Artificial intelligence-based network security risk assessment system and method

Abstract

This invention provides an artificial intelligence-based cybersecurity risk assessment system and method, relating to the field of network information security technology. It innovatively integrates the Dynamic Collaborative Aggregation (DSA) concept and the Trust Game Incentive Mechanism (TGIM) to achieve efficient cross-organizational collaboration while fully protecting data privacy. The DSA algorithm dynamically weights and aggregates model parameters using the Data Utility Factor (DUF) and Threat Correlation Metric (TCM), generating a high-quality global model without sharing original data, significantly reducing the risk of data leakage. TGIM, based on game theory, designs trust scores and exponential reward functions to incentivize high-quality contributions and effectively prevent malicious behavior, ensuring fairness in collaboration. This decentralized collaboration model significantly enhances the ability of multiple organizations to collaboratively address complex network threats, seamlessly combining privacy protection with efficient collaboration. It provides a new security assessment paradigm for sensitive industries such as finance and healthcare, possessing broad application potential.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network information security, in particular to a network security risk assessment system and method based on artificial intelligence. BACKGROUND

[0002] According to the network security assessment and protection method based on artificial intelligence disclosed in Chinese Patent No. CN118694600A, the method comprises safety assessment of various data types, presetting of security protection levels and encryption strategies and matching of the encryption strategies, presetting of storage protection levels and storage strategies and matching of the storage strategies, and checking and calculation of network data. The present application provides data reference for taking corresponding encryption strategies and storage strategies by safety assessment of various data types; effective hierarchical security protection of network data is realized by presetting of security protection levels and corresponding encryption strategies and matching of the encryption strategies; effective hierarchical storage protection of network data is realized by presetting of storage protection levels and corresponding storage strategies and matching of the storage strategies; timely discovery of tampered network data is realized by checking and calculation of network data based on a checking period. Finally, the network security assessment and protection based on artificial intelligence are realized.

[0003] According to the network security event assessment method and system based on artificial intelligence disclosed in Chinese Patent No. CN117973695B, which belongs to the technical field of network security, the method comprises collecting original security events, presetting security type labels, establishing an instance data mapping set and constructing an association tree to obtain an association rule set; extracting fusion features according to the association rules, presetting a classification model, classifying the original security events in combination with the classification model, and presetting a malicious behavior matrix; establishing an optimization model, performing trend analysis on the classification samples by the optimization model to obtain a tendency degree, and optimizing the classification model by the tendency degree; determining evaluation indexes according to the classification results generated by the optimized classification model to obtain an index factor set, and constructing an evaluation index system; dividing the evaluation indexes into a multi-layer structure, and obtaining a threat level of the network security situation by a hierarchical evaluation method. The method reduces manual intervention, improves system analysis efficiency and adaptability.

[0004] The above patent documents and prior art have the following technical problems in use:

[0005] Problem 1: Traditional cybersecurity risk assessment methods typically require centralized sharing of raw data to build a global model, leading to data privacy risks. This is especially true in sensitive industries such as finance and healthcare, where data silos severely limit the efficiency of cross-organizational collaboration. While existing federated learning methods can partially protect privacy, their static aggregation mechanisms (such as simple parameter averaging) cannot fully consider data quality and threat relevance, resulting in insufficient global model performance. Furthermore, the lack of an effective trust mechanism makes collaboration susceptible to malicious interference, making it difficult to ensure fairness and security.

[0006] The second problem is that traditional cybersecurity risk assessment systems rely on static threat models, making it difficult to cope with rapidly changing cyber threat environments, such as zero-day vulnerabilities and new attack patterns like advanced persistent threats (APTs). Existing methods lack effective multimodal data fusion mechanisms when processing multi-source threat intelligence, resulting in incomplete feature extraction and limited threat detection accuracy. Furthermore, traditional optimization algorithms (such as reinforcement learning) are prone to getting stuck in local optima in complex environments, making it difficult to dynamically adjust the model to adapt to unknown threats. Summary of the Invention

[0007] Technical problems to be solved

[0008] To address the shortcomings of existing technologies, this invention provides an artificial intelligence-based cybersecurity risk assessment system and method, which solves the following problems:

[0009] 1. Addressing the conflict between data privacy and cross-organizational collaboration in traditional cybersecurity risk assessments;

[0010] 2. Addressing the issue of insufficient adaptability of traditional risk assessment systems to dynamic threat environments.

[0011] Technical solution

[0012] To achieve the above objectives, the present invention provides the following technical solution: a cybersecurity risk assessment system and method based on artificial intelligence, wherein the method includes the following steps:

[0013] Sp1: At each participating organization, local cybersecurity data is preprocessed, and data features containing threat-related information are generated through feature extraction algorithms. Based on this, local model parameters are generated.

[0014] Sp2: The local model parameters of each organization are aggregated through the Dynamic Collaborative Aggregation (DSA) concept to generate a global model. The Dynamic Collaborative Aggregation concept dynamically calculates nonlinear weighting coefficients based on the Data Utility Factor (DUF) and Threat Correlation Metric (TCM) to achieve intelligent fusion of parameters.

[0015] Sp3: Utilizing a blockchain trust module, a Trust Game Incentive Mechanism (TGIM) is adopted to record model updates of contributions from each participating organization. Through game theory, trust scores are dynamically adjusted and high-quality contributions are incentivized, ensuring fairness and security in collaboration.

[0016] SP4: Through the threat intelligence analysis module, the Multimodal Semantic Distillation (MTSD) method is used to fuse multimodal data such as text, event logs and network traffic, extract threat features and input them into the global model to improve threat detection accuracy;

[0017] Sp5: Utilizing an adaptive optimization module, it employs the Heterogeneous Agent Co-evolution (HACE) method to dynamically optimize the global model, adapting to dynamic threat environments through competition and cooperation among multiple agents;

[0018] SP6: Each participating organization downloads the global model, performs a local cybersecurity risk assessment, and uploads the assessment feedback to optimize the next round of the global model.

[0019] Preferably, the Dynamic Collaborative Aggregation (DSA) concept in step Sp2 calculates the Data Utility Factor (DUF) based on the diversity, timeliness, and threat detection contribution of the data, calculates the Threat Correlation Metric (TCM) based on the feature similarity between local data and threat intelligence, and uses a nonlinear fusion function to generate aggregation weights, ensuring that the global model reflects the impact of high-quality data.

[0020] Preferably, the Trust Game Incentive Mechanism (TGIM) in step Sp3 calculates a Trust Score (TS) based on a game theory model, dynamically updates it according to historical behavior and current contribution, and uses an exponential reward function. (in Incentivize high-quality updates based on contribution level, and punish malicious behavior.

[0021] Preferably, the multimodal semantic distillation method (MTSD) in step Sp4 uses term frequency-inverse threat frequency (TF-ITF) to extract text features, analyzes the temporal features of event logs and statistical patterns of network traffic, and fuses multimodal data through non-negative matrix factorization to generate a compact threat feature representation.

[0022] Preferably, the Heterogeneous Agent Co-evolution (HACE) method in step Sp5 improves the adaptability to unknown threats by setting up feature optimization agents, parameter adjustment agents, and threat prediction agents, and dynamically adjusting the global model through competition and cooperation mechanisms.

[0023] Preferably, the data utility factor (DUF) in step Sp2 is calculated by using the characteristic distribution entropy value to assess data diversity, using the time decay function to assess data timeliness, and using the local model to assess the contribution of the gain to global threat detection.

[0024] Preferably, the Trust Score (TS) update rule of the Trust Game Incentive Mechanism (TGIM) in step Sp3 is that if the model update improves the global performance, the Trust Score (TS) is increased; if a malicious update is detected, the Trust Score (TS) is decreased through an anomaly detection algorithm.

[0025] Preferably, in step Sp4, the multimodal semantic distillation method (MTSD) integrates text, log, and traffic data into a unified semantic space by using non-negative matrix factorization when fusing multimodal features, and retains key threat information through iterative optimization.

[0026] Preferably, the agent functions of the heterogeneous agent co-evolution method (HACE) in step Sp5 include feature optimization, agent selection of key features, parameter adjustment, agent fine-tuning of model parameters, and threat prediction, agent prediction of potential threat trends. Agents work together by sharing optimization goals.

[0027] Preferably, the various modules of the system in the method are interconnected through data flow and collaboration mechanisms, supporting decentralized collaboration and dynamic threat adaptation, and further include the following:

[0028] The local data processing module is used to collect cybersecurity data from participating organizations, extract threat-related features, and generate local model parameters.

[0029] The collaborative learning module implements the Dynamic Collaborative Aggregation (DSA) concept, using an aggregation engine to dynamically weight aggregation parameters based on the Data Utility Factor (DUF) and Threat Correlation Metric (TCM) to generate a global model;

[0030] The blockchain trust module runs smart contracts that utilize distributed ledgers and a Trust Game Incentive Mechanism (TGIM) to record model updates and incentivize high-quality contributions.

[0031] The threat intelligence analysis module fuses multimodal data using the Multimodal Semantic Distillation (MTSD) method, extracts threat features, and inputs them into the global model.

[0032] The adaptive optimization module uses the Heterogeneous Agent Co-evolution (HACE) method to manage competition and cooperation among multiple agents and optimize the global model performance.

[0033] The user interface and management module provide an interactive interface and monitoring dashboard for viewing risk assessment results and receiving alerts.

[0034] Beneficial effects

[0035] This invention provides a cybersecurity risk assessment system and method based on artificial intelligence. It has the following beneficial effects:

[0036] 1. This invention innovatively integrates the Dynamic Collaborative Aggregation (DSA) concept and the Trust Game Incentive Mechanism (TGIM) to achieve efficient cross-organizational collaboration while fully protecting data privacy. It breaks through the limitations of data silos in traditional cybersecurity risk assessment. The DSA algorithm uses the Data Utility Factor (DUF) and Threat Correlation Metric (TCM) to dynamically weight and aggregate model parameters, generating a high-quality global model without sharing original data, greatly reducing the risk of data leakage. TGIM, based on game theory, designs trust scores and exponential reward functions to incentivize high-quality contributions and effectively prevent malicious behavior, ensuring fairness in collaboration. The decentralized collaboration model significantly improves the ability of multiple organizations to collaboratively respond to complex network threats, seamlessly combining privacy protection with efficient collaboration. It provides a new security assessment paradigm for sensitive industries such as finance and healthcare, and has broad application potential.

[0037] 2. The unique design of Multimodal Semantic Distillation (MTSD) and Heterogeneous Agent Co-evolution (HACE) in this invention breaks through the dependence of traditional risk assessment systems on static threat models, and realizes intelligent adaptive optimization for dynamic threat environments. MTSD integrates multimodal data such as text, logs and traffic to generate compact and highly correlated threat features, enabling the system to quickly identify new attack patterns, such as zero-day vulnerabilities or advanced persistent threats (APTs). HACE dynamically adjusts the global model through feature optimization, parameter adjustment and co-evolution of threat prediction agents, significantly improving the response capability to unknown threats. The creativity of the adaptive mechanism lies in its multi-agent collaboration and multimodal feature integration, which overcomes the local optimum problem of traditional reinforcement learning in complex environments. As a result, the system can maintain high accuracy and robustness in rapidly changing network security environments, providing continuous protection for critical infrastructure and enterprise networks, demonstrating a major technological breakthrough. Attached Figure Description

[0038] Figure 1 This is a flowchart illustrating the safety risk assessment method of the present invention.

[0039] Figure 2 This is a structural diagram of the safety assessment system of the present invention;

[0040] Figure 3 This is a graph showing the change in the global model accuracy of the present invention with the number of iterations;

[0041] Figure 4 This is a distribution chart of trust scores for various organizations according to the present invention;

[0042] Figure 5 This is a diagram showing the effect of MTSD multimodal feature extraction in this invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Specific Implementation Example 1:

[0045] like Figures 1-5 As shown, an artificial intelligence-based cybersecurity risk assessment system and method are presented. This method aims to achieve decentralized, privacy-preserving, and dynamically adaptive cybersecurity risk assessment through artificial intelligence technology. It generates model parameters using local data from participating organizations, generates a global model through dynamic collaborative aggregation, and forms a closed-loop system by combining blockchain trust mechanisms, threat intelligence analysis, and adaptive optimization. The operation process includes two phases: initialization and iterative iteration.

[0046] Initialization: Each participating organization joins the platform, configures its local data processing module, and prepares to participate in the collaboration;

[0047] Iterative Cycle: The process continues through the following six steps (Sp1 to Sp6), with each iteration optimizing the global model to improve the accuracy of risk assessment and adaptability to dynamic threats;

[0048] The method includes the following steps:

[0049] Step Sp1: Local Data Preprocessing and Model Parameter Generation: At each participating organization, local cybersecurity data is preprocessed. Feature extraction algorithms generate data features containing threat-related information, and local model parameters are generated based on these features. This process begins with data collection. Organizations acquire local cybersecurity data from their network devices (such as firewalls and routers), system logs, and security tools, including traffic data, event logs (such as login records), and anomaly alerts. Next, custom feature extraction algorithms (such as the threat-based term frequency-inverse threat frequency method, TF-ITF) are used to extract key threat-related features from this data, such as abnormal traffic patterns (such as sudden high traffic), malicious IP addresses, and frequent abnormal login attempts. These features quantify threat relevance, providing a foundation for subsequent modeling. Afterward, local machine learning models (such as neural networks or decision trees) are trained using the extracted features, generating model parameters (such as weights and biases in neural networks, or node splitting rules in decision trees). This step ensures that organizations can transform local threat information into shareable model parameters while protecting data privacy, laying the foundation for building a global model.

[0050] Step Sp2: Dynamic Collaborative Aggregation to Generate a Global Model: This step uses Dynamic Collaborative Aggregation (DSA) to aggregate the local model parameters of each organization, generating a global model. First, each organization uploads its local model parameters to a central server or blockchain network. The aggregation process dynamically calculates non-linear weighting coefficients based on the Data Utility Factor (DUF) and Threat Correlation Metric (TCM) to achieve intelligent parameter fusion. Specifically, DFU evaluates the value of data in three ways: first, it uses the characteristic distribution entropy value to assess the diversity of the data (the higher the entropy, the stronger the diversity); second, it uses a time decay function (such as exponential decay) to assess the timeliness of the data, ensuring that recent data is used effectively. More influential; third, the contribution of local models to global threat detection is evaluated by the gains (e.g., improved accuracy) of local models, while TCM is evaluated based on the feature similarity between local data and current threat intelligence (e.g., by calculating the matching degree between abnormal patterns and known threats through cosine similarity). During aggregation, a non-linear fusion function (e.g., sigmoid function) is used to generate aggregation weights for each organization's parameters based on DUF and TCM, and the parameters are weighted and averaged to generate a global model, ensuring that the model reflects the impact of high-quality data. Finally, the aggregated global model is distributed back to each participating organization. This step balances the contributions of each organization through a dynamic weighting mechanism to achieve efficient parameter fusion.

[0051] Step Sp3: Blockchain Trust and Incentive Mechanism: Utilizing the blockchain trust module, a Trust Game Incentive Mechanism (TGIM) is employed to record model updates contributed by each participating organization. Trust scores are dynamically adjusted using game theory to incentivize high-quality contributions, ensuring fairness and security in collaboration. The process begins with the calculation of the Trust Score (TS). Based on the game theory model, combined with the organization's historical behavior (e.g., whether parameters are submitted on time) and current contribution (the improvement of parameters on the global model performance), TS is dynamically updated. If the model update improves global performance (e.g., increased detection rate), TS is increased; if malicious updates (e.g., intentionally submitting incorrect parameters) are identified through anomaly detection algorithms (e.g., Isolation Forest), TS is decreased. Incentive allocation uses an exponential reward function. (in The model rewards high-quality updates exponentially (based on contributions, such as the improvement of parameters on the accuracy of the global model) while penalizing malicious behavior. All model updates and trust score adjustments are recorded on the blockchain, leveraging its distributed ledger characteristics to ensure transparency and immutability. This step, through a dual mechanism of trust and incentives, safeguards the security of collaboration and the enthusiasm of participants.

[0052] Step Sp4: Threat Intelligence Analysis and Feature Extraction: The threat intelligence analysis module employs Multimodal Semantic Distillation (MTSD) to fuse multimodal data such as text, event logs, and network traffic, extracting threat features and inputting them into the global model to improve threat detection accuracy. The process begins with data collection from external threat intelligence sources, including text reports (such as security bulletins), event logs, and network traffic data. Feature extraction is performed separately for different modalities: for text, TF-ITF methods are used to extract keywords and threat patterns (such as "ransomware" or "SQL injection"); for event logs, time-series features are analyzed. (e.g., time series patterns of anomalous events); For network traffic, statistical patterns (e.g., packet size distribution) are analyzed to detect anomalous traffic. Then, these multimodal features are integrated into a unified semantic space through nonnegative matrix factorization (NMF) to eliminate intermodal heterogeneity. Subsequently, feature distillation is performed through iterative optimization (e.g., gradient descent) to retain compact feature representations most relevant to the threat (e.g., high-risk IP lists or attack pattern vectors) and remove redundant information. These features are input into the global model to further improve its detection accuracy. This step provides high-quality threat input to the global model through multimodal fusion and feature refinement.

[0053] Step Sp5: Adaptive Optimization of the Global Model: Utilizing the adaptive optimization module, the global model is dynamically optimized using the Heterogeneous Agent Co-evolution (HACE) method. This process adapts to the dynamic threat environment through competition and cooperation among multiple agents. Starting with agent settings, the process includes three types of agents: feature optimization agents select the most important features for threat detection (e.g., highly relevant feature vectors); parameter adjustment agents fine-tune global model parameters (e.g., adjusting neural network weights); and threat prediction agents predict potential threat trends (e.g., predicting the likelihood of DDoS attacks based on historical data). These agents work through a co-evolution mechanism: under the competition mechanism, agents compete for computing resources based on performance (e.g., the accuracy of feature selection or the predicted F1 score); under the cooperation mechanism, agents share optimization objectives (e.g., the overall detection rate of the global model) and information (e.g., threat trend data), collaboratively improving performance. Through dynamic adjustments among agents, the parameters and feature selection of the global model are continuously optimized to adapt to the ever-changing threat environment (e.g., new attack methods). This step, through the synergistic effect of heterogeneous agents, ensures that the global model maintains high adaptability and robustness.

[0054] Step Sp6: Risk Assessment and Feedback: Each participating organization downloads the global model, performs a local cybersecurity risk assessment, and uploads the assessment feedback to optimize the next round of the global model. The process begins with the model download. Each organization obtains the latest global model from the central server or blockchain network. Then, it uses the global model to conduct a risk assessment on its local cybersecurity data, generating a risk report (such as identifying high-risk vulnerabilities or potential attack paths). The assessment results and feedback (such as the types of threats detected and false positives) are uploaded to the system to optimize the training of the next round of the global model, such as adjusting feature weights or correcting model biases. This step, through the local assessment and feedback mechanism, forms a closed loop for the continuous improvement of the global model, ensuring the system's adaptability to the specific threats of each organization.

[0055] like Figure 3 As shown, the improvement in global model accuracy with the number of iterations reflects the effectiveness of DSA and HACE. Figure 4 As shown, the distribution of Trust Scores (TS) across organizations reflects the incentive mechanism of TGIM, such as... Figure 5 As shown, the multimodal feature extraction effect is demonstrated, reflecting the contribution of MTSD. This method achieves intelligent parameter aggregation through DSA, ensures collaborative fairness through TGIM, improves threat detection accuracy through MTSD, enhances model adaptability through HACE, and combines blockchain technology to ensure security. Specific Implementation Example 2:

[0057] like Figures 1-5 As shown, based on the content of the above specific embodiments, the following content is further disclosed:

[0058] The local data processing module consists of a data collector, a feature extractor, and a local model trainer. The data collector gathers raw network security data from network devices (such as firewalls and routers), system logs, and security tools of participating organizations, including traffic data, event logs, and abnormal alarms. The feature extractor uses a custom algorithm (such as a threat-based TF-ITF algorithm) to extract key threat-related features from this data, such as abnormal traffic patterns, malicious IP addresses, or abnormal login attempts. The feature extraction process is based on threat relevance quantification, providing reliable input for subsequent modeling. The local model trainer uses the extracted features to train a machine learning model (such as a neural network or decision tree) to generate local model parameters (such as weights and biases). While protecting the data privacy of each organization, the local network security data is transformed into shareable model parameters, laying the foundation for the construction of a global model, while reducing the security risks associated with raw data transmission.

[0059] The collaborative learning module includes a parameter uploader, an aggregation engine, and a model distributor. The parameter uploader is responsible for securely uploading the local model parameters generated by each organization to a central server or blockchain network. The aggregation engine executes the Dynamic Collaborative Aggregation (DSA) concept, dynamically generating weighted coefficients through the Data Utility Factor (DUF) and Threat Correlation Metric (TCM). The DFU is calculated based on the diversity of data (feature entropy value), timeliness (time decay function), and contribution (gain to global threat detection). The TCM measures the feature similarity between local data and threat intelligence. The aggregation process uses a non-linear fusion function (such as sigmoid) to perform a weighted average of the parameters to generate a global model. The model distributor distributes the generated global model back to the participating organizations for use. Through intelligent parameter aggregation, this module balances the differences in contributions from each organization, achieves efficient model fusion, and improves the threat detection capability of the global model.

[0060] The blockchain trust module consists of blockchain nodes, smart contracts, and a contribution evaluator. Blockchain nodes run a distributed ledger protocol, recording updates to all model parameters and transaction information to ensure data immutability. Smart contracts implement a Trust Game Incentive Mechanism (TGIM) to automatically manage the organization's Trust Score (TS) and incentive allocation. The contribution evaluator, based on a game theory model, calculates TS based on the organization's historical behavior and current parameter contributions. If parameter updates improve global model performance, TS increases; if malicious or low-quality updates are detected, TS decreases. Incentive allocation uses an exponential reward function. (in Rewards high-quality contributions based on contribution level, and ensures fairness, security and transparency in the collaboration process through a decentralized trust mechanism, incentivizing high-quality participation and preventing malicious behavior.

[0061] The threat intelligence analysis module includes a data collector, a multimodal fusion unit, and a feature distiller. The data collector acquires multimodal data from external threat intelligence sources, such as threat reports in text format, event logs, and network traffic data. The multimodal fusion unit extracts features for different data types: for text data, it uses the TF-ITF algorithm to extract keywords; for log data, it analyzes time-series features; and for traffic data, it extracts statistical patterns. Subsequently, it integrates the multimodal features into a unified semantic space through nonnegative matrix factorization (NMF). The feature distiller uses iterative optimization methods (such as gradient descent) to retain key threat-related information, generate compact feature representations, and input them into the global model. By fusing multi-source threat intelligence, this module improves the threat detection accuracy of the global model, helping the system cope with complex and ever-changing network attacks.

[0062] The adaptive optimization module consists of an agent manager, a competition and cooperation mechanism, and an optimization engine. The agent manager sets up three types of heterogeneous agents: feature optimization agents are responsible for selecting key features, parameter adjustment agents fine-tune model parameters, and threat prediction agents predict threat trends. Under the competition mechanism, each agent competes for resources based on optimization performance. Under the cooperation mechanism, optimization goals and information are shared, and the optimization engine dynamically adjusts global model parameters based on agent feedback. Model optimization is achieved through the Heterogeneous Agent Co-evolution (HACE) method, making it adaptable to the dynamic threat environment. Through co-evolution among multiple agents, the adaptability and robustness of the global model are improved, ensuring that the system remains efficient when facing emerging threats.

[0063] The user interface and management module consists of a web interface, a monitoring dashboard, and an alarm system. The web interface provides user interaction functions, supporting operations such as user login, data upload, and viewing risk assessment reports. The monitoring dashboard displays information such as system health status, risk score, and threat distribution in real time. When a cybersecurity incident is detected, the alarm system reminds users to take action through real-time notifications (such as emails or pop-ups). This module enhances the user experience and ensures that organizations can easily use the system and respond to security incidents in a timely manner.

[0064] The modules are closely interconnected through data flow and collaboration mechanisms, forming a system that supports decentralized collaboration and dynamic threat adaptation. Specifically, after the local data processing module generates model parameters, the collaborative learning module aggregates them, the blockchain trust module records and updates them and provides incentives, the threat intelligence analysis module integrates external intelligence and extracts features, the adaptive optimization module dynamically adjusts the global model, and the user interface and management module present the results to the user. The modular design ensures efficient system operation while taking into account privacy protection and performance optimization. Through the collaborative work of local data processing, collaborative learning, blockchain trust, threat intelligence analysis, adaptive optimization, and user interface and management modules, combined with algorithms such as DSA, TGIM, MTSD, and HACE, efficient and decentralized cybersecurity risk assessment is achieved. The modules have clear division of labor and support each other, ensuring that the system has the ability to dynamically adapt to threats and is practical while protecting data privacy. Specific Implementation Example 3:

[0066] like Figures 1-5 As shown, based on the content of the above specific embodiments, the following content is further disclosed:

[0067] Based on the content of the above-described specific embodiments one and two, the algorithm corresponding to the above system and method further includes the following:

[0068] Dynamic Collaborative Aggregation (DSA) concept:

[0069]

[0070]

[0071]

[0072]

[0073] in:

[0074] : Global model parameters (such as neural network weight vectors);

[0075] : No. Local model parameters for each organization;

[0076] : No. The aggregate weights of each organization are in the range [0, 1].

[0077] Sigmoid function , used for nonlinear mapping;

[0078] , Hyperparameters that balance the contributions of DFU and TCM;

[0079] : No. Data utility factors for an organization;

[0080] : No. Threat correlation measurement for an organization;

[0081] Weighting coefficients adjust for the relative importance of diversity, timeliness, and contribution.

[0082] Data characteristics The entropy value measures diversity;

[0083] Time decay function The attenuation rate, For the current time, For the time the data was generated;

[0084] The performance gain of the local model on global threat detection (such as improved accuracy);

[0085] Local feature vectors Threat intelligence characteristics Cosine similarity;

[0086] Number of participating organizations;

[0087] Implementation steps: Calculate DFU: for each tissue Calculate data diversity (entropy value) ), timeliness (time decay) and contribution (performance gain) ), weighted summation yields ; Calculate TCM: Extract local features , and threat intelligence characteristics Calculate the cosine similarity to obtain Weight generation: Through a non-linear fusion function φ, combined with... and Calculate aggregate weights Aggregation parameters: based on weights For each organizational parameter Weighted summation to generate global model parameters It improves the accuracy of the global model by assigning weights based on data quality and threat relevance, and enhances the robustness of the model by capturing complex relationships through the Sigmoid function. It achieves parameter fusion while protecting privacy without sharing the original data.

[0088] Trust Game Incentive Mechanism (TGIM):

[0089]

[0090]

[0091]

[0092] in:

[0093] : No. The trust score of an organization at time t+1t+1;

[0094] : No. Trust score of an organization at time t;

[0095] Learning rate controls the speed at which trust scores are updated;

[0096] : No. The gain of each organizational parameter on the global model performance;

[0097] : Penalty coefficient, which adjusts the severity of punishment for malicious behavior;

[0098] Malicious behavior score, calculated using anomaly detection algorithms (such as Isolation Forest);

[0099] : No. Incentive rewards for organizations (such as tokens or points);

[0100] : No. The contribution of each organization is based on the normalized value of performance gain;

[0101] Number of participating organizations;

[0102] Implementation steps: Calculate the performance gain of each organizational parameter on the global model. Normalization yields contribution. Use anomaly detection algorithms (such as Isolation Forest) to analyze parameter updates and calculate malicious behavior scores. Adjust trust scores based on performance gains and malicious behavior. Incentives are calculated using an exponential return function. Recorded in a blockchain smart contract, the trust score is adjusted in real time based on contributions and behaviors, incentivizing high-quality participation, amplifying the rewards of high-quality contributions, enhancing the enthusiasm for collaboration, and preventing malicious attacks through blockchain records and anomaly detection;

[0103] Multimodal semantic distillation (MTSD):

[0104]

[0105]

[0106]

[0107]

[0108]

[0109] in:

[0110] : Feature matrix after multimodal fusion;

[0111] Non-negative matrix decomposition, which decomposes the matrix into a basis matrix and a coefficient matrix;

[0112] Initial feature matrices for text, log, and traffic data;

[0113] : Compact threat characteristics after distillation;

[0114] L2 norm, measures the error in feature reconstruction;

[0115] KL divergence measures the difference in distribution between features and threat intelligence.

[0116] Regularization coefficient, balancing reconstruction and threat relevance;

[0117] : Term frequency-inverse threat frequency algorithm to generate text features;

[0118] Time-series analysis functions are used to extract log features.

[0119] Statistical analysis functions to extract flow characteristics;

[0120] , Raw text, logs, and traffic data;

[0121] Implementation steps: Process text data TF-ITF feature generation ; Regarding log data Extracting temporal features For traffic data Extracting statistical features Through NMF Integration into a unified feature Optimize the objective function to generate compact features. Retain threat-related information and Input a global model, integrate multi-source data to enhance feature comprehensiveness, reduce redundant information during the distillation process to improve computational efficiency, and optimize KL divergence to ensure that features are highly correlated with threats.

[0122] Heterogeneous Proxy Co-evolution (HACE):

[0123]

[0124]

[0125]

[0126] in:

[0127] : Optimized global model parameters;

[0128] : Current global model parameters;

[0129] : No. Optimization suggestions for each agent (such as feature weights or parameter adjustments);

[0130] : No. The weights of each agent are based on softmax normalization;

[0131] : No. Performance score of each agent;

[0132] : Accuracy rate after agent optimization;

[0133] The efficiency of the proxy's execution (e.g., response time);

[0134] The computational cost of the agent;

[0135] 𝛼, 𝛽, 𝛾: Weighting coefficients that balance accuracy, efficiency, and cost;

[0136] k: Number of agents (feature optimization, parameter tuning, threat prediction agents);

[0137] Implementation steps: Agent initialization: Set up feature optimization, parameter tuning, and threat prediction agents, each performing its specific function; calculate the accuracy, efficiency, and cost of each agent; and generate a score. The agent weights are calculated using the softmax function. Based on the suggestions of each agent and weight Update the global model and co-evolve: multi-agent competition and cooperation improve optimization results, adjust the model in real time, respond to emerging threats, balance accuracy and resource consumption, and reduce computational burden. Specific Implementation Example 4:

[0139] like Figures 1-5 As shown, based on the content of the above specific embodiments, the following content is further disclosed:

[0140] To further verify the feasibility of this application in practical use and the significant features of the technical solution, the following application examples are further disclosed:

[0141] Application Case 1: Collaborative Defense Against Cross-Bank Cyber ​​Threats in the Financial Industry

[0142] Application Scenario: Multiple banks (such as Bank A, Bank B, and Bank C) face increasing cyberattacks (such as phishing attacks, malware, and distributed denial-of-service (DDoS) attacks), but due to data privacy regulations (such as the Data Security Law), they cannot directly share customer data for joint defense. This application system provides privacy-protected cyber threat assessment and defense capabilities through decentralized collaboration.

[0143] The implementation process is as follows:

[0144] Initialization: The three banks connect to the system architecture of this application, configure local data processing modules, and collect network traffic, transaction logs, and security event data.

[0145] Sp1: Local data processing: Each bank uses the TF-ITF algorithm to extract features (such as abnormal transaction patterns and malicious IPs) and trains local models to generate parameters;

[0146] Sp2: Dynamic Collaborative Aggregation: Through the DSA algorithm, a global threat detection model is generated based on DUF (Data Diversity, Timeliness, Contribution) and TCM (Threat Relevance) aggregation parameters;

[0147] Sp3: Blockchain Trust: TGIM assesses each bank's contribution, allocates incentives (such as tokens), and updates blockchain records to ensure fairness;

[0148] SP4: Threat Intelligence Analysis: MTSD integrates external intelligence (such as malware reports and network traffic patterns), extracts threat characteristics, and inputs them into the global model;

[0149] Sp5: Adaptive Optimization: HACE dynamically adjusts the model to cope with new types of attacks through feature optimization and threat prediction agents;

[0150] SP6: Risk Assessment and Feedback: Each bank downloads the global model, assesses local risks (such as DDoS risk scoring), and uploads feedback to optimize the model.

[0151] In terms of privacy protection, only model parameters are shared, which complies with regulatory requirements. DSA and TGIM improve model quality and collaborative fairness, enabling efficient collaboration. MTSD and HACE provide rapid response to emerging threats, achieving dynamic adaptation. The data content is shown in Table 1 below:

[0152] Metrics Bank A Bank B Bank C Global model Local data volume (GB / day) 50 40 60 - Feature extraction time (seconds) 120 100 150 - Threat detection accuracy (%) 85 82 88 92 Malicious behavior detection rate (%) 90 87 91 95 Model update time (minutes) 10 8 12 15 Data breach events (times) 0 0 0 0

[0153] Table 1

[0154] The global model accuracy improved from 82%-88% of the local model to 92%, the malicious behavior detection rate reached 95%, and there were zero data breaches, demonstrating that the system achieves efficient collaboration while protecting privacy. Model update time is controlled within 15 minutes, suitable for real-time defense needs.

[0155] Application Case 2: Data Security Assessment of Hospital Alliances in the Healthcare Industry

[0156] Application scenario: Multiple hospitals (such as municipal hospitals, specialized hospitals, and regional hospitals) need to jointly assess the cybersecurity risks of medical information systems (such as electronic medical record systems). However, patient data is highly sensitive and cannot be centrally shared. This system provides a secure data security assessment solution through federated collaboration and blockchain trust mechanisms.

[0157] The implementation process is as follows:

[0158] Initialization: The hospital alliance joins the system, configures the local data processing module, and collects system logs, access records, and network traffic;

[0159] Sp1: Local data processing: Each hospital uses TF-ITF to extract features (such as abnormal access frequency and SQL injection attempts) and generate local model parameters;

[0160] Sp2: Dynamic Collaborative Aggregation: DSA generates a global risk assessment model based on the dynamic aggregation parameters of DUF and TCM;

[0161] Sp3: Blockchain Trust: TGIM incentivizes high-quality contributions through Trust Score (TS) and an exponential reward function, while blockchain ensures transparency;

[0162] SP4: Threat Intelligence Analysis: MTSD integrates medical security reports, logs, and traffic data to extract threat characteristics (such as ransomware patterns).

[0163] Sp5: Adaptive Optimization: HACE optimizes the model to detect new threats (such as attacks against medical devices) through multi-agent co-evolution.

[0164] SP6: Risk Assessment and Feedback: The hospital uses a global model to assess system risks, generate reports (such as vulnerability scores), and provide feedback to optimize the model.

[0165] The above steps ensure that patient data remains on-premises, complying with privacy regulations. MTSD enhances the ability to identify healthcare-specific threats, and HACE ensures the model adapts to new types of attacks. Data parameters are shown in Table 2 below.

[0166] Metrics City hospital Specialty hospital Regional hospital Global model Local data volume (GB / day) 30 25 35 - Feature extraction time (seconds) 90 80 100 - Threat detection accuracy (%) 80 78 82 90 New threat response time (minutes) 20 25 18 10 Trust score (TS, 0-1) 0.85 0.80 0.90 - Data breach events (times) 0 0 0 0

[0167] Table 2

[0168] The global model achieves an accuracy of 90%, an improvement of approximately 10% over the local model. The response time to new threats is reduced to 10 minutes. The trust score reflects the fairness of collaboration, and there have been zero data breaches, demonstrating the system's efficiency and security in the healthcare industry.

[0169] Application Case 3: Cybersecurity Monitoring of Critical Government Infrastructure

[0170] Application scenario: Government departments (such as power, telecommunications, and transportation departments) need to jointly monitor the cybersecurity of critical infrastructure, but the data of each unit is scattered and sensitive, making traditional centralized methods impractical. This system provides real-time cybersecurity monitoring through a decentralized architecture and adaptive optimization.

[0171] The implementation process is as follows:

[0172] Initialization: Each unit joins this system, configures its local data processing module, and collects infrastructure logs and traffic data;

[0173] Sp1: Local data processing: Use TF-ITF to extract features (such as DDoS traffic patterns and anomaly control commands) and generate parameters;

[0174] Sp2: Dynamic Collaborative Aggregation: DSA aggregates parameters to generate a global monitoring model;

[0175] SP3: Blockchain Trust: TGIM assesses contributions, blockchain records are updated, and security is ensured;

[0176] SP4: Threat Intelligence Analysis: MTSD integrates government intelligence, logs, and traffic data to extract features (such as APT attack patterns).

[0177] Sp5: Adaptive Optimization: HACE optimization model, adapting to new threats (such as supply chain attacks).

[0178] SP6: Risk Assessment and Feedback: The unit assesses risks (such as system vulnerabilities) and provides feedback to optimize the model.

[0179] Through the above steps, MTSD and HACE support rapid threat detection, DSA and TGIM ensure data security and fairness, and the system addresses threats to complex infrastructures. The data content is shown in Table 3 below:

[0180] Metrics City hospital Specialty hospital Regional hospital Global model Local data volume (GB / day) 30 25 35 - Feature extraction time (seconds) 90 80 100 - Threat detection accuracy (%) 80 78 82 90 New threat response time (minutes) 20 25 18 10 Trust score (TS, 0-1) 0.85 0.80 0.90 - Data breach events (times) 0 0 0 0

[0181] Table 3

[0182] The global model achieves an accuracy of 94%, the APT attack detection rate is increased to 90%, the model is updated 6 times per day, meeting the real-time monitoring requirements, and there are zero data breaches, proving the feasibility and efficiency of the system in critical infrastructure.

[0183] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising a reference structure" does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0184] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A cybersecurity risk assessment method based on artificial intelligence, characterized by: The method includes the following steps: Sp1: At each participating organization, local cybersecurity data is preprocessed, and data features containing threat-related information are generated through feature extraction algorithms. Based on this, local model parameters are generated. Sp2: By aggregating the local model parameters of each organization through the concept of dynamic collaborative aggregation, a global model is generated. The concept of dynamic collaborative aggregation dynamically calculates nonlinear weighting coefficients based on data utility factors and threat correlation metrics to achieve intelligent fusion of parameters. Sp3: Utilizing a blockchain trust module, a trust game incentive mechanism is adopted to record model updates of contributions from each participating organization. Through game theory, trust scores are dynamically adjusted and high-quality contributions are incentivized, ensuring fairness and security in collaboration. SP4: Through the threat intelligence analysis module, a multimodal semantic distillation method is used to fuse multimodal data from text, event logs, and network traffic to extract threat features and input them into the global model, thereby improving threat detection accuracy; Sp5: Utilizes an adaptive optimization module and employs a heterogeneous agent co-evolution method to dynamically optimize the global model, adapting to dynamic threat environments through competition and cooperation among multiple agents; SP6: Each participating organization downloads the global model, performs a local cybersecurity risk assessment, and uploads the assessment feedback to optimize the next round of the global model.

2. The artificial intelligence-based cybersecurity risk assessment method according to claim 1, characterized in that: The dynamic collaborative aggregation concept in step Sp2 calculates the data utility factor based on the diversity, timeliness and threat detection contribution of the data, calculates the threat correlation metric based on the feature similarity between local data and threat intelligence, and generates aggregation weights using a nonlinear fusion function.

3. The artificial intelligence-based cybersecurity risk assessment method according to claim 1, characterized in that: The trust game incentive mechanism in step Sp3 is based on a game theory model to calculate a trust score TS, which is dynamically updated according to historical behavior and current contribution, and uses an exponential reward function. , As a contribution level.

4. The artificial intelligence-based cybersecurity risk assessment method according to claim 1, characterized in that: The multimodal semantic distillation method in step Sp4 uses word frequency-inverse threat frequency to extract text features, analyzes the temporal features of event logs and statistical patterns of network traffic, and fuses multimodal data through non-negative matrix factorization to generate a compact threat feature representation.

5. The artificial intelligence-based cybersecurity risk assessment method according to claim 1, characterized in that: The heterogeneous agent co-evolution method in step Sp5 improves adaptability to unknown threats by setting feature optimization agents, parameter adjustment agents, and threat prediction agents, and dynamically adjusting the global model through competition and cooperation mechanisms.

6. The artificial intelligence-based cybersecurity risk assessment method according to claim 2, characterized in that: The data utility factor in step Sp2 is calculated by using the characteristic distribution entropy value to assess data diversity, using the time decay function to assess data timeliness, and using the local model to assess the contribution of the gain to global threat detection.

7. The artificial intelligence-based cybersecurity risk assessment method according to claim 3, characterized in that: The trust score update rule of the trust game incentive mechanism in step Sp3 is that if the model update improves the global performance, the trust score is increased; if malicious update is detected, the trust score is reduced through an anomaly detection algorithm.

8. The artificial intelligence-based cybersecurity risk assessment method according to claim 1, characterized in that: In step Sp4, the multimodal semantic distillation method integrates text, log, and traffic data into a unified semantic space by using non-negative matrix factorization when fusing multimodal features, and retains key threat information through iterative optimization.

9. The artificial intelligence-based cybersecurity risk assessment method according to claim 5, characterized in that: The agent functions of the heterogeneous agent co-evolution method in step Sp5 include feature optimization (agents select key features), parameter adjustment (agents fine-tune model parameters), and threat prediction (agents predict potential threat trends). Agents work together by sharing optimization goals.

10. The system corresponding to the artificial intelligence-based cybersecurity risk assessment method according to any one of claims 1-9, characterized in that: The system further includes the following: The local data processing module is used to collect cybersecurity data from participating organizations, extract threat-related features, and generate local model parameters. The collaborative learning module implements the concept of dynamic collaborative aggregation. Through the aggregation engine, it dynamically weights and aggregates parameters based on data utility factors and threat correlation metrics to generate a global model. The blockchain trust module runs smart contracts that utilize distributed ledgers and trust game incentive mechanisms to record model updates and incentivize high-quality contributions. The threat intelligence analysis module fuses multimodal data using a multimodal semantic distillation method, extracts threat features, and inputs them into the global model. The adaptive optimization module uses a heterogeneous agent co-evolution method to manage competition and cooperation among multiple agents and optimize the performance of the global model. The user interface and management module provide an interactive interface and monitoring dashboard for viewing risk assessment results and receiving alerts.

Images