Network security collaborative linkage system and method based on AI intelligence

Abstract

The invention relates to the technical field of network security, in particular to a network security collaborative linkage system and method based on AI intelligence, and is used for solving the problem that an existing AI network security system lacks a collaborative mechanism and cannot cover comprehensive security requirements. By integrating network monitoring, equipment monitoring and environment monitoring functions, the system breaks through the limitation of traditional single-dimensional monitoring, realizes network-equipment-environment three-in-one protection, realizes comprehensive coverage of network security influence factors, and performs deep analysis on monitoring data by using an AI intelligent analysis technology, so that the security of the network is improved. The accuracy of abnormal behavior identification and potential threat prediction is improved, the overall security of a network system is enhanced, the efficiency and accuracy of emergency response are improved, the stability and reliability of a network environment are ensured, the response efficiency and effect of a network security event are improved, and the overall network security protection capability is effectively improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to an AI-based network security collaborative linkage system and method. Background Art

[0002] With the rapid development of information technology, network security faces increasingly severe challenges. Traditional network security monitoring systems mainly rely on manual operations and passive defense. This model often fails to achieve efficient and comprehensive automatic monitoring, making it difficult to find security vulnerabilities in a timely manner, thereby increasing the risk of system attacks, especially when faced with large amounts of complex data and rapidly changing threats.

[0003] In recent years, the development of artificial intelligence (AI) technology has brought new solutions to the field of network security. By applying AI technology, network security monitoring systems can realize functions such as data analysis, anomaly detection and automatic response, which significantly improves the real-time performance and security of the system. However, most existing AI network security systems are still stuck in a single type of monitoring, lack a coordination mechanism, and cannot cover comprehensive security needs, resulting in low efficiency in security incident response, which limits the network security system's ability to respond to complex and changing security threats.

[0004] Therefore, developing a network security collaborative linkage system and method based on AI intelligence is of great significance to improving the overall network security protection level. Summary of the invention

[0005] In order to overcome the above-mentioned technical problems, the purpose of the present invention is to provide an AI-based network security collaborative linkage system and method, which solves the problem that most of the existing AI network security systems are still stuck in a single type of monitoring, lack a collaborative mechanism, and cannot cover comprehensive security needs, resulting in low efficiency in security incident response, limiting the network security system's ability to respond to complex and changing security threats.

[0006] The purpose of the present invention can be achieved by the following technical solutions: A network security collaborative linkage system based on AI intelligence, including the following modules: The collaborative evaluation module is used to obtain a collaborative evaluation risk value XW according to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and generate an early warning instruction according to the collaborative evaluation risk value XW, and send the early warning instruction to the graded early warning module; wherein the early warning instruction includes a severe risk early warning instruction, a mild risk early warning instruction and a safety early warning instruction; The specific process of the collaborative evaluation module generating the early warning instruction is as follows: The network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor are quantified, and the values ​​of the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor are multiplied by their corresponding preset proportional coefficients, and then the sum of the three is obtained and marked as the collaborative assessment risk value XW; The collaborative evaluation risk value XW is compared with the preset collaborative evaluation risk threshold XWy, and the comparison results are as follows: If the collaborative assessment danger value XW ≥ the collaborative assessment danger threshold XWy, a severe danger warning instruction is generated and sent to the graded warning module; If λ×cooperative evaluation hazard threshold XWy≤cooperative evaluation hazard value XW<cooperative evaluation hazard threshold XWy, a mild hazard warning instruction is generated and sent to the graded warning module; If the collaborative evaluation risk value XW < λ × collaborative evaluation risk threshold XWy, a safety warning instruction is generated and sent to the graded warning module; wherein λ is a preset adjustment factor; The specific process of the classified warning module for classified warning is as follows: After receiving the severe danger warning command, the severe danger alarm sounds; After receiving the minor danger warning command, the minor danger alarm sounds; After receiving the safety warning command, the safety display light is controlled to light up.

[0007] As a preferred embodiment of the present invention, the network security collaborative linkage system based on AI intelligence also includes: The network monitoring module is used to obtain the network monitoring information of the monitored object and send the network monitoring information to the information processing module; wherein the network monitoring information includes transmission information, malicious information and operation information.

[0008] As a preferred implementation of the present invention, the specific process of the network monitoring module acquiring network monitoring information is as follows: Mark the network devices for network security monitoring as monitoring objects; Obtain the number of data output bytes and the number of data received bytes per unit time of the monitored object, and mark them as the input value and the received value respectively; obtain the difference between the input value and the preset data output standard value, and mark it as the input difference; obtain the difference between the received value and the preset data receiving standard value, and mark it as the received difference; obtain the sum of the input difference and the received difference, and mark it as transmission information; Obtain the number of malicious files created per unit time of the monitored object and mark it as the creation value, obtain the total number of malicious files stored in the monitored object at the current moment and mark it as the storage value, obtain the product of the creation value and the storage value and mark it as malicious information; Obtain the number of file reads and writes, file encryptions, file transfers and storages, and file deletions in the preset sensitive file storage area of ​​the monitored object within a unit time, and mark them as read-write values, encryption values, transfer values, and deletion values, respectively; quantify the read-write values, encryption values, transfer values, and deletion values, and multiply the values ​​of the read-write values, encryption values, transfer values, and deletion values ​​by their corresponding preset weight factors, then obtain the sum of the four, and mark it as operation information; The transmission information, malicious information and operation information are sent to the information processing module.

[0009] As a preferred embodiment of the present invention, the network security collaborative linkage system based on AI intelligence also includes: The equipment monitoring module is used to obtain the equipment monitoring information of the monitored object and send the equipment monitoring information to the information processing module; wherein the equipment monitoring information includes occupancy information, temperature setting information and network speed information.

[0010] As a preferred embodiment of the present invention, the specific process of the device monitoring module acquiring the device monitoring information is as follows: Get the CPU usage and memory occupancy of the monitored object at the current moment, get the product of the two, and mark it as occupancy information; Get the device temperature of the monitored object at the current moment and mark it as the temperature setting information; Obtain the average upload speed and download speed of the monitored object at the current moment, obtain the average value between the two, and mark it as the network speed information; The occupancy information, temperature setting information and network speed information are sent to the information processing module.

[0011] As a preferred embodiment of the present invention, the network security collaborative linkage system based on AI intelligence also includes: The environmental monitoring module is used to obtain the environmental monitoring information of the monitored object and send the environmental monitoring information to the information processing module; wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information.

[0012] As a preferred embodiment of the present invention, the specific process of the environmental monitoring module acquiring environmental monitoring information is as follows: Obtain the electric field strength of the environment in which the monitored object is currently located, and mark it as electric field information; Obtain the magnetic field strength of the environment in which the monitored object is currently located, and mark it as magnetic field information; Obtain the temperature of the environment in which the monitored object is currently located and mark it as ambient temperature information; Obtain the humidity of the environment in which the monitored object is currently located and mark it as humidity information; The electric field information, magnetic field information, ambient temperature information and humidity information are sent to the information processing module.

[0013] As a preferred embodiment of the present invention, the network security collaborative linkage system based on AI intelligence also includes: The information processing module is used to obtain the network monitoring risk factor based on the network monitoring information, and send the network monitoring risk factor to the collaborative evaluation module; it is also used to obtain the equipment monitoring risk factor based on the equipment monitoring information, and send the equipment monitoring risk factor to the collaborative evaluation module; it is also used to obtain the environment monitoring risk factor based on the environment monitoring information, and send the environment monitoring risk factor to the collaborative evaluation module.

[0014] As a preferred implementation of the present invention, the specific process of the information processing module obtaining the network monitoring risk factor is as follows: Respectively obtain preset measurement values ​​corresponding to the transmission information, malicious information, and operation information, and mark them as transmission measurement value, malicious measurement value, and operation measurement value, respectively; Obtaining a ratio between transmission information and transmission measurement values, and marking it as a transmission conversion value; obtaining a ratio between malicious information and malicious measurement values, and marking it as a malicious conversion value; obtaining a ratio between operation information and operation measurement values, and marking it as an operation conversion value; Obtain a preset equilateral triangle graphic template, obtain three corners and a center of the equilateral triangle graphic template, and mark them as a first moving point, a second moving point, a third moving point, and a fixed point respectively; Move the first mobile point according to the connecting line between the first mobile point and the fixed point until the distance between the first mobile point and the fixed point is equal to the value of the transmission conversion value, move the second mobile point according to the connecting line between the second mobile point and the fixed point until the distance between the second mobile point and the fixed point is equal to the value of the malicious conversion value, move the third mobile point according to the connecting line between the third mobile point and the fixed point until the distance between the third mobile point and the fixed point is equal to the value of the operation conversion value, form a new triangular figure, obtain the area of ​​the new triangular figure, mark it as the network monitoring risk factor, and send the network monitoring risk factor to the collaborative evaluation module.

[0015] As a preferred embodiment of the present invention, the specific process of the information processing module obtaining the equipment monitoring risk factor is as follows: Respectively obtain preset measurement values ​​corresponding to the occupancy information, the temperature setting information, and the network speed information, and mark them as the occupancy measurement value, the temperature setting measurement value, and the network speed measurement value, respectively; Obtain the ratio between the occupancy information and the occupancy measurement value, and mark it as the occupancy conversion value; obtain the ratio between the temperature setting information and the temperature setting measurement value, and mark it as the temperature setting conversion value; obtain the ratio between the network speed information and the network speed measurement value, and mark it as the network speed conversion value; The occupancy conversion value and the network speed conversion value are used as the major axis and minor axis of the ellipse to draw the bottom of the ellipse respectively, and the set temperature conversion value is used as the side height to form a right elliptical cylinder. The volume of the right elliptical cylinder is obtained and marked as the equipment monitoring hazard factor, and the equipment monitoring hazard factor is sent to the collaborative evaluation module.

[0016] As a preferred embodiment of the present invention, the specific process of the information processing module obtaining the environmental monitoring risk factor is as follows: Respectively obtain preset measurement values ​​corresponding to the electric field information, the magnetic field information, the ambient temperature information, and the humidity information, and mark them as the electric field measurement value, the magnetic field measurement value, the ambient temperature measurement value, and the humidity measurement value, respectively; Obtain the ratio between the electric field information and the electric field measurement value, and mark it as the electric field conversion value, obtain the ratio between the magnetic field information and the magnetic field measurement value, and mark it as the magnetic field conversion value, obtain the ratio between the ambient temperature information and the ambient temperature measurement value, and mark it as the ambient temperature conversion value, obtain the ratio between the humidity information and the humidity measurement value, and mark it as the humidity conversion value; The sum of the electric field conversion value, the magnetic field conversion value, the ambient temperature conversion value and the humidity conversion value is obtained, and marked as the environmental monitoring hazard factor, and the environmental monitoring hazard factor is sent to the collaborative evaluation module.

[0017] As a preferred embodiment of the present invention, a network security collaborative linkage method based on AI intelligence includes the following steps: Step 1: The network monitoring module obtains the network monitoring information of the monitored object, wherein the network monitoring information includes transmission information, malicious information and operation information, and sends the network monitoring information to the information processing module; Step 2: The information processing module obtains the network monitoring risk factor according to the network monitoring information, and sends the network monitoring risk factor to the collaborative evaluation module; Step 3: The device monitoring module obtains the device monitoring information of the monitored object, wherein the device monitoring information includes occupancy information, temperature setting information and network speed information, and sends the device monitoring information to the information processing module; Step 4: The information processing module obtains the equipment monitoring risk factor according to the equipment monitoring information, and sends the equipment monitoring risk factor to the collaborative evaluation module; Step 5: The environmental monitoring module obtains environmental monitoring information of the monitored object, wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information, and sends the environmental monitoring information to the information processing module; Step 6: The information processing module obtains the environmental monitoring risk factor according to the environmental monitoring information, and sends the environmental monitoring risk factor to the collaborative evaluation module; Step 7: The collaborative evaluation module obtains a collaborative evaluation risk value XW according to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and generates a severe risk warning instruction or a mild risk warning instruction or a safety warning instruction according to the collaborative evaluation risk value XW, and sends the severe risk warning instruction or the mild risk warning instruction or the safety warning instruction to the graded warning module; Step 8: The graded warning module sounds a severe danger alarm after receiving a severe danger warning command; sounds a mild danger alarm after receiving a mild danger warning command; and controls the safety display light to light up after receiving a safety warning command.

[0018] Compared with the prior art, the present invention has the following beneficial effects: By integrating network monitoring, equipment monitoring and environmental monitoring functions, we break through the limitations of traditional single-dimensional monitoring, realize the "network-equipment-environment" trinity protection, and achieve comprehensive coverage of factors affecting network security. We also use AI intelligent analysis technology to conduct in-depth analysis of monitoring data to improve the accuracy of abnormal behavior identification and potential threat prediction. This not only enhances the overall security of the network system, but also improves the efficiency and accuracy of emergency response, ensures the stability and reliability of the network environment, improves the efficiency and effectiveness of responding to network security incidents, and effectively enhances the overall network security protection capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0020] Figure 1 This is a principle block diagram of an AI-based network security collaborative linkage system of the present invention.

[0021] Figure 2 This is a flow chart of the network security collaborative linkage method based on AI intelligence of the present invention. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Example 1: Please refer to Figure 1 As shown, this embodiment is a network security collaborative linkage system based on AI intelligence, including the following modules: network monitoring module, information processing module, equipment monitoring module, environment monitoring module, collaborative evaluation module and graded warning module; The network monitoring module is used to obtain the network monitoring information of the monitored object and send the network monitoring information to the information processing module; wherein the network monitoring information includes transmission information, malicious information and operation information; The device monitoring module is used to obtain the device monitoring information of the monitored object and send the device monitoring information to the information processing module; wherein the device monitoring information includes occupancy information, temperature setting information and network speed information; The environmental monitoring module is used to obtain environmental monitoring information of the monitored object and send the environmental monitoring information to the information processing module; wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information; The information processing module is used to obtain the network monitoring risk factor according to the network monitoring information, and send the network monitoring risk factor to the collaborative evaluation module; it is also used to obtain the equipment monitoring risk factor according to the equipment monitoring information, and send the equipment monitoring risk factor to the collaborative evaluation module; it is also used to obtain the environment monitoring risk factor according to the environment monitoring information, and send the environment monitoring risk factor to the collaborative evaluation module; The collaborative evaluation module is used to obtain a collaborative evaluation risk value XW according to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and generate a severe risk warning instruction or a mild risk warning instruction or a safety warning instruction according to the collaborative evaluation risk value XW, and send the severe risk warning instruction or the mild risk warning instruction or the safety warning instruction to the graded warning module; Among them, the graded warning module is used to sound a severe danger alarm after receiving a severe danger warning instruction; sound a mild danger alarm after receiving a mild danger warning instruction; and control the safety display light to light up after receiving a safety warning instruction.

[0024] Example 2: Please refer to Figure 2As shown, this embodiment is a network security collaborative linkage method based on AI intelligence, comprising the following steps: Step 1: The network monitoring module obtains the network monitoring information of the monitored object, wherein the network monitoring information includes transmission information, malicious information and operation information, and sends the network monitoring information to the information processing module; Step 2: The information processing module obtains the network monitoring risk factor according to the network monitoring information, and sends the network monitoring risk factor to the collaborative evaluation module; Step 3: The device monitoring module obtains the device monitoring information of the monitored object, wherein the device monitoring information includes occupancy information, temperature setting information and network speed information, and sends the device monitoring information to the information processing module; Step 4: The information processing module obtains the equipment monitoring risk factor according to the equipment monitoring information, and sends the equipment monitoring risk factor to the collaborative evaluation module; Step 5: The environmental monitoring module obtains environmental monitoring information of the monitored object, wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information, and sends the environmental monitoring information to the information processing module; Step 6: The information processing module obtains the environmental monitoring risk factor according to the environmental monitoring information, and sends the environmental monitoring risk factor to the collaborative evaluation module; Step 7: The collaborative evaluation module obtains a collaborative evaluation risk value XW according to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and generates a severe risk warning instruction or a mild risk warning instruction or a safety warning instruction according to the collaborative evaluation risk value XW, and sends the severe risk warning instruction or the mild risk warning instruction or the safety warning instruction to the graded warning module; Step 8: The graded warning module sounds a severe danger alarm after receiving a severe danger warning command; sounds a mild danger alarm after receiving a mild danger warning command; and controls the safety display light to light up after receiving a safety warning command.

[0025] Embodiment 3: Based on any of the above embodiments, Embodiment 3 of the present invention is a network monitoring module. The function of the network monitoring module is to obtain network monitoring information. The specific process is as follows: The network monitoring module marks the network devices for network security monitoring as monitoring objects; The network monitoring module obtains the number of data output bytes and the number of data received bytes per unit time of the monitored object, and marks them as the input value and the received value respectively, obtains the difference between the input value and the preset data output standard value, and marks it as the input difference value, obtains the difference between the received value and the preset data receiving standard value, and marks it as the received difference value, obtains the sum of the input difference value and the received difference value, and marks it as transmission information; The network monitoring module obtains the number of malicious files created per unit time of the monitored object and marks it as a creation value, obtains the total number of malicious files stored in the monitored object at the current moment and marks it as a storage value, obtains the product of the creation value and the storage value, and marks it as malicious information; The network monitoring module obtains the number of file read and write times, file encryption times, file transfer and storage times, and file deletion times in the preset sensitive file storage area of ​​the monitoring object per unit time, and marks them as read and write values, encryption values, transfer values, and deletion values, respectively, quantizes the read and write values, encryption values, transfer values, and deletion values, multiplies the values ​​of the read and write values, encryption values, transfer values, and deletion values ​​by their corresponding preset weight factors, and then obtains the sum of the four, and marks it as operation information; wherein the preset weight factors corresponding to the read and write values, encryption values, transfer values, and deletion values ​​increase in sequence and are all greater than 1, for example, the user can select the preset weight factor corresponding to the read and write value as 1.1, the preset weight factor corresponding to the encryption value as 1.3, the preset weight factor corresponding to the transfer value as 1.6, and the preset weight factor corresponding to the deletion value as 2.0 based on experience; the user can also select the preset weight factor corresponding to the read and write value as 1.09, the preset weight factor corresponding to the encryption value as 1.26, the preset weight factor corresponding to the transfer value as 1.81, and the preset weight factor corresponding to the deletion value as 2.42 based on experience; The network monitoring module sends the transmission information, malicious information and operation information to the information processing module.

[0026] Embodiment 4: Based on any of the above embodiments, Embodiment 4 of the present invention is a device monitoring module. The function of the device monitoring module is to obtain device monitoring information. The specific process is as follows: The device monitoring module obtains the CPU usage rate and memory occupancy rate of the monitored object at the current moment, obtains the product between the two, and marks it as occupancy information; The equipment monitoring module obtains the equipment temperature of the monitored object at the current moment and marks it as the temperature setting information; The device monitoring module obtains the average upload speed and the average download speed of the monitored object at the current moment, obtains the average value between the two, and marks it as the network speed information; The equipment monitoring module sends the occupancy information, temperature setting information and network speed information to the information processing module.

[0027] Embodiment 5: Based on any of the above embodiments, Embodiment 5 of the present invention is an environment monitoring module. The function of the environment monitoring module is to obtain environment monitoring information. The specific process is as follows: The environment monitoring module obtains the electric field strength of the environment in which the monitored object is currently located and marks it as electric field information; The environment monitoring module obtains the magnetic field strength of the environment in which the monitored object is currently located and marks it as magnetic field information; The environmental monitoring module obtains the temperature of the environment in which the monitored object is currently located and marks it as ambient temperature information; The environmental monitoring module obtains the humidity of the environment in which the monitored object is currently located and marks it as humidity information; The environmental monitoring module sends the electric field information, magnetic field information, ambient temperature information and humidity information to the information processing module.

[0028] Embodiment 6: Based on any of the above embodiments, Embodiment 6 of the present invention is an information processing module, which has three functions: One of the functions is to obtain the network monitoring risk factor. The specific process is as follows: The information processing module obtains preset measurement values ​​corresponding to the transmission information, malicious information and operation information respectively, and marks them as transmission measurement value, malicious measurement value and operation measurement value respectively; wherein the transmission measurement value, malicious measurement value and operation measurement value are all set by the user according to experience, and are not zero; The information processing module obtains the ratio between the transmission information and the transmission measurement value, and marks it as the transmission conversion value, obtains the ratio between the malicious information and the malicious measurement value, and marks it as the malicious conversion value, obtains the ratio between the operation information and the operation measurement value, and marks it as the operation conversion value; The information processing module obtains a preset equilateral triangle graphic template, obtains three angles and a center of the equilateral triangle graphic template, and marks them as a first moving point, a second moving point, a third moving point, and a fixed point respectively; The information processing module moves the first mobile point according to the connection line between the first mobile point and the fixed point until the distance between the first mobile point and the fixed point is equal to the value of the transmission conversion value, moves the second mobile point according to the connection line between the second mobile point and the fixed point until the distance between the second mobile point and the fixed point is equal to the value of the malicious conversion value, moves the third mobile point according to the connection line between the third mobile point and the fixed point until the distance between the third mobile point and the fixed point is equal to the value of the operation conversion value, forms a new triangular figure, obtains the area of ​​the new triangular figure, marks it as a network monitoring risk factor, and sends the network monitoring risk factor to the collaborative evaluation module; The second function is to obtain the equipment monitoring risk factor. The specific process is as follows: The information processing module obtains preset measurement values ​​corresponding to the occupancy information, the temperature setting information and the network speed information respectively, and marks them as the occupancy measurement value, the temperature setting measurement value and the network speed measurement value respectively; wherein the occupancy measurement value, the temperature setting measurement value and the network speed measurement value are all set by the user according to experience, and are not zero; The information processing module obtains the ratio between the occupancy information and the occupancy measurement value, and marks it as the occupancy conversion value, obtains the ratio between the temperature setting information and the temperature setting measurement value, and marks it as the temperature setting conversion value, obtains the ratio between the network speed information and the network speed measurement value, and marks it as the network speed conversion value; The information processing module uses the occupancy conversion value and the network speed conversion value as the major axis and the minor axis of the ellipse to draw the bottom of the ellipse, uses the set temperature conversion value as the side height, forms a straight ellipse, obtains the volume of the straight ellipse, marks it as the equipment monitoring risk factor, and sends the equipment monitoring risk factor to the collaborative evaluation module; The third function is to obtain the environmental monitoring risk factor. The specific process is as follows: The information processing module obtains preset measurement values ​​corresponding to the electric field information, the magnetic field information, the ambient temperature information and the humidity information, and marks them as the electric field measurement value, the magnetic field measurement value, the ambient temperature measurement value and the humidity measurement value, respectively; wherein the electric field measurement value, the magnetic field measurement value, the ambient temperature measurement value and the humidity measurement value are all set by the user according to experience, and are not zero; The information processing module obtains the ratio between the electric field information and the electric field measurement value, and marks it as the electric field conversion value, obtains the ratio between the magnetic field information and the magnetic field measurement value, and marks it as the magnetic field conversion value, obtains the ratio between the ambient temperature information and the ambient temperature measurement value, and marks it as the ambient temperature conversion value, obtains the ratio between the humidity information and the humidity measurement value, and marks it as the humidity conversion value; The information processing module obtains the sum of the electric field conversion value, the magnetic field conversion value, the ambient temperature conversion value and the humidity conversion value, marks it as the environmental monitoring hazard coefficient, and sends the environmental monitoring hazard coefficient to the collaborative evaluation module.

[0029] Embodiment 7: Based on any of the above embodiments, Embodiment 7 of the present invention is a collaborative evaluation module. The function of the collaborative evaluation module is to generate a warning instruction. The specific process is as follows: The collaborative evaluation module quantifies the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and multiplies the values ​​of the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor by their corresponding preset proportional coefficients, and then obtains the sum of the three, and marks it as the collaborative evaluation risk value XW; wherein the preset proportional coefficients corresponding to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor decrease in sequence and are all between 0 and 1, and the sum of the three is 1; for example, the user can select the preset proportional coefficient corresponding to the network monitoring risk factor as 0.62, the preset proportional coefficient corresponding to the equipment monitoring risk factor as 0.25, and the preset proportional coefficient corresponding to the environment monitoring risk factor as 0.13 based on experience; the user can also select the preset proportional coefficient corresponding to the network monitoring risk factor as 0.55, the preset proportional coefficient corresponding to the equipment monitoring risk factor as 0.29, and the preset proportional coefficient corresponding to the environment monitoring risk factor as 0.16 based on experience; The collaborative evaluation module compares the collaborative evaluation risk value XW with the preset collaborative evaluation risk threshold XWy. The comparison results are as follows: If the collaborative assessment danger value XW ≥ the collaborative assessment danger threshold XWy, a severe danger warning instruction is generated and sent to the graded warning module; If λ×cooperative evaluation hazard threshold XWy≤cooperative evaluation hazard value XW<cooperative evaluation hazard threshold XWy, a mild hazard warning instruction is generated and sent to the graded warning module; If the collaborative assessment danger value XW<λ×collaborative assessment danger threshold XWy, a safety warning instruction is generated and sent to the graded warning module; wherein λ is a preset adjustment factor and is between 0 and 1; for example, the user can select λ as 0.71 based on experience; the user can also select λ as 0.47 based on experience.

[0030] Embodiment 8: Based on any of the above embodiments, Embodiment 8 of the present invention is a hierarchical warning module. The function of the hierarchical warning module is to perform classified warnings. The specific process is as follows: The graded warning module sounds a severe danger alarm after receiving the severe danger warning instruction; The graded warning module sounds a mild danger alarm after receiving a mild danger warning instruction; After receiving the safety warning instruction, the graded warning module controls the safety display light to light up.

[0031] Based on the above embodiments 1-8, the working principle of the present invention is as follows: A network security collaborative linkage system and method based on AI intelligence, which obtains network monitoring information of a monitored object through a network monitoring module, obtains a network monitoring risk factor according to the network monitoring information through an information processing module, obtains equipment monitoring information of a monitored object through an equipment monitoring module, obtains an equipment monitoring risk factor according to the equipment monitoring information through an information processing module, obtains environmental monitoring information of a monitored object through an environmental monitoring module, obtains an environmental monitoring risk factor according to the environmental monitoring information through an information processing module, obtains a collaborative evaluation risk value according to the network monitoring risk factor, the equipment monitoring risk factor and the environmental monitoring risk factor through a collaborative evaluation module, generates an early warning instruction according to the collaborative evaluation risk value, and receives a classified early warning through a graded early warning module; the method obtains network monitoring information through network monitoring, and then the network monitoring risk factor obtained according to the network monitoring information based on the AI ​​intelligent analysis technology can comprehensively measure the degree of network risk, and the larger the network monitoring risk factor, the higher the degree of network risk, and then the equipment monitoring information is obtained through equipment monitoring, and then the equipment monitoring risk factor obtained according to the equipment monitoring information based on the AI ​​intelligent analysis technology can comprehensively measure the equipment The system can measure the degree of danger, and the larger the equipment monitoring danger coefficient is, the higher the degree of danger of the equipment is. Then, through environmental monitoring, environmental monitoring information is obtained. Then, based on the environmental monitoring danger coefficient obtained by AI intelligent analysis technology according to the environmental monitoring information, the degree of environmental danger can be comprehensively measured. The larger the environmental monitoring danger coefficient is, the higher the degree of environmental danger is. Then, based on AI intelligent analysis technology, in-depth analysis is carried out, and coordinated response is achieved. The obtained collaborative evaluation danger value can comprehensively measure the degree of network security anomaly. The larger the collaborative evaluation danger value is, the higher the degree of network security anomaly is. Finally, classified warnings are carried out according to the degree of network security anomaly. The system integrates network monitoring, equipment monitoring and environmental monitoring functions, breaks through the limitations of traditional single-dimensional monitoring, realizes the "network-equipment-environment" trinity protection, and achieves comprehensive coverage of factors affecting network security. It also uses AI intelligent analysis technology to conduct in-depth analysis of monitoring data, improves the accuracy of abnormal behavior identification and potential threat prediction, and not only enhances the overall security of the network system, but also improves the efficiency and accuracy of emergency response, ensures the stability and reliability of the network environment, improves the efficiency and effectiveness of responding to network security incidents, and effectively enhances the overall network security protection capabilities.

[0032] In the description of this specification, the description with reference to the terms "one embodiment", "example", "specific example", etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0033] The above contents are merely examples and explanations of the present invention. Those skilled in the art may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the invention or exceed the scope defined in this application, they shall all fall within the protection scope of the present invention.

Claims

1. A network security collaborative linkage system based on AI intelligence, characterized in that: Includes the following modules: A collaborative evaluation module is used to obtain a collaborative evaluation risk value XW according to a network monitoring risk factor, an equipment monitoring risk factor, and an environmental monitoring risk factor, and to generate an early warning instruction according to the collaborative evaluation risk value XW; The specific process of the collaborative evaluation module generating the early warning instruction is as follows: Quantify the network monitoring risk factor, equipment monitoring risk factor and environmental monitoring risk factor to obtain the collaborative evaluation risk value XW; The collaborative evaluation risk value XW is compared with the preset collaborative evaluation risk threshold XWy, and the comparison results are as follows: If the collaborative assessment danger value XW ≥ the collaborative assessment danger threshold XWy, a severe danger warning instruction is generated; if λ×the collaborative assessment danger threshold XWy ≤ the collaborative assessment danger value XW < the collaborative assessment danger threshold XWy, a mild danger warning instruction is generated; If the collaborative evaluation hazard value XW<λ×collaborative evaluation hazard threshold XWy, a safety warning instruction is generated; A graded warning module is used to receive warning instructions and perform classified warnings; The specific process of the classified warning module for classified warning is as follows: A severe danger alarm will sound after receiving a severe danger warning command, a mild danger alarm will sound after receiving a mild danger warning command, and the safety display light will be turned on after receiving a safety warning command.

2. According to claim 1, a network security collaborative linkage system based on AI intelligence is characterized in that: Also includes: The network monitoring module is used to obtain network monitoring information of the monitored object; wherein the network monitoring information includes transmission information, malicious information and operation information.

3. According to claim 2, a network security collaborative linkage system based on AI intelligence is characterized in that: The specific process of the network monitoring module obtaining network monitoring information is as follows: Mark the network equipment for network security monitoring as the monitoring object; obtain the number of data output bytes and the number of data received bytes per unit time of the monitoring object, and mark them as the input value and the received value respectively; obtain the difference between the input value and the preset data output standard value, and mark it as the input difference; obtain the difference between the received value and the preset data receiving standard value, and mark it as the received difference; obtain the sum of the input difference and the received difference, and mark it as transmission information; Obtain the number of malicious files created per unit time of the monitored object and mark it as the creation value, obtain the total number of malicious files stored in the monitored object at the current moment and mark it as the storage value, obtain the product of the creation value and the storage value and mark it as malicious information; The number of file read and write times, file encryption times, file transfer and storage times, and file deletion times in the preset sensitive file storage area of ​​the monitored object per unit time are obtained, and they are marked as read and write values, encryption values, transfer values, and deletion values ​​respectively. The read and write values, encryption values, transfer values, and deletion values ​​are quantified to obtain operation information.

4. According to claim 1, a network security collaborative linkage system based on AI intelligence is characterized in that: Also includes: The device monitoring module is used to obtain the device monitoring information of the monitored object; wherein the device monitoring information includes occupancy information, temperature setting information and network speed information.

5. According to claim 4, a network security collaborative linkage system based on AI intelligence is characterized in that: The specific process of the device monitoring module obtaining device monitoring information is as follows: Get the CPU usage rate and memory occupancy rate of the monitored object at the current moment, obtain the product of the two, and mark it as occupancy information; get the device temperature of the monitored object at the current moment, and mark it as temperature setting information; get the average upload rate and average download rate of the network speed of the monitored object at the current moment, obtain the average value between the two, and mark it as network speed information.

6. According to claim 1, a network security collaborative linkage system based on AI intelligence is characterized in that: It also includes: an environmental monitoring module, which is used to obtain environmental monitoring information of the monitored object; wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information.

7. The AI-based network security collaborative linkage system according to claim 6 is characterized in that: The specific process of the environmental monitoring module obtaining environmental monitoring information is as follows: The electric field strength, magnetic field strength, temperature and humidity of the environment in which the monitored object is currently located are obtained, and they are marked as electric field information, magnetic field information, ambient temperature information and humidity information respectively.

8. The AI-based network security collaborative linkage system according to claim 1 is characterized in that: Also includes: The information processing module is used to obtain the network monitoring risk factor based on the network monitoring information; it is also used to obtain the equipment monitoring risk factor based on the equipment monitoring information; it is also used to obtain the environment monitoring risk factor based on the environment monitoring information.

9. The AI-based network security collaborative linkage system according to claim 8 is characterized in that: The specific process of the information processing module obtaining the network monitoring risk factor is as follows: Obtaining a ratio between transmission information and transmission measurement values, and marking it as a transmission conversion value; obtaining a ratio between malicious information and malicious measurement values, and marking it as a malicious conversion value; obtaining a ratio between operation information and operation measurement values, and marking it as an operation conversion value; Obtaining a network monitoring risk factor according to the transmission conversion value, the malicious conversion value, and the operation conversion value, and sending the network monitoring risk factor to the collaborative evaluation module; The specific process of the information processing module obtaining the equipment monitoring risk factor is as follows: Obtain the ratio between the occupancy information and the occupancy measurement value, and mark it as the occupancy conversion value; obtain the ratio between the temperature setting information and the temperature setting measurement value, and mark it as the temperature setting conversion value; obtain the ratio between the network speed information and the network speed measurement value, and mark it as the network speed conversion value; The equipment monitoring risk factor is obtained according to the occupancy conversion value, the network speed conversion value and the set temperature conversion value, and the equipment monitoring risk factor is sent to the collaborative evaluation module; The specific process of the information processing module obtaining the environmental monitoring risk factor is as follows: Obtain the ratio between the electric field information and the electric field measurement value, and mark it as the electric field conversion value, obtain the ratio between the magnetic field information and the magnetic field measurement value, and mark it as the magnetic field conversion value, obtain the ratio between the ambient temperature information and the ambient temperature measurement value, and mark it as the ambient temperature conversion value, obtain the ratio between the humidity information and the humidity measurement value, and mark it as the humidity conversion value; The environmental monitoring hazard factor is obtained according to the electric field conversion value, the magnetic field conversion value, the ambient temperature conversion value and the humidity conversion value, and the environmental monitoring hazard factor is sent to the collaborative evaluation module.

10. A network security collaborative linkage method based on AI intelligence, characterized in that: The following steps are involved: Step 1: The network monitoring module obtains the network monitoring information of the monitored object, wherein the network monitoring information includes transmission information, malicious information and operation information, and sends the network monitoring information to the information processing module; Step 2: The information processing module obtains the network monitoring risk factor according to the network monitoring information, and sends the network monitoring risk factor to the collaborative evaluation module; Step 3: The device monitoring module obtains the device monitoring information of the monitored object, wherein the device monitoring information includes occupancy information, temperature setting information and network speed information, and sends the device monitoring information to the information processing module; Step 4: The information processing module obtains the equipment monitoring risk factor according to the equipment monitoring information, and sends the equipment monitoring risk factor to the collaborative evaluation module; Step 5: The environmental monitoring module obtains environmental monitoring information of the monitored object, wherein the environmental monitoring information includes electric field information, magnetic field information, ambient temperature information and humidity information, and sends the environmental monitoring information to the information processing module; Step 6: The information processing module obtains the environmental monitoring risk factor according to the environmental monitoring information, and sends the environmental monitoring risk factor to the collaborative evaluation module; Step 7: The collaborative evaluation module obtains a collaborative evaluation risk value XW according to the network monitoring risk factor, the equipment monitoring risk factor and the environment monitoring risk factor, and generates a severe risk warning instruction or a mild risk warning instruction or a safety warning instruction according to the collaborative evaluation risk value XW, and sends the severe risk warning instruction or the mild risk warning instruction or the safety warning instruction to the graded warning module; Step 8: The graded warning module sounds a severe danger alarm after receiving a severe danger warning command; sounds a mild danger alarm after receiving a mild danger warning command; and controls the safety display light to light up after receiving a safety warning command.

Images