Network data security analysis method and system based on artificial intelligence

Abstract

The invention provides a network data security analysis method and system based on artificial intelligence, and relates to the technical field of network data security analysis. The method comprises the following steps: acquiring historical security analysis data, and performing network data division based on data security to form network data security division data; performing data source security analysis according to the network data security division data in combination with historical security analysis data to form network data source security analysis result data; and according to the network data security division data and the network data source security analysis result data, performing security analysis on the target network data to form target network data security analysis result data. According to the method, feature analysis and comparison aiming at network data security are carried out by utilizing artificial intelligence, so that analysis on the network data security is more efficiently and accurately realized, and resource consumption required by real-time analysis is reduced.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security analysis, and in particular to a network data security analysis method and system based on artificial intelligence. Background Art

[0002] With the development of Internet information technology, the security of network data has gradually become an important concern and a necessary foundation for creating a harmonious network environment. At present, the security analysis of network data is mainly judged by real-time threat analysis of network data. This method will greatly consume resources and put forward higher requirements for hardware when the amount of data is large, which is not conducive to the management and analysis of network data security.

[0003] In recent years, with the development of artificial intelligence, artificial intelligence has shown excellent efficiency and accuracy in data processing. If artificial intelligence can be used to analyze the security of network data, it should be able to improve the efficiency of data security analysis and further reduce the resource consumption of real-time analysis.

[0004] Therefore, designing a network data security analysis method and system based on artificial intelligence, using artificial intelligence to perform feature analysis and comparison on network data security, realizing the analysis of network data security more efficiently and accurately, and reducing the resource consumption required for real-time analysis, is an urgent problem to be solved. Summary of the invention

[0005] The purpose of the present invention is to provide a network data security analysis method based on artificial intelligence. By analyzing the historical network data security, the characteristic information of threatening network data is determined. At the same time, based on the characteristic information of network data security, the source of network data is also comprehensively analyzed and judged for completeness, and the characteristic information of the security of the source of network data is determined. Then, reference data for accurate security analysis is provided from the network data and the source of network data. With the help of the comparison database formed by artificial intelligence, the security analysis of network data can be realized more quickly and efficiently, and the resource consumption for network data security analysis can also be reduced.

[0006] The purpose of the present invention is also to provide a network data security analysis system based on artificial intelligence. The system is configured to extract network data security feature information and network data source security feature information from historical network data security analysis data, and then establish an intelligent comparison database for network data security analysis to complete the overall system of real-time security analysis of network data. This fully guarantees the efficient implementation of network data security analysis and is an important material basis for realizing intelligent analysis of network data security.

[0007] In a first aspect, the present invention provides a network data security analysis method based on artificial intelligence, comprising obtaining historical security analysis data, and performing network data division based on data security to form network data security division data; performing data source security analysis based on network data security division data, and combining the historical security analysis data to form network data source security analysis result data; performing security analysis on target network data based on the network data security division data and the network data source security analysis result data to form target network data security analysis result data.

[0008] In the present invention, the method determines the characteristic information of threatening network data through security analysis of historical network data, and at the same time, based on the characteristic information of network data security, conducts a comprehensive analysis and judgment on the source of network data for completeness, determines the characteristic information of the security of the source of network data, and then provides reference data for accurate security analysis from the network data and the source of network data. With the help of the comparison database formed by artificial intelligence, the security analysis of network data can be realized more quickly and efficiently, and the resource consumption for network data security analysis can also be reduced.

[0009] As a possible implementation method, historical security analysis data is obtained, and network data is divided based on data security to form network data security division data, including: determining a historical analysis period, extracting different historical network data within the historical analysis period from the historical security analysis data, and performing extraction based on security historical judgment time characteristics to form security historical judgment time characteristic information corresponding to different historical network data; extracting different historical network data within the historical analysis period from the historical security analysis data, and performing data occurrence feature extraction to form data occurrence feature information corresponding to different historical network data; for different historical network data, security division analysis is performed based on the corresponding security historical judgment time characteristic information and data occurrence characteristic information to form network data security division data.

[0010] In the present invention, the security classification of network data is mainly to determine threatening network data. It can be understood that for threatening network data, the characteristics it exhibits are mainly that there is partial data information in the network data that poses a complete threat, and the security threat data that the network data may carry is different in different situations. Therefore, when performing security classification, the time it takes to identify partial data information that poses a security threat and the frequency of security threat situations in the network data can be extracted based on historical data for analysis. By combining these two aspects of feature information, it is possible to achieve a reasonable security comprehensive classification and processing of network data.

[0011] As a possible implementation method, determine the historical analysis cycle, extract different historical network data in the historical security analysis data within the historical analysis cycle, and extract the security historical judgment time characteristics to form the security historical judgment time characteristic information corresponding to different historical network data, including: for different historical network data, determine the threat analysis time for each data threat to be identified in the historical analysis cycle n represents the number of different historical network data in the historical security analysis data within the historical analysis cycle, and i represents the number of times the historical network data numbered n is identified and analyzed within the historical analysis cycle; according to the different threat analysis durations corresponding to the historical network data, the threat analysis feature duration corresponding to the historical network data in the historical analysis cycle is determined. in, Indicates the time required to extract different threat analysis The maximum value of .

[0012] In the present invention, the extraction of characteristic information of network data in terms of threat resolution time is mainly to determine the time for which data information with security threats that can occur in network data is identified, and this time reflects the possibility of the size of the potential or existence of security threats in network data. It is understandable that due to the different application situations of network data, the data information with security threats that exist will have different sizes, properties, etc., and these differences can be comprehensively reflected in the overall threat resolution time. Therefore, when determining the threat resolution time of a certain type of network data, it is reasonable to use the longest time in history as the characteristic time.

[0013] As a possible implementation method, different historical network data in the historical analysis period are extracted from the historical security analysis data, and data occurrence feature extraction is performed to form data occurrence feature information corresponding to different historical network data, including: determining the total number of occurrences M of different historical network data in the historical security analysis data in the historical analysis period n and the number of threat manifestations C corresponding to the security threat n , C n ≤M n ; According to the total number of occurrences of different historical network data M n and threat manifestation times C n , determine the total feature frequency P corresponding to the historical network data n ,in,

[0014] In the present invention, the size and nature of the threats caused by different usage of each type of network data are different. Therefore, the threat classification analysis of network data should also consider the frequency of threats corresponding to each type of network data.

[0015] As a possible implementation method, for different historical network data, security division analysis is performed according to the corresponding security historical judgment time feature information and data occurrence feature information to form network data security division data, including: for different historical network data, according to the corresponding threat analysis feature time and the total frequency of features P n , determine the corresponding data threat level D n ,in, α represents the contribution percentage of duration; set the data security division threshold β, and for different historical network data, according to the corresponding data threat degree D n Perform the following security partition analysis: If D n ≤β, then the corresponding historical network data is determined to be safe network data; if D n >β, the corresponding historical network data is determined to be threat network data.

[0016] In the present invention, it should be noted that for the security analysis of network data, the longer the threat discrimination time of network data is, the smaller the frequency of occurrence is, which means that this uncommon threat data information is not easy to be identified and processed, so the threat of network data in this case is greater. Based on this, when using the characteristic time and characteristic frequency corresponding to the network data, the two parameters are positively correlated and negatively correlated for the security of network data. Thus, a reasonable data threat level is established. Of course, considering that there will be certain individual differences in directly evaluating the threat level of the duration, if the duration is too long, it will affect the results of the comprehensive analysis. Therefore, the duration contribution percentage is used to perform the characteristic restriction processing of the duration. Here, the duration contribution percentage can be determined according to actual needs, or it can be determined based on the analysis and processing of big data.

[0017] As a possible implementation method, data is divided according to network data security, and data source security analysis is performed in combination with historical security analysis data to form network data source security analysis result data, including: determining all network data sources in the historical analysis cycle, and calibrating all historical network data corresponding to different network data sources to form a corresponding network data source information set; performing source threat quantitative analysis based on the network data source information set corresponding to the network data source, and determining the corresponding source threat information quantity Q k , k represents the number of different network data sources; according to the network data source information set corresponding to the network data source, the source threat type analysis is performed to determine the corresponding source threat type quantity W k ; According to the source threat information volume Q corresponding to the network data source k and source threat type quantity W k , determine the corresponding source threat level Dk , where D k =γ1*Q k +γ2*W k , γ1 represents the threat quantification impact factor, γ2 represents the threat type impact factor; set the source security division threshold ρ, for different network data sources, according to the corresponding source threat degree D k Perform the following source safety analysis: If D k ≤ρ, then the corresponding network data source is determined to be a secure network data source; if D k >ρ, the corresponding network data source is determined to be a threat network data source.

[0018] In the present invention, the security analysis of network data can basically realize the security judgment of network data, but this kind of analysis needs to analyze and determine the network data one by one, which will increase the amount of analyzed data to a certain extent. On the other hand, for network data, its source will also determine its security to a certain extent. Therefore, it is necessary to conduct security analysis on the source of network data, that is, to make reasonable restrictions on the threat of the source, and to improve the efficiency of the analysis and judgment of the security of network data to a certain extent, and it can be achieved on the basis of reducing the analysis and processing flow or the amount of analysis and processing data. Similarly, for the security analysis of the source of network data, it is also necessary to conduct a comprehensive analysis of the source, and the comprehensive analysis of the source mainly considers the volume of threatening network data provided by the source and the type distribution of threatening network data types. Through the comprehensive analysis of these two aspects, the security analysis and judgment of the source of network data can be realized.

[0019] As a possible implementation method, according to the network data source information set corresponding to the network data source, a source threat quantitative analysis is performed to determine the corresponding source threat information quantity Q k , including: for different network data sources, determining the source threat frequency of the threatening network data according to the network data source information set Total number of sources for all historical network data provided The number of source threats based on the source of network data and total number of sources Determine the corresponding source threat information volume Q k ,in,

[0020] In the present invention, the quantitative analysis of data security of network data sources is mainly to determine the proportion of threats posed by network data provided by the network data sources, and the proportion determines whether the source can stably output secure data.

[0021] As a possible implementation method, according to the network data source information set corresponding to the network data source, the source threat type analysis is performed to determine the corresponding source threat type quantity W k , including: for different network data sources, determine the source threat type of the threatening network data based on the network data source information set Total number of sources of all historical network data provided Source threat types based on network data sources Total number of source types Determine the corresponding source threat type quantity W k ,in,

[0022] In the present invention, when quantifying the threat types of network data sources, the main consideration is whether the network data sources have a greater tolerance for threats. The greater the tolerance, the greater the threat. After all, a source that provides a variety of network data threats may itself be unsafe.

[0023] As a possible implementation method, a security analysis is performed on the target network data according to the network data security classification data and the network data source security analysis result data to form the target network data security analysis result data, including: determining the target source of the target network data, and performing a source security analysis in combination with the network data source security analysis result data: if the target source is a threat network data source, the target network data is marked as threat source data; if the target source is a security network data source, a data security analysis is performed in combination with the network data security classification data: if the target network data is a threat network data, it is marked as target threat network data; if the target network data is a security network data, it is marked as target security network data.

[0024] In the present invention, after obtaining the security classification information about the network data and the source of the network data, the formed characteristic data information can be used to perform reasonable comparative analysis, and the network data security can be quickly and efficiently confirmed. Of course, if the source of the network data is directly threatening, the network data corresponding to the source can be directly judged as threatening, which can save the process of comparative analysis of the security of the network data.

[0025] In a second aspect, the present invention provides an artificial intelligence-based network data security analysis system, which is configured to: obtain historical security analysis data, and perform network data division based on data security to form network data security division data; perform data source security analysis based on network data security division data, and combine historical security analysis data to form network data source security analysis result data; perform security analysis on target network data based on network data security division data and network data source security analysis result data to form target network data security analysis result data.

[0026] In the present invention, the system is configured to be able to extract network data security feature information and network data source security feature information from historical network data security analysis data, and to establish an intelligent comparison database for network data security analysis to complete the overall system for real-time security analysis of network data. This fully ensures the efficient conduct of network data security analysis and is an important material basis for realizing intelligent analysis of network data security.

[0027] The beneficial effects of the network data security analysis method and system based on artificial intelligence provided by the present invention are as follows:

[0028] This method determines the characteristic information of threatening network data through security analysis of historical network data. At the same time, based on the characteristic information of network data security, it also conducts a comprehensive analysis and judgment on the source of network data for completeness, determines the characteristic information of the security of the source of network data, and then provides reference data for accurate security analysis from the network data and the source of network data. With the help of the comparison database formed by artificial intelligence, the security analysis of network data can be realized more quickly and efficiently, and the resource consumption for network data security analysis can also be reduced.

[0029] The system is configured to extract network data security feature information from historical network data security analysis data and network data source security feature information, and then establish an intelligent comparison database for network data security analysis to complete the overall system of real-time security analysis of network data. This fully ensures the efficient implementation of network data security analysis and is an important material basis for realizing intelligent analysis of network data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments of the present invention are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0031] Figure 1 A step diagram of a network data security analysis method based on artificial intelligence provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present invention will be described below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0033] With the development of Internet information technology, the security of network data has gradually become an important concern and a necessary foundation for creating a harmonious network environment. At present, the security analysis of network data is mainly judged by real-time threat analysis of network data. This method will greatly consume resources and put forward higher requirements for hardware when the amount of data is large, which is not conducive to the management and analysis of network data security.

[0034] In recent years, with the development of artificial intelligence, artificial intelligence has shown excellent efficiency and accuracy in data processing. If artificial intelligence can be used to analyze the security of network data, it should be able to improve the efficiency of data security analysis and further reduce the resource consumption of real-time analysis.

[0035] refer to Figure 1 The embodiment of the present invention provides a network data security analysis method based on artificial intelligence. The method determines the characteristic information of threatening network data through historical network data security analysis. At the same time, based on the characteristic information of network data security, the source of network data is also comprehensively analyzed and judged for completeness, and characteristic information on the security of the source of network data is determined, thereby providing reference data for accurate security analysis from the network data and the source of network data. With the help of the comparison database formed by artificial intelligence, the security analysis of network data can be realized more quickly and efficiently, and the resource consumption for network data security analysis can also be reduced.

[0036] The network data security analysis method based on artificial intelligence specifically includes the following steps:

[0037] S1: Obtain historical security analysis data, and perform network data partitioning based on data security to form network data security partitioning data.

[0038] Obtain historical security analysis data, and perform network data partitioning based on data security to form network data security partitioning data, including: determining a historical analysis period, extracting different historical network data within the historical analysis period from the historical security analysis data, and performing extraction based on security historical judgment time characteristics to form security historical judgment time characteristic information corresponding to different historical network data; extracting different historical network data within the historical analysis period from the historical security analysis data, and performing data occurrence feature extraction to form data occurrence feature information corresponding to different historical network data; performing security partitioning analysis on different historical network data based on the corresponding security historical judgment time characteristic information and data occurrence characteristic information to form network data security partitioning data.

[0039] The security classification of network data is mainly to identify threatening network data. It is understandable that for threatening network data, the main feature is that there is some data information in the network data that poses a complete threat, and the security threat data that the network data may carry is different in different situations. Therefore, when performing security classification, the time it takes to identify the partial data information that poses a security threat and the frequency of security threats in the network data can be analyzed based on historical data extraction. By combining these two aspects of feature information, it is possible to achieve a reasonable security comprehensive classification of network data.

[0040] Determine the historical analysis cycle, extract different historical network data in the historical security analysis data within the historical analysis cycle, and extract the historical security judgment time characteristics to form the historical security judgment time characteristics information corresponding to different historical network data, including: for different historical network data, determine the threat analysis time for each data threat to be identified in the historical analysis cycle n represents the number of different historical network data in the historical security analysis data within the historical analysis cycle, and i represents the number of times the historical network data numbered n is identified and analyzed within the historical analysis cycle; according to the different threat analysis durations corresponding to the historical network data, the threat analysis feature duration corresponding to the historical network data in the historical analysis cycle is determined. in, Indicates the time required to extract different threat analysis The maximum value of .

[0041] The extraction of characteristic information of network data in terms of threat resolution time is mainly to determine the time it takes for data information with security threats to be identified, which reflects the possibility of potential or existing security threats in network data. It is understandable that due to different application situations of network data, the data information with security threats will be different in size and nature, and these differences can be comprehensively reflected in the overall threat resolution time. Therefore, when determining the threat resolution time of a certain type of network data, it is reasonable to use the longest time in history as the characteristic time.

[0042] Extract different historical network data in the historical analysis period from the historical security analysis data, and extract data occurrence characteristics to form data occurrence characteristic information corresponding to different historical network data, including: determining the total number of occurrences M of different historical network data in the historical security analysis data within the historical analysis period n and the number of threat manifestations C corresponding to the security threat n , C n ≤M n ; According to the total number of occurrences of different historical network data M n and threat manifestation times C n , determine the total feature frequency P corresponding to the historical network data n ,in,

[0043] For each type of network data, the size and nature of the threat caused by different usage are different. Therefore, when analyzing the threat classification of network data, the frequency of threats corresponding to each type of network data should also be considered.

[0044] For different historical network data, security classification analysis is performed based on the corresponding security historical judgment duration feature information and data occurrence feature information to form network data security classification data, including: for different historical network data, based on the corresponding threat analysis feature duration and the total frequency of features P n , determine the corresponding data threat level D n ,in, α represents the contribution percentage of duration; set the data security division threshold β, and for different historical network data, according to the corresponding data threat degree D n Perform the following security partition analysis: If D n ≤β, then the corresponding historical network data is determined to be safe network data; if D n >β, the corresponding historical network data is determined to be threat network data.

[0045] It should be noted that for the security analysis of network data, the longer the threat identification time of network data, the smaller the frequency of occurrence, which means that this uncommon threat data information is not easy to be identified and processed, so the network data in this case is more threatening. Based on this, when using the characteristic time and characteristic frequency corresponding to the network data, the two parameters are positively correlated and negatively correlated for the security of the network data. In this way, a reasonable data threat level is established. Of course, considering that there will be certain individual differences in the threat level evaluation of the duration directly, if the duration is too long, it will affect the results of the comprehensive analysis. Therefore, the duration contribution percentage is used to perform the characteristic restriction processing of the duration. Here, the duration contribution percentage can be determined according to actual needs, or it can be determined based on the analysis and processing of big data.

[0046] S2: Divide data according to network data security, and conduct data source security analysis in combination with historical security analysis data to form network data source security analysis result data.

[0047] Divide data according to network data security, and conduct data source security analysis in combination with historical security analysis data to form network data source security analysis result data, including: determine all network data sources in the historical analysis cycle, and calibrate all historical network data corresponding to different network data sources to form the corresponding network data source information set; conduct source threat quantitative analysis based on the network data source information set corresponding to the network data source, and determine the corresponding source threat information quantity Q k , k represents the number of different network data sources; according to the network data source information set corresponding to the network data source, the source threat type analysis is performed to determine the corresponding source threat type quantity W k ; According to the source threat information volume Q corresponding to the network data source k and source threat type quantity W k , determine the corresponding source threat level D k , where D k =γ1*Q k +γ2*W k , γ1 represents the threat quantification impact factor, γ2 represents the threat type impact factor; set the source security division threshold ρ, for different network data sources, according to the corresponding source threat degree D k Perform the following source safety analysis: If D k ≤ρ, then the corresponding network data source is determined to be a secure network data source; if D k >ρ, the corresponding network data source is determined to be a threat network data source.

[0048] The security analysis of network data can basically realize the security judgment of network data, but this kind of analysis requires the network data to be analyzed and determined one by one, which will increase the amount of analyzed data to a certain extent. On the other hand, for network data, its source will also determine its security to a certain extent. Therefore, it is necessary to conduct security analysis on the source of network data, that is, to make reasonable restrictions on the threat of the source, and to improve the efficiency of the analysis and judgment of the security of network data to a certain extent, and it can be achieved on the basis of reducing the analysis and processing flow or the amount of analysis and processing data. Similarly, for the security analysis of the source of network data, it is also necessary to conduct a comprehensive analysis of the source, and the comprehensive analysis of the source mainly considers the volume of threatening network data provided by the source and the type distribution of threatening network data types. Through the comprehensive analysis of these two aspects, the security analysis and judgment of the source of network data can be realized.

[0049] According to the network data source information set corresponding to the network data source, a quantitative analysis of the source threat is performed to determine the corresponding source threat information quantity Q k , including: for different network data sources, determining the source threat frequency of the threatening network data according to the network data source information set Total number of sources for all historical network data provided The number of source threats based on the source of network data and total number of sources Determine the corresponding source threat information volume Q k ,in,

[0050] The quantitative analysis of data security of network data sources is mainly to determine the proportion of threats posed by network data provided by the network data source. The proportion determines whether the source can stably output secure data.

[0051] According to the network data source information set corresponding to the network data source, the source threat type analysis is performed to determine the corresponding source threat type quantity W k , including: for different network data sources, determine the source threat type of the threatening network data based on the network data source information set Total number of sources of all historical network data provided Source threat types based on network data sources Total number of source types Determine the corresponding source threat type quantity W k ,in,

[0052] When quantifying the threat types of network data sources, the main consideration is whether the network data sources have a greater tolerance for threats. The greater the tolerance, the greater the threat. After all, a source that provides a variety of network data threats may itself be unsafe.

[0053] S3: Perform security analysis on the target network data according to the network data security classification data and the network data source security analysis result data to form the target network data security analysis result data.

[0054] According to the network data security classification data and the network data source security analysis result data, a security analysis is performed on the target network data to form the target network data security analysis result data, including: determining the target source of the target network data, and performing a source security analysis in combination with the network data source security analysis result data: if the target source is a threat network data source, the target network data is marked as threat source data; if the target source is a security network data source, a data security analysis is performed in combination with the network data security classification data: if the target network data is a threat network data, it is marked as target threat network data; if the target network data is a security network data, it is marked as target security network data.

[0055] After obtaining the security classification information about network data and the source of network data, the characteristic data information can be used to conduct reasonable comparative analysis and quickly and efficiently confirm the security of network data. Of course, if the source of network data is directly threatening, the network data corresponding to the source can be directly judged as threatening, which can save the process of comparative analysis of network data security.

[0056] The present invention also provides an artificial intelligence-based network data security analysis system, which is configured to: obtain historical security analysis data, and perform network data division based on data security to form network data security division data; perform data source security analysis based on network data security division data and in combination with historical security analysis data to form network data source security analysis result data; perform security analysis on target network data based on network data security division data and network data source security analysis result data to form target network data security analysis result data.

[0057] The system is configured to extract network data security feature information from historical network data security analysis data and network data source security feature information, and then establish an intelligent comparison database for network data security analysis to complete the overall system of real-time security analysis of network data. This fully ensures the efficient implementation of network data security analysis and is an important material basis for realizing intelligent analysis of network data security.

[0058] In summary, the network data security analysis method and system based on artificial intelligence provided by the embodiments of the present invention have the following beneficial effects:

[0059] This method determines the characteristic information of threatening network data through security analysis of historical network data. At the same time, based on the characteristic information of network data security, it also conducts a comprehensive analysis and judgment on the source of network data for completeness, determines the characteristic information of the security of the source of network data, and then provides reference data for accurate security analysis from the network data and the source of network data. With the help of the comparison database formed by artificial intelligence, the security analysis of network data can be realized more quickly and efficiently, and the resource consumption for network data security analysis can also be reduced.

[0060] The system is configured to extract network data security feature information from historical network data security analysis data and network data source security feature information, and then establish an intelligent comparison database for network data security analysis to complete the overall system of real-time security analysis of network data. This fully ensures the efficient implementation of network data security analysis and is an important material basis for realizing intelligent analysis of network data security.

[0061] In the embodiments of the present application, "indication" may include direct indication and indirect indication, and may also include explicit indication and implicit indication. The information indicated by a certain information is called information to be indicated. In the specific implementation process, there are many ways to indicate the information to be indicated, such as but not limited to, the information to be indicated can be directly indicated, such as the information to be indicated itself or the index of the information to be indicated. The information to be indicated can also be indirectly indicated by indicating other information, wherein there is an association between the other information and the information to be indicated. It is also possible to indicate only a part of the information to be indicated, while the other parts of the information to be indicated are known or agreed in advance. For example, the indication of specific information can also be achieved by means of the arrangement order of each piece of information agreed in advance (for example, specified by the protocol), thereby reducing the indication overhead to a certain extent. At the same time, the common parts of each piece of information can also be identified and indicated uniformly to reduce the indication overhead caused by indicating the same information separately.

[0062] In addition, the specific indication method may also be various existing indication methods, such as but not limited to the above-mentioned indication methods and various combinations thereof. The specific details of the various indication methods can refer to the prior art and will not be repeated herein. As can be seen from the above, for example, when it is necessary to indicate multiple information of the same type, different indication methods may be used for different information. In the specific implementation process, the desired indication method can be selected according to specific needs. The embodiment of the present application does not limit the selected indication method. In this way, the indication method involved in the embodiment of the present application should be understood to cover various methods that can enable the party to be indicated to obtain the information to be indicated.

[0063] It should be understood that the information to be indicated can be sent as a whole, or divided into multiple sub-information and sent separately, and the sending period and / or sending time of these sub-information can be the same or different. The specific sending method is not limited in the embodiment of the present application. Among them, the sending period and / or sending time of these sub-information can be pre-defined, for example, pre-defined according to a protocol, or can be configured by the sending end device by sending configuration information to the receiving end device.

[0064] "Pre-definition" or "pre-configuration" can be implemented by pre-saving corresponding codes, tables or other methods that can be used to indicate relevant information in the device, and the embodiments of the present application do not limit the specific implementation method. Among them, "saving" can mean saving in one or more memories. The one or more memories can be set separately or integrated in an encoder or decoder, a processor, or a communication device. The one or more memories can also be partially set separately and partially integrated in a decoder, a processor, or a communication device. The type of memory can be any form of storage medium, which is not limited by the embodiments of the present application.

[0065] The "protocol" involved in the embodiments of the present application may refer to a protocol family in the communication field, a standard protocol with a similar protocol family frame structure, or a related protocol used in future communication systems, and the embodiments of the present application do not make specific limitations on this.

[0066] In the embodiments of the present application, descriptions such as "when...", "in the case of...", "if" and "if" all mean that the device will make corresponding processing under certain objective circumstances. It does not limit the time, nor does it require the device to have a judgment action when implementing it, nor does it mean that there are other limitations.

[0067] In the description of the embodiments of the present application, unless otherwise specified, " / " indicates that the objects associated before and after are in an "or" relationship, for example, A / B can represent A or B; "and / or" in the embodiments of the present application is only a description of the association relationship of the associated objects, indicating that there can be three relationships, for example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. In addition, in the description of the embodiments of the present application, unless otherwise specified, "multiple" refers to two or more than two. "At least one of the following" or its similar expression refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple. In addition, in order to facilitate the clear description of the technical solution of the embodiments of the present application, in the embodiments of the present application, the words "first" and "second" are used to distinguish the same or similar items with basically the same functions and effects. Those skilled in the art will appreciate that words such as "first" and "second" do not limit the quantity and execution order, and words such as "first" and "second" do not necessarily limit the difference. At the same time, in the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete way for easy understanding.

[0068] It should be understood that the processor in the embodiments of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0069] It should also be understood that the memory in the embodiments of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0070] The above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0071] It should be understood that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A and B can be singular or plural. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship, but it may also indicate an "and / or" relationship. Please refer to the context for specific understanding.

[0072] In this application, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, or c can be represented by: a, b, c, ab, ac, bc, or abc, where a, b, c can be single or multiple.

[0073] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0074] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0075] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0076] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0077] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0078] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0079] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage media include: various media that can store program codes, such as USB flash drives, mobile hard disks, read-only memories (ROM), random access memories (RAM), magnetic disks or optical disks.

[0080] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A network data security analysis method based on artificial intelligence, characterized in that: include: Obtain historical security analysis data, and perform network data segmentation based on data security to form network data security segmentation data; Dividing the data according to the network data security, and performing data source security analysis in combination with the historical security analysis data to form network data source security analysis result data; According to the network data security classification data and the network data source security analysis result data, a security analysis is performed on the target network data to form target network data security analysis result data.

2. The network data security analysis method based on artificial intelligence according to claim 1 is characterized in that: The obtaining of historical security analysis data and performing network data partitioning based on data security to form network data security partitioning data includes: Determine a historical analysis period, extract different historical network data within the historical analysis period from the historical security analysis data, and perform extraction based on security historical determination duration characteristics to form security historical determination duration characteristic information corresponding to different historical network data; Extracting different historical network data within the historical analysis period from the historical security analysis data, and performing data occurrence feature extraction to form data occurrence feature information corresponding to different historical network data; For different historical network data, security classification analysis is performed according to the corresponding security history judgment duration characteristic information and the data occurrence characteristic information to form the network data security classification data.

3. The network data security analysis method based on artificial intelligence according to claim 2 is characterized in that: The determining of the historical analysis period, extracting different historical network data in the historical security analysis data within the historical analysis period, and performing extraction based on the security historical determination time characteristics to form security historical determination time characteristic information corresponding to different historical network data, includes: For different historical network data, determine the threat analysis time for each data threat resolution in the historical analysis cycle. n represents the number of different historical network data in the historical security analysis data within the historical analysis period, and i represents the number of times the historical network data numbered n is identified and analyzed within the historical analysis period; According to the different threat analysis durations corresponding to the historical network data, the threat analysis feature duration corresponding to the historical network data in the historical analysis cycle is determined. in, Indicates the time required to extract different threat analysis The maximum value of .

4. The network data security analysis method based on artificial intelligence according to claim 3 is characterized in that: The extracting different historical network data in the historical analysis period from the historical security analysis data and performing data occurrence feature extraction to form data occurrence feature information corresponding to different historical network data includes: Determine the total number of occurrences M of the historical security analysis data that are different from the historical network data within the historical analysis period n and the number of threat manifestations C corresponding to the security threat n , C n ≤M n ; The total number of occurrences M of different historical network data n and the number of times the threat manifests C n , determine the total feature frequency P corresponding to the historical network data n ,in, 5. The network data security analysis method based on artificial intelligence according to claim 4 is characterized in that: The security classification analysis is performed on different historical network data according to the corresponding security history judgment duration characteristic information and the data occurrence characteristic information to form the network data security classification data, including: For different historical network data, according to the corresponding threat analysis feature duration and the total frequency P of the feature n , determine the corresponding data threat level D n ,in, α represents the duration contribution percentage; Set the data security classification threshold β, and for different historical network data, classify them according to the corresponding data threat level D n The following security analysis is performed: If D n ≤β, then the corresponding historical network data is determined to be secure network data; If D n >β, then the corresponding historical network data is determined to be threat network data.

6. The network data security analysis method based on artificial intelligence according to claim 5 is characterized in that: The data is divided according to the network data security, and the data source security analysis is performed in combination with the historical security analysis data to form the network data source security analysis result data, including: Determine all network data sources in the historical analysis period, and mark all the historical network data corresponding to different network data sources to form a corresponding network data source information set; According to the network data source information set corresponding to the network data source, a source threat quantitative analysis is performed to determine the corresponding source threat information quantity Q k , k represents the number of different network data sources; According to the network data source information set corresponding to the network data source, a source threat type analysis is performed to determine the corresponding source threat type quantity W k ; According to the source threat information amount Q corresponding to the network data source k and the source threat type quantity W k , determine the corresponding source threat level D k , where D k =γ1*Q k +γ2*W k , γ1 represents the threat quantification impact factor, and γ2 represents the threat type impact factor; Set the source security classification threshold ρ, and for different network data sources, classify them according to the corresponding source threat level D k Perform the following source safety analysis: If D k ≤ρ, then the corresponding network data source is determined to be a secure network data source; If D k >ρ, then the corresponding network data source is determined to be a threat network data source.

7. The network data security analysis method based on artificial intelligence according to claim 6 is characterized in that: According to the network data source information set corresponding to the network data source, a source threat quantitative analysis is performed to determine the corresponding source threat information quantity Q k ,include: For different network data sources, determine the source threat frequency of the threatening network data according to the network data source information set. and the total number of sources of all said historical network data provided According to the source threat count corresponding to the network data source and total number of sources Determine the corresponding source threat information amount Q k ,in, 8. The network data security analysis method based on artificial intelligence according to claim 7 is characterized in that: The source threat type analysis is performed based on the network data source information set corresponding to the network data source to determine the corresponding source threat type quantity W k ,include: For different network data sources, determine the source threat type of the threatening network data according to the network data source information set. and the total number of sources of all the historical network data provided According to the source threat type corresponding to the network data source and the total number of source types described Determine the corresponding source threat type quantity W k ,in, 9. The network data security analysis method based on artificial intelligence according to claim 8 is characterized in that: The step of performing security analysis on target network data according to the network data security classification data and the network data source security analysis result data to form target network data security analysis result data includes: Determine the target source of the target network data, and perform source security analysis based on the network data source security analysis result data: If the target source is the source of the threat network data, marking the target network data as threat source data; If the target source is the secure network data source, data security analysis is performed in combination with the network data security division data: If the target network data is threat network data, then it is marked as target threat network data; If the target network data is secure network data, it is marked as target secure network data.

10. A network data security analysis system based on artificial intelligence, characterized in that: Configured as: Obtain historical security analysis data, and perform network data segmentation based on data security to form network data security segmentation data; Dividing the data according to the network data security, and performing data source security analysis in combination with the historical security analysis data to form network data source security analysis result data; According to the network data security classification data and the network data source security analysis result data, a security analysis is performed on the target network data to form target network data security analysis result data.

Images