Intelligent detection method for network security vulnerabilities based on artificial intelligence and big data

Abstract

The invention relates to a network security vulnerability intelligent detection method based on artificial intelligence and big data, and the method comprises the steps: carrying out the dynamic time synchronization processing of multi-modal network security data, and generating a multi-source data flow with aligned time sequences through cross-modal correlation analysis; extracting cross-modal features from the data stream, and performing semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector; training the multi-dimensional feature vector through a hybrid model to obtain a vulnerability detection model, detecting real-time network behavior data by using the model, and outputting a vulnerability probability and an abnormal risk score; and performing automatic vulnerability verification according to the vulnerability probability and the abnormal risk score to obtain a verification result, and updating the vulnerability detection model according to the result. The system can effectively improve the accuracy, timeliness and stability of network security vulnerability detection and reduce the false report and missing report rate through multi-modal data collaboration, hybrid model dual detection and closed-loop optimization mechanisms.

Description

Technical Field

[0001] The present invention belongs to the field of network security technology, and particularly relates to an intelligent network security vulnerability detection method based on artificial intelligence and big data. Background Art

[0002] With the development of network information technology, network security vulnerability detection technology has emerged. This technology can analyze network data, identify potential security risks in the network system, and thus ensure the stability and security of the network environment. In traditional technologies, vulnerability detection mainly relies on two methods: signature matching and anomaly detection. Among them, the signature matching method can discover known vulnerabilities by maintaining a database of known vulnerability signatures and comparing the collected network data with the signatures in the database. However, its detection ability for new and unknown vulnerabilities is limited and it cannot cope with newly emerging network security threats in a timely manner. The anomaly detection method can identify potential vulnerabilities by monitoring abnormal behaviors that deviate from the normal mode based on a model of normal network behaviors, but its detection accuracy and stability need to be improved, and false positives and false negatives are likely to occur. Summary of the Invention

[0003] Based on this, it is necessary to provide an intelligent network security vulnerability detection method based on artificial intelligence and big data for the above technical problems, so as to improve the accuracy, comprehensiveness, and timeliness of network security vulnerability detection, and enhance the ability to identify new and unknown vulnerabilities.

[0004] In a first aspect, the present application provides an intelligent network security vulnerability detection method based on artificial intelligence and big data, and the method includes:

[0005] Perform dynamic time synchronization processing on multi-modal network security data, and generate a multi-source data stream with time series alignment through cross-modal correlation analysis. The multi-modal network security data includes network transmission layer traffic data, system operation logs, code repository data, and vulnerability signature data in the public vulnerability database;

[0006] Extract cross-modal features from the multi-source data stream with time series alignment, and perform semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector. The vulnerability knowledge graph is constructed based on the Common Vulnerabilities and Exposures (CVE) framework;

[0007] Train the multi-dimensional feature vector through a hybrid model that combines supervised learning and unsupervised learning to obtain a vulnerability detection model, and use the vulnerability detection model to detect real-time network behavior data, and output a vulnerability probability and an anomaly risk score;

[0008] Perform automated vulnerability verification according to the vulnerability probability and the anomaly risk score to obtain a verification result, and update the vulnerability detection model according to the verification result to obtain an updated vulnerability detection model.

[0009] In one embodiment, dynamic time synchronization processing is performed on multi-modal network security data, and multi-source data streams with time series alignment are generated through cross-modal correlation analysis, including:

[0010] Determine the time window partitioning strategy according to the event types of multi-modal network security data, where the event types include network request events, system login events, and code submission events;

[0011] Adopt a dynamic time window adjustment algorithm based on event triggering to perform sliding window compensation on the microsecond-level timestamps of network transmission layer traffic data and the second-level timestamps of system operation logs, and obtain the data within the compensated time window;

[0012] Perform cross-modal causal correlation analysis on the data within the compensated time window through a causal network model to generate multi-source data streams with time series alignment.

[0013] In one embodiment, a hybrid model is obtained through the following steps:

[0014] Convert the source code in the code repository data into LLVM intermediate representation code through a compiler. The LLVM intermediate representation code is a low-level code format independent of programming languages;

[0015] Generate a cross-language control flow graph based on the LLVM intermediate representation code. The cross-language control flow graph characterizes the code execution path and logical dependency relationship;

[0016] Input the cross-language control flow graph into a graph convolutional network for graph structure feature extraction, and fuse the semantic vectors output by the code pre-training model to obtain code semantic feature vectors, and construct a supervised learning branch;

[0017] Extract time series features from network transmission layer traffic data. The time series features include request frequency, protocol type distribution, and packet size sequence;

[0018] Extract statistical features from system operation log data. The statistical features include user operation frequency and geographical distribution of abnormal logins;

[0019] Input the time series features and statistical features into a variational autoencoder for dimensionality reduction and reconstruction, and generate anomaly scores through an isolation forest algorithm to construct an unsupervised learning branch;

[0020] Combine the supervised learning branch and the unsupervised learning branch, perform feature splicing on the code semantic feature vectors and the anomaly scores, and generate hybrid feature vectors;

[0021] Input the hybrid feature vectors into a fully connected classification layer, output the vulnerability probability and anomaly risk score, and obtain the hybrid model.

[0022] In one embodiment, cross-modal features are extracted from the time-aligned multi-source data stream, and semantic fusion is performed on the cross-modal features in combination with the vulnerability knowledge graph to generate a multi-dimensional feature vector, including:

[0023] Extract metadata features of the transport layer security protocol handshake phase from the network transport layer traffic data. The metadata features include server name indication, certificate chain information, and protocol version.

[0024] Statistically analyze the size distribution characteristics of encrypted data packets in the network transport layer traffic data to generate a packet size sequence histogram.

[0025] Perform pattern encoding on the user behavior sequence in the system operation log to generate a user behavior feature vector.

[0026] Input the metadata features, the packet size sequence histogram, and the user behavior feature vector into the vulnerability knowledge graph for semantic association to generate a multi-dimensional feature vector.

[0027] In one embodiment, a vulnerability detection model is used to detect real-time network behavior data, and a vulnerability probability and an abnormal risk score are output, including:

[0028] Extract metadata features of the transport layer security protocol handshake phase from the real-time network traffic data of the real-time network behavior data. The metadata features include server name indication, certificate chain information, and protocol version.

[0029] Extract user operation sequence features from the real-time system operation log of the real-time network behavior data. The user operation sequence features include permission change records and abnormal login time distribution.

[0030] Input the metadata features and the user operation sequence features into the vulnerability knowledge graph for semantic association to generate a real-time multi-dimensional feature vector.

[0031] Input the real-time multi-dimensional feature vector into the supervised learning branch of the hybrid model to perform vulnerability pattern matching on the code execution path features and output the known vulnerability probability.

[0032] Input the real-time multi-dimensional feature vector into the unsupervised learning branch of the hybrid model to perform anomaly detection on the statistical distribution of network traffic and log features and output the abnormal risk score.

[0033] Fuse the known vulnerability probability and the abnormal risk score, and combine the vulnerability threat level weights in the vulnerability knowledge graph to generate the vulnerability probability and the abnormal risk score.

[0034] In one embodiment, the vulnerability detection model is updated according to the verification result to obtain an updated vulnerability detection model, including:

[0035] If the verification result is that the vulnerability verification is successful, mark the corresponding vulnerability feature vector as a true positive sample;

[0036] If the verification result is that the vulnerability verification fails and the abnormal risk score exceeds the preset threshold, mark the corresponding vulnerability feature vector as a potential threat sample;

[0037] Monitor the output confidence of the vulnerability detection model through the drift awareness module, and calculate the KL divergence difference between the real-time input feature distribution of the vulnerability detection model and the historical training data;

[0038] If the KL divergence difference exceeds the dynamically adjusted threshold, it is determined as a concept drift event. Through the incremental learning mechanism, use the elastic weight consolidation method to update the parameters of the vulnerability detection model to obtain the updated vulnerability detection model;

[0039] Among them, using the elastic weight consolidation method to update the parameters of the vulnerability detection model includes the following steps:

[0040] Lock the neuron weights strongly related to the vulnerability in the vulnerability detection model. The neuron weights strongly related to the vulnerability include memory operation mode features and abnormal protocol request sequence features;

[0041] Update the unlocked weights based on the true positive samples and potential threat samples to obtain the updated parameter set, and update the updated parameter set to the vulnerability detection model to generate the updated vulnerability detection model.

[0042] In a second aspect, the present application also provides a network security vulnerability intelligent detection system based on artificial intelligence and big data. The system includes:

[0043] A data processing module for performing dynamic time synchronization processing on multi-modal network security data, and generating a time-series aligned multi-source data stream through cross-modal correlation analysis. The multi-modal network security data includes network transmission layer traffic data, system operation logs, code repository data, and vulnerability feature data in a public vulnerability database;

[0044] A graph construction module for extracting cross-modal features from the time-series aligned multi-source data stream, and performing semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector. The vulnerability knowledge graph is constructed based on the Common Vulnerabilities and Exposures (CVE) framework;

[0045] A network detection module for training the multi-dimensional feature vector through a hybrid model combining supervised learning and unsupervised learning to obtain a vulnerability detection model, and using the vulnerability detection model to detect real-time network behavior data, and outputting a vulnerability probability and an abnormal risk score;

[0046] The vulnerability verification module is used to perform automated vulnerability verification based on vulnerability probability and anomaly risk score, obtain verification results, and update the vulnerability detection model based on the verification results to obtain an updated vulnerability detection model.

[0047] In a third aspect, the present application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the first aspect when executing the computer program.

[0048] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the first aspect when executed by a processor.

[0049] This intelligent network security vulnerability detection method based on artificial intelligence and big data effectively overcomes the inadequate utilization of single-modal data in traditional vulnerability detection methods by dynamically processing multimodal network security data and conducting cross-modal correlation analysis. It comprehensively integrates vulnerability signature data from network transport layer traffic data, system operation logs, code repository data, and public vulnerability databases, providing a rich data foundation for subsequent vulnerability detection. Furthermore, by semantically fusing cross-modal signatures with a vulnerability knowledge graph constructed based on a common vulnerability enumeration framework, this method not only accurately represents network security-related entities and their relationships, but also deeply explores potential connections between data, thus avoiding the limitations of traditional methods that lack semantic understanding of data. Secondly, this method trains multidimensional feature vectors using a hybrid model combining supervised and unsupervised learning, effectively improving the detection capabilities of both known and unknown vulnerabilities and outputting more accurate vulnerability probabilities and anomaly risk scores. Finally, this method automatically verifies vulnerabilities and updates the vulnerability detection model based on vulnerability probabilities and anomaly risk scores, enabling the model to continuously adapt to new network environments and vulnerability signatures, maintaining the stability and advancement of its detection performance.

[0050] Compared with traditional methods, this method improves the accuracy, comprehensiveness and timeliness of network security vulnerability detection through multimodal data fusion, knowledge graph semantic fusion, hybrid model training and model updating, providing effective technical support for network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following briefly introduces the drawings required for use in the embodiments or related technical descriptions. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 Flowchart of an intelligent network security vulnerability detection method based on artificial intelligence and big data provided for an exemplary embodiment of the present invention;

[0053] Figure 2 Schematic structural diagram of an intelligent network security vulnerability detection system based on artificial intelligence and big data provided for an exemplary embodiment of the present invention. Detailed implementation manners

[0054] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application.

[0055] In one embodiment, as Figure 1 shown, an intelligent network security vulnerability detection method based on artificial intelligence and big data is provided. In this embodiment, an example is given where this method is applied to a terminal. It can be understood that this method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0056] S101: Perform dynamic time synchronization processing on multi-modal network security data, and generate a multi-source data stream with time series alignment through cross-modal correlation analysis. The multi-modal network security data includes network transmission layer traffic data, system operation logs, code repository data, and vulnerability feature data in a public vulnerability database.

[0057] Specifically, network transmission layer traffic data can be obtained through network sniffing tools, including information such as the transmission frequency of network packets, protocol types, source IP addresses, destination IP addresses, port numbers, etc. System operation logs can be obtained through system log collection tools, including user operation records, system error messages, service start and stop times, etc. Code repository data can be obtained through code repository management tools, covering information such as source code files, code change records, and code submitter information. The vulnerability feature data in the public vulnerability database is obtained by accessing public vulnerability databases such as CVE (Common Vulnerabilities and Exposures), including data such as vulnerability numbers, vulnerability descriptions, and vulnerability impact scopes. And since the multi-modal data from different sources may have differences in collection time, to ensure the consistency and accuracy of the data, a unified timestamp format can be set for each type of data, and the timestamps of different data sources can be aligned through a time synchronization algorithm. In addition, there may be potential correlation relationships between different modalities of data, and then the correlation information can be mined through cross-modal correlation analysis. Schematically, cross-modal correlation analysis can integrate relevant data by establishing correlation rules between different data modalities. For example, the abnormal access frequency of a specific IP address in the network transmission layer traffic data is associated with the user operation record corresponding to the same IP address in the system operation log, or the change record of a certain piece of code in the code repository data is matched with the feature data of the corresponding vulnerability in the public vulnerability database, so as to generate a multi-source data stream with time series alignment, providing a basis for subsequent feature extraction and analysis.

[0058] S102: Extract cross-modal features from the multi-source data stream with time series alignment, and semantically fuse the cross-modal features in combination with the vulnerability knowledge graph to generate a multi-dimensional feature vector. The vulnerability knowledge graph is constructed based on the Common Vulnerability Enumeration framework.

[0059] Specifically, when extracting cross-modal features, different feature extraction methods can be used for different types of multi-source data. For example, for network transport layer traffic data, temporal features such as request frequency, protocol type distribution, and packet size sequence can be extracted, as well as statistical features such as traffic peak and traffic mean. For system operation log data, statistical features such as user operation frequency and the geographical distribution of abnormal logins can be extracted. The vulnerability knowledge graph, built based on a general vulnerability enumeration framework, can integrate and represent various vulnerability information and related entities and relationships. For example, the vulnerability knowledge graph can include information such as vulnerability type, impact scope, and remediation methods, as well as the associations between vulnerabilities and entities such as software systems and network devices. By combining the vulnerability knowledge graph, the extracted cross-modal features can be semantically understood and analyzed, mapped into the semantic space of the knowledge graph. Using technologies such as graph neural networks, the feature vector can be associated with the semantic information in the vulnerability knowledge graph, thereby generating a more expressive and semantically rich multidimensional feature vector. This multidimensional feature vector can more comprehensively and accurately represent the security status of the network system, providing effective input for subsequent vulnerability detection model training.

[0060] S103: A multi-dimensional feature vector is trained by a hybrid model based on a combination of supervised learning and unsupervised learning to obtain a vulnerability detection model. The vulnerability detection model is used to detect real-time network behavior data and output vulnerability probability and anomaly risk score.

[0061] Specifically, the hybrid model consists of a supervised learning branch and an unsupervised learning branch. In the supervised learning branch, multidimensional feature vectors with vulnerability labels are used as training data. Deep neural networks and other algorithms are used for training to learn the mapping between vulnerability features and labels, enabling accurate detection of known vulnerabilities. In the unsupervised learning branch, unlabeled multidimensional feature vectors are used, employing techniques such as clustering and autoencoders, to mine the underlying structure and distribution patterns in the data, identifying abnormal patterns and signs of unknown vulnerabilities. After training, the vulnerability detection model can be applied to real-time network behavior data. Schematically, real-time multimodal network security data is preprocessed, feature extracted, and semantically fused according to the aforementioned steps. The generated real-time multidimensional feature vectors are then input into the vulnerability detection model. By comprehensively analyzing the results of supervised and unsupervised learning, the model outputs the probability that the current network behavior contains a vulnerability and an anomaly risk score. The vulnerability probability indicates the likelihood that the network behavior is vulnerable, while the anomaly risk score indicates the degree to which the network behavior deviates from normal patterns.

[0062] S104: Automatically verify the vulnerability based on the vulnerability probability and the abnormal risk score, obtain the verification result, and update the vulnerability detection model according to the verification result to obtain the updated vulnerability detection model.

[0063] Specifically, after the vulnerability detection model outputs the vulnerability probability and the abnormal risk score, it needs to be verified to determine whether there is really a vulnerability. This automatic vulnerability verification can further detect and analyze the network system through technical means such as simulated attacks and vulnerability scans. For example, in the case of a high vulnerability probability, a vulnerability scanning tool can be used to scan the relevant network devices or software systems to verify whether there is a corresponding vulnerability. After obtaining the verification result, the vulnerability detection model can be updated according to the verification result. If the verification result confirms the existence of a vulnerability, the multi-dimensional feature vector related to the vulnerability and its corresponding label information can be added to the training data set, and the hybrid model can be retrained to optimize the parameters and structure of the model, so that the model can better adapt to the new vulnerability characteristics and improve the detection performance. If the verification result excludes the existence of a vulnerability, this data can be added to the training data set as a normal sample to help the model further learn the characteristics of normal network behavior and reduce false positives. Through continuous feedback and update, it can ensure that the vulnerability detection model always maintains high-efficiency and accurate detection capabilities and adapts to the changing network security environment.

[0064] In the above method, by performing dynamic time synchronization processing on multi-modal network security data, the time differences between different data can be effectively eliminated. And through cross-modal correlation analysis, a multi-source data stream with time series alignment is generated, avoiding information loss caused by data asynchronization and isolated analysis, and being able to more comprehensively and accurately reflect the security situation of the network system, providing a reliable data basis for subsequent vulnerability detection. Secondly, cross-modal features are extracted from the multi-source data stream with time series alignment, and semantic fusion of the cross-modal features is performed in combination with the vulnerability knowledge graph constructed based on the Common Vulnerabilities and Exposures (CVE) framework to generate a multi-dimensional feature vector, eliminating the deviation in data semantic understanding and enabling the feature vector to truly reflect network security-related entities and their relationships. In addition, a hybrid model combining supervised learning and unsupervised learning is used to train the multi-dimensional feature vector to obtain a vulnerability detection model, and this model is used to detect real-time network behavior data, outputting vulnerability probabilities and anomaly risk scores. It can fully mine the association and complementary information between different types of data, and compared with the analysis of a single data type or a single learning method, it can more accurately evaluate the vulnerability risk of the network system and improve the accuracy and reliability of vulnerability detection. Finally, automated vulnerability verification is performed according to the vulnerability probabilities and anomaly risk scores to obtain verification results, and the vulnerability detection model is updated according to the verification results to obtain an updated vulnerability detection model. It can quickly and accurately adjust the detection strategy when the network environment is constantly changing, further enhancing the detection ability for new and unknown vulnerabilities, reducing network security risks, and ensuring the stable operation of the network system.

[0065] In an exemplary embodiment, dynamic time synchronization processing is performed on multi-modal network security data, and a multi-source data stream with time series alignment is generated through cross-modal correlation analysis, including:

[0066] Determine a time window partitioning strategy according to the event types of the multi-modal network security data, where the event types include network request events, system login events, and code submission events;

[0067] Adopt a dynamic time window adjustment algorithm based on event triggering to perform sliding window compensation on the microsecond-level timestamps of network transport layer traffic data and the second-level timestamps of system operation logs to obtain the data within the compensated time window;

[0068] Perform cross-modal causal correlation analysis on the data within the compensated time window through a causal network model to generate a multi-source data stream with time series alignment.

[0069] Specifically, different types of events have different importance and temporal characteristics in network security monitoring. Therefore, it is necessary to determine an appropriate time window partitioning strategy according to the event type. Network request events usually reflect the real-time interaction situation of the network system. Their occurrence frequency may be relatively high, and they are highly sensitive to time. Moreover, minor time changes may imply different network behavior patterns. For example, a large number of network requests within a short period may be signs of an attack. System login events are related to user operations, and their occurrence frequency may be relatively lower than that of network request events. Code submission events mainly involve code updates of software systems. Their occurrence is relatively less frequent, but each code submission may introduce new security vulnerabilities or fix known vulnerabilities. Based on the characteristics of different types of events, a reasonable time window size and partitioning method can be determined to ensure that effective data collection and analysis can be carried out for each event type within an appropriate time window. For example, for network request events, a smaller time window can be set to more precisely capture their dynamic changes; for system login events and code submission events, relatively larger time windows can be set.

[0070] Specifically, network transport layer traffic data usually has a timestamp accuracy at the microsecond level, which can very precisely record the time point of data transmission. The timestamp accuracy of system operation logs is usually at the second level, which is relatively rough. Therefore, a dynamic time window adjustment algorithm based on event triggering can be adopted to align the two in terms of time. This algorithm mainly dynamically adjusts the time window according to the occurrence of events. That is, when a specific event (such as a network request event, a system login event, or a code submission event) occurs, the algorithm can, according to the event type and timestamp information, adjust the microsecond-level timestamp of network transport layer traffic data and the second-level timestamp of system operation logs in a sliding window manner. Schematically, first, the two timestamps are uniformly converted into a standard time format, and then interpolation or extrapolation compensation is performed on the timestamps according to the time sequence of event triggering. For example, when there is a microsecond-level difference between the timestamp of a network request event and the timestamp of a system login event, the precise position of the system login event on the microsecond-level time axis can be estimated through interpolation, so as to achieve data alignment of two timestamps with different precisions.

[0071] Specifically, the causal network model is a graph model used to represent causal relationships between variables. In this embodiment, different modalities of data are regarded as different variable nodes, and a causal network is constructed by analyzing the statistical dependence relationship and chronological order between the data. For example, the association between the IP address in the network request event and the user account in the system login event can be analyzed, or the causal relationship between the code changes in the code submission event and the error messages in the system operation log can be analyzed. And the constructed causal network model can be used to perform cross-modal association analysis on multi-source data within the compensated time window, that is, by calculating the causal strength and direction between different nodes, to determine the causal path and influence degree between the data. For example, if it is found that a specific IP address in the network request event has a strong causal relationship with an abnormal login attempt in the system login event, and this relationship shows a certain chronological order in time, it can be inferred that there may be a malicious attack behavior for this IP address. According to the results of cross-modal causal association analysis, integrating different modalities of data according to the causal relationship and chronological order can generate a multi-source data stream with time series alignment. In this data stream, each data point not only contains its own modality information, but also is associated with data in other modalities that have a causal relationship, thus forming a comprehensive and accurate integrated data stream reflecting the network security status, providing a solid data foundation for subsequent vulnerability detection and analysis.

[0072] In an exemplary embodiment, the hybrid model is obtained through the following steps:

[0073] Convert the source code in the code repository data into LLVM intermediate representation code through a compiler. The LLVM intermediate representation code is a low-level code format independent of the programming language;

[0074] Generate a cross-language control flow graph based on the LLVM intermediate representation code. The cross-language control flow graph characterizes the code execution path and logical dependence relationship;

[0075] Input the cross-language control flow graph into a graph convolutional network for graph structure feature extraction, and fuse the semantic vectors output by the code pre-training model to obtain a code semantic feature vector, and construct a supervised learning branch;

[0076] Extract time series features from the network transport layer traffic data. The time series features include request frequency, protocol type distribution, and packet size sequence;

[0077] Extract statistical features from the system operation log data. The statistical features include user operation frequency and abnormal login geographical distribution;

[0078] Input the time series features and statistical features into a variational autoencoder for dimensionality reduction and reconstruction, and generate an anomaly score through an isolation forest algorithm, and construct an unsupervised learning branch;

[0079] Combine the supervised learning branch and the unsupervised learning branch, perform feature concatenation on the code semantic feature vector and the anomaly score to generate a mixed feature vector;

[0080] Input the mixed feature vector into the fully connected classification layer, output the vulnerability probability and the anomaly risk score, and obtain the mixed model.

[0081] Specifically, the code repository data contains the source code of the software system, and different software systems may be written in multiple programming languages. To be able to uniformly process code in different languages, the source code can be converted into LLVM intermediate representation code through a compiler. LLVM IR is a low-level code format independent of programming languages, with good generality and portability. Subsequently, the instruction sequences and control structures in the LLVM IR code can be transformed into nodes and edges in the control flow graph to generate a cross-language control flow graph. Among them, the nodes represent the basic blocks in the code, that is, a continuous sequence of executed code, and the edges represent the control transfer relationships between the basic blocks. This cross-language control flow graph clearly shows the process and logical dependencies of the code during execution. The graph convolutional network is a neural network specifically used to process graph-structured data, which can extract and learn features of the nodes and edges in the graph. In this embodiment, the graph convolutional network can extract the feature information of the graph structure by performing convolution operations on the nodes and edges of the cross-language control flow graph. For example, this graph convolutional network can learn features such as the connection relationships between different basic blocks and the direction of the control flow. And these features can reflect the structural and logical characteristics of the code. In addition, the code pre-training model can be obtained by pre-training on a large amount of code data and can capture the semantic information of the code. By algorithms such as vector concatenation and weighted summation, the semantic vector output by this model is fused with the graph structure features extracted by the graph convolutional network, and a code semantic feature vector that combines code structure and semantic information can be obtained. This vector contains rich code semantic information and can be used for the supervised learning branch.

[0082] The traffic data of the network transport layer reflects the data transmission situation in the network. Among them, the change in the request frequency can reflect the network usage and potential security threats. Analyzing the distribution of protocol types can help understand the usage ratio of various protocols in the network and whether there are abnormal protocol usage situations. The packet size sequence records the size sequence of network data packets. The system operation log data records the operation status of the system and the operation information of users. Among them, the user operation frequency can be obtained by counting the frequencies of various operations of users in the system, such as the number of times of file access, system configuration change, etc. The variational autoencoder is a neural network model that can perform dimensionality reduction and reconstruction on high-dimensional data. In this embodiment, by inputting the time series features and statistical features into the variational autoencoder, they can be mapped into a low-dimensional space and the important information of the data can be retained. And the isolation forest algorithm is an unsupervised anomaly detection algorithm that can identify the anomaly points in the data by constructing isolation trees. After processing the data after dimensionality reduction and reconstruction through the isolation forest algorithm, for each data point, this algorithm can calculate its path length in the isolation tree. The shorter the path length, the higher the possibility that the data point is an anomaly point. Through this process, an anomaly score can be generated for each data to measure whether it is abnormal data. And based on the generated anomaly score, an unsupervised learning branch can be constructed. This branch can detect the anomalies in the network transport layer traffic data and system operation log data without prior labels, thereby discovering potential security vulnerabilities or abnormal behaviors, and supplementing the deficiencies of the supervised learning branch in detecting unknown vulnerabilities.

[0083] Specifically, the code semantic feature vector obtained from the supervised learning branch and the anomaly score generated by the unsupervised learning branch can be feature spliced, that is, the code semantic feature vector and the anomaly score are concatenated in a certain order to form a mixed feature vector. This mixed feature vector combines the code semantic information and the anomaly information in the network traffic and system logs, providing a more comprehensive feature representation for subsequent analysis. By inputting the generated mixed feature vector into the fully connected classification layer, calculations and judgments can be made according to the information in the mixed feature vector through the learned model parameters, and the vulnerability probability and anomaly risk score are output. Among them, the vulnerability probability indicates the likelihood of the current code or network behavior having a vulnerability, and the anomaly risk score comprehensively considers various factors to quantitatively evaluate the anomaly degree of the network behavior. Through this process, a final mixed model can be obtained, which can comprehensively utilize multi-modal data to more accurately detect network security vulnerabilities and evaluate anomaly risks.

[0084] In an exemplary embodiment, cross-modal features are extracted from the temporally aligned multi-source data streams, and semantic fusion of the cross-modal features is performed in combination with the vulnerability knowledge graph to generate a multi-dimensional feature vector, including:

[0085] Extract metadata features of the Transport Layer Security protocol handshake phase from network transport layer traffic data. The metadata features include server name indication, certificate chain information, and protocol version.

[0086] Count the size distribution characteristics of encrypted data packets in the network transport layer traffic data and generate a packet size sequence histogram;

[0087] Encode the user behavior sequence in the system operation log to generate the user behavior feature vector;

[0088] The metadata features, package size sequence histogram and user behavior feature vector are input into the vulnerability knowledge graph for semantic association to generate a multi-dimensional feature vector.

[0089] Specifically, Server Name Indication (SNI) is an extension that allows the client to specify the domain name of the server to connect to in its initial connection request. By extracting SNI information, the specific name of the target server to which the client is attempting to connect can be determined. A certificate chain consists of a series of digital certificates used to verify the server's identity. Extracting this certificate chain information can help verify the validity of the server certificate, the credibility of the issuing authority, and the certificate's validity period. Different versions of the Transport Layer Security (TLS) protocol have different security features and vulnerabilities. Extracting protocol version information can reveal the protocol version used by the current network connection, allowing for security assessment. By extracting this metadata feature, key information about the TLS handshake phase can be obtained from network transport layer traffic data, providing a foundation for subsequent security analysis. Furthermore, network transport layer traffic data contains a large number of encrypted packets, and the size distribution of these packets may contain important security information. For example, by recording the size of each encrypted packet and grouping them by size range, the size distribution of the encrypted packets can be obtained and presented as a packet size series histogram. The packet size sequence histogram can intuitively display the distribution characteristics of the encrypted data packet size, and can mine the characteristics of the encrypted data packet size distribution from the network transport layer traffic data, providing valuable information for subsequent network security analysis.

[0090] Specifically, the system operation logs record various operation behaviors of users in the system. The user behavior sequences in the system operation logs can be pattern-coded to analyze user behaviors. Schematically, first, various operations of users can be classified and defined, such as file access, system configuration changes, user logins, data queries, etc. Then, the user behavior sequences can be recorded in chronological order, and each operation can be encoded. This encoding method can use digital encoding or other forms of encoding, so that each operation corresponds to a unique encoding value. Finally, algorithms such as the bag-of-words model and sequence model can be used to process this encoding, extract the characteristics of user behaviors, and integrate them into a user behavior feature vector. This user behavior feature vector can reflect the behavior patterns and characteristics of users in the system. By analyzing this user behavior feature vector, abnormal changes in user behaviors can be detected in a timely manner, and corresponding security measures can be taken.

[0091] Specifically, after inputting the metadata features, the packet size sequence histogram, and the user behavior feature vector into the vulnerability knowledge graph, it is possible to determine whether the extracted features are associated with known vulnerabilities according to the relationships between the vulnerabilities recorded in the vulnerability knowledge graph and aspects such as the transport layer security protocol and user behaviors. For example, if a certain vulnerability is recorded in the vulnerability knowledge graph as being related to a specific transport layer security protocol version and user behavior pattern, and the extracted metadata features also include this protocol version, and the corresponding behavior pattern also exists in the user behavior feature vector, then it can be considered that this feature has a certain semantic association with this vulnerability. Through this process, features of different modalities can be integrated and fused to generate a multi-dimensional feature vector. This multi-dimensional feature vector can more comprehensively and accurately reflect the security state of the network system, providing strong support for subsequent vulnerability detection and analysis.

[0092] In an exemplary embodiment, a vulnerability detection model is used to detect real-time network behavior data, and a vulnerability probability and an abnormal risk score are output, including:

[0093] Extract metadata features in the transport layer security protocol handshake phase from the real-time network traffic data of the real-time network behavior data. The metadata features include server name indication, certificate chain information, and protocol version;

[0094] Extract user operation sequence features from the real-time system operation logs of the real-time network behavior data. The user operation sequence features include permission change records and abnormal login time distributions;

[0095] Input the metadata features and the user operation sequence features into the vulnerability knowledge graph for semantic association to generate a real-time multi-dimensional feature vector;

[0096] Input the real-time multi-dimensional feature vector into the supervised learning branch of the hybrid model to perform vulnerability pattern matching on the code execution path features, and output the probability of known vulnerabilities;

[0097] Input the real-time multi-dimensional feature vector into the unsupervised learning branch of the hybrid model to perform anomaly detection on the statistical distribution of network traffic and log features, and output the anomaly risk score;

[0098] Fuse the probability of known vulnerabilities and the anomaly risk score, and combine the vulnerability threat level weights in the vulnerability knowledge graph to generate the probability of vulnerabilities and the anomaly risk score.

[0099] Specifically, real-time network behavior data contains rich network activity information, and real-time network traffic data is an important component. And during the network transmission process, the handshake stage of the transport layer security protocol is a key link to ensure the secure transmission of data. Extracting metadata such as server name indication, certificate chain information, and protocol version from real-time network traffic data helps with subsequent network security assessments. Extracting user operation sequence features such as permission change records and abnormal login time distributions from real-time system operation logs helps to detect potential account theft or system attacks in a timely manner. Inputting both into the vulnerability knowledge graph can generate a real-time multi-dimensional feature vector. Inputting this feature vector into the supervised learning branch of the hybrid model can match it with the pre-learned known vulnerability patterns to determine whether there are feature patterns similar to known vulnerabilities in the current real-time network behavior data, and calculate the probability of the existence of known vulnerabilities based on the matching results. Inputting this feature vector into the unsupervised learning branch of the hybrid model can perform anomaly judgment by learning the statistical distribution pattern of this feature vector under normal circumstances, and calculate the corresponding anomaly risk score based on the degree of difference between the feature distribution in the input real-time multi-dimensional feature vector and the normal pattern. Based on the vulnerability threat level weights in the vulnerability knowledge graph, the probability of known vulnerabilities and the anomaly risk score are weighted and fused to generate the final probability of vulnerabilities and the anomaly risk score. Among them, according to the vulnerability threat level in the vulnerability knowledge graph, different weights are assigned to vulnerabilities at different levels. For example, high-risk vulnerabilities have higher weights, and low-risk vulnerabilities have lower weights.

[0100] In an exemplary embodiment, update the vulnerability detection model according to the verification result to obtain an updated vulnerability detection model, including:

[0101] If the verification result is that the vulnerability verification is successful, mark the corresponding vulnerability feature vector as a true positive sample;

[0102] If the verification result is that the vulnerability verification fails and the anomaly risk score exceeds the preset threshold, mark the corresponding vulnerability feature vector as a potential threat sample;

[0103] Monitor the output confidence of the vulnerability detection model through the drift perception module, and calculate the KL divergence difference between the real-time input feature distribution of the vulnerability detection model and the historical training data;

[0104] If the KL divergence difference exceeds the dynamically adjusted threshold, it is determined as a concept drift event. Through the incremental learning mechanism, the elastic weight consolidation method is used to update the parameters of the vulnerability detection model to obtain an updated vulnerability detection model;

[0105] Among them, using the elastic weight consolidation method to update the parameters of the vulnerability detection model includes the following steps:

[0106] Lock the neuron weights strongly related to vulnerabilities in the vulnerability detection model. The neuron weights strongly related to vulnerabilities include memory operation mode features and abnormal protocol request sequence features;

[0107] Update the non-locked weights based on the true positive samples and potential threat samples to obtain an updated parameter set, and update the updated parameter set to the vulnerability detection model to generate an updated vulnerability detection model.

[0108] Specifically, after automated vulnerability verification based on vulnerability probability and abnormal risk score. If the verification result is successful for vulnerability verification, the vulnerability feature vector is marked as a true positive sample, that is, its label is set to 1, indicating that there is indeed a vulnerability. This true positive sample is used as important training data for subsequent model updates to help the model learn known vulnerability features. If the verification result is a failure for vulnerability verification and the abnormal risk score exceeds the preset threshold, it means that although the current evidence is not sufficient to confirm the vulnerability, the network behavior has a relatively high degree of abnormality and there may be unknown threats or false positives. Then the corresponding vulnerability feature vector is marked as a potential threat sample, that is, its label is set to 0.5 (between normal and vulnerability). And this potential threat sample is also included in the training data for subsequent model updates to help the model identify possible abnormal patterns. In addition, to timely detect possible performance changes in the vulnerability detection model during operation, the confidence level output by the vulnerability detection model can be continuously monitored through the drift awareness module. The change in this confidence level can reflect the fluctuation of the model performance or the change in the data distribution. The KL (Kullback-Leibler) divergence is an index for measuring the difference between two probability distributions. The drift awareness module can also calculate the KL divergence difference between the real-time input feature distribution of the vulnerability detection model and the historical training data to quantify the difference degree between the real-time input feature distribution and the historical training data distribution. If the KL divergence difference is small, it means that the feature distribution of the real-time input data is relatively similar to the data distribution during model training, and the performance of the model may be relatively stable. When the KL divergence difference calculated by the drift awareness module exceeds the preset dynamic adjustment threshold, a concept drift event is determined. Concept drift refers to the situation where, during the operation of the model, due to changes in the data distribution, features, or concepts, etc., the performance of the model decreases. Subsequently, the parameter update of the vulnerability detection model with decreased performance can be performed through the incremental learning mechanism in combination with the elastic weight consolidation method. Among them, the incremental learning mechanism allows the model to be updated and optimized using new data without retraining all the data, thereby improving the adaptability and efficiency of the model. The elastic weight consolidation method is a technique for protecting important weights from being overly modified during the model update process. In this embodiment, the parameter update of the vulnerability detection model can be performed through the elastic weight consolidation method, and it can be ensured that the model does not lose the important knowledge and feature patterns learned before when adapting to new data, so as to obtain the updated vulnerability detection model, enabling it to better cope with the changed network environment and data features.

[0109] Specifically, the elastic weight consolidation method is adopted to update the parameters of the vulnerability detection model. In this vulnerability detection model, there are some neuron weights closely related to vulnerabilities, such as the weights corresponding to the memory operation mode feature and the abnormal protocol request sequence feature. Among them, the memory operation mode feature can reflect the behavior pattern of the system in terms of memory usage. The abnormal protocol request sequence feature focuses on the sequence of network protocol requests. By locking the neuron weights strongly related to vulnerabilities, these important weights can be protected from being randomly modified during the model update process, ensuring that the model can still maintain high accuracy and stability when dealing with vulnerability detection tasks related to these features. Subsequently, the non-locked weights in the model can be updated using the previously labeled true positive samples and potential threat samples, and an updated parameter set can be obtained. Applying this updated parameter set to the vulnerability detection model to update the model can generate an updated vulnerability detection model. This updated model can better process the current network behavior data, improve the accuracy of vulnerability detection and the ability to identify potential threats, thus providing more effective protection for network security.

[0110] Based on the same inventive concept, as Figure 2 shown, an embodiment of the present application also provides a network security vulnerability intelligent detection system 200 based on artificial intelligence and big data. The implementation solution provided by this system to solve problems is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of a network security vulnerability intelligent detection system based on artificial intelligence and big data provided below can refer to the limitations on a network security vulnerability intelligent detection method based on artificial intelligence and big data in the above text, and will not be elaborated here. The system includes:

[0111] A data processing module 201, configured to perform dynamic time synchronization processing on multi-modal network security data, and generate a multi-source data stream with time series alignment through cross-modal correlation analysis. The multi-modal network security data includes network transmission layer traffic data, system operation logs, code repository data, and vulnerability feature data in a public vulnerability database;

[0112] A graph construction module 202, configured to extract cross-modal features from the multi-source data stream with time series alignment, and perform semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector. The vulnerability knowledge graph is constructed based on the Common Vulnerabilities and Exposures (CVE) framework;

[0113] A network detection module 203, configured to train the multi-dimensional feature vector through a hybrid model combining supervised learning and unsupervised learning to obtain a vulnerability detection model, and use the vulnerability detection model to detect real-time network behavior data, and output a vulnerability probability and an abnormal risk score;

[0114] The vulnerability verification module 204 is used to perform automated vulnerability verification based on the vulnerability probability and the abnormal risk score, obtain the verification result, and update the vulnerability detection model according to the verification result to obtain an updated vulnerability detection model.

[0115] In the above-mentioned intelligent network security vulnerability detection system 200 based on artificial intelligence and big data, the data processing module 201 can perform dynamic time synchronization processing and cross-modal correlation analysis on multi-modal network security data, effectively solving the problems of single data modality and insufficient time alignment in traditional vulnerability detection methods, and being able to comprehensively integrate the vulnerability feature data in network transmission layer traffic data, system operation logs, code repository data, and public vulnerability databases, thereby providing a rich data basis for subsequent vulnerability detection. The graph construction module 202 can extract cross-modal features from the multi-source data streams with time alignment, and perform semantic fusion in combination with the vulnerability knowledge graph constructed based on the Common Vulnerabilities and Exposures (CVE) framework, and then can effectively mine the potential semantic relationships between different data, generate multi-dimensional feature vectors, and avoid the limitation that traditional feature extraction methods cannot fully mine the associations between data. The network detection module 203 trains the multi-dimensional feature vectors through a hybrid model combining supervised learning and unsupervised learning, and then can comprehensively and accurately evaluate the vulnerability risk of the network system by leveraging the advantages of supervised learning and unsupervised learning. After obtaining the vulnerability detection model, this module can use the model to detect real-time network behavior data, output the vulnerability probability and the abnormal risk score, further improving the accuracy and reliability of vulnerability detection.

[0116] The vulnerability verification module 204 can perform automated vulnerability verification based on the vulnerability probability and the abnormal risk score, obtain the verification result, and update the vulnerability detection model according to the verification result, respond in a timely manner to changes in the network environment, continuously optimize the vulnerability detection model, and obtain an updated vulnerability detection model. This process enhances the detection ability for new and unknown vulnerabilities, can provide continuous and effective protection for network security, and significantly improves the efficiency and quality of network security vulnerability detection.

[0117] In an exemplary embodiment, the present invention further provides a computer device, including a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the steps of a method for intelligent detection of network security vulnerabilities based on artificial intelligence and big data according to the present application are implemented. A multi-core processor is preferably used to improve the parallel processing ability of the system. Memory: Provide sufficient temporary storage space to support the operation of the program and the processing of data. The memory capacity should be large enough to accommodate a large amount of supply information and computing tasks.

[0118] In an exemplary embodiment, the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of a network security vulnerability intelligent detection method based on artificial intelligence and big data according to the present application are implemented. The computer-readable storage medium may include: read-only memory (ROM, Read Only Memory), random access memory (RAM, Random Access Memory), solid state drives (SSD, SolidState Drives), or optical discs, etc. Among them, the random access memory may include resistive random access memory (ReRAM, Resistance Random Access Memory) and dynamic random access memory (DRAM, Dynamic RandomAccess Memory).

[0119] The above-described embodiments only express several implementation manners of the embodiments of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation on the patent scope of the embodiments of the application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the embodiments of the present application, several deformations and improvements can still be made, and these all belong to the protection scope of the embodiments of the present application.

Claims

1. An intelligent detection method for network security vulnerabilities based on artificial intelligence and big data, characterized in that, The method comprises: Performing dynamic time synchronization processing on the multimodal network security data and generating a time-aligned multi-source data stream through cross-modal correlation analysis, wherein the multimodal network security data includes network transport layer traffic data, system operation logs, code repository data, and vulnerability feature data from a public vulnerability database; Extracting cross-modal features from the time-aligned multi-source data streams and semantically fusing the cross-modal features with a vulnerability knowledge graph to generate a multi-dimensional feature vector, wherein the vulnerability knowledge graph is constructed based on a general vulnerability enumeration framework; The multidimensional feature vector is trained by a hybrid model based on a combination of supervised learning and unsupervised learning to obtain a vulnerability detection model, and the vulnerability detection model is used to detect real-time network behavior data to output vulnerability probability and anomaly risk score; Automated vulnerability verification is performed based on the vulnerability probability and the abnormal risk score to obtain a verification result, and the vulnerability detection model is updated based on the verification result to obtain an updated vulnerability detection model.

2. The method according to claim 1, characterized in that The performing dynamic time synchronization processing on the multimodal network security data and generating a time-aligned multi-source data stream through cross-modal correlation analysis includes: Determining a time window division strategy based on event types of the multimodal network security data, wherein the event types include network request events, system login events, and code submission events; Adopting a dynamic time window adjustment algorithm based on event triggering, a sliding window compensation is performed on the microsecond timestamp of the network transport layer traffic data and the second timestamp of the system operation log to obtain the data within the compensated time window; A cross-modal causal association analysis is performed on the data in the compensated time window through a causal network model to generate the time-aligned multi-source data stream.

3. The method according to claim 1, characterized in that, The hybrid model is obtained by the following steps: Convert the source code in the code repository data into LLVM intermediate representation code through a compiler, wherein the LLVM intermediate representation code is a low-level code format independent of the programming language; Generate a cross-language control flow graph based on the LLVM intermediate representation code, wherein the cross-language control flow graph represents the code execution path and logical dependency; The cross-language control flow graph is input into a graph convolutional network to extract graph structure features, and the semantic vector output by the code pre-training model is integrated to obtain a code semantic feature vector and construct a supervised learning branch; Extracting time series features from the network transport layer traffic data, the time series features including request frequency, protocol type distribution, and packet size sequence; Extracting statistical features from the system operation log data, the statistical features including user operation frequency and abnormal login geographical distribution; Inputting the time series features and the statistical features into a variational autoencoder for dimensionality reduction and reconstruction, and generating anomaly scores through an isolation forest algorithm to construct an unsupervised learning branch; Combining the supervised learning branch and the unsupervised learning branch, performing feature concatenation on the code semantic feature vector and the anomaly score to generate a hybrid feature vector; Input the mixed feature vector into the fully connected classification layer, output the vulnerability probability and the abnormal risk score, and obtain the mixed model.

4. The method according to claim 1, wherein Extracting cross-modal features from the temporally aligned multi-source data stream, and semantically fusing the cross-modal features with the vulnerability knowledge graph to generate a multi-dimensional feature vector, including: Extract metadata features of the handshake stage of the transport layer security protocol from the network transport layer traffic data, where the metadata features include server name indication, certificate chain information, and protocol version; Statistically analyze the size distribution characteristics of encrypted data packets in the network transport layer traffic data to generate a packet size sequence histogram; Perform pattern encoding on the user behavior sequence in the system operation log to generate a user behavior feature vector; Input the metadata features, the packet size sequence histogram, and the user behavior feature vector into the vulnerability knowledge graph for semantic association to generate the multi-dimensional feature vector.

5. The method according to claim 1, wherein Using the vulnerability detection model to detect real-time network behavior data and output a vulnerability probability and an abnormal risk score, including: Extract metadata features of the handshake stage of the transport layer security protocol from the real-time network traffic data of the real-time network behavior data, where the metadata features include server name indication, certificate chain information, and protocol version; Extract user operation sequence features from the real-time system operation log of the real-time network behavior data, where the user operation sequence features include permission change records and abnormal login time distribution; Input the metadata features and the user operation sequence features into the vulnerability knowledge graph for semantic association to generate a real-time multi-dimensional feature vector; Input the real-time multi-dimensional feature vector into the supervised learning branch of the mixed model to perform vulnerability pattern matching on the code execution path features and output the known vulnerability probability; Input the real-time multi-dimensional feature vector into the unsupervised learning branch of the mixed model to perform anomaly detection on the statistical distribution of network traffic and log features and output the abnormal risk score; Fuse the known vulnerability probability and the abnormal risk score, and combine the vulnerability threat level weights in the vulnerability knowledge graph to generate the vulnerability probability and the abnormal risk score.

6. The method according to claim 1, characterized in that, Updating the vulnerability detection model according to the verification result to obtain an updated vulnerability detection model, including: If the verification result is that the vulnerability verification is successful, mark the corresponding vulnerability feature vector as a true positive sample; If the verification result is that the vulnerability verification fails and the abnormal risk score exceeds the preset threshold, mark the corresponding vulnerability feature vector as a potential threat sample; Monitor the output confidence of the vulnerability detection model through a drift awareness module, and calculate the KL divergence difference between the real-time input feature distribution of the vulnerability detection model and the historical training data; If the KL divergence difference exceeds the dynamically adjusted threshold, it is determined as a concept drift event, and through an incremental learning mechanism, the elastic weight consolidation method is used to update the parameters of the vulnerability detection model to obtain the updated vulnerability detection model; Among them, the step of updating the parameters of the vulnerability detection model by using the elastic weight consolidation method includes the following steps: Lock the neuron weights strongly related to vulnerabilities in the vulnerability detection model, where the neuron weights strongly related to vulnerabilities include memory operation mode features and abnormal protocol request sequence features; Update the non-locked weights based on the true positive samples and the potential threat samples to obtain an updated parameter set, and update the updated parameter set to the vulnerability detection model to generate the updated vulnerability detection model.

7. An intelligent network security vulnerability detection system based on artificial intelligence and big data, characterized in that, The system includes: A data processing module for performing dynamic time synchronization processing on the multimodal network security data and generating a multi-source data stream with time series alignment through cross-modal correlation analysis. The multimodal network security data includes network transmission layer traffic data, system operation logs, code repository data, and vulnerability feature data in a public vulnerability database; A graph construction module for extracting cross-modal features from the multi-source data stream with time series alignment and performing semantic fusion on the cross-modal features in combination with a vulnerability knowledge graph to generate a multi-dimensional feature vector. The vulnerability knowledge graph is constructed based on the Common Vulnerabilities and Exposures framework; A network detection module for training the multi-dimensional feature vector through a hybrid model combining supervised learning and unsupervised learning to obtain a vulnerability detection model, and using the vulnerability detection model to detect real-time network behavior data and output a vulnerability probability and an abnormal risk score; A vulnerability verification module for performing automated vulnerability verification based on the vulnerability probability and the abnormal risk score to obtain a verification result, and updating the vulnerability detection model according to the verification result to obtain an updated vulnerability detection model.

8. A computer device, comprising a memory and a processor, the memory storing a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the method according to any one of claims 1 to 6.

Images