Network security risk prediction method based on artificial intelligence and big data
By introducing the spatial attention mechanism of CNN and the temporal attention mechanism of BiLSTM in network security risk prediction, combined with the hierarchical analysis method, the problem of dependence and overfitting of training data in the existing technology is solved, and more efficient and accurate risk prediction and evaluation is achieved.
Patent Information
- Application Number
- CN202510823789.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-06-19
- Publication Date
- 2025-08-12
AI Technical Summary
The prior art relies on high-quality training data in network security risk prediction, and has limited generalization ability when processing time series data and new traffic data, high computational complexity, easy to overfit, and prediction accuracy needs to be improved.
The spatial attention mechanism (SAM) is introduced based on convolutional neural network (CNN) for feature extraction, and the network data prediction is combined with the bidirectional long and short-term memory network (BiLSTM) and the temporal attention mechanism (TAM) for risk assessment, and combined with the hierarchical analysis method.
It improves the accuracy and efficiency of feature extraction of network security risk prediction, enhances the adaptability and prediction accuracy for unseen traffic data, reduces false positive rates, and can dynamically adjust resource allocation to ensure network stability.
Smart Images
Figure CN120474816A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of network security technology, and in particular to a network security risk prediction method based on artificial intelligence and big data. Background Art
[0002] Current technical solutions primarily utilize advanced machine learning and deep learning algorithms, such as support vector machines (SVMs), convolutional neural networks (CNNs), recurrent neural networks (RNNs), and long short-term memory networks (LSTMs). For example, in network security risk prediction, support vector machines (SVMs) can classify new network traffic based on the boundaries between normal and abnormal data in training traffic data. Data mining, machine learning, and natural language processing (NLP) are used to extract and analyze historical network data, user behavior, events, and environmental variables for comprehensive analysis. Convolutional neural networks (CNNs) use convolutional layers to extract spatial features from traffic data, pooling layers to reduce data dimensionality, and fully connected layers to classify abnormal traffic. In network security, CNNs are capable of processing large amounts of data and identifying complex patterns, offering significant advantages for detecting abnormal behavior and predicting potential threats. Recurrent neural networks (RNNs) process sequential data and capture the time series characteristics of abnormal traffic. Long short-term memory networks (LSTMs) process time series data and better capture long-term dependencies, enabling the detection of abnormal traffic. The attention mechanism, originally derived from research on human vision and cognitive systems, aims to mimic the human ability to selectively focus on important aspects of information. In the field of machine learning, especially deep learning, attention mechanisms have been introduced to help models better focus on key parts of input data, thereby improving model performance. Originally derived from research on human vision and cognitive systems, the attention mechanism aims to mimic the human ability to selectively focus on important parts when processing information. In the field of machine learning, especially deep learning, attention mechanisms have been introduced to help models better focus on key parts of input data, thereby improving model performance. Multimodal data fusion takes into account external factors such as weather, holidays, and major events, integrating data from different sources to achieve multi-data fusion to predict future network traffic trends and patterns and form richer feature representations.
[0003] Traditional machine learning methods rely on high-quality network data, have limited ability to detect network data features, and are slightly inadequate in processing time series data, and their prediction accuracy needs to be improved.
[0004] When it comes to cybersecurity risk prediction, the performance of machine learning algorithms depends heavily on the quality and quantity of training data. Without sufficient and representative training data, the algorithm may not achieve good performance. Furthermore, machine learning algorithms often have limited generalization capabilities when processing new, unseen traffic data. If the training data differs significantly from the actual application scenario, the model may not be able to accurately predict and classify, requiring further optimization and iteration. Furthermore, as data size and model complexity increase, the computational complexity of machine learning algorithms also increases. A machine learning model may be overly complex, resulting in excellent performance on training data but poor performance on test data, a phenomenon known as overfitting. Therefore, it is crucial to design a cybersecurity risk prediction method based on artificial intelligence and big data. Summary of the Invention
[0005] In order to overcome the shortcomings of the existing technology, the purpose of the present invention is to provide a network security risk prediction method based on artificial intelligence and big data.
[0006] To achieve the above object, the present invention provides the following solutions: The present invention also provides a network security risk prediction method based on artificial intelligence and big data, comprising: Step 1: Collect cybersecurity risk data and perform data cleaning; Step 2: Extract features from the cleaned cybersecurity risk data; Step 3: Predict network data based on the extracted features; Step 4: Conduct security risk assessment based on the prediction results.
[0007] Preferably, in step 1, network security risk data is collected and data cleaning is performed, specifically: Obtain the historical risk information set of the detected object from the server, classify the historical risk information set, clean, denoise, fill missing values and standardize the data, determine the numerical information of network security risks, and finally obtain network security risk data.
[0008] Preferably, in step 2, feature extraction is performed on the cleaned network security risk data, specifically: Build a CNN-based convolutional neural network model that introduces an attention module; Train the convolutional neural network model based on a preset data set; The cleaned cybersecurity risk data is input into the trained convolutional neural network model for feature extraction.
[0009] Preferably, a CNN-based convolutional neural network model introducing an attention module is constructed, specifically: The CNN-based convolutional neural network model that introduces the attention module includes an 8-layer structure, which is convolutional layer, spatial attention layer, maximum pooling layer, convolutional layer, spatial attention layer, average pooling layer, average pooling layer and fully connected layer.
[0010] Preferably, in step 3, network data prediction is performed based on the extracted features, specifically: Build a network security prediction model based on the improved BiLSTM structure; Train network security prediction models based on preset data sets; The extracted features are input into the trained network security prediction model to obtain the prediction results.
[0011] Preferably, the improved BiLSTM structure is composed of a stack of BiLSTM layers, one forward layer with the input value being the input sequence from beginning to end, one reverse layer with the output value being the sequence from end to beginning, and a temporal attention module is inserted after the BiLSTM output layer.
[0012] Preferably, in step 4, a security risk assessment is performed based on the prediction results, specifically: Based on the prediction results and the hierarchical analysis method, a security risk assessment is conducted and the network security status is divided into four levels: safe, low risk, medium risk and high risk.
[0013] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects: This invention provides a network security risk prediction method based on artificial intelligence and big data. The method includes collecting network security risk data and performing data cleaning on it, extracting features from the cleaned network security risk data, predicting network data based on the extracted features, and performing security risk assessment based on the prediction results. This invention introduces a spatial attention mechanism (SAM) into a convolutional neural network (CNN), enabling the model to automatically focus on key features in network traffic data, improving the accuracy and efficiency of feature extraction. The invention also utilizes a temporal attention mechanism (TAM) using BiLSTM for network data prediction, further improving data accuracy. BRIEF DESCRIPTION OF THE DRAWINGS
[0014] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0015] Figure 1A schematic diagram of the process flow of a network security risk prediction method based on artificial intelligence and big data provided by an embodiment of the present invention; Figure 2 Schematic diagram of the convolutional neural network model structure; Figure 3 A schematic diagram of the structure of a network security risk prediction system based on artificial intelligence and big data provided in an embodiment of the present invention. DETAILED DESCRIPTION
[0016] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.
[0017] The purpose of this invention is to provide a network security risk prediction method based on artificial intelligence and big data, aiming to help operation and maintenance personnel understand the trends and potential risks of future network traffic in advance, and dynamically adjust and optimize resource allocation to ensure the stability and efficiency of the network.
[0018] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.
[0019] Figure 1 A flowchart of a network security risk prediction method based on artificial intelligence and big data is provided in an embodiment of the present invention. Figure 1 As shown, the present invention provides a network security risk prediction method based on artificial intelligence and big data, comprising: Step 1: Collect cybersecurity risk data and perform data cleaning; Step 2: Extract features from the cleaned cybersecurity risk data; Step 3: Predict network data based on the extracted features; Step 4: Conduct security risk assessment based on the prediction results.
[0020] In step 1, cybersecurity risk data is collected and cleaned, specifically: Read network log information from the server, collect and integrate risky network data and divide it into different time periods. By building correlations between network traffic, system logs, user behavior and other data, clean, denoise, fill missing values and standardize the data to determine the numerical information of network security risks and ultimately obtain network security risk data.
[0021] In step 2, feature extraction is performed on the cleaned network security risk data. The data types of network security risks are divided according to each time period. Based on the values of each risk data obtained, feature data in the network data is extracted and the network traffic data is converted into a two-dimensional matrix (time step × feature dimension). Specifically: Build a CNN-based convolutional neural network model that introduces an attention module; Train the convolutional neural network model based on a preset data set; The cleaned cybersecurity risk data is input into the trained convolutional neural network model for feature extraction.
[0022] Construct a CNN-based convolutional neural network model that introduces the attention module, specifically: Network traffic data often contains a large amount of noise and redundant information. The spatial attention mechanism can help the model automatically identify and focus on the most representative parts of the input data, namely the "key regions", thereby improving the accuracy and effectiveness of feature extraction. Network traffic data may exhibit complex spatiotemporal correlation characteristics. The spatial attention mechanism can capture these dependencies, making the model more accurate in understanding and predicting network traffic behavior. The CNN-based convolutional neural network model that introduces the attention module includes an 8-layer structure. The specific structure is as follows: Figure 2 As shown in the figure, the structure is convolutional layer, spatial attention layer, maximum pooling layer, convolutional layer, spatial attention layer, average pooling layer, average pooling layer and fully connected layer, which are introduced respectively: 1. Convolution layer: The network security data processed by convolution is set as , the convolution weights are set to , the convolution processed data for:
[0023] Convolution processing is mainly used to obtain security risk network data features. Various types of convolution processing can enhance the original network data features to reduce noise interference. The data features obtained after convolution processing are calculated by applying the convolution kernel to the original features of the previous layer. The network data features obtained in the current layer are:
[0024] Where: For the Tier feature input, ; For the Tier Feature output; is the weight; For the current layer feature bias; 2. Pooling layer: The input of the pooling layer belongs to the output of the convolution layer, which can constrain the number of neurons and complete the dimensionality reduction of network data; The number of input and output of the pooling layer wireless network is equivalent. If the number of input features is , then there is output features, the output of the pooling layer neurons is:
[0025] Where: For the Tier Downsampling of features; is the activation function; 3. Fully connected layer: The fully connected layer is a common connection method in traditional neural networks. The output of each neuron is:
[0026] Where: are neuron input and output respectively; are the input weight matrix and bias vector respectively; 4. Classification layer: The classification layer classifier is a softmax function, which can accurately classify network security risks. For example, the softmax function is used to evaluate the corresponding category probability of each input network data:
[0027] Where, For network data Belong to the category probability; The final result is a feature data set that has been processed by the convolutional neural network. ,in Represents different time periods. Representative Type of data characteristic value. Contains features weighted by spatial attention.
[0028] In step 3, network data prediction is performed based on the extracted features, specifically: Build a network security prediction model based on the improved BiLSTM structure; Train network security prediction models based on preset data sets; The extracted features are input into the trained network security prediction model to obtain the prediction results.
[0029] A network security prediction model is constructed based on the improved BiLSTM structure, specifically: The output data feature set obtained by the network data integration module As the input feature set in the network risk prediction module, a network security prediction model based on bidirectional LSTM is constructed to determine the internal operating status of the model. The network risk prediction module is composed of a stack of BiLSTM layers. One layer is forward, and the input value is the input sequence from the beginning to the end. The other layer is reverse, and the output value is the sequence from the end to the beginning. The predicted value of the network data will be determined by the two layers together. Represents the input value after the network data integration module, Represents the output value of the network risk module, and the first set of outputs is obtained by inputting in the forward layer in positive order , in the reverse layer, the input is reversed to get the second set of outputs , the two sets of states are concatenated to obtain the state output. The BiLSTM unit forgets the information in the cell state and memorizes new information to transmit information useful for subsequent calculations, discards useless information, and outputs the hidden layer state at each moment; Among them, the forget gate is calculated: the forget gate is used to select which insignificant data to forget or which important data to retain. The input of the forget gate is the hidden layer state at the previous moment , the current input value , the output value of the forget gate is , the calculation formula is: ; Calculate the input gate: The function of the input gate is to update important information. The input of the input gate is the hidden layer state at the previous moment. , the current input value , the output value of the input gate is , temporary cell state , and its calculation formula is: ; ; Calculate the current cell state: the input of the current cell state is the value of the input gate , the value of the forget gate , temporary cell state , and the cell state at the previous moment , the current cell state output value is , the calculation formula is: ; Calculate the output gate and the current hidden state: the input value required for this process is the hidden state of the previous moment , the current input value and the current cell state , the value of the output gate is , the current hidden layer state output value is , and its calculation formula is: ; ; Finally, the hidden layer state sequence can be obtained , the output value of the network risk prediction module is obtained by the above operation process, which is the so-called prediction value ; Insert the temporal attention module (TAM) after the BiLSTM output layer to calculate the importance weight of each time step and convert the hidden state sequence of the BiLSTM output into As input, each Attention score: ; Use Softmax to normalize the scores and get the weights:
[0030] The weighted summation is used to obtain the context vector: ; Output: context vector Used for final risk prediction.
[0031] In step 4, a security risk assessment is performed based on the prediction results, specifically: Based on the prediction results and the analytic hierarchy process, a security risk assessment is conducted, and the network security status is divided into four levels: safe, low risk, medium risk and high risk; The technical solution process not only needs to predict and protect against network security risks in the network platform, but also needs to be able to assess the risk level of external factors related to network security. To address the security risk assessment that needs to be addressed, an Analytic Hierarchy Process (FAHP) is proposed. The main steps are as follows: 1. Build a hierarchy Decompose the risk assessment problem into multiple levels. The top level is the target level, which is used to determine the risk level, determine the criteria level, and identify the main factors affecting network security risks. These factors are the output values of the network risk prediction module. ,The indicator layer further subdivides specific evaluation indicators for each factor.
[0032] 2. Form a judgment matrix The importance of each predictor factor was evaluated using the pairwise comparison method, and a The judgment matrix, is the number of indicators under this criterion. The elements of the matrix represent the relative importance of two indicators. By comparing the indicators, we can get the following judgment matrix:
[0033] 3. Calculate weight: Calculate the weight of each cybersecurity risk factor using the following formula:
[0034] 4. Determine the risk level: Set thresholds for different risk levels based on risk tolerance and industry standards, and classify the risk levels according to the thresholds. For example, risks between 0.75 and 1.00 are classified as high risk. The specific safety levels are shown in Table 1.
[0035] Table 1 Safety level table Risk Level Threshold range Security Level Evaluation Metrics 1 [0.00-0.25] Safety The network is working properly 2 [0.25-0.50] Low risk The network was slightly affected, but it can continue to work and needs further observation. 3 [0.50-0.75] Medium risk The network is affected, some parts are working normally, and adjustments need to be made 4 [0.75-1.00] High risk The network has been severely affected and is on the verge of collapse. Immediate adjustments are required. 5. Develop corresponding mitigation strategies for different levels of risk. For example, for high and severe risks, take immediate action, such as strengthening security controls, patching vulnerabilities, and increasing monitoring.
[0036] like Figure 3 As shown, the present invention also provides a network security risk prediction system based on artificial intelligence and big data, which is applied to the above method and specifically includes: 1. Network Data Integration Module: This module reads network log information from the server, collects and integrates risky network data, and divides it into different time periods. By building relationships between network traffic, system logs, user behavior, and other data, it improves the model's comprehensive analysis capabilities. Then, by introducing an attention mechanism based on CNN, the model automatically focuses on key features in network traffic data, improving the accuracy and efficiency of feature extraction. The output of the attention module is integrated with the basic features of the CNN to form a preliminary feature representation. 2. Network Risk Prediction Module: This module introduces a bidirectional long short-term memory (BidirectionalLSTM) network into the prediction model for time series data modeling. A temporal attention module (TAM) is inserted after the BiLSTM output layer to calculate the importance weight of each time step, significantly improving the prediction accuracy, robustness, and adaptability of the network security risk prediction model. 3. Network security risk level assessment module: Based on the predicted values of feature data in different time periods and combined with a simple assessment model, the network security status is divided into four levels, corresponding to different threshold ranges. Through the division of security levels, the monitoring system can more intelligently adjust and allocate computing resources.
[0037] Network traffic data can be highly unstructured. The spatial attention mechanism gives CNN the ability to process this diverse input, enabling it to automatically find the most important pieces of information without explicitly defining the importance of each input element. The spatial attention mechanism can operate across multiple scales, allowing the model to consider both local details and global structure simultaneously. This is particularly useful for understanding network traffic data with multi-level structures. The traditional BiLSTM model uses a fixed method to allocate attention when processing sequence data, while the temporal attention mechanism allows the model to dynamically adjust its focus based on the input data. This flexibility often leads to higher prediction accuracy. The bidirectional BiLSTM can simultaneously consider information before and after a time point. When combined with the temporal attention mechanism, it can more accurately locate important time points based on the context, enhancing the overall performance of the model. This combined approach mainly protects the following aspects: 1. Intrusion detection: By monitoring network traffic in real time, the system can promptly detect potential intrusion attempts and take measures to prevent attackers from taking further action.
[0038] 2. Malware detection: The model can help identify the behavioral patterns of new malware, even if they try to disguise themselves as legitimate applications.
[0039] 3. Abnormal behavior monitoring: The model can also effectively monitor and issue early warnings for internal threats or abnormal behaviors of infected devices.
[0040] 4. Reduce false alarms: Due to its powerful feature extraction and context understanding capabilities, the model is able to reduce false alarms, ensuring that only real threats trigger alerts.
[0041] 5. Enhanced adaptability: As new threats emerge, the model can update its knowledge base through continuous learning and maintain its ability to combat emerging cyber threats.
[0042] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.
[0043] The present invention uses specific examples to illustrate the principles and implementation methods of the present invention. The above examples are only intended to help understand the method and core concept of the present invention. At the same time, those skilled in the art will find that the specific implementation methods and application scopes may vary based on the concept of the present invention. In summary, the contents of this specification should not be construed as limiting the present invention.
Claims
1. A network security risk prediction method based on artificial intelligence and big data, characterized in that: include: Step 1: Collect cybersecurity risk data and perform data cleaning; Step 2: Extract features from the cleaned cybersecurity risk data; Step 3: Predict network data based on the extracted features; Step 4: Conduct security risk assessment based on the prediction results.
2. The method according to claim 1, characterized in that In step 1, cybersecurity risk data is collected and cleaned, specifically: Obtain the historical risk information set of the detected object from the server, classify the historical risk information set, clean, denoise, fill missing values and standardize the data, determine the numerical information of network security risks, and finally obtain network security risk data.
3. The method according to claim 2, characterized in that In step 2, feature extraction is performed on the cleaned network security risk data, specifically: Build a CNN-based convolutional neural network model that introduces an attention module; Train the convolutional neural network model based on a preset data set; The cleaned cybersecurity risk data is input into the trained convolutional neural network model for feature extraction.
4. The method according to claim 3, characterized in that Construct a CNN-based convolutional neural network model that introduces the attention module, specifically: The CNN-based convolutional neural network model that introduces the attention module includes an 8-layer structure, which is convolutional layer, spatial attention layer, maximum pooling layer, convolutional layer, spatial attention layer, average pooling layer, average pooling layer and fully connected layer.
5. The method according to claim 4, characterized in that In step 3, network data prediction is performed based on the extracted features, specifically: Build a network security prediction model based on the improved BiLSTM structure; Train network security prediction models based on preset data sets; The extracted features are input into the trained network security prediction model to obtain the prediction results.
6. The method according to claim 5, characterized in that The improved BiLSTM structure is composed of a stack of BiLSTM layers, one forward layer with the input value being the input sequence from beginning to end, and one reverse layer with the output value being the sequence from end to beginning. A temporal attention module is inserted after the BiLSTM output layer.
7. The method according to claim 6, characterized in that In step 4, a security risk assessment is performed based on the prediction results, specifically: Based on the prediction results and the hierarchical analysis method, a security risk assessment is conducted and the network security status is divided into four levels: safe, low risk, medium risk and high risk.