Network security detection method and system based on artificial intelligence

Abstract

The invention relates to the technical field of network security detection, in particular to a network security detection method and system based on artificial intelligence, and the method comprises the steps: obtaining network flow data of a target network according to a preset sampling period, and obtaining a data packet sequence and a data flow sequence of the network flow; and judging whether each data stream in the data stream sequence is abnormal or not based on a preset data stream exception table. According to the invention, through a multi-level detection mechanism, in combination with a plurality of technical means such as the preset abnormal flow table, the K-means clustering analysis and the abnormal detection model, each layer provides security check, and whether the flow is abnormal and safe is judged by stages, so that missing detection or false alarm possibly caused by a single detection mode is effectively avoided, and the detection efficiency is improved. And through K-means clustering analysis and flow feature extraction, different types of flows can be identified under the clustering condition of the data flow sequence.

Description

Technical Field

[0001] The present invention relates to the technical field of network security detection, and in particular to a network security detection method and system based on artificial intelligence. Background Art

[0002] Artificial intelligence (AI) is a technology that simulates human intelligence, enabling computers to perform tasks that typically require human intelligence, such as learning, reasoning, problem-solving, language understanding, and visual recognition. Technologies involved include machine learning, deep learning, and natural language processing. Network security detection uses various technical means to identify, monitor, and prevent network attacks or malicious activity. These detection methods can identify security threats such as abnormal network traffic, malware, data leaks, and virus transmission. Traditional network security detection methods primarily include intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, virus scanning, and traffic monitoring.

[0003] Due to the diversity of attack methods and network traffic, a single detection method is difficult to cover all attack modes and is prone to missing some new, undefined attacks. In addition, a single detection system often has false alarms. For example, normal traffic may be misjudged as attack traffic, causing unnecessary interference and waste of resources. Traditional network security detection methods often require manual intervention for configuration and adjustment. The frequent involvement of manual intervention leads to a slow response speed for network traffic detection, especially when facing rapidly changing attack methods. Manual intervention may not be able to adapt quickly. Traditional methods often rely on simple traffic characteristics for monitoring and detection. Complex attack behaviors such as DDoS attacks and zero-day attacks may be difficult to effectively identify with traditional methods due to unclear traffic patterns. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the above-mentioned prior art and provide a network security detection method and system based on artificial intelligence.

[0005] The technical solution adopted to solve the above technical problems is: an artificial intelligence-based network security detection method, including:

[0006] Acquire network traffic data of the target network according to a preset sampling period, and obtain a data packet sequence and a data stream sequence of the network traffic;

[0007] Determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table; if the data flow has an anomaly, intercept the data flow; otherwise, determine whether the data flow sequence is clustered based on a K-means algorithm;

[0008] If the data stream sequence is clustered, extracting flow features of the data stream sequence, and judging whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence; if the data stream sequence is not clustered, intercepting the data stream sequence;

[0009] If the data flow sequence is a normal data flow sequence, anomaly detection is performed on the data packet sequence corresponding to the data flow sequence based on a pre-trained anomaly detection model to determine whether each data flow in the data flow sequence is safe. If the data flow sequence is an abnormal data flow sequence, the data flow sequence is intercepted;

[0010] If the data stream is not safe, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

[0011] Preferably, judging whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table includes:

[0012] Obtaining the source address and destination address of each data packet in each data stream in the data stream sequence;

[0013] Matching the source address and destination address of each data packet in each data flow in the data flow sequence with the data flow anomaly table to determine whether the source address and destination address are in the data flow anomaly table;

[0014] If the source address and the destination address are in the data flow anomaly table, it indicates that the data packet corresponding to the source address and the destination address is abnormal, that is, it indicates that the data flow corresponding to the data packet is abnormal.

[0015] Preferably, determining whether the data stream sequence is clustered based on the K-means algorithm includes:

[0016] An objective function is constructed based on the data stream sequence, and the objective function is used to minimize the sum of squares of distances from points within the cluster to the cluster center, wherein the objective function is as follows:

[0017]

[0018] Among them, J represents the sum of squares of distances from points within the cluster to the cluster center, x i Represents a data point in the data stream sequence, r ik A data point x representing the data flow in the data flow sequence i Whether it belongs to cluster k, μ k represents the center of cluster k, ‖x i -μ k ‖ 2 A data point x representing the data flow in the data flow sequence iThe square of the distance to the center of cluster k;

[0019] Allocating data streams in the data stream sequence to different clusters based on the objective function;

[0020] Calculate the silhouette coefficient of the cluster and compare the silhouette coefficient of the cluster with a preset silhouette coefficient threshold. If the silhouette coefficient of the cluster is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered; otherwise, it indicates that the data stream sequence is not clustered. The calculation formula of the silhouette coefficient is as follows:

[0021]

[0022] Among them, S(i) represents the silhouette coefficient of the cluster, a(i) represents the average distance from the data point of the data stream in the data stream sequence to other points in its cluster, and b(i) represents the average distance from the data point of the data stream in the data stream sequence to the nearest other clusters.

[0023] Preferably, the flow characteristics of the data flow sequence include the number of data packets in the data flow, the flow rate of the data flow and the duration of the data flow.

[0024] Preferably, judging whether the data stream sequence is a normal data stream sequence based on the stream characteristics of the data stream sequence includes:

[0025] Storing the flow information of each data flow in the data flow sequence in a counter, wherein the flow information of each data flow includes the start time of the data flow, the end time of the data flow, the sampling rate and the latest sampling flow length;

[0026] An estimated flow length and an estimated flow rate of the data flow are estimated based on the flow characteristics and the sampling rate, wherein a calculation formula for the estimated flow length is as follows:

[0027]

[0028] Among them, z i represents the estimated length of the data stream, z i (θ) represents the sampling stream length, θ represents the sampling rate;

[0029] The calculation formula for the estimated flow rate is as follows:

[0030]

[0031] Among them, r i represents the estimated flow rate of the data flow, t end Indicates the end time of the data stream, t start Indicates the start time of the data stream;

[0032] Whether the data stream sequence is a normal data stream sequence is determined based on a preset normal data stream determination formula and the estimated flow length and estimated flow rate of the data stream. The normal data stream determination formula is as follows:

[0033]

[0034] Among them, f() represents the fitting function, z std Indicates the standard deviation of the data flow length, r std represents the standard deviation of the data flow rate, where a, b, and c represent the fitting parameters.

[0035] Preferably, performing anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model includes:

[0036] Build a communication directed graph based on the data packet sequence;

[0037] The communication directed graph is input into a pre-trained anomaly detection model, and whether each data flow in the data flow sequence is safe is determined based on the pre-trained anomaly detection model.

[0038] Preferably, the communication directed graph includes a node set, an edge set and a node feature set, wherein the node corresponds to the source address of the data packet, the edge corresponds to the communication relationship between two source addresses, and the node feature corresponds to the size of the data packet, the total length of the data in the data packet and the number of bytes in the data packet header.

[0039] Preferably, the anomaly detection model includes a node feature extraction module, a feature aggregation module and a classification module. The node feature extraction module is used to extract node features of different time periods in the communication directed graph to obtain node features of different time periods. The feature aggregation module is used to perform feature aggregation on the node features of different time periods to obtain aggregated features. The classification module is used to classify the aggregated features to obtain a classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer of hidden state to the hidden state of the node features at different times, resets and updates the previous layer of hidden state, calculates the current input with different weight matrices to obtain the reset state, updates the weight matrix to obtain a new hidden state, and obtains the node features of different time periods through calculation of the fully connected layer. The feature aggregation module splices the node features of the previous layer with the node features of the neighboring nodes, combines the weight calculation, and finally obtains the aggregated features of the node through the activation function. The classification module uses the Sigmoid activation function for binary classification.

[0040] Preferably, the expression of the reset state is as follows:

[0041]

[0042] (W xh x it +(⊙(W xr x it +W hr h t-1 +b r ))⊙h t-1 W hh +b h );

[0043] in, represents the reset state, tanh and σ represent activation functions, W xh 、W xr 、W hr and W hh Represents different weight matrices, x it Represents node features, R t =σ(W xr x it +W hr h t-1 +b r ), h t-1 represents the hidden state of the previous layer, b h and b r represents the deviation parameter, ⊙ represents the Hadamard product;

[0044] The expression of the new hidden state is as follows:

[0045]

[0046] Among them, h t represents the new hidden state, W xz and W hz Represents different weight matrices, x it represents node features, b z represents the deviation parameter;

[0047] The aggregation formula of the aggregation feature is as follows:

[0048]

[0049] in, Represents node v i In the aggregated features of the kth layer, W represents the weight matrix, Represents node v i The set of neighboring nodes, Represents node v i Aggregate features of the neighborhood nodes, Represents a splicing operation.

[0050] The technical solution adopted to solve the above technical problems is: an artificial intelligence-based network security detection system, which is applicable to the artificial intelligence-based network security detection method, including:

[0051] A data acquisition unit, the data acquisition unit is used to acquire network traffic data of the target network according to a preset sampling period, and obtain a data packet sequence and a data stream sequence of the network traffic;

[0052] a first detection unit, configured to determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table, and if the data flow has an anomaly, intercept the data flow; otherwise, determine whether the data flow sequence is clustered based on a K-means algorithm;

[0053] a third detection unit, configured to extract flow features of the data flow sequence if the data flow sequence is clustered, and determine whether the data flow sequence is a normal data flow sequence based on the flow features of the data flow sequence; and intercept the data flow sequence if the data flow sequence is not clustered;

[0054] A fourth detection unit, wherein the fourth detection unit is used to perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model if the data stream sequence is a normal data stream sequence, so as to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, the data stream sequence is intercepted; if the data stream is unsafe, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

[0055] The beneficial effects of the present invention are as follows: (1) The present invention combines a preset abnormal traffic table, K-means clustering analysis, anomaly detection model and other technical means through a multi-level detection mechanism. Each layer provides a security check, and determines whether the traffic is abnormal and safe in stages, thereby effectively avoiding missed detection or false alarms that may be caused by a single detection method. Through K-means clustering analysis and flow feature extraction, different types of traffic can be identified under the clustering conditions of the data flow sequence. Clustering analysis can classify traffic according to its characteristics, which helps to accurately identify normal traffic and abnormal traffic; (2) The present invention does not require human intervention through a preset sampling period and automated traffic analysis, and can detect and respond to anomalies in network traffic in real time. Automated detection not only improves the response speed, but also reduces the errors of human operation. In addition, the use of K-means clustering and anomaly detection models can effectively distinguish normal traffic from attack traffic. By extracting features from the data stream and analyzing its flow characteristics, it is possible to more accurately determine whether the traffic is normal, thereby reducing the risk of false alarms; (3) The present invention can independently complete operations such as traffic collection, analysis, judgment, and interception, greatly reducing dependence on manual operations and reducing the workload of security personnel. Accurate interception measures can reduce losses caused by security vulnerabilities and further reduce maintenance and operating costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic flow chart of the steps of the overall method in one embodiment of the present invention;

[0057] Figure 2 This is a schematic diagram of the system architecture of the overall system in an embodiment of the present invention.

[0058] Figure numerals: 1, data collection unit; 2, first detection unit; 3, third detection unit; 4, fourth detection unit. DETAILED DESCRIPTION

[0059] Example 1, as Figure 1 As shown, the network security detection method based on artificial intelligence proposed in the present invention includes:

[0060] S1. Obtain network traffic data of the target network according to a preset sampling period, and obtain a data packet sequence and a data stream sequence of the network traffic;

[0061] S2. Determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table. If the data flow has an anomaly, intercept the data flow. Otherwise, determine whether the data flow sequence is clustered based on the K-means algorithm.

[0062] S3. If the data flow sequence is clustered, extract the flow features of the data flow sequence, and determine whether the data flow sequence is a normal data flow sequence based on the flow features of the data flow sequence. If the data flow sequence is not clustered, intercept the data flow sequence;

[0063] S4. If the data flow sequence is a normal data flow sequence, an anomaly detection is performed on the data packet sequence corresponding to the data flow sequence based on the pre-trained anomaly detection model to determine whether each data flow in the data flow sequence is safe. If the data flow sequence is an abnormal data flow sequence, the data flow sequence is intercepted;

[0064] S5. If the data stream is not secure, the data stream sequence is intercepted; if the data stream is secure, the data stream is transmitted.

[0065] In the present invention, the sampling period refers to the time interval when data is acquired. For example, if the sampling period is set to 1 second, traffic data will be collected from the network once every second. A data packet is the basic unit of information. A data packet contains the information to be sent, the destination address, the source address, the protocol type, etc. A data packet sequence refers to all data packets arranged in chronological order. A data stream refers to a collection of continuous data packets between the source address and the destination address within a period of time, usually generated by a connected session or communication. A data stream sequence is a collection of these data streams arranged in chronological order, representing the overall picture of a specific communication session or data transmission. The K-means algorithm is a commonly used clustering algorithm that classifies data by dividing it into several clusters. The algorithm's goal is to minimize the squared error of the data points within each cluster. Clustering refers to grouping similar objects (such as data streams) into a cluster, and the data between different clusters varies greatly. Flow characteristics refer to statistical information or attributes that describe a network flow. Interception refers to taking measures to block or discard a data flow if it is found to be abnormal or unsafe during the network traffic analysis process.

[0066] In the second embodiment, the artificial intelligence-based network security detection method proposed by the present invention, compared with the first embodiment, this embodiment further includes: determining whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table, including:

[0067] A1. Obtain the source address and destination address of each data packet in each data stream in the data stream sequence;

[0068] A2. matching the source address and destination address of each data packet in each data flow in the data flow sequence with the data flow anomaly table to determine whether the source address and destination address are in the data flow anomaly table;

[0069] A3. If the source address and the destination address are in the data flow anomaly table, it indicates that the data packets corresponding to the source address and the destination address are anomaly, that is, the data flow corresponding to the data packet is anomaly.

[0070] In this embodiment, the source address refers to the IP address of the device that sends the data packet; the destination address refers to the IP address of the device that receives the data packet; the data flow anomaly table is a preset table or database that records known abnormal behavior patterns, characteristics of malicious traffic, mapping relationships between source addresses and destination addresses, and other information. Its function is to help determine whether there are anomalies in network traffic. For example, the table can list the sources of certain malicious IP addresses or abnormal communication patterns. The network traffic analysis system can determine anomalies in the traffic based on this table.

[0071] In an optional embodiment, determining whether a data stream sequence is clustered based on a K-means algorithm includes:

[0072] B1. Construct an objective function based on the data stream sequence. The objective function is used to minimize the sum of squares of distances from points within the cluster to the cluster center. The objective function is as follows:

[0073]

[0074] Among them, J represents the sum of squares of distances from points within the cluster to the cluster center, x i Represents a data point in the data stream sequence, r ik A data point x representing the data flow in the data flow sequence i Whether it belongs to cluster k, μ k represents the center of cluster k, ‖x i -μ k ‖ 2 A data point x representing the data flow in the data flow sequence i The square of the distance to the center of cluster k;

[0075] B2, assigning data streams in the data stream sequence to different clusters based on the objective function;

[0076] B3. Calculate the silhouette coefficient of the cluster and compare it with the preset silhouette coefficient threshold. If the cluster silhouette coefficient is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered. Otherwise, it indicates that the data stream sequence is not clustered. The calculation formula of the silhouette coefficient is as follows:

[0077]

[0078] Among them, S(i) represents the silhouette coefficient of the cluster, a(i) represents the average distance from the data point of the data stream in the data stream sequence to other points in its cluster, and b(i) represents the average distance from the data point of the data stream in the data stream sequence to the nearest other clusters.

[0079] It should be noted that clustering refers to grouping data points so that the similarity of data points within the same cluster is high, while the similarity between different clusters is low. In K-means clustering, cluster division is achieved by minimizing the objective function; the center of the cluster is the mean of all data points in the cluster; the silhouette coefficient is an indicator used to measure the quality of clustering results.

[0080] In an optional embodiment, the flow characteristics of the data flow sequence include the number of data packets in the data flow, the flow rate of the data flow, and the duration of the data flow.

[0081] In an optional embodiment, determining whether the data stream sequence is a normal data stream sequence based on the flow characteristics of the data stream sequence includes:

[0082] C1. Storing the flow information of each data flow in the data flow sequence in a counter, where the flow information of each data flow includes the start time of the data flow, the end time of the data flow, the sampling rate, and the latest sampling flow length;

[0083] C2. Estimate the estimated flow length and estimated flow velocity of the data flow based on the flow characteristics and sampling rate. The calculation formula for the estimated flow length is as follows:

[0084]

[0085] Among them, z i represents the estimated length of the data stream, z i (θ) represents the sampling stream length, θ represents the sampling rate;

[0086] The estimated flow rate is calculated as follows:

[0087]

[0088] Among them, r i represents the estimated flow rate of the data flow, t end Indicates the end time of the data stream, t start Indicates the start time of the data stream;

[0089] C3. Determine whether the data flow sequence is a normal data flow sequence based on the preset normal data flow judgment formula and the estimated flow length and estimated flow rate of the data flow. The normal data flow judgment formula is as follows:

[0090]

[0091] Among them, f() represents the fitting function, z std Indicates the standard deviation of the data flow length, r std represents the standard deviation of the data flow rate, where a, b, and c represent the fitting parameters.

[0092] It should be noted that the sampling rate refers to the frequency of sampling the data stream within a certain time interval, usually expressed as the number of samples per second; the sampling flow length refers to the estimated flow length at each sampling point, usually based on the length of the sampled part of the data stream or the amount of data transmitted; the fitting function is to describe the trend or pattern of the data flow characteristics through a certain mathematical model. In network traffic analysis, the fitting function is usually used to fit an overall trend from a large amount of data streams and predict the behavior of the data stream.

[0093] In an optional embodiment, performing anomaly detection on a data packet sequence corresponding to a data stream sequence based on a pre-trained anomaly detection model includes:

[0094] D1. Construct a communication directed graph based on the data packet sequence;

[0095] D2. Input the communication directed graph into the pre-trained anomaly detection model, and determine whether each data flow in the data flow sequence is safe based on the pre-trained anomaly detection model.

[0096] In an optional embodiment, the communication directed graph includes a node set, an edge set, and a node feature set, wherein the node corresponds to the source address of the data packet, the edge corresponds to the communication relationship between the two source addresses, and the node feature corresponds to the size of the data packet, the total length of the data in the data packet, and the number of bytes in the data packet header.

[0097] In an optional embodiment, the anomaly detection model includes a node feature extraction module, a feature aggregation module and a classification module. The node feature extraction module is used to extract node features of different time periods in the communication directed graph to obtain node features of different time periods. The feature aggregation module is used to perform feature aggregation on node features of different time periods to obtain aggregated features. The classification module is used to classify the aggregated features to obtain a classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer of hidden state to the hidden state of the node features at different times, and resets and updates the previous layer of hidden state. The current input is calculated with different weight matrices to obtain the reset state, and the weight matrix is updated to obtain a new hidden state. The node features of different time periods are obtained through calculation of the fully connected layer. The feature aggregation module splices the node features of the previous layer with the node features of the neighboring nodes, combines the weight calculation, and finally obtains the aggregated features of the node through the activation function. The classification module uses the Sigmoid activation function for binary classification.

[0098] In an optional embodiment, the expression of the reset state is as follows:

[0099]

[0100] (W xh x it +(σ(W xr x it +W hr h t-1 +b r ))⊙h t-1 W hh +b h );

[0101] in, represents the reset state, tanh and σ represent activation functions, W xh 、W xr 、W hr and W hh Represents different weight matrices, x it Represents node features, R t =σ(W xr x it +W hr h t-1 +b r ), h t-1 represents the hidden state of the previous layer, b h and b r represents the deviation parameter, ⊙ represents the Hadamard product;

[0102] The expression of the new hidden state is as follows:

[0103] h t =σ(W xz x it +W hz h t-1 +b z )⊙h t-1 +

[0104]

[0105] Among them, h t represents the new hidden state, W xz and W hz Represents different weight matrices, x it represents node features, b z represents the deviation parameter;

[0106] The aggregation formula for the aggregated features is as follows:

[0107]

[0108] in, Represents node v i In the aggregated features of the kth layer, W represents the weight matrix, Represents node vi The set of neighboring nodes, Represents node v i Aggregate features of the neighborhood nodes, Represents a splicing operation.

[0109] Example 3, as Figure 2 As shown, the network security detection system based on artificial intelligence proposed by the present invention is applicable to the network security detection method based on artificial intelligence, including:

[0110] The data acquisition unit 1 is used to acquire the network traffic data of the target network according to a preset sampling period, and obtain the data packet sequence and data stream sequence of the network traffic;

[0111] The first detection unit 2 is used to determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table. If the data flow has an anomaly, the data flow is intercepted. Otherwise, the data flow sequence is determined based on the K-means algorithm to determine whether the data flow sequence is clustered.

[0112] The third detection unit 3 is used to extract the flow characteristics of the data flow sequence if the data flow sequence is clustered, and determine whether the data flow sequence is a normal data flow sequence based on the flow characteristics of the data flow sequence; if the data flow sequence is not clustered, intercept the data flow sequence;

[0113] The fourth detection unit 4 is used to perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model if the data stream sequence is a normal data stream sequence, so as to determine whether each data stream in the data stream sequence is safe. If the data stream sequence is an abnormal data stream sequence, the data stream sequence is intercepted; if the data stream is unsafe, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

[0114] The embodiments of the present invention are described in detail above with reference to the accompanying drawings, but the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A network security detection method based on artificial intelligence, characterized in that: include: Acquire network traffic data of the target network according to a preset sampling period, and obtain a data packet sequence and a data stream sequence of the network traffic; Determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table; if the data flow has an anomaly, intercept the data flow; otherwise, determine whether the data flow sequence is clustered based on a K-means algorithm; If the data stream sequence is clustered, extracting flow features of the data stream sequence, and judging whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence; if the data stream sequence is not clustered, intercepting the data stream sequence; If the data flow sequence is a normal data flow sequence, anomaly detection is performed on the data packet sequence corresponding to the data flow sequence based on a pre-trained anomaly detection model to determine whether each data flow in the data flow sequence is safe. If the data flow sequence is an abnormal data flow sequence, the data flow sequence is intercepted; If the data stream is not safe, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

2. The network security detection method based on artificial intelligence according to claim 1, characterized in that: Determining whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table includes: Obtaining the source address and destination address of each data packet in each data stream in the data stream sequence; Matching the source address and destination address of each data packet in each data flow in the data flow sequence with the data flow anomaly table to determine whether the source address and destination address are in the data flow anomaly table; If the source address and the destination address are in the data flow anomaly table, it indicates that the data packet corresponding to the source address and the destination address is abnormal, that is, it indicates that the data flow corresponding to the data packet is abnormal.

3. The network security detection method based on artificial intelligence according to claim 2, characterized in that: Determining whether the data stream sequence is clustered based on the K-means algorithm includes: An objective function is constructed based on the data stream sequence, and the objective function is used to minimize the sum of squares of distances from points within the cluster to the cluster center, wherein the objective function is as follows: Among them, J represents the sum of squares of distances from points within the cluster to the cluster center, x i Represents a data point in the data stream sequence, r ik A data point x representing the data flow in the data flow sequence i Whether it belongs to cluster k, μ k represents the center of cluster k, ‖x i -μ k ‖ 2 A data point x representing the data flow in the data flow sequence i The square of the distance to the center of cluster k; Allocating data streams in the data stream sequence to different clusters based on the objective function; Calculate the silhouette coefficient of the cluster and compare the silhouette coefficient of the cluster with a preset silhouette coefficient threshold. If the silhouette coefficient of the cluster is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered; otherwise, it indicates that the data stream sequence is not clustered. The calculation formula of the silhouette coefficient is as follows: Among them, S(i) represents the silhouette coefficient of the cluster, a(i) represents the average distance from the data point of the data stream in the data stream sequence to other points in its cluster, and b(i) represents the average distance from the data point of the data stream in the data stream sequence to the nearest other clusters.

4. The network security detection method based on artificial intelligence according to claim 3 is characterized in that: The flow characteristics of the data flow sequence include the number of data packets in the data flow, the flow rate of the data flow and the duration of the data flow.

5. The network security detection method based on artificial intelligence according to claim 4 is characterized in that: Determining whether the data stream sequence is a normal data stream sequence based on the stream characteristics of the data stream sequence includes: Storing the flow information of each data flow in the data flow sequence in a counter, wherein the flow information of each data flow includes the start time of the data flow, the end time of the data flow, the sampling rate and the latest sampling flow length; An estimated flow length and an estimated flow rate of the data flow are estimated based on the flow characteristics and the sampling rate, wherein a calculation formula for the estimated flow length is as follows: Among them, z i represents the estimated length of the data stream, z i (θ) represents the sampling stream length, θ represents the sampling rate; The calculation formula for the estimated flow rate is as follows: Among them, r i represents the estimated flow rate of the data flow, t end Indicates the end time of the data stream, t start Indicates the start time of the data stream; Whether the data stream sequence is a normal data stream sequence is determined based on a preset normal data stream determination formula and the estimated flow length and estimated flow rate of the data stream. The normal data stream determination formula is as follows: Among them, f() represents the fitting function, z std Indicates the standard deviation of the data flow length, r std represents the standard deviation of the data flow rate, where a, b, and c represent the fitting parameters.

6. The network security detection method based on artificial intelligence according to claim 5, characterized in that: Anomaly detection is performed on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model, including: Build a communication directed graph based on the data packet sequence; The communication directed graph is input into a pre-trained anomaly detection model, and whether each data flow in the data flow sequence is safe is determined based on the pre-trained anomaly detection model.

7. The network security detection method based on artificial intelligence according to claim 6, characterized in that: The communication directed graph includes a node set, an edge set and a node feature set, wherein the node corresponds to the source address of the data packet, the edge corresponds to the communication relationship between two source addresses, and the node feature corresponds to the size of the data packet, the total length of the data in the data packet and the number of bytes in the data packet header.

8. The network security detection method based on artificial intelligence according to claim 7, characterized in that: The anomaly detection model includes a node feature extraction module, a feature aggregation module and a classification module. The node feature extraction module is used to extract node features of different time periods in the communication directed graph to obtain node features of different time periods. The feature aggregation module is used to perform feature aggregation on the node features of different time periods to obtain aggregated features. The classification module is used to classify the aggregated features to obtain a classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer of hidden state to the hidden state of the node features at different times, resets and updates the previous layer of hidden state, calculates the current input with different weight matrices to obtain the reset state, updates the weight matrix to obtain a new hidden state, and obtains the node features of different time periods through calculation of the fully connected layer. The feature aggregation module splices the node features of the previous layer with the node features of the neighboring nodes, combines the weight calculation, and finally obtains the aggregated features of the node through the activation function. The classification module uses the Sigmoid activation function for binary classification.

9. The network security detection method based on artificial intelligence according to claim 8, characterized in that: The expression of the reset state is as follows: (W xh x it +(σ(W xr x it +W hr h t-1 +b r ))⊙h t-1 W hh +b h ); in, represents the reset state, tanh and σ represent activation functions, W xh 、W xr 、W hr and W hh Represents different weight matrices, x it Represents node features, R t =σ(W xr x it +W hr h t-1 +b r ), h t-1 represents the hidden state of the previous layer, b h and b r represents the deviation parameter, ⊙ represents the Hadamard product; The expression of the new hidden state is as follows: Among them, h t represents the new hidden state, W xz and W hz Represents different weight matrices, x it represents node features, b z represents the deviation parameter; The aggregation formula of the aggregation feature is as follows: in, Represents node v i In the aggregated features of the kth layer, W represents the weight matrix, Represents node v i The set of neighboring nodes, Represents node v i Aggregate features of the neighborhood nodes, Represents a splicing operation.

10. An artificial intelligence-based network security detection system, which is applicable to the artificial intelligence-based network security detection method according to any one of claims 1 to 9, characterized in that: include: A data acquisition unit (1), the data acquisition unit (1) is used to acquire network traffic data of a target network according to a preset sampling period, and acquire a data packet sequence and a data stream sequence of the network traffic; A first detection unit (2), the first detection unit (2) is used to determine whether each data flow in the data flow sequence has an anomaly based on a preset data flow anomaly table, and if the data flow has an anomaly, intercept the data flow; otherwise, determine whether the data flow sequence is clustered based on a K-means algorithm; a third detection unit (3), the third detection unit (3) being configured to extract flow features of the data flow sequence if the data flow sequence is clustered, and determine whether the data flow sequence is a normal data flow sequence based on the flow features of the data flow sequence, and intercept the data flow sequence if the data flow sequence is not clustered; The fourth detection unit (4) is used for, if the data stream sequence is a normal data stream sequence, performing anomaly detection on a data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, intercepting the data stream sequence; if the data stream is unsafe, intercepting the data stream sequence; and if the data stream is safe, transmitting the data stream.

Images