Artificial intelligence security classification and identification method for multi-modal data combined with transfer learning

Abstract

The application relates to the technical field of information security identification, and specifically discloses a multi-modal data artificial intelligence security classification identification method combined with transfer learning, in the process of constructing a multi-modal behavior data set, file access frequency and network connection frequency are collected in real time, and fluctuation characteristic values thereof are extracted through fast Fourier transform and K-means clustering algorithm respectively, which are used for evaluating internal threat and external attack risk faced by a system, the two types of characteristics are fused into a comprehensive characteristic vector, which is used as input to construct a transfer learning model based on a support vector machine, intelligent identification of a safety state of a target object is realized, in order to improve identification accuracy, a proportional-integral-derivative control mechanism is introduced into the system, a sampling period and a detection granularity are dynamically adjusted according to identification error, and a closed-loop feedback optimization structure is formed, the application realizes effective integration of multi-source heterogeneous behavior data, model cross-scene transfer and online self-adaptive adjustment, and improves the intelligent level of a security identification system.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security identification, and particularly relates to a multi-modal data artificial intelligence security classification identification method combined with transfer learning. BACKGROUND

[0002] With the rapid development of informationization and network technology, the security threats faced by various information systems are increasingly complex and concealed. Traditional security detection methods mainly rely on rule matching, signature recognition or behavior analysis based on a single data source (such as system logs, network traffic), which is difficult to effectively respond to multi-dimensional, cross-platform attack behaviors. In recent years, artificial intelligence technology, especially machine learning, has been widely applied in the security field. By modeling user behavior, system resource access patterns and network communication characteristics, the automation level of anomaly detection has been improved. On this basis, researchers have begun to focus on the application of multi-modal data analysis and deep learning models to improve recognition accuracy and adaptability.

[0003] The prior art has the following disadvantages:

[0004] Although some research has attempted to introduce machine learning for security identification, most methods still have many limitations: first, most use single-modal data as input, lacking fusion analysis of local operation behavior and network interaction behavior, resulting in incomplete feature expression; second, the data collection process is mostly statically configured, unable to dynamically adjust the sampling frequency according to the recognition effect; third, traditional models have limited generalization ability and need to be retrained when facing new environments or unknown scenarios, lacking transferability. In addition, existing systems generally lack a closed-loop feedback mechanism, making it difficult to achieve online optimization of recognition performance, limiting their practicality and stability in complex dynamic environments. SUMMARY

[0005] The present application aims to provide a multi-modal data artificial intelligence security classification identification method combined with transfer learning to solve the problems in the background.

[0006] The purpose of the present application can be achieved by the following technical solutions:

[0007] The multi-modal data artificial intelligence security classification identification method combined with transfer learning comprises the following steps:

[0008] S1: In the process of constructing a multi-modal data set, real-time collection and monitoring of file access frequency and network connection frequency are performed;

[0009] S2: According to the real-time monitored file access frequency variation amplitude, a file access frequency fluctuation feature value is calculated to evaluate the potential internal threat level under the current system environment;

[0010] S3: According to the real-time acquisition network connection frequency change, the network connection frequency fluctuation characteristic value is calculated, which is used to judge whether there is external attack behavior;

[0011] S4: The file access frequency fluctuation characteristic value and the network connection frequency fluctuation characteristic value are comprehensively analyzed, and a transfer learning model is constructed according to the analysis result, and the accuracy of safety identification is judged according to the transfer learning model;

[0012] S5: If the safety identification is inaccurate, the file access frequency and the network connection frequency during identification are dynamically adjusted.

[0013] As a further scheme of the application: the evaluation of the potential internal threat level under the current system environment specifically includes:

[0014] In the process of constructing the multi-modal data set, the file access frequency data is collected in real time, the file access frequency fluctuation characteristic value is calculated according to the change amplitude of the file access frequency data, whether the file access frequency fluctuation characteristic value is greater than or equal to the preset threshold is judged, if yes, there is internal threat, if not, there is no internal threat.

[0015] As a further scheme of the application: the acquisition process of the file access frequency fluctuation characteristic value is:

[0016] The access frequency data of the file on the continuous time point is collected to form a discrete time series data set, the collected time series data set is applied to fast Fourier transform to obtain a complex array represented in frequency domain;

[0017] The amplitude value of each frequency component is calculated to form an amplitude spectrum, including: the complex value of each frequency component is converted into its corresponding amplitude, that is, the module length of the complex number is calculated;

[0018] The root mean square value of all amplitude spectra is calculated to obtain the file access frequency fluctuation characteristic value.

[0019] As a further scheme of the application: the judgment of whether there is external attack behavior specifically includes:

[0020] In the process of constructing the multi-modal data set, the network connection frequency data is collected in real time, the network connection frequency fluctuation characteristic value is calculated according to the fluctuation amplitude of the network connection frequency data, whether the network connection frequency fluctuation characteristic value is greater than or equal to the preset threshold is judged, if yes, there is external attack behavior, if not, there is no external attack behavior.

[0021] As a further scheme of the application: the acquisition process of the network connection frequency fluctuation characteristic value is:

[0022] In the process of constructing the multi-modal data set, the network connection frequency data is collected in real time to form a discrete time series data set, the time series data set is subjected to sliding window processing, the statistical features of each time point are extracted, including the mean and standard deviation of the network connection frequency in the sliding window, the mean and standard deviation of the network connection frequency in the sliding window are constructed into a feature vector, the K-means clustering algorithm is used to cluster the feature vectors of all time points, and the data points are divided into clusters, and the network connection frequency fluctuation feature values are calculated based on the fluctuation information in each clustering result.

[0023] As a further scheme of the application, the comprehensive analysis of the file access frequency fluctuation feature values and the network connection frequency fluctuation feature values specifically includes:

[0024] In the process of constructing the multi-modal data set, the file access frequency fluctuation feature values and the network connection frequency fluctuation feature values are obtained, the file access frequency fluctuation feature values and the network connection frequency fluctuation feature values are constructed into a comprehensive feature vector, which is used as the input of the transfer learning model, the error between the predicted security recognition score and the actual security recognition score is minimized as the training target of the transfer learning model, and the security recognition score is output according to the trained transfer learning model.

[0025] As a further scheme of the application, the training process of the transfer learning model is:

[0026] The fluctuation feature values extracted by analyzing the file access frequency and the network connection frequency are constructed into a comprehensive feature vector as the model input, wherein the comprehensive feature vector includes two dimensions of the file access frequency fluctuation feature values and the network connection frequency fluctuation feature values; a support vector machine is used as the basic model, and existing labeled data is used to train the same; in the training process, the error between the predicted security recognition score and the actual labeled security recognition score is minimized as the target; the input features are mapped to a high-dimensional space through a kernel function to improve the learning ability of the model for nonlinear relationships, and an optimization algorithm is used to adjust the model parameters to enhance the generalization performance; after the preliminary training is completed, the trained model is migrated to a new application scenario as a source domain model, and a small amount of sample data in the new environment is combined to adjust the model, including adjusting the kernel function parameters, updating the support vectors and re-weighting the feature dimensions, so that the model adapts to the new data distribution characteristics, and outputs the corresponding security recognition score.

[0027] As a further scheme of the application, the accuracy of the security recognition according to the transfer learning model specifically includes:

[0028] According to the migration learning model output, a security recognition score is output, and it is judged whether the security recognition score is greater than or equal to a preset threshold value, if yes, the security recognition is accurate, and if no, the security recognition is inaccurate.

[0029] As a further scheme of the application: if it is judged that the security recognition is inaccurate, the file access frequency and the network connection frequency during recognition are dynamically adjusted, specifically including:

[0030] By deploying a proportional-integral-derivative control algorithm, the absolute value of the difference between the security recognition score output by the migration learning model at the current time and the actual security score is recorded as an error value, the error value is taken as an input signal, a control variable is calculated according to the error value, the control variable is converted into an adjustment amount for the file access frequency sampling period and the network connection frequency detection window size, specifically including: when the recognition error increases, the sampling time interval of the file access frequency is shortened, and the detection frequency of the network connection frequency is increased.

[0031] The beneficial effects of the application are:

[0032] (1) By fusing multi-modal behavior data such as file access frequency and network connection frequency, the application constructs a multi-level and multi-dimensional security analysis framework, which can comprehensively depict the behavior characteristics of the target object from two key aspects of system internal operation behavior and external network interaction behavior. Specifically, in the file access behavior analysis, the fast Fourier transform is used to convert the time series data into the frequency domain, and the root mean square value of the amplitude spectrum is extracted as the fluctuation feature, so as to effectively identify the sudden, periodic or abnormally high-frequency access mode, and accurately capture the potential internal threat behavior; in the network connection behavior modeling, the sliding window mechanism is introduced to extract statistical features, and the K-means clustering algorithm is combined to mine the potential distribution structure of network traffic in different time periods, and further calculate the weighted fluctuation feature value to quantify the instability of network behavior, and realize the high-sensitivity detection of external attack behavior. On this basis, the two types of fluctuation features are fused into a comprehensive feature vector, which is input into the migration learning model based on support vector machine, the learning ability for complex nonlinear relationship is improved through kernel function mapping, and the cross-scene knowledge reuse and model adaptation are realized through the migration mechanism, which significantly enhances the generalization ability and discrimination precision of the system in different application environments. This method not only realizes the effective integration of multi-source heterogeneous behavior data, but also fully utilizes the advantages of machine learning model in feature abstraction and pattern recognition, thereby improving the intelligent level and practical application value of the security recognition system as a whole.

[0033] (2) The application innovatively introduces a proportional-integral-derivative (PID) control mechanism, and constructs an adaptive data collection adjustment system for safety identification error feedback, which significantly improves the intelligent level and dynamic response capability of the behavior monitoring process. Specifically, during the model running process, the system continuously compares the error absolute value between the safety identification score output by the transfer learning model and the actual labeled score, and inputs the error as a feedback signal into the PID controller, and calculates the control variable for adjusting the sampling parameters in real time according to the designed control law. Through the proportional term to quickly respond to the current error, the integral term to eliminate long-term deviation, and the differential term to predict the error trend, the three work together to enable the system to automatically shorten the sampling time interval of file access frequency and improve the detection frequency of network connection frequency when the recognition accuracy decreases or the environmental behavior pattern mutates, thereby enhancing the time resolution of data collection and the perception sensitivity of behavior anomalies. The closed-loop feedback adjustment mechanism effectively overcomes the inherent contradiction between resource occupation and detection accuracy of the traditional static sampling strategy, realizes the optimal sampling configuration and dynamic performance optimization under limited system resources, not only improves the stability and robustness of the overall safety identification system, but also provides reliable technical support for the adaptive evolution of intelligent safety protection systems in complex environments. BRIEF DESCRIPTION OF DRAWINGS

[0034] The application will be further described below with reference to the drawings.

[0035] Figure 1 is a flow chart of the multi-modal data artificial intelligence safety classification identification method of the application combined with transfer learning. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the application will be described clearly and completely below with reference to the drawings in the embodiments of the application. Obviously, the described embodiments are only part of the embodiments of the application, not all. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of the application.

[0037] Please refer to Figure 1 The application is a multi-modal data artificial intelligence safety classification identification method combined with transfer learning, which comprises the following steps:

[0038] S1: In the process of constructing a multi-modal data set, file access frequency and network connection frequency are collected and monitored in real time;

[0039] S2: According to the change amplitude of the file access frequency monitored in real time, the file access frequency fluctuation characteristic value is calculated, which is used to evaluate the potential internal threat level under the current system environment;

[0040] S3: According to the real-time acquisition of the network connection frequency change, the network connection frequency fluctuation characteristic value is calculated, which is used to judge whether there is external attack behavior;

[0041] S4: The file access frequency fluctuation characteristic value and the network connection frequency fluctuation characteristic value are comprehensively analyzed, and a transfer learning model is constructed according to the analysis result, and the accuracy of safety recognition is judged according to the transfer learning model;

[0042] S5: If the safety recognition is inaccurate, the file access frequency and the network connection frequency during identification are dynamically adjusted.

[0043] In S1, in the process of constructing the multi-modal data set, the file access frequency and the network connection frequency are collected and monitored in real time, specifically including:

[0044] In the process of constructing the multi-modal data set, the system collects the file access behavior in the target device or service in real time through the operating system level monitoring module. Specifically, the system uses the file system hook provided by the kernel layer to capture each file opening, reading, writing and other operation events, and records the timestamp of each operation. Based on these timestamp information, the system takes the preset time window length as the unit, and counts the total number of file access events in each time window, so as to obtain the continuous file access frequency sequence.

[0045] The system also collects the network communication behavior of the target object in real time through the network protocol stack monitoring module. Specifically, the system listens to all network connection requests in and out of the device through the network filtering interface provided by the operating system, including TCP, UDP and other common protocol data packets, and records the timestamp of each complete connection establishment. Based on these timestamps, the system also takes the preset time window length as the unit, and counts the total number of network connection events in each window, forming the network connection frequency sequence.

[0046] In S2, according to the real-time monitored file access frequency change amplitude, the file access frequency fluctuation characteristic value is calculated, which is used to evaluate the potential internal threat level in the current system environment, specifically including:

[0047] In the process of constructing the multi-modal data set, the file access frequency data is collected in real time, the file access frequency fluctuation characteristic value is calculated according to the change amplitude of the file access frequency data, it is judged whether the file access frequency fluctuation characteristic value is greater than or equal to the preset threshold value, if yes, there is internal threat, if not, there is no internal threat.

[0048] The acquisition process of the file access frequency fluctuation characteristic value is:

[0049] The access frequency data of the collection file at continuous time points is collected to form a discrete time series data set, the fast Fourier transform is applied to the collected time series data set, and a complex array in the frequency domain is obtained;

[0050] The amplitude value of each frequency component is calculated to form an amplitude spectrum, including: converting the complex value of each frequency component into its corresponding amplitude, that is, calculating the modulus of the complex number, wherein the calculation expression of the amplitude is: ; wherein the amplitude value of the th frequency component, the number of frequency components, the complex value of the th frequency component after fast Fourier transform, the real part of the complex value , the imaginary part of the complex value ;

[0051] The root mean square value of all amplitude spectra is calculated to obtain the file access frequency fluctuation characteristic value, and the calculation expression is: ; wherein, the total number of time series sampling points, the file access frequency fluctuation characteristic value.

[0052] It should be noted that: in the process of constructing the multi-modal data set, the frequency domain analysis method based on fast Fourier transform is introduced to calculate the file access frequency fluctuation characteristic value, so as to realize real-time detection of potential abnormal behaviors inside the system. By converting the collected file access frequency time series into frequency domain representation and extracting the root mean square value of the amplitude spectrum as the fluctuation characteristic value, the sudden or periodic fluctuations in the access mode can be effectively identified. Further, by setting a reasonable fluctuation threshold, the system can determine whether the current fluctuation is beyond the normal behavior range, so as to identify possible internal threat behaviors, such as abnormal batch access, abuse of rights, etc. This process not only improves the accuracy of security evaluation, but also enhances the automation level of threat detection, providing quantifiable and transferable technical support for behavior security analysis in a multi-source heterogeneous environment.

[0053] In S3, the network connection frequency fluctuation characteristic value is calculated according to the real-time acquired network connection frequency change, which is used to judge whether there is an external attack behavior, specifically including:

[0054] In the process of constructing the multi-modal data set, the network connection frequency data is collected in real time, the network connection frequency fluctuation characteristic value is calculated according to the fluctuation amplitude of the network connection frequency data, it is judged whether the network connection frequency fluctuation characteristic value is greater than or equal to the preset threshold, if yes, there is an external attack behavior, if not, there is no external attack behavior.​

[0055] The acquisition process of the network connection frequency fluctuation feature value is as follows:

[0056] In the process of constructing the multi-modal data set, the network connection frequency data is collected in real time to form a discrete time series data set, the time series data set is processed by a sliding window, the statistical features of each time point are extracted, including the mean and standard deviation of the network connection frequency in the sliding window, the mean and standard deviation of the network connection frequency in the sliding window are constructed into a feature vector, the K-means clustering algorithm is used to cluster the feature vectors of all time points, and the data points are divided into clusters, based on the fluctuation information in each cluster result, the network connection frequency fluctuation feature value is calculated, and the calculation expression is: ; wherein, the network connection frequency fluctuation feature value is represented by the total number of cluster, the first cluster, the standard deviation calculated based on the sliding window at the first time point, the first time point.

[0057] It should be noted that: in the process of constructing the multi-modal data set, a fluctuation feature value calculation method based on sliding window statistical features and K-means clustering fusion analysis is proposed for the dynamic change characteristics of network connection frequency, which is used to identify whether the system is subjected to external attack behavior. Specifically, by processing the network connection frequency data on the time series by a sliding window, the mean and standard deviation in each window are extracted as local behavior representation, and these statistical features are constructed into a feature vector that can be used for clustering analysis; then, the K-means clustering algorithm is used to unsupervisedly classify the behavior patterns of all time points, so as to mine the potential distribution structure of network connection behavior in different time periods; on this basis, further combined with the standard deviation information of the time points contained in each cluster, the network connection frequency fluctuation feature value is calculated, and the quantitative evaluation of the overall fluctuation intensity is realized.

[0058] In S4, the file access frequency fluctuation feature value and the network connection frequency fluctuation feature value are comprehensively analyzed, and a transfer learning model is constructed according to the analysis result, and the accuracy of security identification is judged according to the transfer learning model, specifically including:

[0059] In the process of constructing the multi-modal data set, the file access frequency fluctuation feature value and the network connection frequency fluctuation feature value are obtained, the file access frequency fluctuation feature value and the network connection frequency fluctuation feature value are constructed into a comprehensive feature vector, which is used as the input of the transfer learning model, so as to minimize the error between the predicted security identification score and the actual security identification score, which is used as the training target of the transfer learning model, and the security identification score is output according to the trained transfer learning model, and the transfer learning model is a support vector machine model.

[0060] The training process of the transfer learning model is as follows:

[0061] The fluctuation feature values extracted by analyzing the file access frequency and the network connection frequency are constructed into a two-dimensional comprehensive feature vector as the model input, wherein the feature vector includes two dimensions of file access frequency fluctuation feature value and network connection frequency fluctuation feature value, which are used to represent the stability of the target object in local resource access and network communication behavior; the support vector machine is used as the basic model, and the existing labeled data is used for training; in the training process, the error between the predicted security identification score and the actual labeled security identification score is minimized as the target; the input features are mapped to high-dimensional space through kernel function, the learning ability of the model for nonlinear relationship is improved, and the optimization algorithm is used to adjust the model parameters to enhance the generalization performance; after the preliminary training is completed, the trained model is migrated to a new application scenario as a source domain model, and the model is adjusted combined with a small amount of sample data in the new environment, including adjusting the kernel function parameters, updating the support vectors and reweighting the feature dimensions, so that the model adapts to the new data distribution characteristics, thereby realizing accurate evaluation of the security state of the new target object and outputting the corresponding security identification score.

[0062] The accuracy of the security identification according to the transfer learning model is determined, and specifically includes:

[0063] According to the output of the transfer learning model, the security identification score is output, and it is judged whether the security identification score is greater than or equal to a preset threshold value, if yes, the security identification is accurate, and if no, the security identification is not accurate.

[0064] In S5, if it is judged that the security identification is not accurate, the file access frequency and the network connection frequency during identification are dynamically adjusted, and specifically includes:

[0065] A proportional-integral-derivative control algorithm is deployed, and the absolute value of the difference between the security identification score output by the transfer learning model at the current time and the actual security score is denoted as the error value, which is used as the input signal, and the control variable is calculated according to the error value, and the calculation expression is: ; wherein, Kp represents the proportional gain, Ki represents the integral gain, denotes a differential gain, denotes a time point, denotes an error value of the time point, denotes an error value of any time point from time point 0 to the current time point , , denotes any time point from time point 0 to the current time point , denotes a control variable of the time point , the control variable is converted into an adjustment amount of the file access frequency sampling period and the network connection frequency detection window size, specifically including: when the identification error increases, the sampling time interval of the file access frequency is shortened, and the detection frequency of the network connection frequency is increased.

[0066] It should be noted that: the present application introduces a proportional-integral-differential (PID controller) control mechanism in the running process of the security identification model, realizes the dynamic self-adaptive adjustment of the file access frequency sampling period and the network connection frequency detection window, and thus improves the security identification accuracy of the system when facing complex and changeable behavior patterns. Specifically, the system takes the absolute value of the error between the security score output by the migration learning model and the actual labeled score as the feedback signal, inputs it into the PID controller, obtains the control variable through the collaborative calculation of the proportional, integral and differential parts, and maps it to the adjustment parameter of the sampling and detection period; when the identification error increases, the system automatically shortens the sampling time interval of the file access frequency and increases the detection frequency of the network connection frequency, thereby enhancing the spatio-temporal resolution of data acquisition, so that the model can capture the subtle changes of potential abnormal behaviors more timely. This method breaks through the contradiction between resource utilization and detection sensitivity of the traditional static sampling mechanism, realizes the dynamic balance of behavior data analysis precision and system response efficiency, and provides a new type of technology path with closed-loop feedback regulation ability for intelligent security evaluation in uncertain environment.

[0067] The working principle of the present application: the present application provides a multi-modal data artificial intelligence security classification identification method combined with transfer learning, aiming to solve the problems of insufficient recognition accuracy, poor adaptability and low response efficiency of traditional security detection methods in the face of complex dynamic environment. By constructing a multi-modal data set integrating local resource access behavior and network communication behavior, file access frequency and network connection frequency are collected in real time during system operation, and their fluctuation characteristic values are extracted respectively; among them, the file access frequency fluctuation characteristic value is converted from time series to frequency domain representation based on fast Fourier transform, and the root mean square value of the amplitude spectrum is calculated to characterize the burstiness and periodicity of the access behavior, so as to identify potential internal threat behavior; the network connection frequency fluctuation characteristic value is obtained by K-means clustering analysis of the statistical characteristics in the sliding window, combined with the standard deviation information in each cluster, to quantify the instability of network behavior and judge whether there is external attack behavior. Further, the two types of fluctuation characteristics are fused to construct a comprehensive feature vector, which is input into the transfer learning model based on support vector machine for training, the kernel function mapping and optimization algorithm are used to improve the learning ability of the model to nonlinear relationship, and the transfer mechanism is used to adapt to the data distribution characteristics in different application scenarios, to realize accurate evaluation of the safety state of the target object. When there is deviation between the safety identification score output by the model and the actual score, the system introduces a proportional-integral-derivative (PID) control mechanism to drive adaptive adjustment of the sampling parameters through error feedback, dynamically shortens the sampling period of file access frequency and increases the detection frequency of network connection frequency, effectively enhancing the sensitivity of data acquisition and the real-time response ability of the model. This method realizes the whole process closed-loop control from data acquisition, feature extraction, model identification to feedback regulation, significantly improves the safety identification accuracy, generalization ability and intelligent level of the system in the multi-source heterogeneous environment, and has wide application prospect and practical value.

[0068] The above describes one embodiment of the present application in detail, but the content described is only the preferred embodiment of the present application, and cannot be considered as limiting the scope of the present application. Any equivalent changes and improvements made within the scope of the present application shall still belong to the patent coverage range of the present application.

Claims

1. A multimodal data artificial intelligence security classification and recognition method combining transfer learning, characterized in that: Includes the following steps: S1: During the construction of the multimodal dataset, file access frequency and network connection frequency are collected and monitored in real time; S2: Calculate the file access frequency fluctuation characteristic value based on the real-time monitored changes in file access frequency, which is used to assess the level of potential internal threats in the current system environment; S3: Based on the real-time network connection frequency changes, calculate the network connection frequency fluctuation characteristic value to determine whether there is an external attack. S4: Conduct a comprehensive analysis of the fluctuation characteristics of file access frequency and network connection frequency, and construct a transfer learning model based on the analysis results. Use the transfer learning model to determine the accuracy of security identification. The comprehensive analysis of the characteristic values ​​of file access frequency fluctuations and network connection frequency fluctuations specifically includes: In the process of constructing a multimodal dataset, file access frequency fluctuation feature values ​​and network connection frequency fluctuation feature values ​​are obtained. These feature values ​​are then used to construct a comprehensive feature vector, which is used as the input to the transfer learning model to minimize the error between the predicted security identification score and the actual security identification score. This vector serves as the training objective of the transfer learning model. Based on the trained transfer learning model, the security identification score is output. The transfer learning model is a support vector machine model. The training process of the transfer learning model is as follows: A comprehensive feature vector is constructed from the fluctuation features extracted by analyzing file access frequency and network connection frequency, serving as the model input. This comprehensive feature vector contains two dimensions: fluctuation features of file access frequency and fluctuation features of network connection frequency. A support vector machine (SVM) is used as the base model, trained on existing labeled data. During training, the goal is to minimize the error between the predicted security identification score and the actual labeled security identification score. A kernel function maps the input features to a high-dimensional space, and optimization algorithms are used to adjust the model parameters. After initial training, the trained model is transferred to a new application scenario as the source domain model. The model is then adjusted using a small amount of sample data in the new environment, including adjusting kernel function parameters, updating support vectors, and reweighting feature dimensions to adapt the model to the new data distribution characteristics and output the corresponding security identification score. S5: If the security identification is inaccurate, dynamically adjust the file access frequency and network connection frequency during identification; If the security identification is deemed inaccurate, the file access frequency and network connection frequency during identification will be dynamically adjusted, specifically including: By deploying a proportional-integral-derivative (PI-DE) control algorithm, the absolute value of the difference between the safety identification score output by the transfer learning model at the current moment and the actual safety score is denoted as the error value. This error value is used as the input signal, and the control variable is calculated based on it. The calculation expression is as follows: ;in, Indicates proportional gain. Indicates integral gain. Represents differential gain. Indicates a point in time. Indicates the first Error value at each time point This represents the time from time point 0 to the current time point. At any time within The error value, Represents time point 0 to the current time point At any time within, Indicates a point in time The control variables are converted into adjustments to the sampling period for file access frequency and the size of the detection window for network connection frequency. Specifically, when the recognition error increases, the sampling time interval for file access frequency is shortened and the detection frequency for network connection frequency is increased.

2. The multimodal data artificial intelligence security classification and recognition method combining transfer learning according to claim 1, characterized in that, The assessment of the potential insider threat level in the current system environment specifically includes: During the construction of the multimodal dataset, file access frequency data is collected in real time. Based on the change range of the file access frequency data, the fluctuation characteristic value of the file access frequency is calculated. It is then determined whether the fluctuation characteristic value of the file access frequency is greater than or equal to a preset threshold. If it is, there is an internal threat; otherwise, there is no internal threat.

3. The multimodal data artificial intelligence security classification and recognition method combining transfer learning according to claim 2, characterized in that, The process for obtaining the file access frequency fluctuation characteristic value is as follows: The access frequency data of the collected file at continuous time points are used to form a discrete time series dataset. The collected time series dataset is then subjected to a fast Fourier transform to obtain a complex array in the frequency domain. The amplitude value of each frequency component is calculated to form an amplitude spectrum, including converting the complex value of each frequency component into its corresponding amplitude, i.e., calculating the modulus of the complex number. Calculate the root mean square value of all amplitude spectra to obtain the characteristic value of file access frequency fluctuation.

4. The multimodal data artificial intelligence security classification and recognition method combining transfer learning according to claim 1, characterized in that, The determination of whether an external attack has occurred specifically includes: During the construction of the multimodal dataset, network connection frequency data is collected in real time. Based on the fluctuation range of the network connection frequency data, the network connection frequency fluctuation characteristic value is calculated. It is then determined whether the network connection frequency fluctuation characteristic value is greater than or equal to a preset threshold. If it is, there is an external attack; otherwise, there is no external attack.

5. The multimodal data artificial intelligence security classification and recognition method combining transfer learning according to claim 2, characterized in that, The process for obtaining the network connection frequency fluctuation characteristic value is as follows: In constructing the multimodal dataset, network connection frequency data was collected in real time to form a discrete time series dataset. A sliding window processing method was applied to the time series dataset to extract statistical features for each time point, including the mean and standard deviation of the network connection frequency within the sliding window. These mean and standard deviations were then used to construct feature vectors. The K-means clustering algorithm was then used to cluster the feature vectors for all time points, dividing the data points into... For each cluster, based on the fluctuation information in each clustering result, the network connection frequency fluctuation characteristic value is calculated.

6. The multimodal data artificial intelligence security classification and recognition method combining transfer learning according to claim 1, characterized in that, The determination of the accuracy of security identification based on the transfer learning model specifically includes: Based on the output of the transfer learning model, a security identification score is output. It is then determined whether the security identification score is greater than or equal to a preset threshold. If it is, the security identification is accurate; otherwise, the security identification is inaccurate.

Images