Network security risk assessment method and device based on artificial intelligence, and medium

Abstract

The invention relates to the technical field of network security, in particular to a network security risk assessment method and device based on artificial intelligence and a medium, and the method comprises the following steps: S1, collecting network flow data, user behavior data and device state data, and generating a standardized data set; s2, extracting features related to network threats, and constructing a risk data set with labels; s3, dividing the risk data set with the label into a training set and a verification set, and training the risk assessment model by using a support vector machine algorithm; s4, outputting a risk score and a threat level, and identifying a high-risk event; and S5, performing backtracking analysis on the high-risk events identified in the step S4, and forming a risk assessment report. According to the invention, through multi-source data processing, intelligent feature extraction and support vector machine model training technologies, accurate identification and real-time evaluation of network threats and deep traceability analysis of high-risk events are realized, and the initiative of network security protection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an artificial intelligence-based network security risk assessment method, device and medium. Background Art

[0002] In the current network environment, network threats are increasing day by day, and the forms of network attacks are constantly evolving, such as distributed denial of service (DDoS) attacks, malware propagation, and phishing, which pose serious threats to user privacy data and system stability. With the popularization of Internet of Things (IoT) devices, the widespread application of cloud computing, and the formation of complex network architectures, the traffic types, user behavior patterns, and device status information in the network are highly diverse and complex. This complexity poses a challenge to traditional network security methods. Existing static rule detection or risk identification methods based on simple feature matching are often difficult to effectively respond to new and dynamic network threats. At the same time, traditional methods lack the ability to deeply mine historical security events and cannot accurately judge and warn potential high-risk events in the network through comprehensive analysis of multi-source data and model training.

[0003] However, the existing technologies have the following shortcomings when solving the above problems: first, the network data collection and processing process lacks systematicity, especially in the fusion and standardization of multi-source heterogeneous data, which makes it difficult to ensure data quality and consistency; second, the existing risk assessment models show insufficient recognition accuracy for complex network threat patterns and cannot provide effective analysis for real-time threats; finally, the existing technologies lack deep mining capabilities in the retrospective analysis of high-risk events, making it difficult to locate the specific causes of triggering risks and unable to form a complete and accurate risk assessment report. Summary of the invention

[0004] Based on the above objectives, the present invention provides a network security risk assessment method, device and medium based on artificial intelligence.

[0005] The cybersecurity risk assessment method based on artificial intelligence includes the following steps:

[0006] S1: Collect network traffic data, user behavior data, and device status data, and clean and unify all collected data to generate a standardized data set;

[0007] S2: Based on the standardized data set generated by S1, network threat-related features are extracted, and multi-dimensional features are annotated based on historical security event records to construct a labeled risk data set;

[0008] S3: Divide the labeled risk dataset into a training set and a validation set, and use the support vector machine algorithm to train the risk assessment model;

[0009] S4: Based on the risk assessment model trained in S3, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events;

[0010] S5: Conduct retrospective analysis on the high-risk events identified in S4, identify the relevant factors that trigger the risks, and form a risk assessment report.

[0011] Optionally, the S1 specifically includes:

[0012] S11: By configuring deep packet inspection and traffic sampling equipment, network traffic data is collected in real time, and the network traffic data includes IP address, port, protocol type, data packet size and transmission timestamp;

[0013] S12: embedding a behavior tracking module in the application server and terminal device to collect user behavior data, including user login, access request, operation type, and access time;

[0014] S13: Obtain device status information through the IoT device monitoring platform, including device ID, operating status, CPU usage, memory usage, device temperature, and network connection status;

[0015] S14: Clean all data collected from S11, S12, and S13, including removing duplicate records, correcting outliers, and filling in missing data to ensure data accuracy and consistency;

[0016] S15: Standardize the format of the cleaned data and convert the network traffic data, user behavior data and device status data using a unified data format, including the unification of timestamp format, character encoding consistency processing and field renaming, to generate a standardized data set.

[0017] Optionally, the S2 specifically includes:

[0018] S21: Based on the standardized data set generated by S1, feature extraction is performed on network traffic data, user behavior data and device status data respectively; for network traffic data, the features of connection duration, packet transmission rate and protocol usage frequency are extracted; for user behavior data, the features of user login frequency, access resource type and operation type are extracted; for device status data, the features of device operation load, status fluctuation amplitude and abnormal alarm frequency are extracted;

[0019] S22: perform numerical normalization on the features extracted by S21, and use a standard score normalization method to map the feature values ​​to a uniform numerical interval;

[0020] S23: Collect historical security event records for labeling the normalized features. Specifically, compare the normalized features with the features of known security events, use an association matching algorithm to classify the normalized features into risk categories, and annotate the historical event labels matched to the features in the corresponding features to form a labeled risk data set.

[0021] Optionally, the S3 specifically includes:

[0022] S31: Dataset division: divide the labeled risk dataset generated by S2 into a training set and a validation set, with 80% of the data used as the training set and the rest as the validation set;

[0023] S32: Feature input preparation, constructing the risk data set in the training set into the input format of the support vector machine algorithm, including feature vectors and labels; wherein the feature vector represents the feature information of the risk data, and the label represents the corresponding risk level;

[0024] S33: Model initialization, setting the initial parameters of the support vector machine algorithm, including the kernel function type, penalty coefficient and number of iterations;

[0025] S34: Model training, inputting the feature vectors and corresponding labels of the training set into the support vector machine algorithm for training. After the training is completed, a risk assessment model is obtained;

[0026] S35: Model verification: Use the data of the verification set to verify the trained risk assessment model, input the feature vector of the verification set, compare the risk level output by the risk assessment model with the actual label, calculate the classification accuracy and error rate of the risk assessment model; and adjust the risk assessment model parameters according to the verification results to improve the prediction ability.

[0027] Optionally, the S35 specifically includes:

[0028] S351: Input the validation set data divided in S31 into the trained risk assessment model, and predict the risk level of each validation data to generate a corresponding risk level output;

[0029] S352: Compare the risk level output by the risk assessment model with the actual risk level label of the validation set, predict the correct number of samples, and calculate the classification accuracy of the risk assessment model;

[0030] S353: Based on the calculation result of the classification accuracy, the number of samples with errors is predicted and the error rate of the risk assessment model is calculated;

[0031] S354: Construct a confusion matrix to analyze the classification effect of the risk assessment model at different risk levels;

[0032] S355: According to the analysis results of classification accuracy, error rate and confusion matrix, adjust the hyperparameters of the risk assessment model to improve the classification performance of the model.

[0033] Optionally, the S4 specifically includes:

[0034] S41: Use the risk assessment model trained in S3 to evaluate the real-time input network data, calculate based on the input network data, and output the corresponding risk score;

[0035] S42: Based on the output risk score, the risk score is divided into different threat levels according to a preset risk score threshold, including low risk, medium risk and high risk;

[0036] S45: For events determined to be high-risk, detailed information of the high-risk events is recorded, including triggering time, related IP addresses, user IDs, and device IDs; and the security administrator is notified to conduct an investigation and handle the situation.

[0037] Optionally, the S42 specifically includes:

[0038] S421: Preset a threshold range of risk scores to classify different threat levels; the thresholds include a first threshold T 1 and the second threshold T 2 , where T 1 is the scoring boundary between low risk and medium risk, T 2 The scoring boundaries for medium risk and high risk;

[0039] S422: For each risk score S input in real time, the threat level is divided according to the following rules:

[0040] Rule 1: If S <T 1 , then the risk score is judged as low risk;

[0041] Rule 2: If T 1 ≤S <T 2 , then the risk score is judged as medium risk;

[0042] Rule 3: If S ≥ T 2 , then the risk score is judged as high risk.

[0043] Optionally, the S5 specifically includes:

[0044] S51: for the high-risk event identified in S4, retrieve and collect historical data records related to the event, including network traffic logs, user operation logs, and device status logs;

[0045] S52: Use time series analysis technology to sort the log data collected in S51, build a timeline of events, and identify the preceding operations or abnormal behaviors that lead to high-risk events;

[0046] S53: performing correlation analysis on the log data collected in S51 to mine correlation patterns between high-risk events and user operations, system vulnerabilities, or malicious codes;

[0047] S54: Combine the analysis results of S52 and S53 to determine the relevant factors that trigger high-risk events, including specific user operations, system vulnerabilities or malicious code sources; and generate a risk assessment report, the report content includes detailed information of the high-risk events, high-risk event factors and security protection measures; the security protection measures include updating system patches and adjusting user permissions.

[0048] An artificial intelligence-based network security risk assessment device, used to implement the above-mentioned artificial intelligence-based network security risk assessment method, includes the following modules:

[0049] Data collection module: used to collect network traffic data, user behavior data and device status data in real time, and clean and standardize the collected data to generate a standardized data set;

[0050] Feature extraction and annotation module: connects to the data collection module, extracts network threat-related features based on standardized data sets, annotates multi-dimensional features in combination with historical security event records, and constructs a labeled risk data set;

[0051] Model training module: connects the feature extraction and annotation modules, divides the labeled risk data set into a training set and a validation set, trains the training set using the support vector machine algorithm, generates a risk assessment model, and verifies and optimizes the model using the validation set;

[0052] Real-time assessment module: connected to the model training module, based on the trained risk assessment model, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events;

[0053] Retrospective analysis module: connects to the real-time assessment module to perform retrospective analysis on identified high-risk events, identify relevant factors that trigger risks, including user operations, system vulnerabilities, and malicious code sources; and generate a risk assessment report.

[0054] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of the above-mentioned artificial intelligence-based network security risk assessment method.

[0055] Beneficial effects of the present invention:

[0056] The present invention, by introducing multi-source data collection and processing technology, can uniformly clean and standardize network traffic data, user behavior data and device status data to ensure the accuracy and consistency of the data. At the same time, combined with historical security event records, intelligent feature extraction and annotation methods are adopted to construct a labeled risk data set, so that the risk assessment process has stronger pertinence and comprehensiveness. Compared with the traditional static rule detection method, it can effectively cope with the diversity and dynamics of network threats and improve the accuracy of network security risk assessment.

[0057] The present invention uses the support vector machine algorithm to perform model training and optimization, which can accurately identify potential high-risk events in the network, and uses time series analysis and association rule mining technology to conduct in-depth retrospective analysis of high-risk events and locate specific risk triggering factors. The risk assessment report generated in combination with the analysis results can provide network administrators with clear risk sources and targeted protection suggestions. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0059] Figure 1 A schematic diagram of a network security risk assessment method according to an embodiment of the present invention;

[0060] Figure 2 Schematic diagram of a network security risk assessment device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0061] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. At the same time, it is explained here that in order to make the embodiments more detailed, the following embodiments are the best and preferred embodiments, and those skilled in the art may also adopt other alternatives to implement some known technologies; and the accompanying drawings are only for more specific description of the embodiments, and are not intended to specifically limit the present invention.

[0062] It should be noted that the references to "one embodiment", "an embodiment", "an exemplary embodiment", "some embodiments" and the like in the specification indicate that the embodiments described may include specific features, structures or characteristics, but not every embodiment may include the specific features, structures or characteristics. In addition, when a specific feature, structure or characteristic is described in conjunction with an embodiment, it should be within the knowledge of a person skilled in the art to implement such feature, structure or characteristic in conjunction with other embodiments (whether or not explicitly described).

[0063] In general, a term can be understood, at least in part, from its use in context. For example, depending, at least in part, on the context, the term "one or more" as used herein can be used to describe any feature, structure, or characteristic in the singular sense, or can be used to describe a combination of features, structures, or characteristics in the plural sense. Additionally, the term "based on" can be understood as not necessarily intended to convey an exclusive set of factors, but can instead, depending, at least in part, on the context, allow for the presence of other factors that are not necessarily explicitly described.

[0064] like Figure 1 As shown, the cybersecurity risk assessment method based on artificial intelligence includes the following steps:

[0065] S1: Collect network traffic data, user behavior data, and device status data, and clean and unify all collected data to generate a standardized data set;

[0066] S2: Based on the standardized data set generated by S1, network threat-related features are extracted, and multi-dimensional features are annotated based on historical security event records to construct a labeled risk data set;

[0067] S3: Divide the labeled risk dataset into a training set and a validation set, and use the support vector machine algorithm to train the risk assessment model;

[0068] S4: Based on the risk assessment model trained in S3, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events;

[0069] S5: Conduct retrospective analysis on the high-risk events identified in S4, identify the relevant factors that trigger the risks, and form a risk assessment report.

[0070] S1 specifically includes:

[0071] S11: By configuring deep packet inspection (DPI) and traffic sampling devices, network traffic data is collected in real time. The network traffic data includes characteristic data such as IP address, port, protocol type, packet size and transmission timestamp to capture the complete status of network communication;

[0072] S12: embed a behavior tracking module in the application server and terminal device to collect user behavior data, including user login, access request, operation type, access time, and record historical information of user operations through security logs to ensure the comprehensiveness and timeliness of behavior data;

[0073] S13: Obtain device status information through the IoT device monitoring platform, including device ID, operating status, CPU usage, memory usage, device temperature, and network connection status, and generate complete device status data to support subsequent comprehensive risk analysis;

[0074] S14: Clean all data collected in S11, S12 and S13, including removing duplicate records, correcting outliers and filling missing data to ensure data accuracy and consistency. This step uses anomaly detection algorithms to identify and process noise data to ensure the reliability of input data.

[0075] S15: Standardize the format of the cleaned data and convert the network traffic data, user behavior data and device status data in a unified data format, including the unification of timestamp format, character encoding consistency processing and field renaming, to generate a standardized data set to ensure the smooth progress of subsequent analysis; through the above sub-steps, the data acquisition process realizes the accurate collection and processing of multi-source data, so that the generated standardized data set can comprehensively and accurately reflect network traffic, user behavior and device status, and provide reliable data input for the construction of subsequent risk assessment models.

[0076] S2 specifically includes:

[0077] S21: Based on the standardized data set generated by S1, feature extraction is performed on network traffic data, user behavior data and device status data respectively; for network traffic data, the features of connection duration, packet transmission rate and protocol usage frequency are extracted; for user behavior data, the features of user login frequency, access resource type and operation type are extracted; for device status data, the features of device operation load, status fluctuation amplitude and abnormal alarm frequency are extracted;

[0078] S22: Perform numerical normalization on the features extracted by S21, using the standard score normalization method to map the feature values ​​to a unified numerical range to ensure that different features have a balanced influence on model training;

[0079] S23: Collect historical security event records for labeling the normalized features. Specifically, by comparing the normalized features with the features of known security events, use the association matching algorithm to classify the normalized features, and annotate the historical event labels matched to the features in the corresponding features to form a labeled risk data set. The similarity measurement formula for association matching is as follows:

[0080] Among them, Similarity(F,H) is the similarity score, f i is the normalized eigenvalue, h iis the corresponding historical event feature value, and n is the dimension of the feature vector; by calculating the similarity score, the feature vectors with similarity greater than the preset threshold are marked as corresponding historical event labels; thus, the matching labels are assigned to the corresponding features to form a labeled risk data set; the labeled labels include risk levels such as "low risk", "medium risk" and "high risk" to characterize the level of network security risks that may be caused by the data features.

[0081] S3 specifically includes:

[0082] S31: Dataset division: divide the labeled risk dataset generated by S2 into a training set and a validation set, with 80% of the data used as the training set and the rest as the validation set;

[0083] S32: Feature input preparation, constructing the risk data set in the training set into the input format of the support vector machine algorithm, including feature vectors and labels; wherein the feature vector represents the feature information of the risk data, and the label represents the corresponding risk level;

[0084] S33: Model initialization, setting the initial parameters of the support vector machine algorithm, including the kernel function type (such as linear kernel function or radial basis kernel function), penalty coefficient (a parameter used to balance classification accuracy and model complexity) and number of iterations to ensure that the model can adapt to the characteristics of labeled risk data;

[0085] S34: Model training, inputting the feature vectors and corresponding labels of the training set into the support vector machine algorithm for training, optimizing the hyperplane of the support vector machine algorithm by adjusting the model parameters, so that it can distinguish data of different risk levels to the greatest extent, and after the training is completed, a risk assessment model is obtained; specifically, inputting the feature vectors and corresponding labels of the training set into the support vector machine algorithm, and training is performed through the following optimization objective function:

[0086]

[0087] ξ i ≥0,i=1,2,…,m; where w is the normal vector of the classification hyperplane; b is the offset; ξ i is a slack variable used to process nonlinearly separable data; C is a penalty coefficient; m is the total number of training data; by optimizing the objective function, a classification hyperplane w·x+b=0 is trained to maximize the boundary between data categories;

[0088] S35: Model verification: Use the data from the verification set to verify the trained risk assessment model. Input the feature vector of the verification set, compare the risk level output by the risk assessment model with the actual label, and calculate the classification accuracy and error rate of the risk assessment model. Based on the verification results, adjust the risk assessment model parameters to improve the prediction ability and ensure that the final model can accurately distinguish different network risk levels.

[0089] S35 specifically includes:

[0090] S351: Input the validation set data divided in S31 into the trained risk assessment model, and predict the risk level of each validation data to generate a corresponding risk level output;

[0091] S352: Compare the risk level output by the risk assessment model with the actual risk level label of the validation set, predict the correct number of samples, and calculate the classification accuracy of the risk assessment model to evaluate the classification performance of the model;

[0092] S353: Based on the calculation result of the classification accuracy and the number of samples with prediction errors, the error rate of the risk assessment model is calculated, and the prediction error ratio of the assessment model is evaluated;

[0093] S354: Construct a confusion matrix to analyze the classification effect of the risk assessment model at different risk levels; the confusion matrix specifically includes the prediction performance of high risk and non-high risk. Through the confusion matrix, the prediction accuracy and detection rate of the model for high-risk events can be obtained, and the recognition effect of the model for each risk level can be deeply understood;

[0094] S355: According to the analysis results of classification accuracy, error rate and confusion matrix, adjust the hyperparameters of the risk assessment model to improve the classification performance of the model.

[0095] The specific steps of model validation are as follows:

[0096] Calculate the classification accuracy. By calculating the classification accuracy of the validation set data, the classification performance of the model is evaluated. The calculation formula for the classification accuracy is as follows: Among them, n 1 is the total number of samples in the validation set, is the risk level predicted by the model, y i is the actual risk label, δ is the indicator function, when It takes 1 when , otherwise it takes 0; This formula represents the accuracy of the model prediction, that is, the proportion of the risk level output by the model that matches the actual label;

[0097] Calculate the error rate. By calculating the error rate of the validation set data, further evaluate the model classification errors. The calculation formula of the error rate ErrorRate is: This formula represents the proportion of model prediction errors, that is, the proportion of risk levels output by the model that do not match the actual labels;

[0098] Confusion matrix analysis, construct a confusion matrix to further analyze the classification effect of the model at each risk level; the form of the confusion matrix is: Among them, TP represents the number of true positive examples, that is, the number of cases predicted as high risk and actually high risk; FN represents the number of false negative examples, that is, the number of cases actually high risk but predicted as non-high risk; FP represents the number of false positive examples, that is, the number of cases actually non-high risk but predicted as high risk; TN represents the number of true negative examples, that is, the number of cases predicted as non-high risk and actually non-high risk; Through the mixed matrix, the precision and recall of the model can be further calculated, and the formulas are:

[0099] Adjust model parameters. According to the classification accuracy, error rate and confusion matrix analysis results, adjust the hyperparameters of the risk assessment model, including the penalty coefficient C and kernel function parameter γ, to optimize the classification effect of the model.

[0100] The specific adjustment method of hyperparameters is as follows:

[0101] Adjustment of penalty coefficient C: The penalty coefficient C controls the model's tolerance for misclassified samples. A higher C value will reduce the training error, but may cause the model to overfit; a lower C value will increase the model's fault tolerance, but may cause underfitting; if the classification accuracy is low and the error rate is high, the C value needs to be increased to reduce the training error and improve the classification accuracy; if the confusion matrix shows that there are a large number of misclassifications between high-risk and non-high-risk, while other categories perform well, the C value needs to be appropriately reduced to make the model more flexible and reduce overfitting;

[0102] Adjustment of kernel function parameter γ, taking radial basis kernel function as an example: parameter γ controls the influence range of a single training sample on the decision boundary. A higher γ value will make the model pay more attention to neighboring samples, which may improve classification accuracy, but easily lead to overfitting; a lower γ value will make the model decision boundary smoother, which is suitable for processing noisy data; if both precision and recall are low and the model does not clearly distinguish risk levels, increase the γ value to enhance the model's sensitivity to local data features; if the confusion matrix shows that the model has a high misclassification rate for samples, especially in distinguishing between low risk and high risk, reduce the γ value to make the model more generalizable;

[0103] Verification result feedback and parameter optimization: By verifying the model performance on different combinations of C and γ, the best combination is selected to maximize the classification accuracy and balance the error rate, precision, and recall rate. If the model shows better classification results on the validation set after adjusting the hyperparameters, the optimization scheme can be continued to eventually obtain a model with higher accuracy, lower error rate, and better recognition ability for high-risk events.

[0104] S4 specifically includes:

[0105] S41: Use the risk assessment model trained in S3 to evaluate the real-time input network data, calculate based on the input network data, and output the corresponding risk score;

[0106] S42: Based on the output risk score, the risk score is divided into different threat levels according to a preset risk score threshold, including low risk, medium risk and high risk;

[0107] S45: For events determined to be high-risk, detailed information of the high-risk events is recorded, including triggering time, related IP addresses, user IDs, and device IDs; and the security administrator is notified to conduct an investigation and handle the situation.

[0108] S42 specifically includes:

[0109] S421: Preset a threshold range of risk scores to classify different threat levels; the thresholds include a first threshold T 1 and the second threshold T 2 , where T 1 is the scoring boundary between low risk and medium risk, T 2 The scoring boundaries for medium risk and high risk are set by analyzing historical security incident data. 1 and T 2 values ​​to ensure the accuracy of each level classification;

[0110] S422: For each risk score S input in real time, the threat level is divided according to the following rules:

[0111] Rule 1: If S <T 1 , then the risk score is judged as low risk;

[0112] Rule 2: If T 1 ≤S <T 2 , then the risk score is judged as medium risk;

[0113] Rule 3: If S ≥ T 2, then the risk score is judged as high risk; through the above steps, S42 can accurately divide the threat level based on the risk score, realize accurate identification of different risk levels, and ensure real-time and effective evaluation of network security incidents.

[0114] S5 specifically includes:

[0115] S51: for the high-risk event identified in S4, retrieve and collect historical data records related to the event, including network traffic logs, user operation logs, and device status logs;

[0116] S52: Use time series analysis technology to sort the log data collected in S51, build a timeline of events, and identify the preceding operations or abnormal behaviors that lead to high-risk events;

[0117] S53: performing correlation analysis on the log data collected in S51 to mine correlation patterns between high-risk events and user operations, system vulnerabilities, or malicious codes;

[0118] S54: Combine the analysis results of S52 and S53 to determine the relevant factors that trigger high-risk events, including specific user operations, system vulnerabilities or malicious code sources; and generate a risk assessment report, which includes detailed information of the high-risk events, high-risk event factors and security protection measures; security protection measures include updating system patches and adjusting user permissions.

[0119] like Figure 2 As shown, an artificial intelligence-based network security risk assessment device is used to implement the above-mentioned artificial intelligence-based network security risk assessment method, including the following modules:

[0120] Data collection module: used to collect network traffic data, user behavior data and device status data in real time, and clean and standardize the collected data to generate a standardized data set;

[0121] Feature extraction and annotation module: connects to the data collection module, extracts network threat-related features based on standardized data sets, annotates multi-dimensional features in combination with historical security event records, and constructs a labeled risk data set;

[0122] Model training module: connects the feature extraction and annotation modules, divides the labeled risk data set into a training set and a validation set, trains the training set using the support vector machine algorithm, generates a risk assessment model, and verifies and optimizes the model using the validation set;

[0123] Real-time assessment module: connected to the model training module, based on the trained risk assessment model, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events;

[0124] Retrospective analysis module: connects to the real-time assessment module to perform retrospective analysis on identified high-risk events, identify relevant factors that trigger risks, including user operations, system vulnerabilities, and malicious code sources; and generate a risk assessment report.

[0125] A computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-mentioned artificial intelligence-based network security risk assessment method.

[0126] The present invention covers any substitution, modification, equivalent method and scheme made on the essence and scope of the present invention. In order to make the public have a thorough understanding of the present invention, specific details are described in detail in the following preferred embodiments of the present invention, but those skilled in the art can fully understand the present invention without the description of these details. In addition, in order to avoid unnecessary confusion about the essence of the present invention, well-known methods, processes, procedures, components and circuits are not described in detail.

[0127] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A network security risk assessment method based on artificial intelligence, characterized in that: The following steps are involved: S1: Collect network traffic data, user behavior data, and device status data, and clean and unify all collected data to generate a standardized data set; S2: Based on the standardized data set generated by S1, network threat-related features are extracted, and multi-dimensional features are annotated based on historical security event records to construct a labeled risk data set; S3: Divide the labeled risk dataset into a training set and a validation set, and use the support vector machine algorithm to train the risk assessment model; S4: Based on the risk assessment model trained in S3, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events; S5: Conduct retrospective analysis on the high-risk events identified in S4, identify the relevant factors that trigger the risks, and form a risk assessment report.

2. The network security risk assessment method based on artificial intelligence according to claim 1 is characterized in that: The S1 specifically includes: S11: By configuring deep packet inspection and traffic sampling equipment, network traffic data is collected in real time, and the network traffic data includes IP address, port, protocol type, data packet size and transmission timestamp; S12: embedding a behavior tracking module in the application server and terminal device to collect user behavior data, including user login, access request, operation type, and access time; S13: Obtain device status information through the IoT device monitoring platform, including device ID, operating status, CPU usage, memory usage, device temperature, and network connection status; S14: Clean all data collected from S11, S12, and S13, including removing duplicate records, correcting outliers, and filling in missing data to ensure data accuracy and consistency; S15: Standardize the format of the cleaned data and convert the network traffic data, user behavior data and device status data using a unified data format, including the unification of timestamp format, character encoding consistency processing and field renaming, to generate a standardized data set.

3. The network security risk assessment method based on artificial intelligence according to claim 1 is characterized in that: The S2 specifically includes: S21: Based on the standardized data set generated by S1, feature extraction is performed on network traffic data, user behavior data and device status data respectively; for network traffic data, the features of connection duration, packet transmission rate and protocol usage frequency are extracted; for user behavior data, the features of user login frequency, access resource type and operation type are extracted; for device status data, the features of device operation load, status fluctuation amplitude and abnormal alarm frequency are extracted; S22: perform numerical normalization on the features extracted by S21, and use a standard score normalization method to map the feature values ​​to a uniform numerical interval; S23: Collect historical security event records for labeling the normalized features. Specifically, compare the normalized features with the features of known security events, use an association matching algorithm to classify the normalized features into risk categories, and annotate the historical event labels matched to the features in the corresponding features to form a labeled risk data set.

4. The network security risk assessment method based on artificial intelligence according to claim 1 is characterized in that: The S3 specifically includes: S31: Dataset division. Divide the labeled risk dataset generated in S2 into a training set and a validation set. 80% of the data is used as the training set, and the rest is used as the validation set. S32: Feature input preparation. Construct the risk dataset in the training set into the input format of the support vector machine algorithm, including feature vectors and labels. The feature vectors represent the feature information of the risk data, and the labels represent the corresponding risk levels. S33: Model initialization. Set the initial parameters of the support vector machine algorithm, including the kernel function type, penalty coefficient, and number of iterations. S34: Model training. Input the feature vectors and corresponding labels of the training set into the support vector machine algorithm for training. After training is completed, a risk assessment model is obtained. S35: Model validation. Use the data in the validation set to validate the trained risk assessment model. Input the feature vectors of the validation set, compare the risk levels output by the risk assessment model with the actual labels, and calculate the classification accuracy and error rate of the risk assessment model. According to the validation results, adjust the parameters of the risk assessment model to improve the prediction ability.

5. The network security risk assessment method based on artificial intelligence according to claim 4 is characterized in that: The specific steps of S35 include: S351: Input the data in the validation set divided in S31 into the trained risk assessment model, and predict the risk level for each piece of validation data to generate the corresponding risk level output. S352: Compare the risk levels output by the risk assessment model with the actual risk level labels in the validation set, predict the number of correctly predicted samples, and calculate the classification accuracy of the risk assessment model. S353: Based on the calculation result of the classification accuracy, predict the number of incorrectly predicted samples, and calculate the error rate of the risk assessment model. S354: Construct a confusion matrix to analyze the classification effect of the risk assessment model at different risk levels. S355: According to the analysis results of the classification accuracy, error rate, and confusion matrix, adjust the hyperparameters of the risk assessment model to improve the classification performance of the model.

6. The network security risk assessment method based on artificial intelligence according to claim 1 is characterized in that: The specific steps of S4 include: S41: Use the risk assessment model trained in S3 to evaluate the real-time input network data, calculate based on the input network data, and output the corresponding risk score. S42: According to the output risk score, divide the risk score into different threat levels according to the preset risk score threshold, including low risk, medium risk, and high risk. S45: For events determined to be high risk, record the detailed information of the high-risk events, including the trigger time, related IP addresses, user IDs, and device IDs. And notify the security administrator for investigation and handling.

7. The network security risk assessment method based on artificial intelligence according to claim 6 is characterized in that: The specific steps of S42 include: S421: Preset the threshold range of the risk score to divide different threat levels. The thresholds include the first threshold T1 and the second threshold T2, where T1 is the scoring boundary between low risk and medium risk, and T2 is the scoring boundary between medium risk and high risk. S422: For each real-time input risk score S, divide the threat level according to the following rules: Rule 1, if S < T1, then the risk score is determined to be low risk. Rule 2, if T1 ≤ S < T2, then the risk score is determined to be medium risk. Rule 3, if S ≥ T2, then the risk score is determined to be high risk.

8. The network security risk assessment method based on artificial intelligence according to claim 1 is characterized in that: The S5 specifically includes: S51: for the high-risk event identified in S4, retrieve and collect historical data records related to the event, including network traffic logs, user operation logs, and device status logs; S52: Use time series analysis technology to sort the log data collected in S51, build a timeline of events, and identify the preceding operations or abnormal behaviors that lead to high-risk events; S53: performing correlation analysis on the log data collected in S51 to mine correlation patterns between high-risk events and user operations, system vulnerabilities, or malicious codes; S54: Combine the analysis results of S52 and S53 to determine the relevant factors that trigger high-risk events, including specific user operations, system vulnerabilities or malicious code sources; and generate a risk assessment report, the report content includes detailed information of the high-risk events, high-risk event factors and security protection measures; the security protection measures include updating system patches and adjusting user permissions.

9. An artificial intelligence-based network security risk assessment device, used to implement the artificial intelligence-based network security risk assessment method according to any one of claims 1 to 9, characterized in that: Includes the following modules: Data collection module: used to collect network traffic data, user behavior data and device status data in real time, and clean and format the collected data to generate a standardized data set; Feature extraction and annotation module: connects to the data collection module, extracts network threat-related features based on standardized data sets, annotates multi-dimensional features in combination with historical security event records, and constructs a labeled risk data set; Model training module: connects the feature extraction and annotation modules, divides the labeled risk data set into a training set and a validation set, trains the training set using the support vector machine algorithm, generates a risk assessment model, and verifies and optimizes the model using the validation set; Real-time assessment module: connected to the model training module, based on the trained risk assessment model, it evaluates the real-time input network data, outputs risk scores and threat levels, and identifies high-risk events; Retrospective analysis module: connects to the real-time assessment module to perform retrospective analysis on identified high-risk events, identify relevant factors that trigger risks, including user operations, system vulnerabilities, and malicious code sources; and generate a risk assessment report.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the network security risk assessment method based on artificial intelligence described in any one of claims 1 to 8 are implemented.

Images