An artificial intelligence-based network security management method and system

Abstract

The application discloses a network security management method and system based on artificial intelligence, and the content comprises constructing a training data set, behavior pattern modeling, network anomaly detection and intelligent decision-making. The application relates to the technical field of network security, and particularly discloses a network security management method and system based on artificial intelligence. The scheme constructs a time sequence behavior modeling framework integrating a convolutional neural network and a recurrent neural network, extracts behavior pattern features of users and devices, generates diversified attack samples by using an adversarial generative network, realizes multi-modal anomaly detection by combining self-supervised learning and an attention mechanism, realizes dynamic generation and automatic adjustment of a response strategy for a security event based on a decision-making model optimized based on an improved deep reinforcement learning strategy, effectively improves the accuracy and robustness of a network intrusion detection system, and has good scalability and real-time performance, and is suitable for complex and changeable network security protection scenes.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security management method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of network technology, the network environment is becoming increasingly complex, and network attack methods are showing a trend towards intelligence and diversification, seriously threatening the stable operation of systems and data security. Traditional network security management methods mainly rely on rule bases or static models, which have problems such as limited detection capabilities, delayed response, and inability to identify unknown threats.

[0003] In existing technologies, network behavior analysis models are mostly based on a single neural network structure, which makes it difficult to extract local features and global temporal relationships simultaneously, and the ability to recognize behavior patterns is limited. Most existing anomaly detection methods are based on static thresholds or known attack samples, which are difficult to deal with variant attacks and covert threats. At the same time, current network security response mechanisms rely heavily on manual configuration, lack intelligence and adaptive capabilities, and cannot dynamically adjust protection strategies according to the threat level. Response efficiency and accuracy need to be improved. Summary of the Invention

[0004] To address the above issues and overcome the shortcomings of existing technologies, this invention provides an artificial intelligence-based network security management method and system. Addressing the problems of traditional behavior pattern modeling methods based on single deep learning models, such as limited feature extraction, insufficient capture of temporal dependencies, and static anomaly benchmarks, this solution integrates multi-layer convolutional neural networks and recurrent neural networks on temporal data to achieve joint extraction of local and global features, constructing an adaptive baseline for historical behavior and dynamically calculating behavior deviations and risk indices. Furthermore, existing anomaly detection methods, mostly based on static thresholds or known attack samples, struggle to cope with variant attacks and covert threats, suffer from blind spots due to isolated use of multimodal information, and are difficult to integrate with other technologies. To address the issues of detection accuracy and real-time performance, this solution introduces generative adversarial networks to enrich extreme and rare attack samples, self-supervised learning to finely extract hidden anomaly features, and integrates convolutional features, adaptive baseline bias, and self-supervised anomaly scores under an attention mechanism. It also incorporates dynamic threshold triggering to achieve real-time alarms. Furthermore, addressing the problems of traditional network security response methods relying on static rules or manual configuration, which suffer from slow response, lack of intelligent judgment, susceptibility to misjudgment, and inability to dynamically adapt to changing threat environments, this solution introduces intelligent decision-making state modeling that integrates detection scores and risk indices to construct a multi-dimensional action space for response. Finally, it implements reinforcement learning-driven response strategy selection based on an improved DQN network.

[0005] The technical solution adopted in this invention is as follows: A network security management method and system based on artificial intelligence, the method comprising the following steps:

[0006] Step S1: Construct the dataset;

[0007] Step S2: Behavioral pattern modeling;

[0008] Step S3: Network anomaly detection;

[0009] Step S4: Intelligent decision-making.

[0010] Further, in step S1, the dataset is constructed, specifically including the following steps:

[0011] Step S11: Collect raw data, specifically network traffic data, system log data, and user behavior data;

[0012] Step S12: Generate a dataset. Specifically, the network traffic data, system log data, and user behavior data obtained in step S11 are preprocessed and divided to generate a dataset.

[0013] Furthermore, in step S2, the behavioral pattern modeling specifically includes the following:

[0014] Step S21: Hybrid feature extraction. Construct an improved model composed of convolutional neural networks and recurrent neural networks to extract local features from time-series data and capture global temporal dependencies, forming behavioral feature representations. This specifically includes the following steps:

[0015] Step S211: Input representation;

[0016] Step S212: Convolutional feature extraction, using multi-layer convolution operations to extract local features, extracting features from local regions of the input data;

[0017] Step S213: Temporal modeling, inputting the feature sequence extracted by the convolutional neural network into the recurrent neural network to capture the temporal dependency and complete the transformation from local features to global temporal features;

[0018] Step S214: Construct an adaptive baseline by introducing historical behavior statistics to construct an adaptive baseline and calculate the behavioral feature deviation between the current state and the baseline;

[0019] Step S22: Calculate the risk index.

[0020] Furthermore, in step S3, the network anomaly detection specifically includes the following steps:

[0021] Step S31: Network attack simulation. Generative adversarial networks (GANs) are used to generate potential network attack scenario data, and an adversarial training framework is constructed. This specifically includes the following steps:

[0022] Step S311: Construct an objective function, take random noise as the generator input, the generator outputs synthetic behavior samples, the discriminator judges the authenticity of the input samples and outputs the probability that the sample is a real sample, and construct the objective function to train the adversarial process;

[0023] Step S312: Enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data;

[0024] Step S32: Self-supervised anomaly classification. Self-supervised learning is used to compare the features of the generated potential attack samples with real samples and calculate the anomaly score.

[0025] Step S33: Multimodal fusion discrimination, which integrates the features extracted by the convolutional neural network, baseline bias and self-supervised anomaly scores through an attention mechanism to form the final discrimination score;

[0026] Step S34: Anomaly detection. Set an anomaly score threshold. When the final judgment score is greater than the anomaly score threshold, trigger a network threat alarm.

[0027] Furthermore, in step S4, the intelligent decision-making process, upon detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system in taking a response; specifically, it includes the following steps:

[0028] Step S41: Define the state and action, specifically including the following steps:

[0029] Step S411: Define the decision state by combining the detection score and the risk index;

[0030] Step S412: Define decision actions, introduce four decision actions, namely blocking connection, rate limiting, generating sandbox traffic and issuing alarms, and create action space;

[0031] Step S42: Deep learning decision-making, innovatively introducing false rejection probability into the reward function to construct the DQN network;

[0032] Step S43: Network security management, collecting network traffic data, system log data and user behavior data, performing real-time network anomaly detection, and when a network threat alarm is triggered, using the DQN network to make decisions and automatically output decision actions to perform network security management.

[0033] The present invention provides an artificial intelligence-based network security management system, including a dataset construction module, a behavior pattern modeling module, a network anomaly detection module, and an intelligent decision-making module;

[0034] The dataset construction module collects network traffic data, system log data, and user behavior data, generates a dataset, and sends the data to the behavior pattern modeling module.

[0035] The behavior pattern modeling module receives data sent by the dataset construction module, extracts features based on a hybrid convolutional neural network and a recurrent neural network, constructs an adaptive baseline and calculates a risk index, and then sends the data to the network anomaly detection module.

[0036] The network anomaly detection module receives data sent by the behavior pattern modeling module, performs anomaly detection by generating adversarial networks to simulate network attacks, comparing anomaly features through self-supervised learning, and using multimodal fusion discrimination through attention mechanisms, and then sends the data to the intelligent decision-making module.

[0037] The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates policies, and outputs the optimal response action to implement network security management.

[0038] The beneficial effects achieved by the present invention using the above solution are as follows:

[0039] (1) In view of the problems of single feature extraction, insufficient capture of temporal dependence and static abnormal benchmark in traditional behavior pattern modeling methods based on a single deep learning model, this scheme achieves joint extraction of local and global features by integrating multi-layer convolutional neural networks and recurrent neural networks on temporal data, constructs an adaptive baseline of historical behavior and dynamically calculates behavior deviation and risk index, which improves the sensitivity to subtle behavioral anomalies and significantly enhances the accuracy of network anomaly detection and real-time response capability.

[0040] (2) To address the problems of weak generalization ability due to the lack of attack samples, the blind spot caused by the isolated use of multimodal information, and the difficulty in balancing detection accuracy and real-time performance in traditional rule-based supervised classification model network anomaly detection methods, this scheme introduces generative adversarial networks to enrich extreme and rare attack samples, refines hidden anomaly features through self-supervised learning, and integrates convolutional features, adaptive baseline bias and self-supervised anomaly scores under the attention mechanism. At the same time, it combines dynamic threshold triggering to realize real-time alarm, thereby significantly improving the coverage and detection accuracy of unknown threats, reducing the false alarm and false negative rates, and enhancing the real-time response capability of the system.

[0041] (3) In view of the problems that traditional network security response methods rely on static rules or manual configuration, such as slow response, lack of intelligent judgment, easy misjudgment and inability to dynamically adapt to the changing threat environment, this solution introduces intelligent decision state modeling that integrates detection scores and risk indices to construct a multi-dimensional response action space, and realizes reinforcement learning-driven response strategy selection based on the improved DQN network. This effectively improves the system's adaptive response capability in the face of complex network attacks, significantly enhances the real-time performance, accuracy and automation level of security management, reduces the cost of human intervention, and has good practical promotion value. Attached Figure Description

[0042] Figure 1 A schematic diagram illustrating an artificial intelligence-based network security management method provided by the present invention;

[0043] Figure 2 A schematic diagram of an artificial intelligence-based network security management system provided by the present invention;

[0044] Figure 3 This is a schematic diagram of step S2;

[0045] Figure 4 This is a schematic diagram of step S3;

[0046] Figure 5 This is a schematic diagram of step S4.

[0047] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0048] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0049] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0050] Example 1, see Figure 1This invention provides an artificial intelligence-based network security management method, which includes the following steps:

[0051] Step S1: Construct a dataset by collecting network traffic data, system log data, and user behavior data and generating the dataset;

[0052] Step S2: Behavioral pattern modeling, which integrates multi-layer convolutional neural networks and recurrent neural networks on time-series data, jointly extracts local and global features, constructs an adaptive baseline, and dynamically calculates behavioral bias and risk index;

[0053] Step S3: Network anomaly detection, which is performed through network attack simulation, self-supervised anomaly classification, and multimodal fusion discrimination.

[0054] Step S4: Intelligent decision-making. By introducing decision state modeling that integrates detection scores and risk indices, a multi-dimensional response action space is constructed, and reinforcement learning-driven response strategy selection is achieved based on an improved DQN network.

[0055] Example 2, see Figure 1 This embodiment is based on the above embodiment. In step S1, the dataset is constructed, which specifically includes the following steps:

[0056] Step S11: Collect raw data, specifically network traffic data, system log data, and user behavior data; the network traffic data specifically includes the usage time of data packets, source address, destination address, protocol type, port number, traffic volume, number of connections, and abnormal traffic ratio; the system log data specifically includes log records of system login, logout, abnormal operations, and firewall alarms; the user behavior data includes user operation commands and application interaction records.

[0057] Step S12: Generate the dataset. Specifically, preprocess and segment the network traffic data, system log data, and user behavior data obtained in Step S11. This includes: parsing and segmenting the network traffic data according to protocol type, port number, and timestamp; classifying the system log data according to login, logout, abnormal operation, and firewall alarm event types; performing time-series encoding on the user behavior data according to the operation command sequence and application interaction records; performing deduplication and outlier removal on all data; and finally, dividing all samples into training set, validation set, and test set in a 75:15:15 ratio to generate the final dataset.

[0058] Example 3, see Figure 1 and Figure 3 This embodiment is based on the above embodiment. In step S2, the behavior pattern modeling specifically includes the following:

[0059] Step S21: Hybrid feature extraction. Construct an improved model composed of convolutional neural networks and recurrent neural networks to extract local features from time-series data and capture global temporal dependencies, forming behavioral feature representations. This specifically includes the following steps:

[0060] Step S211: Input representation, the original data at time step t is represented as: Where t represents the index of the time step;

[0061] Step S212: Convolutional feature extraction. Multi-layer convolution operations are used to extract local features from the local regions of the input data, as shown below:

[0062] ;

[0063] Where l represents the layer index of the convolutional layer. This represents the local features extracted by the l-th convolutional layer at time step t. Let represent a leaky linear rectified function, where i represents the index of the convolution kernel and k represents the size of the convolution kernel. This represents the weight of the i-th convolutional kernel in the l-th convolutional layer. This represents the raw data at time step (t+i). This represents the convolution bias of the l-th layer;

[0064] Step S213: Temporal modeling. The feature sequence extracted by the convolutional neural network is input into the recurrent neural network to capture the temporal dependencies, completing the transformation from local features to global temporal features, as shown below:

[0065] ;

[0066] in, This represents the behavioral feature vector at time step t. Represents the hyperbolic tangent function. and Indicates the timing adjustment weight. This represents the behavioral feature vector at time step (t-1). This represents the features extracted by the convolutional neural network. Indicates timing adjustment bias;

[0067] Step S214: Construct an adaptive baseline. Introduce historical behavior statistics to construct an adaptive baseline, and calculate the behavioral feature deviation between the current state and the baseline, as shown below:

[0068] ;

[0069] in, This represents the baseline range factor, with a value range of [10, 30]; it is used to determine the sliding window size of the historical behavior feature vector. This represents the adaptive baseline at time step t. By calculating the past at time step t It is obtained by averaging the behavioral feature vectors of each time step; j represents the index of the time step. This represents the behavioral feature vector at the j-th time step. This represents the behavioral characteristic deviation at time step t. Indicates modulo;

[0070] Step S22: Calculate the risk index, as shown below:

[0071] ;

[0072] in, This represents the risk index at time step t. and This represents the balance coefficient, with a value range of [0, 1]. This represents the behavioral characteristic deviation at the j-th time step. Indicates time step from The variance of all behavioral characteristic deviations between t and t.

[0073] By performing the above operations, this solution addresses the problems of traditional behavior pattern modeling methods based on a single deep learning model, such as limited feature extraction, insufficient capture of temporal dependencies, and static anomaly baselines. This solution achieves joint extraction of local and global features by fusing multi-layer convolutional neural networks and recurrent neural networks on temporal data, constructs an adaptive baseline for historical behavior, and dynamically calculates behavior deviations and risk indices. This improves the sensitivity to subtle behavioral anomalies and significantly enhances the accuracy and real-time response capability of network anomaly detection.

[0074] Example 4, see Figure 1 and Figure 4 This embodiment is based on the above embodiment. In step S3, the network anomaly detection specifically includes the following steps:

[0075] Step S31: Network attack simulation. Generative adversarial networks (GANs) are used to generate potential network attack scenario data, and an adversarial training framework is constructed. This specifically includes the following steps:

[0076] Step S311: Construct the objective function to convert random noise. As input to the generator, the generator G outputs synthesized behavioral samples. The discriminator D judges the authenticity of the input samples and outputs the probability that a sample is a real sample. The entire adversarial process is trained using the following objective function:

[0077] ;

[0078] in, Represents the adversarial loss function. This means that the generator minimizes the adversarial loss function while the discriminator maximizes the adversarial loss function. Indicates taking the expected value. Represents the true data distribution. This refers to data sampled from real data. This indicates the discriminator's judgment result on data Y. Let represent the logarithmic function, and c represent the noise factor, with a value range of [0.5, 2.0]. This indicates that the distribution follows a normal distribution with a mean of 0 and a variance of c. Indicates random noise. This indicates that the generator uses random noise q as input to generate data. This represents the auxiliary regularization coefficient, with a value range of [1.0, 10.0]. This represents an interpolated sample uniformly sampled between real and generated data. This indicates that the discriminator is sensitive to the data. The judgment result, Indicates the output of the discriminator For input data The gradient;

[0079] Step S312: Enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data;

[0080] Step S32: Self-supervised anomaly classification. Self-supervised learning is used to compare the features of the generated potential attack samples with those of real samples, and anomaly scores are calculated, as shown below:

[0081] ;

[0082] in, This represents the self-supervised anomaly score at time step t. and These represent the encoders of the self-supervised network SimCLR architecture and the BYOL architecture, respectively.

[0083] Step S33: Multimodal fusion discrimination. The features extracted by the convolutional neural network, baseline bias, and self-supervised anomaly scores are fused through an attention mechanism to form the final discrimination score, as shown below:

[0084] ;

[0085] in, Let represent the final discrimination score at time step t. This represents the Sigmoid function. , and Indicates the multimodal fusion weights. Indicates the multimodal fusion bias;

[0086] Step S34: Anomaly detection, setting anomaly score threshold The value range is [0, 1]; when the final judgment score is greater than the abnormal score threshold, a network threat alarm is triggered.

[0087] By performing the above operations, this solution addresses the problems of traditional rule-based supervised classification models for network anomaly detection, such as a lack of attack samples leading to weak generalization ability, isolated use of multimodal information resulting in discrimination blind spots, and difficulty in balancing detection accuracy and real-time performance. It introduces generative adversarial networks to enrich extreme and rare attack samples, employs self-supervised learning to finely extract hidden anomaly features, and fuses convolutional features, adaptive baseline bias, and self-supervised anomaly scores under an attention mechanism. Furthermore, it combines dynamic threshold triggering to achieve real-time alarms, thereby significantly improving the coverage and detection accuracy of unknown threats, reducing false positives and false negatives, and enhancing the system's real-time response capability.

[0088] Example 5, see Figure 1 and Figure 5 This embodiment is based on the above embodiment. In step S4, the intelligent decision-making, after detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system to respond; specifically, it includes the following steps:

[0089] Step S41: Define the state and action, specifically including the following steps:

[0090] Step S411: Define the decision state. Based on the current detection score and risk index Composition, represented as: ;in, This represents the decision state at time step t;

[0091] Step S412: Define decision actions, introduce four types of decision actions, and create an action space, represented as follows:

[0092] ;

[0093] in, Represents the action space, Indicates blocking the connection. Indicates speed limit, Indicates the generated sandbox flow, This indicates a notification or alarm.

[0094] Step S42: Deep learning decision-making, innovatively introducing false rejection probability into the reward function. Constructing a DQN network The following update rules apply:

[0095] ;

[0096] in, Indicates the state of decision-making. The decision-making actions taken below This represents the reward function value. , and Indicates the reward weight; This indicates an indicator function, which takes a value of 1 when the decision action is to block the connection, and 0 otherwise. This indicates the probability that the current action will cause the normal connection to be blocked; Indicates the error factor. This represents the discount factor, with a value range of (0.7, 1). This represents the decision state at time step t+1. Indicates the state Any one of the possible decision actions to take. The parameters represent the target decision network. The parameters represent the actual decision-making network. Indicates the state of decision-making. and decision-making actions The maximum expected return of the target decision network. Indicates the state of decision-making. and decision-making actions The actual decision-making network below, This represents the parameters of the updated actual decision network. This represents the parameters of the actual decision network before the update. The decision learning rate represents the step size for updating network parameters, and its preferred value range is... ; Represents the actual decision-making network Regarding parameters The gradient;

[0097] Step S43: Network security management, collecting network traffic data, system log data and user behavior data, performing real-time network anomaly detection, and when a network threat alarm is triggered, using the DQN network to make decisions and automatically output decision actions to perform network security management.

[0098] By performing the above operations, this solution addresses the problems of traditional network security response methods, which rely on static rules or manual configuration, resulting in slow response, lack of intelligent judgment, susceptibility to misjudgment, and inability to dynamically adapt to changing threat environments. It introduces intelligent decision-making state modeling that integrates detection scores and risk indices to construct a multi-dimensional response action space. Furthermore, based on an improved DQN network, it implements reinforcement learning-driven response strategy selection, effectively improving the system's adaptive response capability in the face of complex network attacks. This significantly enhances the real-time performance, accuracy, and automation level of security management, reduces the cost of human intervention, and possesses significant practical and promotional value.

[0099] Example 6, see Figure 1 and Figure 2 Based on the above embodiments, this embodiment provides an artificial intelligence-based network security management system, including a dataset construction module, a behavior pattern modeling module, a network anomaly detection module, and an intelligent decision-making module.

[0100] The dataset construction module collects network traffic data, system log data, and user behavior data, generates a dataset, and sends the data to the behavior pattern modeling module.

[0101] The behavior pattern modeling module receives data sent by the dataset construction module, extracts features based on a hybrid convolutional neural network and a recurrent neural network, constructs an adaptive baseline and calculates a risk index, and then sends the data to the network anomaly detection module.

[0102] The network anomaly detection module receives data sent by the behavior pattern modeling module, performs anomaly detection by generating adversarial networks to simulate network attacks, comparing anomaly features through self-supervised learning, and using multimodal fusion discrimination through attention mechanisms, and then sends the data to the intelligent decision-making module.

[0103] The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates policies, and outputs the optimal response action to implement network security management.

[0104] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0105] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention.

[0106] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A network security management method based on artificial intelligence, characterized in that, The method includes the following steps: Step S1: Construct a dataset by collecting network traffic data, system log data, and user behavior data and generating the dataset; Step S2: Behavioral pattern modeling, which integrates multi-layer convolutional neural networks and recurrent neural networks on time-series data, jointly extracts local and global features, constructs an adaptive baseline, and dynamically calculates behavioral bias and risk index; Step S21: Hybrid feature extraction. Construct an improved model composed of convolutional neural networks and recurrent neural networks to extract local features from time-series data and capture global temporal dependencies, forming behavioral feature representations. This specifically includes the following steps: Step S211: Input representation, the original data at time step t is represented as: Where t represents the index of the time step; Step S212: Convolutional feature extraction. Multi-layer convolution operations are used to extract local features from the local regions of the input data, as shown below: ； Where l represents the layer index of the convolutional layer. This represents the local features extracted by the l-th convolutional layer at time step t. Let represent a leaky linear rectified function, where i represents the index of the convolution kernel and k represents the size of the convolution kernel. This represents the weight of the i-th convolutional kernel in the l-th convolutional layer. This represents the raw data at time step t+i. This represents the convolution bias of the l-th layer; Step S213: Temporal modeling. The feature sequence extracted by the convolutional neural network is input into the recurrent neural network to capture temporal dependencies, completing the transformation from local features to global temporal features, as shown below: ； in, This represents the behavioral feature vector at time step t. Represents the hyperbolic tangent function. and Indicates the timing adjustment weight. This represents the behavioral feature vector at time step (t-1). This represents the features extracted by the convolutional neural network. Indicates timing adjustment bias; Step S214: Construct an adaptive baseline. Introduce historical behavior statistics to construct an adaptive baseline, and calculate the behavioral feature deviation between the current state and the baseline, as shown below: ； in, This represents the baseline range factor, with a value range of [10, 30]; it is used to determine the sliding window size of the historical behavior feature vector. This represents the adaptive baseline at time step t. By calculating the past at time step t It is obtained by averaging the behavioral feature vectors of each time step; j represents the index of the time step. This represents the behavioral feature vector at the j-th time step. This represents the behavioral characteristic deviation at time step t. Indicates modulo; Step S3: Network anomaly detection, which is performed through network attack simulation, self-supervised anomaly classification, and multimodal fusion discrimination. Step S31: Network attack simulation. Generative adversarial networks (GANs) are used to generate potential network attack scenario data, and an adversarial training framework is constructed. This specifically includes the following steps: Step S311: Construct the objective function to convert random noise. As input to the generator, the generator G outputs synthesized behavioral samples. The discriminator D judges the authenticity of the input samples and outputs the probability that a sample is a real sample. The entire adversarial process is trained using the following objective function: ； in, Represents the adversarial loss function. This means that the generator minimizes the adversarial loss function while the discriminator maximizes the adversarial loss function. Indicates taking the expected value. Represents the true data distribution. This refers to data sampled from real data. This indicates the discriminator's judgment result on data Y. Let represent the logarithmic function, and c represent the noise factor, with a value range of [0.5, 2.0]. This indicates that the distribution follows a normal distribution with a mean of 0 and a variance of c. Indicates random noise. This indicates that the generator uses random noise q as input to generate data. This represents the auxiliary regularization coefficient, with a value range of [1.0, 10.0]. This represents an interpolated sample uniformly sampled between real and generated data. This indicates that the discriminator is sensitive to the data. The judgment result, Indicates the output of the discriminator For input data The gradient; Step S312: Enrich the model anomaly sample library, use the generator to generate network attack simulation samples, and add network attack scenario data; Step S4: Intelligent decision-making. By introducing decision state modeling that integrates detection scores and risk indices, a multi-dimensional response action space is constructed, and reinforcement learning-driven response strategy selection is achieved based on an improved DQN network.

2. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S2, the behavioral pattern modeling further includes the following steps: Step S22: Calculate the risk index, as shown below: ； in, This represents the risk index at time step t. and This represents the balance coefficient, with a value range of [0, 1]. This represents the behavioral characteristic deviation at the j-th time step. Indicates time step from The variance of all behavioral characteristic deviations between t and t.

3. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S3, the network anomaly detection further includes the following steps: Step S32: Self-supervised anomaly classification. Self-supervised learning is used to compare the features of the generated potential attack samples with those of real samples, and anomaly scores are calculated, as shown below: ； in, This represents the self-supervised anomaly score at time step t. and These represent the encoders of the self-supervised network SimCLR architecture and the BYOL architecture, respectively. Step S33: Multimodal fusion discrimination. The features extracted by the convolutional neural network, baseline bias, and self-supervised anomaly scores are fused through an attention mechanism to form the final discrimination score, as shown below: ； in, Let represent the final discrimination score at time step t. This represents the Sigmoid function. , and Indicates the multimodal fusion weights. Indicates the multimodal fusion bias; Step S34: Anomaly detection. Set an anomaly score threshold. When the final judgment score is greater than the anomaly score threshold, trigger a network threat alarm.

4. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S4, the intelligent decision-making process, upon detecting a potential threat, introduces reinforcement learning and adaptive strategies to guide the system in taking a response; specifically, it includes the following steps: Step S41: Define the state and action, specifically including the following steps: Step S411: Define the decision state. Based on the current detection score and risk index Composition, represented as: ;in, This represents the decision state at time step t; Step S412: Define decision actions, introduce four types of decision actions, and create an action space, represented as follows: ； in, Represents the action space. Indicates blocking the connection. Indicates speed limit, Indicates the generated sandbox flow, This indicates an alert or warning. Step S42: Deep learning decision-making, innovatively introducing false rejection probability into the reward function. Constructing a DQN network The following update rules apply: ； in, Indicates the state of decision-making. The decision-making actions taken below This represents the reward function value. , and Indicates the reward weight; This indicates an indicator function, which takes a value of 1 when the decision action is to block the connection, and 0 otherwise. This indicates the probability that the current action will cause the normal connection to be blocked; Indicates the error factor. This represents the discount factor, with a value range of (0.7, 1). This represents the decision state at time step t+1. Indicates the state Any one of the possible decision actions to take. The parameters represent the target decision network. The parameters represent the actual decision-making network. Indicates the state of decision-making. and decision-making actions The maximum expected return of the target decision network. Indicates the state of decision-making. and decision-making actions The actual decision-making network below, This represents the parameters of the updated actual decision network. This represents the parameters of the actual decision network before the update. The decision learning rate represents the step size for updating network parameters, and its preferred value range is... ; Represents the actual decision-making network Regarding parameters The gradient; Step S43: Network security management, collecting network traffic data, system log data and user behavior data, performing real-time network anomaly detection, and when a network threat alarm is triggered, using the DQN network to make decisions and automatically output decision actions to perform network security management.

5. The network security management method based on artificial intelligence according to claim 1, characterized in that: In step S1, the dataset is constructed, which specifically includes the following steps: Step S11: Collect raw data, specifically network traffic data, system log data, and user behavior data; Step S12: Generate a dataset. Specifically, the network traffic data, system log data, and user behavior data obtained in step S11 are preprocessed and divided to generate a dataset.

6. An artificial intelligence-based network security management system, used to implement the artificial intelligence-based network security management method as described in any one of claims 1-5, characterized in that: It includes a dataset construction module, a behavior pattern modeling module, a network anomaly detection module, and an intelligent decision-making module; The dataset construction module collects network traffic data, system log data, and user behavior data, generates a dataset, and sends the data to the behavior pattern modeling module. The behavior pattern modeling module receives data sent by the dataset construction module, extracts features based on a hybrid convolutional neural network and a recurrent neural network, constructs an adaptive baseline and calculates a risk index, and then sends the data to the network anomaly detection module. The network anomaly detection module receives data sent by the behavior pattern modeling module, performs anomaly detection by generating adversarial networks to simulate network attacks, comparing anomaly features through self-supervised learning, and using multimodal fusion discrimination through attention mechanisms, and then sends the data to the intelligent decision-making module. The intelligent decision-making module receives data sent by the network anomaly detection module, defines states and actions based on the reinforcement learning decision model of the DQN network, calculates rewards and updates policies, and outputs the optimal response action to implement network security management.

Images