Multi-stage network security threat defense method and system based on AI adaptive optimization

Abstract

The invention relates to the field of Internet of Things security, in particular to a multi-stage network security threat defense method and system based on AI adaptive optimization. Scene similarity calculation is carried out on multi-dimensional feature differences of historical security events and to-be-processed security events, an Adaboost algorithm is combined to carry out iterative training on a decision tree, key dimensions are screened out, a similar scene set is applied to match a strategy library, and targeted defense measures are automatically generated. The method has the beneficial effects that the multi-stage attack detection accuracy and strategy response efficiency can be remarkably improved, complex threats such as zero-day vulnerabilities and APT (Advanced Persistent Threats) can be effectively handled, redundant dimension interference is reduced, dynamic self-adaptive security decision is realized, and the method has both flexibility and expandability. Meanwhile, the method can be applied to environments such as the Internet of Things, cloud computing and an enterprise intranet, and the intelligent level of network protection is further improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a multi-stage network security threat defense method and system based on AI adaptive optimization. Background Art

[0002] With the rapid development of emerging technologies such as the Internet of Things and cloud computing, cybersecurity incidents are increasingly multi-stage, highly concealed, and complex. Traditional network security defense methods typically rely on pre-set fixed rules and static patterns, such as firewall rules and intrusion detection system rules. While these methods can provide some protection against known threats, they often struggle to effectively identify and accurately defend against emerging threats such as advanced persistent threats (APTs), zero-day exploits, and multi-stage coordinated attacks. This is because traditional methods are unable to dynamically track and analyze the correlations between the various stages of a cybersecurity incident and lack in-depth exploration and utilization of the incident's essential characteristics, resulting in significantly insufficient accuracy and adaptability in policy generation.

[0003] In addition, although there are solutions in the existing technology for generating defense strategies through historical event matching methods, network security events generally have multiple feature dimensions, among which there are inevitably some redundant or interfering dimensions. Traditional solutions do not consider the critical differences of different dimensions in the security scenario matching process during feature analysis, resulting in the existence of redundant feature information that seriously interferes with the accuracy of scenario matching, which not only reduces the analysis efficiency, but also makes the generated strategies lack effective targeting, which easily causes delays and misjudgments in security incident defense.

[0004] Therefore, how to achieve intelligent identification and dynamic optimization analysis of key dimensional features in network security incidents, thereby effectively eliminating the interference caused by redundant features and further improving the defense accuracy and response efficiency of multi-stage network security threats has become an important issue that urgently needs to be solved in the current network security field. Summary of the Invention

[0005] In order to solve the technical problem that the presence of some redundant dimensions reduces the effect of scenario matching between current network security events and historical security events, thereby leading to poor security policy generation, the purpose of the present invention is to provide a multi-stage network security threat defense method based on AI adaptive optimization. The technical solution adopted is as follows:

[0006] The present invention proposes a multi-stage network security threat defense method based on AI adaptive optimization, characterized in that the method comprises the following steps:

[0007] Obtain a scenario library and a policy library for network security, wherein the scenario library contains multiple historical security events, and the policy library contains corresponding defense policies; at the same time, obtain the pending security events currently received by the network, wherein both the pending security events and the historical security events include feature data information in multiple dimensions.

[0008] Based on the differences in characteristic data information of each dimension between the security event to be processed and each of the historical security events, the attack scenario similarity of each of the historical security events is calculated; based on the attack scenario similarity, similar security events to the security event to be processed are screened out, and the similar security events and non-similar security events are marked separately to form labels for the historical security events.

[0009] Taking any dimension as the target dimension, construct a decision tree with the target dimension as the feature input as a weak classifier, use the weak classifier to iteratively train historical security events with the label, and record the classification accuracy of each iterative process; determine whether to terminate the iterative training based on the difference in the classification accuracy between each iterative process and the previous iterative process, and then obtain the criticality of the target dimension based on the classification accuracy of the last iteration, the difference in classification accuracy between the last iteration and the first iteration, and the number of iterative training; and then screen out the key dimensions for scene matching analysis based on the criticality of each dimension.

[0010] Based on the screened key dimensions, the differences in characteristic data information between the security event to be processed and the similar security events are further analyzed to obtain a set of similar scenarios of the security event to be processed, and corresponding defense strategies are selected from the strategy library to form a defense strategy set for the security event to be processed, so as to achieve prediction and adaptive defense of network security threats.

[0011] Furthermore, the method of obtaining the attack scenario similarity of each historical security event includes: dividing all dimensions into statistical feature dimensions and content feature dimensions based on the representation of the feature data of each dimension of the security event to be processed and each historical security event, wherein the statistical feature dimensions are in numerical form and the content feature dimensions are in text form; taking the security event to be processed or any historical security event as the target security event, obtaining a first feature vector composed of the statistical feature dimensions of the target security event; processing the content feature dimension of the target security event using a bag-of-words model to obtain a second feature vector of the target security event; respectively calculating the absolute value of the cosine similarity of the first feature vector and the second feature vector between the security event to be processed and each historical security event, and taking the average value of the two as the attack scenario similarity of each historical security event. By separately processing feature data of different representations, the accuracy of similarity calculation is improved, and the screening effect of similar security events is further optimized.

[0012] Furthermore, screening similar security events from historical security events based on the attack scenario similarity includes determining as the similar security events historical security events whose attack scenario similarity is greater than a preset first similarity threshold. By setting the preset first similarity threshold, the accuracy of screening similar security events is ensured, and security events with low similarity are prevented from interfering with the analysis process.

[0013] Furthermore, obtaining the classification accuracy rate for each iteration includes: using the Adaboost algorithm to classify labeled historical security events using the weak classifier, counting the number of correctly classified historical security events during each iteration; and calculating the ratio of the number of correctly classified historical security events during each iteration as the numerator and the total number of historical security events as the denominator, and using the resulting ratio as the classification accuracy rate for each iteration. This method dynamically assesses the classification accuracy of each dimensional feature, effectively improving the objectivity of dimensional criticality judgments.

[0014] Furthermore, determining whether to terminate iterative training based on the difference in classification accuracy between each iteration and the previous iteration includes terminating iterative training when the absolute value of the difference in classification accuracy between two consecutive iterations is less than a preset judgment threshold; otherwise, iterative training continues. This enables automatic termination determination of the training process, improving the efficiency and stability of the training process.

[0015] Furthermore, obtaining the criticality of the target dimension includes: using the reciprocal of the absolute difference between the classification accuracy of the last iteration and the first iteration as the first key parameter of the target dimension; using the reciprocal of the number of iterative training times as the second key parameter of the target dimension; and normalizing the sum of the classification accuracy of the last iteration, the first key parameter, and the second key parameter to obtain the criticality of the target dimension. In this way, scientific quantification of dimension importance ensures the accuracy of key dimension identification.

[0016] Furthermore, the method of screening out key dimensions from all dimensions includes: calculating the ratio of the number of similar security events to the number of all historical security events to obtain the similar scenario ratio value of the security event to be processed; using the difference between the value 1 and the similar scenario ratio value as the weight parameter of the security event to be processed, multiplying the weight parameter by the number of all dimensions and rounding up to obtain the minimum number of dimensions; combining any multiple dimensions to form a dimension group, wherein the number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions; calculating the average value of the criticality of all dimensions in each dimension group as the overall criticality of each dimension group; and determining all dimensions in the dimension group with the largest overall criticality as key dimensions. This achieves accurate dynamic screening of key dimensions, avoids interference from redundant dimensions, and significantly improves the effect of security policy generation.

[0017] As a preferred option, the method for calculating the similarity of attack scenarios of the security event to be processed includes: calculating the scenario similarity parameters of each similar security event based on the difference in characteristic data information on key dimensions between the security event to be processed and each similar security event based on the attack scenario similarity calculation method described in claim 2; and forming a set of similar security events whose scenario similarity parameters are greater than a preset second similarity threshold value as the similar scenario set of the security event to be processed. In this way, the high-similarity scenario set of the security event to be processed can be accurately identified, further improving the accuracy of defense strategy selection.

[0018] Preferably, selecting a policy set from a policy library based on a set of similar scenarios includes selecting defense policies from the policy library that are used to resolve all historical security incidents in the set of similar scenarios, with all selected defense policies constituting a policy set as the defense policy for the security incident to be handled. This ensures the targetedness and effectiveness of the defense policies, thereby improving the success rate of network threat defense.

[0019] The present invention also requests protection for a multi-stage network security threat defense system based on AI adaptive optimization, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor, characterized in that when the processor executes the computer program, the steps of the method as described in any one of claims 1 to 9 are implemented.

[0020] The present invention has the following beneficial effects:

[0021] In response to the problems existing in the background technology, the present invention proposes a multi-stage network security threat defense method based on AI adaptive optimization, which has the following beneficial effects:

[0022] (1) The present invention addresses the problem in the existing technology that it is difficult to accurately identify complex threats such as advanced persistent threats, multi-stage network attacks and zero-day attacks. By introducing a scenario library and a policy library, the similarity of attack scenarios is calculated using an AI adaptive optimization method, and historical security events that are highly similar to current network security events are accurately screened out. This significantly improves the accuracy of identifying complex network threats and the accuracy of matching defense strategies, and overcomes the problem that traditional fixed rules are difficult to dynamically track and defend against complex attacks.

[0023] (2) The present invention effectively solves the problem that the existing technology does not consider the interference of redundant dimensions and cannot accurately identify key dimensional features. Specifically, through the decision tree weak classifier and Adaboost iterative training, the criticality of each dimensional feature is adaptively quantified, thereby dynamically screening out the key dimensions that have a decisive role in scene matching, eliminating the interference of redundant dimensions on scene matching analysis. This technical means is not reflected in the existing technology, so the present invention significantly improves the efficiency and accuracy of scene matching analysis compared with the existing technology.

[0024] (3) Furthermore, the method proposed in this invention, which constructs a set of similar scenarios based on key dimensions and adaptively generates defense strategies, solves the problem of low strategy generation efficiency and slow response due to dimensional redundancy in traditional methods. This invention achieves rapid, accurate, and adaptive generation of defense strategies, and can dynamically generate optimal defense strategy sets for different attack scenarios in real time, significantly improving the real-time response capability and effectiveness of network security defense.

[0025] (4) Compared with the background technology, the present invention not only solves the redundant dimension interference problem of the existing technology through the adaptive optimization mechanism of the AI algorithm, but also provides an automated intelligent solution for network security threat prediction and defense strategy selection, achieving a breakthrough from passive defense to active prediction, and greatly improving the adaptability, intelligence and operational stability of the network security system.

[0026] In summary, compared with the existing technology, the method of the present invention has more accurate threat identification capabilities, higher scenario matching accuracy, faster strategy generation response efficiency, and intelligent and adaptive strategy optimization advantages, which comprehensively solves the shortcomings faced by the background technology and at the same time embodies obvious innovation and advancement. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0028] Figure 1 A flowchart of a multi-stage network security threat defense method based on AI adaptive optimization provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation method, structure, features and effects of a multi-stage network security threat defense method based on AI adaptive optimization proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics of one or more embodiments may be combined in any suitable form.

[0030] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0031] The following describes in detail a multi-stage network security threat defense method based on AI adaptive optimization provided by the present invention with reference to the accompanying drawings.

[0032] A multi-stage network security threat defense method based on AI adaptive optimization, characterized in that the method comprises the following steps:

[0033] Obtain a scenario library and a policy library for network security, wherein the scenario library contains multiple historical security events, and the policy library contains corresponding defense policies; at the same time, obtain the pending security events currently received by the network, wherein both the pending security events and the historical security events include feature data information in multiple dimensions.

[0034] Based on the differences in characteristic data information of each dimension between the security event to be processed and each of the historical security events, the attack scenario similarity of each of the historical security events is calculated; based on the attack scenario similarity, similar security events to the security event to be processed are screened out, and the similar security events and non-similar security events are marked separately to form labels for the historical security events.

[0035] Taking any dimension as the target dimension, construct a decision tree with the target dimension as the feature input as a weak classifier, use the weak classifier to iteratively train historical security events with the label, and record the classification accuracy of each iterative process; determine whether to terminate the iterative training based on the difference in the classification accuracy between each iterative process and the previous iterative process, and then obtain the criticality of the target dimension based on the classification accuracy of the last iteration, the difference in classification accuracy between the last iteration and the first iteration, and the number of iterative training; and then screen out the key dimensions for scene matching analysis based on the criticality of each dimension.

[0036] Based on the screened key dimensions, the differences in characteristic data information between the security event to be processed and the similar security events are further analyzed to obtain a set of similar scenarios of the security event to be processed, and corresponding defense strategies are selected from the strategy library to form a defense strategy set for the security event to be processed, so as to achieve prediction and adaptive defense of network security threats.

[0037] The method of obtaining the attack scenario similarity of each historical security event includes: dividing all dimensions into statistical feature dimensions and content feature dimensions based on the representation of the feature data of each dimension of the security event to be processed and each historical security event, wherein the statistical feature dimensions are in numerical form and the content feature dimensions are in text form; taking the security event to be processed or any historical security event as the target security event, obtaining a first feature vector composed of the statistical feature dimensions of the target security event; processing the content feature dimension of the target security event using a bag-of-words model to obtain a second feature vector of the target security event; respectively calculating the absolute value of the cosine similarity of the first feature vector and the second feature vector between the security event to be processed and each historical security event, and taking the average value of the two as the attack scenario similarity of each historical security event. By separately processing feature data of different representations, the accuracy of similarity calculation is improved, and the screening effect of similar security events is further optimized.

[0038] The method of screening similar security events from historical security events based on the attack scenario similarity includes determining historical security events whose attack scenario similarity is greater than a preset first similarity threshold as the similar security events. By setting the preset first similarity threshold, the accuracy of screening similar security events is ensured, and security events with low similarity are prevented from interfering with the analysis process.

[0039] Obtaining the classification accuracy rate for each iteration involves using the Adaboost algorithm to classify labeled historical security events using the weak classifier, counting the number of correctly classified historical security events during each iteration, and calculating the ratio of the number of correctly classified historical security events during each iteration to the total number of historical security events as the denominator, representing the classification accuracy rate for each iteration. This method dynamically assesses the classification accuracy of each dimensional feature, effectively improving the objectivity of dimensional criticality assessments.

[0040] Determining whether to terminate iterative training based on the difference in classification accuracy between each iteration and the previous iteration includes terminating iterative training when the absolute value of the difference in classification accuracy between two consecutive iterations is less than a preset judgment threshold, and otherwise continuing iterative training. This enables automatic termination of the training process, improving the efficiency and stability of the training process.

[0041] Determining the criticality of the target dimension includes: using the reciprocal of the absolute difference between the classification accuracy of the last iteration and the first iteration as the first key parameter of the target dimension; using the reciprocal of the number of iterative training times as the second key parameter of the target dimension; and normalizing the sum of the classification accuracy of the last iteration, the first key parameter, and the second key parameter to obtain the criticality of the target dimension. This scientific quantification of dimension importance ensures the accuracy of key dimension identification.

[0042] The method of screening out key dimensions from all dimensions includes: calculating the ratio of the number of similar security events to the number of all historical security events to obtain the similar scenario ratio value of the security event to be processed; using the difference between the value 1 and the similar scenario ratio value as the weight parameter of the security event to be processed, multiplying the weight parameter by the number of all dimensions and rounding up to obtain the minimum number of dimensions; combining any multiple dimensions to form a dimension group, wherein the number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions; calculating the average value of the criticality of all dimensions in each dimension group as the overall criticality of each dimension group; and determining all dimensions in the dimension group with the largest overall criticality as key dimensions. This method achieves accurate dynamic screening of key dimensions, avoids interference from redundant dimensions, and significantly improves the effect of security policy generation.

[0043] The method of obtaining a similar scenario set for the pending security event includes: calculating the scenario similarity parameters of each similar security event based on the attack scenario similarity calculation method described in claim 2 and the difference in characteristic data information between the pending security event and each similar security event in key dimensions; and forming a set of similar security events whose scenario similarity parameters are greater than a preset second similarity threshold value as the similar scenario set for the pending security event. In this way, a highly similar scenario set for the pending security event can be accurately identified, further improving the accuracy of defense strategy selection.

[0044] Selecting a policy set from a policy library based on a similar scenario set includes selecting defense policies from the policy library that are used to resolve all historical security incidents in the similar scenario set. All selected defense policies constitute a policy set, which serves as the defense policy for the security incident to be handled. This ensures the targetedness and effectiveness of the defense policies, improving the success rate of network threat defense.

[0045] The present invention also requests protection for a multi-stage network security threat defense system based on AI adaptive optimization, comprising a memory, a processor, and a computer program stored in the memory and runnable on the processor, characterized in that when the processor executes the computer program, the steps of the method as described in any one of claims 1 to 9 are implemented.

[0046] Example 1:

[0047] See also Figure 1 , which shows a flow chart of a multi-stage network security threat defense method based on AI adaptive optimization provided by one embodiment of the present invention, the method comprising:

[0048] Step S1: Acquire a scenario library, a policy library, and security events to be processed. The scenario library includes multiple historical security events, and the policy library includes defense policies for resolving each historical security event.

[0049] The embodiment of the present invention first uses a large AI model (such as the Bert-BiLSTM-CRF algorithm) to extract a large number of historical security events from the network, and integrates the strategies used to resolve each historical security event into the policy library. Among them, there is a correspondence between the historical security events in the scenario library and the strategies in the policy library, that is, each historical security event can be associated with a corresponding defense strategy. The Bert-BiLSTM-CRF algorithm is a technical means well known to those skilled in the art and will not be described here. At the same time, the network will receive new network security events and treat them as "pending security events." These events also have feature data in multiple dimensions, such as:

[0050] Numerical form: traffic volume, number of connections, number of failed logins, etc.

[0051] Text form: access mode, file access behavior, etc.

[0052] Since the present invention emphasizes the comprehensive processing of multiple different types of features, the subsequent scene matching analysis is compatible with both numerical features and text features.

[0053] Step S2: Calculate scenario similarity and preliminarily screen similar security events. The embodiment of the present invention needs to perform similarity analysis between the security event to be processed and the historical security events, namely "scenario matching analysis", so as to subsequently select the most appropriate defense strategy from the existing strategy library.

[0054] First, obtain the scenario similarity of each historical security event:

[0055] Dimension type classification: Based on the data information form of each dimension, all dimensions are divided into statistical feature dimensions (numerical values) and content feature dimensions (text).

[0056] Construct eigenvectors:

[0057] For statistical feature dimensions, the numerical values are directly combined into the first feature vector. For example, when the traffic size = 1, the number of connections = 2, and the number of failed login attempts = 3, it can be represented as a vector (1, 2, 3).

[0058] For the content feature dimension, the Bag-of-Words model is used to quantify the text to obtain the second feature vector.

[0059] Cosine similarity calculation: For the first eigenvector and second eigenvector of the pending security event and the historical security event, the absolute value of the cosine similarity is calculated respectively, and the average value is taken as the "scenario similarity" of each historical security event.

[0060] Then, the expression of scene similarity is:

[0061]

[0062] Among them, A n Indicates the scene similarity of the nth historical security event; C (n,1) Represents the cosine similarity of the first eigenvector (statistical feature), C (n,2) Represents the cosine similarity of the second eigenvector (text feature); |C (n,1) ∣、∣C (n,2) ∣ respectively represent the absolute value of the corresponding cosine similarity.

[0063] Next, filter for similar security events:

[0064] In this embodiment, a preset first similarity threshold (such as 0.6) can be set. n When the value is ≥0.6, it indicates that the historical security event has a high degree of similarity with the security event to be processed, and the event can be marked as a “similar security event” (marked as 1); otherwise, it is marked as a “non-similar security event” (marked as -1).

[0065] This will obtain historical security events with positive and negative labels, and prepare data for subsequent classification training using decision trees.

[0066] It should be noted that the present invention is not limited to the use of cosine similarity, and Euclidean distance or Manhattan distance may also be used and negative correlation mapping or normalization processing may be performed, as long as the differences between events can be effectively measured.

[0067] Step S3: Iteratively train weak classifiers and screen key dimensions. Because different dimensions play different roles in the scene matching process, simply using all dimensions for scene analysis may introduce a large number of redundant or noisy features, reducing matching accuracy. This paper uses a decision tree as a weak classifier and combines it with the Adaboost algorithm to dynamically evaluate the importance of each dimension during iterative training, ultimately determining the key dimensions.

[0068] First, build a weak classifier (decision tree):

[0069] Select any dimension as the "target dimension" and train a single-layer decision tree (decision stump) using the feature data of all historical security events in the scenario library on this target dimension. Use the aforementioned events marked as 1 or -1 as training samples, i.e., similar event / dissimilar event labels.

[0070] Then, the classification accuracy of each iteration process is:

[0071] The weak classifier is trained repeatedly using the Adaboost algorithm, and a classification accuracy rate is obtained in each iteration. The formula for the accuracy rate is as follows:

[0072]

[0073] Among them, K i represents the number of historical security events correctly classified in iteration i, and N is the total number of historical security events. When the absolute value of the difference in classification accuracy between two consecutive iterations is less than a preset judgment threshold (e.g., 0.05), the training results have converged and the iteration is terminated.

[0074] Then, calculate the criticality of the target dimension:

[0075] After the iteration is completed, the importance of the target dimension can be calculated based on the classification accuracy of the last iteration, the classification accuracy of the first iteration, and the number of training rounds. In this embodiment, the criticality G of the target dimension can be calculated by a normalization function, and the calculation formula is:

[0076]

[0077] Where T′ is the classification accuracy of the last iteration, T1 is the classification accuracy of the first iteration, and M is the total number of iterations. Dimension contributions are quantified using 1 / |T′-T1|, 1 / M, and T′. After the calculation is complete, the same operation can be performed on all dimensions, and the more critical dimensions can be selected as "key dimensions."

[0078] Finally, set the minimum number of dimensions:

[0079] If the scenario presented by the security incident to be handled is a "niche scenario" and there are fewer similar security incidents, it may be necessary to include more dimensions for analysis. The minimum number of dimensions can be dynamically adjusted using the following example formula:

[0080]

[0081] Among them, EEE is the number of similar security events, NNN is the number of all historical security events, and HHH is the total number of dimensions. When E / NE / NE / N is very small (niche scenario), the (1-E / N) value increases, thus The obtained F min Also bigger.

[0082] Step S4: Construct a similar scenario set and generate a strategy set. After obtaining the key dimensions, the key feature differences between the security incident to be processed and similar security incidents can be analyzed again to obtain the final similar scenario set and select the most appropriate defense strategy from the strategy library.

[0083] First, similar scene parameters are calculated:

[0084] A similar approach to step S2 can be used, but only the similarity scenario parameters B are calculated for the selected “key dimensions”. r The calculation formula is:

[0085]

[0086] Among them, D (r,3) 、D (r,4) Respectively represent the cosine similarity (absolute value) in the key statistical features and key text feature dimensions.

[0087] Set the preset second similarity threshold (such as 0.8), if B rIf ≥0.8, the rth similar safety event will be included in the similar scenario set.

[0088] Finally, select a defense strategy from the strategy library:

[0089] Historical security incidents in similar scenarios often closely resemble the security incidents currently being addressed in key dimensions. Therefore, the policy library can be used to search for defense policies corresponding to these historical security incidents and integrate them into a "policy set" to quickly resolve the current security incident. Embodiments of the present invention can also automatically organize these policies into defense scripts, enabling automated responses on platforms such as SOAR systems.

[0090] Example 2:

[0091] The present invention provides a network security policy generation system based on an AI large model, which includes a memory, a processor, and a computer program, wherein the memory is used to store the corresponding computer program, and the processor is used to run the corresponding computer program. When the computer program runs in the processor, it can implement the method described in steps S1 to S4.

[0092] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0093] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A multi-stage network security threat defense method based on AI adaptive optimization, characterized by: The method comprises the following steps: Obtain a scenario library and a policy library for network security, wherein the scenario library contains multiple historical security events, and the policy library contains corresponding defense policies; at the same time, obtain the pending security events currently received by the network, wherein both the pending security events and the historical security events include feature data information in multiple dimensions. Based on the differences in characteristic data information of each dimension between the security event to be processed and each of the historical security events, the attack scenario similarity of each of the historical security events is calculated; based on the attack scenario similarity, similar security events to the security event to be processed are screened out, and the similar security events and non-similar security events are marked separately to form labels for the historical security events. Taking any dimension as the target dimension, construct a decision tree with the target dimension as the feature input as a weak classifier, use the weak classifier to iteratively train historical security events with the label, and record the classification accuracy of each iterative process; determine whether to terminate the iterative training based on the difference in the classification accuracy between each iterative process and the previous iterative process, and then obtain the criticality of the target dimension based on the classification accuracy of the last iteration, the difference in classification accuracy between the last iteration and the first iteration, and the number of iterative training; and then screen out the key dimensions for scene matching analysis based on the criticality of each dimension. Based on the screened key dimensions, the differences in characteristic data information between the security event to be processed and the similar security events are further analyzed to obtain a set of similar scenarios of the security event to be processed, and corresponding defense strategies are selected from the strategy library to form a defense strategy set for the security event to be processed, so as to achieve prediction and adaptive defense of network security threats.

2. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 1 is characterized in that: The method of obtaining the attack scenario similarity of each historical security event includes: based on the expression form of the characteristic data of each dimension of the security event to be processed and each historical security event, dividing all dimensions into statistical feature dimensions and content feature dimensions, the statistical feature dimensions are in numerical form, and the content feature dimensions are in text form; taking the security event to be processed or any historical security event as the target security event, and obtaining a first feature vector composed of the statistical feature dimensions of the target security event; using the bag-of-words model to process the content feature dimension of the target security event, and obtaining a second feature vector of the target security event; respectively calculating the absolute value of the cosine similarity of the first feature vector and the second feature vector between the security event to be processed and each historical security event, and taking the average value of the two as the attack scenario similarity of each historical security event.

3. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 1 is characterized in that: The screening out similar security events from historical security events based on the attack scenario similarity includes: determining historical security events whose attack scenario similarity is greater than a preset first similarity threshold as the similar security events.

4. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 1 is characterized in that: Obtaining the classification accuracy of each iterative process includes: using the Adaboost algorithm to classify the labeled historical security events through the weak classifier, and counting the number of historical security events correctly classified in each iterative process; using the number of historical security events correctly classified in each iterative process as the numerator and the number of all historical security events as the denominator, and calculating the resulting ratio as the classification accuracy of each iterative process.

5. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 1 is characterized in that: The determining whether to terminate iterative training based on the difference in classification accuracy between each iterative process and the previous iterative process includes: terminating iterative training when the absolute value of the difference in classification accuracy between two consecutive iterative processes is less than a preset judgment threshold, otherwise continuing iterative training.

6. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 1 is characterized in that: The method of obtaining the criticality of the target dimension includes: taking the reciprocal of the absolute value of the difference between the classification accuracy of the last iterative process and the first iterative process as the first key parameter of the target dimension; taking the reciprocal of the number of iterative training times as the second key parameter of the target dimension; and normalizing the sum of the classification accuracy of the last iterative process, the first key parameter, and the second key parameter to obtain the criticality of the target dimension.

7. A multi-stage network security threat defense method based on AI adaptive optimization according to any one of claims 1 to 6, characterized in that: The screening out of key dimensions from all dimensions includes: calculating the ratio of the number of similar security events to the number of all historical security events to obtain the similar scenario ratio value of the security event to be processed; using the difference between the value 1 and the similar scenario ratio value as the weight parameter of the security event to be processed, multiplying the weight parameter by the number of all dimensions and rounding up to obtain the minimum number of dimensions; combining any multiple dimensions to form a dimension group, and the number of dimensions contained in each dimension group is greater than or equal to the minimum number of dimensions and less than or equal to the number of all dimensions; calculating the average value of the criticality of all dimensions in each dimension group as the overall criticality of each dimension group; and determining all dimensions in the dimension group with the largest overall criticality as key dimensions.

8. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 2 is characterized in that: The obtaining of the similar scenario set of the security event to be processed includes: based on the calculation method of the attack scenario similarity described in claim 2, calculating the scenario similarity parameters of each similar security event according to the difference in characteristic data information in key dimensions between the security event to be processed and each similar security event; forming a set of similar security events whose scenario similarity parameters are greater than a preset second similarity threshold as the similar scenario set of the security event to be processed.

9. The multi-stage network security threat defense method based on AI adaptive optimization according to claim 8 is characterized in that: The selecting of a policy set from a policy library based on a similar scenario set includes: selecting defense policies for resolving all historical security events in the similar scenario set from the policy library, wherein all selected defense policies constitute a policy set as defense policies for the security event to be processed.

10. A multi-stage network security threat defense system based on AI adaptive optimization, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 9 are implemented.

Images