Network information security monitoring system

Abstract

The invention relates to the technical field of information security, and discloses a network information security monitoring system, which comprises the following modules: a data collection module used for collecting data from network traffic, system logs and user behaviors in real time; the data processing module adopts a Z-score standardized processing technology to unify different features to the same scale so as to ensure that the mean value of the features is 0 and the standard deviation is 1, thereby improving the comparability between the features; and the threat detection module analyzes the processed data based on a machine learning algorithm and identifies possible network security threats. Through cooperative work of all the modules, comprehensive real-time data collection, accurate threat detection, practical response execution and continuous feedback optimization are realized, the network security threat handling capacity is integrally improved, and network information security monitoring work is stably and efficiently carried out for a long time. The problem that a response strategy of a traditional network information security monitoring system lacks pertinence and timeliness is solved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a network information security monitoring system. Background Art

[0002] With the rapid development of information technology and the widespread adoption of global networks, cybersecurity issues are becoming increasingly prominent and a major challenge facing organizations and businesses of all types. Cyberattacks are becoming increasingly diverse, ranging from traditional malware, viruses, and worms to more complex phishing, distributed denial of service (DDoS) attacks, and ransomware. Attackers use various means to infiltrate systems and steal data, resulting in significant financial losses and reputational damage.

[0003] Traditional systems have a low level of intelligence, and the response strategies they generate are often fixed and single, lacking the ability to flexibly adjust and optimize according to actual threat situations. In the process of executing response strategies, there is a lack of effective feedback mechanisms, making it impossible to grasp the effectiveness of strategy implementation in real time, and difficult to promptly discover problems that arise during the implementation process and make corresponding adjustments. This makes the entire response process inefficient and unable to effectively curb the spread of network security incidents at critical moments, which may eventually lead to serious network information security incidents, causing huge losses to enterprises such as the leakage of commercial secrets and business interruptions, causing serious interference to the normal operation of the organization, and even threatening the country's information security and social stability. Summary of the Invention

[0004] In view of the shortcomings of the existing technology, the present invention provides a network information security monitoring system, which solves the problem that the response strategy of the traditional network information security monitoring system lacks pertinence and timeliness.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: A network information security monitoring system includes the following modules:

[0006] Data collection module, used to collect data from network traffic, system logs and user behavior in real time;

[0007] The data processing module uses Z-score standardization technology to unify different features to the same scale to ensure that the mean of the feature is 0 and the standard deviation is 1, thereby improving the comparability between features;

[0008] Threat detection module, which analyzes processed data based on machine learning algorithms to identify possible network security threats;

[0009] Intelligent decision-making module, used to quickly generate effective response strategies based on threat detection results and output them to the response execution module;

[0010] The response execution module is used to implement the response strategy generated by the intelligent decision module to reduce potential losses;

[0011] The feedback and optimization module is used to analyze the detection and response effects of the system, continuously optimize data processing and threat detection models, and enhance the system's adaptive capabilities.

[0012] By adopting the above technical solutions, the various modules of the network information security monitoring system work together, data collection is comprehensive and real-time, data processing is scientific, threat detection is accurate, intelligent decision-making can generate targeted response strategies, response execution is effective, feedback optimization is adaptive, monitoring capabilities and efficiency are improved, network security and stability are guaranteed, and security risks are reduced.

[0013] Preferably, in the data collection module: a distributed collection node architecture is adopted, and each collection node is deployed on key network nodes, servers with different operating systems, and multiple types of terminal devices. Through a customized lightweight data collection protocol, network traffic, system logs, and user behavior data can be collected with low latency.

[0014] Preferably, the data processing module further includes:

[0015] The feature fusion submodule, after Z-score normalization, uses a deep learning feature fusion algorithm to fuse features from different dimensions based on semantic relevance and importance weights, generating a new composite feature vector. This allows subsequent threat detection modules to perform analysis based on more representative features.

[0016] The dynamic adjustment unit monitors changes in the network environment and fluctuations in the distribution of data features in real time, and automatically adjusts the parameters of standardization processing and the weights of feature fusion according to the preset adjustment strategy, so that the system can maintain good data processing in different network scenarios.

[0017] Preferably, the threat detection module includes: constructing a hybrid machine learning model, integrating an unsupervised learning clustering algorithm for preliminary clustering of abnormal behaviors, and a supervised learning deep neural network for accurate classification of clustered potential threats.

[0018] Preferably, the threat detection module also includes: establishing a threat correlation analysis engine to perform correlation analysis on multiple detected scattered threat events based on multi-dimensional information such as time, source IP, target IP, and attack methods, and to discover potential attack links and collaborative attack behaviors.

[0019] Preferably, the intelligent decision-making module specifically integrates a dual reasoning mechanism of case-based reasoning and rule-based reasoning. First, through case-based reasoning, it quickly matches the effective response strategies corresponding to historical similar threat cases. At the same time, it uses rule-based reasoning to verify and adjust the compliance and rationality of the preliminary matching strategies according to the system's built-in security policy rules and legal and regulatory requirements.

[0020] Preferably, the response execution module: constructs a multi-channel response execution mechanism, and automatically selects the execution channel corresponding to network blocking, service isolation, authority adjustment, and alarm notification for rapid implementation according to different types of response strategies. Each channel is independent of each other and has redundant backup functions.

[0021] Preferably, the feedback and optimization module includes: adopting a multi-dimensional effect evaluation index system, which, in addition to conventional threat detection accuracy and false alarm rate indicators, also incorporates multiple indicators such as response timeliness, business impact, and resource consumption, to comprehensively quantitatively evaluate the system's detection and response effects.

[0022] Preferably, the feedback and optimization module also includes: combining a reinforcement learning algorithm to perform model optimization, treating the optimization process as a Markov decision process, and automatically exploring and learning better data processing parameters and threat detection model structures based on the reward signal fed back by the evaluation indicators.

[0023] The present invention provides a network information security monitoring system. It has the following beneficial effects:

[0024] 1. Through the collaborative work of various modules, this invention achieves comprehensive and real-time data collection, data processing with unified feature scales, accurate threat detection, intelligent and effective decision-making, effective response execution, and continuous feedback optimization. This overall enhances the ability to respond to network security threats, ensures the normal operation of network systems and information security, and can adapt to complex and changing network environments, enabling long-term, stable, and efficient network information security monitoring. This solves the problem of traditional network information security monitoring systems' lack of targeted and timely response strategies.

[0025] 2. This invention generates more representative composite feature vectors by performing semantic correlation analysis, weight assignment, and fusion on features, thereby improving threat detection accuracy. A dynamic adjustment unit monitors and automatically adjusts standardized processing parameters and feature fusion weights in real time, ensuring that the system maintains optimal data processing performance in different network scenarios and ensuring stable and efficient system operation. This addresses the issues of traditional data processing methods, such as insufficient utilization of feature correlation, difficulty in fully grasping security information, and inability to adapt to dynamic changes in the network environment.

[0026] 3. This invention utilizes a hybrid machine learning model in its threat detection module that integrates unsupervised clustering and supervised deep neural networks. This model can both detect unknown anomalies and accurately classify known threats, improving detection efficiency and accuracy. The threat correlation analysis engine uses multi-dimensional information correlation analysis to uncover attack links and coordinated attack behaviors, helping security personnel gain a comprehensive understanding of the attack landscape and formulate effective defense strategies, enhancing their ability to respond to complex attacks. This approach addresses the limitations of single machine learning algorithms in threat detection and the difficulty traditional detection systems face in identifying complex attack scenarios.

[0027] 4. This invention utilizes a multi-dimensional performance evaluation index system within the feedback and optimization module to comprehensively and quantitatively assess system detection and response performance, accurately identifying strengths and weaknesses and providing a basis for optimization. A reinforcement learning optimization mechanism models the optimization process, automatically exploring and learning optimal parameter configurations based on reward signals, enabling automated, adaptive optimization and effectively improving system performance. This addresses the issue of traditional evaluation systems being limited in scope and incapable of coping with complex, dynamic network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 This is a module architecture diagram of a network information security monitoring system proposed by the present invention. DETAILED DESCRIPTION

[0029] The following will clearly and completely describe the technical solution of the present invention in conjunction with the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0030] Please see the attached Figure 1 , an embodiment of the present invention provides a network information security monitoring system, including the following modules:

[0031] Data collection module, used to collect data from network traffic, system logs and user behavior in real time;

[0032] The data processing module uses Z-score standardization technology to unify different features to the same scale to ensure that the mean of the feature is 0 and the standard deviation is 1, thereby improving the comparability between features;

[0033] Threat detection module, which analyzes processed data based on machine learning algorithms to identify possible network security threats;

[0034] Intelligent decision-making module, used to quickly generate effective response strategies based on threat detection results and output them to the response execution module;

[0035] The response execution module is used to implement the response strategy generated by the intelligent decision module to reduce potential losses;

[0036] The feedback and optimization module is used to analyze the detection and response effects of the system, continuously optimize data processing and threat detection models, and enhance the system's adaptive capabilities.

[0037] Specifically, the data collection module is deployed at key nodes in the network environment and acquires relevant data through network interface monitoring, system log reading interfaces, and specific user behavior monitoring tools. For network traffic, network packet capture technology is used to capture data packets flowing through each monitoring point in real time according to preset network protocol rules without affecting normal network transmission. Key information such as source IP address, destination IP address, port number, protocol type, and packet content is extracted from these packets. For system logs, various log records including system startup, service operation status, user login and logout are regularly read based on the logging specifications and interfaces provided by different operating systems (such as Windows and Linux). For user behavior, a lightweight monitoring program installed on the terminal device is used to collect user operation behavior information, such as mouse clicks, keyboard input, and application opening and closing operation records. This data collected from various channels is aggregated into a temporary data cache pool and preliminarily sorted according to rules such as timestamps, awaiting further processing by subsequent modules.

[0038] After receiving the data from the data collection module, the data is first parsed and features are extracted to convert the raw data into a quantifiable and analyzable feature vector form. Then, the Z-score standardization processing technology is used to calculate the mean and standard deviation of each feature dimension. The specific calculation formula is: for a certain feature value x, the standardized z value is calculated by z = (x-μ) / σ (where μ is the mean of the feature and σ is the standard deviation of the feature). Through such calculations, the numerical ranges of all different features are unified to the same scale with a mean of 0 and a standard deviation of 1. During the processing, every data record of the entire data set will be traversed, and the above-mentioned standardization operation will be performed on each feature in turn to ensure that all features are under the same comparable standard scale in subsequent analysis and comparison, so as to facilitate more effective feature analysis based on machine learning algorithms.

[0039] Machine learning algorithms are used to analyze the feature data, which has been standardized by the data processing module. The specific machine learning algorithms used can be supervised learning algorithms (such as support vector machines and random forests), unsupervised learning algorithms (such as clustering algorithms and isolation forests), or a combination of the two. Supervised learning algorithms require pre-training with labeled cybersecurity threat data samples to allow the model to learn the characteristic patterns corresponding to different threat types. The real-time processed feature data is then fed into the trained model, which outputs the corresponding threat category based on the learned patterns. Unsupervised learning algorithms, on the other hand, primarily use data clustering and anomaly detection to identify anomalous data points or clusters within a dataset that deviate significantly from normal patterns. These anomalies often indicate potential cybersecurity threats. For example, clustering algorithms divide data into clusters based on feature similarity, while isolation forest algorithms construct random tree structures to determine the degree of isolation of data points. Data points with high levels of isolation may represent characteristic data corresponding to anomalous behavior, thus indicating a potential security threat.

[0040] Once the threat detection module receives detection results regarding potential network security threats, a response strategy is generated based on a pre-defined policy rule library and threat severity assessment mechanism. The policy rule library contains corresponding response strategy templates for different threat types and severities. For example, for low-level, suspected threats, a strategy of observation and recording detailed information might be implemented initially. For medium-level threats, measures such as partial network access restrictions and temporary service shutdowns might be initiated. For high-level threats, measures such as direct network severance and comprehensive system isolation might be implemented. Furthermore, these policy templates are refined and adjusted based on the specific characteristics of the threat, such as its source and scope of impact, to ensure that the generated response strategy is appropriate and operational. The generated response strategy is organized into a standardized instruction format and then passed to the response execution module.

[0041] After receiving the response policy instructions passed by the intelligent decision-making module, the corresponding operations will be performed according to the specific requirements of the instructions. If the instruction is to limit the network access rights of a certain IP address, then the control interface of the relevant network equipment such as the network firewall will be called to add the corresponding rules to its access control list to implement access restrictions on the IP; if a service is required to be shut down, a stop service command will be sent to the corresponding server operating system, and the shutdown operation will be executed through the system's built-in service management mechanism. When executing each policy operation, key information such as the start time of the operation, execution progress, and success will be recorded, and these execution status will be fed back to the feedback and optimization module in real time to facilitate subsequent evaluation and optimization of the entire execution process.

[0042] Continuously collect the execution status information fed back from the response execution module and the detection result data of the threat detection module, and at the same time, combine it with the pre-set evaluation index system to quantitatively evaluate the detection and response effects of the system. Evaluation indicators may include the accuracy rate, false alarm rate, missed alarm rate of threat detection, the success rate of response strategy execution, execution time, and the impact on the business. Based on the analysis results of these evaluation indicators, for the data processing module, it will check whether the effect of feature standardization meets expectations. If necessary, adjust the relevant parameters of the Z-score standardization processing or optimize the feature extraction method; for the threat detection module, based on indicators such as detection accuracy, determine whether the currently used machine learning algorithm needs to be adjusted, such as replacing the algorithm, adjusting the algorithm's hyperparameters, etc. Through continuous adjustment and optimization, the system can better adapt to the ever-changing network environment and the increasingly complex network security threats.

[0043] Through the collaborative work of various modules, comprehensive and real-time data collection, data processing with unified feature scales, accurate threat detection, intelligent and effective decision-making, effective response execution, and continuous feedback optimization are achieved. This overall enhances the ability to respond to network security threats, ensures the normal operation of network systems and information security, and can adapt to complex and changing network environments, enabling long-term, stable, and efficient network information security monitoring. This solves the problem of traditional network information security monitoring systems' response strategies lacking pertinence and timeliness.

[0044] In the data collection module: a distributed collection node architecture is adopted, and each collection node is deployed on key network nodes, servers with different operating systems, and multiple types of terminal devices. Through a customized lightweight data collection protocol, it can collect network traffic, system logs, and user behavior data with low latency.

[0045] Specifically, the layout of distributed collection nodes is carefully planned based on the network topology and the distribution of business applications. Numerous collection nodes are deployed at key network nodes, such as core switches and routers. These nodes are important hubs for network data traffic aggregation and forwarding, and can capture a large amount of basic traffic information flowing through the entire network. Nodes are also deployed for servers with different operating systems, such as Windows Server and Linux servers. Because different operating systems have different log recording formats and system operation mechanisms, deploying collection nodes on corresponding servers can directly obtain native and accurate system log data, ensuring that key log content such as system startup, service operation status changes, and software installation and uninstallation are fully captured. Furthermore, collection nodes are set up on multiple types of terminal devices, including desktop computers and mobile terminals (such as smartphones and tablets). These terminal devices are the carriers of direct user operations. By deploying nodes on them, various user behavior operation data can be accurately collected, such as the specific details of users' clicks, inputs, and browsing in different applications.

[0046] During data collection, a custom lightweight data collection protocol is utilized. This protocol is optimized based on existing network communication protocols. While ensuring compatibility, it focuses on reducing protocol overhead and complexity, minimizing network bandwidth usage and achieving low-latency data collection. For network traffic collection, the protocol clearly defines the scope of collected packets, sampling frequency, and parsing rules. For example, packets are filtered and collected based on specific port ranges or protocol types, ensuring efficient data acquisition without missing critical traffic information. For system log collection, the protocol adapts to the log output formats of different operating systems, reading and transmitting them using a unified format specification, enabling the orderly integration and collection of log data from various sources. For user behavior data collection, the protocol defines how to obtain behavioral data from the relevant interfaces at the application and operating system levels of terminal devices, and specifies data encapsulation and transmission methods to ensure accurate and timely collection of user behavior data at each node. Each collection node continuously collects corresponding data from its location according to this protocol, and transmits the collected data in real time to a unified data aggregation center through a reliable network connection (such as a stable link established based on the TCP / IP protocol) for further processing.

[0047] By adopting a distributed collection node architecture and a custom lightweight data collection protocol, comprehensive data coverage is achieved at all network levels, enabling the acquisition of network traffic, system logs, and user behavior data. This ensures low latency in data collection, providing near-real-time insights into the network's actual state and providing a rich and timely data foundation for subsequent security analysis and decision-making. This addresses the issues of incomplete data collection and high latency associated with traditional data collection methods.

[0048] The data processing module also includes:

[0049] The feature fusion submodule, after Z-score normalization, uses a deep learning feature fusion algorithm to fuse features from different dimensions based on semantic relevance and importance weights, generating a new composite feature vector. This allows subsequent threat detection modules to perform analysis based on more representative features.

[0050] The dynamic adjustment unit monitors changes in the network environment and fluctuations in the distribution of data features in real time, and automatically adjusts the parameters of standardization processing and the weights of feature fusion according to the preset adjustment strategy, so that the system can maintain good data processing in different network scenarios.

[0051] Specifically, after Z-score normalization, the feature fusion submodule is activated. First, it performs semantic analysis on features from different dimensions to identify potential logical connections between them. For example, it constructs a feature correlation matrix and calculates metrics such as mutual information or cosine similarity between features to determine the degree of semantic correlation between features. Next, it assigns a weight to each feature based on this correlation and a pre-set importance assessment algorithm. This algorithm comprehensively considers factors such as the feature's performance in historical security incidents and its indicative power for specific threat types. Finally, it uses deep learning feature fusion algorithms, such as attention-based fusion networks, to fuse these weighted features. During the fusion process, the algorithm prioritizes highly weighted features that are highly relevant to the current security analysis, while suppressing interference from noisy features. Ultimately, it generates a new composite feature vector. This composite feature vector integrates key information from multiple original features, more comprehensively and accurately reflecting the inherent characteristics of the data.

[0052] The dynamic adjustment unit determines whether the current network scenario has changed significantly by monitoring the changing parameters of the network environment in real time, such as fluctuations in network traffic, the increase and decrease trends in the number of connections, changes in the access frequency of specific applications, and the statistical characteristics of the data feature distribution, such as the fluctuations in the mean, variance, distribution curve and other indicators of the features. When the changes in these indicators are monitored to exceed the preset threshold, it indicates that the network environment or the data feature distribution may have changed substantially. At this time, the dynamic adjustment unit will automatically adjust the parameters of the Z-score normalization processing (such as the calculation window size of the mean and standard deviation, the update frequency, etc.) and the weight of the feature fusion according to the preset adjustment strategy. For example, if it is found that a certain type of feature is more indicative of security threats in the new network scenario, the weight of the feature in the fusion process will be increased; if the distribution of data features has shifted, the normalization parameters will be recalculated to ensure that subsequent data processing can still unify the features to an appropriate scale.

[0053] By analyzing semantic associations, assigning weights, and fusing features, a more representative composite feature vector is generated, improving threat detection accuracy. A dynamic adjustment unit monitors and automatically adjusts standardized processing parameters and feature fusion weights in real time, ensuring the system maintains optimal data processing performance in various network scenarios and ensuring stable and efficient operation. This addresses the issues inherent in traditional data processing methods, such as insufficient utilization of feature associations, difficulty in fully grasping security information, and inability to adapt to dynamic changes in the network environment.

[0054] The threat detection module includes: building a hybrid machine learning model, integrating an unsupervised learning clustering algorithm for preliminary clustering of abnormal behaviors, and a supervised learning deep neural network for accurate classification of clustered potential threats.

[0055] The threat detection module also includes: establishing a threat correlation analysis engine to conduct correlation analysis on multiple detected scattered threat events based on multi-dimensional information such as time, source IP, target IP, and attack methods, and to uncover potential attack links and coordinated attack behaviors.

[0056] Specifically, the hybrid machine learning model analyzes the processed data in stages. First, an unsupervised clustering algorithm (such as K-means and DBSCAN) automatically divides the data into multiple clusters based on the similarity of data features. The algorithm calculates distance metrics (such as Euclidean distance and cosine similarity) between data points and forms different sets of clusters based on preset clustering parameters (such as the number of clusters and density threshold). Within these clusters, clusters that deviate from normal patterns are labeled as potentially abnormal. Subsequently, a supervised deep neural network (such as a multi-layer perceptron and convolutional neural network) receives these preliminary clustering results and accurately classifies them. Using the normal and abnormal pattern features learned during the training phase, the deep neural network further analyzes each cluster and outputs a specific threat type (such as malware attack, SQL injection, DDoS attack, etc.) and its confidence score. Throughout the process, the model continuously optimizes parameters to improve detection accuracy and reduce false positives.

[0057] After receiving multiple, dispersed threat events, the threat correlation analysis engine first constructs a multidimensional correlation index table, storing structured information such as the timestamp, source IP address, target IP address, and attack method for each threat event. Then, based on pre-set correlation rules and graph database technology, the engine analyzes the correlations between these events. For example, time series analysis can identify similar attacks from the same source IP address against multiple target IP addresses within a short period of time; IP address clustering can identify IP addresses belonging to the same attack group; and attack method similarity calculations can correlate events using the same vulnerability exploitation method. The engine then constructs an attack graph model, connecting isolated threat events into possible attack chains and assessing the credibility of each chain using probabilistic reasoning algorithms.

[0058] In the threat detection module, a hybrid machine learning model combines unsupervised clustering with supervised deep neural networks to detect unknown anomalies and accurately classify known threats, improving detection efficiency and accuracy. The threat correlation analysis engine uses multi-dimensional information correlation analysis to uncover attack links and coordinated attack behaviors, helping security personnel understand the full attack landscape and develop effective defense strategies, enhancing their ability to respond to complex attacks. This addresses the limitations of single machine learning algorithms in threat detection and the difficulty of traditional detection systems in identifying complex attack scenarios.

[0059] Specifically, the intelligent decision-making module integrates a dual reasoning mechanism of case-based reasoning and rule-based reasoning. First, through case-based reasoning, it quickly matches the effective response strategies corresponding to similar historical threat cases. At the same time, it uses rule-based reasoning to verify and adjust the compliance and rationality of the preliminary matching strategies according to the system's built-in security policy rules and legal and regulatory requirements.

[0060] Specifically, upon receiving threat data from the threat detection module, the intelligent decision-making module immediately activates the case-based reasoning (CBR) system. It searches a historical case library, which contains a large number of previously processed cybersecurity threat cases. Each case includes threat characteristics, attack scenarios, and corresponding successful response strategies. The system calculates the similarity between the current threat characteristics and historical cases (using algorithms such as cosine similarity and Euclidean distance) to quickly identify the most similar historical cases and their corresponding response strategies. Simultaneously, the rule-based reasoning (RBR) system reviews the CBR-recommended policies based on the system's built-in security policy rule library and legal and regulatory requirements. The rule library contains a series of rules, such as those for cybersecurity multi-level protection requirements, data privacy regulations, and corporate security policies. The RBR system performs logical verification on each operational step of the policy to check for compliance with the rules, such as whether excessive protection has caused business interruption or whether cross-border data transmission regulations have been violated.

[0061] If the CBR-recommended strategy passes RBR verification, it proceeds directly to the strategy execution phase. If any non-compliance occurs, the RBR system will suggest modifications, such as adjusting the protection scope or adding compliance procedures. The system generates multiple candidate strategies and uses multi-objective optimization algorithms (such as the Pareto optimal algorithm) to evaluate their comprehensive performance in terms of effectiveness, compliance, resource consumption, and other dimensions, ultimately selecting the optimal strategy as output.

[0062] The intelligent decision-making module integrates a dual reasoning mechanism based on case-based reasoning and rule-based reasoning. Using case-based reasoning, it quickly matches strategies to historically similar cases, while relying on rule-based reasoning to verify and adjust strategies. This enables rapid response and accurate decision-making. With its adaptive optimization capabilities, it can quickly generate response strategies that meet both security needs and regulatory requirements. This addresses the lack of flexibility inherent in either rule-based or case-based decision-making systems.

[0063] Response execution module: A multi-channel response execution mechanism has been built. According to different types of response strategies, it automatically selects the execution channel corresponding to network blocking, service isolation, permission adjustment, and alarm notification for rapid implementation. Each channel is independent of each other and has redundant backup functions.

[0064] Specifically, policy parsing and channel mapping: After the response execution module receives the response policy generated by the intelligent decision-making module, it first performs semantic parsing on the policy to extract key execution elements, such as operation type (blocking, isolation, adjustment, etc.), target object (IP address, service process, user account, etc.), execution parameters (blocking duration, permission level, etc.). Then, based on the preset mapping rules, these elements are matched with predefined execution channels. For example, for the access control policy at the network layer, the system will automatically map it to the network blocking channel; for the protection requirements at the service level, it will be mapped to the service isolation channel.

[0065] Multi-channel parallel execution: The system configures independent execution engines for each execution channel. These engines interact with underlying infrastructure (such as firewalls, load balancers, and operating systems) through standardized interfaces. When policies require coordinated execution across multiple channels, each channel initiates execution in parallel, for example, to implement service isolation while triggering alerts. Each channel utilizes a state machine mechanism for refined execution management, recording the status of each stage from initiation to completion.

[0066] Redundant backup and failover: To ensure high availability, each execution channel is configured with at least one backup channel. The system monitors the operational status of each channel in real time, assessing channel health through heartbeat monitoring and performance metric collection. If the primary channel experiences a failure (such as an interface timeout or connection loss), the backup channel takes over execution within milliseconds, ensuring a continuous response strategy. The failed channel is marked as abnormal and triggers maintenance. Once repaired, it is automatically added to the backup queue.

[0067] The multi-channel response execution mechanism built by the response execution module, policy analysis and channel mapping, multi-channel parallel execution, redundant backup and fault switching and other working principles achieve rapid response and accurate execution, shorten response time, and have high availability and reliability, greatly improving the overall performance of the system. It solves the single channel performance bottleneck and single point failure problem existing in traditional response execution systems.

[0068] The feedback and optimization module includes: using a multi-dimensional effect evaluation indicator system. In addition to the conventional threat detection accuracy and false alarm rate indicators, it also incorporates multiple indicators such as response timeliness, business impact, and resource consumption to comprehensively quantify the system's detection and response effects.

[0069] The feedback and optimization module also includes: combining reinforcement learning algorithms for model optimization, treating the optimization process as a Markov decision process, and automatically exploring and learning better data processing parameters and threat detection model structures based on the reward signals fed back by the evaluation indicators.

[0070] Specifically, the multi-dimensional effectiveness evaluation indicator system collects system operation data at the data collection layer, including raw output from the threat detection module, operation records from the response execution module, performance indicators of business systems, and infrastructure resource consumption data. Then, at the indicator calculation layer, specific algorithms are used to quantify indicators across different dimensions. For threat detection accuracy, the percentage of correctly classified samples is calculated by comparing detection results with manually annotated real threat labels. The false alarm rate measures the proportion of non-threat events misclassified as threats. Response timeliness is assessed by analyzing the time interval from threat discovery to the implementation of response measures, using a time series analysis algorithm to calculate the average response time and response time distribution. The degree of business impact is quantified using business system availability metrics (such as service downtime and throughput reduction) and a business loss model. Resource consumption monitors resource utilization rates for CPU, memory, network bandwidth, and other resources during system operation, using a resource usage pattern analysis algorithm to identify abnormal consumption. Finally, at the comprehensive evaluation layer, indicators from each dimension are weighted and aggregated according to preset weights to form a comprehensive evaluation score that comprehensively reflects system performance.

[0071] The reinforcement learning optimization mechanism models the system optimization process as a Markov decision process (MDP). The state space consists of the current system configuration parameters (such as feature fusion weights and detection model hyperparameters), performance metrics, and network environment characteristics. The action space is defined as executable parameter adjustment operations, such as increasing or decreasing the weight of a feature or adjusting the number of neural network layers. The reward function is constructed based on the output of a multi-dimensional evaluation metric system. For example, improved detection accuracy results in positive rewards, while increased business impact or excessive resource consumption results in negative rewards. A reinforcement learning agent (such as a deep Q-network or policy gradient algorithm) interacts with the environment, continuously trying different actions and adjusting its policy based on reward signals, gradually learning the optimal parameter configuration that maximizes long-term cumulative rewards. In each decision cycle, the agent selects an action based on the current state. The system executes the action and enters a new state, providing feedback on the reward value. The agent uses this experience to update its policy, forming a closed-loop optimization loop.

[0072] The multi-dimensional performance evaluation index system within the feedback and optimization module comprehensively and quantitatively assesses the system's detection and response effectiveness, accurately identifying strengths and weaknesses and providing a basis for optimization. The reinforcement learning optimization mechanism models the optimization process, automatically exploring and learning optimal parameter configurations based on reward signals, enabling automated and adaptive optimization and effectively improving system performance. This addresses the problem of traditional evaluation systems, which suffer from a single dimension and struggle to cope with complex and dynamic network environments.

[0073] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A network information security monitoring system, characterized in that: Includes the following modules: Data collection module, used to collect data from network traffic, system logs and user behavior in real time; The data processing module uses Z-score standardization technology to unify different features to the same scale to ensure that the mean of the feature is 0 and the standard deviation is 1, thereby improving the comparability between features; Threat detection module, which analyzes processed data based on machine learning algorithms to identify possible network security threats; Intelligent decision-making module, used to quickly generate effective response strategies based on threat detection results and output them to the response execution module; The response execution module is used to implement the response strategy generated by the intelligent decision module to reduce potential losses; The feedback and optimization module is used to analyze the detection and response effects of the system, continuously optimize data processing and threat detection models, and enhance the system's adaptive capabilities.

2. A network information security monitoring system according to claim 1, characterized in that: In the data collection module: a distributed collection node architecture is adopted, and each collection node is deployed on key network nodes, servers with different operating systems, and multiple types of terminal devices. Through a customized lightweight data collection protocol, network traffic, system logs, and user behavior data can be collected with low latency.

3. A network information security monitoring system according to claim 1, characterized in that: The data processing module also includes: The feature fusion submodule, after Z-score normalization, has the following formula: where x new is the standardized data, x is the original data, μ is the mean of the original data, and σ is the standard deviation of the original data. Using the feature fusion algorithm in deep learning, features of different dimensions are fused according to semantic association and importance weight to generate a new composite feature vector, enabling subsequent threat detection modules to perform analysis based on more representative features. The dynamic adjustment unit monitors changes in the network environment and fluctuations in the distribution of data features in real time, and automatically adjusts the parameters of standardization processing and the weights of feature fusion according to the preset adjustment strategy, so that the system can maintain good data processing in different network scenarios.

4. A network information security monitoring system according to claim 1, characterized in that: The threat detection module includes: building a hybrid machine learning model, integrating the unsupervised learning clustering algorithm for the preliminary clustering division of abnormal behavior, and its cluster allocation formula is: i =argmin k ||x i -μ k || 2 , where k is the number of clusters, x i is the processed feature vector data, μ k is the centroid of the k-th cluster, and a supervised learning deep neural network is used to accurately classify the clustered potential threats.

5. A network information security monitoring system according to claim 1, characterized in that: The threat detection module further includes: establishing a threat correlation analysis engine, whose support formula is: Where X and Y are different attribute sets of threat events. In order to reflect the prevalence of association rules, we conduct association analysis on multiple scattered threat events detected based on multi-dimensional information such as time, source IP, target IP, and attack methods to uncover potential attack links and coordinated attack behaviors.

6. A network information security monitoring system according to claim 1, characterized in that: Specifically, the intelligent decision-making module integrates a dual reasoning mechanism of case-based reasoning and rule-based reasoning. First, through case-based reasoning, it quickly matches effective response strategies corresponding to historical similar threat cases. At the same time, it uses rule-based reasoning to verify and adjust the compliance and rationality of the initially matched strategies according to the system's built-in security policy rules and legal and regulatory requirements.

7. A network information security monitoring system according to claim 1, characterized in that: The response execution module: constructs a multi-channel response execution mechanism, and its channel selection formula is: M(S i )=P j ; where S i For specific response strategies, P j For execution channels, according to different types of response strategies, the corresponding execution channels are automatically selected for rapid implementation through network blocking, service isolation, permission adjustment, and alarm notification. Each channel is independent of each other and has redundant backup functions.

8. A network information security monitoring system according to claim 1, characterized in that: The feedback and optimization module includes: using a multi-dimensional effect evaluation indicator system, in addition to the conventional threat detection accuracy and false alarm rate indicators, it also incorporates multiple indicators such as response timeliness, business impact, and resource consumption, to comprehensively quantify the system's detection and response effects.

9. A network information security monitoring system according to claim 1, characterized in that: The feedback and optimization module also includes: combining reinforcement learning algorithms to optimize the model, treating the optimization process as a Markov decision process, and automatically exploring and learning better data processing parameters and threat detection model structures based on the reward signal fed back by the evaluation indicators.

Images