Network security analysis early warning system based on artificial intelligence

Abstract

The invention discloses a network security analysis early warning system based on artificial intelligence, and relates to the technical field of network security, and the system comprises the following steps: S1, constructing a multi-dimensional state table based on original traffic features; s2, generating an attack graph based on a causal relationship by using the state table; s3, extracting a topological evolution path by using an attack graph; s4, performing joint mode mapping by using the state table and the risk path; and S5, performing neural discriminant embedding modeling by using the composite risk event set. Through setting the attack graph based on the causal relationship, the technology significantly improves the integrity of risk propagation condition modeling, and lays a more stable data foundation for intelligent early warning of network security risk propagation. The joint modeling overcomes the problems of insufficient data granularity and incomplete application conditions caused by only depending on adjacency relation or simple condition judgment in the prior art, and can more clearly describe the internal relation between conditions when risk propagation occurs.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to an artificial intelligence-based network security analysis and early warning system. Background Art

[0002] As network infrastructure increasingly penetrates into production and life, the ways of network security risks occurring are becoming increasingly intelligent and highly concealed. The spread of such risks has characteristics such as uncertain propagation paths, highly coupled risk event occurrence conditions, and significant space-time diffusion effects of risk propagation. If such risks cannot be detected and warned early intelligently, it will inevitably lead to major security accidents. When such risks occur, if only relying on the pure rule-based data detection technology in the prior art for risk identification and propagation prediction, it cannot meet the technical requirements of high-speed, intelligent, and accurate risk early warning.

[0003] In the prior art, the modeling of network security risk propagation conditions mainly adopts static condition settings, lacking the joint modeling of the spatio-temporal connection, dependence conditions, and propagation weights in the risk propagation conditions. This deficiency leads to the inability of the prior art to accurately depict the internal connection between the conditions relied on when risk propagation occurs, resulting in insufficient modeling granularity and incomplete applicable conditions in the risk propagation model, thereby reducing the accuracy of risk propagation prediction. Summary of the Invention

[0004] Aiming at the deficiencies of the prior art, the present invention provides an artificial intelligence-based network security analysis and early warning system to solve the problems raised in the above background art.

[0005] To achieve the above object, the present invention provides the following technical solutions: In the first aspect, an embodiment of the present invention provides an artificial intelligence-based network security analysis and early warning system, including the following steps: S1. Construct a multi-dimensional state table based on the original traffic characteristics; S2. Generate an attack graph based on causal relationships using the state table; S3. Extract the topological evolution path using the attack graph to obtain the time-series risk path; S4. Perform joint pattern mapping using the state table and the risk path to obtain a composite risk event set; S5. Perform neural discriminative embedding modeling using the composite risk event set to obtain the risk event discrimination result.

[0006] To further optimize the technical solution, the state table generated in step S1 is a multi-dimensional structured data set sorted by time: ; Each record has the structure of: ; Among them, : The th connection record; : Connection ID; [[ID=!2]] : Timestamp; : Source / destination IP address; : Behavior vector; : Protocol status flag; : Abnormal flag bit.

[0007] To further optimize this technical solution, in step S2, the graph node mapping of the status nodes is first performed, and each status record is converted into a graph node , and a node set is established: ; The node attributes include connection identifier, behavior vector, protocol status, and abnormal flag bit, that is: .

[0008] To further optimize this technical solution, in step S2, the construction of causal edges is then performed, and the causal edge set is . If the status node and meet the following three conditions, then an edge is established: Time before and after logic: ; Behavior correlation constraint: , satisfying , where is the empirically set causal behavior deviation threshold; Protocol status evolution condition: The state transition from conforms to the reasonable state graph of the protocol; If the above three conditions are all met, then a directed edge is established: .

[0009] To further optimize this technical solution, in step S2, the construction and output of the causal attack graph are finally performed. By integrating the node set and the edge set , an attack graph is constructed: ; Each path in the graph represents a potential attack behavior chain.

[0010] Further optimize this technical solution. In step S3, candidate attack paths are first generated. In the attack graph , paths that meet the risk propagation characteristics are screened out from all existing acyclic paths (DAG paths) in the graph. The path is a node sequence: ; The path screening criteria include: Path length threshold limit: ; The cumulative index of abnormal node behavior exceeds the threshold: , where , is the cumulative index of abnormalities; Thus, the initial output candidate path set is obtained: .

[0011] Further optimize this technical solution. Then, in step S3, a path risk assessment function is constructed. Set the risk scoring function of path : ; Among them, , indicating the severity of behavior change; , indicating the propagation stability; is the empirical weight, satisfying ; is the time scale normalization function, , used to compress the influence of the time span.

[0012] Further optimize this technical solution. Finally, in step S3, a set of time-series risk paths is generated and sorted. Based on the risk score of the candidate path , a risk score threshold is set, so as to screen out the final set of high-risk paths: .

[0013] Further optimize this technical solution. In step S4, the risk path set generated in step S3 is structurally analyzed. The sliding window mechanism and time series segmentation technology are used to sort the connection data set in chronological order. For each risk path, it is detected whether there is a completely matching node and behavior sequence in each subsequence. For each successfully matched path instance, the subject and behavior relationship involved in its connection behavior is extracted to construct a path graph in the form of a directed graph.

[0014] To further optimize this technical solution, step S5 uses the result obtained in step S4 as input, maps the structured atlas set to a continuous vector space, constructs a neural discriminative embedding model to capture the complex non-linear relationships between risk events, and realizes the discrimination and classification of risk events.

[0015] In a second aspect, an embodiment of the present invention provides a computer device, including a memory and a processor, where the memory stores a computer program, and: when the computer program instructions are executed by the processor, the steps of an artificial intelligence-based network security analysis and early warning system as described in the first aspect of the present invention are implemented.

[0016] In a third aspect, an embodiment of the present invention provides a computer-readable storage medium, on which a computer program is stored, and: when the computer program instructions are executed by the processor, the steps of an artificial intelligence-based network security analysis and early warning system as described in the first aspect of the present invention are implemented.

[0017] Compared with the prior art, the present invention provides an artificial intelligence-based network security analysis and early warning system, which has the following beneficial effects: This artificial intelligence-based network security analysis and early warning system, by setting an attack atlas based on causal relationships, significantly improves the integrity of risk propagation condition modeling, laying a more solid data foundation for the intelligent early warning of network security risk propagation. This joint modeling overcomes the problems of insufficient data granularity and incomplete applicable conditions caused by simply relying on adjacency relationships or simple conditional judgments in the prior art, and can more clearly depict the internal relationships between conditions when risk propagation occurs. These internal relationships include key links such as spatio-temporal relationships, dependent conditions, and propagation weights, thereby endowing the intelligent early warning model with stronger data insights. This technology helps the network security risk propagation model to be more accurate in modeling and have more complete applicable conditions, providing a strong foundation for the intelligent analysis and early warning of risk propagation trends, and significantly improving the intelligent level of network security risk management. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0019] Figure 1 It is a schematic flowchart of an artificial intelligence-based network security analysis and early warning system proposed by the present invention; Figure 2Schematic diagram of the process for generating an attack graph based on an artificial intelligence network security analysis and early warning system proposed by the present invention; Figure 3 Schematic diagram of the process for extracting the topological evolution path of an artificial intelligence network security analysis and early warning system proposed by the present invention. Detailed implementation manners

[0020] In order to make the above objects, features and advantages of the present invention more obvious and understandable, the following detailed description of the specific implementation manners of the present invention will be given with reference to the accompanying drawings of the specification.

[0021] In the following description, many specific details are set forth in order to fully understand the present invention. However, the present invention can also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the connotation of the present invention. Therefore, the present invention is not limited by the specific embodiments disclosed below.

[0022] Secondly, the so-called "one embodiment" or "embodiment" herein refers to a specific feature, structure or characteristic that can be included in at least one implementation manner of the present invention. The "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it an independent or selectively exclusive embodiment from other embodiments.

[0023] Embodiment 1: Refer to Figures 1 to 3 , which is the first embodiment of the present invention. This embodiment provides an artificial intelligence network security analysis and early warning system, including the following steps: S1. Construct a multi-dimensional state table based on the original traffic characteristics; In step S1, a mature network traffic analysis engine is used to parse the original packet-level data to obtain structured five-tuple information (source IP, destination IP, source port, destination port, protocol type) and its associated complete session flow; through a mature feature extraction tool, the following are extracted from each session flow: session duration, number of packets, average packet length, throughput, communication interval, retransmission ratio, and then the features are transformed into a dimensionless representation using a standard normalization method to form a behavior vector; Subsequently, a protocol state graph is constructed based on the PROTOS protocol state analysis model to identify the protocol state of each session connection and mark the following contents: Whether there is a protocol state jump; Whether there is a sudden protocol switch; Whether there is a mutation in the behavior characteristics; The marking result is used as the abnormal flag bit for each record in the state table.

[0024] The finally generated state table is a multi-dimensional structured data set sorted by time: ; The structure of each record is as follows: : ; Among them, : The th connection record; : Connection ID; : Timestamp; : Source / destination IP address; : Behavior vector; : Protocol status flag; : Abnormal flag bit.

[0025] S2. Generate an attack graph based on causal relationships using the status table; In step S2, first perform graph node mapping of status nodes, and convert each status record into a graph node , and establish a node set: ; The node attributes include connection identifier, behavior vector, protocol status, and abnormal flag bit, that is: ; Then, in step S2, construct causal edges. The causal edge set is . If the status node and meet the following three conditions, then establish an edge : Temporal logic: ; Behavioral correlation constraint: , satisfying , where is the empirically set causal behavior deviation threshold; Protocol status evolution condition: The state transition from conforms to the protocol's reasonable state diagram; If all of the above three conditions are met, then establish a directed edge: .

[0026] Finally, in step S2, construct and output the causal attack graph. Combine the node set and the edge set to construct an attack graph: ; Each path in the graph Indicates a potential attack behavior chain.

[0027] Traditional graph construction methods are mostly based on static IP or port relationship graphs, such as "IP-communication graph" or "IP-domain name graph", lacking the ability to express the causality of connection behavior evolution; Step S2 realizes the causal graph modeling of deriving the attack path from state evolution through the combination of behavioral vector time series offset modeling and protocol state graph rules, making up for the problem that static graphs cannot express the evolution chain of attack stages; The composition rules are based on measured data parameters ( ), protocol state graph and behavioral similarity, which are more suitable for the dynamic security event modeling scenario.

[0028] S3. Use the attack graph to extract the topological evolution path to obtain the time series risk path; In step S3, in the attack graph Identify the attack paths with topological evolution characteristics, and accordingly construct a time-ordered set of high-risk attack paths .

[0029] In step S3, first generate candidate attack paths. In the attack graph , from all the existing acyclic paths (DAG paths) in the graph, select the paths that meet the risk propagation characteristics. The path is a node sequence: ; The path screening basis includes: Path length threshold limit: ; The cumulative index of node behavior anomalies exceeds the threshold: , where , is the anomaly cumulative index; Thus, the initial output candidate path set is obtained: ; Then, in step S3, construct a path risk assessment function, and set the risk score function of the path : ; Among them, , indicating the severity of behavior change; , indicating the propagation stability; is the empirical weight, satisfying ; is the time scale normalization function, , used to compress the influence of time span.

[0030] In step S3, the generation and sorting of the timing risk path set are finally carried out, based on the risk scores of the candidate paths , a risk score threshold is set , so as to screen out the final high-risk path set: ; Different from traditional graph mining techniques (such as static path enumeration based on IP communication graphs or using shortest path search for attack node positioning), the key difference in this step lies in: The graph composition comes from causal evolution paths rather than static communication structures; The risk path extraction process takes into account the cumulativeness of abnormal behaviors, the trend of behavior changes and the consistency of time evolution, rather than simply the path length or connection frequency; The output paths have a complete timing structure and the ability to sort risk values, and can be directly used for dynamic early warning tasks.

[0031] S4. Use the state table and risk paths for joint pattern mapping to obtain a set of composite risk events; In step S4, finite state path modeling (FSA) and structured sequence deconstruction techniques are used to structurally analyze the risk path set generated in step S3. Each path is represented as a sequence of nodes and behavior labels. The nodes reflect the roles of the subjects or objects in the events, and the labels represent the behavior relationships.

[0032] The sliding window mechanism and time series segmentation techniques are used to sort the connection data set in chronological order, and multiple sliding subsequences are constructed using a fixed window for subsequent path matching.

[0033] For each risk path, it is detected whether there is a completely matching node and behavior sequence in each subsequence. The matching needs to meet two conditions: consistent node types and consistent behavior labels. For each successfully matched path instance, the subjects and behavior relationships involved in its connection behavior are extracted to construct a path graph in the form of a directed graph.

[0034] Finally, all successfully matched path graphs are integrated into a set, which is used as the basic data structure for subsequent propagation modeling analysis. The output set of matching risk path graphs is the set of composite risk events, and its expression is: ; Where: is the set of matching risk path graphs, which is composed of graph instances constructed by all successfully matched paths; : a single path graph instance, representing the structural mapping result of a connection behavior chain, ; : Represents the number of the final hit path graphs.

[0035] S5. Use the composite risk event set to perform neural discriminative embedding modeling to obtain the risk event discrimination result; Step S5 takes the result obtained in step S4 as the input, and processes it through the following sub - processes to map the structured graph set to a continuous vector space, construct a neural discriminative embedding model for capturing complex non - linear relationships between risk events, and realize the discrimination and classification of risk events.

[0036] Graph encoding: Perform graph neural network encoding on each path graph instance to map it into a vector representation: ; Among them, represents the graph neural network encoding function, which is responsible for extracting the composite information of the graph structure and node features, aggregating neighbor node information using multi - layer graph convolution operations (Graph Convolution) to realize the structured high - dimensional representation of risk events, and the parameter set is , is the low - dimensional embedding vector with the dimension unified.

[0037] Discriminative embedding learning: Set the discriminative loss function, and use the risk level label to perform supervised training on the embedding vector : ; Among them, is the classification discriminant function, is the cross - entropy loss function; This formula optimizes the model parameters through the supervision signal to ensure that the embedding space has discriminability and can distinguish different risk types.

[0038] Risk event discrimination: After training, input any new risk path graph , and obtain its discriminant vector and risk category prediction through the neural discriminative embedding model. The discrimination result is: ; Among them, is the risk event category, represents the category label; This formula realizes the automatic discrimination of risk events through the classification output of the embedding vector, replaces the traditional method that relies on explicit rules for matching, and improves the ability to adapt to dynamic and complex network environments.

[0039] Step S5 finally outputs the set of risk event representations mapped by the neural discriminant embedding model: ; and the corresponding set of risk classification results , reflecting the deep discriminant ability of risk events.

[0040] Traditional rule matching mechanisms are based on predefined explicit rules, which are difficult to cover complex and ever-changing network security risk events, and rule design is time-consuming and difficult to maintain.

[0041] This step adopts a discriminant embedding model based on a neural network, which can automatically learn the complex non-linear structural features of risk events, has strong generalization ability and dynamic adaptation ability, and significantly improves the accuracy and robustness of risk discrimination.

[0042] Embodiment 2: This embodiment also provides a computer device, which is applicable to a situation of an artificial intelligence-based network security analysis and early warning system, including a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement an artificial intelligence-based network security analysis and early warning system as proposed in the above embodiment.

[0043] This embodiment also provides a storage medium, on which a computer program is stored, and when the program is executed by a processor, it implements an artificial intelligence-based network security analysis and early warning system as proposed in the above embodiment.

[0044] The computer device can be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a carrier network, NFC (Near Field Communication), or other technologies. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a button, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse, etc.

[0045] If a function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present invention. The aforementioned storage medium includes: USB flash drives, mobile hard disks, read-only memories (ROMs), random access memories (RAMs), magnetic disks, or optical discs, etc., which can store program codes of various kinds.

[0046] The logic and / or steps represented in the flowchart or described in other ways herein, for example, can be considered as a definite sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch instructions from the instruction execution system, apparatus, or device and execute the instructions), or in combination with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by or in combination with an instruction execution system, apparatus, or device.

[0047] More specific examples (non-exhaustive list) of computer-readable media include the following: electrical connection parts with one or more wirings (electronic devices), portable computer disk cartridges (magnetic devices), random access memories (RAMs), read-only memories (ROMs), erasable programmable read-only memories (EPROMs or flash memories), optical fiber devices, and portable compact disc read-only memories (CDROMs). Additionally, a computer-readable medium can even be paper or other suitable media on which a program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, then editing, interpreting, or otherwise processing it as appropriate, and then storing it in a computer memory.

[0048] It should be understood that each part of the present invention can be implemented by hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits with logic gate circuits for implementing logical functions on data signals, application specific integrated circuits with suitable combinational logic gate circuits, programmable gate arrays (PGAs), field programmable gate arrays (FPGAs), etc.

[0049] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the spirit and scope of the technical solutions of the present invention, and they should all be covered within the scope of the claims of the present invention.

Claims

1. An artificial intelligence-based network security analysis and early warning system, characterized in that, The following steps are involved: S1. Construct a multi-dimensional state table based on the original traffic characteristics; S2. Generate an attack graph based on causal relationships using the state table; S3. Use the attack graph to extract the topological evolution path and obtain the temporal risk path; S4. Use the state table and the risk path to perform joint pattern mapping to obtain a set of composite risk events; S5. Use the composite risk event set to perform neural discriminant embedding modeling to obtain risk event discrimination results.

2. The artificial intelligence-based network security analysis and early warning system according to claim 1, wherein, The state table generated in step S1 is a multi-dimensional structure data set sorted by time: ； Each record has the following structure: ； Among them, : the th connection record; : Connection ID; : Timestamp; : Source / Destination IP address; : Behavior vector; : Protocol status identifier; : Abnormal flag bit.

3. The artificial intelligence-based network security analysis and early warning system according to claim 1 is characterized in that: The step S2 first performs graph node mapping of the state nodes, and records each state Convert to graph node , create a node set: ； Node attributes include connection identifier, behavior vector, protocol status, and exception flag, namely: 。 4. The artificial intelligence-based network security analysis and early warning system according to claim 3 is characterized in that: The step S2 then constructs causal edges, and the causal edge set is , if the state node and satisfy the following three conditions, then an edge is established: Logic before and after time: ; Behavioral dependency constraints: ,satisfy ,in thresholds for causal behavioral deviations set for experience; Protocol state evolution conditions: from The state transition conforms to the reasonable state diagram of the protocol; If all of the above three conditions are satisfied, then a directed edge is established: .

5. An artificial intelligence-based network security analysis and early warning system according to claim 3, characterized in that, The above-mentioned step S2 finally constructs and outputs a causal attack graph, integrating the node set and the edge set to construct an attack graph: ; Each path in the graph Indicates a potential chain of attack behaviors.

6. The artificial intelligence-based network security analysis and early warning system according to claim 1, wherein, The step S3 first generates candidate attack paths. In the attack graph , paths that meet the risk propagation characteristics are screened out from all existing acyclic paths in the graph. The path is a node sequence: ； Path filtering by include: Path length threshold limit: ; The cumulative index of node behavior anomalies exceeds the threshold: , where , is the cumulative index of anomalies; Thus, the initial output candidate path set is obtained: 。 7. An artificial intelligence-based network security analysis and early warning system according to claim 6, characterized in that, The step S3 then constructs a path risk assessment function and sets the path risk scoring function : ； in, , indicating the drastic nature of behavioral changes; , indicating propagation stability; is the experience weight, satisfying ; is a time scale normalization function, , which is used to compress the influence of the time span.

8. An artificial intelligence-based network security analysis and early warning system according to claim 6, characterized in that, The step S3 finally generates and sorts the temporal risk path set based on the candidate paths. Risk score , set the risk score threshold , thereby screening out the final high-risk path set: 。 9. An artificial intelligence-based network security analysis and early warning system according to claim 1, characterized in that, Step S4 performs a structured analysis on the risk path set generated in step S3, and uses a sliding window mechanism and time series segmentation technology to sort the connection data set in chronological order. For each risk path, it is detected whether there is a completely matching node and behavior sequence in each subsequence. For each successfully matched path instance, the subject and behavior relationship involved in its connection behavior is extracted, and a path map in the form of a directed graph is constructed.

10. An artificial intelligence-based network security analysis and early warning system according to claim 1, characterized in that, The step S5 uses the result obtained in step S4 as input, maps the structured atlas to a continuous vector space, constructs a neural discriminative embedding model to capture the complex non-linear relationships between risk events, and realizes the discrimination and classification of risk events.

Images