Network security management method and system based on artificial intelligence

Abstract

The invention discloses a network security management method and system based on artificial intelligence. The method comprises the steps of training data set construction, behavior pattern modeling, network anomaly detection and intelligent decision making. The invention relates to the technical field of network security, in particular to a network security management method and system based on artificial intelligence, and the method comprises the steps: constructing a time sequence behavior modeling framework integrating a convolutional neural network and a recurrent neural network, and extracting the behavior pattern features of a user and equipment; generating diversified attack samples by adopting a generative adversarial network; multi-modal anomaly detection is realized in combination with self-supervised learning and an attention mechanism; based on an improved deep reinforcement learning strategy optimized decision model, dynamic generation and automatic adjustment of a response strategy of the security event are realized; the accuracy and robustness of the network intrusion detection system are effectively improved, and the method has good expandability and real-time performance and is suitable for complex and changeable network security protection scenes.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and specifically to an artificial intelligence-based network security management method and system. Background Art

[0002] With the rapid development of network technology, network environments are becoming increasingly complex, and cyberattacks are becoming increasingly intelligent and diverse, posing a serious threat to system stability and data security. Traditional network security management methods, which primarily rely on rule-based systems or static models, suffer from limited detection capabilities, delayed responses, and an inability to identify unknown threats.

[0003] In existing technologies, network behavior analysis models are mostly based on a single neural network structure, which makes it difficult to simultaneously extract local features and global temporal relationships, and has limited behavioral pattern recognition capabilities; existing anomaly detection methods are mostly based on static thresholds or known attack samples, which make it difficult to deal with variant attacks and hidden threats; at the same time, current network security response mechanisms mostly rely on manual configuration, lack intelligence and adaptability, and are unable to dynamically adjust protection strategies according to the degree of threat. Response efficiency and accuracy need to be improved. Summary of the Invention

[0004] In view of the above situation, in order to overcome the defects of the existing technology, the present invention provides a network security management method and system based on artificial intelligence. In view of the problems of single feature extraction, insufficient capture of temporal dependency and static abnormality benchmark in the traditional behavior pattern modeling method based on a single deep learning model, this solution integrates multi-layer convolutional neural network and recurrent neural network on time series data to realize the joint extraction of local and global features, construct a historical behavior adaptive baseline and dynamically calculate the behavior deviation and risk index; the existing anomaly detection methods are mostly based on static thresholds or known attack samples, which are difficult to deal with variant attacks and hidden threats, the isolated use of multimodal information brings about blind spots in judgment, and it is difficult to integrate To address the issues of detection accuracy and real-time performance, this solution introduces generative adversarial networks to enrich extreme and rare attack samples, self-supervised learning to finely extract hidden abnormal features, and fuses convolutional features, adaptive baseline deviation and self-supervised anomaly scores under the attention mechanism. At the same time, dynamic threshold triggering is combined to achieve real-time alarms. Traditional network security response methods rely on static rules or manual configuration, and have the problems of slow response, lack of intelligent judgment, easy misjudgment and inability to dynamically adapt to changing threat environments. This solution introduces intelligent decision-making state modeling that integrates detection scores and risk indexes, constructs a multi-dimensional response action space, and implements reinforcement learning-driven response strategy selection based on the improved DQN network.

[0005] The technical solution adopted by the present invention is as follows: a network security management method and system based on artificial intelligence, the method comprising the following steps:

[0006] Step S1: constructing a dataset;

[0007] Step S2: behavioral pattern modeling;

[0008] Step S3: network anomaly detection;

[0009] Step S4: Intelligent decision making.

[0010] Furthermore, in step S1, a data set is constructed, which specifically includes the following steps:

[0011] Step S11: Collecting raw data, specifically collecting network traffic data, system log data, and user behavior data;

[0012] Step S12: Generate a data set, specifically pre-process and divide the network traffic data, system log data and user behavior data obtained in step S11 to generate a data set.

[0013] Furthermore, in step S2, the behavior pattern modeling specifically includes the following contents:

[0014] Step S21: Hybrid feature extraction: construct an improved model consisting of a convolutional neural network and a recurrent neural network to extract local features from time series data and capture global time dependencies to form behavioral feature representations. The model specifically includes the following steps:

[0015] Step S211: input representation;

[0016] Step S212: Convolution feature extraction, using multi-layer convolution operations to extract local features, and extract features of local areas of the input data;

[0017] Step S213: Time series modeling, inputting the feature sequence extracted by the convolutional neural network into the recurrent neural network to capture the time dependency and complete the transformation from local features to global time series features;

[0018] Step S214: construct an adaptive baseline, introduce historical behavior statistics to construct an adaptive baseline, and calculate the behavioral feature deviation between the current state and the baseline;

[0019] Step S22: Calculate the risk index.

[0020] Furthermore, in step S3, the network anomaly detection specifically includes the following steps:

[0021] Step S31: Network attack simulation, using a generative adversarial network to generate potential network attack scenario data and construct an adversarial training framework, specifically including the following steps:

[0022] Step S311: Construct an objective function, use random noise as the generator input, the generator outputs a synthetic behavior sample, the discriminator judges the authenticity of the input sample, and outputs the probability that the sample is a real sample, and constructs the objective function to train the adversarial process;

[0023] Step S312: enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data;

[0024] Step S32: Self-supervised anomaly classification, using self-supervised learning to compare the features of the generated potential attack samples with the real samples and calculate the anomaly score;

[0025] Step S33: Multimodal fusion discrimination, which fuses the features extracted by the convolutional neural network, the baseline deviation, and the self-supervised anomaly score through the attention mechanism to form the final discrimination score;

[0026] Step S34: Anomaly detection, setting an anomaly score threshold, and triggering a network threat alarm when the final judgment score is greater than the anomaly score threshold.

[0027] Furthermore, in step S4, the intelligent decision-making, after detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system to take a response; specifically, the following steps are included:

[0028] Step S41: define states and actions, specifically including the following steps:

[0029] Step S411: define the decision state, and combine the detection score and risk index into the decision state;

[0030] Step S412: Define decision actions and introduce four decision actions: blocking the connection, limiting the speed, generating sandbox traffic, and notifying an alarm, to create an action space;

[0031] Step S42: Deep learning decision-making, innovatively introducing the probability of false blocking in the reward function to construct the DQN network;

[0032] Step S43: Network security management, collect network traffic data, system log data and user behavior data, perform real-time network anomaly detection, and when a network threat alarm is triggered, use the DQN network to make decisions, automatically output decision actions, and perform network security management.

[0033] The present invention provides an artificial intelligence-based network security management system, which includes a data set construction module, a behavior pattern modeling module, a network anomaly detection module and an intelligent decision-making module;

[0034] The data set building module collects network traffic data, system log data and user behavior data to generate a data set, and sends the data to the behavior pattern modeling module;

[0035] The behavior pattern modeling module receives the data sent by the dataset construction module, extracts features based on a hybrid of convolutional neural networks and recurrent neural networks, constructs an adaptive baseline, calculates a risk index, and sends the data to the network anomaly detection module;

[0036] The network anomaly detection module receives data sent by the behavior pattern modeling module, simulates network attacks through generative adversarial networks, performs anomaly feature comparison through self-supervised learning, and performs multimodal fusion discrimination through attention mechanism to detect anomalies, and sends the data to the intelligent decision-making module;

[0037] The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates strategies, and outputs the optimal response action to implement network security management.

[0038] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0039] (1) In response to the problems of single feature extraction, insufficient capture of temporal dependencies, and static anomaly baselines in traditional behavioral pattern modeling methods based on a single deep learning model, this solution achieves joint extraction of local and global features by fusing multi-layer convolutional neural networks and recurrent neural networks on time series data, constructs a historical behavior adaptive baseline, and dynamically calculates behavioral deviations and risk indexes, thereby improving the sensitivity to subtle behavioral anomalies and significantly enhancing the accuracy and real-time response capabilities of network anomaly detection.

[0040] (2) Aiming at the problems of network anomaly detection methods based on traditional rule-based supervised classification models, such as lack of attack samples leading to weak generalization ability, isolated use of multimodal information leading to blind spots in judgment, and difficulty in balancing detection accuracy and real-time performance, this scheme introduces generative adversarial networks to enrich extreme and rare attack samples, self-supervised learning to finely extract hidden anomaly features, and fuses convolutional features, adaptive baseline deviation and self-supervised anomaly scores under the attention mechanism. At the same time, it combines dynamic threshold triggering to achieve real-time alarm, thereby significantly improving the coverage and detection accuracy of unknown threats, reducing false alarm and missed alarm rates, and enhancing the real-time response capability of the system.

[0041] (3) In view of the problems that traditional network security response methods rely on static rules or manual configuration, such as slow response, lack of intelligent judgment, easy misjudgment and inability to dynamically adapt to changing threat environments, this solution introduces intelligent decision-making state modeling that integrates detection scores and risk indexes, constructs a multi-dimensional response action space, and implements reinforcement learning-driven response strategy selection based on the improved DQN network. It effectively improves the system's adaptive response capability in the face of complex network attacks, significantly enhances the real-time, accuracy and automation level of security management, reduces the cost of human intervention, and has good practical promotion value. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 A schematic diagram of an artificial intelligence-based network security management method provided by the present invention;

[0043] Figure 2 A schematic diagram of an artificial intelligence-based network security management system provided by the present invention;

[0044] Figure 3 is a schematic diagram of step S2;

[0045] Figure 4 is a schematic diagram of step S3;

[0046] Figure 5 is a schematic diagram of step S4.

[0047] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0048] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] In the description of the present invention, it should be understood that terms such as "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0050] Example 1, see Figure 1The present invention provides an artificial intelligence-based network security management method, which includes the following steps:

[0051] Step S1: Construct a data set, collect network traffic data, system log data and user behavior data and generate a data set;

[0052] Step S2: Behavioral pattern modeling, integrating multi-layer convolutional neural networks and recurrent neural networks on time series data, jointly extracting local and global features, constructing an adaptive baseline, and dynamically calculating behavioral deviations and risk indices;

[0053] Step S3: Network anomaly detection, which is performed through network attack simulation, self-supervised anomaly classification and multimodal fusion discrimination;

[0054] Step S4: Intelligent decision-making, by introducing the decision state modeling that integrates the detection score and the risk index, constructing a multi-dimensional response action space, and realizing reinforcement learning-driven response strategy selection based on the improved DQN network.

[0055] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, a data set is constructed, which specifically includes the following steps:

[0056] Step S11: Collecting raw data, specifically network traffic data, system log data, and user behavior data; the network traffic data specifically includes the usage time, source address, destination address, protocol type, port number, traffic volume, number of connections, and abnormal traffic ratio of the data packet; the system log data specifically includes log records of system login, logout, abnormal operation, and firewall alarm; the user behavior data includes user operation instructions and application interaction records;

[0057] Step S12: Generate a data set, specifically preprocessing and dividing the network traffic data, system log data and user behavior data obtained in step S11, including: parsing and segmenting the network traffic data according to protocol type, port number and timestamp; classifying the system log data according to login, logout, abnormal operation and firewall alarm event types; time-series encoding the user behavior data according to the operation instruction sequence and application interaction record; performing deduplication and outlier removal on all data; and finally dividing all samples into training set, validation set and test set in a ratio of 75:15:15 to generate the final data set.

[0058] Example 3, see Figure 1 and Figure 3 This embodiment is based on the above embodiment. In step S2, the behavior pattern modeling specifically includes the following contents:

[0059] Step S21: Hybrid feature extraction: construct an improved model consisting of a convolutional neural network and a recurrent neural network to extract local features from time series data and capture global time dependencies to form behavioral feature representations. The model specifically includes the following steps:

[0060] Step S211: Input representation, the original data of the t-th time step is represented as: ;Where t represents the index of the time step;

[0061] Step S212: Convolution feature extraction, using multi-layer convolution operations to extract local features, extracting features of local areas of the input data, as shown below:

[0062] ;

[0063] Among them, l represents the layer index of the convolution layer, represents the local features extracted by the lth convolutional layer at the tth time step, Represents a leaky linear rectifier function, i represents the index of the convolution kernel, k represents the size of the convolution kernel, represents the weight of the i-th convolution kernel in the l-th convolution layer, represents the original data of the t+i time step, Represents the convolution bias of the lth layer;

[0064] Step S213: Time series modeling, inputting the feature sequence extracted by the convolutional neural network into the recurrent neural network, capturing the time dependency, and completing the transformation from local features to global time series features, as shown below:

[0065] ;

[0066] in, represents the behavioral feature vector at the t-th time step, represents the hyperbolic tangent function, and represents the timing adjustment weight, represents the behavioral feature vector at the t-1th time step, represents the features extracted by the convolutional neural network, Indicates timing adjustment bias;

[0067] Step S214: Construct an adaptive baseline. Introduce historical behavior statistics to construct an adaptive baseline and calculate the behavioral feature deviation between the current state and the baseline, which is expressed as follows:

[0068] ;

[0069] in, Represents the baseline range factor, with a value range of [10, 30]; it is used to determine the sliding window size of the historical behavior feature vector; represents the adaptive baseline at the t-th time step, By calculating the past of the t-th time step The average value of the behavioral feature vectors of the time steps is obtained; j represents the index of the time step, represents the behavioral feature vector at the jth time step, represents the behavioral characteristic deviation at the t-th time step, Indicates modulus;

[0070] Step S22: Calculate the risk index, which is expressed as follows:

[0071] ;

[0072] in, represents the risk index at the t-th time step, and Indicates the balance coefficient, the value range is [0, 1]; represents the behavioral characteristic deviation at the j-th time step, Indicates the time step from The variance of all behavioral feature deviations between t and t.

[0073] By performing the above operations, the traditional behavioral pattern modeling method based on a single deep learning model has the problems of single feature extraction, insufficient capture of temporal dependencies, and static anomaly baselines. This solution realizes the joint extraction of local and global features by fusing multi-layer convolutional neural networks and recurrent neural networks on time series data, constructs a historical behavior adaptive baseline, and dynamically calculates behavioral deviations and risk indexes, thereby improving the sensitivity to subtle behavioral anomalies and significantly enhancing the accuracy and real-time response capabilities of network anomaly detection.

[0074] Example 4, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S3, the network anomaly detection specifically includes the following steps:

[0075] Step S31: Network attack simulation, using a generative adversarial network to generate potential network attack scenario data and construct an adversarial training framework, specifically including the following steps:

[0076] Step S311: Construct the objective function and transform the random noise As the generator input, the generator G outputs a synthetic behavior sample. The discriminator D judges the authenticity of the input sample and outputs the probability that the sample is a real sample. The entire adversarial process is trained with the following objective function:

[0077] ;

[0078] in, represents the adversarial loss function, Denotes that the generator minimizes the adversarial loss function while the discriminator maximizes the adversarial loss function, Indicates expectation, represents the real data distribution, represents data sampled from real data, Represents the discriminator’s judgment result on the data Y, represents the logarithmic function, c represents the noise factor, and its value range is [0.5, 2.0]; It means that it obeys a normal distribution with a mean of 0 and a variance of c. represents random noise, represents the data generated by the generator using random noise q as input, represents the auxiliary regularization coefficient, and its value range is [1.0, 10.0]; represents interpolation samples uniformly sampled between real data and generated data, Represents the discriminator's The judgment result of represents the discriminator output For input data gradient;

[0079] Step S312: enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data;

[0080] Step S32: Self-supervised anomaly classification, using self-supervised learning to compare the features of the generated potential attack samples with the real samples, and calculate the anomaly score, which is expressed as follows:

[0081] ;

[0082] in, represents the self-supervised anomaly score at the t-th time step, and Represents the encoders of the self-supervised network SimCLR architecture and BYOL architecture respectively;

[0083] Step S33: Multimodal fusion discrimination, the features extracted by the convolutional neural network, the baseline deviation and the self-supervised anomaly score are fused through the attention mechanism to form the final discrimination score, which is expressed as follows:

[0084] ;

[0085] in, represents the final discriminant score at the t-th time step, represents the Sigmoid function, 、 and represents the multimodal fusion weight, Represents the multimodal fusion bias;

[0086] Step S34: Anomaly detection, setting anomaly score threshold , the value range is [0, 1]; when the final discrimination score is greater than the anomaly score threshold, a network threat alert is triggered.

[0087] By performing the above operations, the traditional network anomaly detection method based on rule-based supervised classification models has the problems of weak generalization ability due to lack of attack samples, blind spots in judgment due to isolated use of multimodal information, and difficulty in balancing detection accuracy and real-time performance. This solution introduces generative adversarial networks to enrich extreme and rare attack samples, uses self-supervised learning to finely extract hidden anomaly features, and integrates convolutional features, adaptive baseline deviation and self-supervised anomaly scores under the attention mechanism. At the same time, it combines dynamic threshold triggering to achieve real-time alarms, thereby significantly improving the coverage and detection accuracy of unknown threats, reducing false alarm and missed alarm rates, and enhancing the system's real-time response capabilities.

[0088] Example 5, see Figure 1 and Figure 5 This embodiment is based on the above embodiment. In step S4, the intelligent decision-making, after detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system to take a response. Specifically, the following steps are included:

[0089] Step S41: define states and actions, specifically including the following steps:

[0090] Step S411: Define decision status, decision status By the current detection score and risk index Composition, expressed as: ;in, represents the decision state at the tth time step;

[0091] Step S412: Define decision actions, introduce four decision actions, and create an action space, which is expressed as follows:

[0092] ;

[0093] in, represents the action space, Indicates blocking the connection, Indicates speed limit, Indicates the generation of sandbox traffic, Indicates notification alarm;

[0094] Step S42: Deep learning decision-making, innovatively introducing the probability of false blocking in the reward function , build a DQN network , using the following update rule:

[0095] ;

[0096] in, Indicates that it is in the decision-making state The decision action taken represents the reward function value, 、 and represents the reward weight; Represents an indicator function, which takes the value 1 when the decision action is to block the connection, otherwise it takes the value 0; Indicates the probability that the current action will block the normal connection; represents the error factor, Represents the discount coefficient, the value range is (0.7, 1); represents the decision state at the t+1th time step, Indicates that the status Any of all possible decision actions, represents the parameters of the target decision network, represents the parameters of the actual decision network, Indicates that it is in the decision-making state and decision-making actions The maximum expected benefit of the target decision network under Indicates that it is in the decision-making state and decision-making actions The actual decision network under represents the parameters of the actual decision network after update, represents the parameters of the actual decision network before updating, Represents the decision learning rate that controls the update step size of network parameters. The preferred value range is ; Represents the actual decision network About parameters gradient;

[0097] Step S43: Network security management, collect network traffic data, system log data and user behavior data, perform real-time network anomaly detection, and when a network threat alarm is triggered, use the DQN network to make decisions, automatically output decision actions, and perform network security management.

[0098] By performing the above operations, traditional network security response methods rely on static rules or manual configuration, and have problems such as slow response, lack of intelligent judgment, easy misjudgment, and inability to dynamically adapt to changing threat environments. This solution introduces intelligent decision-making state modeling that integrates detection scores and risk indexes, constructs a multi-dimensional response action space, and implements reinforcement learning-driven response strategy selection based on an improved DQN network. This effectively improves the system's adaptive response capability in the face of complex network attacks, significantly enhances the real-time, accuracy, and automation level of security management, reduces the cost of human intervention, and has good practical promotion value.

[0099] Example 6, see Figure 1 and Figure 2 , this embodiment is based on the above embodiment, and the present invention provides an artificial intelligence-based network security management system, including a data set construction module, a behavior pattern modeling module, a network anomaly detection module and an intelligent decision-making module;

[0100] The data set building module collects network traffic data, system log data and user behavior data to generate a data set, and sends the data to the behavior pattern modeling module;

[0101] The behavior pattern modeling module receives the data sent by the dataset construction module, extracts features based on a hybrid of convolutional neural networks and recurrent neural networks, constructs an adaptive baseline, calculates a risk index, and sends the data to the network anomaly detection module;

[0102] The network anomaly detection module receives data sent by the behavior pattern modeling module, simulates network attacks through generative adversarial networks, performs anomaly feature comparison through self-supervised learning, and performs multimodal fusion discrimination through attention mechanism to detect anomalies, and sends the data to the intelligent decision-making module;

[0103] The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates strategies, and outputs the optimal response action to implement network security management.

[0104] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0105] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that various changes, modifications, substitutions, and alterations can be made to the embodiments without departing from the principles and spirit of the invention.

[0106] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A network security management method based on artificial intelligence, characterized in that: The method comprises the following steps: Step S1: Construct a data set, collect network traffic data, system log data and user behavior data and generate a data set; Step S2: Behavioral pattern modeling, integrating multi-layer convolutional neural networks and recurrent neural networks on time series data, jointly extracting local and global features, constructing an adaptive baseline, and dynamically calculating behavioral deviations and risk indices; Step S3: Network anomaly detection, which is performed through network attack simulation, self-supervised anomaly classification and multimodal fusion discrimination; Step S4: Intelligent decision-making, by introducing the decision state modeling that integrates the detection score and the risk index, constructing a multi-dimensional response action space, and realizing reinforcement learning-driven response strategy selection based on the improved DQN network.

2. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S1, a data set is constructed, which specifically includes the following steps: Step S11: Collecting raw data, specifically collecting network traffic data, system log data, and user behavior data; Step S12: Generate a data set, specifically pre-process and divide the network traffic data, system log data and user behavior data obtained in step S11 to generate a data set.

3. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S2, the behavior pattern modeling specifically includes the following: Step S21: Hybrid feature extraction: construct an improved model consisting of a convolutional neural network and a recurrent neural network to extract local features from time series data and capture global time dependencies to form behavioral feature representations. The model specifically includes the following steps: Step S211: input representation; Step S212: Convolution feature extraction, using multi-layer convolution operations to extract local features, and extract features of local areas of the input data; Step S213: Time series modeling, inputting the feature sequence extracted by the convolutional neural network into the recurrent neural network to capture the time dependency and complete the transformation from local features to global time series features; Step S214: construct an adaptive baseline, introduce historical behavior statistics to construct an adaptive baseline, and calculate the behavioral feature deviation between the current state and the baseline; Step S22: Calculate the risk index.

4. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S3, the network anomaly detection specifically includes the following steps: Step S31: Network attack simulation, using a generative adversarial network to generate potential network attack scenario data and construct an adversarial training framework, specifically including the following steps: Step S311: Construct an objective function, use random noise as the generator input, the generator outputs a synthetic behavior sample, the discriminator judges the authenticity of the input sample, and outputs the probability that the sample is a real sample, and constructs the objective function to train the adversarial process; Step S312: enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data; Step S32: Self-supervised anomaly classification, using self-supervised learning to compare the features of the generated potential attack samples with the real samples and calculate the anomaly score; Step S33: Multimodal fusion discrimination, which fuses the features extracted by the convolutional neural network, the baseline deviation, and the self-supervised anomaly score through the attention mechanism to form the final discrimination score; Step S34: Anomaly detection, setting an anomaly score threshold, and triggering a network threat alarm when the final judgment score is greater than the anomaly score threshold.

5. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S4, the intelligent decision-making, after detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system to take a response. Specifically, the following steps are included: Step S41: define states and actions, specifically including the following steps: Step S411: define the decision state, and combine the detection score and risk index into the decision state; Step S412: Define decision actions and introduce four decision actions: blocking the connection, limiting the speed, generating sandbox traffic, and notifying an alarm, to create an action space; Step S42: Deep learning decision-making, innovatively introducing the probability of false blocking in the reward function to construct the DQN network; Step S43: Network security management, collect network traffic data, system log data and user behavior data, perform real-time network anomaly detection, and when a network threat alarm is triggered, use the DQN network to make decisions, automatically output decision actions, and perform network security management.

6. An artificial intelligence-based network security management system, used to implement an artificial intelligence-based network security management method according to any one of claims 1 to 5, characterized in that: It includes a dataset construction module, a behavior pattern modeling module, a network anomaly detection module and an intelligent decision-making module.

7. The artificial intelligence-based network security management system according to claim 6, characterized in that: The data set building module collects network traffic data, system log data and user behavior data to generate a data set, and sends the data to the behavior pattern modeling module; The behavior pattern modeling module receives the data sent by the dataset construction module, extracts features based on a hybrid of convolutional neural networks and recurrent neural networks, constructs an adaptive baseline, calculates a risk index, and sends the data to the network anomaly detection module; The network anomaly detection module receives data sent by the behavior pattern modeling module, simulates network attacks through generative adversarial networks, performs anomaly feature comparison through self-supervised learning, and performs multimodal fusion discrimination through attention mechanism to detect anomalies, and sends the data to the intelligent decision-making module; The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates strategies, and outputs the optimal response action to implement network security management.

Images