Network intrusion detection and defense method and system based on artificial intelligence, and medium

Abstract

The invention provides a network intrusion detection and defense method and system based on artificial intelligence, and a medium, and belongs to the technical field of artificial intelligence and big data. The method comprises the following steps: collecting network flow data, user behavior data and system log data in a preset time period through an intrusion detection defense system, and constructing an intrusion behavior detection graph; and extracting intrusion feature information from the atlas, and performing simulation attack through a preset adversarial network model to obtain a simulation attack result. And generating an optimization detection strategy according to the simulation attack result, and applying the optimization detection strategy to the intrusion behavior detection map to perform detection optimization. Besides, monitoring information is obtained from a plurality of edge nodes, flow abnormal data is extracted, a global threat view is generated, and then a defense strategy and a repair instruction are obtained through a strategy library and a repair instruction library respectively, so that comprehensive network intrusion defense and repair are realized. The intelligent level and the response speed of network intrusion detection are remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence and big data technology, and more specifically, to a network intrusion detection and defense method, system, and medium based on artificial intelligence. Background Art

[0002] Network security issues are becoming increasingly serious, and network intrusion incidents are frequent, posing a serious threat to security. Traditional network intrusion detection systems rely on rule matching and feature recognition technology. When faced with complex and changing network attacks, they have problems such as low detection efficiency, high false alarm rate, and poor adaptability. In addition, traditional defense mechanisms lack the ability to predict and respond quickly to new attacks, resulting in poor defense results.

[0003] In recent years, artificial intelligence technology has provided new ideas for network intrusion detection. Through machine learning, deep learning and other technologies, network traffic, user behavior and system logs can be analyzed more efficiently to identify potential intrusion behaviors. However, existing artificial intelligence-based detection systems have limitations, such as insufficient ability to identify unknown attacks, inaccurate feature extraction, and limited adaptability to large-scale network environments.

[0004] To this end, developing an artificial intelligence-based network intrusion detection and defense method and system that can detect and defend various intrusion behaviors in real time and accurately, and has self-learning and optimization capabilities, has become an important research direction in the current network security field. This application aims to solve the shortcomings of existing technologies and improve the level of network security protection. Summary of the invention

[0005] The purpose of this application is to provide a network intrusion detection and defense method, system and medium based on artificial intelligence. By integrating multiple artificial intelligence technologies, the intelligence level and response efficiency of network intrusion detection are significantly improved. The method first collects network traffic data, user behavior data and system log data within a preset time period through an intrusion detection and defense system to construct an intrusion behavior detection map; then, extracts intrusion feature information from the map, uses a preset adversarial network model to simulate attacks, and obtains simulated attack results; then, generates an optimized detection strategy based on the simulated attack results, and applies it to the intrusion behavior detection map to achieve detection optimization. In addition, monitoring information is obtained from multiple edge nodes, traffic anomaly data is extracted and a global threat view is generated; finally, according to the global threat view, defense strategies and repair instructions are obtained through a preset policy library and a repair instruction library, respectively, to achieve comprehensive network intrusion defense and repair.

[0006] The first aspect of the present application provides a network intrusion detection and defense method based on artificial intelligence, comprising the following steps: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; Extract intrusion feature information according to the intrusion behavior detection map, perform simulated attacks through a preset adversarial network model and obtain simulated attack results; Generate an optimized detection strategy based on the simulated attack results and input the intrusion behavior detection map for detection optimization; Acquire monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extract traffic anomaly data for marking and generate a global threat view; According to the global threat view, a defense strategy is obtained through a preset strategy library, and a repair instruction is obtained through a preset repair instruction library.

[0007] Among them, in the network intrusion detection and defense method based on artificial intelligence described in the present application, the network traffic data, user behavior data and system log data of a preset time period are obtained according to the intrusion detection and defense system, and an intrusion behavior detection map is constructed, specifically: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; The network traffic data includes data packet header information, data packet payload content and traffic statistics information; The user behavior data includes user login information, operation record information and permission change record information; The system log data includes system event log, security event log and system error log.

[0008] Among them, in the network intrusion detection and defense method based on artificial intelligence described in the present application, the intrusion feature information is extracted according to the intrusion behavior detection map, and a simulated attack is performed through a preset adversarial network model to obtain a simulated attack result, specifically: Extracting intrusion feature information according to the intrusion behavior detection graph, wherein the intrusion feature information includes network traffic patterns, user behavior abnormality indicators, and system log abnormality information; According to the network traffic pattern, user behavior abnormality indicators and system log abnormality information, a simulated attack is performed through a preset adversarial network model and a simulated attack result is obtained; The simulated attack results include detection success rate, network attack type and detection response time.

[0009] Among them, in the network intrusion detection and defense method based on artificial intelligence described in the present application, the optimization detection strategy is generated according to the simulated attack result and the intrusion behavior detection map is input for detection optimization, specifically: generating an optimized detection strategy according to the simulated attack result, wherein the optimized detection strategy includes detection threshold adjustment information, detection rule change information, and feature extraction improvement information; The detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map for detection optimization.

[0010] Among them, in the network intrusion detection and defense method based on artificial intelligence described in the present application, the monitoring information of multiple edge nodes is obtained according to the intrusion detection and defense system, and the abnormal traffic data is extracted for marking and a global threat view is generated, specifically: Acquire multiple edge node monitoring information according to the intrusion detection and prevention system; Extracting traffic anomaly data according to the monitoring information of the plurality of edge nodes, wherein the traffic anomaly data includes data transmission volume mutation information, heterogeneous port access information, and unknown protocol usage information; Marking the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information and generating a global threat view; The global threat view includes a dynamic traffic map, an attack frequency chart, and a threat area distribution map.

[0011] Among them, in the network intrusion detection and defense method based on artificial intelligence described in the present application, the defense strategy is obtained through a preset strategy library according to the global threat view, specifically: Extract threat type information, attack source information, attack intent information, and attack impact information according to the global threat view; Obtaining a defense strategy through a preset strategy library according to the threat type information, attack source information, attack intention information, and attack impact information; The defense strategy includes access restrictions, vulnerability management information, network log analysis, and emergency response information.

[0012] Among them, in the network intrusion detection and defense method based on artificial intelligence described in this application, the obtaining of the repair instruction is specifically: Extracting damaged system information, system vulnerability distribution information, attack impact range information, and historical repair record information based on the global threat view; Obtaining repair instructions through a preset repair instruction library according to the damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information; The repair instructions include damaged system isolation information, vulnerability repair information, data recovery information and security reinforcement information.

[0013] The second aspect of the present application provides a network intrusion detection and defense system based on artificial intelligence, the system comprising: a memory and a processor, the memory comprising a program of a network intrusion detection and defense method based on artificial intelligence, and the program of the network intrusion detection and defense method based on artificial intelligence is executed by the processor to implement the following steps: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; Extract intrusion feature information according to the intrusion behavior detection map, perform simulated attacks through a preset adversarial network model and obtain simulated attack results; Generate an optimized detection strategy based on the simulated attack results and input the intrusion behavior detection map for detection optimization; Acquire monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extract traffic anomaly data for marking and generate a global threat view; According to the global threat view, a defense strategy is obtained through a preset strategy library, and a repair instruction is obtained through a preset repair instruction library.

[0014] Among them, in the network intrusion detection and defense system based on artificial intelligence described in the present application, the intrusion detection and defense system obtains network traffic data, user behavior data and system log data in a preset time period and constructs an intrusion behavior detection map, specifically: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; The network traffic data includes data packet header information, data packet payload content and traffic statistics information; The user behavior data includes user login information, operation record information and permission change record information; The system log data includes system event log, security event log and system error log.

[0015] The third aspect of the present application also provides a computer-readable storage medium, which includes an artificial intelligence-based network intrusion detection and defense method program. When the artificial intelligence-based network intrusion detection and defense method program is executed by a processor, the steps of the above-mentioned artificial intelligence-based network intrusion detection and defense method are implemented.

[0016] It can be seen from the above that the network intrusion detection and defense method, system and medium based on artificial intelligence provided by the embodiment of the present application significantly improve the intelligence level and response efficiency of network intrusion detection by integrating multiple artificial intelligence technologies. The method first collects network traffic data, user behavior data and system log data within a preset time period through the intrusion detection and defense system to construct an intrusion behavior detection map; then, extracts intrusion feature information from the map, uses a preset adversarial network model to simulate attacks, and obtains simulated attack results; then, generates an optimized detection strategy based on the simulated attack results, and applies it to the intrusion behavior detection map to achieve detection optimization. In addition, monitoring information is obtained from multiple edge nodes, traffic anomaly data is extracted and a global threat view is generated; finally, according to the global threat view, defense strategies and repair instructions are obtained respectively through the preset strategy library and the repair instruction library to achieve comprehensive network intrusion defense and repair. The core advantages of this application are: accurately extracting intrusion features through artificial intelligence technology to improve detection efficiency and accuracy; dynamically adjusting detection strategies based on simulated attack results to enhance the system's adaptability to new attacks; real-time grasp of network threat situations through global threat views to achieve rapid response; combining defense strategies and repair instructions to provide an integrated solution from detection to repair. This application is suitable for large-scale network environments, can effectively respond to complex and changeable network attacks, and provide strong technical support for network security.

[0017] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by implementing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained through the description and the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a network intrusion detection and defense method based on artificial intelligence provided in an embodiment of the present application; Figure 2 A flowchart of obtaining simulated attack results for the artificial intelligence-based network intrusion detection and defense method provided in an embodiment of the present application; Figure 3 A flow chart for optimizing the detection of the network intrusion detection and defense method based on artificial intelligence provided in an embodiment of the present application; Figure 4A flowchart of generating a global threat view for the artificial intelligence-based network intrusion detection and defense method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0021] It should be noted that similar numbers and letters represent similar items in the following figures, so once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and cannot be understood as indicating or implying relative importance. It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0022] Please refer to Figure 1 , is a flow chart of the network intrusion detection and defense method based on artificial intelligence of the present application. The method is used in terminal devices, such as computers, mobile terminals, etc. The method includes the following steps: S101, obtaining network traffic data, user behavior data and system log data for a preset time period according to the intrusion detection and prevention system and constructing an intrusion behavior detection map; S102, extracting intrusion feature information according to the intrusion behavior detection map, performing a simulated attack through a preset adversarial network model and obtaining a simulated attack result; S103, generating an optimized detection strategy according to the simulated attack results and inputting the intrusion behavior detection map for detection optimization; S104, obtaining monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extracting abnormal traffic data for marking and generating a global threat view; S105. Obtain a defense strategy through a preset strategy library according to the global threat view, and obtain a repair instruction through a preset repair instruction library.

[0023] First, by acquiring network traffic data, user behavior data, and system log data within a preset time period, an intrusion behavior detection map is constructed to fully reflect the potential threats in the network. Then, intrusion feature information is extracted from the intrusion behavior detection map, and a preset adversarial network model is used to simulate attacks to generate simulated attack results for evaluating the effectiveness of the current detection strategy. Subsequently, an optimized detection strategy is generated based on the simulated attack results and fed back to the intrusion behavior detection map to achieve dynamic optimization of detection capabilities. In addition, monitoring information is obtained from multiple edge nodes, traffic anomaly data is extracted and marked, and a global threat view is generated to fully grasp the security situation in the network. Finally, based on the global threat view, combined with the preset strategy library and repair instruction library, defense strategies and repair instructions are generated respectively, thereby achieving rapid response and repair of network threats. This process improves the accuracy and efficiency of intrusion detection and defense through data-driven and intelligent analysis.

[0024] According to an embodiment of the present application, network traffic data, user behavior data and system log data for a preset time period are obtained according to an intrusion detection and prevention system, and an intrusion behavior detection map is constructed. Specifically, network traffic data, user behavior data and system log data for a preset time period are obtained according to an intrusion detection and prevention system, and an intrusion behavior detection map is constructed; network traffic data includes data packet header information, data packet payload content and traffic statistics information; user behavior data includes user login information, operation record information and permission change record information; system log data includes system event log, security event log and system error log.

[0025] Among them, the core technology of the present application is to construct an intrusion behavior detection map by comprehensively collecting and analyzing network traffic data, user behavior data and system log data, so as to realize accurate identification and defense of network threats. Specifically, network traffic data includes data packet header information, data packet payload content and traffic statistics information, which are used to monitor abnormal behavior in network communication; user behavior data includes user login information, operation record information and permission change record information, which are used to analyze the potential risks of user activities; system log data includes system event log, security event log and system error log, which are used to identify security events and abnormal states at the system level. By integrating these multi-dimensional data, a dynamic intrusion behavior detection map can be constructed, so as to realize comprehensive perception and correlation analysis of complex intrusion behaviors. The innovation of this technical solution is that it improves the accuracy and efficiency of intrusion detection through multi-source data fusion and intelligent analysis, and provides data-driven decision support for network security defense. This solution can be applied to the field of network security and has high practical value and market prospects.

[0026] Please refer to Figure 2 , which is a flow chart of obtaining simulated attack results of the network intrusion detection and defense method based on artificial intelligence in some embodiments of the present application. According to the embodiment of the present application, intrusion feature information is extracted according to the intrusion behavior detection map, and a simulated attack is performed through a preset adversarial network model to obtain a simulated attack result, specifically: S201, extracting intrusion feature information according to the intrusion behavior detection map, the intrusion feature information includes network traffic patterns, user behavior abnormal indicators and system log abnormal information; S202, performing a simulated attack through a preset adversarial network model according to the network traffic patterns, user behavior abnormal indicators and system log abnormal information and obtaining a simulated attack result; S203, the simulated attack result includes the detection success rate, network attack type and detection response time.

[0027] Among them, the core technology of the present application lies in evaluating and optimizing the performance of the intrusion detection system by extracting intrusion feature information and using the adversarial network model to simulate attacks. Specifically, the system first extracts intrusion feature information from the intrusion behavior detection map, and the intrusion feature information includes network traffic patterns (such as abnormal traffic features), user behavior abnormal indicators (such as abnormal login or operation behavior) and system log abnormal information (such as security events or error logs). These feature information provide a data basis for subsequent simulated attacks. Then, through the preset adversarial network model, simulated attacks are performed based on network traffic patterns, user behavior abnormal indicators and system log abnormal information to generate simulated attack results. The simulated attack results include detection success rate (i.e., the system's ability to identify attacks), network attack types (such as DDoS attacks, malware attacks, etc.) and detection response time (i.e., the time from the discovery of attacks to the response of the system). The innovation of this technical solution is that through simulated attack tests, the performance of the intrusion detection system can be comprehensively evaluated, and data support can be provided for system optimization. This solution can be applied to the field of network security testing and defense, and has high practical value and market prospects.

[0028] Please refer to Figure 3 , is a flow chart of the network intrusion detection and defense method based on artificial intelligence for detection optimization in some embodiments of the present application. According to the embodiment of the present application, an optimized detection strategy is generated according to the simulated attack results and input into the intrusion behavior detection map for detection optimization, specifically: S301, an optimized detection strategy is generated according to the simulated attack results, and the optimized detection strategy includes detection threshold adjustment information, detection rule change information and feature extraction improvement information; S302, the detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map for detection optimization.

[0029] Among them, an optimized detection strategy is generated by analyzing the simulated attack results, and the intrusion behavior detection map is dynamically adjusted to improve the detection accuracy and response efficiency of the system. Specifically, the system generates an optimized detection strategy based on the simulated attack results (including detection success rate, network attack type and detection response time). The optimized detection strategy includes detection threshold adjustment information (such as adjusting the judgment threshold of abnormal traffic), detection rule change information (such as updating or adding new detection rules) and feature extraction improvement information (such as optimizing feature extraction algorithms or adding new feature dimensions). Subsequently, the detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map to achieve dynamic optimization of the intrusion behavior detection map. The innovation of this technical solution is that through the feedback mechanism of simulated attack results, the detection strategy can be intelligently adjusted, thereby continuously improving the detection capability and adaptability of the system.

[0030] For example, Figure 4 It is a flowchart of generating a global threat view of a network intrusion detection and defense method based on artificial intelligence in some embodiments of the present application. According to the embodiment of the present application, the monitoring information of multiple edge nodes is obtained according to the intrusion detection and defense system, and the abnormal flow data is extracted for marking and generating a global threat view, specifically: S401, obtaining multiple edge node monitoring information according to the intrusion detection and defense system; S402, extracting abnormal flow data according to the monitoring information of multiple edge nodes, and the abnormal flow data includes data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information; S403, marking the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information and generating a global threat view; S404, the global threat view includes a dynamic flow graph, an attack frequency graph and a threat area distribution graph.

[0031] Among them, by collecting and analyzing the monitoring information of multiple edge nodes, extracting traffic anomaly data and generating a global threat view, the comprehensive perception and visual display of network threats can be achieved. Specifically, first, the monitoring information of multiple edge nodes is obtained according to the intrusion detection and defense system, including data such as network traffic, port access records and protocol usage. Then, the traffic anomaly data is extracted from the monitoring information of multiple edge nodes. The traffic anomaly data includes data on sudden changes in data transmission volume (such as a surge or a sharp drop in traffic), heterogeneous port access information (such as access behavior of uncommon ports) and unknown protocol usage information (such as usage behavior of non-standard protocols). Subsequently, the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information are marked, and a global threat view is generated. The global threat view includes a dynamic traffic map (real-time display of network traffic changes), an attack frequency chart (statistical frequency and trend of attack events) and a threat area distribution map (identifying the geographical location or network area of ​​the threat source). The innovation of this technical solution is that through the distributed monitoring of edge nodes and the generation of a global threat view, it can realize real-time perception, precise positioning and visual analysis of network threats, thereby providing comprehensive decision support for network security defense.

[0032] According to an embodiment of the present application, a defense strategy is obtained through a preset policy library based on a global threat view, specifically: threat type information, attack source information, attack intention information and attack impact information are extracted according to the global threat view; a defense strategy is obtained through a preset policy library based on the threat type information, attack source information, attack intention information and attack impact information; the defense strategy includes access restrictions, vulnerability management information, network log analysis and emergency response information.

[0033] Among them, by analyzing the threat information in the global threat view, combined with the preset policy library, targeted defense strategies are generated to achieve rapid response and effective defense against network threats. Specifically, first, according to the global threat view, threat type information (such as DDoS attack, malware attack, etc.), attack source information (such as the attacker's IP address or geographic location), attack intention information (such as data theft, system destruction, etc.) and attack impact information (such as affected systems or services) are extracted. Then, according to the threat type information, attack source information, attack intention information and attack impact information, the preset policy library is matched and generated. The defense strategy includes access restrictions (such as blocking the attack source IP or restricting access to specific ports), vulnerability management information (such as fixing known vulnerabilities or updating patches), network log analysis (such as in-depth analysis of logs to track attack paths) and emergency response information (such as launching emergency plans or isolating infected systems). The innovation of this technical solution is that through the in-depth analysis of the global threat view and the intelligent matching of the policy library, accurate defense strategies can be quickly generated, thereby improving the efficiency and effectiveness of network security defense.

[0034] According to an embodiment of the present application, obtaining repair instructions is specifically as follows: extracting damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information according to the global threat view; obtaining repair instructions through a preset repair instruction library according to the damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information; the repair instructions include damaged system isolation information, vulnerability repair information, data recovery information and security reinforcement information.

[0035] Among them, by analyzing the damaged information and vulnerability distribution in the global threat view, combined with the preset repair instruction library, targeted repair instructions are generated to achieve rapid repair and security reinforcement of the damaged system. Specifically, firstly, the damaged system information (such as the server or terminal device affected by the attack), the system vulnerability distribution information (such as the known or unknown vulnerabilities in the system), the attack impact range information (such as the network area or business function affected by the attack) and the historical repair record information (such as the records and effects of previous repair operations) are extracted according to the global threat view. Then, according to the damaged system information, the system vulnerability distribution information, the attack impact range information and the historical repair record information, the preset repair instruction library is matched and generated. The repair instructions include damaged system isolation information (such as isolating the attacked system from the network to prevent further spread), vulnerability repair information (such as patching vulnerabilities or updating patches), data recovery information (such as restoring damaged data from backups) and security reinforcement information (such as strengthening system configuration or deploying additional security protection measures). The innovation of this technical solution is that through the in-depth analysis of the global threat view and the intelligent matching of the repair instruction library, accurate repair instructions can be quickly generated, thereby improving the efficiency and security of system repair.

[0036] According to an embodiment of the present application, the method further includes: obtaining detection optimization information of a preset time period, extracting detection rate data, false alarm rate data, missed alarm rate data and response time; processing the detection rate data, false alarm rate data, missed alarm rate data and response time through a preset optimization success rate evaluation model to obtain an optimization success rate index; comparing the optimization success rate index with a preset success rate index threshold; if the optimization success rate index is greater than or equal to the preset success rate index threshold, sending optimization success information; if the optimization success rate index is less than the preset success rate index threshold, sending optimization failure information; the calculation formula of the preset optimization success rate evaluation model is: .

[0037] in, To optimize the success rate index, They are detection rate data, false alarm rate data, missed alarm rate data and response time. is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset optimization detection database).

[0038] Among them, in order to evaluate the optimization effect of the detection strategy, it is first necessary to obtain the detection optimization information within the preset time period, including data such as detection rate, false alarm rate, missed alarm rate and response time. These data will be input into the preset optimization success rate evaluation model, and the optimization success rate index will be generated through model processing. The index comprehensively reflects the performance improvement of the detection system. Next, the optimization success rate index is compared with the preset success rate index threshold: if the optimization success rate index is greater than or equal to the threshold, it means that the optimization has achieved the expected goal, and the system will send an optimization success message; if the optimization success rate index is less than the threshold, it means that the optimization has not achieved the expected goal, and the system will send an optimization failure message. This process can intuitively judge the optimization effect of the detection strategy through automated evaluation and quantitative indicators, and provide clear feedback for subsequent improvements, thereby continuously improving the accuracy and efficiency of the detection system.

[0039] The present application also discloses an artificial intelligence-based network intrusion detection and defense system, including a memory and a processor, wherein the memory includes an artificial intelligence-based network intrusion detection and defense method program, and the artificial intelligence-based network intrusion detection and defense method program implements the following steps when executed by the processor: according to the intrusion detection and defense system, network traffic data, user behavior data and system log data for a preset time period are obtained and an intrusion behavior detection map is constructed; according to the intrusion behavior detection map, intrusion feature information is extracted, a simulated attack is performed through a preset adversarial network model and simulated attack results are obtained; according to the simulated attack results, an optimized detection strategy is generated and input into the intrusion behavior detection map for detection optimization; according to the intrusion detection and defense system, monitoring information of multiple edge nodes is obtained, abnormal traffic data is extracted for marking and a global threat view is generated; according to the global threat view, a defense strategy is obtained through a preset strategy library, and a repair instruction is obtained through a preset repair instruction library.

[0040] First, by acquiring network traffic data, user behavior data, and system log data within a preset time period, an intrusion behavior detection map is constructed to fully reflect the potential threats in the network. Then, intrusion feature information is extracted from the intrusion behavior detection map, and a preset adversarial network model is used to simulate attacks to generate simulated attack results for evaluating the effectiveness of the current detection strategy. Subsequently, an optimized detection strategy is generated based on the simulated attack results and fed back to the intrusion behavior detection map to achieve dynamic optimization of detection capabilities. In addition, monitoring information is obtained from multiple edge nodes, traffic anomaly data is extracted and marked, and a global threat view is generated to fully grasp the security situation in the network. Finally, based on the global threat view, combined with the preset strategy library and repair instruction library, defense strategies and repair instructions are generated respectively, thereby achieving rapid response and repair of network threats. This process improves the accuracy and efficiency of intrusion detection and defense through data-driven and intelligent analysis.

[0041] According to an embodiment of the present application, network traffic data, user behavior data and system log data of a preset time period are obtained according to an intrusion detection and prevention system, and an intrusion behavior detection map is constructed. Specifically, network traffic data, user behavior data and system log data of a preset time period are obtained according to an intrusion detection and prevention system, and an intrusion behavior detection map is constructed; the network traffic data includes data packet header information, data packet payload content and traffic statistics information; the user behavior data includes user login information, operation record information and permission change record information; the system log data includes system event log, security event log and system error log.

[0042] Among them, the core technology of the present application is to construct an intrusion behavior detection map by comprehensively collecting and analyzing network traffic data, user behavior data and system log data, so as to realize accurate identification and defense of network threats. Specifically, network traffic data includes data packet header information, data packet payload content and traffic statistics information, which are used to monitor abnormal behavior in network communication; the user behavior data includes user login information, operation record information and permission change record information, which are used to analyze the potential risks of user activities; the system log data includes system event log, security event log and system error log, which are used to identify security events and abnormal states at the system level. By integrating these multi-dimensional data, a dynamic intrusion behavior detection map can be constructed, so as to realize comprehensive perception and correlation analysis of complex intrusion behaviors. The innovation of this technical solution is that it improves the accuracy and efficiency of intrusion detection through multi-source data fusion and intelligent analysis, and provides data-driven decision support for network security defense. This solution can be applied to the field of network security and has high practical value and market prospects.

[0043] According to the embodiment of the present application, the aforementioned intrusion feature information is extracted according to the intrusion behavior detection map, and a simulated attack is performed through a preset adversarial network model to obtain a simulated attack result, specifically: Extracting intrusion feature information according to the intrusion behavior detection graph, the intrusion feature information includes network traffic patterns, user behavior abnormality indicators and system log abnormality information; According to the network traffic pattern, abnormal user behavior indicators and abnormal system log information, simulated attacks are carried out through the preset adversarial network model and simulated attack results are obtained; The simulated attack results include detection success rate, network attack type and detection response time.

[0044] Among them, the core technology of the present application lies in evaluating and optimizing the performance of the intrusion detection system by extracting intrusion feature information and using the adversarial network model to simulate attacks. Specifically, the system first extracts intrusion feature information from the intrusion behavior detection map. The intrusion feature information includes network traffic patterns (such as abnormal traffic features), user behavior abnormal indicators (such as abnormal login or operation behavior) and system log abnormal information (such as security events or error logs). These feature information provide a data basis for subsequent simulated attacks. Then, through the preset adversarial network model, simulated attacks are carried out based on the network traffic pattern, user behavior abnormal indicators and system log abnormal information to generate simulated attack results. The simulated attack results include detection success rate (i.e., the system's ability to identify attacks), network attack types (such as DDoS attacks, malware attacks, etc.) and detection response time (i.e., the time from the discovery of attacks to the response of the system). The innovation of this technical solution is that through simulated attack tests, the performance of the intrusion detection system can be comprehensively evaluated, and data support can be provided for system optimization. This solution can be applied to the field of network security testing and defense, and has high practical value and market prospects.

[0045] According to the embodiment of the present application, an optimized detection strategy is generated according to the simulated attack results and an intrusion behavior detection map is input for detection optimization, specifically: generating an optimized detection strategy according to the simulated attack result, the optimized detection strategy including detection threshold adjustment information, detection rule change information and feature extraction improvement information; The detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map for detection optimization.

[0046] Among them, an optimized detection strategy is generated by analyzing the simulated attack results, and the intrusion behavior detection map is dynamically adjusted to improve the detection accuracy and response efficiency of the system. Specifically, the system generates an optimized detection strategy based on the simulated attack results (including detection success rate, network attack type and detection response time). The optimized detection strategy includes detection threshold adjustment information (such as adjusting the judgment threshold of abnormal traffic), detection rule change information (such as updating or adding new detection rules) and feature extraction improvement information (such as optimizing feature extraction algorithms or adding new feature dimensions). Subsequently, the detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map to achieve dynamic optimization of the intrusion behavior detection map. The innovation of this technical solution is that through the feedback mechanism of simulated attack results, the detection strategy can be intelligently adjusted, thereby continuously improving the detection capability and adaptability of the system.

[0047] According to the embodiment of the present application, the intrusion detection and prevention system obtains monitoring information of multiple edge nodes, extracts abnormal traffic data for marking and generates a global threat view, specifically: Acquire multiple edge node monitoring information according to the intrusion detection and prevention system; Extracting traffic anomaly data according to the monitoring information of the multiple edge nodes, the traffic anomaly data including data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information; Mark the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information and generate a global threat view; The global threat view includes dynamic traffic maps, attack frequency charts, and threat regional distribution maps.

[0048] Among them, by collecting and analyzing the monitoring information of multiple edge nodes, extracting traffic anomaly data and generating a global threat view, the comprehensive perception and visual display of network threats can be achieved. Specifically, first, the monitoring information of multiple edge nodes is obtained according to the intrusion detection and defense system, including data such as network traffic, port access records and protocol usage. Then, the traffic anomaly data is extracted from the monitoring information of multiple edge nodes, and the traffic anomaly data includes data on data transmission volume mutation (such as a surge or a sharp drop in traffic), heterogeneous port access information (such as access behavior of uncommon ports) and unknown protocol usage information (such as non-standard protocol usage behavior). Subsequently, the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information are marked, and a global threat view is generated. The global threat view includes a dynamic traffic map (real-time display of network traffic changes), an attack frequency chart (statistical frequency and trend of attack events) and a threat area distribution map (identifying the geographical location or network area of ​​the threat source). The innovation of this technical solution is that through the distributed monitoring of edge nodes and the generation of a global threat view, it can realize real-time perception, precise positioning and visual analysis of network threats, thereby providing comprehensive decision support for network security defense.

[0049] According to an embodiment of the present application, the defense strategy is obtained through a preset policy library based on a global threat view, specifically: extracting threat type information, attack source information, attack intention information and attack impact information based on the global threat view; obtaining a defense strategy through a preset policy library based on the threat type information, attack source information, attack intention information and attack impact information; the defense strategy includes access restrictions, vulnerability management information, network log analysis and emergency response information.

[0050] Among them, by analyzing the threat information in the global threat view, combined with the preset policy library, targeted defense strategies are generated to achieve rapid response and effective defense against network threats. Specifically, firstly, according to the global threat view, threat type information (such as DDoS attack, malware attack, etc.), attack source information (such as the attacker's IP address or geographic location), attack intention information (such as data theft, system destruction, etc.) and attack impact information (such as affected systems or services) are extracted. Then, according to the threat type information, attack source information, attack intention information and attack impact information, the preset policy library is matched and generated. The defense strategy includes access restrictions (such as blocking the attack source IP or restricting access to specific ports), vulnerability management information (such as fixing known vulnerabilities or updating patches), network log analysis (such as in-depth analysis of logs to track attack paths) and emergency response information (such as launching emergency plans or isolating infected systems). The innovation of this technical solution is that through the in-depth analysis of the global threat view and the intelligent matching of the policy library, accurate defense strategies can be quickly generated, thereby improving the efficiency and effectiveness of network security defense.

[0051] According to an embodiment of the present application, the repair instruction is obtained specifically as follows: extracting damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information according to a global threat view; obtaining repair instructions through a preset repair instruction library according to the damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information; the repair instructions include damaged system isolation information, vulnerability repair information, data recovery information and security reinforcement information.

[0052] Among them, by analyzing the damaged information and vulnerability distribution in the global threat view, combined with the preset repair instruction library, targeted repair instructions are generated to achieve rapid repair and security reinforcement of the damaged system. Specifically, firstly, according to the global threat view, the damaged system information (such as the server or terminal device affected by the attack), the system vulnerability distribution information (such as the known or unknown vulnerabilities in the system), the attack impact range information (such as the network area or business function affected by the attack) and the historical repair record information (such as the records and effects of previous repair operations) are extracted. Then, according to the damaged system information, the system vulnerability distribution information, the attack impact range information and the historical repair record information, the preset repair instruction library is matched and generated. The repair instruction includes the damaged system isolation information (such as isolating the attacked system from the network to prevent further spread), vulnerability repair information (such as patching vulnerabilities or updating patches), data recovery information (such as restoring damaged data from backups) and security reinforcement information (such as strengthening system configuration or deploying additional security protection measures). The innovation of this technical solution is that through the in-depth analysis of the global threat view and the intelligent matching of the repair instruction library, accurate repair instructions can be quickly generated, thereby improving the efficiency and security of system repair.

[0053] According to an embodiment of the present application, it also includes: Obtain detection optimization information for a preset time period, and extract detection rate data, false alarm rate data, missed alarm rate data, and response time; The detection rate data, false alarm rate data, missed alarm rate data and response time are processed through a preset optimization success rate evaluation model to obtain an optimization success rate index; Comparing the optimization success rate index with a preset success rate index threshold; If the optimization success rate index is greater than or equal to the preset success rate index threshold, an optimization success message is sent; If the optimization success rate index is less than the preset success rate index threshold, an optimization failure message is sent; The calculation formula of the preset optimization success rate evaluation model is: .

[0054] in, To optimize the success rate index, They are detection rate data, false alarm rate data, missed alarm rate data and response time. is the preset characteristic coefficient (the characteristic coefficient is obtained by querying the preset optimization detection database).

[0055] Among them, in order to evaluate the optimization effect of the detection strategy, it is first necessary to obtain the detection optimization information within the preset time period, including data such as detection rate, false alarm rate, missed alarm rate and response time. These data will be input into the preset optimization success rate evaluation model, and the optimization success rate index will be generated through model processing. The index comprehensively reflects the performance improvement of the detection system. Next, the optimization success rate index is compared with the preset success rate index threshold: if the optimization success rate index is greater than or equal to the threshold, it means that the optimization has achieved the expected goal, and the system will send an optimization success message; if the optimization success rate index is less than the threshold, it means that the optimization has not achieved the expected goal, and the system will send an optimization failure message. This process can intuitively judge the optimization effect of the detection strategy through automated evaluation and quantitative indicators, and provide clear feedback for subsequent improvements, thereby continuously improving the accuracy and efficiency of the detection system.

[0056] The third aspect of the present application provides a computer-readable storage medium, which includes an artificial intelligence-based network intrusion detection and defense method program. When the artificial intelligence-based network intrusion detection and defense method program is executed by a processor, the steps of the aforementioned method are implemented.

[0057] The network intrusion detection and defense method, system and medium based on artificial intelligence disclosed in the present application obtain network traffic data, user behavior data and system log data within a preset time period through the intrusion detection and defense system, and construct an intrusion behavior detection map to comprehensively reflect the potential threats in the network. Extract intrusion feature information from the intrusion behavior detection map, which includes network traffic patterns, user behavior abnormality indicators and system log abnormality information, and simulate attacks through a preset adversarial network model to generate simulated attack results (such as detection success rate, network attack type and detection response time), and then generate optimized detection strategies (including detection threshold adjustment information, detection rule change information and feature extraction improvement information) according to the simulated attack results, and input the intrusion behavior detection map for detection optimization to improve the detection accuracy and response efficiency of the system. At the same time, by obtaining the monitoring information of multiple edge nodes, extracting traffic abnormality data (such as data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information), and generating a global threat view (including dynamic traffic map, attack frequency chart and threat area distribution map) to achieve comprehensive perception and visual analysis of network threats. Based on the global threat view, defense strategies (such as access restrictions, vulnerability management information, network log analysis, and emergency response information) are generated through the preset strategy library, and repair instructions (such as damaged system isolation information, vulnerability repair information, data recovery information, and security reinforcement information) are generated through the preset repair instruction library, thereby achieving rapid response and effective defense against network threats. The innovation of this technical solution lies in the realization of full-chain intelligent network security protection from data collection, threat detection, strategy optimization to defense repair through multi-source data fusion, simulated attack testing, global threat view generation, and intelligent strategy matching.

[0058] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0059] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0060] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0061] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a readable storage medium, which, when executed, executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: mobile storage devices, read-only memories, random access memories, magnetic disks or optical disks, and other media that can store program codes.

[0062] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, RAM, disks or optical disks.

Claims

1. A network intrusion detection and defense method based on artificial intelligence, characterized in that: The following steps are involved: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; Extract intrusion feature information according to the intrusion behavior detection map, perform simulated attacks through a preset adversarial network model and obtain simulated attack results; Generate an optimized detection strategy based on the simulated attack results and input the intrusion behavior detection map for detection optimization; Acquire monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extract traffic anomaly data for marking and generate a global threat view; According to the global threat view, a defense strategy is obtained through a preset strategy library, and a repair instruction is obtained through a preset repair instruction library.

2. The network intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: The method of obtaining network traffic data, user behavior data and system log data in a preset time period and constructing an intrusion behavior detection graph according to the intrusion detection and prevention system is specifically as follows: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; The network traffic data includes data packet header information, data packet payload content and traffic statistics information; The user behavior data includes user login information, operation record information and permission change record information; The system log data includes system event log, security event log and system error log.

3. The network intrusion detection and defense method based on artificial intelligence according to claim 2 is characterized in that: The extracting of intrusion feature information according to the intrusion behavior detection map, performing a simulated attack through a preset adversarial network model and obtaining a simulated attack result are specifically as follows: Extracting intrusion feature information according to the intrusion behavior detection graph, wherein the intrusion feature information includes network traffic patterns, user behavior abnormality indicators, and system log abnormality information; According to the network traffic pattern, user behavior abnormality indicators and system log abnormality information, a simulated attack is performed through a preset adversarial network model and a simulated attack result is obtained; The simulated attack results include detection success rate, network attack type and detection response time.

4. The network intrusion detection and defense method based on artificial intelligence according to claim 3 is characterized in that: The generating of the optimized detection strategy according to the simulated attack result and inputting the intrusion behavior detection map for detection optimization is specifically as follows: generating an optimized detection strategy according to the simulated attack result, wherein the optimized detection strategy includes detection threshold adjustment information, detection rule change information, and feature extraction improvement information; The detection threshold adjustment information, detection rule change information and feature extraction improvement information are input into the intrusion behavior detection map for detection optimization.

5. The network intrusion detection and defense method based on artificial intelligence according to claim 1 is characterized in that: The method of obtaining monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extracting abnormal traffic data for marking and generating a global threat view is specifically as follows: Acquire multiple edge node monitoring information according to the intrusion detection and prevention system; Extracting traffic anomaly data according to the monitoring information of the plurality of edge nodes, wherein the traffic anomaly data includes data transmission volume mutation information, heterogeneous port access information, and unknown protocol usage information; Marking the data transmission volume mutation information, heterogeneous port access information and unknown protocol usage information and generating a global threat view; The global threat view includes a dynamic traffic map, an attack frequency chart, and a threat area distribution map.

6. The network intrusion detection and defense method based on artificial intelligence according to claim 5 is characterized in that: The obtaining of the defense strategy through the preset strategy library according to the global threat view is specifically: Extract threat type information, attack source information, attack intent information, and attack impact information according to the global threat view; Obtaining a defense strategy through a preset strategy library according to the threat type information, attack source information, attack intention information, and attack impact information; The defense strategy includes access restrictions, vulnerability management information, network log analysis, and emergency response information.

7. The network intrusion detection and defense method based on artificial intelligence according to claim 6 is characterized in that: The obtaining of the repair instruction is specifically as follows: Extracting damaged system information, system vulnerability distribution information, attack impact range information, and historical repair record information based on the global threat view; Obtaining repair instructions through a preset repair instruction library according to the damaged system information, system vulnerability distribution information, attack impact range information and historical repair record information; The repair instructions include damaged system isolation information, vulnerability repair information, data recovery information and security reinforcement information.

8. The network intrusion detection and defense system based on artificial intelligence is characterized by: The invention comprises a memory and a processor, wherein the memory comprises a network intrusion detection and defense method program based on artificial intelligence, and the network intrusion detection and defense method program based on artificial intelligence is executed by the processor to implement the following steps: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; Extract intrusion feature information according to the intrusion behavior detection map, perform simulated attacks through a preset adversarial network model and obtain simulated attack results; Generate an optimized detection strategy based on the simulated attack results and input the intrusion behavior detection map for detection optimization; Acquire monitoring information of multiple edge nodes according to the intrusion detection and prevention system, extract traffic anomaly data for marking and generate a global threat view; According to the global threat view, a defense strategy is obtained through a preset strategy library, and a repair instruction is obtained through a preset repair instruction library.

9. The artificial intelligence-based network intrusion detection and defense system according to claim 8, characterized in that: The method of obtaining network traffic data, user behavior data and system log data in a preset time period and constructing an intrusion behavior detection graph according to the intrusion detection and prevention system is specifically as follows: According to the intrusion detection and prevention system, network traffic data, user behavior data and system log data in a preset time period are obtained and an intrusion behavior detection map is constructed; The network traffic data includes data packet header information, data packet payload content and traffic statistics information; The user behavior data includes user login information, operation record information and permission change record information; The system log data includes system event log, security event log and system error log.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes an artificial intelligence-based network intrusion detection and defense method, system, and medium program. When the artificial intelligence-based network intrusion detection and defense method, system, and medium program are executed by a processor, the steps of the artificial intelligence-based network intrusion detection and defense method as described in any one of claims 1 to 7 are implemented.

Images