A method to enhance the robustness of artificial intelligence systems

Abstract

The present invention discloses a method for enhancing the robustness of an artificial intelligence system. The method collects system logs, performance indicators, and user behaviors of the system operation to form a data set; uses a distributed stream processing platform to process the data set in real time, including time alignment and spatial alignment; performs heterogeneous analysis through a graph neural network to identify normal data and abnormal data; sends normal data to feature storage and performs cross-dimensional detection on abnormal data, including isolation forest detection and rule engine re-checking; performs real-time risk assessment based on the results of heterogeneous analysis and cross-dimensional detection, and calculates the final risk level through a fusion formula; performs corresponding current limiting, blocking, or monitoring operations based on the risk level; and completes adaptive adjustment of system parameters. By dynamically assessing system risk in real time, this method reduces the amount of computation compared to traditional adversarial sample methods and provides a more flexible and comprehensive protection mechanism, effectively enhancing the robustness of the artificial intelligence system.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence system security, and in particular to a method for enhancing the robustness of artificial intelligence systems. Background Art

[0002] With the widespread application of artificial intelligence (AI) technology, the robustness of AI systems is becoming increasingly prominent. During actual operation, AI systems face challenges from multiple risk factors, including adversarial attacks, data contamination, and outdated models. These factors can lead to performance degradation or even failure. To enhance the robustness of AI systems, the industry has conducted extensive research. However, existing technologies for enhancing the robustness of AI systems still have the following shortcomings:

[0003] First, existing methods are not capable of processing cross-dimensional correlation analysis of multi-dimensional data, making it difficult to effectively identify complex risk patterns.

[0004] Secondly, traditional systems rely heavily on static rules for risk assessment, lack dynamic adaptability, and are unable to effectively respond to new risks such as 0day vulnerabilities.

[0005] Third, existing methods lack a real-time parameter dynamic adjustment mechanism in terms of response strategies and are unable to respond to rapidly changing risks in a timely manner.

[0006] Fourth, existing robustness enhancement methods usually require a lot of computing resources and storage space, limiting their applications in resource-constrained environments.

[0007] Fifth, many methods perform well on specific datasets or attack types, but their robustness may drop significantly when facing unknown or diverse attacks, and they lack the ability to generalize to new attack patterns.

[0008] Therefore, there is an urgent need for a method that can process multi-dimensional data in real time, conduct cross-dimensional risk detection, assess risks in real time, and inform managers to make corresponding strategies, so as to enhance the robustness of artificial intelligence systems and improve the system's ability to deal with various risks. Summary of the Invention

[0009] The present invention discloses a method for enhancing the robustness of an artificial intelligence system, which can effectively overcome the above problems. The specific method adopted is:

[0010] S1. Multi-source data collection: Collect data from three dimensions: system logs, performance indicators, and user behavior.

[0011] S2. Streaming feature engineering: Apache Kafka is used as a distributed stream processing platform to process collected multi-source data in real time. Specifically, this includes: using the sliding window DTW algorithm to align multi-source data streams, adaptively adjusting the window size based on the characteristics of the data stream, and performing session segmentation based on session identifiers to form a spatiotemporally aligned feature dataset.

[0012] S3. Heterogeneous Graph Construction and Analysis: Based on the feature dataset processed in S2, a heterogeneous graph containing system log nodes, performance indicator nodes, and user behavior nodes is constructed. Graph neural networks (GNNs) are used to perform heterogeneous data association analysis. Specifically:

[0013] Construct a heterogeneous graph, where system logs, performance indicators, and user behaviors are treated as different types of nodes, and the temporal and logical relationships between nodes are treated as edges;

[0014] Calculate node importance and cross-type association weights through a two-stage attention mechanism;

[0015] Combining node-level attention, graph-level attention, and time decay factors to achieve dynamic updates of edge weights;

[0016] The trained GNN model analyzes the input data and outputs a preliminary risk score, GNN_Risk. The test environment is an AWS EC2 c5.4xlarge instance. The dataset is HTTP flood attack samples from CIC-IDS2017 (n=12,000). The training set: validation set: test set ratio is 6:2:2.

[0017] S4, cross-dimensional anomaly detection: Process the GNN analysis results in S3, specifically setting a threshold, sending data less than or equal to the threshold as normal data to the feature repository for GNN model update, and treating data greater than the threshold as abnormal data for further cross-dimensional detection, specifically including:

[0018] Use the Isolation Forest algorithm to detect abnormal data and calculate the anomaly score Isolation_Score;

[0019] At the same time, the rule engine is used to match the abnormal data to obtain the rule confidence Rule_Weight.

[0020] S5, Risk Assessment: Based on the GNN analysis results of S3 and the cross-dimensional detection results of S4, a weighted fusion algorithm is used to calculate the final risk score. The specific formula is:

[0021] FinalRisk=0.4·GNN_Risk+0.3·Isolation_Score+0.3·Rule_Weight

[0022] Among them, GNN_Risk is the preliminary risk score output by the GNN model, Isolation_Score is the anomaly detection score normalized to the [0,1] interval, and Rule_Weight is the confidence of the rule engine;

[0023] S6. Implementation of graded early warning: Based on the final risk score FinalRisk calculated in S5, implement corresponding early warning measures:

[0024] S61. When FinalRisk < 0.3, it is considered low risk and recorded in the log and regularly summarized and analyzed;

[0025] S62. When 0.3 ≤ FinalRisk < 0.7, the risk is determined to be medium, triggering an alarm notification and increasing the monitoring frequency;

[0026] S63. When FinalRisk ≥ 0.7, it is judged as high risk and current limiting measures are automatically implemented, including API access frequency restrictions, resource allocation adjustments, etc., and an emergency notification is sent;

[0027] Preferably, the collection of system operation data in S1 includes: the frequency of data collection is once per second, and the collected data all contain timestamp information.

[0028] Preferably, the dual-stage attention mechanism in S3 includes intra-node attention calculation and inter-node relationship attention calculation, and realizes information fusion between different types of nodes through a trainable attention weight matrix.

[0029] Preferably, the S6 current limiting measure is implemented using a token bucket algorithm, and the token generation rate r is dynamically adjusted according to the risk score, and the calculation formula is: r=base_rate×(1-β×FinalRisk), where base_rate is the basic rate and β is the adjustment coefficient.

[0030] As a preference, adjust the feature aggregation depth, hidden layer dimension, and learning rate in the GNN model based on the error rates of false positives and false negatives in the detection results; adjust the number of trees and subsample size in the isolation forest model; and adjust the matching threshold of the rules in the rule engine once a day.

[0031] According to the accuracy of the detection method, the weights of the three indicators GNN_Risk, Isolation_Score and Rule_Weight are adjusted. The weight adjustment adopts the gradient descent method with a step size of 0.05 and the adjustment frequency is once a day.

[0032] According to the feedback from managers, the response parameters are adjusted. The response parameters are response strategies corresponding to different risk ratings, and the adjustment frequency is once a day.

[0033] Compared with the existing technology, the present invention achieves spatiotemporal alignment of data in three dimensions: system logs, performance indicators, and user behavior, through multi-source data collection and streaming feature engineering, ensuring the consistency of multi-source data. Real-time response is achieved through GNN heterogeneous data analysis. Combined with the cross-dimensional anomaly detection method of the Solation Forest algorithm and the rule engine, it effectively identifies complex risk patterns and meets high-performance requirements. The weighted fusion algorithm performs dynamic risk assessment to ensure rapid response capabilities. Finally, hierarchical warnings improve the accuracy and timeliness of risk response, and adaptive parameter adjustments can ensure timely detection of risks, so that corresponding emergency operations can be taken, thereby improving system robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Flowchart of the present invention. DETAILED DESCRIPTION

[0035] In order to make it easier for those skilled in the art to understand, the present invention is described in detail below with reference to the accompanying drawings.

[0036] A method for enhancing the robustness of an artificial intelligence system comprises the following steps:

[0037] S1: Collect system operation data to form a data set;

[0038] Specifically, the collected system operation data includes system logs, performance indicators and user behavior data.

[0039] System logs refer to log records with a fixed format generated during the operation of the system, including error logs, warning logs, information logs, etc. Each log contains fields such as timestamp, log level, and log content; performance indicators include CPU usage, memory usage, network traffic, response time, etc.; user behavior data refers to a series of operation commands executed by users or systems and their execution results, including API call sequences, user interaction behaviors, etc.

[0040] Data is collected once per second to ensure real-time and complete data. All collected data includes timestamp information for subsequent time alignment processing.

[0041] S2: uses Apache Kafka as a distributed stream processing platform to process data sets in real time;

[0042] Specifically, real-time processing includes three steps: data cleaning, time alignment, and spatial alignment.

[0043] During the data cleaning step, the collected raw data is formatted uniformly, invalid fields are removed, missing values ​​are corrected, and the data format is standardized. For system logs, key fields such as timestamp, log level, event type, and error code are extracted; for time series data, outlier detection and smoothing are performed; for user behavior data, key information such as operation type, operation object, and operation result is extracted.

[0044] During the time alignment step, data from different sources are aligned according to their timestamps, ensuring that data from the same point in time can be correlated for analysis. This is done by establishing a unified time window of 1 second and treating data falling within the same window as data from the same instant. For data with inaccurate timestamps, linear interpolation is used to correct the time.

[0045] In the spatial alignment step, data from different dimensions is associated to establish spatial relationships between the data. This is done by linking different types of data using common identifiers (such as session IDs, user IDs, and transaction IDs) to form a multidimensional data view. For data lacking associated identifiers, associations are inferred through temporal correlation and contextual information.

[0046] After real-time processing, the data in the formed data set at each moment contains the system logs, performance data and user operation information at that moment, providing a basis for subsequent heterogeneous analysis.

[0047] S3: Heterogeneous analysis via graph neural networks (GNNs);

[0048] Specifically, in the heterogeneous graph construction step, the processed multidimensional data is converted into a heterogeneous graph structure, where system logs, performance indicators, and user behaviors are respectively used as different types of nodes, and the temporal and logical relationships between nodes are used as edges.

[0049] The node importance and cross-type association weight are calculated through a two-stage attention mechanism, and then the node importance (i.e., node-level attention), the cross-type association weight (i.e., graph-level attention) and the time decay factor are combined to achieve dynamic update of edge weights.

[0050] The calculation formula is: Wt=λ⋅Wt−1+(1−λ)⋅AttentionWeight

[0051] Among them, Wt is the current moment weight, λ is the time decay factor, and every 24 hours is λ(t)=λ×(0.99) t , update, the initial value of λ is 0.9, t is the number of days, and AttentionWeight is the weight calculated by node-level and graph-level attention.

[0052] During the feature extraction step, graph neural networks are used to learn representations of heterogeneous graphs and extract implicit features of nodes and edges. Specifically, the GraphSAGE algorithm is used to aggregate node features, with an aggregation depth of three layers, a hidden layer dimension of 128, and a ReLU activation function. Different feature transformation matrices are used for processing different types of nodes and edges to capture the characteristics of different data types.

[0053] The preliminary risk score, GNN_Risk, calculates node and edge anomaly scores based on learned graph representation features. Specifically, it calculates the degree of deviation between node features and their historical feature distribution, as well as the degree of anomaly between a node and its neighbors. Node feature deviation is calculated using the Mahalanobis distance, while relationship anomaly is calculated using an edge prediction model to calculate the difference between expected and actual edge weights.

[0054] The pre-training process of the edge prediction model is divided into three steps: first, a heterogeneous graph is constructed based on historical normal data, in which nodes represent entities such as hosts and users, and edges represent interactive relationships; second, a supervised learning method is used, with node feature splicing as input, such as resource access frequency and session duration, and true edge weights as labels, to train a fully connected neural network by minimizing the prediction error (MSE loss); finally, a retained validation set is used to adjust model hyperparameters such as the learning rate and hidden layer dimension to ensure that it can accurately predict the edge weight distribution in normal scenarios. For example, the test set error must be less than 0.05. This pre-trained model is used as a benchmark, and edge weights that exceed the prediction threshold in subsequent real-time detection will be judged as abnormal.

[0055] Finally, the comprehensive calculation of anomaly scores is achieved:

[0056] Node_Score is the node anomaly score, calculated using Mahalanobis distance and normalized to the [0, 1] range using the Sigmoid function:

[0057] ,

[0058] Among them, D M is the Mahalanobis distance, which indicates the degree of deviation between node features and normal distribution. μ is the mean (or threshold parameter) of the Mahalanobis distance, which is usually the mean of the Mahalanobis distance of normal nodes in the training set for centralization. σ is the standard deviation (or scaling parameter) of the Mahalanobis distance, which is used to adjust the sensitivity of the score to distance changes. It is usually the standard deviation of the training set. e is the base of the natural logarithm.

[0059] Edge_Score is the edge anomaly score, based on the edge weight prediction error:

[0060] ,

[0061] Edge_Score (edge ​​anomaly score): measures the degree of anomaly of an edge in the graph. The value range is [0,1]. The closer to 1, the higher the possibility of anomaly.

[0062] W real is the true edge weight: the actually observed edge weight (such as user operation frequency, number of system calls, etc.).

[0063] W pred To predict edge weights, edge weights are predicted by graph neural networks (GNNs) or time series models.

[0064] σ train is the standard deviation of the training set, the standard deviation of the normal edge weight error during the training phase, and is used to standardize the deviation.

[0065] After weighted fusion based on actual conditions:

[0066] ,

[0067] The above weights can be adjusted according to actual conditions.

[0068] Based on the above, the comprehensive anomaly score is the preliminary risk score GNN_Risk. The threshold is set to 0.7. Data above the threshold is marked as anomaly data, and data below and equal to the threshold is marked as normal data. Abnormal data can also be assigned a preliminary risk level, with scores between 0.7-0.8 as low risk, between 0.8-0.9 as medium risk, and above 0.9 as high risk.

[0069] Note that GNN_Risk > 0.7 only indicates that cross-dimensional verification is required, and the final abnormal state is determined by FinalRisk.

[0070] S4: Based on the results of S3, normal data is sent to feature storage, and abnormal data is detected across dimensions;

[0071] Specifically, normal data is stored in a feature repository for updating the GNN model. This feature storage uses the time series database InfluxDB, with a 30-day storage cycle and hourly aggregation to conserve storage space. The stored features include node feature vectors, edge feature vectors, and graph structure features, which are used for subsequent anomaly detection and model updates.

[0072] For data marked as abnormal, cross-dimensional detection is performed, which means that the abnormal data is verified again from multiple different dimensions. Cross-dimensional detection includes two methods: isolation forest detection and rule engine detection.

[0073] In the isolation forest detection step, the feature vector of the anomaly data is fed into a pre-trained isolation forest model to calculate its anomaly score. The isolation forest model parameters are set to: 100 trees, 256 subsamples, and a contamination rate of 0.1. The output of the isolation forest detection is an anomaly score in the range [0, 1], with scores closer to 1 indicating a higher probability of an anomaly.

[0074] During the rule engine detection step, abnormal data is matched against a predefined rule set to determine whether it conforms to known abnormal patterns. The rule set includes three categories: system error rules, performance anomaly rules, and security threat rules. Each category contains multiple specific rules, such as "five consecutive authentication failures" and "CPU usage suddenly increases by more than 90%." The output of the rule engine detection is the matched rule and its confidence level, which ranges from 0 to 1. For example, if the confidence level of a rule match is 0.8 and the historical accuracy of the rule is 90%, then Rule_Weight = Confidence Level × Historical Accuracy = 0.8 × 0.9 = 0.72. More specific rules are developed based on industry common sense and actual needs, and therefore are not fully detailed.

[0075] Through cross-dimensional detection, the authenticity of anomalies can be verified from different angles, the false alarm rate can be reduced, and more information about the nature of the anomaly can be obtained, providing a basis for subsequent risk assessment.

[0076] S5: Conduct real-time risk assessment;

[0077] Specifically, real-time risk assessment is based on the results of GNN heterogeneous analysis in S3 and the results of cross-dimensional detection in S4, and the final risk level is calculated comprehensively. Risk assessment adopts weighted fusion method, and the fusion formula is:

[0078] FinalRisk = 0.4×GNN_Risk +0.3×Isolation_Score+ 0.3× Rule_Weight

[0079] GNN_Risk is the risk score derived from GNN heterogeneous analysis in S3, ranging from [0 to 1]. Isolation_Score is the anomaly score derived from isolation forest detection, normalized to the interval [0 to 1]. Rule_Weight is the confidence level of the rule matched by the rule engine, ranging from [0 to 1]. If the rule engine does not match any rule, Rule_Weight is 0.

[0080] The weight distribution is based on the characteristics of the three detection methods: GNN heterogeneous analysis can capture complex relationship anomalies, so it is given a higher weight; isolation forest detection and rule engine detection are used as auxiliary verification methods and are given relatively low weights.

[0081] The calculated FinalRisk value ranges from [0,1], and the risk level is divided into three levels based on this value:

[0082] - Low risk: FinalRisk is between [0,0.3);

[0083] - Medium risk: FinalRisk is between [0.3, 0.7);

[0084] - High risk: FinalRisk is between [0.7,1].

[0085] Risk assessment results are recorded in the risk log, including information such as timestamp, risk level, risk source, and impact scope, providing a basis for subsequent risk management. The high risk threshold can be configured based on system sensitivity (default 0.7).

[0086] S6: Take appropriate actions based on the risk assessment level;

[0087] Specifically, for different risk levels, the system will automatically perform different levels of response operations:

[0088] For low risk levels, the actions performed include:

[0089] Record risk events in the monitoring log;

[0090] Increase the monitoring frequency of related components from the default once per minute to once every 10 seconds;

[0091] Send low-priority alarm notifications to system administrators;

[0092] Starts automatic diagnostics to gather more relevant information.

[0093] For the medium risk level, the following actions are performed:

[0094] Record risk events in the monitoring log and mark them as important events;

[0095] Implemented some throttling measures on related components, reducing the request processing rate to 70% of the normal level;

[0096] Start backup resources to increase system redundancy;

[0097] Send medium-priority alert notifications to system administrators and security teams;

[0098] Initiate an in-depth diagnostic program to analyze the root causes of risks.

[0099] For high risk levels, the actions performed include:

[0100] Record risk events in the monitoring log and mark them as emergency events;

[0101] Implemented strict flow control measures on relevant components, reducing the request processing rate to 30% of the normal level;

[0102] Isolate affected system components to prevent risk from spreading;

[0103] Switch to safe mode and only keep core functions;

[0104] Send high-priority alert notifications to system administrators, security teams, and technical leaders;

[0105] Initiate emergency response procedures and prepare for manual intervention.

[0106] After these operations are performed, the results will be recorded and evaluated by managers, and subsequent grading operations will be adjusted based on the evaluation results.

[0107] If the flow control measure is implemented using the token bucket algorithm, the token generation rate r is dynamically adjusted according to the risk score. The calculation formula is: r = base_rate × (1-β × FinalRisk), where base_rate is the basic rate, base_rate = 1000 requests / second, β is the adjustment coefficient, and the initial value of β is set based on experience. Subsequent adjustments can be made using the gradient descent method based on system stability.

[0108] S7: Perform parameter adaptive adjustment.

[0109] Specifically, adaptive parameter adjustment dynamically optimizes the parameters of each system module based on risk management results and system operating status to improve system robustness. Parameter adjustment includes three aspects: detection parameter adjustment, evaluation parameter adjustment, and response parameter adjustment.

[0110] Detection parameter adjustments primarily target parameters used in GNN heterogeneous analysis and cross-dimensional detection. For GNN models, these adjustments include feature aggregation depth, hidden layer dimensions, and learning rate; for isolation forest models, these adjustments include the number of trees and subsample size; and for rule engines, the rule matching threshold is adjusted. Adjustments are based on the accuracy of detection results, evaluated by calculating false positive and false negative rates, with the goal of minimizing the overall error rate.

[0111] Assessment parameter adjustments primarily target the weighting parameters used in risk assessment. The weights of the three metrics, GNN_Risk, Isolation_Score, and Rule_Weight, are dynamically adjusted based on the accuracy of detection of different risk sources. If the accuracy of a particular detection method improves, the weight of the corresponding metric is increased; otherwise, the weight is decreased. Weight adjustments are performed using a gradient descent method with a step size of 0.05 and are performed periodically.

[0112] The accuracy of a test can be assessed using a variety of existing methods, such as:

[0113] The accuracy of the GNN model is calculated using the validation set to calculate how well its predicted risk score matches the true risk.

[0114] Isolation Forest detection accuracy, calculates the anomaly detection capability of Isolation_Score based on historical data and evaluates its ability to distinguish normal from abnormal data.

[0115] Response parameter adjustments primarily target response strategies for different risk levels. Based on the response effectiveness and system recovery, parameters such as the throttling ratio, monitoring frequency, and alarm thresholds are adjusted. If a response strategy performs well, it is maintained or slightly enhanced. If it performs poorly, the strategy parameters are adjusted or the response method is changed. Response parameter adjustments utilize reinforcement learning, using a reward function to guide the system in learning the optimal response strategy.

[0116] Parameter adaptation is performed daily during periods of low system load. The adjustment process considers long-term trends in historical data and short-term fluctuations in recent data, balancing stability and adaptability. Adjustment results are recorded in the system log for administrator review and analysis.

[0117] Through the above seven steps, this method realizes all-round monitoring and risk management of artificial intelligence systems. It can timely detect system anomalies, assess risk levels, take corresponding measures, and continuously optimize system parameters, thereby enhancing the robustness of the system and ensuring its stable operation.

[0118] Compared with traditional adversarial sample methods, this invention reduces the amount of computation and provides a more flexible and comprehensive protection mechanism, effectively enhancing the robustness of artificial intelligence systems. According to tests, under the same test environment, the average false alarm rate of traditional static rule-based methods is 18.7%, while this method reduces the false alarm rate to 5.2% through the collaborative mechanism of GNN heterogeneous analysis and cross-dimensional detection. In particular, when dealing with new attack patterns, the false alarm rate of the existing isolation forest algorithm reaches 23.5%, while this method is based on (1) a two-stage attention mechanism to effectively capture cross-dimensional abnormal correlations; (2) a sliding window DTW algorithm to reduce the multi-source data alignment error by 82%; and (3) weighted fusion to reduce the risk assessment response delay to 200ms. These data ensure that this method significantly reduces the risk of false alarms and false negatives while maintaining a high detection rate, and controls the false negative rate within 8.1%.

Claims

1. A method for enhancing the robustness of an artificial intelligence system, characterized in that: The steps include: S1. Collect system operation data, including system logs, performance indicators, and user behavior; S2 uses Apache Kafka as a distributed stream processing platform to process the data collected in S1 in real time, forming a spatiotemporally aligned feature dataset. S3. Input the feature dataset into the GNN model for heterogeneous analysis: First, a heterogeneous graph is constructed based on the feature dataset of S2, where system logs, performance indicators, and user behaviors are used as different types of nodes, and the temporal and logical relationships between nodes are used as edges. Next, node-level attention and graph-level attention are calculated through a two-stage attention mechanism; Then, we combine node-level attention, graph-level attention, and time decay factors to achieve dynamic updates of edge weights. Finally, the trained GNN model is used to analyze the input data and output a preliminary risk score GNN_Risk; S4. Set a threshold and, based on the calculation results of S3, classify the output data into normal data and abnormal data. Output data less than or equal to the threshold is sent to the feature repository as normal data for storage and used for GNN model update. Output data greater than the threshold is detected as abnormal data using the isolation forest algorithm, and the abnormality score Isolation_Score is calculated. At the same time, the rule engine matches the abnormal data with rules to obtain the rule confidence Rule_Weight. S5. Use the weighted fusion algorithm to calculate the final risk score. The specific formula is: FinalRisk=0.4·GNN_Risk+0.3·Isolation_Score+0.3·Rule_Weight Among them, FinalRisk is the final risk score; S6. Perform grading operations based on the final risk score FinalRisk: S61. When FinalRisk < 0.3, it is considered low risk and recorded in the log and regularly summarized and analyzed; S62. When 0.3 ≤ FinalRisk < 0.7, the risk is determined to be medium, triggering an alarm notification and increasing the monitoring frequency; S63. When FinalRisk ≥ 0.7, it is judged as high risk and throttling measures are automatically implemented, including API access frequency restriction, resource allocation adjustment, and emergency notification.

2. The method for enhancing the robustness of an artificial intelligence system according to claim 1, characterized in that: The acquisition system operation data in S1 includes: the frequency of data acquisition is once per second, and the acquired data all contain time stamp information.

3. The method for enhancing the robustness of an artificial intelligence system according to claim 1, characterized in that: The dual-stage attention mechanism in S3 includes intra-node attention calculation and inter-node relation attention calculation, and realizes information fusion between different types of nodes through a trainable attention weight matrix.

4. The method for enhancing the robustness of an artificial intelligence system according to claim 1, characterized in that: The S6 current limiting measure is implemented using a token bucket algorithm. The token generation rate r is dynamically adjusted according to the risk score. The calculation formula is: r=base_rate×(1-β×FinalRisk), where base_rate is the basic rate and β is the adjustment coefficient.

5. The method for enhancing the robustness of an artificial intelligence system according to claim 1, characterized in that: The method further includes step S7, which includes adaptively adjusting parameters, specifically: Adjust the feature aggregation depth, hidden layer dimension, and learning rate in the GNN model based on the error rates of false positives and false negatives in the detection results; adjust the number of trees and subsample size in the isolation forest model; and adjust the matching threshold of the rules in the rule engine once a day. According to the accuracy of the detection method, the weights of the three indicators GNN_Risk, Isolation_Score and Rule_Weight are adjusted. The weight adjustment adopts the gradient descent method with a step size of 0.05 and the adjustment frequency is once a day. According to the feedback effect of managers, the response parameters are adjusted, and the response parameters are response strategies corresponding to different risk ratings.

Images