Artificial Intelligence-Based Network Security Detection Methods and Systems

Abstract

This invention relates to the field of network security detection technology, specifically to a network security detection method and system based on artificial intelligence. The method includes: acquiring network traffic data of a target network according to a preset sampling period; acquiring the data packet sequence and data stream sequence of the network traffic; and determining whether each data stream in the data stream sequence is abnormal based on a preset data stream anomaly table. This invention employs a multi-layered detection mechanism, combining a preset abnormal traffic table, K-means clustering analysis, anomaly detection models, and other technical means. Each layer provides security checks, effectively avoiding missed detections or false alarms that might occur with a single detection method by determining whether traffic is abnormal and safe in stages. Furthermore, through K-means clustering analysis and flow feature extraction, it can identify different types of traffic under the clustering conditions of the data stream sequence.

Description

Technical Field

[0001] This invention relates to the field of network security detection technology, and more specifically to network security detection methods and systems based on artificial intelligence. Background Technology

[0002] Artificial intelligence (AI) is a technology that simulates human intelligent behavior, enabling computers to perform tasks that typically require human intelligence, such as learning, reasoning, problem-solving, language understanding, and visual recognition. It involves technologies including machine learning, deep learning, and natural language processing. Network security detection refers to the use of various technical means to identify, monitor, and prevent network attacks or malicious behavior. These detection methods can identify security threats such as abnormal network traffic, malware, data breaches, and virus propagation. Traditional network security detection methods mainly include intrusion detection systems (IDS), intrusion prevention systems (IPS), firewalls, virus scanning, and traffic monitoring.

[0003] Due to the diversity of attack methods and network traffic, a single detection method is difficult to cover all attack patterns, easily missing some new and undefined attacks. Furthermore, single detection systems often produce false alarms; for example, normal traffic may be misjudged as attack traffic, causing unnecessary interference and wasted resources. Traditional network security detection methods often require manual intervention for configuration and adjustment, leading to slow response times, especially when facing rapidly changing attack methods, where manual intervention may not be able to adapt quickly. Moreover, traditional methods often rely on simple traffic characteristics for monitoring and detection; for complex attack behaviors such as DDoS attacks and zero-day attacks, traditional methods may struggle to effectively identify them due to unclear traffic patterns. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the shortcomings of the prior art and provide a network security detection method and system based on artificial intelligence.

[0005] The technical solution adopted to solve the above-mentioned technical problems is: an artificial intelligence-based network security detection method, including:

[0006] According to a preset sampling period, network traffic data of the target network is acquired, and the data packet sequence and data stream sequence of the network traffic are acquired;

[0007] Based on a preset data stream anomaly table, it is determined whether each data stream in the data stream sequence is abnormal. If the data stream is abnormal, it is intercepted; otherwise, it is determined whether the data stream sequence is clustered based on the K-means algorithm.

[0008] If the data stream sequence is clustered, then the flow features of the data stream sequence are extracted, and it is determined whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence. If the data stream sequence is not clustered, then the data stream sequence is intercepted.

[0009] If the data stream sequence is a normal data stream sequence, then anomaly detection is performed on the data packet sequence corresponding to the data stream sequence based on the pre-trained anomaly detection model to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, then the data stream sequence is intercepted.

[0010] If the data stream is insecure, the data stream sequence is intercepted; if the data stream is secure, the data stream is transmitted.

[0011] Preferably, determining whether each data stream in the data stream sequence has an anomaly based on a preset data stream anomaly table includes:

[0012] Obtain the source address and destination address of each data packet in each data stream of the data stream sequence;

[0013] The source address and destination address of each data packet in each data stream of the data stream sequence are matched with the data stream anomaly table to determine whether the source address and destination address are in the data stream anomaly table;

[0014] If the source address and destination address are in the data flow anomaly table, it indicates that the data packet corresponding to the source address and destination address is abnormal, that is, it indicates that the data flow corresponding to the data packet is abnormal.

[0015] Preferably, determining whether the data stream sequence is clustered based on the K-means algorithm includes:

[0016] An objective function is constructed based on the data stream sequence. This objective function minimizes the sum of squared distances from points within a cluster to the cluster center. The objective function is as follows:

[0017]

[0018] Where J represents the sum of squared distances from points within the cluster to the cluster center, and x i r represents a data point in a data stream sequence. ik Represents the data point x in the data stream sequence. i Does it belong to cluster k, μ k Denotes the center of cluster k, ||x i -μ k || 2 Represents the data point x in the data stream sequence. iThe squared distance to the center of cluster k;

[0019] Based on the objective function, the data streams in the data stream sequence are allocated to different clusters;

[0020] The silhouette coefficient of the cluster is calculated and compared with a preset silhouette coefficient threshold. If the silhouette coefficient of the cluster is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered; otherwise, it indicates that the data stream sequence is not clustered. The formula for calculating the silhouette coefficient is as follows:

[0021]

[0022] Where S(i) represents the silhouette coefficient of the cluster, a(i) represents the average distance from the data point of the data stream in the data stream sequence to other points in its own cluster, and b(i) represents the average distance from the data point of the data stream in the data stream sequence to the nearest other cluster.

[0023] Preferably, the flow characteristics of the data stream sequence include the number of data packets in the data stream, the flow rate of the data stream, and the duration of the data stream.

[0024] Preferably, determining whether the data stream sequence is a normal data stream sequence based on the stream characteristics of the data stream sequence includes:

[0025] The flow information of each data stream in the data stream sequence is stored in a counter. The flow information of each data stream includes the start time of the data stream, the end time of the data stream, the sampling rate, and the latest sampled stream length.

[0026] Based on the flow characteristics and the sampling rate, the estimated flow length and estimated flow velocity of the data flow are estimated, wherein the formula for calculating the estimated flow length is as follows:

[0027]

[0028] Among them, z i z represents the estimated length of the data stream. i (θ) represents the sampling stream length, and θ represents the sampling rate;

[0029] The formula for calculating the estimated flow velocity is as follows:

[0030]

[0031] Where, r i t represents the estimated flow rate of the data stream. end t represents the end time of the data stream. start Indicates the start time of the data stream;

[0032] Based on a preset normal data stream discrimination formula and the estimated length and estimated velocity of the data stream, it is determined whether the data stream sequence is a normal data stream sequence. The normal data stream discrimination formula is as follows:

[0033]

[0034] Where f() represents the fitting function, z std r represents the standard deviation of the data stream length. std The standard deviation of the data stream rate is represented by, where, a, b, and c represent the fitting parameters.

[0035] Preferably, anomaly detection is performed on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model, including:

[0036] Constructing a directed communication graph based on data packet sequences;

[0037] The directed communication graph is input into a pre-trained anomaly detection model, and the model is used to determine whether each data stream in the data stream sequence is secure.

[0038] Preferably, the directed communication graph includes a set of nodes, a set of edges, and a set of node features, wherein the nodes correspond to the source addresses of the data packets, the edges correspond to the communication relationships between two source addresses, and the node features correspond to the size of the data packets, the total length of the data in the data packets, and the number of bytes in the header of the data packets.

[0039] Preferably, the anomaly detection model includes a node feature extraction module, a feature aggregation module, and a classification module. The node feature extraction module is used to extract node features from different time periods in the directed communication graph to obtain node features for different time periods. The feature aggregation module is used to aggregate the node features from different time periods to obtain aggregated features. The classification module is used to classify the aggregated features to obtain the classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer of hidden states to the hidden states of node features at different times, resets and updates the previous layer of hidden states, calculates the current input with different weight matrices to obtain the reset state, updates the weight matrices to obtain the new hidden states, and obtains node features for different time periods through calculations using fully connected layers. The feature aggregation module concatenates the node features from the previous layer with the node features of neighboring nodes, combines weight calculations, and finally uses an activation function to obtain the aggregated features of the nodes. The classification module uses the Sigmoid activation function for binary classification.

[0040] Preferably, the expression for the reset state is as follows:

[0041]

[0042] (W xh x it +(⊙(W xr x it +W hr h t-1 +b r ))⊙h t-1 W hh +b h );

[0043] in, This represents the reset state, tanh and σ represent the activation functions, and W... xh W xr W hr and W hh Representing different weight matrices, x it Representing node features, R t =σ(W xr x it +W hr h t-1 +b r ), h t-1 Indicates the hidden state of the previous layer, b h and b r The ⊙ symbol represents the deviation parameter, and ⊙ represents the Hadamard product.

[0044] The expression for the new hidden state is as follows:

[0045]

[0046] Among them, h t W represents the new hidden state. xz and W hz Representing different weight matrices, x it Representing node features, b z Indicates the deviation parameter;

[0047] The aggregation formula for the aggregation feature is as follows:

[0048]

[0049] in, Represents node v i In the aggregated features of the k-th layer, W represents the weight matrix. Represents node v i The set of neighboring nodes, Represents node v i The aggregation characteristics of neighboring nodes, This indicates a splicing operation.

[0050] The technical solution adopted to solve the above-mentioned technical problems is: an artificial intelligence-based network security detection system, which is applicable to the aforementioned artificial intelligence-based network security detection method, including:

[0051] A data acquisition unit is used to acquire network traffic data of a target network according to a preset sampling period, and to acquire the data packet sequence and data stream sequence of the network traffic;

[0052] The first detection unit is used to determine whether there is an anomaly in each data stream in the data stream sequence based on a preset data stream anomaly table. If there is an anomaly in the data stream, the data stream is intercepted; otherwise, the data stream sequence is clustered based on the K-means algorithm.

[0053] The third detection unit is used to extract the flow features of the data stream sequence if the data stream sequence is clustered, and determine whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence; if the data stream sequence is not clustered, the data stream sequence is intercepted.

[0054] The fourth detection unit is used to perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model if the data stream sequence is a normal data stream sequence, so as to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, the data stream sequence is intercepted; if the data stream is insecure, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

[0055] The beneficial effects of the present invention are as follows: (1) The present invention uses a multi-level detection mechanism, combining a preset abnormal traffic table, K-means clustering analysis, anomaly detection model and other technical means. Each layer provides security checks. By judging whether the traffic is abnormal or safe in stages, it effectively avoids the possibility of missed detection or false alarms that may be caused by a single detection method. Moreover, through K-means clustering analysis and flow feature extraction, it can identify different types of traffic under the clustering condition of data flow sequence. Clustering analysis can classify traffic according to its characteristics, which helps to accurately identify normal traffic and abnormal traffic. (2) The present invention uses a preset sampling period and automated traffic analysis. It does not require manual intervention and can detect and respond to anomalies in network traffic in real time. Automated detection not only improves the response speed but also reduces the error of human operation. Moreover, by using K-means clustering and anomaly detection model, it can effectively distinguish between normal traffic and attack traffic. By performing feature extraction and flow feature analysis on the data stream, it is possible to more accurately determine whether the traffic belongs to normal traffic, thereby reducing the risk of false alarms; (3) This invention can autonomously complete traffic collection, analysis, judgment, and interception operations, which greatly reduces the dependence on manual operation, reduces the workload of security personnel, and accurate interception measures can reduce the losses caused by security vulnerabilities, further reducing maintenance and operation costs. Attached Figure Description

[0056] Figure 1 This is a schematic diagram of the overall method steps in one embodiment of the present invention;

[0057] Figure 2 This is a schematic diagram of the overall system architecture in one embodiment of the present invention.

[0058] Reference numerals in the attached figures: 1. Data acquisition form; 2. First detection unit; 3. Third detection unit; 4. Fourth detection unit. Detailed Implementation

[0059] Example 1, as Figure 1 As shown, the artificial intelligence-based network security detection method proposed in this invention includes:

[0060] S1. Obtain network traffic data of the target network according to the preset sampling period, and obtain the data packet sequence and data stream sequence of the network traffic;

[0061] S2. Based on the preset data stream anomaly table, determine whether there is an anomaly in each data stream in the data stream sequence. If there is an anomaly in the data stream, intercept the data stream. Otherwise, determine whether the data stream sequence is clustered based on the K-means algorithm.

[0062] S3. If the data stream sequence is clustered, extract the flow features of the data stream sequence and determine whether the data stream sequence is a normal data stream sequence based on the flow features. If the data stream sequence is not clustered, intercept the data stream sequence.

[0063] S4. If the data stream sequence is a normal data stream sequence, then perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on the pre-trained anomaly detection model to determine whether each data stream in the data stream sequence is safe. If the data stream sequence is an abnormal data stream sequence, then intercept the data stream sequence.

[0064] S5. If the data stream is insecure, the data stream sequence is intercepted; if the data stream is secure, the data stream is transmitted.

[0065] In this invention, the sampling period refers to the time interval when acquiring data. For example, if the sampling period is set to 1 second, then traffic data will be collected from the network once per second. A data packet is the basic unit of information. A data packet contains the information to be sent, the destination address, the source address, the protocol type, etc. A data packet sequence refers to all data packets arranged in chronological order. A data stream refers to a continuous set of data packets between the source address and the destination address within a certain period of time. It is usually generated by a session or communication of a connection. A data stream sequence is a set of these data streams arranged in chronological order, representing the overall picture of a specific communication session or data transmission. The K-means algorithm is a commonly used clustering algorithm. It classifies data by dividing it into several clusters. The goal of the algorithm is to minimize the squared error of the data points within each cluster. Clustering refers to grouping similar objects (such as data streams) into a cluster. The data differences between different clusters are relatively large. Flow features refer to the statistical information or attributes that describe a network flow. Interception refers to taking measures to block or discard data streams if abnormal or insecure data streams are found during network traffic analysis.

[0066] Example 2: The artificial intelligence-based network security detection method proposed in this invention, compared to Example 1, further includes: determining whether each data stream in the data stream sequence has an anomaly based on a preset data stream anomaly table, including:

[0067] A1. Obtain the source and destination addresses of each data packet in each data stream of the data stream sequence;

[0068] A2. Match the source address and destination address of each data packet in each data stream of the data stream sequence with the data stream anomaly table to determine whether the source address and destination address are in the data stream anomaly table;

[0069] A3. If the source address and destination address are in the data flow anomaly table, it indicates that the data packets corresponding to the source address and destination address are abnormal, that is, it indicates that the data flow corresponding to the data packets is abnormal.

[0070] In this embodiment, the source address refers to the IP address of the device sending the data packet; the destination address refers to the IP address of the device receiving the data packet; the data flow anomaly table is a preset table or database that records known abnormal behavior patterns, characteristics of malicious traffic, mapping relationships between source and destination addresses, and other information. Its function is to help determine whether there are anomalies in network traffic. For example, the table can list the sources of certain malicious IP addresses or abnormal communication patterns, and the network traffic analysis system can use this table to determine anomalies in the traffic.

[0071] In an optional embodiment, determining whether a data stream sequence is clustered based on the K-means algorithm includes:

[0072] B1. Construct an objective function based on the data stream sequence. The objective function is used to minimize the sum of squared distances from points within a cluster to the cluster center. The objective function is as follows:

[0073]

[0074] Where J represents the sum of squared distances from points within the cluster to the cluster center, and x i r represents a data point in a data stream sequence. ik Represents the data point x in the data stream sequence. i Does it belong to cluster k, μ k Denotes the center of cluster k, ||x i -μ k || 2 Represents the data point x in the data stream sequence. i The squared distance to the center of cluster k;

[0075] B2. Assign data streams in the data stream sequence to different clusters based on the objective function;

[0076] B3. Calculate the silhouette coefficient of the clusters and compare it with a preset silhouette coefficient threshold. If the silhouette coefficient of the cluster is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered; otherwise, it indicates that the data stream sequence is not clustered. The formula for calculating the silhouette coefficient is as follows:

[0077]

[0078] Where S(i) represents the silhouette coefficient of the cluster, a(i) represents the average distance from the data point of the data stream in the data stream sequence to other points in its own cluster, and b(i) represents the average distance from the data point of the data stream in the data stream sequence to the nearest other cluster.

[0079] It should be noted that a cluster refers to grouping data points such that data points within the same cluster have high similarity, while data points in different clusters have low similarity. In K-means clustering, clustering is achieved by minimizing the objective function; the center of a cluster is the mean of all data points within the cluster; and the silhouette coefficient is an indicator used to measure the quality of clustering results.

[0080] In an optional embodiment, the flow characteristics of the data stream sequence include the number of data packets in the data stream, the flow rate of the data stream, and the duration of the data stream.

[0081] In an optional embodiment, determining whether a data stream sequence is a normal data stream sequence based on its stream characteristics includes:

[0082] C1. Store the flow information of each data stream in the data stream sequence in a counter. The flow information of each data stream includes the start time of the data stream, the end time of the data stream, the sampling rate, and the latest sampled stream length.

[0083] C2. Estimating the estimated flow length and estimated flow velocity of the data stream based on flow characteristics and sampling rate. The formula for calculating the estimated flow length is as follows:

[0084]

[0085] Among them, z i z represents the estimated length of the data stream. i (θ) represents the sampling stream length, and θ represents the sampling rate;

[0086] The formula for estimating flow velocity is as follows:

[0087]

[0088] Where, r i t represents the estimated flow rate of the data stream. end t represents the end time of the data stream. start Indicates the start time of the data stream;

[0089] C3. Based on the preset normal data stream discrimination formula and the estimated length and estimated velocity of the data stream, determine whether the data stream sequence is a normal data stream sequence. The normal data stream discrimination formula is as follows:

[0090]

[0091] Where f() represents the fitting function, z std r represents the standard deviation of the data stream length. std The standard deviation of the data stream rate is represented by, where, a, b, and c represent the fitting parameters.

[0092] It should be noted that the sampling rate refers to the frequency of sampling a data stream within a certain time interval, usually expressed as the number of samples per second; the sampled stream length refers to the estimated stream length at each sampling point, usually based on the length of the sampled portion of the data stream or the amount of data transmitted; the fitting function is a mathematical model used to describe the trend or pattern of data stream characteristics. In network traffic analysis, the fitting function is usually used to fit an overall trend from a large number of data streams and predict the behavior of the data streams.

[0093] In an optional embodiment, anomaly detection is performed on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model, including:

[0094] D1. Construct a directed communication graph based on data packet sequences;

[0095] D2. Input the directed graph of communication into a pre-trained anomaly detection model, and determine whether each data stream in the data stream sequence is safe based on the pre-trained anomaly detection model.

[0096] In an optional embodiment, the communication directed graph includes a set of nodes, a set of edges, and a set of node features, wherein nodes correspond to the source addresses of data packets, edges correspond to the communication relationships between two source addresses, and node features correspond to the size of the data packets, the total length of the data in the data packets, and the number of bytes in the header of the data packets.

[0097] In an optional embodiment, the anomaly detection model includes a node feature extraction module, a feature aggregation module, and a classification module. The node feature extraction module extracts node features from different time periods in the directed graph of communication to obtain node features for different time periods. The feature aggregation module aggregates node features from different time periods to obtain aggregated features. The classification module classifies the aggregated features to obtain the classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer's hidden state to the hidden state of node features at different times, resets and updates the previous layer's hidden state, calculates the current input with different weight matrices to obtain the reset state, updates the weight matrix to obtain the new hidden state, and obtains node features for different time periods through calculations using a fully connected layer. The feature aggregation module concatenates the node features from the previous layer with the node features of neighboring nodes, calculates weights, and finally uses an activation function to obtain the aggregated features of the nodes. The classification module uses the Sigmoid activation function for binary classification.

[0098] In an optional embodiment, the expression for the reset state is as follows:

[0099]

[0100] (W xh x it +(σ(W xr x it +W hr h t-1 +b r ))⊙h t-1 W hh +b h );

[0101] in, This represents the reset state, tanh and σ represent the activation functions, and W... xh W xr W hr and W hh Representing different weight matrices, x it Representing node features, R t =σ(W xr x it +W hr h t-1 +b r ), h t-1 Indicates the hidden state of the previous layer, b h and b r The ⊙ symbol represents the deviation parameter, and ⊙ represents the Hadamard product.

[0102] The expression for the new hidden state is as follows:

[0103] h t =σ(W xz x it +W hz h t-1 +b z )⊙h t-1 +

[0104]

[0105] Among them, h t W represents the new hidden state. xz and W hz Representing different weight matrices, x it Representing node features, b z Indicates the deviation parameter;

[0106] The aggregation formula for aggregated features is as follows:

[0107]

[0108] in, Represents node v i In the aggregated features of the k-th layer, W represents the weight matrix. Represents node vi The set of neighboring nodes, Represents node v i The aggregation characteristics of neighboring nodes, This indicates a splicing operation.

[0109] Example 3, as Figure 2 As shown, the artificial intelligence-based network security detection system proposed in this invention is applicable to the aforementioned artificial intelligence-based network security detection method, including:

[0110] Data acquisition unit 1 is used to acquire network traffic data of the target network according to a preset sampling period, and to acquire the data packet sequence and data stream sequence of the network traffic;

[0111] The first detection unit 2 is used to determine whether there is an anomaly in each data stream in the data stream sequence based on a preset data stream anomaly table. If there is an anomaly in the data stream, the data stream is intercepted; otherwise, the data stream sequence is clustered based on the K-means algorithm.

[0112] The third detection unit 3 is used to extract the flow features of the data stream sequence if the data stream sequence is clustered, and to determine whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence; if the data stream sequence is not clustered, the data stream sequence is intercepted.

[0113] The fourth detection unit 4 is used to perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model if the data stream sequence is a normal data stream sequence, so as to determine whether each data stream in the data stream sequence is safe. If the data stream sequence is an abnormal data stream sequence, the data stream sequence is intercepted. If the data stream is not safe, the data stream sequence is intercepted. If the data stream is safe, the data stream is transmitted.

[0114] The embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited thereto. Various changes can be made within the scope of knowledge possessed by those skilled in the art without departing from the spirit of the present invention.

Claims

1. A network security detection method based on artificial intelligence, characterized in that, include: According to a preset sampling period, network traffic data of the target network is acquired, and the data packet sequence and data stream sequence of the network traffic are acquired; Based on a preset data stream anomaly table, it is determined whether each data stream in the data stream sequence is abnormal. If the data stream is abnormal, it is intercepted; otherwise, it is determined whether the data stream sequence is clustered based on the K-means algorithm. If the data stream sequence is clustered, then the flow features of the data stream sequence are extracted, and it is determined whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence. If the data stream sequence is not clustered, then the data stream sequence is intercepted. If the data stream sequence is a normal data stream sequence, then anomaly detection is performed on the data packet sequence corresponding to the data stream sequence based on the pre-trained anomaly detection model to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, then the data stream sequence is intercepted. If the data stream is insecure, the data stream sequence is intercepted; if the data stream is secure, the data stream is transmitted. The flow characteristics of the data stream sequence include the number of data packets in the data stream, the flow rate of the data stream, and the duration of the data stream; The process of detecting anomalies in the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model includes: Constructing a directed communication graph based on data packet sequences; The directed communication graph is input into a pre-trained anomaly detection model, and the security of each data stream in the data stream sequence is determined based on the pre-trained anomaly detection model. The directed communication graph includes a set of nodes, a set of edges, and a set of node features. The nodes correspond to the source addresses of the data packets, the edges correspond to the communication relationships between two source addresses, and the node features correspond to the size of the data packets, the total length of the data in the data packets, and the number of bytes in the header of the data packets.

2. The artificial intelligence-based network security detection method according to claim 1, characterized in that, Determining whether each data stream in the data stream sequence has an anomaly based on a preset data stream anomaly table includes: Obtain the source address and destination address of each data packet in each data stream of the data stream sequence; The source address and destination address of each data packet in each data stream of the data stream sequence are matched with the data stream anomaly table to determine whether the source address and destination address are in the data stream anomaly table; If the source address and destination address are in the data flow anomaly table, it indicates that the data packet corresponding to the source address and destination address is abnormal, that is, it indicates that the data flow corresponding to the data packet is abnormal.

3. The artificial intelligence-based network security detection method according to claim 2, characterized in that, Determining whether the data stream sequence is clustered based on the K-means algorithm includes: An objective function is constructed based on the data stream sequence. This objective function minimizes the sum of squared distances from points within a cluster to the cluster center. The objective function is as follows: ； in, This represents the sum of squared distances from points within the cluster to the cluster center. This represents a data point in a data stream sequence. Represents the data points of the data stream in the data stream sequence. Does it belong to a cluster? , Cluster The center Represents the data points of the data stream in the data stream sequence. to cluster The square of the distance from the center; Based on the objective function, the data streams in the data stream sequence are allocated to different clusters; The silhouette coefficient of the cluster is calculated and compared with a preset silhouette coefficient threshold. If the silhouette coefficient of the cluster is greater than the preset silhouette coefficient threshold, it indicates that the data stream sequence is clustered; otherwise, it indicates that the data stream sequence is not clustered. The formula for calculating the silhouette coefficient is as follows: ； in, Represents the silhouette coefficient of the cluster. This represents the average distance from a data point in a data stream sequence to other points within its cluster. This represents the average distance from a data point in a data stream sequence to the nearest other cluster.

4. The artificial intelligence-based network security detection method according to claim 3, characterized in that, Determining whether a data stream sequence is a normal data stream sequence based on its stream characteristics includes: The flow information of each data stream in the data stream sequence is stored in a counter. The flow information of each data stream includes the start time of the data stream, the end time of the data stream, the sampling rate, and the latest sampled stream length. Based on the flow characteristics and the sampling rate, the estimated flow length and estimated flow velocity of the data flow are estimated, wherein the formula for calculating the estimated flow length is as follows: ； in, This represents the estimated length of the data stream. Indicates the sampling flow length, Indicates the sampling rate; The formula for calculating the estimated flow velocity is as follows: ； in, This represents the estimated flow rate of the data stream. Indicates the end time of the data stream. Indicates the start time of the data stream; Based on a preset normal data stream discrimination formula and the estimated length and estimated velocity of the data stream, it is determined whether the data stream sequence is a normal data stream sequence. The normal data stream discrimination formula is as follows: ； in, Represents the fitted function. The standard deviation of the data stream length. The standard deviation of the data stream rate is represented by, where, , , and This represents the fitted parameters.

5. The AI-based network security detection method according to claim 4, characterized in that, The anomaly detection model includes a node feature extraction module, a feature aggregation module, and a classification module. The node feature extraction module extracts node features from different time periods in the directed communication graph to obtain node features for different time periods. The feature aggregation module aggregates the node features from different time periods to obtain aggregated features. The classification module classifies the aggregated features to obtain a classification label for each data stream in the data stream sequence. The node feature extraction module adds the previous layer's hidden state to the hidden state of the node features at different times, resets and updates the previous layer's hidden state, calculates the current input with different weight matrices to obtain the reset state, updates the weight matrices to obtain a new hidden state, and obtains node features for different time periods through calculations using a fully connected layer. The feature aggregation module concatenates the node features from the previous layer with the node features of neighboring nodes, calculates weights, and finally uses an activation function to obtain the aggregated features of the nodes. The classification module uses the Sigmoid activation function for binary classification.

6. The artificial intelligence-based network security detection method according to claim 5, characterized in that, The expression for the reset state is as follows: ； in, This indicates the state after the reset. and This represents the activation function. , , and Representing different weight matrices, Representing node characteristics, , This indicates the hidden state of the previous layer. and Indicates the deviation parameter. Represents the Hadamard product; The expression for the new hidden state is as follows: ； in, This indicates a new hidden state. and Representing different weight matrices, Representing node characteristics, Indicates the deviation parameter; The aggregation formula for the aggregation feature is as follows: ； in, Represents a node In the Layer aggregation characteristics, Represents the weight matrix. Represents a node The set of neighboring nodes, Represents a node The aggregation characteristics of neighboring nodes, This indicates a splicing operation.

7. An artificial intelligence-based network security detection system, applicable to the artificial intelligence-based network security detection method according to any one of claims 1-6, characterized in that, include: The data acquisition unit (1) is used to acquire network traffic data of the target network according to a preset sampling period, and to acquire the data packet sequence and data stream sequence of the network traffic; The first detection unit (2) is used to determine whether there is an anomaly in each data stream in the data stream sequence based on a preset data stream anomaly table. If there is an anomaly in the data stream, the data stream is intercepted; otherwise, the data stream sequence is clustered based on the K-means algorithm. The third detection unit (3) is used to extract the flow features of the data stream sequence if the data stream sequence is clustered, and to determine whether the data stream sequence is a normal data stream sequence based on the flow features of the data stream sequence; if the data stream sequence is not clustered, the data stream sequence is intercepted. The fourth detection unit (4) is used to perform anomaly detection on the data packet sequence corresponding to the data stream sequence based on a pre-trained anomaly detection model if the data stream sequence is a normal data stream sequence, so as to determine whether each data stream in the data stream sequence is safe; if the data stream sequence is an abnormal data stream sequence, the data stream sequence is intercepted; if the data stream is not safe, the data stream sequence is intercepted; if the data stream is safe, the data stream is transmitted.

Images