Network information security verification management system and method based on artificial intelligence

Abstract

The invention discloses a network information security verification management system and method based on artificial intelligence, and relates to the technical field of artificial intelligence data management, and the method comprises the following steps: collecting network flow data and user behavior data, constructing a user behavior mode model through employing a machine learning algorithm, and calculating the abnormal degree of a user network behavior; calculating a safety coefficient through the abnormal degree quantized value of the user network behavior, comparing the safety coefficient with a preset threshold range, and judging a risk level of the user network behavior; marking user information with security threats, and counting network traffic fluctuation amplitude and user abnormal operation frequency; by means of the network information security verification management method and system, network information security verification management is achieved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence data management technology, and in particular to an artificial intelligence-based network information security verification management system and method. Background Art

[0002] With the rapid development of information technology and the increasing popularity of network applications, the network environment has become increasingly complex and diverse. In the daily operations of enterprises, government agencies and various organizations, network information security has become a key factor in ensuring the normal operation of business. Network information systems face multiple security threats from both inside and outside, including hacker attacks, malware intrusions and illegal operations by internal personnel. These threats seriously affect the confidentiality, integrity and availability of network information.

[0003] In the current field of network information security management, traditional security verification management methods have exposed many shortcomings when dealing with complex and changing network environments and growing security risks. First, the overall assessment and management of network information security lacks systematicity and foresight. Traditional methods usually analyze network traffic or user behavior in isolation, failing to fully consider the close relationship between the two and their combined impact on network security. Secondly, there is a lack of flexibility in adjusting the frequency of security monitoring of equipment and systems, and the monitoring strategy cannot be dynamically optimized according to the actual security risk situation, resulting in waste of resources or insufficient monitoring during critical periods. It is unable to provide comprehensive and accurate support for network security decision-making, and it is difficult to meet the needs of modern network information security management. Summary of the invention

[0004] The purpose of the present invention is to provide a network information security verification management system and method based on artificial intelligence to solve the problems raised in the prior art.

[0005] To achieve the above object, the present invention provides the following technical solution: a network information security verification management method based on artificial intelligence, the method comprising the following steps: Collect network traffic data and user behavior data, use machine learning algorithms to build user behavior pattern models, and calculate the degree of abnormality of user network behavior; The safety factor is calculated by quantifying the abnormality of the user's network behavior and compared with the preset threshold range to determine the risk level of the user's network behavior; Mark user information that poses a security threat, and count network traffic fluctuations and user abnormal operation frequencies; Calculate network information security risk scores and adjust monitoring frequency.

[0006] Collect network traffic data and user behavior data from network devices, user terminals, and information sources preset by the security log system, divide them according to fixed time intervals, count the network information features in each time period, and generate a first network information data set N divided by time period i , N i ={F i1 、F i2 , ..., F im}, where i represents the time period index, i=1, 2, ..., I, I represents the total number of time periods, F i1 、F i2 , ..., F im They represent the 1st, 2nd, ..., mth network information features in the i-th time period, respectively, and m represents the total number of network information features in each time period; A machine learning algorithm is used to extract features from the first network information data set, including user access frequency, access period, and common operations, and a user behavior pattern model is constructed. The model includes m features that characterize the user's normal network behavior, denoted as M={M1, M2, ..., M m}, where M m represents the mth feature value; Obtain the second network information data N of the target user within a period of time j , by extracting the user's access frequency, access period and common operations in the time period, converting them into the target user behavior vector, using the user behavior pattern model, taking cosine similarity as a metric to measure the difference between the target user behavior and the normal behavior, calculating the maximum cosine similarity between the target user behavior vector and the normal behavior vector in the user behavior pattern model, taking the complement of the cosine similarity, and obtaining the quantitative value D of the abnormal degree of the target user's network behavior.

[0007] According to the quantitative value of the abnormal degree of the target user's network behavior, the safety factor of the user's network behavior is obtained according to the following formula, and the calculation formula is as follows: S=1-(D / D max ), where S represents the safety factor of the user's network behavior, D represents the quantitative value of the abnormal degree of the target user's network behavior, and D max Indicates the upper limit of the preset maximum abnormality degree quantitative value. When the safety factor S of the user's network behavior does not belong to the preset safety factor threshold range [C, F], it is determined that the user's network behavior has a security threat, where C represents the lower limit of the preset safety factor threshold, which is set by historical data, and F represents the upper limit of the preset safety factor threshold, which is set by historical data; When S≤C, it is determined that there are high-risk anomalies in the user's network behavior, such as possible malicious attacks, account theft, etc. At this time, a high-level security verification process is initiated, such as requiring users to perform multi-factor verification such as fingerprint recognition and face recognition, and restricting the user's current network access, allowing only access to necessary security resources. At the same time, an in-depth analysis of related network traffic is performed to track possible attack sources and attack paths; when S≥D, it is determined that there are low-risk anomalies in the user's network behavior, such as changes in behavior patterns that may be caused by temporary changes in the network environment or the user's use of new devices. At this time, the user is prompted to inform him that there are certain anomalies in his network behavior, and the user is advised to confirm his own operations. At the same time, relevant abnormal information is recorded, and the user's subsequent network behavior is continuously observed. If the abnormal situation persists or worsens, the security verification level is further improved and monitoring efforts are strengthened.

[0008] Real-time data is collected through network traffic monitoring equipment and user behavior analysis systems. During the collection process, user information with security threats is marked and the fluctuation range of network traffic is extracted as F. w , w=1, 2, ..., W, W represents the number of nodes monitoring network traffic fluctuations, and the frequency of abnormal user operations is counted to obtain F u , u=1, 2, ..., U, where U represents the number of different categories of statistical user operation behaviors. w / F max )≥f' network traffic fluctuation amplitude data is accumulated to obtain Q1, where F w Indicates the fluctuation range of network traffic, F max represents the maximum fluctuation range allowed for network traffic, f' represents the preset threshold of the network traffic fluctuation ratio, which is set by historical data, and Q1 represents the number of nodes whose ratio of network traffic fluctuation to the maximum allowed fluctuation exceeds the preset threshold among all nodes monitoring network traffic fluctuation; Yes (F u / F umax )≥u', the abnormal operation frequency data of users is accumulated to obtain Q2, where F u Indicates the frequency of abnormal user operations, F umax It represents the upper limit of the user's normal operation frequency, u' represents the preset threshold of the user's abnormal operation frequency ratio, which is set by historical data, and Q2 represents the number of operation categories in which the ratio of the user's abnormal operation frequency to the upper limit of the normal operation frequency exceeds the preset threshold in the statistics of different categories of user operation behaviors.

[0009] The risk score of network information security is calculated according to the formula R=R0-λ1 / (Q1 / W)-λ2 / (Q2 / U); wherein R represents the risk score of network information security, R0 represents the initial score of network information security risk, Q1 represents the number of nodes whose ratio of network traffic fluctuation amplitude to the maximum allowable fluctuation amplitude exceeds the preset threshold among all nodes monitoring network traffic fluctuation, W represents the number of nodes monitoring network traffic fluctuation, Q2 represents the number of operation categories whose ratio of abnormal user operation frequency to the upper limit of normal operation frequency exceeds the preset threshold among different categories of statistical user operation behaviors, U represents the number of different categories of statistical user operation behaviors, and λ1 and λ2 represent weight values; The monitoring frequency is adjusted according to the calculated risk score of network information security, and the initial monitoring frequency is set to f0. The monitoring frequency adjustment formula is defined as follows: F=f0+k*R; wherein F represents the monitoring frequency, f0 represents the initial monitoring frequency, k represents the adjustment coefficient, and R represents the risk score of network information security.

[0010] A network information security verification and management system based on artificial intelligence, the system includes a data acquisition module, an anomaly detection module, a security assessment module and a monitoring frequency adjustment module, the data acquisition module is used to collect network traffic data and user behavior data, the anomaly detection module is used to use a machine learning algorithm to build a user behavior pattern model, and calculate the degree of abnormality of the user's network behavior, the security assessment module is used to calculate the safety factor through the quantified value of the degree of abnormality of the user's network behavior, and compare it with a preset threshold range to determine the risk level of the user's network behavior, and mark user information that poses a security threat, count the network traffic fluctuation amplitude and the user's abnormal operation frequency, and the monitoring frequency adjustment module is used to calculate the network information security risk score and adjust the monitoring frequency.

[0011] The data collection module includes a network traffic collection unit and a user behavior collection unit. The network traffic collection unit is used to collect network traffic data through network equipment, and the user behavior collection unit is used to collect user behavior data through user terminals and information sources preset by the security log system, and divide the data according to fixed time intervals, count the network information features in each time period, and generate a first network information data set divided by time period. The output end of the data collection module is connected to the input end of the anomaly detection module.

[0012] The anomaly detection module includes a feature extraction unit, a user behavior pattern modeling unit and an anomaly degree calculation unit. The feature extraction unit is used to extract features from the collected first network information data set using a machine learning algorithm, including user access frequency, access time period and common operations. The user behavior pattern modeling unit is used to construct a user behavior pattern model based on the extracted features, and the model contains features that characterize the user's normal network behavior. The anomaly degree calculation unit is used to obtain the second network information data of the target user and convert it into a behavior vector, and use the user behavior pattern model and cosine similarity to calculate the quantitative value of the abnormal degree of the target user's network behavior, and quantify the degree of deviation of the user behavior by comparing it with normal behavior. The output end of the feature extraction unit is connected to the input end of the user behavior pattern modeling unit, the output end of the user behavior pattern modeling unit is connected to the input end of the anomaly degree calculation unit, and the output end of the anomaly degree calculation unit is connected to the input end of the security assessment module.

[0013] The security assessment module includes a safety factor calculation unit and a traffic fluctuation and operation statistics unit. The safety factor calculation unit is used to calculate the safety factor according to the safety factor calculation formula of the user's network behavior based on the quantified value of the abnormal degree of the user's network behavior, and compare it with the preset threshold range to determine the risk level of the user's network behavior. The traffic fluctuation and operation statistics unit is used to mark user information that poses a security threat during the collection of real-time data, and at the same time count the network traffic fluctuation amplitude and the user's abnormal operation frequency. The output end of the safety factor calculation unit is connected to the input end of the traffic fluctuation and operation statistics unit, and the output end of the traffic fluctuation and operation statistics unit is connected to the input end of the monitoring frequency adjustment module.

[0014] The monitoring frequency adjustment module includes a risk score calculation unit and a monitoring frequency adjustment unit. The risk score calculation unit is used to calculate the risk score of network information security based on the statistical data using the risk score calculation formula of network information security, and comprehensively evaluate the overall security risk level of the network. The monitoring frequency adjustment unit is used to adjust the monitoring frequency based on the calculated risk score of network information security. The output end of the risk score calculation unit is connected to the input end of the monitoring frequency adjustment unit.

[0015] Compared with the prior art, the present invention has the following beneficial effects: 1. Breaking through the limitations of traditional fixed rules and thresholds, it can identify complex user behavior anomalies by building a user behavior pattern model and analyzing multi-dimensional network data. It can make comprehensive judgments from multiple dimensions, including the time series, frequency distribution, protocol characteristics, and historical patterns and operating habits of network traffic, and distinguish between normal behavior changes and security threats. 2. Considering the close relationship between network traffic and user behavior and their combined impact on network security, conduct a comprehensive and systematic assessment of network information security. By comprehensively analyzing factors such as the fluctuation range of network traffic and the frequency of abnormal user operations, calculate the network information security risk score, and dynamically adjust the monitoring frequency according to the risk situation to achieve a reasonable allocation of security management resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a flow chart of the network information security verification management method based on artificial intelligence of the present invention; Figure 2 It is a structural diagram of the network information security verification management system based on artificial intelligence of the present invention. DETAILED DESCRIPTION

[0017] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0018] In the embodiment: Figure 1-Figure 2 As shown, the present invention provides a technical solution, a network information security verification management method based on artificial intelligence, the method comprising the following steps: Collect network traffic data and user behavior data, use machine learning algorithms to build user behavior pattern models, and calculate the degree of abnormality of user network behavior; The safety factor is calculated by quantifying the abnormality of the user's network behavior and compared with the preset threshold range to determine the risk level of the user's network behavior; Mark user information that poses a security threat, and count network traffic fluctuations and user abnormal operation frequencies; Calculate network information security risk scores and adjust monitoring frequency.

[0019] Collect network traffic data and user behavior data from network devices, user terminals, and information sources preset by the security log system, divide them according to fixed time intervals, count the network information features in each time period, and generate a first network information data set N divided by time period i , N i ={F i1 、F i2 , ..., F im}, where i represents the time period index, i=1, 2, ..., I, I represents the total number of time periods, F i1 、F i2 , ..., Fim They represent the 1st, 2nd, ..., mth network information features in the i-th time period, respectively, and m represents the total number of network information features in each time period; Specifically, within a week, network traffic data and user behavior data are collected from network devices, user terminals, and information sources preset in the security log system. A total of 100 GB of network traffic data and 500,000 pieces of user behavior data are collected. The data are divided into fixed time intervals of one hour, and a total of 168 time periods are obtained. Each time period has an average of 20 network information features, network traffic features such as the average network delay, data packet transmission rate, and traffic proportion of a specific port in each time period, as well as user behavior features such as the number of user logins, the number of file operations, and the frequency of accessing different application systems, to generate a first network information data set N divided by time periods i ; A machine learning algorithm is used to extract features from the first network information data set, including user access frequency, access period, and common operations, and a user behavior pattern model is constructed. The model includes m features that characterize the user's normal network behavior, denoted as M={M1, M2, ..., M m}, where M m represents the mth feature value; Specifically, a machine learning algorithm of a random forest algorithm is used to extract features from the first network information data set, including user access frequency, access time period, and common operations, and a user behavior pattern model is constructed after training. The model includes 20 features that characterize normal user network behaviors. Under normal circumstances, the average number of logins by users during working hours from 9:00 to 18:00 is 5 times, and the frequency of access to a specific system is 3 times per hour. This is only an example and is not specifically limited. Obtain the second network information data N of the target user within a period of time j , by extracting the user's access frequency, access period and common operations in the time period, converting them into a target user behavior vector, using the user behavior pattern model, using cosine similarity as a measurement indicator to measure the difference between the target user behavior and the normal behavior, calculating the maximum cosine similarity between the target user behavior vector and the normal behavior vector in the user behavior pattern model, taking the complement of the cosine similarity, and obtaining the quantitative value D of the abnormal degree of the target user's network behavior; Specifically, obtain the second network information data N of the target user within one week j, by extracting the user access frequency, access period and common operations in this time period, and converting them into the target user behavior vector, using the constructed user behavior pattern model, and taking cosine similarity as the metric to measure the difference between the target user behavior and the normal behavior, a user made 10 login attempts during non-working hours from 2:00 to 4:00 on a certain day, and the frequency of access to sensitive data reached 5 times per hour, which was far beyond the normal range. The maximum cosine similarity between its behavior vector and the normal behavior vector in the user behavior pattern model was calculated to be 0.2. Taking the complement of the cosine similarity, we get the quantitative value of the abnormal degree of the target user's network behavior D=0.8.

[0020] According to the quantitative value of the abnormal degree of the target user's network behavior, the safety factor of the user's network behavior is obtained according to the following formula, and the calculation formula is as follows: S=1-(D / D max ), where S represents the safety factor of the user's network behavior, D represents the quantitative value of the abnormal degree of the target user's network behavior, and D max Indicates the upper limit of the preset maximum abnormality degree quantitative value. When the safety factor S of the user's network behavior does not belong to the preset safety factor threshold range [C, F], it is determined that the user's network behavior has a security threat, where C represents the lower limit of the preset safety factor threshold, which is set by historical data, and F represents the upper limit of the preset safety factor threshold, which is set by historical data; Specifically, the preset maximum abnormality quantization value upper limit D max =1, according to the target user's network behavior abnormality degree quantification value D, according to the formula S=1-(D / D max ) The safety factor S=0.2 of the user's network behavior is calculated. Assuming that the preset safety factor threshold range is [0.3, 0.7], since S=0.2 does not belong to this range, it is determined that the user's network behavior has a security threat, and since S≤0.3, it is determined that the user's network behavior has a high-risk anomaly; When S≤C, it is determined that there are high-risk anomalies in the user's network behavior, such as possible malicious attacks, account theft, etc. At this time, a high-level security verification process is initiated, such as requiring users to perform multi-factor verification such as fingerprint recognition and face recognition, and restricting the user's current network access, allowing only access to necessary security resources. At the same time, an in-depth analysis of related network traffic is performed to track possible attack sources and attack paths; when S≥D, it is determined that there are low-risk anomalies in the user's network behavior, such as changes in behavior patterns that may be caused by temporary changes in the network environment or the user's use of new devices. At this time, the user is prompted to inform him that there are certain anomalies in his network behavior, and the user is advised to confirm his own operations. At the same time, relevant abnormal information is recorded, and the user's subsequent network behavior is continuously observed. If the abnormal situation persists or worsens, the security verification level is further improved and monitoring efforts are strengthened.

[0021] Real-time data is collected through network traffic monitoring equipment and user behavior analysis systems. During the collection process, user information with security threats is marked and the fluctuation range of network traffic is extracted as F. w , w=1, 2, ..., W, W represents the number of nodes monitoring network traffic fluctuations, and the frequency of abnormal user operations is counted to obtain F u , u=1, 2, ..., U, where U represents the number of different categories of statistical user operation behaviors. w / F max )≥f', the network traffic fluctuation amplitude data is accumulated to obtain Q1, where F max represents the maximum fluctuation range allowed for network traffic, f' represents the preset threshold of the network traffic fluctuation ratio, which is set by historical data, and Q1 represents the number of nodes whose ratio of network traffic fluctuation to the maximum allowed fluctuation exceeds the preset threshold among all nodes monitoring network traffic fluctuation; Yes (F u / F umax )≥u', the abnormal operation frequency data of users is accumulated to obtain Q2, where F umax represents the upper limit of the user's normal operation frequency, u' represents the preset threshold of the user's abnormal operation frequency ratio, which is set according to historical data, and Q2 represents the number of operation categories whose ratio of the user's abnormal operation frequency to the upper limit of the normal operation frequency exceeds the preset threshold in the statistics of different categories of user operation behaviors; Specifically, real-time data is collected through network traffic monitoring equipment and user behavior analysis systems. During the collection process, user information with security threats is marked. In one day of monitoring, the number of nodes that monitor network traffic fluctuations is W=100, and the fluctuation amplitude of network traffic is extracted as F w(w=1, 2, ..., 100), it is found that there are 20 nodes with the largest network traffic fluctuations (F w / F max ) ≥ f' (assuming F max =100, f'=0.6), that is, Q1=20. At the same time, the number of different categories of user operation behaviors is counted, U=50, and the frequency of abnormal user operations is counted to obtain F u (u=1, 2, ..., 50), where there are 10 types of abnormal operation frequencies of user operations (F u / F umax ) ≥ u' (assuming F umax =10, u'=0.8), that is, Q2=10.

[0022] The risk score of network information security is calculated according to the formula R=R0-λ1 / (Q1 / W)-λ2 / (Q2 / U); wherein R represents the risk score of network information security, R0 represents the initial score of network information security risk, Q1 represents the number of nodes whose ratio of network traffic fluctuation amplitude to the maximum allowable fluctuation amplitude exceeds the preset threshold among all nodes monitoring network traffic fluctuation, W represents the number of nodes monitoring network traffic fluctuation, Q2 represents the number of operation categories whose ratio of abnormal user operation frequency to the upper limit of normal operation frequency exceeds the preset threshold among different categories of statistical user operation behaviors, U represents the number of different categories of statistical user operation behaviors, and λ1 and λ2 represent weight values; Specifically, the risk score of network information security is calculated according to the formula R=R0-λ1 / (Q1 / W)-λ2 / (Q2 / U). Assuming that the initial score of network information security risk is R0=80, the weight value λ1=10, λ2=15, then R=45; The monitoring frequency is adjusted according to the calculated risk score of network information security, and the initial monitoring frequency is set to f0. The monitoring frequency adjustment formula is defined as follows: F=f0+k*R; where F represents the monitoring frequency, f0 represents the initial monitoring frequency, k represents the adjustment coefficient, and R represents the risk score of network information security; Specifically, the initial monitoring frequency is set to f0=1 time / minute, and the monitoring frequency is adjusted according to the monitoring frequency adjustment formula. Assuming k=0.1, the adjusted monitoring frequency is F=5.5 times / minute.

[0023] A network information security verification and management system based on artificial intelligence, the system includes a data acquisition module, an anomaly detection module, a security assessment module and a monitoring frequency adjustment module, the data acquisition module is used to collect network traffic data and user behavior data, the anomaly detection module is used to use a machine learning algorithm to build a user behavior pattern model, and calculate the degree of abnormality of the user's network behavior, the security assessment module is used to calculate the safety factor through the quantified value of the degree of abnormality of the user's network behavior, and compare it with a preset threshold range to determine the risk level of the user's network behavior, and mark user information that poses a security threat, count the network traffic fluctuation amplitude and the user's abnormal operation frequency, and the monitoring frequency adjustment module is used to calculate the network information security risk score and adjust the monitoring frequency.

[0024] The data collection module includes a network traffic collection unit and a user behavior collection unit. The network traffic collection unit is used to collect network traffic data through network equipment, and the user behavior collection unit is used to collect user behavior data through user terminals and information sources preset by the security log system, and divide the data according to fixed time intervals, count the network information features in each time period, and generate a first network information data set divided by time period. The output end of the data collection module is connected to the input end of the anomaly detection module.

[0025] The anomaly detection module includes a feature extraction unit, a user behavior pattern modeling unit and an anomaly degree calculation unit. The feature extraction unit is used to extract features from the collected first network information data set using a machine learning algorithm, including user access frequency, access time period and common operations. The user behavior pattern modeling unit is used to construct a user behavior pattern model based on the extracted features, and the model contains features that characterize the user's normal network behavior. The anomaly degree calculation unit is used to obtain the second network information data of the target user and convert it into a behavior vector, and use the user behavior pattern model and cosine similarity to calculate the quantitative value of the abnormal degree of the target user's network behavior, and quantify the degree of deviation of the user behavior by comparing it with normal behavior. The output end of the feature extraction unit is connected to the input end of the user behavior pattern modeling unit, the output end of the user behavior pattern modeling unit is connected to the input end of the anomaly degree calculation unit, and the output end of the anomaly degree calculation unit is connected to the input end of the security assessment module.

[0026] The security assessment module includes a safety factor calculation unit and a traffic fluctuation and operation statistics unit. The safety factor calculation unit is used to calculate the safety factor according to the safety factor calculation formula of the user's network behavior based on the quantified value of the abnormal degree of the user's network behavior, and compare it with the preset threshold range to determine the risk level of the user's network behavior. The traffic fluctuation and operation statistics unit is used to mark user information that poses a security threat during the collection of real-time data, and at the same time count the network traffic fluctuation amplitude and the user's abnormal operation frequency. The output end of the safety factor calculation unit is connected to the input end of the traffic fluctuation and operation statistics unit, and the output end of the traffic fluctuation and operation statistics unit is connected to the input end of the monitoring frequency adjustment module.

[0027] The monitoring frequency adjustment module includes a risk score calculation unit and a monitoring frequency adjustment unit. The risk score calculation unit is used to calculate the risk score of network information security based on the statistical data using the risk score calculation formula of network information security, and comprehensively evaluate the overall security risk level of the network. The monitoring frequency adjustment unit is used to adjust the monitoring frequency based on the calculated risk score of network information security. The output end of the risk score calculation unit is connected to the input end of the monitoring frequency adjustment unit.

[0028] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference numeral in a claim should not be considered as limiting the claim to which it relates.

Claims

1. A network information security verification management method based on artificial intelligence, characterized in that: The method comprises the following steps: Collect network traffic data and user behavior data, use machine learning algorithms to build user behavior pattern models, and calculate the degree of abnormality of user network behavior; The safety factor is calculated by quantifying the abnormality of the user's network behavior and compared with the preset threshold range to determine the risk level of the user's network behavior; Mark user information that poses a security threat, and count network traffic fluctuations and user abnormal operation frequencies; Calculate network information security risk scores and adjust monitoring frequency.

2. The network information security verification management method based on artificial intelligence according to claim 1 is characterized by: Collect network traffic data and user behavior data from network devices, user terminals, and information sources preset by the security log system, divide them according to fixed time intervals, count the network information features in each time period, and generate a first network information data set N divided by time period i , N i ={F i1 、F i2 , ..., F im }, where i represents the time period index, i=1, 2, ..., I, I represents the total number of time periods, F i1 、F i2 , ..., F im They represent the 1st, 2nd, ..., mth network information features in the i-th time period, respectively, and m represents the total number of network information features in each time period; A machine learning algorithm is used to extract features from the first network information data set, including user access frequency, access period, and common operations, and a user behavior pattern model is constructed. The model includes m features that characterize the user's normal network behavior, denoted as M={M1, M2, ..., M m }, where M m represents the mth feature value; Obtain the second network information data N of the target user within a period of time j , by extracting the user's access frequency, access period and common operations in the time period, converting them into the target user behavior vector, using the user behavior pattern model, taking cosine similarity as a metric to measure the difference between the target user behavior and the normal behavior, calculating the maximum cosine similarity between the target user behavior vector and the normal behavior vector in the user behavior pattern model, taking the complement of the cosine similarity, and obtaining the quantitative value D of the abnormal degree of the target user's network behavior.

3. The network information security verification management method based on artificial intelligence according to claim 2 is characterized in that: According to the quantitative value of the abnormal degree of the target user's network behavior, the safety factor of the user's network behavior is obtained according to the following formula, and the calculation formula is as follows: S=1-(D / D max ), where S represents the safety factor of the user's network behavior, D represents the quantitative value of the abnormal degree of the target user's network behavior, and D max Indicates the upper limit of the preset maximum abnormality degree quantization value. When the safety factor S of the user's network behavior does not belong to the preset safety factor threshold range [C, F], it is determined that the user's network behavior has a security threat, where C represents the lower limit of the preset safety factor threshold, and F represents the upper limit of the preset safety factor threshold; When S≤C, the user's network behavior is judged to have high-risk anomalies; when S≥F, the user's network behavior is judged to have low-risk anomalies.

4. The network information security verification management method based on artificial intelligence according to claim 3 is characterized by: Real-time data is collected through network traffic monitoring equipment and user behavior analysis systems. During the collection process, user information with security threats is marked and the fluctuation range of network traffic is extracted as F. w , w=1, 2, ..., W, W represents the number of nodes monitoring network traffic fluctuations, and the frequency of abnormal user operations is counted to obtain F u , u=1, 2, ..., U, where U represents the number of different categories of statistical user operation behaviors. w / F max )≥f' network traffic fluctuation amplitude data is accumulated to obtain Q1, where F w Indicates the fluctuation range of network traffic, F max represents the maximum fluctuation amplitude allowed for network traffic, f' represents the preset threshold of the network traffic fluctuation amplitude ratio, and Q1 represents the number of nodes whose ratio of network traffic fluctuation amplitude to the maximum allowed fluctuation amplitude exceeds the preset threshold among all nodes monitoring network traffic fluctuation; Yes (F u / F umax )≥u', the abnormal operation frequency data of users is accumulated to obtain Q2, where F u Indicates the frequency of abnormal user operations, F umax represents the upper limit of the user's normal operation frequency, u' represents the preset threshold of the user's abnormal operation frequency ratio, and Q2 represents the number of operation categories in which the ratio of the user's abnormal operation frequency to the upper limit of the normal operation frequency exceeds the preset threshold in the statistics of different categories of user operation behaviors.

5. The network information security verification management method based on artificial intelligence according to claim 4 is characterized in that: The risk score of network information security is calculated according to the formula R=R0-λ1 / (Q1 / W)-λ2 / (Q2 / U); wherein R represents the risk score of network information security, R0 represents the initial score of network information security risk, Q1 represents the number of nodes whose ratio of network traffic fluctuation amplitude to the maximum allowable fluctuation amplitude exceeds the preset threshold among all nodes monitoring network traffic fluctuation, W represents the number of nodes monitoring network traffic fluctuation, Q2 represents the number of operation categories whose ratio of abnormal user operation frequency to the upper limit of normal operation frequency exceeds the preset threshold among different categories of statistical user operation behaviors, U represents the number of different categories of statistical user operation behaviors, and λ1 and λ2 represent weight values; The monitoring frequency is adjusted according to the calculated risk score of network information security, and the initial monitoring frequency is set to f0. The monitoring frequency adjustment formula is defined as follows: F=f0+k*R; wherein F represents the monitoring frequency, f0 represents the initial monitoring frequency, k represents the adjustment coefficient, and R represents the risk score of network information security.

6. The network information security verification management system based on artificial intelligence is characterized by: The system includes a data acquisition module, an anomaly detection module, a security assessment module and a monitoring frequency adjustment module. The data acquisition module is used to collect network traffic data and user behavior data. The anomaly detection module is used to use a machine learning algorithm to build a user behavior pattern model and calculate the degree of abnormality of the user's network behavior. The security assessment module is used to calculate the safety factor through the quantified value of the degree of abnormality of the user's network behavior, and compare it with the preset threshold range to determine the risk level of the user's network behavior, and mark the user information that poses a security threat, and count the network traffic fluctuation amplitude and the user's abnormal operation frequency. The monitoring frequency adjustment module is used to calculate the network information security risk score and adjust the monitoring frequency.

7. The network information security verification management system based on artificial intelligence according to claim 6 is characterized by: The data collection module includes a network traffic collection unit and a user behavior collection unit. The network traffic collection unit is used to collect network traffic data through network equipment, and the user behavior collection unit is used to collect user behavior data through user terminals and information sources preset by the security log system, and divide the data according to fixed time intervals, count the network information features in each time period, and generate a first network information data set divided by time period. The output end of the data collection module is connected to the input end of the anomaly detection module.

8. The network information security verification management system based on artificial intelligence according to claim 7 is characterized by: The anomaly detection module includes a feature extraction unit, a user behavior pattern modeling unit and an anomaly degree calculation unit. The feature extraction unit is used to extract features from the collected first network information data set using a machine learning algorithm, including user access frequency, access time period and common operations. The user behavior pattern modeling unit is used to construct a user behavior pattern model based on the extracted features, and the model contains features that characterize the user's normal network behavior. The anomaly degree calculation unit is used to obtain the second network information data of the target user and convert it into a behavior vector, and use the user behavior pattern model and cosine similarity to calculate the quantitative value of the abnormal degree of the target user's network behavior, and quantify the degree of deviation of the user behavior by comparing it with normal behavior. The output end of the feature extraction unit is connected to the input end of the user behavior pattern modeling unit, the output end of the user behavior pattern modeling unit is connected to the input end of the anomaly degree calculation unit, and the output end of the anomaly degree calculation unit is connected to the input end of the security assessment module.

9. The network information security verification management system based on artificial intelligence according to claim 8 is characterized by: The security assessment module includes a safety factor calculation unit and a traffic fluctuation and operation statistics unit. The safety factor calculation unit is used to calculate the safety factor according to the safety factor calculation formula of the user's network behavior based on the quantified value of the abnormal degree of the user's network behavior, and compare it with the preset threshold range to determine the risk level of the user's network behavior. The traffic fluctuation and operation statistics unit is used to mark user information that poses a security threat during the collection of real-time data, and at the same time count the network traffic fluctuation amplitude and the user's abnormal operation frequency. The output end of the safety factor calculation unit is connected to the input end of the traffic fluctuation and operation statistics unit, and the output end of the traffic fluctuation and operation statistics unit is connected to the input end of the monitoring frequency adjustment module.

10. The network information security verification management system based on artificial intelligence according to claim 9 is characterized in that: The monitoring frequency adjustment module includes a risk score calculation unit and a monitoring frequency adjustment unit. The risk score calculation unit is used to calculate the risk score of network information security based on the statistical data using the risk score calculation formula of network information security, and comprehensively evaluate the overall security risk level of the network. The monitoring frequency adjustment unit is used to adjust the monitoring frequency based on the calculated risk score of network information security. The output end of the risk score calculation unit is connected to the input end of the monitoring frequency adjustment unit.

Images