Low-delay event response method based on information safety monitoring and early warning AI platform

Abstract

The invention relates to the technical field of information security early warning, and discloses a low-delay event response method based on an information security monitoring and early warning AI platform, which comprises the following steps of: acquiring various monitoring data in real time through sensor nodes, identifying information abnormality and space-time characteristic node value of the acquired data, and processing according to an information packaging standard; the method comprises the steps of forming an information response chain with a priority response weight, sequentially analyzing to-be-analyzed information through an information analysis layer to obtain an early warning feedback feature, performing information association tracking based on the early warning feedback feature, dividing related information into high association information and common association information, and respectively adjusting response priorities, thereby improving the response speed to a security event. According to the method, low-time-delay processing is ensured, the response priority is optimized through intelligent analysis, irrelevant event interference is effectively reduced, potential threats can be rapidly recognized in multi-dimensional data, the emergency processing capacity of the system is enhanced, and the problem that in the prior art, early warning response cannot be effectively conducted on security events in time is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of information security early warning, and in particular to a low-latency event response method based on an information security monitoring and early warning AI platform. Background Art

[0002] Network security in modern society is not limited to preventing traditional network attacks such as viruses, Trojans, and ransomware. More and more physical security issues have also entered the field of vision of security protection, especially in systems such as the Industrial Internet of Things (IIoT), smart grids, and smart buildings. The monitoring of physical parameters (such as temperature, humidity, gas leakage, vibration, etc.) and network security events are often intertwined. For example, sensor failures, gas leaks, or equipment abnormalities at the physical level may directly trigger network security events. Conversely, network attacks may also cause physical equipment to malfunction or fail. In response to this cross-domain security protection demand, traditional security monitoring systems often have problems such as delayed response, complex information processing, and difficulty in priority judgment, and are unable to provide timely and effective early warning responses to security incidents. Summary of the invention

[0003] The purpose of the present invention is to provide a low-latency event response method based on an information security monitoring and early warning AI platform, aiming to solve the problem in the prior art that it is impossible to promptly and effectively respond to security incidents.

[0004] The present invention is implemented in this way. In a first aspect, the present invention provides a low-latency event response method based on an information security monitoring and early warning AI platform, comprising: The data collection layer collects monitoring data of several pre-deployed sensor nodes in real time to obtain monitoring data corresponding to each of the sensor nodes; According to the information encapsulation standard, the monitoring data of each sensor node is subjected to information anomaly identification and spatiotemporal characteristic node value evaluation, and the monitoring data of each sensor node in each time period is subjected to information encapsulation processing according to the obtained anomaly index and node value parameter, so as to obtain an information response chain composed of a plurality of information to be analyzed with priority response weights; wherein the information response chain includes an immediate response chain, a priority response chain and a common response chain; The information analysis layer sequentially analyzes and processes each of the information to be analyzed in the information response chain to obtain early warning feedback features of each of the information to be analyzed; The information response chain is tracked for information correlation according to the early warning feedback characteristics of the information to be analyzed, and the information to be analyzed in the information response chain that has an information correlation relationship with the information to be analyzed is divided into highly correlated information and generally correlated information, and the priority response weight of the highly correlated information is adjusted upward, and it is determined whether to adjust the priority response weight of the generally correlated information according to the early warning feedback characteristics of the highly correlated information, so that the information analysis layer can analyze the information response chain in sequence.

[0005] The present invention provides a low-latency event response method based on an information security monitoring and early warning AI platform, which has the following beneficial effects: The present invention relates to the technical field of information security early warning, and discloses a low-latency event response method based on an information security monitoring and early warning AI platform. The present invention collects various monitoring data in real time through sensor nodes, identifies the information abnormality and spatiotemporal characteristic node value of the collected data, processes the collected data according to the information encapsulation standard, forms an information response chain with a priority response weight, analyzes the information to be analyzed in sequence through the information analysis layer, obtains early warning feedback characteristics, tracks information association based on the early warning feedback characteristics, divides the relevant information into highly correlated information and generally correlated information, adjusts the response priority respectively, improves the response speed to security incidents, ensures low-latency processing, optimizes the response priority through intelligent analysis, effectively reduces the interference of irrelevant events, can quickly identify potential threats in multi-dimensional data, enhances the emergency handling capability of the system, and solves the problem that the prior art cannot promptly and effectively respond to security incidents. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 It is a schematic diagram of the steps of a low-latency event response method based on an information security monitoring and early warning AI platform provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0007] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0008] The implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0009] Reference Figure 1 As shown, a preferred embodiment of the present invention is provided.

[0010] In a first aspect, the present invention provides a low-latency event response method based on an information security monitoring and early warning AI platform, comprising: S1: real-time collection of monitoring data of several pre-deployed sensor nodes is performed through the data collection layer to obtain monitoring data corresponding to each of the sensor nodes; S2: performing information anomaly identification and spatiotemporal characteristic node value evaluation on the monitoring data of each sensor node according to the information encapsulation standard, and performing information encapsulation processing on the monitoring data of each sensor node in each time period according to the obtained anomaly index and node value parameter, so as to obtain an information response chain composed of a plurality of information to be analyzed with priority response weights; wherein the information response chain includes an immediate response chain, a priority response chain and a common response chain; S3: analyzing and processing the information to be analyzed in the information response chain in sequence through the information analysis layer to obtain early warning feedback features of the information to be analyzed; S4: Tracking the information association of the information response chain according to the early warning feedback characteristics of the information to be analyzed, and dividing the information to be analyzed in the information response chain that has an information association relationship with the information to be analyzed into highly associated information and generally associated information, adjusting the priority response weight of the highly associated information upward, and determining whether to adjust the priority response weight of the generally associated information according to the early warning feedback characteristics of the highly associated information, so that the information analysis layer can analyze the information response chain in sequence.

[0011] Specifically, in step S1 of the embodiment provided by the present invention, before data collection, the system first needs to analyze the node address of each sensor node. These node addresses may include different dimensional information, such as: network node dimension: refers to the position of the sensor node in the network (such as IP address, network topology position), positioning map dimension: refers to the specific position of the sensor in the physical space (such as GPS coordinates or geographic location), regional function dimension: refers to the functional characteristics of the area where the sensor is located, such as industrial areas, office areas, transportation hubs, etc., traffic-related dimension: if it is a sensor node related to traffic, it may involve information such as traffic flow and vehicle speed. The analysis of the node address enables the system to more accurately identify the specific location and function of each sensor node, thereby more effectively locating and classifying monitoring data. Through these dimensional information, the function and importance of each sensor can be quickly understood, thereby laying the foundation for subsequent data collection and response priority allocation.

[0012] More specifically, after analyzing the address of the sensor node, the system needs to set the data port to ensure the information connectivity between each sensor node and the data acquisition layer. The purpose of this link is to ensure that the collected data can be seamlessly transmitted to the acquisition system for subsequent processing. By setting the data port, the system can allocate a suitable data transmission path (such as TCP / IP protocol, wireless communication, etc.) to each sensor node to ensure the reliability of data transmission from the sensor node to the data acquisition layer, ensure the stability and real-time performance of data transmission, reduce data loss and delay problems, and ensure that real-time monitoring data can be smoothly collected and transmitted. The data port setting can also ensure the parallel collection capability between multiple nodes, so that data from multiple sensors can be collected synchronously, thereby improving the overall efficiency of the system.

[0013] More specifically, during the data collection process, each piece of collected data will be marked with data location characteristics. These characteristics describe the source and importance of each piece of data, mainly including: sensor node identification of the data: clarify which specific sensor node the data was collected by; timestamp of the data: mark the time when the data was collected for subsequent time period analysis; geographic or functional location of the data: indicate the geographic location or functional area where the data was collected to help understand the context of the data. The location characteristic marking of the data can provide rich background information for subsequent data analysis, enhance the traceability and comprehensibility of the data, and by marking the location characteristics, the system can quickly identify the source and scope of influence of the data, and help with subsequent anomaly detection and response chain priority setting.

[0014] More specifically, each sensor node transmits the collected monitoring data to the data acquisition layer in real time through its data port. This process ensures the rapid flow of data, so that subsequent data analysis can be carried out in real time or near real time. Real-time data transmission ensures that the system can respond to changes in the external environment in the first time, provide timely feedback and early warning, and avoid delays that cause security risks. This technology can support parallel data collection from a large number of sensor nodes, and will not affect the overall monitoring efficiency due to collection delays at a single node.

[0015] It is understandable that analyzing the node address information of each sensor node (including network, location, region and other dimensions), ensuring the accuracy of data collection, setting a data port for each sensor node, realizing information connectivity with the data collection layer, marking the collected data with positioning characteristics (such as node identification, timestamp, etc.), ensuring accurate identification of data source and timeliness, and transmitting the monitoring data to the data collection layer in real time for further processing can improve the accuracy and reliability of data collection, ensure real-time data transmission, reduce data delays, ensure rapid response, strengthen the background information of data analysis, and improve the effectiveness of subsequent processing and priority adjustment. This method enables the information security monitoring system to ensure the real-time, accuracy and traceability of data when sensors are deployed on a large scale, and provide basic support for low-latency event response.

[0016] Specifically, in step S2 of the embodiment provided by the present invention, the raw data collected from each sensor node needs to be preliminarily identified. The goal of this step is to determine whether the data is abnormal data or whether there is a potential risk of a security incident through preliminary analysis of the raw data. First, the format of the data is parsed to ensure that the data type meets the preset standards, such as timestamp, node identifier, data value, etc., and certain rules or preliminary algorithms are applied, such as threshold determination, data fluctuation analysis, pattern recognition, etc., to identify whether there are anomalies. Through a machine learning model or a rule engine, a preliminarily judgment is made as to whether the collected data involves potential security risks, such as network attacks, data leakage or equipment failure, etc. The preliminary identification of the data can quickly screen out potential anomalies or security threats, provide guidance for subsequent processing, reduce the burden of subsequent data processing, give priority to abnormal or high-risk data, and improve the system response efficiency.

[0017] More specifically, based on the results of the preliminary identification, the monitoring data of each sensor node is encapsulated according to the information encapsulation standard, and a data structure is provided for the establishment of the subsequent response chain. The information encapsulation standard usually includes data format, priority, time interval, node characteristics, etc., and specifies the encapsulation format for the data of each sensor node. For example, the encapsulation standard may require that each data contains: node identifier (such as sensor ID or location), timestamp (marking the specific time of data collection), data value (such as temperature, flow, event indicator, etc.), anomaly indicator (indicating whether the data is abnormal or requires further analysis), priority weight (determined by the preliminary identification result, determining the response priority of the event).

[0018] More specifically, priority weights are assigned to data based on the preliminary identification results, and the priority may be evaluated based on multiple factors, including: the degree of abnormality of the data: if the data exhibits abnormal characteristics or patterns (such as network attack behavior, sensor failure, etc.), the priority weight is higher, node value of the data source: some sensor nodes may be more critical than other nodes (for example, the monitoring data of important servers is more important than the data of ordinary devices), time sensitivity: some events may require a response as soon as possible (such as real-time security incidents), so the priority weight may also be determined based on time sensitivity.

[0019] More specifically, the encapsulated data is sorted by priority weight and a response chain is formed. According to the priority of the data, the system will assign it to different response chains, which usually include: immediate response chain: high priority data that requires immediate response, priority response chain: second-highest priority data that requires a faster response but can be slightly delayed, and ordinary response chain: low priority data that can be processed later when resources are limited.

[0020] More specifically, information encapsulation processing ensures a unified data format, facilitating subsequent analysis, evaluation and response. By assigning priority weights, the system can flexibly adjust the order of responses and processing strategies to avoid waste of resources and ensure timely processing of key events. The construction of the response chain enables the system to dynamically respond to events of various levels and adjust processing strategies according to the situation to ensure efficient and accurate responses.

[0021] More specifically, when encapsulating information, the system will consider the time period factor. The monitoring data of some sensor nodes may be time-sensitive. For example, the period of abnormal network traffic may be directly related to the peak period of security attacks, or the time of occurrence of equipment failure may be critical to decision-making. According to the predetermined time window (such as 1 minute, 5 minutes, 1 hour), the monitoring data is divided into time periods. This is to capture the timeliness of certain events, such as peak attack behaviors or the continuous state of equipment failures. The data in each time period is encapsulated and marked to facilitate subsequent event response according to the time dimension. The data encapsulation within the time period enables the system to identify rapid changes in the short term and capture potential security threats more accurately. Through the division of the time dimension, the system can avoid missing key timeliness information and optimize the timeliness of event response.

[0022] More specifically, based on the encapsulated data, the system divides the data into different response chains and sorts them by priority. The generation of these response chains is a dynamic process and may be affected by different factors, such as real-time update of data, priority adjustment, etc. The changes in data flow are analyzed in real time, and the priority of data in the response chain is dynamically adjusted. For example, if the data originally in a low-priority response chain suddenly becomes abnormal, it can be dynamically promoted to a higher-priority response chain. According to the processing load and resources, the system can dynamically allocate resources among multiple response chains to optimize the overall event response efficiency. The dynamic generation and priority adjustment of response chains can ensure that the system can quickly respond to changing security environments, effectively allocate computing resources and response resources, ensure that high-risk events can be responded to in the shortest time, and reasonably allocate the processing time of low-risk events to improve the response efficiency of the entire system.

[0023] It is understandable that the monitoring data is initially identified, anomalies or security risks in the data are detected, each piece of data is encapsulated according to the encapsulation standard, and the data identifier, timestamp, degree of anomaly and priority are recorded. The encapsulated data is assigned to different response chains according to priority to form immediate, priority and ordinary response chains, and the response chain is dynamically adjusted to optimize the priority of the data in real time to ensure that key events are responded to in a timely manner. Through data encapsulation and priority allocation, the system can efficiently process a large amount of sensor data and reduce the processing burden of irrelevant or low-risk data. The dynamic response chain and priority adjustment ensure the flexibility and efficiency of the system in different situations and environments, and improve the timeliness and accuracy of event response. The construction of time-sensitive data encapsulation and response chain ensures that the system can adapt quickly in a changing environment and ensure a rapid response to potential security threats.

[0024] Specifically, in step S3 of the embodiment provided by the present invention, the information analysis layer first receives a packaged information response chain from the data acquisition layer, which contains multiple information to be analyzed. These information have been sorted according to priority and may contain timestamps, node identifiers, data types, abnormality and other characteristics. The information analysis layer receives the packaged information response chain from the data acquisition layer. Each information node contains data and its related characteristics, such as time, node identifier, priority, etc. According to the priority, timestamp, abnormality and other factors of the information, ensure that the information to be analyzed enters the analysis process in order of priority. High-priority events will be analyzed first to ensure the system's response to emergencies. Priority sorting ensures that the system can handle high-risk, high-priority events in a timely manner, reduce the response time of potential threats, and improve overall processing efficiency. During the sorting process, the system can automatically optimize the allocation of resources to ensure that high-priority events will not be delayed.

[0025] More specifically, before analyzing the information to be analyzed, the information analysis layer needs to pre-process the received data. The purpose of this step is to clean, denoise, and format the raw data as necessary so that the data can enter the next step of the analysis process, remove redundant or invalid data information, and correct errors or missing values ​​in the data. This can include removing duplicate data, filling missing values, filtering and denoising, etc., converting data from different sources or formats into a unified standard format to ensure that the data can be effectively analyzed in the subsequent processing process, for example, converting timestamps into a unified time zone, standardizing data units, etc.

[0026] More specifically, key features are extracted from the information to be analyzed. These features can help the system determine whether there are potential risks. For example, the flow change rate and abnormal flow peak are extracted from network flow monitoring data; the slope of temperature change is extracted from environmental monitoring data, etc. Preprocessing and feature extraction ensure the accuracy of information during analysis and avoid invalid or erroneous data affecting the analysis results. Standardized data enables data from different sources to be processed and compared under a unified analysis framework, improving the data consistency of the overall system.

[0027] More specifically, after preprocessing and feature extraction, the information analysis layer will conduct an in-depth analysis of each piece of information to be analyzed to identify potential security risks or abnormal events. This analysis is usually based on a certain model or rule engine. Through rule matching, statistical analysis or machine learning models, the system can identify potential abnormal patterns in the data. For example, a machine learning model trained based on historical data can help identify abnormal patterns in network traffic, failure modes of sensor nodes, etc. By analyzing the features, the system evaluates the risk level of each event. For example, a sudden increase in traffic may cause a bandwidth bottleneck, and abnormal device temperature may cause device failure. The analysis results are based on the rules or models. The output risk score can further determine the degree of danger of the incident, cross-analyze data from different sources, and identify the correlation between multiple data sources. For example, the environmental data and equipment monitoring data of a certain area may be correlated. Analyzing the intersection of these data can help discover hidden dangers or potential failures. Information analysis and risk assessment help the system extract potential security threats from large amounts of data and improve the ability to identify abnormal events. The use of pattern recognition and machine learning models enables the system to discover complex patterns that are difficult to capture with traditional rules, thereby improving the intelligence level of security detection. Risk assessment provides data support for subsequent response decisions, effectively avoiding false alarms or omissions.

[0028] More specifically, after completing information analysis and risk assessment, the information analysis layer will generate early warning feedback features, which are a set of data features that describe abnormal events and potential risks, usually including warning level, event type, urgency, scope of impact, recommended response and other information. Based on the results of the analysis, the system will assign a warning level to each event, such as high risk (serious threat), medium risk (potential threat), and low risk (minor threat). According to the type and characteristics of the event, the corresponding early warning feedback content is generated. According to the results of the risk assessment, the system generates response recommendations for each warning. The early warning feedback feature enables the system to quickly output clear and accurate early warning information to users or other systems, helping decision makers to take quick measures. The early warning information can clearly indicate the severity of the event, the scope of impact and response recommendations, thereby guiding subsequent rapid responses, improving the system's automated response capabilities, reducing manual intervention, and improving event response efficiency.

[0029] More specifically, after the early warning feedback feature is generated, the system may also establish a feedback mechanism to feed back the early warning results to the data collection layer, monitoring platform or user end. If the feedback results show that the early warning level does not match the actual situation, the system can optimize the analysis model based on the feedback information, adjust the rules or parameters, and enhance the subsequent recognition and prediction accuracy. The feedback mechanism can improve the intelligence level of the system, continuously optimize the analysis model through self-learning, and enhance the system's adaptability. The optimized system can discover new security threat patterns in a shorter time and improve the system's detection accuracy and response speed.

[0030] It is understandable that the information to be analyzed is received and prioritized, the information is preprocessed and feature extracted to ensure data clarity, accuracy and standardization, each piece of information to be analyzed is analyzed using pattern recognition, risk assessment and association analysis methods, potential risks are identified, warning feedback features are generated based on the analysis results, warning levels are assessed, and response recommendations are provided. The analysis model is optimized using the feedback mechanism to improve the system's adaptability and the ability to identify anomalies and security risks, especially in complex or irregular event patterns. The generated warning feedback can help decision makers quickly judge the risk level of the event and take action. The system's automated processing and self-learning mechanism make the response more efficient and accurate, reducing the need for human intervention.

[0031] Specifically, in step S4 of the embodiment provided by the present invention, information association tracking refers to analyzing the association between the information to be analyzed, identifying which information has correlation or dependency relationships, and dynamically adjusting the processing order of the information response chain based on these relationships. The core of this process is to perform association analysis on the information and find out the key information chains in order to give priority to responding to those events with higher associations.

[0032] More specifically, the information analysis layer first receives all the information to be analyzed and its warning feedback characteristics from the information response chain. These warning feedback characteristics usually include information such as the risk level of the event, the warning type, and the degree of urgency. Through pattern recognition, rule engines, or machine learning algorithms, the system analyzes the correlation between different information nodes. The correlation relationship can be a temporal dependency (for example, a change in the status of a certain device may be a precursor to the failure of another device) or a spatial dependency (for example, the failure of multiple devices in a certain area may be caused by the same cause).

[0033] More specifically, based on the results of association analysis, the system can construct an information association graph. Each node in the graph represents a piece of information to be analyzed, and the edges between the nodes represent the association relationship between these pieces of information. For example, the high temperature alarm and current anomaly of a certain device may be connected by edges in the graph, indicating that they may jointly indicate a failure of the device. In the information response chain, the system will identify the dependencies between information based on the association graph. These dependencies may affect the order of event response. For example, if the occurrence of an event may be a precursor to another event, the system needs to give priority to these related events.

[0034] It is understandable that through information correlation tracking, the system can more intelligently identify the correlation between information and ensure a linked response to multiple related events. Correlation analysis helps the system identify potential chain reactions in complex environments and avoid missed or misjudgment, especially when multiple devices, sensors or systems are abnormal at the same time. Correlation tracking can help focus on the key information that is most likely to cause other risks, improve the accuracy and real-time nature of event response, and avoid excessive response to isolated events or omission of related events.

[0035] More specifically, based on information association tracking, the system will adjust the priority response weight of the information to be analyzed in the information response chain. This means that the system dynamically adjusts the priority of the response based on the association, risk level, urgency and other characteristics of each piece of information to be analyzed. Through this adjustment, the system can ensure that the most critical and urgent information is processed first.

[0036] More specifically, each piece of information to be analyzed will first be assigned a preliminary response weight based on its early warning feedback characteristics (such as risk level, urgency, etc.). Generally, information with higher risk levels, greater urgency, and wider potential impact will receive higher initial weights. After identifying the correlation between information, the system will dynamically adjust the response weight of the information to be analyzed based on these correlations. For example, if a high-risk event is associated with multiple other events, the system may increase the response priority of information related to these events to prevent the spread of potential risks.

[0037] More specifically, for information to be analyzed that has a higher relevance, the system can increase its response weight through a weighted strategy. For example, if the failure of a certain device may cause the overall performance of the system to decline, the related information will be given a higher priority. For those events that are less relevant or irrelevant, the system will reduce their response weight to optimize the allocation of resources. Once certain information to be analyzed receives priority response, the system will track and provide feedback on it. If the warning feedback characteristics of this information change (for example, the risk level is reduced or the event is resolved), the system will re-evaluate and adjust the weight accordingly to ensure that the system always responds to events in the most effective way.

[0038] It can be understood that by adjusting the priority response weight, the system can dynamically optimize resource allocation according to the correlation between information, ensure that the most critical events are given the greatest attention, and reduce resource waste on low-priority events. The priority response weight adjustment enhances the flexibility and intelligence of the system, and can automatically optimize the response strategy according to changes in real-time data, thereby improving the overall response efficiency. This mechanism effectively avoids excessive response to irrelevant events, while ensuring that any node in the highly correlated information chain can be processed as early as possible to prevent potential chain reactions.

[0039] More specifically, the information analysis layer analyzes the information response chain in sequence according to the adjusted priority response weights, ensuring that information with higher weights is processed first, especially those events with strong correlations with other information. According to the adjustment results of the priority response weights, the system will reorder the information to be analyzed in the information response chain. The sorted order ensures that information with greater correlations with high-priority events is processed first, and the sorted information chain will enter the information analysis layer for processing in turn. Each piece of information will be further analyzed according to its characteristics and risk assessment until all information in the entire information chain has been processed.

[0040] It is understandable that sequential analysis ensures that the system can handle each event in the information response chain in an orderly and efficient manner. Especially for complex situations with multiple events, priority sorting can minimize delays, and high-priority information can be processed in a timely manner, which greatly improves the system's response speed and processing efficiency, and ensures that security incidents can be discovered and responded to in the first time. This step significantly enhances the intelligence of information processing by introducing association and weight adjustment, avoiding rigid response methods based solely on the chronological order of events or fixed priorities.

[0041] Specifically, the steps of this solution receive the information to be analyzed and analyze the early warning feedback characteristics, analyze the correlation between the information through pattern recognition and rule engine, build an information correlation map, and identify the dependency chain between the information, calculate the initial response weight according to the early warning feedback characteristics, adjust the priority response weight of the information to be analyzed based on the information correlation relationship, dynamically optimize the weight adjustment strategy according to the feedback of the event, sort the information to be analyzed and rearrange the analysis order, process the information in sequence according to priority, and ensure that the most important events receive priority response. The system can identify the relationship between multiple events through information correlation tracking, thereby reducing omissions or misjudgments, and ensure that high-risk and high-priority information can be processed first by dynamically adjusting the priority response weight, optimizing resource allocation, and sequential analysis ensures efficient information flow processing, avoids excessive response to low-priority events or ignores high-priority events, thereby improving response efficiency and event processing accuracy.

[0042] The present invention provides a low-latency event response method based on an information security monitoring and early warning AI platform, which has the following beneficial effects: The present invention relates to the technical field of information security early warning, and discloses a low-latency event response method based on an information security monitoring and early warning AI platform. The present invention collects various monitoring data in real time through sensor nodes, identifies the information abnormality and spatiotemporal characteristic node value of the collected data, processes the collected data according to the information encapsulation standard, forms an information response chain with a priority response weight, analyzes the information to be analyzed in sequence through the information analysis layer, obtains early warning feedback characteristics, tracks information association based on the early warning feedback characteristics, divides the relevant information into highly correlated information and generally correlated information, adjusts the response priority respectively, improves the response speed to security incidents, ensures low-latency processing, optimizes the response priority through intelligent analysis, effectively reduces the interference of irrelevant events, can quickly identify potential threats in multi-dimensional data, enhances the emergency handling capability of the system, and solves the problem that the prior art cannot promptly and effectively respond to security incidents.

[0043] Preferably, the step of collecting monitoring data of a plurality of pre-deployed sensor nodes in real time through a data collection layer to obtain monitoring data corresponding to each of the sensor nodes includes: S11: Analyze the node addresses of several pre-deployed sensor nodes to obtain the node address information of each of the sensor nodes; wherein the node address information includes address positioning information of several address analysis dimensions, and the address analysis dimensions include network node dimension, positioning map dimension, regional function dimension, and traffic association dimension; S12: setting a data port for each of the sensor nodes according to the node address information of each of the sensor nodes, so that each of the sensor nodes is in an information connection state with the data acquisition layer; S13: Marking the data location characteristics of the data collected by each of the sensor nodes through the data ports of each of the sensor nodes to obtain monitoring data with the data location characteristics corresponding to the sensor nodes, and transmitting the monitoring data to the data collection layer through the information connectivity status between the data port and the data collection layer.

[0044] Specifically, the system will perform node address analysis on several pre-deployed sensor nodes. The purpose of node address analysis is to identify the unique address of each sensor node to ensure that the data source of each sensor node can be accurately identified during the data collection process. Based on the node address analysis, the system will generate node address information for each sensor node. This information usually includes positioning data in multiple dimensions to ensure that each sensor node can be accurately located in different dimensions. These dimensions include: Network node dimension: the unique identifier of each sensor node in the network, which is used to determine the position and communication path of the node in the network architecture; Positioning map dimension: based on the geographic information system (GIS) or map data, the physical location of each sensor node (such as longitude and latitude) will also be used as part of the node address; Regional function dimension: the area where the sensor node is located and its functional attributes (for example, whether the monitoring area is an industrial area, residential area, etc.). This dimension helps analyze the different roles of node data in different areas; Traffic association dimension: the node may be associated with the traffic network (such as intersection monitoring sensors, traffic flow sensors, etc.). This dimension can determine the relationship between the sensor node and the traffic system and the impact of its data on traffic management.

[0045] It can be understood that through node address analysis, the system can ensure that each sensor node has unique identification information, avoiding confusion of data sources. Multi-dimensional address information enables sensor data to be accurately located at different levels and angles, improving the accuracy and diversity of monitoring data.

[0046] More specifically, based on the node address information of the sensor node, the system configures a data port for each sensor node. This port is the communication channel between the sensor and the data acquisition layer, ensuring that information can be transmitted smoothly. Through the configuration of the data port, the system ensures that a stable information connection is established between the sensor node and the data acquisition layer. This process usually involves the setting of network protocols and the management of data flows, ensuring that each sensor node can transmit monitoring data to the data acquisition layer in real time through the set port. The configuration of the data port ensures effective communication between the sensor node and the data acquisition layer, thereby laying the foundation for subsequent data collection and analysis. Through precise port settings, the system can ensure that the data of each sensor can be transmitted accurately, reducing the risk of communication errors or data loss.

[0047] More specifically, the data collected by each sensor node will be transmitted through its configured data port, and the data will be marked with data location characteristics according to the node's address information during the transmission process. These marks include: geographic location marking: the data is geographically marked according to the node's positioning map dimensions (latitude and longitude), so that the data not only contains measurement values, but also can be accompanied by physical locations; functional attribute marking: based on the regional function dimension and traffic association dimension, the data will be marked as monitoring data for a specific functional area or transportation network, which will help to better understand the application context of the data in subsequent analysis.

[0048] More specifically, through these tags, the collected monitoring data can be associated with specific location, region, function and other background information, thereby improving the data's parsing capabilities and practical value. The marked data will be easier to perform geographic information analysis, trend analysis, regional performance analysis, etc. The data location feature tags make the collected data not just raw measurement data, but also add rich contextual information, thereby enhancing the data's value and usability. The data location feature tags help with subsequent data analysis, such as being able to judge environmental conditions based on specific locations, or analyzing the impact of traffic flow on certain events.

[0049] More specifically, the marked monitoring data will be connected to the data acquisition layer through the data port of each sensor node and transmitted to the data acquisition layer in real time. As the data aggregation and processing center, the data acquisition layer will receive the data uploaded by all sensor nodes and perform further processing and analysis as needed. Since the sensor nodes may be located in different geographical locations and involve different monitoring dimensions, the data acquisition layer needs to synchronously receive data streams from different sensors. During the data transmission process, issues such as transmission delay and data consistency must be considered to ensure that the data can be transmitted to the acquisition layer in a timely and accurate manner. Through the effective connection of the data port and the real-time transmission of the data, the sensor data can be obtained by the data acquisition layer in a timely manner, meeting the requirements of real-time monitoring. The data transmission and marking mechanism ensures the integrity, accuracy and traceability of the data, providing a reliable foundation for subsequent data processing, analysis and decision-making.

[0050] It can be understood that the system can accurately locate sensor nodes through multi-dimensional node address information, avoiding confusion of data sources. The setting of data ports ensures effective communication between sensor nodes and data acquisition layer, and realizes real-time data transmission. By marking the positioning characteristics of monitoring data, the data is more valuable for application and the accuracy of data analysis is enhanced. The whole process ensures the real-time, accuracy and efficiency of sensor data, providing a reliable basis for subsequent analysis and decision-making.

[0051] Preferably, the steps of performing information anomaly identification and spatiotemporal characteristic node value evaluation on the monitoring data of each sensor node according to the information encapsulation standard, and performing information encapsulation processing on the monitoring data of each sensor node in each time period according to the obtained anomaly index and node value parameter to obtain an information response chain consisting of a plurality of information to be analyzed with priority response weights include: S21: Identifying the information abnormality of the monitoring data of each sensor node according to the information abnormality standard in the information encapsulation standard, so as to obtain an abnormality index of each monitoring data corresponding to the information abnormality standard; wherein the abnormality index is used to describe the possibility of the monitoring data feeding back an information security warning event; S22: performing data location characteristics and node value evaluation of the time period to which the data belongs on the monitoring data of each sensor node according to the node address value standard in the information encapsulation standard, and obtaining node value parameters of each monitoring data corresponding to the node address value standard; S23: performing information encapsulation processing on each of the monitoring data according to the abnormality index and the node value parameter of each of the monitoring data, so as to obtain an information response chain consisting of a plurality of information to be analyzed with priority response weights.

[0052] Specifically, according to the predetermined information encapsulation standard, the system will perform preliminary identification on the monitoring data of each sensor node. The purpose of preliminary identification is to analyze and process the raw data from different sensors to ensure that the data can be further processed according to unified standards. Preliminary identification enables different types of monitoring data (such as temperature, humidity, air pressure, flow, etc.) to be processed according to the same encapsulation standard, ensuring the consistency and comparability of the data.

[0053] More specifically, according to the abnormality standard in the information encapsulation standard, the system will identify the abnormality of the monitoring data of each sensor node. The purpose of abnormality identification is to evaluate the abnormality of each monitoring data in the data feedback and calculate the corresponding abnormality index. The abnormality index is a quantitative indicator used to describe the abnormal conditions that may exist in the monitoring data, such as abnormal temperature, excessive pressure, etc. This index reflects the possibility of potential security warning events behind the data. Through abnormality identification, the system can promptly detect abnormal behavior or potential faults in the sensor node data and generate an abnormality index. This provides a basis for subsequent security warnings and abnormality handling. The abnormality index helps to quickly determine whether the monitoring data belongs to an emergency or high-risk data that needs further inspection, thereby improving the response efficiency of the system.

[0054] More specifically, in the information encapsulation standard, the system will also evaluate the monitoring data according to the node address value standard. The node value evaluation mainly considers the following two factors: data location characteristics: that is, the geographical location of the monitoring data, regional functions, and its specific role in the sensor network. For example, if a sensor is located in a key location (such as the core area of ​​a factory), the importance of its data will be relatively high; the time period to which the data belongs: the time period of data collection will also affect the value of the node. For example, certain specific time periods (such as peak hours and emergency periods) have a greater impact on the overall security and resource scheduling of the system, and the value of the node may be higher.

[0055] More specifically, based on the above evaluation, the system assigns a node value parameter to each monitoring data, reflecting its relative importance in a specific time period and geographical location. The node value evaluation helps to identify monitoring data with high priority at critical moments or critical locations. This evaluation mechanism provides an important reference for data prioritization and decision-making. The system can reasonably allocate resources for processing according to the importance of different nodes and the timeliness of the data, thereby optimizing the system's responsiveness.

[0056] More specifically, based on the anomaly index and node value parameters, the system will encapsulate each monitoring data. During the encapsulation process, the system will assign different priority response weights to the data based on the data's anomaly and node value. The priority response weight is determined based on the importance and urgency of the monitoring data. For example, data with high anomaly and high node value will be given a higher priority weight. The encapsulated monitoring data will be sorted by priority to form an information response chain. The data in the information response chain will be sorted by chronological order, urgency and importance to ensure that key data can be processed first.

[0057] It can be understood that information encapsulation processing ensures that data priority is reasonably allocated and improves the system's responsiveness. High-priority data will be able to receive a more rapid response and avoid the expansion of potential risk events. The generated information response chain provides clear guidance for subsequent security warnings, incident responses, and resource scheduling, which helps to optimize the overall operating efficiency and emergency response capabilities of the system; abnormality identification enables the system to promptly detect potential abnormal events and generate early warning signals. Node value assessment provides multi-dimensional support for data processing and decision-making, ensuring that important data can be given priority. Information encapsulation processing and the generation of response chains optimize the order and efficiency of data processing and improve the system's response speed and accuracy. The entire process improves the system's automated processing capabilities in a variety of scenarios (such as security monitoring, emergency response, etc.), helping managers to respond to various emergencies quickly and effectively.

[0058] Preferably, the step of performing information encapsulation processing on each of the monitoring data according to the abnormality index and the node value parameter of each of the monitoring data to obtain an information response chain consisting of a plurality of information to be analyzed with priority response weights includes: S231: performing priority gradient division on each of the monitoring data according to the abnormality index of each of the monitoring data, so as to obtain the response priority gradient to which each of the monitoring data belongs; wherein the response priority gradient includes an immediate response gradient, a priority response gradient, and a common response gradient; S232: preliminarily allocating each of the monitoring data according to the response priority gradient to which each of the monitoring data belongs, so as to obtain an immediate response data set, a priority response data set and a common response data set; S233: analyzing the execution order of each monitoring data within the gradient according to the node value parameter of each monitoring data, so as to obtain the priority within the gradient of each monitoring data; S234: Arranging the monitoring data in the immediate response data set, the priority response data set and the common response data set in a processing order according to the intra-gradient priority of each monitoring data, so as to obtain an immediate response chain, a priority response chain and a common response chain; S235: Perform correlation analysis on the overall response order of each monitoring data in the immediate response chain, the priority response chain and the ordinary response chain, and convert each monitoring data according to the analysis result to obtain the information to be analyzed corresponding to each monitoring data, and combine the immediate response chain, the priority response chain and the ordinary response chain composed of the information to be analyzed to obtain the information response chain.

[0059] Specifically, the core of this technical solution is to perform hierarchical priority response processing on the monitoring data of sensor nodes, and to encapsulate and prioritize each data according to the data's abnormality index and node value parameters, ultimately forming an information response chain. This process aims to ensure that data of different priorities can be responded to efficiently according to their urgency and importance, thereby optimizing the system's decision-making and processing processes.

[0060] More specifically, according to the information encapsulation standard, the abnormality index of each monitoring data is analyzed. The abnormality index is used to measure the degree of abnormality of the monitoring data, that is, it reflects the possible risks of the data or the severity of the warning event. Based on the abnormality index, each monitoring data is divided into different response priority gradients: Immediate response gradient: the abnormality index is extremely high, which means that the data needs to be responded to and processed immediately; priority response gradient: the abnormality is high and requires priority response, but does not require immediate response; ordinary response gradient: the abnormality is low and the response can be delayed, which belongs to routine processing. By dividing the priority gradients of monitoring data, it is ensured that the system can classify and process the data according to the urgency and importance, avoiding waste of processing resources and unnecessary delays. High-priority data will be processed quickly, reducing the probability of potential risk events and improving the system's ability to respond to emergencies.

[0061] More specifically, all monitoring data are preliminarily allocated according to the response priority gradient of each monitoring data (immediate response gradient, priority response gradient, ordinary response gradient). In this way, the data will be divided into: immediate response data set: containing high-priority data that requires immediate response, priority response data set: containing data that requires priority processing, ordinary response data set: containing data that can be processed later. Through this allocation mechanism, the system can accurately distinguish data of different urgency, avoid ineffective use of resources, and give priority to high-risk data, so that urgent data can be processed more quickly and centrally, reducing resource usage.

[0062] More specifically, according to the node value parameters in the information encapsulation standard, a priority analysis within the gradient is performed on the monitoring data in each data set. The node value parameters take into account factors such as the geographical location and functional importance of the node to which the data belongs, and further determine the priority of the data within the same response gradient. The data in each set is sorted to determine the execution priority of each data item. Even within the same response priority gradient, through the analysis of node value parameters, the system can more accurately sort and prioritize data, further optimize the response processing process, and when allocating resources to the system, data with higher priority will be processed first, further improving processing efficiency.

[0063] More specifically, based on the results of the intra-gradient priority analysis, the data in the immediate response data set, the priority response data set, and the ordinary response data set are arranged in the order of processing: immediate response chain: arrange all data in the immediate response data set in order of priority, priority response chain: arrange all data in the priority response data set in order of priority, ordinary response chain: arrange all data in the ordinary response data set in order of priority, to ensure that data processing is carried out according to priority, to solve the most urgent and critical tasks first, and to avoid the occupation of system resources by low-priority tasks.

[0064] More specifically, the data in the immediate response chain, priority response chain and ordinary response chain are analyzed in terms of overall response sequence. This analysis is mainly based on the temporal, geographical, priority and other correlations between the data. The purpose is to ensure that the data in multiple response chains can be coordinated and consistent to avoid conflicts. According to the results of the correlation analysis, information conversion is performed on each monitoring data to convert it into corresponding information to be analyzed. The information to be analyzed will facilitate further decision-making, early warning and resource scheduling. Through the analysis of the overall response sequence, conflicts and inconsistencies between data are avoided, ensuring that the system's response process is more coordinated and orderly. The information to be analyzed obtained after information conversion provides decision makers with more accurate and comprehensive reference data, which helps to make more reasonable and efficient response decisions.

[0065] More specifically, the information to be analyzed in the immediate response chain, the priority response chain, and the ordinary response chain are combined to eventually obtain a complete information response chain, which contains all the data that need to be processed and is arranged according to priority to ensure that the most urgent data is responded to first. Through the combination of information response chains, the system can uniformly manage various types of response data and realize unified scheduling of tasks with different response priorities. The final information response chain can optimize the resource allocation of the entire system, ensuring that the most urgent data can be processed as quickly as possible, and at the same time, system resources will not be wasted on processing unimportant data.

[0066] It can be understood that through the combination of anomaly index and node value, the data priority is refined and can flexibly respond to situations of different levels of urgency. Through hierarchical management and priority sorting within the gradient, the system can optimize resource scheduling and ensure that key tasks are given priority. The organization and sorting of the response chain makes data processing orderly and efficient, and the system response time is significantly improved. The information response chain finally generated provides clear priorities for the system's decision-making, early warning and execution, and can respond to potential security incidents in a timely manner.

[0067] Preferably, the steps of performing a correlation analysis of the overall response order on each of the monitoring data in the immediate response chain, the priority response chain, and the ordinary response chain, and converting each of the monitoring data according to the analysis result to obtain information to be analyzed corresponding to each of the monitoring data include: S2351: Calculate the ratio of the monitoring data to be responded to of the priority response chain and the common response chain to obtain the workload ratio of the priority response chain and the common response chain; S2352: Analyze the chain conversion relationship between the priority response chain and the ordinary response chain according to the workload ratio of the priority response chain and the ordinary response chain to obtain a rotation response rule between the priority response chain and the ordinary response chain; S2353: allocating priority response weights to the monitoring data in the priority response chain and the common response chain according to the rotation response rule, so as to obtain information to be analyzed with priority response weights corresponding to the monitoring data; S2354: Allocate priority response weights in the form of highest priority to the monitoring data of the immediate response chain according to the preset highest priority response rule to obtain information to be analyzed with priority response weights in the form of highest priority corresponding to each of the monitoring data; wherein the information to be analyzed with priority response weights in the form of highest priority obtained by the highest priority response rule is arranged at the forefront of the information to be analyzed with priority response weights obtained by the rotation response rule.

[0068] Specifically, the monitoring data in the priority response chain and the ordinary response chain are ratio-calculated to obtain the workload ratio of the two. This ratio reflects the relationship between the priority response chain and the ordinary response chain in terms of resource consumption, time consumption, etc. By calculating the workload ratio, the workload between different chains is quantified, so that the system can more clearly judge the relative importance and resource occupancy of the priority response chain and the ordinary response chain in the response process. This ratio provides an important basis for further chain conversion and resource scheduling.

[0069] More specifically, based on the calculated workload ratio, the conversion relationship between the priority response chain and the ordinary response chain is analyzed. The purpose of this analysis is to identify how to effectively convert between the two through rotating response rules when the workload changes. The rotating response rules include: when the workload ratio of the priority response chain is large, some of the ordinary response chain data needs to be transferred to the priority response chain to improve its processing efficiency. When the workload of the ordinary response chain is too large, some priority response data may need to be postponed and transferred to ordinary response processing. Through this analysis, the dynamic adjustment rules of data priority between the two can be determined to ensure efficient use of resources. Chain conversion analysis makes the conversion between the priority response chain and the ordinary response chain more flexible and orderly, avoids excessive congestion of a certain chain, and ensures the efficiency of the overall response. By dynamically adjusting the conversion between the priority response chain and the ordinary response chain, resource allocation can be effectively optimized and processing efficiency can be improved.

[0070] More specifically, priority response weights are assigned to the monitoring data in the priority response chain and the ordinary response chain according to the rotation response rules. Specifically, the data in the priority response chain will be assigned a higher weight, and the data in the ordinary response chain will be assigned a lower weight to ensure that urgent data is processed first. According to the priority and importance of the data, a higher priority response weight is assigned to the data in the priority response chain. Although the data in the ordinary response chain has a lower priority, it still needs to be processed according to the weight to ensure that it receives an appropriate response. After the allocation, information to be analyzed with a priority response weight is formed. Through the allocation of priority response weights, the system can accurately adjust the response order of each monitoring data to ensure that key data is processed first and improve response efficiency. Through this dynamic allocation method, it can be ensured that high-priority data in the priority response chain is processed first, and data in the ordinary response chain can be processed in a timely manner to avoid processing delays.

[0071] More specifically, priority response weights are allocated to the monitoring data in the immediate response chain according to the preset highest priority response rule. The highest priority response rule is based on the urgency, importance and impact of the data on the system, and the strongest priority response weights are allocated to the data in the immediate response chain. These data will be given the highest priority response weight to ensure that these data receive the highest priority response during the processing. The information to be analyzed with the highest priority response weight obtained according to the highest priority response rule will be arranged at the forefront of the information to be analyzed with the priority response weight obtained through the rotating response rule. The data in the immediate response chain is weighted by the highest priority response rule to ensure that the most urgent and critical tasks can be processed in the highest priority order to avoid delays in the system's rapid response. The combination of the highest priority response rule and the rotating response rule enables data of different priorities to be responded to in an orderly manner, thereby improving the response speed and resource scheduling efficiency of the entire system.

[0072] More specifically, through the above process, three chains are formed: immediate response chain: controlled by the highest priority response rule, the most urgent data is processed first, priority response chain: adjusted according to the rotation response rules and workload ratio analysis to ensure that data is processed on demand, ordinary response chain: processed according to ordinary priority to ensure that no necessary response is missed, and finally, through the comprehensive sorting of the data of these three chains, an information response chain with a complete priority system is formed to ensure that different types of data can be responded to accurately and orderly. Through the final sorting and analysis, the data processing of all chains is ensured to be orderly, avoiding priority confusion or resource conflicts. This process ensures that the system can respond quickly and accurately when faced with complex monitoring data, greatly improving the system's response capability and processing efficiency.

[0073] It can be understood that through multi-level priority response rules and weight allocation, the most urgent and important data can be responded to quickly. The reasonable allocation of chain conversion and priority response weights enables the system to maintain efficient response even when resources are limited. The combination of the highest priority response rule and the rotation response rule enables the system to quickly process various types of monitoring data and improve the overall response speed.

[0074] Preferably, the step of sequentially analyzing and processing each of the information to be analyzed in the information response chain through the information analysis layer to obtain the early warning feedback characteristics of each of the information to be analyzed includes: S31: sequentially retrieve and process each piece of information to be analyzed from the information response chain to obtain a real-time processing object at the current moment; S32: performing data feature extraction and event warning analysis on the real-time processing object based on the pre-trained information security warning model to obtain security risk indexes of the real-time processing object corresponding to several types of information security warning events; S33: Comprehensively combining the security risk indexes of the real-time processing object corresponding to various information security warning events to obtain the warning feedback characteristics of the real-time processing object.

[0075] Specifically, in the information response chain, each piece of information to be analyzed will be retrieved and processed in a predetermined order. This process ensures that the system processes the data in sequence according to its priority, timeliness and other characteristics to avoid delays or losses in data processing. The system extracts the information to be analyzed in sequence through a certain mechanism (such as timestamp, priority, event importance, etc.), and by retrieving the information to be analyzed, it obtains the objects that need to be processed at the current moment in real time, ensuring that the data that needs to be analyzed can be accurately located each time. Sequential retrieval and processing ensure that the data enters the processing link smoothly in sequence, avoiding disorder, duplication or omission, ensuring that the system can process the data that needs the most response at the current moment, and improving the timeliness of the system response.

[0076] More specifically, a pre-trained information security warning model is used to analyze the real-time processing object and extract data features from it. These features may include: abnormal behavior patterns: such as data access anomalies, frequent system access, data transmission anomalies, etc. Attack pattern recognition: by analyzing data streams, access records, etc., potential security threats (such as DDoS attacks, data leaks, etc.) are identified; Historical trend analysis: by retrospective analysis of historical data, abnormal changes in current data are identified; Event warning analysis: based on the extracted features, event warning analysis is performed to determine whether there are potential security risks and give a corresponding security risk index.

[0077] It is understandable that through the pre-trained model, the system can automatically identify potential security risks without human intervention, thereby improving monitoring efficiency. Through data feature extraction and event warning analysis, it can conduct security assessments from multiple angles (such as behavior patterns, attack patterns, historical trends, etc.), thereby improving the accuracy of warnings. It can analyze possible security incidents in real time based on real-time processing objects, accurately calculate risk levels, and provide warnings.

[0078] More specifically, the security risk indexes corresponding to different warning events of real-time processing objects (such as intrusion, sensitive data leakage, equipment failure, etc.) are comprehensively processed. The goal of this process is to obtain a comprehensive security risk assessment, namely, the warning feedback feature, by weighting or combining the risk indexes of different events. Specifically, the comprehensive calculation process may include: weighted average: according to the severity and impact range of each security event, different risk indexes are weighted averaged; maximum value method: for multiple concurrent security events, the risk index of the most serious event is selected as the overall assessment; probability combination: if there is a correlation between warning events (such as data leakage caused by an intrusion event), a comprehensive risk assessment can be obtained through joint probability analysis. The comprehensive warning feedback feature reflects the overall security situation faced by the system at the current moment and helps decision makers respond to emergencies.

[0079] It is understandable that by integrating the risk index of different events, the system can provide a comprehensive security risk assessment, avoiding the one-sidedness of single event analysis. The early warning feedback feature provides accurate data support for subsequent decisions (such as triggering alarms, initiating emergency responses, etc.), improving the scientificity and efficiency of responses, and combining different levels of security risks (such as network layer, application layer, data layer, etc.) to help the system more comprehensively manage and respond to potential security threats.

[0080] More specifically, the system will eventually output the early warning feedback features to relevant personnel or systems for the next step of security decision-making and emergency response. The output content can be: real-time alerts: for sudden high-risk events, alarms are immediately output to notify security personnel to take action; trend analysis reports: by historical tracking of risk indexes, the system's security situation report is output to help with long-term security planning. Through the output of early warning feedback features, the security team can respond quickly to security incidents and reduce the impact of potential threats on the system. Trend analysis reports help companies conduct a comprehensive assessment of security conditions, optimize security strategies, and prevent potential threats in advance.

[0081] Preferably, the information response chain is tracked for information association according to the early warning feedback characteristics of the information to be analyzed, and the information to be analyzed in the information response chain that has an information association relationship with the information to be analyzed is divided into highly associated information and generally associated information, the priority response weight of the highly associated information is adjusted upward, and it is determined whether to adjust the priority response weight of the generally associated information according to the early warning feedback characteristics of the highly associated information, so that the information analysis layer can analyze the information response chain in sequence. The steps include: S41: performing security threshold analysis on the warning feedback features of the information to be analyzed to obtain the security risk levels of various information security warning events warned by the information to be analyzed, and judging the associated tracking requirements of the security risk levels of various security warning events warned by the information to be analyzed to obtain whether the information to be analyzed needs information associated tracking; S42: If the information to be analyzed needs to be tracked for information association, then based on a preset association standard, the security risk levels of various information security warning events warned by the information to be analyzed are analyzed for associated information features to obtain associated information features of the information to be analyzed; wherein the associated information features include time association features and address association features; S43: performing association tracking processing on the information to be analyzed according to the associated information feature, so as to obtain a number of information to be analyzed having an associated tracking relationship with the information to be analyzed and information association degrees on the information response chain; S44: classifying the information to be analyzed according to the information relevance of each piece of information to be analyzed, so as to obtain highly relevant information and generally relevant information; S45: increasing the priority response weight of the highly relevant information so that the highly relevant information has a higher priority response weight; S46: Acquire the early warning feedback characteristics of the highly correlated information, and analyze the early warning feedback characteristics of the highly correlated information to obtain the security event verification result of the highly correlated information; S47: When the security event verification result shows that the highly relevant information has potential risks, the priority response weight of the common relevant information is adjusted upward.

[0082] Specifically, the warning feedback characteristics of the information to be analyzed are analyzed to determine the security risk levels of the corresponding various information security warning events. Based on pre-set thresholds, the warning characteristics (such as the security risk index) are analyzed to derive the risk level of each event. Each event is classified according to the risk level, which may include high risk, medium risk, and low risk. Through security threshold analysis, the system can accurately assess the risks of different security events, provide data support for subsequent processing steps, improve the accuracy of security event identification, and ensure that important security risk events can be discovered in a timely manner.

[0083] More specifically, based on the security risk level of the information to be analyzed, determine whether it is necessary to conduct associated tracking of the information. Usually, if the risk level of the information to be analyzed is high, the system will initiate associated tracking to evaluate whether the information has potential association with other information. The system can set the standard for associated tracking based on the type, nature or threshold of the event, and can dynamically determine which information requires in-depth tracking based on the security risk level, avoiding redundant analysis of irrelevant information, and reducing the system's processing burden by screening the associated tracking needs, making subsequent steps more efficient.

[0084] More specifically, if the information to be analyzed needs to be tracked for correlation, the system will conduct correlation feature analysis on the security risk level of its warning event based on the preset correlation standards. Time correlation feature: analyze the time attributes of the information to be analyzed, such as the interval and frequency of event occurrence, to evaluate whether there are periodic or sudden security risks. Address correlation feature: analyze whether the IP address, physical location, network nodes, etc. involved in the information are correlated, to help identify cross-regional or cross-device security incidents; through the analysis of multi-dimensional features such as time and address, the system can effectively identify potential related events and improve the accuracy of event tracking. Through in-depth correlation analysis, the system can reveal complex attack patterns (such as cross-regional attacks, time-sensitive attacks, etc.).

[0085] More specifically, based on the characteristics of associated information, the system performs associated tracking on the information to be analyzed, identifies other information to be analyzed that has an associated tracking relationship with the information, and calculates the information association between them. The association between information is calculated based on characteristics such as time association and address association. For example, if two events occur at a similar time and are accessed through the same network path, the association is high. Through effective associated tracking, the system can identify multiple related information and provide a more comprehensive reference for subsequent security decisions. By calculating the information association, the system screens out information with strong correlation and reduces the interference of irrelevant information.

[0086] More specifically, the information is divided according to the information correlation between the information to be analyzed. Usually, the information is divided into two categories according to the degree of correlation: highly correlated information indicates that they may have the same root cause or be part of the same attack chain, and low-correlation information may be just some scattered events or accidental associations. The priority response weight of highly correlated information is adjusted upward to give it a higher priority response weight. This step is to ensure that the system responds to those information with greater risks and higher urgency first. If it is found through verification of highly correlated information that it has potential security risks, the system will increase the priority response weight of ordinary correlated information. Through weight adjustment, the system can optimize resource allocation more intelligently, give priority to high-risk and highly correlated information, reduce the risk of security incidents, and dynamically adjust the response strategy according to the correlation and risk level of the information, so that the system can respond to different types of security threats more flexibly.

[0087] More specifically, the system analyzes highly correlated information based on its early warning feedback features to obtain verification results of security incidents, which may include: Verification of potential security risks: for example, analyzing whether the information has signs of attack and whether it matches known attack patterns; Event confirmation: If the verification results show that the information has potential risks, the corresponding emergency response measures are initiated to ensure that security incidents of related information are fully verified to avoid misjudgments and missed judgments, thereby improving the reliability of the entire security protection system. Through the verification mechanism, the system can dynamically determine which information may trigger a larger range of security incidents, thereby optimizing the response strategy.

[0088] More specifically, when the system confirms that certain information poses a security risk, it immediately initiates emergency response measures. This may include: raising the alarm level and triggering an alarm; automating disposal measures (such as blocking IP addresses, isolating devices, etc.); the system can respond quickly based on risk levels and highly correlated information, reducing the risk of incident spread; by processing highly correlated information, the system can accurately take countermeasures to ensure that security incidents are responded to and handled in a timely manner.

[0089] It is understandable that the system can flexibly adjust the response strategy according to the correlation and risk level of the information, improve processing efficiency and response accuracy, ensure that key security incidents are given priority, reduce the spread of potential security threats, and comprehensively improve the system's security protection capabilities and emergency response efficiency through correlation tracking and risk verification mechanisms.

[0090] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A low-latency event response method based on an information security monitoring and early warning AI platform, characterized in that: include: The data collection layer collects monitoring data of several pre-deployed sensor nodes in real time to obtain monitoring data corresponding to each of the sensor nodes; According to the information encapsulation standard, the monitoring data of each sensor node is subjected to information anomaly identification and spatiotemporal characteristic node value evaluation, and the monitoring data of each sensor node in each time period is subjected to information encapsulation processing according to the obtained anomaly index and node value parameter, so as to obtain an information response chain composed of a plurality of information to be analyzed with priority response weights; wherein the information response chain includes an immediate response chain, a priority response chain and a common response chain; The information analysis layer sequentially analyzes and processes each of the information to be analyzed in the information response chain to obtain early warning feedback features of each of the information to be analyzed; The information response chain is tracked for information correlation according to the early warning feedback characteristics of the information to be analyzed, and the information to be analyzed in the information response chain that has an information correlation relationship with the information to be analyzed is divided into highly correlated information and generally correlated information, and the priority response weight of the highly correlated information is adjusted upward, and it is determined whether to adjust the priority response weight of the generally correlated information according to the early warning feedback characteristics of the highly correlated information, so that the information analysis layer can analyze the information response chain in sequence.

2. The low-latency event response method based on the information security monitoring and early warning AI platform according to claim 1 is characterized in that: The steps of collecting monitoring data of several pre-deployed sensor nodes in real time through the data collection layer to obtain monitoring data corresponding to each of the sensor nodes include: Analyzing the node addresses of several pre-deployed sensor nodes to obtain the node address information of each of the sensor nodes; wherein the node address information includes address positioning information of several address analysis dimensions, and the address analysis dimensions include network node dimension, positioning map dimension, regional function dimension, and traffic association dimension; Setting a data port for each of the sensor nodes according to the node address information of each of the sensor nodes, so that each of the sensor nodes is in an information connection state with the data acquisition layer; The data collected by each sensor node is marked with data location characteristics through the data port of each sensor node to obtain monitoring data with the data location characteristics corresponding to the sensor node, and the monitoring data is transmitted to the data acquisition layer through the information connectivity status between the data port and the data acquisition layer.

3. The low-latency event response method based on the information security monitoring and early warning AI platform as claimed in claim 2 is characterized in that: The steps of identifying the degree of abnormality of information and evaluating the value of spatiotemporal characteristic nodes for the monitoring data of each sensor node according to the information encapsulation standard, and encapsulating the monitoring data of each sensor node in each time period according to the obtained abnormality index and node value parameter to obtain an information response chain consisting of a plurality of information to be analyzed with priority response weights include: According to the information anomaly standard in the information encapsulation standard, the monitoring data of each sensor node is identified for information anomaly, so as to obtain an anomaly index corresponding to the information anomaly standard for each monitoring data; wherein the anomaly index is used to describe the possibility of the monitoring data feeding back an information security warning event; According to the node address value standard in the information encapsulation standard, the monitoring data of each sensor node is evaluated for the data location characteristics and the node value of the time period to which the data belongs, so as to obtain the node value parameter of each monitoring data corresponding to the node address value standard; Information encapsulation processing is performed on each of the monitoring data according to the abnormality index and the node value parameter of each of the monitoring data to obtain an information response chain consisting of a number of information to be analyzed with priority response weights.

4. The low-latency event response method based on the information security monitoring and early warning AI platform as claimed in claim 3 is characterized in that: The steps of performing information encapsulation processing on each of the monitoring data according to the abnormality index and the node value parameter of each of the monitoring data to obtain an information response chain consisting of a plurality of information to be analyzed with priority response weights include: According to the abnormality index of each monitoring data, each monitoring data is divided into priority gradients to obtain the response priority gradients to which each monitoring data belongs; wherein the response priority gradients include immediate response gradients, priority response gradients, and ordinary response gradients; Preliminarily allocating each of the monitoring data according to the response priority gradient to which each of the monitoring data belongs, so as to obtain an immediate response data set, a priority response data set and a common response data set; Analyzing the execution order of each monitoring data within the gradient according to the node value parameter of each monitoring data to obtain the priority within the gradient of each monitoring data; Arranging the monitoring data in the immediate response data set, the priority response data set and the common response data set in a processing order according to the intra-gradient priority of each of the monitoring data to obtain an immediate response chain, a priority response chain and a common response chain; Perform a correlation analysis on the overall response order of each monitoring data in the immediate response chain, the priority response chain and the ordinary response chain, and convert each monitoring data according to the analysis result to obtain the information to be analyzed corresponding to each monitoring data, and combine the immediate response chain, the priority response chain and the ordinary response chain composed of the information to be analyzed to obtain the information response chain.

5. The low-latency event response method based on the information security monitoring and early warning AI platform as claimed in claim 4 is characterized in that: The steps of performing a correlation analysis of the overall response order on each of the monitoring data in the immediate response chain, the priority response chain, and the ordinary response chain, and converting each of the monitoring data according to the analysis result to obtain information to be analyzed corresponding to each of the monitoring data include: Calculating the ratio of the monitoring data to be responded to of the priority response chain and the common response chain to obtain the workload ratio of the priority response chain and the common response chain; Analyzing the chain conversion relationship between the priority response chain and the ordinary response chain according to the workload ratio of the priority response chain and the ordinary response chain to obtain a rotation response rule between the priority response chain and the ordinary response chain; Allocating priority response weights to each of the monitoring data in the priority response chain and the common response chain according to the rotation response rule, so as to obtain information to be analyzed with priority response weights corresponding to each of the monitoring data; According to the preset highest priority response rule, the monitoring data of the immediate response chain are allocated the highest priority response weight to obtain the information to be analyzed with the highest priority response weight corresponding to each monitoring data; wherein the information to be analyzed with the highest priority response weight obtained by the highest priority response rule is arranged at the forefront of the information to be analyzed with the priority response weight obtained by the rotation response rule.

6. The low-latency event response method based on the information security monitoring and early warning AI platform according to claim 1 is characterized in that: The step of sequentially analyzing and processing each of the information to be analyzed in the information response chain through the information analysis layer to obtain the early warning feedback characteristics of each of the information to be analyzed includes: The information response chain is sequentially retrieved and processed for each piece of information to be analyzed to obtain a real-time processing object at the current moment; Based on the pre-trained information security early warning model, data feature extraction and event early warning analysis are performed on the real-time processing object to obtain security risk indexes of several information security early warning events corresponding to the real-time processing object; The security risk indexes of the real-time processing object corresponding to various information security warning events are comprehensively combined to obtain the warning feedback characteristics of the real-time processing object.

7. The low-latency event response method based on the information security monitoring and early warning AI platform as claimed in claim 6 is characterized in that: The steps of tracking the information association of the information response chain according to the early warning feedback characteristics of the information to be analyzed, dividing the information to be analyzed in the information response chain that has an information association relationship with the information to be analyzed into highly associated information and generally associated information, adjusting the priority response weight of the highly associated information upward, and determining whether to adjust the priority response weight of the generally associated information according to the early warning feedback characteristics of the highly associated information, so that the information analysis layer can analyze the information response chain in sequence include: Perform security threshold analysis on the warning feedback characteristics of the information to be analyzed to obtain the security risk levels of various information security warning events warned by the information to be analyzed, and determine the associated tracking requirements for the security risk levels of various security warning events warned by the information to be analyzed to determine whether the information to be analyzed needs information associated tracking; If the information to be analyzed needs to be tracked for information association, then the security risk levels of various information security warning events warned by the information to be analyzed are analyzed for associated information features based on preset association standards to obtain associated information features of the information to be analyzed; wherein the associated information features include time association features and address association features; Performing association tracking processing on the information to be analyzed according to the associated information feature, so as to obtain a number of information to be analyzed having an associated tracking relationship with the information to be analyzed and information association degrees on the information response chain; Classify the information properties of each of the information to be analyzed according to the information relevance of each of the information to be analyzed, so as to obtain highly relevant information and generally relevant information; Performing an upward adjustment on the priority response weight of the highly relevant information so that the highly relevant information has a higher priority response weight; Acquire the early warning feedback characteristics of the highly correlated information, and analyze the early warning feedback characteristics of the highly correlated information to obtain the security event verification result of the highly correlated information; When the security event verification result shows that the highly relevant information has potential hidden dangers, the priority response weight of the common relevant information is adjusted upward.

Images