Network security vulnerability detection method and system based on artificial intelligence

Abstract

The present invention belongs to the technical field of network security vulnerability detection and relates to an artificial intelligence-based network security vulnerability detection method and system. The method extracts structured and unstructured feature fields of target protocol data packets from network traffic in real time, performs syntax tree parsing on the structured feature fields to generate nested hierarchical feature vectors, generates explicit anomaly confidence by comparing positive and negative samples of the feature vectors, performs temporal state tracking and dynamic qualification verification on the unstructured feature fields, generates implicit anomaly confidence, and determines the existence of network security vulnerabilities by combining the explicit and implicit anomaly confidences. If it is determined that a network security vulnerability exists, the vulnerability attributes are identified, and corresponding blocking strategies for known vulnerabilities or new vulnerabilities are triggered, thereby achieving accurate identification and efficient response to security vulnerability threats at the network protocol level, and effectively intercepting threats at the bottom layer of network communication, thereby ensuring the stable operation of the network.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security vulnerability detection, and relates to a network security vulnerability detection method and system based on artificial intelligence. Background Art

[0002] As digitalization accelerates, network security vulnerabilities have become a core risk to digital assets. Cyberattacks are becoming increasingly intelligent and covert, exposing systems to security threats such as data leaks and service disruptions. Traditional vulnerability detection relies on manual rules and static analysis, making it difficult to cope with the risks of massive amounts of heterogeneous data. This leads to lagging protection and frequent false positives and missed detections. Therefore, accurate and efficient vulnerability detection is becoming increasingly necessary.

[0003] Solutions related to network security vulnerability detection already exist in the prior art. For example, the artificial intelligence-based network security vulnerability mining method and system with Chinese patent publication number CN114553525A obtains multiple malicious file samples that have successfully attacked, uses deep learning to train a classification model based on their attack behavior data and classifies them, builds a vulnerability database based on the results, calls it to send detection packages to monitoring terminals, analyzes the feedback data to obtain vulnerability detection results, and solves the problem of poor effectiveness of existing network security vulnerability mining.

[0004] Another Chinese patent publication number is CN119628902A, which discloses a vulnerability analysis method, device, electronic device, storage medium, and program product. The method obtains and parses a first data packet generated based on the network protocol to be analyzed in the cloud network, determines a second data packet generated based on an unknown protocol, observes the message header field of the second data packet using a hidden Markov model, and constructs a state machine model of the unknown protocol based on the observed multiple states. Based on the content recorded by the state machine model, a test case corresponding to the protocol format description file of the unknown protocol is generated. The vulnerabilities in the unknown protocol are analyzed through the test case, thereby realizing vulnerability analysis of the cloud computer's self-developed proprietary protocol to improve the security of cloud computer use.

[0005] However, existing technologies still have certain limitations, specifically: 1. Existing network security vulnerability detection technologies lack in-depth analysis methods for the network protocol layer, and focus more on the structured features of the network protocol header fields, ignoring the analysis of unstructured features of the network protocol, making it difficult to discover attack features hidden in unstructured data.

[0006] 2. Existing network security vulnerability detection technologies mostly rely on comparing known vulnerability attack behaviors. Vulnerability detection results remain at the known vulnerability matching stage. There is a lack of vulnerability attribute identification mechanism and it is unable to distinguish between known or new threats, resulting in rigid blocking strategies and lagging protection. Summary of the Invention

[0007] In view of this, in order to solve the problems raised in the above background technology, a network security vulnerability detection method and system based on artificial intelligence is proposed.

[0008] The objectives of the present invention can be achieved through the following technical solutions: The first aspect of the present invention provides a network security vulnerability detection method based on artificial intelligence, including: extracting a single characteristic field of a target protocol data packet from network traffic in real time, and classifying the field into structured or unstructured form according to the target protocol syntax specification.

[0009] The structured feature field is parsed through a syntax tree to generate a nested hierarchical feature vector, and the confidence level of the dominant anomaly is output by comparing the positive and negative samples of the feature vector.

[0010] Perform time series status tracking and dynamic qualification verification on unstructured feature fields, and output implicit anomaly confidence.

[0011] The confidence level of explicit and implicit anomalies is combined to determine the existence of network security vulnerabilities. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0012] The second aspect of the present invention provides an artificial intelligence-based network security vulnerability detection system, including: a feature field extraction module, an explicit anomaly detection module, a implicit anomaly detection module and a vulnerability determination processing module.

[0013] The feature field extraction module is connected to the explicit anomaly detection module and the implicit anomaly detection module respectively, and the explicit anomaly detection module and the implicit anomaly detection module are both connected to the vulnerability determination processing module.

[0014] The feature field extraction module extracts a single feature field of a target protocol data packet from network traffic in real time and classifies the field as structured or unstructured according to the target protocol syntax specification.

[0015] The explicit anomaly detection module performs syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and outputs the explicit anomaly confidence by comparing the positive and negative samples of the feature vector.

[0016] The implicit anomaly detection module performs temporal state tracking and dynamic qualification verification on unstructured feature fields, and outputs implicit anomaly confidence levels.

[0017] The vulnerability determination processing module comprehensively determines the existence of network security vulnerabilities based on the confidence of explicit and implicit anomalies. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0018] Compared with the existing technology, the beneficial effects of the present invention are as follows: (1) The present invention extracts the structured and unstructured feature fields of the target protocol data packet, and through explicit and implicit anomaly confidence detection, comprehensively determines the existence of vulnerabilities and identifies vulnerability attributes to trigger corresponding blocking strategies, thereby achieving accurate identification and efficient response to security vulnerability threats at the network protocol level, and effectively intercepting threats at the bottom layer of network communication, thereby ensuring the safe and stable operation of the network.

[0019] (2) The present invention captures latent attack features such as sudden changes in field value ranges and abnormal protocol state transitions by tracking the time series status of unstructured feature fields and performing dynamic qualification verification, thus breaking through the blind spots of existing technologies in analyzing unstructured data and providing effective data support for vulnerability determination.

[0020] (3) The present invention uses the confidence level of explicit and implicit anomalies as the basis for analysis, not only to determine the existence of vulnerabilities, but also to identify known vulnerabilities or new vulnerabilities to trigger corresponding blocking strategies, thus realizing the integration of vulnerability detection and response, greatly improving the efficiency and effectiveness of security management, and thus effectively reducing the losses caused by network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 The present invention is a flowchart of the steps for implementing the method.

[0023] Figure 2 This is a logical diagram of performing syntax tree parsing on structured feature fields to generate nested hierarchical feature vectors in the method of the present invention.

[0024] Figure 3 This is a schematic diagram of the system module connection of the present invention. DETAILED DESCRIPTION

[0025] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0026] See also Figure 1As shown, the first aspect of the present invention provides an artificial intelligence-based network security vulnerability detection method, including: extracting a single characteristic field of a target protocol data packet from network traffic in real time, and classifying the field into structured or unstructured form according to the target protocol syntax specification.

[0027] It should be noted that the target protocol syntax specification specifically refers to the standardized syntax structure of the network communication protocol, the structured field refers to the part that conforms to the hierarchical and key-value pair format clearly defined by the protocol, and the unstructured field refers to the free text or binary data whose format is not strictly defined in the protocol.

[0028] Exemplarily, the HTTP protocol syntax specification structure includes: the request line format is the method URI version, the header field is a key-value pair, and the body part is unstructured data such as JSON, XML or unencoded binary content.

[0029] The TCP / IP protocol syntax specification structure includes: the header contains structured fields such as source / destination port, sequence number, flag bit, etc., and the payload part is unstructured data.

[0030] According to the example, if there is a single feature field in the target protocol data packet that contains both structured and unstructured features, it is necessary to first segment the field according to the protocol syntax specification, extract the structured part of the single feature field as an independent structured feature field, and extract the unstructured part as an independent unstructured feature field. By segmenting, classification processing can be achieved, and syntax tree parsing and time series tracking can be performed separately, thereby reducing the computational complexity of heterogeneous data mixed analysis and improving detection efficiency.

[0031] A single feature field in the target protocol data packet may contain both structured features and unstructured features. Therefore, field segmentation should be performed on this feature field first, and the structured feature segmentation field should be re-used as an independent structured feature field, and the unstructured feature segmentation field should be re-used as an independent unstructured feature field, so as to facilitate subsequent centralized integration and analysis to reduce computing resources.

[0032] The structured feature field is parsed through a syntax tree to generate a nested hierarchical feature vector, and the confidence level of the dominant anomaly is output by comparing the positive and negative samples of the feature vector.

[0033] See also Figure 2 As shown, as a preferred embodiment, the syntax tree parsing of the structured feature field to generate a nested hierarchical feature vector includes: decomposing the structured feature field into multiple syntax units, including a root syntax unit, a path hierarchical unit and a key-value semantic unit.

[0034] The affiliation between each grammatical unit is marked to construct a tree-like hierarchical structure, in which the root grammatical unit is the top node, the path hierarchical unit is the branch node, and the key-value semantic unit is the terminal leaf node.

[0035] The tree-like hierarchical structure is traversed layer by layer starting from the root syntax unit, the type identifier, hierarchical depth position and attribute value of each syntax unit are recorded, and a hierarchical structure description character string is generated according to a fixed nesting order.

[0036] Generate a nested-level feature vector by converting the string into a fixed-dimensional numeric vector.

[0037] As a preferred embodiment, the process of obtaining the explicit anomaly confidence includes: performing forward similarity matching on the nested hierarchical feature vector and a sequence of known vulnerability grammatical units stored in an autonomously maintained vulnerability feature library, where the matching parameters include grammatical unit type, hierarchical order, and attribute value.

[0038] It should be noted that the above-mentioned known vulnerability grammatical unit sequence contains several grammatical structure feature fields with security vulnerability types. Before performing forward similarity matching, each field in the known vulnerability grammatical unit sequence should be converted into a nested hierarchical feature vector, which is recorded as each vulnerability nested hierarchical feature vector. The nested hierarchical feature vector is compared with each vulnerability nested hierarchical feature vector in turn, including the type identifier, hierarchical depth position and attribute value of each grammatical unit. The similarity between the nested hierarchical feature vector and the nested hierarchical feature vector of each vulnerability in the type identifier, hierarchical depth position and attribute value of each grammatical unit is quantified by the cosine similarity formula, and the forward similarity between the nested hierarchical feature vector and the nested hierarchical feature vector of each vulnerability is accumulated. ,in is the number of each vulnerability nesting level feature vector, .

[0039] The number of level missing, the number of type conflicts and the number of attribute value deviation items of the nested level feature vector relative to the standard grammatical unit sequence stored in the normal traffic benchmark library are counted respectively to calculate the negative deviation degree.

[0040] It should be noted that the above-mentioned standard grammatical unit sequence contains several grammatical structure feature fields without security vulnerability threats. Before calculating the negative deviation, each field in the standard grammatical unit sequence should be converted into a nested-level feature vector, recorded as each standard nested-level feature vector, and the nested-level feature vector is compared with each standard nested-level feature vector in turn. The number of relative level missing, the number of type conflicts and the number of attribute value deviation items are counted, and the ratio operation is performed with the total number of levels of the nested-level feature vector, the total number of grammatical unit types and the total number of grammatical units to complete the normalization processing. The results of the ratio operation are accumulated to obtain the negative deviation of the nested-level feature vector and each standard nested-level feature vector. ,in is the number of the feature vector of each standard nesting level, .

[0041] By linearly weighting the positive similarity and negative deviation, the confidence level of the dominant anomaly is output.

[0042] It should be noted that the linear weighted fusion of positive similarity and negative deviation can be specifically referred to the formula Obtain the confidence level of the dominant anomaly, where The preset weights for positive similarity and negative deviation are 0.6 and 0.4, respectively. The basis for the allocation is that the positive similarity match of known vulnerabilities has a higher judgment certainty and a lower risk of false alarms, while the negative deviation of normal traffic may cause occasional anomalies due to fluctuations in legitimate business. It is necessary to reduce the weight to weaken the interference of such fluctuations on the final judgment, so as to balance the accuracy and robustness of the detection results.

[0043] Perform time series status tracking and dynamic qualification verification on unstructured feature fields, and output implicit anomaly confidence.

[0044] As a preferred embodiment, the timing status tracking and dynamic qualification verification process of the unstructured feature field includes: collecting the number of unstructured feature field requests and the sliding time step of each request within a preset time window, obtaining the average interval time step of a single request of the field and using its value as the request frequency value, combining the preset baseline frequency of the target protocol, and quantifying the field timing request status qualification verification index.

[0045] It should be noted that the quantification process of the field timing request status qualification verification indicator includes: obtaining the absolute deviation ratio between the request frequency value and the preset baseline frequency of the target protocol. In order to avoid the denominator being zero, a preset constant is introduced to smooth the absolute deviation ratio, and then the field timing request status qualification verification indicator is obtained by an inverse operation.

[0046] The unstructured feature field content and associated metadata are stored according to the window time series, the field content is segmented according to the request sliding time step, the content segments of each request for the unstructured feature field within the preset time window are collected, the value domain mutation amplitude of the content segment of each request relative to the previous request is calculated, and based on the changing trend of the value domain mutation amplitude, the field time series value domain status qualification verification index is quantified.

[0047] It should be noted that the above-mentioned field time series value range status qualification verification index is obtained by obtaining the time series standard deviation of the value range mutation amplitude and substituting it into the standard attenuation exponential function. The use of the standard attenuation exponential function is intended to take into account the fact that the value range mutation amplitude of unstructured data may produce instantaneous noise due to factors such as network jitter and normal business fluctuations. The time series standard deviation is smoothed by the exponential attenuation function to reduce the weight of short-term fluctuations and highlight long-term trends.

[0048] As a preferred embodiment, the timing status tracking and dynamic qualification verification process of the unstructured feature field also includes: based on the protocol control flag of the unstructured feature field, recording each protocol change event and timestamp of the field within the preset time window, constructing a protocol interaction timing chain and benchmarking the preset protocol implementable interaction table to determine the basic rationality of the protocol interaction timing chain.

[0049] It should be noted that the preset protocol interaction table stores a set of interactive protocols for various network protocols. For example, the HTTP protocol can interact with the TCP protocol, and the DNS protocol can interact with the UDP protocol. When determining the basic rationality of the protocol interaction timing chain, the following steps can be performed:

[0050] (a) Split the protocol interaction timing chain into several single interaction chains according to the preset interaction direction.

[0051] (b) Each interactive single chain takes the initiating protocol and the interacting protocol as the analysis objects. If the interacting protocol belongs to the set of interactive protocols in the preset interaction table of the initiating protocol, the rationality factor of the single chain is given as 1, otherwise it is 0.

[0052] (c) Counting the rationality factors of all interactive single chains in the timing chain, and generating the basic rationality of the protocol interaction timing chain through cumulative calculation.

[0053] Synchronously collect the changes in the associated metadata corresponding to each protocol change event of the field, and determine the expected compliance of the protocol interaction timing chain based on the comparison results of the associated metadata changes and the reasonable change range of the associated metadata historically calibrated with the corresponding protocol change event.

[0054] It should be noted that the above-mentioned associated metadata includes but is not limited to the data packet byte stream length, transmission rate, and compression type.

[0055] The process of determining the expected compliance of the protocol interaction timing chain is as follows: if the change in the associated metadata corresponding to a certain protocol change event is within the reasonable change range of the associated metadata historically calibrated for the corresponding protocol change event, then the compliance factor of the protocol change event is assigned to 1, otherwise it is assigned to 0. The compliance factors of each protocol change event in the protocol interaction timing chain are sorted out, and the minimum value is taken as the expected compliance of the protocol interaction timing chain.

[0056] The product of the expected compliance and the basic rationality is used as the field timing protocol status qualification verification indicator.

[0057] As a preferred embodiment, the implicit anomaly confidence acquisition process includes: mapping the timing request, value range, and protocol status qualification verification index of the unstructured feature field to corresponding membership levels, and the membership levels are divided into three levels: low, medium, and high.

[0058] It should be noted that the above-mentioned membership level mapping can use the triangular or trapezoidal membership function in fuzzy logic to map the timing request, value range, and protocol status qualification verification indicators into membership degrees, and the preset membership degree intervals correspond to low, medium, and high membership levels, corresponding to the membership levels to which the mapping indicators belong.

[0059] Retrieve the historical conditional probability matrix of unstructured vulnerability patterns in the self-maintained vulnerability feature library, take the membership level corresponding to the timing request status qualification check indicator triggering the vulnerability event as the first confidence level, take the membership level corresponding to the value range status qualification check indicator triggering the vulnerability event as the second confidence level based on the membership level corresponding to the timing request status qualification check indicator, take the membership level corresponding to the protocol status qualification check indicator triggering the vulnerability event as the third confidence level based on the membership level corresponding to the timing request and value range status qualification check indicator, extract the conditional probabilities corresponding to the first confidence level, the second confidence level, and the third confidence level in the historical conditional probability matrix, and obtain the implicit anomaly confidence by cumulative multiplication.

[0060] It should be noted that the historical conditional probability matrix of the unstructured vulnerability pattern in the above-mentioned self-maintained vulnerability feature library is a three-dimensional probability table, whose dimensions are composed of low, medium and high membership levels of timing request status, value domain status and protocol status. Each element in the matrix stores the conditional probability value of the historical vulnerability event under a specific combination. The specific combination can be exemplified by a combination of a high membership level of the timing request status, a medium membership level of the value domain status and a low membership level of the protocol status.

[0061] This matrix is ​​continuously optimized through a dynamic update mechanism. Whenever a new known vulnerability is added to the database, the self-maintained vulnerability feature library will extract its associated unstructured feature data and iteratively update the corresponding conditional probability values ​​in the matrix based on Bayesian theorem or maximum likelihood estimation method to ensure that the matrix can reflect the latest vulnerability attack patterns in real time and improve the calculation accuracy of implicit anomaly confidence.

[0062] It should also be noted that the above implicit anomaly confidence can be exemplified by the formula Get, among them Respectively represent the conditional probabilities corresponding to the first confidence level, the second confidence level, and the third confidence level, They respectively represent the corresponding membership levels of the timing request and value range status qualification verification indicators.

[0063] The embodiments of the present invention capture hidden attack features such as sudden changes in field value ranges and abnormal protocol state jumps by tracking the temporal status of unstructured feature fields and performing dynamic qualification verification, thus breaking through the blind spots in the analysis of unstructured data by existing technologies and providing effective data support for determining the existence of vulnerabilities.

[0064] The confidence level of explicit and implicit anomalies is combined to determine the existence of network security vulnerabilities. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies, where the vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0065] As a preferred embodiment, the comprehensive explicit and implicit anomaly confidence determination of network security vulnerability includes: arranging the target protocol data packet structured feature field group to output an explicit anomaly confidence sequence and the unstructured feature field group to output an implicit anomaly confidence sequence.

[0066] Extract the sliding window maximum value of the explicit abnormal confidence sequence respectively Sliding window mean of implicit anomaly confidence sequence .

[0067] like , then it is determined that the network security vulnerability exists, otherwise it is determined that it does not exist. They are preset explicit and implicit anomaly confidence warning thresholds respectively.

[0068] As a preferred embodiment, the vulnerability attribute identification process includes: if , extract the positive similarity of the known vulnerability grammatical unit sequence that matches the nested hierarchical feature vector corresponding to the maximum value element of the sliding window in the self-maintained vulnerability feature library, screen the maximum positive similarity and compare it with the preset similarity threshold. If it is greater than or equal to the preset similarity threshold, the vulnerability attribute is identified as a known vulnerability, otherwise it is identified as a new vulnerability.

[0069] It should be explained that the positive similarity of the known vulnerability grammatical unit sequence that matches the nested-level feature vector corresponding to the maximum value element of the sliding window in the above-mentioned self-maintained vulnerability feature library specifically refers to the positive similarity of the nested-level feature vectors of each vulnerability in the known vulnerability grammatical unit sequence, and therefore there is a subsequent processing operation of screening out the one with the maximum positive similarity.

[0070] like Based on the membership level combination of timing request, value domain, and protocol status qualification verification indicators, the self-maintained vulnerability feature library is searched to see whether there is an unstructured vulnerability pattern with the same membership level combination and a conditional probability greater than the preset probability threshold. If so, the vulnerability attribute is identified as a known vulnerability, otherwise it is identified as a new vulnerability.

[0071] As a preferred embodiment, the corresponding blocking strategy triggering process includes: if it is a known vulnerability, retrieving a pre-stored blocking instruction for the known vulnerability from an independently maintained vulnerability feature library, and sending it to the network protection device for execution.

[0072] If it is a new vulnerability, the target protocol session will be terminated immediately and the source IP address will be temporarily blocked. The sandbox environment will be started simultaneously for behavioral analysis, and an early warning report containing the attack context will be generated and pushed to the security management terminal. If the manual review confirms the validity of the vulnerability, the feature fingerprint will be extracted and updated to the self-maintained vulnerability feature library, and the new vulnerability label will be associated.

[0073] The embodiment of the present invention uses the confidence level of explicit and implicit anomalies as the basis for analysis, not only determining the existence of vulnerabilities, but also identifying known or new vulnerabilities to trigger corresponding blocking strategies, thereby realizing the integration of vulnerability detection and response, greatly improving the efficiency and effectiveness of security management, and effectively reducing the losses caused by network attacks.

[0074] The embodiment of the present invention extracts the structured and unstructured feature fields of the target protocol data packet, and through explicit and implicit anomaly confidence detection, comprehensively determines the existence of vulnerabilities and identifies vulnerability attributes to trigger corresponding blocking strategies, thereby achieving accurate identification and efficient response to security vulnerability threats at the network protocol level, and effectively intercepting threats at the bottom layer of network communication, thereby ensuring the safe and stable operation of the network.

[0075] See also Figure 3 As shown, the second aspect of the present invention provides an artificial intelligence-based network security vulnerability detection system, including: a feature field extraction module, an explicit anomaly detection module, a implicit anomaly detection module and a vulnerability determination processing module.

[0076] The feature field extraction module is connected to the explicit anomaly detection module and the implicit anomaly detection module respectively, and the explicit anomaly detection module and the implicit anomaly detection module are both connected to the vulnerability determination processing module.

[0077] The feature field extraction module extracts a single feature field of a target protocol data packet from network traffic in real time and classifies the field as structured or unstructured according to the target protocol syntax specification.

[0078] The explicit anomaly detection module performs syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and outputs the explicit anomaly confidence by comparing the positive and negative samples of the feature vector.

[0079] The implicit anomaly detection module performs temporal state tracking and dynamic qualification verification on unstructured feature fields, and outputs implicit anomaly confidence levels.

[0080] The vulnerability determination processing module comprehensively determines the existence of network security vulnerabilities based on the confidence of explicit and implicit anomalies. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

[0081] The above formulas are all dimensionless and numerical calculations. The formulas are obtained by collecting a large amount of data and performing software simulation to obtain the most recent real situation. The preset parameters in the formulas are set by technicians in this field according to actual conditions.

[0082] The above embodiments may be implemented in whole or in part through software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments may be implemented in whole or in part in the form of a computer program product.

[0083] Those skilled in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0084] In addition, each functional module in each embodiment of the present application may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0085] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0086] Finally, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security vulnerability detection method based on artificial intelligence, characterized in that: include: Extracting a single characteristic field of a target protocol data packet from network traffic in real time, and classifying the field as structured or unstructured according to the target protocol syntax specification; Perform syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector, and output the confidence level of the dominant anomaly by comparing the positive and negative samples of the feature vector; The explicit anomaly confidence acquisition process includes: performing forward similarity matching on the nested hierarchical feature vector and a sequence of known vulnerability grammatical units stored in an autonomously maintained vulnerability feature library, where the matching parameters include grammatical unit type, hierarchical order, and attribute value; Counting the number of level missing, type conflict, and attribute value out-of-range deviation items of the nested level feature vector relative to the standard grammatical unit sequence stored in the normal traffic benchmark library, and calculating the negative deviation degree; By linearly weighting the positive similarity and negative deviation, the confidence level of the dominant anomaly is output; Perform time series status tracking and dynamic qualification verification on unstructured feature fields, and output implicit anomaly confidence levels; The implicit anomaly confidence acquisition process includes: mapping the timing request, value range, and protocol status qualification verification index of the unstructured feature field to corresponding membership levels, and the membership levels are divided into three levels: low, medium, and high; Retrieve the historical conditional probability matrix of the unstructured vulnerability pattern in the self-maintained vulnerability feature library, take the membership level corresponding to the timing request status qualification check indicator triggering the vulnerability event as the first confidence level, take the membership level corresponding to the value range status qualification check indicator triggering the vulnerability event as the second confidence level based on the membership level corresponding to the timing request status qualification check indicator, take the membership level corresponding to the protocol status qualification check indicator triggering the vulnerability event as the third confidence level based on the membership level corresponding to the timing request and value range status qualification check indicator, extract the conditional probabilities corresponding to the first confidence level, the second confidence level, and the third confidence level in the historical conditional probability matrix, and obtain the implicit anomaly confidence by cumulative multiplication; The confidence level of explicit and implicit anomalies is combined to determine the existence of network security vulnerabilities. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

2. The network security vulnerability detection method based on artificial intelligence according to claim 1 is characterized in that: The performing syntax tree parsing on the structured feature field to generate a nested hierarchical feature vector includes: decomposing the structured feature field into a plurality of syntax units, including a root syntax unit, a path hierarchical unit, and a key-value semantic unit; Mark the affiliation between each grammatical unit and construct a tree-like hierarchical structure, where the root grammatical unit is the top node, the path hierarchical unit is the branch node, and the key-value semantic unit is the terminal leaf node; Traversing the tree hierarchy layer by layer starting from the root syntax unit, recording the type identifier, hierarchical depth position and attribute value of each syntax unit, and generating a hierarchical structure description string in a fixed nesting order; Generate a nested-level feature vector by converting the string into a fixed-dimensional numeric vector.

3. The network security vulnerability detection method based on artificial intelligence according to claim 1 is characterized in that: The temporal state tracking and dynamic qualification verification process of the unstructured feature field includes: Collect the number of unstructured feature field requests and the sliding time step of each request within a preset time window, obtain the average time step interval between single requests of the field and use its value as the request frequency value. Combined with the preset baseline frequency of the target protocol, quantify the field timing request status qualification verification indicator; The unstructured feature field content and associated metadata are stored according to the window time series, the field content is segmented according to the request sliding time step, the content segments of each request for the unstructured feature field within the preset time window are collected, the value domain mutation amplitude of the content segment of each request relative to the previous request is calculated, and based on the changing trend of the value domain mutation amplitude, the field time series value domain status qualification verification index is quantified.

4. The method for detecting network security vulnerabilities based on artificial intelligence according to claim 3, characterized in that: The timing state tracking and dynamic qualification verification process of the unstructured feature field also includes: Based on the protocol control flag of the unstructured feature field, record each protocol change event and timestamp of the field within the preset time window, build a protocol interaction timing chain and benchmark the preset protocol implementable interaction table to determine the basic rationality of the protocol interaction timing chain; Synchronously collect the metadata changes corresponding to each protocol change event of the field, and determine the expected compliance of the protocol interaction timing chain based on the comparison results of the metadata changes with the reasonable change range of the metadata in the history of the corresponding protocol change event; The product of the expected compliance and the basic rationality is used as the field timing protocol status qualification verification indicator.

5. The network security vulnerability detection method based on artificial intelligence according to claim 1 is characterized in that: The method of determining the existence of a network security vulnerability by combining explicit and implicit anomaly confidences includes: arranging the output explicit anomaly confidence sequence corresponding to the structured feature field group of the target protocol data packet and the output implicit anomaly confidence sequence corresponding to the unstructured feature field group; Extract the sliding window maximum value of the explicit abnormal confidence sequence respectively Sliding window mean of implicit anomaly confidence sequence ; like , then it is determined that the network security vulnerability exists, otherwise it is determined that it does not exist. They are preset explicit and implicit anomaly confidence warning thresholds respectively.

6. The artificial intelligence-based network security vulnerability detection method according to claim 5, characterized in that: The vulnerability attribute identification process includes: like , extract the positive similarity of the known vulnerability grammatical unit sequence that matches the nested level feature vector corresponding to the maximum value element of the sliding window in the self-maintained vulnerability feature library, select the maximum positive similarity and compare it with the preset similarity threshold, if it is greater than or equal to the preset similarity threshold, then identify the vulnerability attribute as a known vulnerability, otherwise identify it as a new vulnerability; like Based on the membership level combination of timing request, value domain, and protocol status qualification verification indicators, the self-maintained vulnerability feature library is searched to see whether there is an unstructured vulnerability pattern with the same membership level combination and a conditional probability greater than the preset probability threshold. If so, the vulnerability attribute is identified as a known vulnerability, otherwise it is identified as a new vulnerability.

7. The network security vulnerability detection method based on artificial intelligence according to claim 1, characterized in that: The corresponding blocking strategy triggering process includes: if it is a known vulnerability, retrieving the known vulnerability pre-stored blocking instructions from the self-maintained vulnerability feature library, and sending them to the network protection device for execution; If it is a new vulnerability, the target protocol session will be terminated immediately and the source IP address will be temporarily blocked. The sandbox environment will be started simultaneously for behavioral analysis, and an early warning report containing the attack context will be generated and pushed to the security management terminal. If the manual review confirms the validity of the vulnerability, the feature fingerprint will be extracted and updated to the self-maintained vulnerability feature library, and the new vulnerability label will be associated.

8. An artificial intelligence-based network security vulnerability detection system, configured to implement the artificial intelligence-based network security vulnerability detection method according to any one of claims 1 to 7, characterized in that: include: A feature field extraction module extracts a single feature field of a target protocol data packet from network traffic in real time and classifies the field as structured or unstructured according to the target protocol syntax specification; The explicit anomaly detection module parses the structured feature field into a syntax tree to generate a nested hierarchical feature vector, and outputs the explicit anomaly confidence level by comparing the positive and negative samples of the feature vector. The implicit anomaly detection module performs time series status tracking and dynamic qualification verification on unstructured feature fields, and outputs implicit anomaly confidence levels; The vulnerability determination processing module comprehensively determines the existence of network security vulnerabilities based on the confidence of explicit and implicit anomalies. If it is determined to exist, the vulnerability attributes are identified to trigger corresponding blocking strategies. The vulnerability attributes include known vulnerabilities or new vulnerabilities.

Images