Network security vulnerability detection method and system based on artificial intelligence

Abstract

The invention belongs to the technical field of network security vulnerability detection, and relates to a network security vulnerability detection method and system based on artificial intelligence, and the method comprises the steps: extracting structured and unstructured feature fields of a target protocol data packet from network traffic in real time, and carrying out the syntax tree analysis of the structured feature fields to generate a nested hierarchical feature vector; generating a dominant abnormal confidence coefficient through positive and negative sample comparison of the feature vector, performing time sequence state tracking and dynamic qualification verification on the unstructured feature field, generating a hidden abnormal confidence coefficient, judging the existence of the network security vulnerability by integrating the dominant abnormal confidence coefficient and the hidden abnormal confidence coefficient, if the judgment result is yes, identifying vulnerability attributes, and if the judgment result is no, identifying the network security vulnerability. A blocking strategy corresponding to known vulnerabilities or novel vulnerabilities is triggered, accurate identification and efficient response of a network protocol level to security vulnerability threats are realized, and the threats are effectively intercepted at a network communication bottom layer, so that safe and stable operation of a network is guaranteed.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security vulnerability detection, and relates to a network security vulnerability detection method and system based on artificial intelligence. Background Art

[0002] With the acceleration of the digitalization process, network security vulnerabilities have become the core risk threatening digital assets. The intelligence and concealment of network attacks have led to security threats such as data leakage and service paralysis for systems. Traditional vulnerability detection relies on manual rules and static analysis, making it difficult to cope with the risks of massive heterogeneous data, with problems such as lagging protection and frequent false positives and false negatives. Therefore, accurate and efficient vulnerability detection is becoming increasingly necessary.

[0003] In the prior art, there are already solutions related to network security vulnerability detection. For example, a network security vulnerability mining method and system based on artificial intelligence with the Chinese patent publication number CN114553525A, which obtains multiple malicious file samples with successful attacks, trains a classification model according to their attack behavior data using deep learning and classifies them, constructs a vulnerability database based on the results, calls it to send detection packets to monitoring terminals, and analyzes the feedback data to obtain vulnerability detection results, solving the problem of poor network security vulnerability mining effect in the prior art.

[0004] Another vulnerability analysis method, device, electronic device, storage medium, and program product with the Chinese patent publication number CN119628902A, which obtains and analyzes the first data packet generated based on a network protocol to be analyzed in a cloud network, determines the second data packet generated based on an unknown protocol, observes the packet header fields of the second data packet using a hidden Markov model, constructs a state machine model of the unknown protocol based on multiple observed states, generates test cases corresponding to a protocol format description file of the unknown protocol based on the content recorded in the state machine model, and analyzes vulnerabilities in the unknown protocol through the test cases to achieve vulnerability analysis of the self-developed proprietary protocol of a cloud computer, so as to improve the use security of the cloud computer.

[0005] However, the prior art still has certain limitations, specifically manifested as follows: 1. Existing network security vulnerability detection technologies lack in-depth analysis methods for the network protocol layer. Most focus on the structured features of network protocol header fields and ignore the analysis of unstructured features of network protocols, making it difficult to discover attack features hidden in unstructured data.

[0006] 2. Existing network security vulnerability detection technologies mostly rely on the comparison of known vulnerability attack behaviors. The vulnerability detection results stay in the stage of known vulnerability matching, lacking a vulnerability attribute recognition mechanism and being unable to distinguish between known or new threats, resulting in rigid blocking strategies and lagging protection. Summary of the Invention

[0007] In view of this, to solve the problems raised in the above-mentioned background technology, a network security vulnerability detection method and system based on artificial intelligence are proposed.

[0008] The object of the present invention can be achieved by the following technical solutions: In the first aspect of the present invention, a network security vulnerability detection method based on artificial intelligence is provided, including: extracting a single feature field of a target protocol data packet from network traffic in real time, and classifying the field as structured or unstructured according to the target protocol syntax specification.

[0009] Performing syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and outputting an explicit anomaly confidence level through positive and negative sample comparison of the feature vector.

[0010] Performing time-series state tracking and dynamic compliance verification on the unstructured feature field, and outputting an implicit anomaly confidence level.

[0011] Comprehensively determining the existence of network security vulnerabilities based on the explicit and implicit anomaly confidence levels. If it is determined that there is a vulnerability, identify the vulnerability attributes to trigger corresponding blocking strategies, and the vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0012] In the second aspect of the present invention, a network security vulnerability detection system based on artificial intelligence is provided, including: a feature field extraction module, an explicit anomaly detection module, an implicit anomaly detection module, and a vulnerability determination and processing module.

[0013] The feature field extraction module is respectively connected to the explicit anomaly detection module and the implicit anomaly detection module, and both the explicit anomaly detection module and the implicit anomaly detection module are connected to the vulnerability determination and processing module.

[0014] The feature field extraction module extracts a single feature field of a target protocol data packet from network traffic in real time, and classifies the field as structured or unstructured according to the target protocol syntax specification.

[0015] The explicit anomaly detection module performs syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and outputs an explicit anomaly confidence level through positive and negative sample comparison of the feature vector.

[0016] The implicit anomaly detection module performs time-series state tracking and dynamic compliance verification on the unstructured feature field, and outputs an implicit anomaly confidence level.

[0017] The vulnerability determination and processing module comprehensively determines the existence of network security vulnerabilities based on the explicit and implicit anomaly confidence levels. If it is determined that there is a vulnerability, identify the vulnerability attributes to trigger corresponding blocking strategies, and the vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0018] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) By extracting the structured and unstructured feature fields of the target protocol data packet, through explicit and implicit anomaly confidence detection, comprehensively determining the existence of vulnerabilities and identifying the vulnerability attributes to trigger corresponding blocking strategies, the present invention realizes the accurate identification and efficient response to the security vulnerability threats at the network protocol level, effectively intercepts the threats at the bottom layer of network communication, and thus ensures the secure and stable operation of the network.

[0019] (2) By tracking the temporal state of the unstructured feature fields and performing dynamic qualification verification, the present invention captures the implicit attack features such as the mutation of the field value range and the abnormal jump of the protocol state, breaks through the analysis blind spot of the unstructured data in the prior art, and provides effective data support for the determination of the existence of vulnerabilities.

[0020] (3) Taking the explicit and implicit anomaly confidence as the analysis basis, the present invention not only determines the existence of vulnerabilities, but also identifies known vulnerabilities or new vulnerabilities to trigger corresponding blocking strategies, realizes the integration of vulnerability detection and response, greatly improves the efficiency and effect of security management, and further effectively reduces the losses caused by network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0022] Figure 1 It is a flowchart of the implementation steps of the method of the present invention.

[0023] Figure 2 It is a logical schematic diagram of parsing the structured feature fields in the content of the method of the present invention to generate nested hierarchical feature vectors.

[0024] Figure 3 It is a schematic diagram of the connection of the system modules of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, rather than all embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0026] Please refer to Figure 1As shown in the figure, the first aspect of the present invention provides an artificial intelligence-based network security vulnerability detection method, including: extracting a single feature field of a target protocol data packet from network traffic in real time, and classifying the field as structured or unstructured according to the target protocol syntax specification.

[0027] It should be noted that the target protocol syntax specification specifically refers to the standardized syntax structure of the network communication protocol. The structured field refers to the part that conforms to the clearly defined hierarchy and key-value pair format of the protocol, and the unstructured field refers to the free text or binary data whose format is not strictly defined in the protocol.

[0028] Exemplarily, the syntax specification structure of the HTTP protocol includes: the request line format is method URI version, the header field is a key-value pair, and the body part is unstructured data such as JSON, XML, or unencoded binary content.

[0029] The syntax specification structure of the TCP / IP protocol includes: the header contains structured fields such as source / destination ports, sequence numbers, and flag bits, and the payload part is unstructured data.

[0030] According to the example, if a single feature field in the target protocol data packet contains both structured and unstructured features, then first, it is necessary to perform field splitting on it according to the protocol syntax specification, extract the structured part of the single feature field as an independent structured feature field, and extract the unstructured part as an independent unstructured feature field. Through splitting, classification processing can be achieved, and syntax tree parsing and time series tracking can be performed respectively, thereby reducing the computational complexity of heterogeneous data mixed analysis and improving the detection efficiency.

[0031] The single feature field in the target protocol data packet can jointly contain structured features and unstructured features. Therefore, for this feature field, field cutting should be performed first. The structured feature cutting fields are re-used as independent structured feature fields, and the unstructured feature cutting is re-used as independent unstructured feature fields, which is convenient for subsequent centralized integration analysis to reduce computing resources.

[0032] Perform syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and output the explicit anomaly confidence through the positive and negative sample comparison of the feature vector.

[0033] Please refer to Figure 2 As shown in the figure, as a preference, the performing syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector includes: disassembling the structured feature field into multiple syntax units, including a root syntax unit, a path hierarchy unit, and a key-value semantic unit.

[0034] Mark the subordination relationship between each grammar unit, and construct a tree - shaped hierarchical structure, where the root grammar unit is the top - level node, the path - level unit is the branch node, and the key - value semantic unit is the terminal leaf node.

[0035] Traverse the tree - shaped hierarchical structure layer by layer starting from the root grammar unit, record the type identifier, hierarchical depth position, and attribute value of each grammar unit, and generate a hierarchical structure description string in a fixed nested order.

[0036] Convert the string into a numerical vector with a fixed dimension to generate a nested hierarchical feature vector.

[0037] As a preference, the process of obtaining the explicit anomaly confidence includes: performing a positive similarity match between the nested hierarchical feature vector and the known vulnerability grammar unit sequences stored in the self - maintained vulnerability feature library. The matching parameters include grammar unit type, hierarchical order, and attribute value.

[0038] It should be noted that the above - mentioned known vulnerability grammar unit sequences contain several grammar structure feature fields of security vulnerability types. Before performing the positive similarity match, each field in the known vulnerability grammar unit sequences should be converted into a nested hierarchical feature vector, denoted as each vulnerability nested hierarchical feature vector. Then, the nested hierarchical feature vector is compared with each vulnerability nested hierarchical feature vector in turn, including the type identifier, hierarchical depth position, and attribute value of each grammar unit. The cosine similarity formula is used to quantify the similarity between the nested hierarchical feature vector and each vulnerability nested hierarchical feature vector in terms of the type identifier, hierarchical depth position, and attribute value of each grammar unit, and the sum is used to obtain the positive similarity between the nested hierarchical feature vector and each vulnerability nested hierarchical feature vector. , where is the number of each vulnerability nested hierarchical feature vector. .

[0039] Respectively count the number of hierarchical missing, type conflicts, and the number of out - of - range deviation items of attribute values of the nested hierarchical feature vector relative to the standard grammar unit sequences stored in the normal traffic benchmark library, and calculate the negative deviation degree.

[0040] It should be noted that the above standard syntax unit sequence contains several syntax structure feature fields without security vulnerability threats. Before calculating the negative deviation degree, each field in the standard syntax unit sequence should be converted into a nested level feature vector, denoted as each standard nested level feature vector. The nested level feature vectors are compared with each standard nested level feature vector in turn, and the number of missing relative levels, the number of type conflicts, and the number of out-of-range deviation items of attribute values are counted. They are respectively operated with the total number of levels of the nested level feature vector, the total number of syntax unit types, and the total number of syntax units to complete the normalization process. The results of the ratio operations are accumulated to obtain the negative deviation degree of the nested level feature vector and each standard nested level feature vector. , where is the number of each standard nested level feature vector, .

[0041] By linearly weighted fusion of the positive similarity and the negative deviation degree, the explicit anomaly confidence level is output.

[0042] It should be noted that the above linear weighted fusion of the positive similarity and the negative deviation degree can specifically refer to the formula to obtain the explicit anomaly confidence level, where are the preset weights corresponding to the positive similarity and the negative deviation degree respectively. They can be exemplarily assigned as 0.6 and 0.4. The basis for the assignment is that the positive similarity matching of known vulnerabilities has a high determination certainty and a low false alarm risk, while the negative deviation degree of normal traffic may have occasional anomalies due to legal business fluctuations. It is necessary to weaken the interference of such fluctuations on the final determination by reducing the weight to balance the accuracy and robustness of the detection result.

[0043] Perform time series state tracking and dynamic qualification verification on the unstructured feature fields, and output the implicit anomaly confidence level.

[0044] As a preference, the time series state tracking and dynamic qualification verification process of the unstructured feature fields includes: collecting the number of requests for the unstructured feature fields within a preset time window and the sliding time step of each request, obtaining the average interval time step of a single request for the field and using its value as the request frequency value, and combining the preset baseline frequency of the target protocol to quantify the qualified verification index of the time series request state of the field.

[0045] It should be noted that the process of quantifying the qualified verification index of the time series request state of the field includes: obtaining the proportion of the absolute deviation between the request frequency value and the preset baseline frequency of the target protocol. To avoid the denominator being zero, a preset constant is introduced to smooth the proportion of the absolute deviation, and then the qualified verification index of the time series request state of the field is obtained through reciprocal operation.

[0046] Store the content of the unstructured feature field and associated metadata according to the window time sequence, segment the field content by sliding the time step according to the request, gather the content segments of each request of the unstructured feature field within a preset time window, calculate the range mutation amplitude of the content segment of each request relative to its previous request, and quantify the qualified verification index of the time sequence range state of the field based on the change trend of the range mutation amplitude.

[0047] It should be noted that the above-mentioned qualified verification index of the time sequence range state of the field is obtained by acquiring the time sequence standard deviation of the range mutation amplitude and substituting it into the standard decay exponential function. The use of the standard decay exponential function aims to consider that the range mutation amplitude of unstructured data may be affected by instantaneous noise due to factors such as network jitter and normal business fluctuations. The time sequence standard deviation is smoothed through the exponential decay function to reduce the weight of short-term fluctuations and highlight the long-term trend.

[0048] As a preference, the time sequence state tracking and dynamic qualified verification process of the unstructured feature field further includes: based on the protocol control flag of the unstructured feature field, record each protocol change event and time stamp of the field within a preset time window, construct a protocol interaction time sequence chain and compare it with the preset protocol executable interaction table to determine the basic rationality of the protocol interaction time sequence chain.

[0049] It should be noted that the above-mentioned preset protocol executable interaction table stores the executable protocol sets of various network protocols. For example, the HTTP protocol can interact with the TCP protocol, and the DNS protocol can interact with the UDP protocol. When determining the basic rationality of the protocol interaction time sequence chain, the following steps can be executed:

[0050] (a) Split the protocol interaction time sequence chain into several interaction single chains according to the preset interaction direction.

[0051] (b) Take the initiating protocol and the interacting protocol of each interaction single chain as the analysis objects. If the interacting protocol belongs to the executable protocol set of the initiating protocol in the preset interaction table, assign the rationality factor of this single chain as 1, otherwise as 0.

[0052] (c) Statistically calculate the rationality factors of all interaction single chains within the time sequence chain, and generate the basic rationality of the protocol interaction time sequence chain through cumulative operation.

[0053] Synchronously collect the changes in the associated metadata corresponding to each protocol change event of the field, and determine the expected compliance of the protocol interaction time sequence chain based on the comparison result between the change in the associated metadata and the reasonable change range of the historical calibrated associated metadata corresponding to the protocol change event.

[0054] It should be noted that the above-mentioned associated metadata includes but is not limited to the data packet byte stream length, transmission rate, and compression type.

[0055] The process for determining the expected compliance degree of the protocol interaction time sequence chain is as follows: If the change in the associated metadata corresponding to a certain protocol change event is within the reasonable change range of the historically calibrated associated metadata for the corresponding protocol change event, then the compliance factor for this protocol change event is assigned as 1; otherwise, it is 0. Organize the compliance factors of each protocol change event in the protocol interaction time sequence chain, and take the minimum value as the expected compliance degree of the protocol interaction time sequence chain.

[0056] Take the product of the expected compliance degree and the basic reasonableness as the qualified check index for the field time sequence protocol status.

[0057] As an optimization, the process for obtaining the implicit anomaly confidence level includes: mapping the time sequence request, value range, and qualified check index for the protocol status of the unstructured feature field to their corresponding membership levels, and the membership levels are divided into three levels: low, medium, and high.

[0058] It should be noted that the above-mentioned membership level mapping can use the triangular or trapezoidal membership function in fuzzy logic to map the time sequence request, value range, and qualified check index for the protocol status to membership degrees, and according to the preset membership degree intervals corresponding to the low, medium, and high membership levels, map the membership level to which the index belongs.

[0059] Retrieve the historical conditional probability matrix of the unstructured vulnerability pattern in the self-maintained vulnerability feature library. Take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified check index of the time sequence request as the first confidence level, take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified check index of the value range based on the membership level corresponding to the qualified check index of the time sequence request as the second confidence level, and take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified check index of the protocol status based on the membership levels corresponding to the qualified check indexes of the time sequence request and value range as the third confidence level. Extract the conditional probabilities corresponding to the first confidence level, second confidence level, and third confidence level in the historical conditional probability matrix, and obtain the implicit anomaly confidence level through cumulative multiplication.

[0060] It should be noted that the historical conditional probability matrix of the unstructured vulnerability pattern in the above-mentioned self-maintained vulnerability feature library is a three-dimensional probability table, and its dimensions are composed of the low, medium, and high membership levels of the time sequence request status, value range status, and protocol status. Each element in the matrix stores the conditional probability value of a historical vulnerability event under a specific combination, and the specific combination can be exemplified as the combination composed of a high membership level of the time sequence request status, a medium membership level of the value range status, and a low membership level of the protocol status.

[0061] This matrix is continuously optimized through a dynamic update mechanism. Whenever a new known vulnerability is added to the database, the self-maintained vulnerability feature library will extract the associated unstructured feature data. Based on Bayes' theorem or the maximum likelihood estimation method, the corresponding conditional probability values in the matrix are iteratively updated to ensure that the matrix can reflect the latest vulnerability attack patterns in real time and improve the calculation accuracy of the implicit anomaly confidence level.

[0062] It should also be noted that the above-mentioned implicit anomaly confidence level can be exemplarily obtained through the formula where respectively represent the conditional probabilities corresponding to the first confidence level, the second confidence level, and the third confidence level, respectively represent the membership grades corresponding to the time-series request and the value range status qualification verification index.

[0063] In the embodiment of the present invention, by tracking the time-series status of unstructured feature fields and performing dynamic qualification verification, implicit attack features such as sudden changes in field value ranges and abnormal jumps in protocol states are captured, breaking through the analysis blind spot of unstructured data in the prior art and providing effective data support for the determination of the existence of vulnerabilities.

[0064] Based on the combined determination of the explicit and implicit anomaly confidence levels, the existence of network security vulnerabilities is determined. If it is determined that there is a vulnerability, the vulnerability attributes are identified to trigger corresponding blocking strategies, where the vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0065] As a preference, the determination of the existence of network security vulnerabilities based on the combined explicit and implicit anomaly confidence levels includes: sorting out the explicit anomaly confidence level sequence corresponding to the structured feature field group of the target protocol data packet and the implicit anomaly confidence level sequence corresponding to the unstructured feature field group.

[0066] Respectively extract the maximum value of the sliding window of the explicit anomaly confidence level sequence and the mean value of the sliding window of the implicit anomaly confidence level sequence .

[0067] If , it is determined that there is a network security vulnerability; otherwise, it is determined that there is no vulnerability, where are the preset explicit and implicit anomaly confidence level warning thresholds respectively.

[0068] As a preference, the process of identifying the vulnerability attributes includes: if , extract the positive similarity of the known vulnerability syntax unit sequence that matches the nested hierarchical feature vector corresponding to the maximum value element of the sliding window in the self-maintained vulnerability feature library, and screen the maximum positive similarity for comparison with the preset similarity threshold. If it is greater than or equal to the preset similarity threshold, the vulnerability attribute is identified as a known vulnerability; otherwise, it is identified as a new vulnerability.

[0069] It should be noted that the positive similarity of the known vulnerability syntax unit sequence corresponding to the nested hierarchical feature vector of the maximum element in the sliding window in the above self-maintained vulnerability feature library specifically refers to the positive similarity of the nested hierarchical feature vectors of each vulnerability in the known vulnerability syntax unit sequence. Therefore, there is a subsequent processing operation of screening the maximum positive similarity among them.

[0070] If , based on the membership grade combination of the time-series request, value range, and protocol status qualification verification indicators, retrieve whether there is an unstructured vulnerability pattern with the same membership grade combination and a conditional probability greater than the preset probability threshold in the self-maintained vulnerability feature library. If it exists, identify the vulnerability attribute as a known vulnerability; otherwise, identify it as a new type of vulnerability.

[0071] As an optimization, the process of triggering the corresponding blocking strategy includes: if it is a known vulnerability, retrieve the pre-stored blocking instruction of the known vulnerability from the self-maintained vulnerability feature library and send it to the network protection device for execution.

[0072] If it is a new type of vulnerability, immediately terminate the target protocol session and temporarily block the source IP address, synchronously start the sandbox environment for behavior analysis, generate a warning report containing the attack context, and push it to the security management terminal. If the vulnerability effectiveness is confirmed through manual review, extract the feature fingerprint and update it to the self-maintained vulnerability feature library, and associate the new type of vulnerability label.

[0073] The embodiment of the present invention uses the explicit and implicit anomaly confidence levels as the analysis basis, not only determines the existence of vulnerabilities, but also identifies known vulnerabilities or new types of vulnerabilities to trigger the corresponding blocking strategy, realizing the integration of vulnerability detection and response, greatly improving the efficiency and effect of security management, and thus effectively reducing the losses caused by network attacks.

[0074] The embodiment of the present invention extracts the structured and unstructured feature fields of the target protocol data packet, detects through the explicit and implicit anomaly confidence levels, comprehensively determines the existence of vulnerabilities and identifies the vulnerability attributes to trigger the corresponding blocking strategy, realizes the accurate identification and efficient response to the security vulnerability threats at the network protocol level, and effectively intercepts the threats at the bottom layer of network communication, thereby ensuring the stable operation of network security.

[0075] Please refer to Figure 3 As shown, the second aspect of the present invention provides a network security vulnerability detection system based on artificial intelligence, including: a feature field extraction module, an explicit anomaly detection module, an implicit anomaly detection module, and a vulnerability determination and processing module.

[0076] The feature field extraction module is respectively connected to the explicit anomaly detection module and the implicit anomaly detection module, and both the explicit anomaly detection module and the implicit anomaly detection module are connected to the vulnerability determination and processing module.

[0077] The feature field extraction module extracts a single feature field of the target protocol data packet from network traffic in real time and classifies the field as structured or unstructured according to the syntax specification of the target protocol.

[0078] The explicit anomaly detection module parses the syntax tree of the structured feature field to generate a nested hierarchical feature vector, and outputs the explicit anomaly confidence level through the comparison of positive and negative samples of the feature vector.

[0079] The implicit anomaly detection module performs time-series state tracking and dynamic compliance verification on the unstructured feature field and outputs the implicit anomaly confidence level.

[0080] The vulnerability determination and handling module comprehensively determines the existence of network security vulnerabilities based on the explicit and implicit anomaly confidence levels. If it is determined that there are vulnerabilities, it identifies the vulnerability attributes to trigger corresponding blocking strategies, and the vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0081] The above formulas are all dimensionless and take their numerical values for calculation. The formulas are obtained by collecting a large amount of data for software simulation to get a formula that is closest to the real situation. The preset parameters in the formulas are set by those skilled in the art according to the actual situation.

[0082] The above embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product.

[0083] Those of ordinary skill in the art can realize that the modules and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are executed in hardware or software depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0084] In addition, the functional modules in each embodiment of this application can be integrated into one processing module, or each module can exist physically alone, or two or more modules can be integrated into one module.

[0085] The above is only the specific implementation manner of this application, but the protection scope of this application is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed in this application, and all should be covered by the protection scope of this application. Therefore, the protection scope of this application should be subject to the protection scope of the claims.

[0086] Finally, the above are only the preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A network security vulnerability detection method based on artificial intelligence, characterized in that, Including: Extract the single feature field of the target protocol data packet from the network traffic in real time, and classify the field structurally or unstructurally according to the target protocol syntax specification; Perform syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and output the explicit anomaly confidence through the positive and negative sample comparison of the feature vector; Perform time-series state tracking and dynamic compliance verification on the unstructured feature field, and output the implicit anomaly confidence; Comprehensively determine the existence of network security vulnerabilities based on the explicit and implicit anomaly confidences. If it is determined that there is a vulnerability, identify the vulnerability attributes to trigger corresponding blocking strategies, and the vulnerability attributes include known vulnerabilities or new vulnerabilities.

2. The network security vulnerability detection method based on artificial intelligence according to claim 1 is characterized in that: The syntax tree parsing of the structured feature field to generate a nested hierarchical feature vector includes: decomposing the structured feature field into multiple syntax units, including a root syntax unit, a path-level unit, and a key-value semantic unit; Mark the subordination relationship between each syntax unit and construct a tree-like hierarchical structure, where the root syntax unit is the top-level node, the path-level unit is the branch node, and the key-value semantic unit is the terminal leaf node; Traverse the tree-like hierarchical structure layer by layer starting from the root syntax unit, record the type identifier, hierarchical depth position, and attribute value of each syntax unit, and generate a hierarchical structure description string in a fixed nested order; Convert the string into a numerical vector with a fixed dimension to generate a nested hierarchical feature vector.

3. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 2, wherein: The process of obtaining the explicit anomaly confidence includes: performing positive similarity matching between the nested hierarchical feature vector and the known vulnerability syntax unit sequence stored in the self-maintained vulnerability feature library, and the matching parameters include the syntax unit type, hierarchical order, and attribute value; Respectively count the number of hierarchical missing, type conflicts, and out-of-range deviation items of the attribute values of the nested hierarchical feature vector relative to the standard syntax unit sequence stored in the normal traffic benchmark library, and calculate the negative deviation degree; Output the explicit anomaly confidence through the linear weighted fusion of the positive similarity and the negative deviation degree.

4. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 1, characterized in that: The process of time-series state tracking and dynamic compliance verification of the unstructured feature field includes: Collect the number of requests for the unstructured feature field within a preset time window and the sliding time step of each request, obtain the average interval time step of a single request for the field and use its value as the request frequency value, and combine it with the preset baseline frequency of the target protocol to quantify the qualified verification index of the time-series request state of the field; Store the content of the unstructured feature field and the associated metadata according to the window time series, divide the field content into segments according to the request sliding time step, gather the content segments of each request for the unstructured feature field within a preset time window, calculate the value range mutation amplitude of each request relative to the content segment of its previous request, and quantify the qualified verification index of the time-series value range state of the field based on the change trend of the value range mutation amplitude.

5. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 4, characterized in that: The process of time-series state tracking and dynamic compliance verification of the unstructured feature field further includes: Based on the protocol control flag of the unstructured feature field, record each protocol change event and timestamp of the field within the preset time window, construct the protocol interaction time sequence chain and compare it with the preset protocol executable interaction table to determine the basic rationality of the protocol interaction time sequence chain; Synchronously collect the changes in the associated metadata corresponding to each protocol change event of the field. Based on the comparison result between the change in the associated metadata and the reasonable change range of the associated metadata calibrated by the historical protocol change event, determine the expected compliance of the protocol interaction time sequence chain; Take the product of the expected compliance and the basic rationality as the qualified verification index of the time sequence protocol status of the field.

6. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 5, wherein: The process of obtaining the implicit anomaly confidence level includes: mapping the time sequence request, value range, and qualified verification index of the protocol status of the unstructured feature field to their corresponding membership levels respectively. The membership levels are divided into three levels: low, medium, and high; Retrieve the historical conditional probability matrix of the unstructured vulnerability pattern from the independently maintained vulnerability feature library. Take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified verification index of the time sequence request status as the first confidence level, take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified verification index of the value range status based on the membership level corresponding to the qualified verification index of the time sequence request status as the second confidence level, and take the occurrence of a vulnerability event triggered by the membership level corresponding to the qualified verification index of the protocol status based on the membership levels corresponding to the qualified verification indexes of the time sequence request and value range status as the third confidence level. Extract the conditional probabilities corresponding to the first confidence level, second confidence level, and third confidence level in the historical conditional probability matrix, and obtain the implicit anomaly confidence level through cumulative multiplication operation.

7. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 1, characterized in that: The determination of the existence of network security vulnerabilities by comprehensively considering the explicit and implicit anomaly confidence levels includes: sorting out the explicit anomaly confidence level sequence corresponding to the structured feature field group of the target protocol data packet and the implicit anomaly confidence level sequence corresponding to the unstructured feature field group; Extract the sliding window maximum value of the explicit abnormal confidence sequence respectively Sliding window mean of implicit anomaly confidence sequence ; If , it is determined that there is a network security vulnerability; otherwise, it is determined that there is none, where are the preset warning thresholds for explicit and implicit abnormal confidence levels, respectively.

8. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 7, characterized in that: The vulnerability attribute identification process includes: If , extract the positive similarity of the known vulnerability syntax unit sequence that matches the nested hierarchical feature vector corresponding to the maximum element of the sliding window from the self-maintained vulnerability feature library, and filter the maximum positive similarity for comparison with the preset similarity threshold. If it is greater than or equal to the preset similarity threshold, identify the vulnerability attribute as a known vulnerability; otherwise, identify it as a new type of vulnerability. If , based on the membership grade combination of the time-series request, value range, and protocol status qualification verification indicators, retrieve whether there is an unstructured vulnerability pattern in the self-maintained vulnerability feature library with the same membership grade combination and a conditional probability greater than the preset probability threshold. If it exists, identify the vulnerability attribute as a known vulnerability; otherwise, identify it as a new vulnerability.

9. The network security vulnerability detection method based on artificial intelligence according to claim 1, characterized in that: The corresponding blocking strategy triggering process includes: if it is a known vulnerability, retrieve the pre-stored blocking instruction of the known vulnerability from the independently maintained vulnerability feature library and send it to the network protection device for execution; If it is a new vulnerability, immediately terminate the target protocol session and temporarily block the source IP address. Synchronously start the sandbox environment for behavior analysis, generate an early warning report containing the attack context, and push it to the security management terminal. If the vulnerability effectiveness is confirmed through manual review, extract the feature fingerprint and update it to the independently maintained vulnerability feature library, and associate the new vulnerability label.

10. An artificial intelligence-based network security vulnerability detection system, characterized in that, Including: A feature field extraction module that extracts a single feature field of the target protocol data packet from the network traffic in real time and classifies the field as structured or unstructured according to the target protocol syntax specification; An explicit anomaly detection module that parses the syntax tree of the structured feature field to generate a nested hierarchical feature vector, and outputs the explicit anomaly confidence level through the comparison of positive and negative samples of the feature vector; An implicit anomaly detection module that performs time sequence status tracking and dynamic qualified verification on the unstructured feature field and outputs the implicit anomaly confidence level; The vulnerability determination processing module comprehensively determines the existence of network security vulnerabilities based on the confidence of explicit and implicit anomalies. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

Images