Network security threat detection and response method based on artificial intelligence technology

Abstract

The invention relates to the technical field of network security detection and response, and discloses a network security threat detection and response method based on an artificial intelligence technology, which comprises analysis and response of login times and file modification times in log data. According to the method, when one of the login times and the file modification times is slightly abnormal, and the other one is normal, the key index of the permission modification times is introduced, if the permission modification times are normal, it is indicated that one of the login times and the file modification times is large in abnormal probability caused by an accidental factor, and therefore it is judged that the software is normal. The risk that malicious software is misjudged due to slight abnormality of a single index can be reduced.

Description

Technical Field

[0001] The present invention relates to the field of network security detection and response technology, and specifically to a network security threat detection and response method based on artificial intelligence technology. Background Art

[0002] There are many types of network security threats, mainly including malware such as viruses, worms, Trojans, ransomware and other attacks, phishing, denial of service attacks, zero-day vulnerability exploits, advanced persistent threats, insider abuse of permissions and data leaks.

[0003] Malware typically infiltrates systems through email attachments, downloaded programs, or network shares, stealing or destroying data. Phishing exploits use forged emails or websites to trick users into submitting sensitive information, such as account numbers and passwords. Denial of Service attacks use a large number of spurious requests to exhaust target server resources, preventing legitimate users from accessing the system. Zero-day vulnerabilities, undisclosed or unpatched, provide hackers with covert entry points. In summary, facing a complex and ever-changing threat landscape, it is crucial to build a multi-layered, dynamic protection system and strengthen security monitoring and emergency response capabilities. To this end, this paper proposes a network security threat detection and response method based on artificial intelligence technology. Summary of the Invention

[0004] In view of the problems existing in the above-mentioned prior art, the purpose of the present invention is to provide a network security threat detection and response method based on artificial intelligence technology, so as to be able to detect and respond to network security threats.

[0005] In order to achieve the above-mentioned purpose, the present invention provides the following technical solutions: a network security threat detection and response method based on artificial intelligence technology, comprising: step one, using log collection to aggregate the log data of the software, and after aggregation, using the log parsing algorithm to denoise it, extracting the denoised log data, and obtaining the number of software logins within a cycle time; step two, obtaining the number of software logins within several consecutive cycles in the past period of time, taking the average value as the login number threshold, and comparing the number of software logins with the login number threshold. If the number of software logins is less than or equal to the login number threshold, it means that the number of software logins within a cycle time is within a normal range. In this case, the number of software logins is normal; if the number of software logins is greater than the login number threshold, it means that the number of software logins within a cycle time exceeds the normal range. In this case, the number of software logins is abnormal; step three When the number of software logins is abnormal, obtain the number of file modifications of the software within a cycle time. At the same time, take the average number of file modifications in several consecutive cycles in the past period as the file modification number threshold, and compare the number of file modifications of the software with the file modification number threshold. If the number of file modifications of the software is less than or equal to the file modification number threshold, it means that the number of file modifications of the software within a cycle time is within the normal range. In this case, the number of file modifications is normal; if the number of file modifications of the software is greater than the file modification number threshold, it means that the number of file modifications of the software within a cycle time exceeds the normal range. In this case, the number of file modifications is abnormal. Step 4: When both the number of file modifications and the number of logins are abnormal, determine that the software is malware, start the response mechanism, isolate the suspected infected host or software from the network, block its communication with the outside, and prevent the spread of malicious behavior.

[0006] In some embodiments, if the number of logins is abnormal and the number of file modifications is normal, a login number approaching threshold value is set that is greater than the login number threshold value. When the login number is greater than the login number threshold value, the login number is compared again with the login number approaching threshold value, and different responses are obtained based on the comparison results; if the number of file modifications is abnormal and the number of logins is normal, a file modification number approaching threshold value is set that is greater than the file modification number threshold value. When the file modification number is greater than the file modification number threshold value, the file modification number is compared again with the file modification number approaching threshold value, and different responses are obtained based on the comparison results.

[0007] In some embodiments, if the number of logins is less than or equal to the number of logins close to the threshold, it means that the degree to which the number of logins exceeds the number of logins threshold is low, and the abnormal number of logins is only a slight abnormality. In this case, a re-judgment is performed; if the number of logins is greater than the number of logins close to the threshold, it means that the degree to which the number of logins exceeds the number of logins threshold is high. In this case, the judgment that the software is malware is maintained.

[0008] In some embodiments, if the number of file modifications is less than or equal to the file modification number threshold, it means that the degree to which the file modification number exceeds the file modification number threshold is low, and the file modification number abnormality is only a slight abnormality in the file modification number. In this case, the judgment is made again; if the number of file modifications is greater than the file modification number threshold, it means that the degree to which the file modification number exceeds the file modification number threshold is high. In this case, the judgment that the software is malware is maintained.

[0009] In some embodiments, when making another judgment, the number of times the software obtains permissions within a cycle is extracted from the log data. At the same time, a permission acquisition number threshold is set based on the number of times other similar software obtains permissions within a cycle. Based on this, the number of times the software obtains permissions is compared with the permission acquisition number threshold, and different responses are obtained based on the comparison results.

[0010] In some embodiments, if the number of permission acquisition times is less than or equal to the permission acquisition times threshold, it means that the frequency of the software acquiring permissions within a cycle time is within the normal range, and the number of permission acquisition times of the software is normal. In this case, when one of the login times or the file modification times is abnormal, but it is a minor abnormality, and the other is normal, the detection of the software is considered normal; if the number of permission acquisition times is greater than the permission acquisition times threshold, it means that the frequency of the software acquiring permissions within a cycle time exceeds the normal range, and the number of permission acquisition times of the software is abnormal. In this case, the detection result that the software is malware is maintained.

[0011] In some embodiments, when the number of logins and file modifications are slightly abnormal, but the number of permission acquisitions is normal, the maximum number of logins and the maximum number of file modifications in the past are obtained, the number of logins is compared with the maximum number of logins, and the number of file modifications is compared with the maximum number of file modifications, a comparison result is obtained, and a response is taken based on the comparison result.

[0012] In some embodiments, the comparison results include: the number of login times is less than or equal to the maximum number of login times, and the number of file modifications is less than or equal to the maximum number of file modifications; the number of login times is less than or equal to the maximum number of login times, and the number of file modifications is greater than the maximum number of file modifications; the number of login times is greater than the maximum number of login times, and the number of file modifications is less than or equal to the maximum number of file modifications; the number of login times is greater than the maximum number of login times, and the number of file modifications is greater than the maximum number of file modifications.

[0013] In some embodiments, the response to the comparison result is: under the premise that the number of permission acquisitions is normal and the number of logins and file modification times are slightly abnormal, the detection of the software is normal if and only if the number of logins is less than or equal to the maximum number of logins and the number of file modification times is less than or equal to the maximum number of file modification times. In other cases, the software is considered to be malware.

[0014] The present invention further provides a computer-readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned network security threat detection and response method based on artificial intelligence technology.

[0015] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:

[0016] First, in the present invention, when a slight anomaly occurs in one of the number of logins and the number of file modifications, while the other is normal, the key indicator of the number of permission modifications is introduced. If the number of permission modifications is normal, it means that the anomaly in one of the number of logins and the number of file modifications is most likely caused by an unexpected factor, and the software is judged to be normal. In this way, the risk of misjudging malware due to a slight anomaly in a single indicator can be reduced.

[0017] Secondly, in the present invention, when the number of permission modifications is normal, but the number of logins and the number of file modifications are both slightly abnormal, the maximum value of the two in the historical data is used to represent the threshold value of the two to re-judge. If the number of logins and the number of file modifications do not exceed their maximum values, the slight abnormalities of the two can be considered as normal fluctuations. On the contrary, as long as one of the two exceeds the maximum value, it indicates that there is an abnormality, and the software is judged to be malware. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Schematic diagram of the steps of the present invention. DETAILED DESCRIPTION

[0019] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0020] It is to be understood that the term "one" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element may be one, while in another embodiment, the number of the elements may be multiple, and the term "one" should not be understood as a limitation on the quantity.

[0021] The network security threat detection and response method based on artificial intelligence technology provided by the present invention is as follows: Figure 1 As shown, including:

[0022] The first step is to aggregate the log data generated by the software to a log platform using log collection tools such as Filebeat, Fluentd, and Logstash. The logs are then preprocessed using log parsing algorithms. This involves performing pattern recognition on the log text using the Drain, Spell, or LogPai algorithms, automatically extracting common templates and stripping out variable parts that do not have a fixed format. This significantly reduces the data dimension and filters out redundant noise. Next, the logs recording login operations are extracted, and a cycle time is set. Keyword matching and data aggregation techniques are used to automatically count the number of software logins within a cycle time.

[0023] The second step is to obtain the software login count for several consecutive cycles based on historical records. After obtaining the login counts for multiple cycles, the average of these log-in counts is used as the login threshold. Under this condition, the software login count for a cycle is compared with the login threshold, and different responses are determined based on the comparison result. If the software login count is less than or equal to the login threshold, it indicates that the software login count for the cycle is within the normal range and the software login count is normal. If the software login count is greater than the login threshold, it indicates that the software login count for the cycle exceeds the normal range and the software login count is abnormal.

[0024] In the third step, when the software's login count is abnormal, the number of file modifications within a given cycle is extracted from the log data. Furthermore, the number of file modifications within several consecutive cycles over the past period is obtained based on historical records. After obtaining the file modification counts for multiple cycles, the average of these file modification counts is taken as the file modification threshold. Under this condition, the software's file modification count is compared with the file modification threshold, and different responses are determined based on the comparison results. If the software's file modification count is less than or equal to the file modification threshold, the software's file modification count within a given cycle is within the normal range; in this case, the file modification count is normal. If the software's file modification count is greater than the file modification threshold, the software's file modification count within a given cycle exceeds the normal range; in this case, the file modification count is abnormal. If both the file modification count and login count are abnormal, the software is identified as malware and a response mechanism is activated. The suspected infected host or software is immediately isolated from the network, blocking external communications and preventing the spread of malicious activity. This includes automatically restricting network access, suspending related processes, and disconnecting virtual or physical machines. Furthermore, pre-configured security policies are used to automatically delete or isolate malicious files and processes, apply patches, or perform system configuration corrections. If necessary, antivirus software or endpoint detection and response tools can be called upon to automatically repair affected systems and remove residual threats.

[0025] In step 4, based on the above, in addition to abnormal login times and abnormal file modification times, there are two other situations. One is that both the login times and the file modification times are normal. In this case, the software is normal. The other is that one of the login times or the file modification times is abnormal, while the other is normal. In this case, if the login times are abnormal and the file modification times are normal, a login times proximity threshold is set that is slightly greater than the login times threshold. When the login times exceed the login times threshold, the login times are compared again with the login times proximity threshold, and different responses are determined based on the comparison results. If the login times are less than or equal to the login times proximity threshold, the degree to which the login times exceed the login times threshold is low, and the abnormal login times are only slightly abnormal. In this case, a re-determination is made. If the login times are greater than the login times proximity threshold, the degree to which the login times exceed the login times threshold is high. In this case, the judgment that the software is malware is maintained. If the file modification times are abnormal and the login times are normal, a file modification times proximity threshold is set that is slightly greater than the file modification times threshold. When the file modification times exceed the file modification times threshold, the file modification times are compared again with the file modification times proximity threshold, and different responses are determined based on the comparison results. If the number of file modifications is less than or equal to the file modification number threshold, it means that the degree to which the file modification number exceeds the file modification number threshold is low, and the file modification number abnormality is only a slight abnormality of the file modification number. In this case, the same judgment is made again. If the number of file modifications is greater than the file modification number threshold, it means that the degree to which the file modification number exceeds the file modification number threshold is high. In this case, the judgment that the software is malicious software is maintained. During the re-judgment process, the number of times the software obtains permissions within a cycle time is extracted from the log data. At the same time, the permission acquisition number threshold is set according to the number of times other software of the same type obtain permissions within a cycle time. Based on this, the number of times the software obtains permissions is compared with the permission acquisition number threshold, and different responses are obtained according to the comparison results. If the permission acquisition number is less than or equal to the permission acquisition number threshold, it means that the frequency of the software obtaining permissions within a cycle time is within the normal range, and the software's permission acquisition number is normal. In this case, when one of the login times or the file modification times is abnormal, but the abnormality is not high (that is, less than or equal to the threshold), it is manifested as a slight abnormality, and the other is normal, it can be regarded as an accident, and the detection of the software is regarded as normal. If the number of permission acquisitions is greater than the permission acquisition threshold, it means that the frequency of the software obtaining permissions within a period of time exceeds the normal range, and the number of permission acquisitions of the software is abnormal. In this case, when one of the login times or the file modification times is abnormal, but the degree of abnormality is not high (that is, less than or equal to the threshold), it is manifested as a slight abnormality, and the other is normal, the detection result of the software as malware is maintained.Because permission acquisition is a sensitive and critical indicator, malware often frequently requests or elevates system privileges to perform illegal operations. Therefore, if the number of permission acquisitions performed by software within a period is less than or equal to the set threshold, it indicates that the software has not exhibited abnormal permission request behavior and is not attempting to illegally expand privileges. If only minor anomalies in logins or file modifications occur, and the magnitude of the anomaly does not exceed the set proximity threshold, this indicates that the anomaly may be due to system maintenance, user fluctuations, or other incidental events. The normality of other indicators further confirms that the software's overall behavior conforms to normal operating patterns. Overall, the normal state of permission acquisition serves to validate and supplement the judgments of other indicators, thereby reducing the risk of misidentifying malware due to a single minor anomaly and ensuring that software is only considered malicious when multiple key behaviors exhibit anomalies. Therefore, in this case, the minor anomaly can be considered an unexpected fluctuation, and the software's detection result can be maintained as normal. For example, within a certain monitoring cycle, the thresholds set based on historical data are: 100 logins, 110 logins approaching the threshold; 20 file modifications, 25 file modifications approaching the threshold; and 10 permission acquisitions. Suppose the software recorded 105 logins, 18 file modifications, and 9 permission acquisitions during the current cycle. The 105 logins exceed the 100 login threshold, but do not reach the 110 login approaching threshold, indicating a low level of anomaly. The 18 file modifications are well below the 20 file modification threshold, indicating normal behavior. Furthermore, the 9 permission acquisitions are also within the normal range (no more than 10), indicating that the software exhibits no abnormal behavior in critical permission acquisition operations. Since permission acquisition operations are sensitive indicators, their normal values further confirm that while the individual indicator (logins) is slightly elevated, the overall behavior is likely a fluctuating event due to system maintenance or user operations, rather than malicious intent. Therefore, in this case, the abnormality of the software determined by the comprehensive indicators can be attributed to an accident, and the detection result is still considered normal, not malware.

[0026] Step 5: When both the number of logins and the number of file modifications are slightly abnormal, but the number of permission acquisitions is normal, that is, the number of logins is greater than the login threshold but less than or equal to the login proximity threshold, the number of file modifications is greater than the file modification threshold but less than or equal to the file modification proximity threshold, and the number of permission acquisitions is less than or equal to the permission acquisition threshold, obtain the maximum number of software logins and the maximum number of file modifications over several consecutive cycles in the past, and record them as the maximum number of logins and the maximum number of file modifications, respectively. Compare the number of logins with the maximum number of logins, and the number of file modifications with the maximum number of file modifications, and come up with different responses based on the comparison results. There are four types of comparison results: the first is that the number of logins is less than or equal to the maximum number of logins, and the number of file modifications is less than or equal to the maximum number of file modifications; the second is that the number of logins is less than or equal to the maximum number of logins, and the number of file modifications is greater than the maximum number of file modifications; the third is that the number of logins is greater than the maximum number of logins, and the number of file modifications is less than or equal to the maximum number of file modifications; and the fourth is that the number of logins is greater than the maximum number of logins, and the number of file modifications is greater than the maximum number of file modifications. Under the premise that the number of permission acquisitions is normal and the number of logins and file modifications are slightly abnormal, the software detection is normal if and only if the number of logins is less than or equal to the maximum number of logins and the number of file modifications is less than or equal to the maximum number of file modifications. In other cases, the software is considered to be malware. This is because the initial login threshold and file modification threshold are derived from the average of multiple logins and file modification times of the software over several consecutive cycles in the past. Under the premise that the key indicator of permission acquisition is normal and the number of logins and file modifications are slightly abnormal, the login threshold and file modification threshold can be slightly increased, but must not exceed the maximum value over the past few cycles. In other words, in this step, the login threshold and file modification threshold are dynamically adjusted to the maximum number of logins and the maximum number of file modifications. For example, suppose that in the past few cycles, the system has counted an average of 100 software logins and an average of 20 file modifications. At the same time, after historical data analysis, the maximum number of logins in the past few cycles was 108, and the maximum number of file modifications was 24. The system also sets the login threshold to 110, the file modification threshold to 25, and the permission acquisition threshold to 10. If in the current cycle, the software logins are 105 (greater than the average of 100 but not exceeding the threshold of 110), the file modifications are 23 (greater than the average of 20 but not exceeding the threshold of 25), and the permission acquisition is 9 (≤10, which is within the normal range), then the login and file modification counts will appear to be slightly abnormal, but the permission acquisition count will still appear normal.To further confirm whether this minor anomaly represents normal fluctuation, the system compares the current cycle's 105 logins and 23 file modifications with their respective maximum values from past cycles. Here, 105 ≤ 108 and 23 ≤ 24, respectively, are within the historical fluctuation range. This indicates that while the average thresholds are slightly lower, after dynamic adjustment to the historical maximum, neither exceeds the upper limit of expected normal fluctuations, thus determining that this minor anomaly is likely a sporadic fluctuation. Conversely, if either value exceeds the historical maximum, it indicates an abnormally high level compared to the most extreme historical normal state, indicating potential risk. Therefore, the software detection is considered normal only if both the login and file modification counts do not exceed their historical maximums. This dynamic adjustment based on historical maximums allows for a reasonable fluctuation margin for minor anomalies in logins and file modifications, while maintaining normal sensitivity for access permissions, effectively reducing the risk of false positives.

[0027] In the embodiments disclosed herein, the processes described above with reference to the flowcharts can be implemented as computer software programs. The embodiments disclosed herein include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for executing the method illustrated in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication component and / or installed from removable media. When the computer program is executed by a central processing unit, the functions defined in the methods of this application are performed. It should be noted that the computer-readable medium referred to herein can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. Computer-readable storage media can be, for example, but not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or components, or any combination thereof. More specific examples of computer-readable storage media can include, but are not limited to, an electrical connection having one or more wire segments, a portable computer disk, a hard disk, random access memory, read-only memory, erasable programmable read-only memory, optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. Furthermore, in this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, electrical, optical, RF, or any suitable combination thereof.

[0028] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architectures, functions, and operations of the systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or portion of code that contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two boxes shown in succession can actually be executed substantially in parallel, or they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as combinations of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified functions or operations, or can be implemented using a combination of dedicated hardware and computer instructions.

[0029] Those skilled in the art should understand that the above is only a specific implementation method of the present application, but the scope of protection of the present application is not limited thereto. Any technician familiar with this technical field can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered by the scope of protection of the present application.

Claims

1. A network security threat detection and response method based on artificial intelligence technology, characterized in that: include: Step 1: Use log collection to aggregate the software's log data. After aggregation, use the log parsing algorithm to denoise it. The denoised log data is extracted to obtain the number of software logins within a cycle. Step 2: Obtain the number of software logins in several consecutive cycles over the past period, take the average value as the login threshold, and compare the number of software logins with the login threshold. If the number of software logins is less than or equal to the login threshold, it means that the number of software logins in one cycle is within a normal range. In this case, the number of software logins is normal. If the number of software logins is greater than the login threshold, it means that the number of software logins in one cycle exceeds the normal range. In this case, the number of software logins is abnormal. Step 3: When the software login times are abnormal, obtain the number of file modifications of the software within a cycle time. At the same time, take the average number of file modifications within several consecutive cycles in the past as the file modification number threshold. Compare the number of file modifications of the software with the file modification number threshold. If the number of file modifications of the software is less than or equal to the file modification number threshold, it means that the number of file modifications of the software within a cycle time is within the normal range. In this case, the file modification number is normal. If the number of file modifications in the software exceeds the file modification threshold, it means that the number of file modifications in a cycle exceeds the normal range. In this case, the file modification number is abnormal. Step 4: When both the number of file modifications and the number of logins are abnormal, the software is judged to be malware, and the response mechanism is activated to isolate the suspected infected host or software from the network, blocking its communication with the outside world and preventing the spread of malicious behavior.

2. The network security threat detection and response method based on artificial intelligence technology according to claim 1 is characterized in that: If the number of logins is abnormal and the number of file modifications is normal, set a login count approaching threshold that is greater than the login count threshold. When the login count is greater than the login count threshold, compare the login count with the login count approaching threshold again, and come up with different responses based on the comparison results. If the number of file modifications is abnormal and the number of logins is normal, set a file modification count approaching threshold that is greater than the file modification count threshold. When the file modification count is greater than the file modification count threshold, compare the file modification count with the file modification count approaching threshold again, and come up with different responses based on the comparison results.

3. The network security threat detection and response method based on artificial intelligence technology according to claim 2 is characterized in that: If the number of logins is less than or equal to the login number threshold, it means that the degree to which the number of logins exceeds the login number threshold is low, and the login number abnormality is only a slight abnormality. In this case, another judgment is made; if the number of logins is greater than the login number threshold, it means that the degree to which the number of logins exceeds the login number threshold is high. In this case, the judgment that the software is malicious software is maintained.

4. The network security threat detection and response method based on artificial intelligence technology according to claim 2 is characterized in that: If the number of file modifications is less than or equal to the file modification count proximity threshold, it means that the degree to which the file modification count exceeds the file modification count threshold is low, and the file modification count abnormality is only a slight abnormality of the file modification count. In this case, the judgment is made again; if the number of file modifications is greater than the file modification count proximity threshold, it means that the degree to which the file modification count exceeds the file modification count threshold is high. In this case, the judgment that the software is malware is maintained.

5. The network security threat detection and response method based on artificial intelligence technology according to claim 3 or 4 is characterized in that: When making the second judgment, the number of times the software obtains permissions within a cycle is extracted from the log data. At the same time, a permission acquisition number threshold is set based on the number of times other similar software obtains permissions within a cycle. Based on this, the number of times the software obtains permissions is compared with the permission acquisition number threshold, and different responses are obtained based on the comparison results.

6. The network security threat detection and response method based on artificial intelligence technology according to claim 5 is characterized in that: If the number of permission acquisitions is less than or equal to the permission acquisition threshold, it means that the frequency of the software acquiring permissions within a cycle is within the normal range, and the number of permission acquisitions for the software is normal. In this case, when one of the login times or the file modification times is abnormal, but the abnormality is minor, and the other is normal, the software detection is considered normal; if the number of permission acquisitions is greater than the permission acquisition threshold, it means that the frequency of the software acquiring permissions within a cycle exceeds the normal range, and the number of permission acquisitions for the software is abnormal. In this case, the detection result of the software as malware is maintained.

7. The network security threat detection and response method based on artificial intelligence technology according to claim 6 is characterized in that: When the number of logins and file modifications are slightly abnormal, but the number of permission acquisitions is normal, obtain the maximum number of logins and the maximum number of file modifications in the past time, compare the number of logins with the maximum number of logins, and compare the number of file modifications with the maximum number of file modifications, obtain the comparison results, and respond accordingly.

8. The network security threat detection and response method based on artificial intelligence technology according to claim 7 is characterized in that: The comparison results include: the number of login times is less than or equal to the maximum number of login times, and the number of file modifications is less than or equal to the maximum number of file modifications; the number of login times is less than or equal to the maximum number of login times, and the number of file modifications is greater than the maximum number of file modifications; the number of login times is greater than the maximum number of login times, and the number of file modifications is less than or equal to the maximum number of file modifications; the number of login times is greater than the maximum number of login times, and the number of file modifications is greater than the maximum number of file modifications.

9. The network security threat detection and response method based on artificial intelligence technology according to claim 8 is characterized in that: The response to the comparison results is: under the premise that the number of permission acquisitions is normal, and the number of logins and file modifications are slightly abnormal, the software detection is normal if and only if the number of logins is less than or equal to the maximum number of logins, and the number of file modifications is less than or equal to the maximum number of file modifications. In all other cases, the software is considered to be malware.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and the computer program is executed by a processor to implement the network security threat detection and response method based on artificial intelligence technology as described in any one of claims 1 to 9.

Images