An artificial intelligence-based network security threat intelligent identification and defense method

Abstract

The application discloses a network security threat intelligent identification and defense method based on artificial intelligence, S1. Collecting network flow data, user behavior data and system log data from the network security system, outputting the final converged network feature data set; S2. The network feature data set is applied to the global optimization search of the super-entropy differential evolution algorithm, and the network feature data optimized by the super-entropy differential evolution is generated; S3. The network flow anomaly detection probability model based on variational Bayesian inference is constructed by using the network feature data optimized by the super-entropy differential evolution; S4. The network feature data set is input into the network flow anomaly detection probability model, and the risk probability of abnormal behavior is evaluated; S5. Adaptive defense strategy is generated based on the detection result, and defense strategy data is formed. The application improves the overall stability and defense capability of the network security system.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an intelligent identification and defense method for network security threats based on artificial intelligence. Background Technology

[0002] With the continuous evolution of cyberattack techniques, cybersecurity faces increasingly severe challenges, especially zero-day attacks, which are attacks launched by attackers using software vulnerabilities that have not yet been disclosed or patched. Since traditional security defense mechanisms mainly rely on known attack signature databases for detection, existing security systems often struggle to identify and block attacks in a timely and effective manner in the face of the suddenness and unknown nature of zero-day attacks.

[0003] Currently, mainstream network attack detection technologies mainly include intrusion detection systems based on feature matching and intrusion detection systems based on anomaly behavior analysis. Intrusion detection systems based on feature matching detect attacks by building an attack signature database and comparing traffic characteristics with known malicious behavior patterns. However, this method relies on timely updates to the attack signature database, making it difficult to discover new attack patterns. It also suffers from a serious lag, especially when dealing with zero-day attacks. Intrusion detection systems based on anomaly behavior analysis use machine learning or statistical analysis to identify abnormal traffic. However, due to the complexity of the network environment and the variability of normal traffic patterns, traditional anomaly detection algorithms often face the problem of high false positive rates, affecting the availability and detection accuracy of the system.

[0004] Furthermore, existing security defense mechanisms are weak in responding to zero-day attacks. Most defense systems rely on predefined static policies, making it difficult to dynamically adjust defense measures for different types of attacks. For example, blacklist-based traffic blocking strategies are highly effective against known attacks, but in zero-day attack scenarios, the blacklist mechanism is ineffective because the attack traffic characteristics are unknown. Meanwhile, rule-based access control policies suffer from long adjustment cycles and insufficient flexibility, making them difficult to adapt to complex attack environments.

[0005] In recent years, with the development of artificial intelligence and optimization algorithms, intelligent optimization technology has been gradually introduced into the field of cybersecurity. For example, differential evolution algorithm, as a global optimization method, can be used for feature selection and detection model parameter optimization to improve the adaptability of the detection system. However, traditional differential evolution algorithm is prone to getting stuck in local optima when facing high-dimensional and complex network data, affecting the effectiveness of feature selection. In addition, traditional Bayesian inference method can be used for probabilistic modeling of network attack detection, but due to its high computational complexity, it is difficult to meet the needs of real-time detection. At the same time, when dealing with dynamically changing attack traffic, the parameter update speed of traditional Bayesian inference model is slow, which limits its application in zero-day attack detection.

[0006] Therefore, there is an urgent need for a zero-day attack detection and defense method that combines intelligent optimization and probabilistic reasoning to improve the accuracy of detection, enhance the dynamic adjustment capability of defense, and build a full-process intelligent collaborative mechanism from detection to defense to overcome the limitations of existing technologies. Summary of the Invention

[0007] One objective of this invention is to propose an intelligent identification and defense method for cybersecurity threats based on artificial intelligence, which improves the overall stability and defense capabilities of cybersecurity systems.

[0008] An intelligent identification and defense method for cybersecurity threats based on artificial intelligence, according to an embodiment of the present invention, includes the following steps:

[0009] S1. Collect network traffic data, user behavior data and system log data from the network security system, and perform data cleaning, normalization, feature extraction and dimensionality reduction on the collected network dataset to output the final converged set of network feature data;

[0010] S2. Apply the hyperentropy differential evolution algorithm to the network feature data set for global optimization search. By introducing the hyperentropy mechanism, the population evolution parameters are dynamically adjusted to achieve the optimal subset selection and dimensionality reduction optimization of network features, and generate network feature data optimized by hyperentropy differential evolution.

[0011] S3. Construct a network traffic anomaly detection probability model based on variational Bayesian inference using network feature data optimized by hyperentropy differential evolution, and make approximate inferences on the potential probability distribution of network feature data through variational inference methods;

[0012] S4. Input the network feature data set into the network traffic anomaly detection probability model, use the network traffic anomaly detection probability model to perform real-time inference and abnormal behavior analysis on network data, identify abnormal data patterns with zero-day attack risk, and assess the risk probability of abnormal behavior.

[0013] S5. Generate an adaptive defense strategy based on the detection results. The adaptive defense strategy includes automatically blocking abnormal traffic, restricting suspicious ports, dynamically isolating infected nodes, and providing real-time alerts to network security administrators, and forming defense strategy data.

[0014] Optionally, step S1 includes:

[0015] S11. Collect network traffic data, user behavior data, and system log data to construct network dataset D:

[0016] D = D f ∪D u ∪D s ;

[0017] Among them, D f This is a collection of network traffic data, including the size, rate, and communication protocol characteristics of network data packets. u This is a collection of user behavior data, including user login records, access frequency, and interaction pattern characteristics. s This is a collection of system log data, including server logs, error logs, and audit records.

[0018] S12. Perform data cleaning on the network dataset D, removing duplicate, missing, and abnormal data. For missing data, use interpolation to fill in the missing data, and perform consistency verification on the time series data to form a cleaned network dataset.

[0019] S13. Normalize the cleaned network dataset by using the min-max normalization method to map all feature values ​​to the interval [0,1]. Extract feature vectors from the normalized network dataset to obtain the feature matrix. Reduce the dimensionality of the feature matrix to finally form the network feature dataset D. o .

[0020] Optionally, step S2 includes:

[0021] S21. Construct an initial differential evolutionary population P0, representing the feature selection strategy for zero-day attack detection tasks, and the network feature dataset D. o It contains M features, each candidate feature subset p i Represented by encoding in the form of continuous vectors;

[0022] S22. Define the network risk information entropy function H. net (p i This is used to measure the ability of each candidate feature subset to reveal potential zero-day attack risks in the network.

[0023]

[0024] Where, α i,j w represents the selection weight of the j-th feature in the candidate feature subset. j The weights are selected to reflect the contribution of features to the risk of zero-day attacks in revealing anomalous network behavior;

[0025] The average network risk information entropy of the differentially evolved population in generation t is:

[0026]

[0027] Wherein, represents the total number of individuals in the population;

[0028] Average network risk information entropy is used to comprehensively evaluate the overall performance of current feature selection strategies in revealing network attack risk information.

[0029] S23. Based on the current average network risk information entropy H(P) of the differentially evolved population t ), set the adaptive mutation factor F net (H(P t To dynamically adjust the range of variation:

[0030]

[0031] Among them, F min and F max These represent the lower and upper limits of the mutation factor, respectively, determining the minimum and maximum exploration range for searching unknown attack features in a network environment. λ is the decay coefficient, used to control the sensitivity of the mutation factor to changes in network risk information entropy. H max The theoretically achievable maximum network risk information entropy represents the upper limit under extreme conditions where all features fully demonstrate network risk information.

[0032] Generate a variant individual v based on the adaptive mutation factor. i :

[0033]

[0034] in, and To evolve from the current differentially evolved population P t A random selection of non-repeating individuals;

[0035] S24. In the mutant individual v i Based on this, crossover operations are performed to generate offspring individuals u i Set adaptive cross rate CR net (H(P t ));

[0036]

[0037] Among them, CR min With CR max These represent the lower and upper limits of the crossover rate, reflecting the minimum and maximum percentages of feature combinations retained in network anomaly detection, respectively.

[0038] Each component of the offspring individuals is obtained through the binomial crossover rule:

[0039]

[0040] Among them, u i,j rand represents the specific feature value of a newly generated individual. i,jLet j be a random number uniformly distributed in the range [0,1]. rand To ensure that at least one dimension of the random index must intersect;

[0041] S25. Define the fitness function f for zero-day attack detection performance. net (p i Evaluate the performance of each candidate feature subset in actual detection:

[0042]

[0043] Among them, Acc net (p i ) indicates that based on the candidate feature subset p i The accuracy of the constructed detection model in identifying zero-day attacks, where ω and δ are weighting coefficients that balance detection accuracy with the network risk information revealed by feature selection;

[0044] Based on the fitness comparison of the fitness function for zero-day attack detection performance, the differential evolution population is updated using selection rules:

[0045]

[0046] S26. Set the average fitness difference between two consecutive generations of differentially evolved populations:

[0047]

[0048] When Δf is satisfied net <∈ or t≥T max When T reaches a certain point, the candidate feature subset is considered to have reached a stable state, where ∈ is a preset convergence accuracy threshold, and T max Set the maximum number of iterations; otherwise, return to step S22 to continue iterating and updating.

[0049] S27. Output the final converged network feature data set P * :

[0050]

[0051] Among them, P * It is a set of network feature data.

[0052] Optionally, step S3 includes:

[0053] S31. Utilizing the network feature data set P after hyperentropy differential evolution optimization. * Construct a network traffic anomaly detection probabilistic model, and let the optimized network feature data set be X, where... Let x represent N network traffic feature samples, each sample x i It consists of M feature vectors;

[0054] S32. For the task of network traffic anomaly detection, assume that the attack category Z follows a discrete distribution with a prior distribution of p(Z|θ), and the conditional distribution of network traffic data follows a Gaussian mixture model of p(X|Z,θ).

[0055] S33. An approximate inference is performed using variational Bayesian inference. The variational distribution q(Z) is defined as approximating the true posterior distribution. The variational parameter φ is iteratively updated through variational inference. i The optimal network traffic anomaly detection probability model after convergence is obtained.

[0056] S34. Calculate x for each sample. i Posterior probabilities of belonging to different attack categories:

[0057]

[0058] Wherein, p(z) i |x i ,θ) is used to evaluate sample x i To determine whether an attack belongs to a specific attack type, this method classifies and detects unknown zero-day attacks, employing an expectation-maximization algorithm to optimize parameters. Calculate update rules:

[0059]

[0060] in, Indicates attack category z i The prior probability after the (t+1)th iteration Indicates attack category z i The mean vector after the (t+1)th iteration. Indicates attack category z i At t+

[0061] The covariance matrix after one iteration, p(z) i |x i ,θ t ) represents the value of sample x in the t-th iteration. i

[0062] Belongs to attack category z i The posterior probability, x i

[0063] Let represent the i-th network traffic sample, and t represent the current iteration step;

[0064] S35. Define the convergence criterion for the network traffic anomaly detection probability model as follows:

[0065]

[0066] When Δθ<∈ or t≥T is satisfied max When T is reached, the network traffic anomaly detection probability model is considered to have converged, where ∈ is a preset convergence accuracy threshold, and T max Set the maximum number of iterations; otherwise, return to step S34 and continue optimizing the network traffic anomaly detection probability model parameters.

[0067] S36. Output the optimized network traffic anomaly detection probability model, with the posterior probability p(z). i |x i θ) is used to assess whether there are unknown attacks in the current network traffic.

[0068] Optionally, step S4 includes:

[0069] S41. Transfer the network feature data set P * Input to the network traffic anomaly detection probability model;

[0070] S42. Use the network traffic anomaly detection probability model to infer the standardized network feature data set X′, and calculate x′ for each network traffic sample. i The posterior probability of the attack category;

[0071] S43. Calculate the anomaly score S for each network traffic sample. anom (x′ i Anomaly score is defined as the expected negative log-likelihood of each attack category, used to identify potential zero-day attack samples;

[0072] S44. Set the anomaly score S anom (x′ i Threshold T anom Calculate sample x′ i The probability of being identified as a zero-day attack; if the probability of risk is close to 1, it means that sample x′ i The probability falls under the category of zero-day attacks;

[0073] S45. Classify network traffic using risk probability, and classify traffic with a risk probability higher than a preset threshold T. risk The samples were classified as zero-day attacks, forming a zero-day attack detection result set;

[0074] S46. Calculate the current performance metrics of the network traffic anomaly detection probability model, including precision, recall, and F1 score. Based on the detection performance metrics, use an adaptive adjustment mechanism to optimize the parameters of the network traffic anomaly detection probability model.

[0075] Optionally, step S5 includes:

[0076] S51. Using the zero-day attack detection result set as input for defense decisions, the attack category posterior probability and anomaly score S are calculated based on the network traffic anomaly detection probability model. anom and risk probability p risk The detected abnormal traffic is classified, and the classification includes:

[0077] High-risk attack traffic: When the posterior probability of the attack category of a network traffic sample is higher than a set threshold and the anomaly score exceeds the high-risk threshold, it is judged as high-risk attack traffic.

[0078] Continuous attack behavior: When an IP address or port is repeatedly identified as a high-risk attack traffic within a short period of time, and the attack behavior continues, it is identified as a continuous attack behavior.

[0079] Low-risk suspicious traffic: When the attack category posterior probability of a network traffic sample is within the suspicious range, but the anomaly score does not reach the high-risk threshold, it is judged as low-risk suspicious traffic and monitoring measures are taken.

[0080] S52. Based on the posterior probability calculated by the network traffic anomaly detection probability model and the feature data optimized by hyperentropy differential evolution, dynamically set the triggering conditions for the adaptive defense strategy:

[0081] When the number of high-risk attack traffic exceeds a set threshold and the attack sources are relatively concentrated, an automatic blocking strategy is triggered.

[0082] When a persistent attack is detected and the attack targets multiple victim nodes, the infected node isolation policy is triggered.

[0083] When a continuous increase in low-risk suspicious traffic is detected, but it has not yet posed a direct threat to the network system, the traffic monitoring strategy is triggered to dynamically adjust the defense measures.

[0084] S53. Construct a dynamically adjusted set of defense parameters using the optimized feature subset, enabling the defense strategy to adaptively adjust defense rules. The defense parameters include:

[0085] Variation trend of attack behavior: Calculate the magnitude of change in attack patterns based on the optimized feature subset, and optimize the sensitivity of defense strategies;

[0086] Attack source feature distribution: Optimize feature data for dynamically updating the distribution of attack source IP, attack time period, and attack protocol type;

[0087] Dynamic adjustment of port risk level: Calculate the probability of a port being attacked by combining optimized feature data, and strengthen or relax the defense strategy for a specific port.

[0088] S54. Execute the adaptive defense strategy based on the set defense strategy trigger conditions:

[0089] Traffic blocking: When high-risk attack traffic is detected, the attack source is automatically blocked and communication between the attack source and the target is prevented. Port restriction: When a port is attacked multiple times in a short period of time and the probability of attack after the attack gradually increases, the access permission of the port is automatically restricted and the port opening policy is adjusted.

[0090] Infected node isolation: When the same victim node is subjected to continuous attacks, or when zero-day attacks are confirmed, the node is automatically isolated and its communication with other network devices is blocked.

[0091] Traffic monitoring and source tracing: Real-time monitoring of low-risk suspicious traffic, collection of attack source characteristics, and analysis of attacker behavior patterns in order to take precise defense measures in the future;

[0092] Real-time security alerts: When a defense policy is triggered, real-time alerts are automatically sent to the network security administrator, providing information such as the attack type, attack source, affected targets, and suggested defense measures.

[0093] S55. Store the executed defense strategy in the defense strategy database, and dynamically optimize the defense strategy based on the detection performance evaluation method:

[0094] If high-risk attack traffic persists after traffic blocking, adjust the blocking rules to improve defense response speed;

[0095] If port restrictions affect normal business operations, optimize the port access control policy to reduce the probability of false blocking.

[0096] If the infected node continues to be attacked after being isolated, the isolation scope will be expanded and the attack path will be analyzed.

[0097] If the false alarm rate is too high, resulting in an abnormal increase in the number of alarms, the detection algorithm will be optimized based on the network traffic anomaly detection probability model to improve the accuracy of attack judgment.

[0098] S56. Finally, an adaptive defense strategy set is formed, and the optimized defense strategy is applied to the network security system to achieve dynamic response and real-time defense against zero-day attacks.

[0099] The beneficial effects of this invention are:

[0100] (1) This invention proposes a network traffic feature optimization method that combines hyperentropy differential evolution algorithm. By introducing hyperentropy control mechanism, the feature search range is dynamically adjusted, enabling the detection model to accurately extract key features that can distinguish zero-day attacks in complex network environments. Furthermore, a population dynamic adjustment strategy based on network risk information entropy is adopted, which enables the feature selection process to adaptively adjust between global exploration and local development. The optimized feature subset can more effectively describe zero-day attack patterns and has higher adaptability and detection stability in complex high-dimensional network data.

[0101] (2) This invention uses variational Bayesian inference to construct a network traffic anomaly detection probability model. By using variational inference method to dynamically approximate the potential probability distribution of network data, the detection system can quickly identify abnormal attack patterns in a real-time environment. The variational Bayesian inference model can dynamically update model parameters using new data, ensuring that the detection model adapts to changes in the network environment, thereby improving the detection capability for new zero-day attacks and enhancing the identification capability for detecting new variant attacks.

[0102] (3) This invention proposes an adaptive defense strategy driven by detection results. Based on the detection results, the defense strategy is dynamically adjusted according to the attack category posterior probability, anomaly score and risk probability. The attack pattern dynamic learning mechanism based on optimized feature data can adaptively optimize defense parameters after discovering new attack behaviors, and dynamically adjust traffic blocking, port restriction and infected node isolation defense measures, thereby improving the overall stability and defense capability of the network security system. Attached Figure Description

[0103] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0104] Figure 1 This is a flowchart of an artificial intelligence-based intelligent identification and defense method for cybersecurity threats proposed in this invention. Detailed Implementation

[0105] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0106] refer to Figure 1 A method for intelligent identification and defense of cybersecurity threats based on artificial intelligence includes the following steps:

[0107] S1. Collect network traffic data, user behavior data and system log data from the network security system, and perform data cleaning, normalization, feature extraction and dimensionality reduction on the collected network dataset to output the final converged set of network feature data;

[0108] S2. Apply the hyperentropy differential evolution algorithm to the network feature data set for global optimization search. By introducing the hyperentropy mechanism, the population evolution parameters are dynamically adjusted to achieve the optimal subset selection and dimensionality reduction optimization of network features, and generate network feature data optimized by hyperentropy differential evolution.

[0109] S3. Construct a network traffic anomaly detection probability model based on variational Bayesian inference using network feature data optimized by hyperentropy differential evolution, and make approximate inferences on the potential probability distribution of network feature data through variational inference methods;

[0110] S4. Input the network feature data set into the network traffic anomaly detection probability model, use the network traffic anomaly detection probability model to perform real-time inference and abnormal behavior analysis on network data, identify abnormal data patterns with zero-day attack risk, and assess the risk probability of abnormal behavior.

[0111] S5. Generate adaptive defense strategies based on the detection results. The adaptive defense strategies include automatically blocking abnormal traffic, restricting suspicious ports, dynamically isolating infected nodes, and providing real-time alerts to network security administrators, thus forming defense strategy data.

[0112] In this embodiment, step S1 includes:

[0113] S11. Collect network traffic data, user behavior data, and system log data to construct network dataset D:

[0114] D = D f ∪D u ∪D s ;

[0115] Among them, D f This is a collection of network traffic data, including the size, rate, and communication protocol characteristics of network data packets. u This is a collection of user behavior data, including user login records, access frequency, and interaction pattern characteristics. s This is a collection of system log data, including server logs, error logs, and audit records.

[0116] S12. Perform data cleaning on the network dataset D, removing duplicate, missing, and abnormal data. For missing data, use interpolation to fill in the missing data, and perform consistency verification on the time series data to form a cleaned network dataset.

[0117] S13. Normalize the cleaned network dataset by using the min-max normalization method to map all feature values ​​to the interval [0,1]. Extract feature vectors from the normalized network dataset to obtain the feature matrix. Reduce the dimensionality of the feature matrix to finally form the network feature dataset D. o .

[0118] In this embodiment, step S2 includes:

[0119] S21. Construct an initial differential evolutionary population P0, representing the feature selection strategy for zero-day attack detection tasks, and the network feature dataset D. o It contains M features, each candidate feature subset p i Represented by encoding in the form of continuous vectors;

[0120] S22. Define the network risk information entropy function H. net (p i This is used to measure the ability of each candidate feature subset to reveal potential zero-day attack risks in the network.

[0121]

[0122] Where, α i,j w represents the selection weight of the j-th feature in the candidate feature subset. j The weights are selected to reflect the contribution of features to the risk of zero-day attacks in revealing anomalous network behavior;

[0123] The average network risk information entropy of the differentially evolved population in generation t is:

[0124]

[0125] Wherein, represents the total number of individuals in the population;

[0126] Average network risk information entropy is used to comprehensively evaluate the overall performance of current feature selection strategies in revealing network attack risk information.

[0127] S23. Based on the current average network risk information entropy H(P) of the differentially evolved population t ), set the adaptive mutation factor F net (H(P t To dynamically adjust the range of variation:

[0128]

[0129] Among them, F min and F maxThese represent the lower and upper limits of the mutation factor, respectively, determining the minimum and maximum exploration range for searching unknown attack features in a network environment. λ is the decay coefficient, used to control the sensitivity of the mutation factor to changes in network risk information entropy. H max The theoretically achievable maximum network risk information entropy represents the upper limit under extreme conditions where all features fully demonstrate network risk information.

[0130] Generate a variant individual v based on the adaptive mutation factor. i :

[0131]

[0132] in, and To evolve from the current differentially evolved population P t A random selection of non-repeating individuals;

[0133] S24. In the mutant individual v i Based on this, crossover operations are performed to generate offspring individuals u i Set adaptive cross rate CR net (H(P t ));

[0134]

[0135] Among them, CR min With CR max These represent the lower and upper limits of the crossover rate, reflecting the minimum and maximum percentages of feature combinations retained in network anomaly detection, respectively.

[0136] Each component of the offspring individuals is obtained through the binomial crossover rule:

[0137]

[0138] Among them, u i,j rand represents the specific feature value of a newly generated individual. i,j Let j be a random number uniformly distributed in the range [0,1]. rand To ensure that at least one dimension of the random index must intersect;

[0139] S25. Define the fitness function f for zero-day attack detection performance. net (p i Evaluate the performance of each candidate feature subset in actual detection:

[0140]

[0141] Among them, Acc net (p i ) indicates that based on the candidate feature subset pi The accuracy of the constructed detection model in identifying zero-day attacks, where ω and δ are weighting coefficients that balance detection accuracy with the network risk information revealed by feature selection;

[0142] Based on the fitness comparison of the fitness function for zero-day attack detection performance, the differential evolution population is updated using selection rules:

[0143]

[0144] S26. Set the average fitness difference between two consecutive generations of differentially evolved populations:

[0145]

[0146] When Δf is satisfied net <∈ or t≥T max When T reaches a certain point, the candidate feature subset is considered to have reached a stable state, where ∈ is a preset convergence accuracy threshold, and T max Set the maximum number of iterations; otherwise, return to step S22 to continue iterating and updating.

[0147] S27. Output the final converged network feature data set P * :

[0148]

[0149] Among them, P * It is a set of network feature data.

[0150] In this embodiment, step S3 includes:

[0151] S31. Utilizing the network feature data set P after hyperentropy differential evolution optimization. * Construct a network traffic anomaly detection probabilistic model, and let the optimized network feature data set be X, where... Let x represent N network traffic feature samples, each sample x i It consists of M feature vectors;

[0152] S32. For the task of network traffic anomaly detection, assume that the attack category Z follows a discrete distribution with a prior distribution of p(Z|θ), and the conditional distribution of network traffic data follows a Gaussian mixture model of p(X|Z,θ).

[0153] S33. An approximate inference is performed using variational Bayesian inference. The variational distribution q(Z) is defined as approximating the true posterior distribution. The variational parameter φ is iteratively updated through variational inference. i The optimal network traffic anomaly detection probability model after convergence is obtained.

[0154] S34. Calculate x for each sample. iPosterior probabilities of belonging to different attack categories:

[0155]

[0156] Wherein, p(z) i |x i ,θ) is used to evaluate sample x i To determine whether an attack belongs to a specific attack type, this method classifies and detects unknown zero-day attacks, employing an expectation-maximization algorithm to optimize parameters. Calculate update rules:

[0157]

[0158] in, Indicates attack category z i The prior probability after the (t+1)th iteration Indicates attack category z i The mean vector after the (t+1)th iteration. Indicates attack category z i At t+

[0159] The covariance matrix after one iteration, p(z) i |x i ,θ t ) represents the value of sample x in the t-th iteration. i

[0160] Belongs to attack category z i The posterior probability, x i

[0161] Let represent the i-th network traffic sample, and t represent the current iteration step;

[0162] S35. Define the convergence criterion for the network traffic anomaly detection probability model as follows:

[0163]

[0164] When Δθ<∈ or t≥T is satisfied max When T is reached, the network traffic anomaly detection probability model is considered to have converged, where ∈ is a preset convergence accuracy threshold, and T max Set the maximum number of iterations; otherwise, return to step S34 and continue optimizing the network traffic anomaly detection probability model parameters.

[0165] S36. Output the optimized network traffic anomaly detection probability model, with the posterior probability p(z). i |x i θ) is used to assess whether there are unknown attacks in the current network traffic.

[0166] In this embodiment, step S4 includes:

[0167] S41. Transfer the network feature data set P * Input to the network traffic anomaly detection probability model;

[0168] S42. Use the network traffic anomaly detection probability model to infer the standardized network feature data set X′, and calculate x′ for each network traffic sample. i The posterior probability of the attack category;

[0169] S43. Calculate the anomaly score S for each network traffic sample. anom (x′ i Anomaly score is defined as the expected negative log-likelihood of each attack category, used to identify potential zero-day attack samples;

[0170] S44. Set the anomaly score S anom (x′ i Threshold T anom Calculate sample x′ i The probability of being identified as a zero-day attack; if the probability of risk is close to 1, it means that sample x′ i The probability falls under the category of zero-day attacks;

[0171] S45. Classify network traffic using risk probability, and classify traffic with a risk probability higher than a preset threshold T. risk The samples were classified as zero-day attacks, forming a zero-day attack detection result set;

[0172] S46. Calculate the current performance metrics of the network traffic anomaly detection probability model, including precision, recall, and F1 score. Based on the detection performance metrics, use an adaptive adjustment mechanism to optimize the parameters of the network traffic anomaly detection probability model.

[0173] In this embodiment, step S5 includes:

[0174] S51. Using the zero-day attack detection result set as input for defense decisions, the attack category posterior probability and anomaly score S are calculated based on the network traffic anomaly detection probability model. anom and risk probability p risk The detected abnormal traffic is classified, including:

[0175] High-risk attack traffic: When the posterior probability of the attack category of a network traffic sample is higher than a set threshold and the anomaly score exceeds the high-risk threshold, it is judged as high-risk attack traffic.

[0176] Continuous attack behavior: When an IP address or port is repeatedly identified as a high-risk attack traffic within a short period of time, and the attack behavior continues, it is identified as a continuous attack behavior.

[0177] Low-risk suspicious traffic: When the attack category posterior probability of a network traffic sample is within the suspicious range, but the anomaly score does not reach the high-risk threshold, it is judged as low-risk suspicious traffic and monitoring measures are taken.

[0178] S52. Based on the posterior probability calculated by the network traffic anomaly detection probability model and the feature data optimized by hyperentropy differential evolution, dynamically set the triggering conditions for the adaptive defense strategy:

[0179] When the number of high-risk attack traffic exceeds a set threshold and the attack sources are relatively concentrated, an automatic blocking strategy is triggered.

[0180] When a persistent attack is detected and the attack targets multiple victim nodes, the infected node isolation policy is triggered.

[0181] When a continuous increase in low-risk suspicious traffic is detected, but it has not yet posed a direct threat to the network system, the traffic monitoring strategy is triggered to dynamically adjust the defense measures.

[0182] S53. Construct a dynamically adjusted set of defense parameters using the optimized feature subset, enabling the defense strategy to adaptively adjust defense rules. The defense parameters include:

[0183] Variation trend of attack behavior: Calculate the magnitude of change in attack patterns based on the optimized feature subset, and optimize the sensitivity of defense strategies;

[0184] Attack source feature distribution: Optimize feature data for dynamically updating the distribution of attack source IP, attack time period, and attack protocol type;

[0185] Dynamic adjustment of port risk level: Calculate the probability of a port being attacked by combining optimized feature data, and strengthen or relax the defense strategy for a specific port.

[0186] S54. Execute the adaptive defense strategy based on the set defense strategy trigger conditions:

[0187] Traffic blocking: When high-risk attack traffic is detected, the attack source is automatically blocked and communication between the attack source and the target is prevented. Port restriction: When a port is attacked multiple times in a short period of time and the probability of attack after the attack gradually increases, the access permission of the port is automatically restricted and the port opening policy is adjusted.

[0188] Infected node isolation: When the same victim node is subjected to continuous attacks, or when zero-day attacks are confirmed, the node is automatically isolated and its communication with other network devices is blocked.

[0189] Traffic monitoring and source tracing: Real-time monitoring of low-risk suspicious traffic, collection of attack source characteristics, and analysis of attacker behavior patterns in order to take precise defense measures in the future;

[0190] Real-time security alerts: When a defense policy is triggered, real-time alerts are automatically sent to the network security administrator, providing information such as the attack type, attack source, affected targets, and suggested defense measures.

[0191] S55. Store the executed defense strategy in the defense strategy database, and dynamically optimize the defense strategy based on the detection performance evaluation method:

[0192] If high-risk attack traffic persists after traffic blocking, adjust the blocking rules to improve defense response speed;

[0193] If port restrictions affect normal business operations, optimize the port access control policy to reduce the probability of false blocking.

[0194] If the infected node continues to be attacked after being isolated, the isolation scope will be expanded and the attack path will be analyzed.

[0195] If the false alarm rate is too high, resulting in an abnormal increase in the number of alarms, the detection algorithm will be optimized based on the network traffic anomaly detection probability model to improve the accuracy of attack judgment.

[0196] S56. Finally, an adaptive defense strategy set is formed, and the optimized defense strategy is applied to the network security system to achieve dynamic response and real-time defense against zero-day attacks.

[0197] Example 1:

[0198] On March 5, 2024, the cybersecurity team of a financial institution discovered abnormal network traffic in its core server cluster during routine monitoring. System logs showed that some servers experienced a large number of abnormal SSH access attempts between 2:14 AM and 2:26 AM, with the traffic characteristics of the source IP address "192.168.1.100" exhibiting highly abnormalities. This IP address sent over 7,500 login requests to servers "10.0.0.15" and "10.0.0.22" within just 12 minutes, attempting to use multiple different SSH keys. Since this behavior was not detected by traditional intrusion detection systems, the security team decided to use the method of this invention for further analysis.

[0199] The method of this invention first cleans and normalizes network traffic data from the past 48 hours, extracting network traffic packet features, user login behavior features, and system log event features. Subsequently, the system uses a hyper-entropy differential evolution algorithm to optimize the feature data, automatically selecting the key feature set that best characterizes the abnormal behavior. The optimized features show that the traffic behavior of this IP address exhibits the following significant anomalies:

[0200] 1. Abnormal source port change frequency: The source port of 192.168.1.100 changes continuously in a short period of time, changing the port more than 40 times per second on average, while normal users' SSH access usually keeps a fixed source port.

[0201] 2. Abnormal frequency of access to destination ports: This IP address accessed 22 different servers within 10 minutes, with 80% of the access targeting ports 22 (SSH), 3389 (remote desktop), and 5432 (database), which are common attack target ports.

[0202] 3. Abnormal packet size distribution: The packet size of a normal user's SSH session is usually stable between 800-1500 bytes, while the SSH packet size of 192.168.1.100 varies randomly between 500-2000 bytes, which is consistent with the typical pattern of SSH brute-force attack + covert data penetration attack.

[0203] The detection model inputs the optimized feature data into the variational Bayesian inference model for inference, and calculates the posterior probability of the attack category and the anomaly score of the IP.

[0204] Posterior probability of attack category: Model calculations show that the posterior probability of this IP address belonging to an SSH brute-force attack is 93.6%, the posterior probability of belonging to a remote desktop attack is 4.1%, and the posterior probability of belonging to normal user behavior is only 2.3%.

[0205] Anomaly Score: The SSH traffic anomaly score for this IP is 8.73 (the average score for normal users is about 3.12, and the threshold is 6.5), indicating that this traffic pattern is highly likely to be a malicious attack.

[0206] The system ultimately determined that 192.168.1.100 was highly likely conducting an SSH brute-force attack and might attempt to further expand the attack scope. The system then automatically generated an attack event report, recording the following:

[0207] Attack time: March 5, 2024, 02:14–02:26;

[0208] Attack source IP: 192.168.1.100;

[0209] Victim servers: 10.0.0.15, 10.0.0.22, 10.0.0.30;

[0210] Attack type: SSH brute-force attack + port scanning + covert data penetration;

[0211] Attack characteristics: random changes in source port, high-frequency access to destination port, and unstable packet size;

[0212] Posterior probability of attack: 93.6%;

[0213] Anomaly score: 8.73;

[0214] Upon detecting an attack, the system automatically executes an adaptive defense strategy and takes the following measures:

[0215] 1. Traffic blocking: Automatically blocks all outbound traffic from 192.168.1.100 and records it in the firewall log.

[0216] 2. Port restrictions: Restrict SSH ports 10.0.0.15, 10.0.0.22, and 10.0.0.30 to only trusted IP addresses, while also increasing the threshold for failed login attempts.

[0217] 3. Infected node isolation: Since 10.0.0.15 is suspected of being successfully compromised, the system automatically isolates it from the core network and initiates a security review process.

[0218] 4. Real-time security alerts: The system sends high-priority security alerts to the security operations team, including attack source information, attack behavior analysis, and suggested defense measures.

[0219] Comparative results show that the method of the present invention can detect attacks faster than traditional IDS (identification time reduced from 213 seconds to 2.1 seconds), while reducing false alarms and improving the automated response speed of the defense strategy (defense response time shortened from 110 seconds to 4.2 seconds).

[0220] Within two hours of the incident, the system used historical data for further attack tracing analysis and found that the attack source 192.168.1.100 had scanned network ports at a low frequency multiple times in the past two days, but had not previously triggered the alarm rules of traditional IDS. The method of this invention discovered these low-frequency attack precursors through feature subsets optimized by hyperentropy differential evolution, and similar behaviors will be included in the potential threat monitoring list in future defense strategy optimizations in order to detect attacker activities earlier.

[0221] Over the next two weeks, the financial institution's overall cybersecurity defense capabilities were significantly improved, with the system's detection efficiency for potential zero-day attacks increasing by 67.2%, and two similar SSH brute-force attacks were successfully prevented.

[0222] This embodiment demonstrates the practical application effect of the method of the present invention in the network security protection of financial institutions. Experimental data shows that the method of the present invention can accurately detect zero-day attacks and quickly prevent the spread of attacks through adaptive defense strategies. Compared with traditional IDS, the detection speed is increased by 100 times and the defense response time is shortened by 26 times, effectively improving the intelligence level of network security.

[0223] This invention proposes a network traffic feature optimization method that combines hyperentropy differential evolution algorithm. By introducing a hyperentropy control mechanism, the feature search range is dynamically adjusted, enabling the detection model to accurately extract key features that can distinguish zero-day attacks in complex network environments. Furthermore, a population dynamic adjustment strategy based on network risk information entropy is adopted, allowing the feature selection process to adaptively adjust between global exploration and local development. The optimized feature subset can more effectively describe zero-day attack patterns and has higher adaptability and detection stability in complex high-dimensional network data.

[0224] This invention employs variational Bayesian inference to construct a network traffic anomaly detection probability model. By using variational inference methods to dynamically approximate the potential probability distribution of network data, the detection system can quickly identify abnormal attack patterns in a real-time environment. The variational Bayesian inference model can dynamically update model parameters using new data, ensuring that the detection model adapts to changes in the network environment, thereby improving the detection capability for new zero-day attacks and enhancing the ability to identify new variant attacks.

[0225] This invention proposes a detection result-driven adaptive defense strategy. Based on the detection results, the defense strategy is dynamically adjusted according to the attack category posterior probability, anomaly score, and risk probability. The attack pattern dynamic learning mechanism based on optimized feature data can adaptively optimize defense parameters after discovering new attack behaviors, and dynamically adjust traffic blocking, port restriction, and infected node isolation defense measures, thereby improving the overall stability and defense capability of the network security system.

[0226] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An artificial intelligence-based network security threat intelligent identification and defense method, characterized in that, The method comprises the following steps: S1. Collecting network traffic data, user behavior data and system log data from a network security system, and performing data cleaning, normalization, feature extraction and dimension reduction processing on the collected network data set to output a final converged network feature data set; S2. Applying a super-entropy differential evolution algorithm to the network feature data set for global optimization search, dynamically adjusting the population evolution parameters by introducing a super-entropy mechanism, realizing optimal subset selection and dimension reduction optimization of network features, and generating network feature data optimized by the super-entropy differential evolution algorithm; S3. Constructing a network traffic anomaly detection probability model based on variational Bayesian inference using the network feature data optimized by the super-entropy differential evolution algorithm, and approximating the latent probability distribution of the network feature data by variational inference method; S4. Inputting the network feature data set into the network traffic anomaly detection probability model, and using the network traffic anomaly detection probability model to perform real-time inference and anomaly behavior analysis on the network data, identifying the abnormal data pattern of the existing zero-day attack risk, and evaluating the risk probability of the abnormal behavior; S5. Generating an adaptive defense strategy based on the detection result, wherein the adaptive defense strategy comprises automatically blocking abnormal traffic, limiting suspicious ports, dynamically isolating infected nodes, and real-time alarming network security administrators, and forming a defense strategy data.

2. The method of claim 1, wherein the method is based on artificial intelligence. The step S1 comprises: S11. Collect network traffic data, user behavior data, and system log data, and build a network data set : ； wherein, is a network traffic data set containing traffic size, flow rate and communication protocol features of network packets, is a user behavior data set containing user login records, access frequency and interaction mode features, is a system log data set containing server logs, error logs and audit records; S12. Data cleaning is performed on the network data set to remove duplicate data, missing data and abnormal data, interpolate missing data, and perform consistency check on time series data to form a cleaned network data set; S13. Normalizing the cleaned network data set, mapping all feature values to the interval using the min-max normalization method, extracting feature vectors from the normalized network data set, obtaining a feature matrix, and finally forming a network feature data set . 3.The method of claim 1, wherein, The step S2 comprises: S21. Constructing an initial differential evolution population The initial differential evolution population represents a feature selection strategy for the network zero-day attack detection task, and the network feature data set contains features, and each candidate feature subset is encoded in the form of a continuous vector. S22. Define the network risk information entropy function for measuring the revealing ability of each candidate feature subset to the potential zero-day attack risk information in the network: ； wherein, represents the selection weight of the i-th feature in the candidate feature subset, is the selection weight, reflecting the contribution of the feature to the zero-day attack risk in revealing network abnormal behavior;​ The average network risk information entropy of the differential evolution population in the first generation is: ； wherein, represents the total number of individuals in the population; The average network risk information entropy is used for overall evaluation of the comprehensive performance of the current feature selection strategy in revealing network attack risk information; S23. According to the average network risk information entropy of the current differential evolution population , set the adaptive mutation factor to dynamically adjust the mutation range: ； wherein, and are the lower and upper limits of the mutation factor, respectively, which determine the minimum and maximum exploration range for searching unknown attack features in a network environment, is the decay coefficient, used to control the sensitivity of the mutation factor to the change in network risk information entropy, is the maximum network risk information entropy that can be theoretically achieved, representing the upper limit of the network risk information fully exhibited by all features in an extreme case. Generating a mutated individual according to an adaptive mutation factor : ； wherein , and are randomly selected non-repeated individuals from the current differential evolution population . S24. In the variant individual crossing operation on the basis of the fitness values to generate offspring individuals , an adaptive crossover rate is set ; ； wherein, with are lower and upper limits for the cross rate, reflecting the lowest and highest rates reserved for the combination of features in the network anomaly detection, respectively; Each component of the offspring individual is obtained by binomial crossover rule: ； in, This represents a specific feature value of the newly generated individual. To distribute evenly in Random numbers within, To ensure that at least one dimension of the random index must intersect; S25. Defining network zero-day attack detection performance fitness function Evaluate each candidate feature subset's performance in actual detection: ； wherein, represents the detection model constructed based on the candidate feature subset the accuracy of the detection model constructed in identifying zero-day attacks, and a weight coefficient for balancing the detection accuracy and the network risk information revealed by the feature selection; According to the fitness comparison of the network zero-day attack detection performance fitness function, the differential evolution population is updated by using the selection rule: ； S26. Set the average fitness difference of two consecutive generations of differential evolution population: ； When the condition is satisfied the candidate feature subset is considered to have reached a stable state, wherein, is a preset convergence precision threshold, is the maximum number of iterations; otherwise, return to step S22 to continue iteration update; S27. outputting the final converged set of network feature data : ， wherein, is a set of network feature data.

4. The method of claim 1, wherein the method further comprises: The step S3 comprises: S31. Utilize the network feature data set optimized by hyper-entropy differential evolution Construct a network traffic anomaly detection probability model, and let the optimized network feature data set be , wherein represents network traffic feature samples, and each sample is composed of feature vectors; S32. For network traffic anomaly detection task, set attack category The prior distribution is subject to a discrete distribution The conditional distribution of network traffic data is subject to a Gaussian mixture model ; S33. Approximate inference is performed using variational Bayesian inference method, and a variational distribution is defined Approximate true posterior distribution, through variational inference, iteratively update the variational parameters , obtain the optimal network traffic anomaly detection probability model after convergence; S34. Calculate each sample Posterior probabilities belonging to different attack classes: ； Wherein, For evaluating samples Whether it belongs to a certain attack type, realizing the classification detection of unknown zero-day attacks, adopting the expectation maximization algorithm to optimize parameters , calculating update rules: ； ； ； wherein, represents the attack class the prior probability after the first iteration, the mean vector after the first iteration, represents the attack class the mean vector after the first iteration, the covariance matrix after the first iteration, represents the attack class the covariance matrix after the first iteration, the covariance matrix after the first iteration, represents the posterior probability that the sample belongs to the attack class at iteration t, represents the ith network traffic sample, and t represents the current iteration step number. S35. Define the convergence criterion of the network traffic anomaly detection probability model as: ； When the condition is met , it is determined that the network traffic anomaly detection probability model has converged, wherein, is a preset convergence accuracy threshold, is the maximum number of iterations; otherwise, return to step S34 to continue optimizing the network traffic anomaly detection probability model parameters; S36. Output the optimized network traffic anomaly detection probability model, posterior probability for assessing whether a current network traffic is under an unknown attack.

5. The method of claim 1, wherein the method further comprises: The step S4 comprises: S41. inputting the network feature data set to the network traffic anomaly detection probability model; S42. utilize the network traffic anomaly detection probability model on the standardized network feature data set perform inference to compute an attack class posterior probability for each network traffic sample ; S43. Calculate anomaly score for each network traffic sample , the anomaly score is defined as the expected negative log-likelihood of each attack category for identifying potential zero-day attack samples; S44. Set the anomaly score threshold , calculate the risk probability of the sample being determined as a zero-day attack, if the risk probability is close to 1, it means that the sample probability belongs to a zero-day attack; S45. Classify the network traffic using the risk probability, and classify the samples with risk probability higher than a preset threshold as zero-day attacks to form a zero-day attack detection result set. S45. Classify the network traffic using the risk probability, and classify the samples with risk probability higher than a preset threshold as zero-day attacks to form a zero-day attack detection result set. S46. Calculate the current performance indicators of the network traffic anomaly detection probability model, including precision, recall and F1 score, and adaptively adjust the parameters of the network traffic anomaly detection probability model according to the detection performance indicators.

6. The method of claim 1, wherein the method further comprises: The step S5 comprises: S51. Taking the zero-day attack detection result set as the input of the defense decision, classifying the detected abnormal traffic according to the attack category posterior probability calculated by the network traffic anomaly detection probability model, the abnormality score and the risk probability ​ High-risk attack traffic: when the attack category posterior probability of the network traffic sample is higher than the set threshold, and the abnormality score exceeds the high-risk threshold, it is determined as high-risk attack traffic; Persistent attack behavior: when a certain IP address or port is repeatedly determined as high-risk attack traffic in a short time, and the attack behavior persists, it is determined as persistent attack behavior; Low-risk suspicious traffic: when the attack category posterior probability of the network traffic sample is in the suspicious range, but the abnormality score does not reach the high-risk threshold, it is determined as low-risk suspicious traffic, and monitoring measures are taken; S52. According to the posterior probability calculated by the network traffic anomaly detection probability model and the feature data optimized by the super-entropy differential evolution algorithm, dynamically set the trigger condition of the adaptive defense strategy: When the number of high-risk attack traffic exceeds the set threshold, and the attack sources are relatively concentrated, the automatic blocking strategy is triggered; When a sustained attack behavior is detected, and the attack target involves multiple victim nodes, the infected node isolation strategy is triggered; When a sustained increase in low-risk suspicious traffic is detected, but has not yet posed a direct threat to the network system, the traffic monitoring strategy is triggered, and the defense measures are dynamically adjusted; S53. Use the optimized feature subset to construct a dynamically adjusted defense parameter set, so that the defense strategy can adaptively adjust the defense rules. The defense parameters include: Variation trend of attack behavior: based on the optimized feature subset, calculate the change amplitude of the attack pattern, and optimize the sensitivity of the defense strategy; Attack source feature distribution: optimize the feature data for dynamic updating of the distribution of attack source IP, attack time period, and attack protocol type; Port risk level dynamic adjustment: combine the optimized feature data to calculate the probability of attack on the port, and enhance or relax the defense strategy for specific ports; S54. Execute the adaptive defense strategy according to the set defense strategy trigger conditions: Traffic blocking: when high-risk attack traffic is detected, automatically block the attack source and prevent it from communicating with the victim target; port restriction: when a port is attacked multiple times in a short period of time, and the attack posterior probability gradually increases, automatically restrict the access rights of the port and adjust the port opening strategy; Infected node isolation: when the same victim node is subjected to sustained attacks, or a zero-day attack behavior has been confirmed, automatically isolate the node and block its communication with other network devices; Traffic monitoring and tracing: real-time monitoring of low-risk suspicious traffic, collecting attack source features, and analyzing the behavior pattern of the attacker to take precise defense measures subsequently; Real-time security alert: when the defense strategy is triggered, automatically send real-time alert information to the network security administrator, and provide attack category, attack source, affected target, and recommended defense measures; S55. Store the executed defense strategy to the defense strategy database, and dynamically optimize the defense strategy based on the detection performance evaluation method: If high-risk attack traffic still exists after traffic blocking, adjust the blocking rules to improve the defense response speed; If port restriction affects normal business, optimize the port access control strategy to reduce the probability of false blocking; If the infected node is still subjected to attacks after isolation, expand the isolation range and analyze the attack path; If the false positive rate is too high, resulting in an abnormal increase in the number of alerts, optimize the detection algorithm based on the network traffic anomaly detection probability model to optimize the attack judgment accuracy; S56. Finally form a set of adaptive defense strategies, and apply the optimized defense strategies to the network security system to realize dynamic response and real-time defense against zero-day attacks.

Images