Network security threat detection and response method based on artificial intelligence technology

Abstract

The application relates to the technical field of network security detection and response, and discloses a network security threat detection and response method based on artificial intelligence technology, which comprises analysis and response of login times and file modification times in log data. In the application, when one of the login times and the file modification times is slightly abnormal and the other is normal, a key index of permission modification times is introduced, if the permission modification times are normal, it is proved that the abnormality of one of the login times and the file modification times is caused by an accidental factor, so that it is judged that the software is normal, and thus the risk of false judgment of malicious software caused by slight abnormality of a single index can be reduced.

Description

Technical Field

[0001] This invention relates to the field of network security detection and response technology, specifically to a network security threat detection and response method based on artificial intelligence technology. Background Technology

[0002] Cybersecurity threats are diverse, mainly including attacks by malicious software such as viruses, worms, Trojans, and ransomware; phishing attacks; denial-of-service attacks; zero-day exploits; advanced persistent threats; insider abuse of privileges; and data breaches.

[0003] Malware typically infiltrates systems through email attachments, download programs, or network sharing to steal or damage data; phishing attacks use fake emails or websites to trick users into submitting sensitive information, such as usernames and passwords; denial-of-service attacks exhaust the target server's resources with a large number of fake requests, preventing legitimate users from accessing the system; and zero-day vulnerabilities, because they have not yet been publicly disclosed or patched, provide hackers with a secret entry point. In summary, facing a complex and ever-changing threat environment, building a multi-layered, dynamic protection system and strengthening security monitoring and emergency response capabilities are crucial. Therefore, this paper proposes a cybersecurity threat detection and response method based on artificial intelligence technology. Summary of the Invention

[0004] To address the problems existing in the prior art, the purpose of this invention is to provide a network security threat detection and response method based on artificial intelligence technology, which can detect and respond to network security threats.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a network security threat detection and response method based on artificial intelligence technology, comprising: Step 1, using log collection to aggregate software log data, then using a log parsing algorithm to denoise the aggregated data, extracting the denoised log data, and obtaining the number of logins of the software within a period; Step 2, obtaining the number of logins of the software within several consecutive periods over a past period, taking the average value as a login count threshold, comparing the number of logins of the software with the login count threshold; if the number of logins of the software is less than or equal to the login count threshold, it means that the number of logins of the software within a period is within the normal range, and in this case, the number of logins of the software is normal; if the number of logins of the software is greater than the login count threshold, it means that the number of logins of the software within a period exceeds the normal range, and in this case, the number of logins of the software is abnormal; Step 3, ... When the number of login attempts for the software is abnormal, the system retrieves the number of file modifications made by the software within a given period. Simultaneously, it takes the average of the number of file modifications over several consecutive periods as a threshold. The software's file modification count is compared to this threshold. If the number of file modifications is less than or equal to the threshold, it indicates the number of file modifications within a given period is within the normal range, and the file modification count is considered normal. If the number of file modifications exceeds the threshold, it indicates the number of file modifications within a given period exceeds the normal range, and the file modification count is considered abnormal. In step four, when both the number of file modifications and login attempts are abnormal, the software is identified as malicious software. A response mechanism is initiated to isolate the suspected infected host or software from the network, blocking its communication with the outside world and preventing the spread of malicious behavior.

[0006] In some implementations, if the number of login attempts is abnormal but the number of file modifications is normal, a login attempt threshold greater than the login attempt threshold is set. When the number of login attempts exceeds the login attempt threshold, the login attempts are compared with the login attempt threshold again, and different responses are given based on the comparison results. Similarly, if the number of file modifications is abnormal but the number of login attempts is normal, a file modification threshold greater than the file modification attempt threshold is set. When the number of file modifications exceeds the file modification attempt threshold, the file modification attempts are compared with the file modification threshold again, and different responses are given based on the comparison results.

[0007] In some implementations, if the number of login attempts is less than or equal to the login attempt threshold, it means that the number of login attempts exceeds the login attempt threshold to a low degree, and the abnormal number of login attempts is only slightly abnormal. In this case, a second judgment is made. If the number of login attempts is greater than the login attempt threshold, it means that the number of login attempts exceeds the login attempt threshold to a high degree. In this case, the judgment that the software is malicious software is maintained.

[0008] In some implementations, if the number of file modifications is less than or equal to the number of file modifications close to the threshold, it means that the number of file modifications exceeds the threshold to a low degree, and the abnormal number of file modifications is only slightly abnormal. In this case, the same judgment is made again. If the number of file modifications is greater than the number of file modifications close to the threshold, it means that the number of file modifications exceeds the threshold to a high degree. In this case, the judgment that the software is malicious software is maintained.

[0009] In some implementations, during the re-evaluation, the number of times the software requested permissions within a certain period is extracted from the log data. At the same time, a permission request threshold is set based on the number of times other similar software requested permissions within a certain period. Based on this, the number of times the software requested permissions is compared with the permission request threshold, and different responses are given according to the comparison results.

[0010] In some implementations, if the number of permission requests is less than or equal to the permission request threshold, it means that the frequency of the software requesting permissions within a period of time is within the normal range, and the number of permission requests is normal. In this case, if one of the login count or file modification count is abnormal but only slightly abnormal, while the other is normal, the software is considered to be normal. If the number of permission requests is greater than the permission request threshold, it means that the frequency of the software requesting permissions within a period of time exceeds the normal range, and the number of permission requests is abnormal. In this case, the detection result of the software being malware is maintained.

[0011] In some implementations, when the number of login attempts and the number of file modifications are slightly abnormal, while the number of permission acquisition attempts is normal, the maximum number of login attempts and the maximum number of file modifications in the past time are obtained, the number of login attempts is compared with the maximum number of login attempts, and the number of file modifications is compared with the maximum number of file modifications, the comparison results are obtained, and the response is based on the comparison results.

[0012] In some implementations, the comparison results include: the number of logins is less than or equal to the maximum number of logins, and the number of file modifications is less than or equal to the maximum number of file modifications; the number of logins is less than or equal to the maximum number of logins, and the number of file modifications is greater than the maximum number of file modifications; the number of logins is greater than the maximum number of logins, and the number of file modifications is less than or equal to the maximum number of file modifications; and the number of logins is greater than the maximum number of logins, and the number of file modifications is greater than the maximum number of file modifications.

[0013] In some implementations, the response to the comparison results is as follows: provided that the number of permission acquisitions is normal and the number of logins and file modifications are slightly abnormal, the software is considered to be normal only if the number of logins is less than or equal to the maximum number of logins and the number of file modifications is less than or equal to the maximum number of file modifications. Otherwise, the software is considered to be malicious software.

[0014] The present invention further provides a computer-readable storage medium storing a computer program, which is executed by a processor to implement the above-described method for network security threat detection and response based on artificial intelligence technology.

[0015] The technical solution provided by this invention has the following advantages compared with the prior art:

[0016] Firstly, in this invention, when one of the login count and the file modification count shows a slight anomaly while the other is normal, the key indicator of permission modification count is introduced. If the permission modification count is normal, it indicates that the anomaly in one of the login count and the file modification count is likely caused by an unexpected factor, thus determining that the software is normal. In this way, the risk of misjudging malicious software due to a slight anomaly in a single indicator can be reduced.

[0017] Secondly, in this invention, when the number of permission modifications is normal, but the number of logins and the number of file modifications are slightly abnormal, the maximum value of the two in historical data is used to represent the threshold of the two for re-judgment. If neither the number of logins nor the number of file modifications exceeds its maximum value, the slight abnormality of the two can be considered as normal fluctuation. Conversely, as long as one of the two exceeds the maximum value, it indicates that there is an abnormality, and thus the software is judged to be malicious software. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the steps of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] It is understood that the term "a" should be understood as "at least one" or "one or more", that is, in one embodiment, the number of an element can be one, while in another embodiment, the number of the element can be multiple, and the term "a" should not be understood as a limitation on the number.

[0021] The network security threat detection and response method based on artificial intelligence technology provided by this invention, such as Figure 1 As shown, it includes:

[0022] The first step involves aggregating the log data generated by the software to a log platform using log collection tools such as Filebeat, Fluentd, and Logstash. Log parsing algorithms are then used to preprocess the logs, specifically Drain, Spell, or LogPai algorithms for pattern recognition, automatically extracting common templates and removing variable parts without a fixed format. This significantly reduces data dimensionality and filters out redundant noise. Next, logs recording login operations are extracted, and a set time period is established. Keyword matching and data aggregation techniques are then used to automatically count the number of logins within that time period.

[0023] The second step involves retrieving the software's login count over several consecutive periods based on historical records. After obtaining the login counts for multiple periods, the average of these counts is taken as the login count threshold. Under this condition, the software's login count within a single period is compared to the login count threshold, and different responses are determined based on the comparison results. If the software's login count is less than or equal to the login count threshold, it means the software's login count within a single period is within the normal range, and in this case, the software's login count is normal. If the software's login count exceeds the login count threshold, it means the software's login count within a single period exceeds the normal range, and in this case, the software's login count is abnormal.

[0024] The third step involves extracting the number of file modifications within a given period from the log data when the software's login count becomes abnormal. Simultaneously, the file modification counts for several consecutive periods over a past timeframe are obtained based on historical records. The average of these file modification counts is then used as a threshold. Under this condition, the software's file modification count is compared to the threshold, and different responses are determined based on the comparison results. If the software's file modification count is less than or equal to the threshold, it indicates that the number of file modifications within a given period is within the normal range, and the file modification count is considered normal. If the software's file modification count exceeds the threshold, it indicates that the number of file modifications within a given period exceeds the normal range, and the file modification count is considered abnormal. When both the file modification count and login count are abnormal, the software is identified as malware, and a response mechanism is initiated to immediately isolate the suspected infected host or software from the network, blocking its communication with the outside world and preventing the spread of malicious behavior. This includes automatically restricting network access, suspending related processes, and disconnecting virtual machines or physical machines. Furthermore, pre-defined security policies are used to automatically delete or isolate malicious files and processes, apply patches, or perform system configuration corrections. If necessary, antivirus software or endpoint detection and response tools can be used to automatically repair affected systems and remove residual threats.

[0025] Fourth, based on the above, besides abnormal login counts and abnormal file modification counts, there are two other scenarios. One is that both login counts and file modification counts are normal; in this case, the software is normal. The other is that one of the login counts or file modification counts is abnormal, while the other is normal. In this case, if the login count is abnormal and the file modification count is normal, a login count proximity threshold slightly higher than the login count threshold is set. When the login count exceeds the login count threshold, it is compared again with the proximity threshold, and different actions are taken based on the comparison result. If the login count is less than or equal to the proximity threshold, it means the degree to which the login count exceeds the login count threshold is low, and the login count abnormality is only slight; in this case, a further judgment is made. If the login count is greater than the proximity threshold, it means the degree to which the login count exceeds the login count threshold is high; in this case, the judgment that the software is malicious remains. If the file modification count is abnormal and the login count is normal, a file modification count proximity threshold slightly higher than the file modification count threshold is set. When the file modification count exceeds the file modification count threshold, it is compared again with the proximity threshold, and different actions are taken based on the comparison result. If the number of file modifications is less than or equal to the near-threshold, it indicates a low degree of exceeding the threshold, and the abnormality is only slightly abnormal. In this case, a second assessment is performed. If the number of file modifications is greater than the near-threshold, it indicates a high degree of exceeding the threshold. In this case, the judgment that the software is malicious remains unchanged. During the second assessment, the number of permissions requested by the software within a period is extracted from the log data. Simultaneously, a permission request threshold is set based on the permission request counts of other similar software within the same period. Based on this, the software's permission request count is compared with the threshold, and different responses are given according to the comparison results. If the number of permission requests is less than or equal to the threshold, it means that the frequency of permission requests by the software within a period is within the normal range, and the software's permission request count is normal. In this case, if one of the login count or file modification count is abnormal, but the abnormality is not high (i.e., less than or equal to the near-threshold), manifesting as a slight abnormality, while the other is normal, it can be considered an unexpected incident, and the software detection is considered normal. If the number of permission requests exceeds the permission request threshold, it means that the software requests permissions more frequently than normal within a period of time, and the number of permission requests is abnormal. In this case, if one of the login count or file modification count is abnormal but the degree of abnormality is not high (i.e. less than or equal to close to the threshold), it will be considered a slight abnormality, while the other is normal. In this case, the software will be considered as malware.Because permission acquisition is a sensitive and critical indicator, malware often frequently requests or elevates system privileges to perform illegal operations. Therefore, if the number of permission acquisitions by software within a given period is less than or equal to a set threshold, it indicates that the software does not exhibit abnormal behavior in permission requests and shows no signs of attempting to illegally expand privileges. When only the number of login attempts or file modifications shows slight anomalies, and the magnitude of the anomaly does not exceed the set threshold, it suggests that the anomaly may be caused by system maintenance, fluctuations in user activity, or other unforeseen events. The fact that another indicator remains normal further corroborates that the overall behavior of the software conforms to normal operating patterns. In summary, the normal state of permission acquisition serves to verify and supplement the judgment of other indicators, thereby reducing the risk of misjudging malware due to a single slight anomaly. It ensures that only when multiple key behaviors show anomalies will the software be considered malicious. Therefore, in this case, the slight anomaly can be judged as an unexpected fluctuation, and the detection result for the software remains normal. For example, within a certain monitoring period, the thresholds set based on historical data are as follows: login count threshold is 100 times, and the near-login count threshold is 110 times; file modification count threshold is 20 times, and the near-file modification count threshold is 25 times; meanwhile, the permission acquisition count threshold is set to 10 times. Suppose the software records 105 logins, 18 file modifications, and 9 permission acquisitions in the current period. In this case, the 105 logins exceed the 100-login threshold but do not reach the 110-login threshold, indicating a low level of anomaly; the 18 file modifications are far below the 20-file modification threshold, indicating normal behavior. Meanwhile, the 9 permission acquisitions are also within the normal range (not exceeding 10 times), indicating that the software did not exhibit abnormal behavior in critical permission acquisition operations. Since permission acquisition is a sensitive indicator, its normal values ​​further corroborate that although the individual indicator (login count) is slightly high, the overall behavior is likely just an occasional fluctuation due to system maintenance or user operation, rather than a malicious attempt. Therefore, in this case, the abnormality of the software as determined by the comprehensive indicators can be attributed to an accident, and the test results are still considered normal, rather than malicious software.

[0026] Step 5: When the login count and file modification count are slightly abnormal, while the permission acquisition count is normal (i.e., the login count is greater than the login count threshold but less than or equal to the near-threshold, the file modification count is greater than the file modification count threshold but less than or equal to the near-threshold, and the permission acquisition count is less than or equal to the permission acquisition count threshold), obtain the maximum login count and the maximum file modification count over several consecutive periods over the past period, and record them as the maximum login count and the maximum file modification count, respectively. Compare the login count with the maximum login count and the file modification count with the maximum file modification count, and take different actions based on the comparison results. There are four possible comparison results: 1) Login count is less than or equal to the maximum login count, and file modification count is less than or equal to the maximum file modification count; 2) Login count is less than or equal to the maximum login count, and file modification count is greater than the maximum file modification count; 3) Login count is greater than the maximum login count, and file modification count is less than or equal to the maximum file modification count; 4) Login count is greater than the maximum login count, and file modification count is greater than the maximum file modification count. Assuming normal permission acquisition counts and only slightly abnormal login and file modification counts, the software is considered normal only if both the login and file modification counts are less than or equal to the maximum login and file modification counts. Otherwise, the software is considered malicious. This is because the initial login and file modification count thresholds are derived from the average of multiple login and file modification counts over several consecutive periods. With normal permission acquisition counts and only slightly abnormal login and file modification counts, the login and file modification count thresholds can be slightly increased, but must not exceed the maximum values ​​over the past few periods. In other words, in this step, the login and file modification count thresholds are dynamically adjusted to match the maximum login and file modification counts. For example, suppose that over the past few periods, the system has recorded an average of 100 logins and 20 file modifications for the software. Historical data analysis shows that the maximum number of logins over these periods was 108, and the maximum number of file modifications was 24. The system also sets thresholds of 110 for logins, 25 for file modifications, and 10 for permission requests. If, in the current period, the software has 105 logins (greater than the average of 100 but less than the threshold of 110), 23 file modifications (greater than the average of 20 but less than the threshold of 25), and 9 permission requests (≤10, within the normal range), then the login and file modification counts appear slightly abnormal, but the permission request count still appears normal.To further confirm whether this slight anomaly falls within the bounds of normal fluctuation, the system compares the current period's login count (105) and file modification count (23) with the maximum values ​​from the past few periods. Here, 105 ≤ 108 and 23 ≤ 24, meaning they are within the historical fluctuation range. This indicates that although the average threshold is slightly low, after dynamically adjusting to the historical maximum, neither exceeds the upper limit of their expected normal fluctuation, thus determining that this slight anomaly is likely just an occasional fluctuation. Conversely, if either exceeds the historical maximum, it indicates that the current performance is abnormally high compared to the most extreme normal state in history, suggesting potential risk. Therefore, the software detection is only considered normal if both login count and file modification count do not exceed their historical maximums. This dynamic adjustment based on historical maximums, while maintaining the normality of sensitive permission acquisition indicators, provides a reasonable margin for fluctuations in login and file modification anomalies, effectively reducing the risk of misjudgment.

[0027] The processes described above with reference to the flowcharts in the embodiments disclosed in this invention can be implemented as computer software programs. Embodiments of this invention include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication component, and / or installed from a removable medium. When the computer program is executed by a central processing unit, it performs the functions defined in the methods of this application. It should be noted that the computer-readable medium described above in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection having one or more wire segments, a portable computer disk, a hard disk, a random access memory, a read-only memory, an erasable programmable read-only memory, an optical fiber, a portable compact disk read-only memory, an optical storage device, a magnetic storage device, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless segments, wire segments, optical cables, RF, etc., or any suitable combination thereof.

[0028] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0029] Those skilled in the art should understand that the above description is only a specific embodiment of this application, but the protection scope of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the protection scope of this application.

Claims

1. An artificial intelligence technology-based network security threat detection and response method, characterized by, Comprise: Step one, using log collection to summarize the log data of software, after summarizing, using log analysis algorithm to denoise, extracting the denoised log data, in a cycle time, obtaining the login times of software; Step two, obtaining the login times of software in several continuous cycle times in the past period of time, taking the average value as the login times threshold, comparing the login times of software with the login times threshold, if the login times of software is less than or equal to the login times threshold, it represents that the login times of software in a cycle time is in the normal range, in this case, the login times of software is normal; if the login times of software is greater than the login times threshold, it represents that the login times of software in a cycle time exceeds the normal range, in this case, the login times of software is abnormal; Step three, when the login times of software is abnormal, obtaining the file modification times of software in a cycle time, at the same time, taking the average value of file modification times in several continuous cycle times in the past period of time as the file modification times threshold, comparing the file modification times of software with the file modification times threshold, if the file modification times of software is less than or equal to the file modification times threshold, it represents that the file modification times of software in a cycle time is in the normal range, in this case, the file modification times is normal; If the file modification times of software is greater than the file modification times threshold, it represents that the file modification times of software in a cycle time exceeds the normal range, in this case, the file modification times is abnormal; Step four, when the file modification times and the login times are both abnormal, judging that the software is malicious software, starting the response mechanism, isolating the suspected infected host or software from the network, blocking its communication with the outside, preventing the spread of malicious behavior; if the login times is abnormal and the file modification times is normal, setting the login times close threshold which is greater than the login times threshold, when the login times is greater than the login times threshold, comparing the login times with the login times close threshold again, according to the comparison result, obtaining different responses; if the file modification times is abnormal and the login times is normal, setting the file modification times close threshold which is greater than the file modification times threshold, when the file modification times is greater than the file modification times threshold, comparing the file modification times with the file modification times close threshold again, according to the comparison result, obtaining different responses; if the login times is less than or equal to the login times close threshold, it represents that the degree of exceeding the login times threshold is low, the login times abnormality is only slight abnormality, in this case, further judgment is carried out; if the login times is greater than the login times close threshold, it represents that the degree of exceeding the login times threshold is high, in this case, the judgment that the software is malicious software is maintained; If the file modification times is less than or equal to the file modification times approaching threshold, it represents that the degree of exceeding the file modification times threshold is low, and the file modification times anomaly is only a slight file modification times anomaly. In this case, the software is re-judged. If the file modification times is greater than the file modification times approaching threshold, it represents that the degree of exceeding the file modification times threshold is high. In this case, the judgment that the software is malicious software is maintained. When re-judging, the permission acquisition times of the software in a period of time is extracted from the log data. Meanwhile, the permission acquisition times threshold is set according to the permission acquisition times of other software of the same type in a period of time. Based on this, the permission acquisition times of the software is compared with the permission acquisition times threshold, and different responses are made according to the comparison result. 2.The network security threat detection and response method based on artificial intelligence technology according to claim 1, characterized in that, If the permission acquisition times is less than or equal to the permission acquisition times threshold, it represents that the frequency of acquiring permissions of the software in a period of time is within the normal range, and the permission acquisition times of the software is normal. In this case, when one of the login times or the file modification times is abnormal but slight, and the other is normal, the detection of the software is considered normal. If the permission acquisition times is greater than the permission acquisition times threshold, it represents that the frequency of acquiring permissions of the software in a period of time exceeds the normal range, and the permission acquisition times of the software is abnormal. In this case, the detection result that the software is malicious software is maintained. 3.The network security threat detection and response method based on artificial intelligence technology according to claim 2, characterized in that, When the login times and the file modification times are both slightly abnormal, and the permission acquisition times is normal, the maximum value of the login times and the maximum value of the file modification times in the past time are obtained. The login times is compared with the maximum value of the login times, and the file modification times is compared with the maximum value of the file modification times. The comparison result is obtained, and the response to the comparison result is made. 4.The network security threat detection and response method based on artificial intelligence technology according to claim 3, characterized in that, The comparison result includes: the login times is less than or equal to the maximum value of the login times, and the file modification times is less than or equal to the maximum value of the file modification times; the login times is less than or equal to the maximum value of the login times, and the file modification times is greater than the maximum value of the file modification times; the login times is greater than the maximum value of the login times, and the file modification times is less than or equal to the maximum value of the file modification times; and the login times is greater than the maximum value of the login times, and the file modification times is greater than the maximum value of the file modification times. 5.The network security threat detection and response method based on artificial intelligence technology according to claim 4, characterized in that, The response to the comparison result is: under the premise that the permission acquisition times is normal, and the login times and the file modification times are both slightly abnormal, only when the login times is less than or equal to the maximum value of the login times, and the file modification times is less than or equal to the maximum value of the file modification times, the detection of the software is normal. Otherwise, the software is considered to be malicious software.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is executed by the processor to implement the network security threat detection and response method based on artificial intelligence technology in any one of claims 1-5.

Images