneously, and the detection comparison results are shown in the following Table 1:

[0107] Table 1 Comparison table between traditional method and method of the present invention

[0108]

[0109] The traditional method is a network security defense system based on static rules and predefined threat indicators. The system relies on manually updated rule bases and predefined threat features. Due to the lack of dynamic learning and adjustment mechanisms, the traditional method is slow to respond to the constantly changing network environment and threat behaviors, resulting in lagging and insufficient security defense.

[0110] It can be seen from the above comparison table and simulation conditions that the present invention is significantly superior to traditional methods in many aspects, especially in key indicators such as threat detection rate, average response time and automated emergency response coverage. These improvements show that the present invention has significant advantages in improving the intelligence and effectiveness of network security defense.

[0111] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security operation and maintenance and dynamic emergency management method for machine learning applications, characterized by: include, Collect traffic data and operation logs from networks and terminal devices, integrate external security threat intelligence, clean and standardize the collected data, and extract key security features from pre-processed data; Using the extracted key security features, identify compound threats composed of multiple attack methods or threat factors; Build and train machine learning models using extracted key security features and compound threats; Utilize the trained model to monitor network behavior in real time, issue immediate warnings for abnormal activities, and execute corresponding emergency measures based on the warning information to quickly respond to identified threats.

2. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 1, characterized in that: The traffic data includes network traffic logs, application layer data, packet size and transmission frequency; The operation logs include system logs, application logs and security logs; The key security features include network traffic features, operation log features and threat intelligence features.

3. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 2, characterized in that: The composite threat includes identifying a specific threat type based on key security features, inputting the extracted key security features x into the model, using a multi-layer perceptron structure with multiple hidden layers, each layer including a nonlinear activation function, expressed as, z1=ReLU(W1x+b1) z2=RELU(W2z1+b2) : With m =ReLU(W m With m-1 +b m ) Where z1 is the output of the first hidden layer, ReLU is the activation function, W1 is the weight of the first hidden layer, b1 is the bias of the first hidden layer, z2 is the output of the second hidden layer, W2 is the weight of the second hidden layer, b2 is the bias of the second hidden layer, z m is the output of the mth hidden layer, W m is the weight of the mth hidden layer, b m is the bias of the mth hidden layer; The output layer uses the Sigmoid activation function to output the probability p of the existence of the i-th threat i , expressed as, p i =σ(W out With m +b out ) Among them, p i is the probability of the existence of the ith threat, σ is the activation function, W out is the weight of the output layer, b out is the bias of the output layer.

4. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 3, characterized in that: The composite threat also includes dynamically adjusting the weight of each threat, and calculating the composite threat probability by combining different threats through a combination function, which is expressed as: P=f(w1·p1,w2·p2,…,w n ·p n ) Among them, P is the composite threat probability, w1 is the weight of the first threat, w2 is the weight of the second threat, and w n is the weight of the nth threat; The dynamically adjusting the weight of each threat includes adjusting the weight by the F1 score of each threat, expressed as, Among them, w i is the weight of the ith threat, α is the adjustment parameter, n is the total number of threats, F1 i is the F1 score of the ith threat, F1 j is the F1 score of the jth threat; The combined function is expressed as, Among them, f(w1·p1,w2·p2,…,w n ·p n ) is the combination function and b is the bias.

5. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 4, characterized in that: The machine learning model includes taking the probability of each threat and the probability of a compound threat as input, introducing an attention layer, using the attention weight to weight the probability of each threat, generating a weighted sum of threat probabilities, combining the weighted sum of threat probabilities and the compound threat probability, making decisions through a nonlinear transformation layer, using a sigmoid function to transform the decision layer output, and predicting the probability of a threat event.

6. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 5, characterized in that: The attention layer is expressed as, Among them, a i is the attention weight, LeakyReLU is the activation function, [;] is the connection operation, W a is the weight matrix of the attention layer, b a is the bias vector of the attention layer; The sum of the threat probabilities is expressed as, in, is the weighted sum of threat probabilities; The decision making of the nonlinear transformation layer is expressed as, Among them, Z is the output of the decision layer, tanh is the hyperbolic tangent activation function, and W d is the weight matrix of the decision layer, b d is the bias vector of the decision layer; The probability of the predicted threat event is expressed as, in, is the probability of a threat event; The training process includes calculating the model output and the loss L total , calculate the gradient of the loss function with respect to each parameter, and update the model parameters using the selected optimization algorithm, expressed as, in, is the cross entropy loss function, y is the true value, L total is the total loss function including the regularization term, λ is the regularization strength, θ u is the model parameter, θ new is the updated parameter, θ old is the parameter before update, η is the learning rate, Adam is the result of applying the Adam optimizer to the gradient of the loss function, is the gradient of the loss function with respect to the parameter θ.

7. The network security operation and maintenance and dynamic emergency management method for machine learning applications according to claim 6, characterized in that: The early warning includes setting a low threshold, a medium threshold and a high threshold of a threat event. If the probability of a threat event is lower than the low threshold, a low-level alarm is set, a record is made, and an analysis and inspection is notified. The low-level alarm is reviewed regularly to analyze whether there is an escalation trend. If the probability of a threat event is greater than or equal to the low threshold of a threat event and less than the medium threshold of a threat event, a low-medium alert is set, and an automatic script is started to perform a more detailed data analysis of the suspicious activity, send an early warning, evaluate the situation, and prepare to take further measures; If the probability of a threat event is greater than or equal to the medium threshold of a threat event and less than the high threshold of a threat event, it is set as a medium or high level alarm, and an immediate review is conducted to implement temporary access restrictions on suspicious devices or accounts to prevent the spread of potential security incidents, and re-verify security; If the probability of a threat event is greater than or equal to the high threshold of a threat event, an advanced warning is set to automatically isolate the affected systems and networks, execute automated defense measures, activate crisis response, and conduct emergency intervention and problem solving.

8. A system for network security operation and maintenance and dynamic emergency management method using machine learning application as claimed in any one of claims 1 to 7, characterized in that: Including data collection module, compound threat identification module, model building training module and early warning response module; The data acquisition module is used to collect traffic data and operation logs from the network and terminal devices, integrate external security threat intelligence, clean and standardize the collected data, and extract key security features from the pre-processed data; The composite threat identification module is used to identify composite threats composed of a combination of multiple attack methods or threat factors by using the extracted key security features; The model building training module is used to build and train a machine learning model using the extracted key security features and compound threats; The early warning response module is used to use the trained model to monitor network behavior in real time, issue immediate early warnings for abnormal activities, and execute corresponding emergency measures to quickly respond to identified threats based on the early warning information.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security operation and maintenance and dynamic emergency management method of the machine learning application described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security operation and maintenance and dynamic emergency management method of the machine learning application according to any one of claims 1 to 7 are implemented.

Images