Artificial intelligence-based cloud network collaborative distributed security communication method and system

Abstract

The application discloses an artificial intelligence-based cloud network cooperative distributed security communication method and system. The method comprises the following steps: acquiring network timing data corresponding to a communication connection; performing threat event identification on the network timing data to obtain first identification information; for each communication relay point, determining probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents the probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents the characteristics possessed by the communication relay point in the communication connection; performing association processing on the first identification information and the probability information to obtain second identification information; determining a cloud network cooperative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and sending the cloud network cooperative distributed security protection strategy to a gateway, so that the communication security of the distributed security communication system can be improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a cloud-network collaborative distributed security communication method and system based on artificial intelligence. BACKGROUND

[0002] In the related art, when a network security protection system performs protection policy customization, it will mostly preconfigure policy customization rules based on the artificial experience of network security experts, for example, setting corresponding threshold values for different network index data and configuring the network protection policy to be adopted when the threshold value is not met.

[0003] However, this processing method often has problems such as severe dependence on artificial configuration experience and the need for frequent human intervention, thereby resulting in poor overall defense capability of the system. SUMMARY

[0004] To solve the above technical problems, the embodiments of the present application propose a cloud-network collaborative distributed security communication method and system based on artificial intelligence, which can improve the communication security of the distributed security communication system.

[0005] In a first aspect, the embodiments of the present application provide a cloud-network collaborative distributed security communication method based on artificial intelligence, which is applicable to a cloud end in a distributed system, the distributed system further comprising a gateway having a communication connection with the cloud end, the communication connection being constructed based on at least one communication relay point, and the method comprising:

[0006] obtaining network timing data corresponding to the communication connection;

[0007] performing threat event identification on the network timing data to obtain first identification information;

[0008] For each communication relay point, based on the network timing data and characteristic information of the communication relay point, determining probability information corresponding to the communication relay point, wherein the probability information represents the probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents the characteristics possessed by the communication relay point in the communication connection;

[0009] performing association processing on the first identification information and the probability information to obtain second identification information;

[0010] using a pre-trained artificial intelligence model to determine a cloud-network collaborative distributed security protection policy according to the second identification information, and sending the cloud-network collaborative distributed security protection policy to the gateway.

[0011] Optionally, the artificial intelligence model to be trained includes a recurrent neural network and an attention mechanism network, and the training process of the artificial intelligence model comprises:

[0012] obtaining sample identification information and a plurality of guidance information corresponding to the sample identification information, wherein the plurality of guidance information is associated with a plurality of safety types, each guidance information is associated with at least one of the plurality of safety types, at least two guidance information in the plurality of guidance information are associated with different safety types, and the attention mechanism network has pre-stored standard features corresponding to each of the plurality of safety types;

[0013] determining, by using the recurrent neural network, guidance features corresponding to each of the plurality of safety types based on the guidance information associated with each of the plurality of safety types;

[0014] determining, by using the attention mechanism network, safety guidance features corresponding to each of the plurality of safety types based on the guidance features corresponding to each of the plurality of safety types and the standard features;

[0015] training the artificial intelligence model to be trained based on the sample identification information and the safety guidance features corresponding to each of the plurality of safety types, to obtain the artificial intelligence model.

[0016] Optionally, the determining, by using the recurrent neural network, guidance features corresponding to each of the plurality of safety types based on the guidance information associated with each of the plurality of safety types comprises:

[0017] for each of the plurality of safety types,

[0018] for each of the guidance information associated with the safety type, inputting the guidance information into the recurrent neural network to obtain global features of the guidance information output by the recurrent neural network, and extracting local features corresponding to the safety type from the global features;

[0019] determining the guidance features corresponding to the safety type based on the local features corresponding to the safety type.

[0020] Optionally, the associating the first identification information and the probability information to obtain second identification information comprises:

[0021] clustering the first identification information based on target information of each of the at least one communication relay point to obtain at least one first cluster, wherein the target information comprises communication capability information and / or geographic information;

[0022] associating the first identification information and the probability information based on the first cluster to obtain second identification information.

[0023] Optionally, the associating the first identification information and the probability information based on the first cluster comprises:

[0024] selecting a second cluster from the at least one first cluster according to the probability information;

[0025] associating the first identification information and the probability information based on the second cluster to obtain second identification information.

[0026] Optionally, the target information comprises at least the communication capability information and the geographic information, and the clustering the first identification information based on the target information of each of the at least one communication relay point to obtain at least one first cluster comprises:

[0027] clustering the first identification information based on the geographic information of each of the at least one communication relay point to obtain at least one third cluster;

[0028] determining the farthest communication distance of each of the at least one communication relay point under a specified communication strategy based on the communication capability information of each of the at least one communication relay point;

[0029] clustering the at least one third cluster based on the farthest communication distance of each of the at least one communication relay point to obtain the at least one first cluster.

[0030] Optionally, the at least one communication relay point is included in the distributed system.

[0031] Before the determining the probability information corresponding to the communication relay point based on the network timing data and the characteristic information of the communication relay point, the method further comprises:

[0032] determining an architecture diagram of the distributed system, wherein the architecture diagram comprises a plurality of nodes and edges between the plurality of nodes, the plurality of nodes comprise a first node, a second node and at least one third node, the first node represents the cloud, the second node represents the gateway, and the at least one third node represents the at least one communication relay point;

[0033] determining the characteristic information of each of the at least one communication relay point based on the architecture diagram.

[0034] Optionally, the determining the characteristic information of each of the at least one communication relay point based on the architecture diagram comprises:

[0035] Based on the architecture diagram, characteristics information of each of the at least one communication relay point is identified by using a graph neural network, wherein the graph neural network is obtained by being trained in advance based on sample data, the sample data includes a sample architecture diagram and a label, the label is adapted to indicate sample node characteristic information corresponding to the sample architecture diagram, the sample architecture diagram includes a plurality of sample nodes and edges between the plurality of sample nodes, part of the sample nodes correspond to sample communication connections, and the sample node characteristic information represents characteristics of the part of the sample nodes corresponding to the sample communication connections.

[0036] Optionally, the training manner of the graph neural network comprises:

[0037] The sample data is obtained.

[0038] Based on the sample architecture diagram, predicted characteristic information corresponding to the part of the sample nodes is identified by using a to-be-trained graph neural network.

[0039] Based on a difference between the sample node characteristic information indicated by the label and the predicted characteristic information, the to-be-trained graph neural network is trained to obtain the graph neural network.

[0040] In a second aspect, an embodiment of the present application provides a cloud-network collaborative distributed security communication system based on artificial intelligence, which is applicable to a cloud end in a distributed system, the distributed system further includes a gateway having a communication connection with the cloud end, the communication connection is constructed based on at least one communication relay point, and the communication system comprises:

[0041] A data acquisition module is configured to acquire network timing data corresponding to the communication connection.

[0042] A threat identification module is configured to perform threat event identification on the network timing data to obtain first identification information.

[0043] A probability module is configured to determine, for each communication relay point, probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection.

[0044] An association module is configured to perform association processing on the first identification information and the probability information to obtain second identification information.

[0045] A protection module is configured to determine a cloud-network collaborative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and send the cloud-network collaborative distributed security protection strategy to the gateway.

[0046] To sum up, the embodiments of the present application have at least the following beneficial effects:

[0047] By adopting the embodiments of the present application, the network timing data corresponding to the communication connection is acquired; threat event identification is performed on the network timing data to obtain first identification information; for each communication relay point, probability information corresponding to the communication relay point is determined based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents the probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents the characteristics possessed by the communication relay point in the communication connection; the first identification information and the probability information are associated to obtain second identification information; a pre-trained artificial intelligence model is used to determine a cloud-network collaborative distributed security protection strategy according to the second identification information, and the cloud-network collaborative distributed security protection strategy is sent to the gateway, thereby improving the communication security of the distributed security communication system. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 is a flow diagram of the cloud-network collaborative distributed security communication method based on artificial intelligence provided by the embodiments of the present application;

[0049] Figure 2 is a structural diagram of the cloud-network collaborative distributed security communication system based on artificial intelligence provided by the embodiments of the present application;

[0050] Figure 3 is a structural diagram of the computer device provided by the embodiments of the present application. DETAILED DESCRIPTION

[0051] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of protection of the present application.

[0052] In the description of the present application, the terms "first", "second", "third", etc. are only for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined with "first", "second", "third", etc. can be explicitly or implicitly included one or more of the features. In the description of the present application, unless otherwise specified, the meaning of "a plurality of" is two or more. In the description of the present application, the term "comprising" and its variants are open-ended, i.e. "including but not limited to". The term "based on" is "at least partially based on". The term "according to" is "at least partially according to". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments".

[0053] In the description of the present application, it should be noted that, unless otherwise explicitly specified and limited, the terms "mounting", "connecting", "connecting" should be understood in a broad sense, for example, it can be fixedly connected, or it can be detachably connected, or integrally connected; it can be mechanically connected, or it can be electrically connected; it can be directly connected, or it can be indirectly connected through an intermediate medium, or it can be connected inside two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0054] In the description of the present application, it should be noted that, unless otherwise defined, all technical and scientific terms used in the present application have the same meaning as understood by those skilled in the art. The terms used in the specification of the present application are only for the purpose of describing the specific embodiments, and are not intended to limit the present application. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0055] In the first aspect, see Figure 1 , shows a flow diagram of a cloud network collaborative distributed security communication method based on artificial intelligence provided by the embodiment of the present application, the method is suitable for cloud in a distributed system, the distributed system also includes a gateway having a communication connection with the cloud, the communication connection is based on at least one communication relay point to build, the method includes steps S101-S105, as follows:

[0056] S101, obtaining network timing data corresponding to the communication connection.

[0057] In an example, the above network timing data can include at least one of the following: data packet of the transport layer, behavior data of the application layer protocol, or network traffic in a specific time period.

[0058] It should be noted that in the distributed system, for the communication connection between the cloud and the gateway, the communication relay point can be various types of devices or services, and the communication relay point can be used to help data transmission from one point to another, to ensure that data can be smoothly transmitted between different network environments, so that the cloud and the gateway can complete data interaction safely and reliably via the communication connection.

[0059] In an example, the communication relay point described above can include at least one of a router, a switch, a proxy server, a load balancer, a content distribution network node, etc. At this time, the network timing data described above can include at least one of the following of the communication relay point: a timestamp, a packet size and quantity, a session duration, an encrypted traffic feature (such as a TLS (Transport Layer Security) version, certificate information, etc.), path information, a performance indicator, etc.

[0060] S102, performing threat event identification on the network timing data to obtain first identification information.

[0061] In an example, performing threat event identification on the network timing data to obtain first identification information can include at least one of the following:

[0062] By matching the network timing data with a signature library of known attack patterns, a specific type of attack is identified to obtain at least part of the first identification information.

[0063] By using machine learning or statistical methods, a normal behavior model is established according to historical network timing data, the network timing data is input into the established normal behavior model for matching, and behavior represented by network timing data deviating from the model is considered as a potential threat to obtain at least part of the first identification information.

[0064] S103, for each communication relay point, determining probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection.

[0065] In an example, determining probability information corresponding to the communication relay point based on the network timing data and the characteristic information of the communication relay point can include: determining a similarity between each data point in the network timing data and the characteristic information of the communication relay point; and determining a probability that each data point matches the communication relay point according to the similarity as the probability information.

[0066] In an example, the characteristic possessed by the communication relay point in the communication connection can be a specific attribute of the communication relay point, for example, for a router, it can be a routing table size, a forwarding rule; for a switch, it can be information about VLAN (Virtual Local Area Network) configuration; for a proxy server, it can be a cache strategy, an access control list, etc.

[0067] In an example, the above characteristic information can be pre-set.

[0068] S104, performing association processing on the first identification information and the probability information to obtain second identification information.

[0069] In an example, a more accurate threat intelligence can be extracted through an association analysis algorithm by directly combining the first identification information with the probability information of each communication relay point to obtain the second identification information, so as to help improve the accuracy of threat detection and better locate the source of specific security problems.

[0070] S105, determining a cloud-network collaborative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and sending the cloud-network collaborative distributed security protection strategy to the gateway.

[0071] In an example, a pre-trained artificial intelligence model (such as a deep neural network, a reinforcement learning model, etc.) can be used to generate a cloud-network collaborative distributed security protection strategy for the obtained network time series data based on the second identification information. Then, the strategy can be deployed on the corresponding gateway to realize dynamic adjustment and optimization, ensuring the security of the entire distributed system. In addition, the strategy can also include a sub-strategy executed by the cloud itself, so as to facilitate the cloud to execute the sub-strategy.

[0072] In the embodiment, by associating the first identification information with the probability information, it is ensured that the second identification information can focus on each communication relay point, reducing the influence of non-communication relay points, so that the finally generated cloud-network collaborative distributed security protection strategy can adapt to the current situation of each communication relay point, so as to ensure the security of the communication connection.

[0073] In an optional implementation, the artificial intelligence model to be trained includes a recurrent neural network and an attention mechanism network, and the training process of the artificial intelligence model includes:

[0074] obtain sample identification information and a plurality of guidance information corresponding to the sample identification information, wherein the plurality of guidance information is associated with a plurality of safety types, each guidance information is associated with at least one of the plurality of safety types, at least two guidance information in the plurality of guidance information are associated with different safety types, and the attention mechanism network has pre-stored standard features corresponding to each of the plurality of safety types;

[0075] determine, based on the guidance information associated with each of the plurality of safety types, a guidance feature corresponding to each of the plurality of safety types by using the recurrent neural network;

[0076] determine, based on the guidance feature corresponding to each of the plurality of safety types and the standard feature, a safety guidance feature corresponding to each of the plurality of safety types by using the attention mechanism network;

[0077] train the artificial intelligence model to be trained based on the sample identification information and the safety guidance feature corresponding to each of the plurality of safety types, and obtain the artificial intelligence model.

[0078] It should be noted that in the plurality of guidance information, there are at least two guidance information associated with different safety types, that is, the safety type associated with one guidance information in the at least two guidance information is different from the safety type associated with at least one of the other guidance information in the at least two guidance information.

[0079] In an example, the determination of the guidance feature corresponding to each of the plurality of safety types based on the guidance information associated with each of the plurality of safety types by using the recurrent neural network can include: inputting the guidance information associated with each of the plurality of safety types into the recurrent neural network respectively, and obtaining the guidance feature corresponding to each of the guidance information output by the recurrent neural network as the guidance feature corresponding to each of the plurality of safety types.

[0080] In an example, the recurrent neural network in the embodiments of the present application can be used to implement encoding processing / feature extraction processing.

[0081] In an example, the determination of the safety guidance feature corresponding to each of the plurality of safety types based on the guidance feature corresponding to each of the plurality of safety types and the standard feature by using the attention mechanism network can include: inputting the guidance feature corresponding to each of the plurality of safety types and the standard feature into the attention mechanism network, and obtaining the safety guidance feature corresponding to each of the plurality of safety types output by the attention mechanism network.

[0082] In an example, the attention mechanism network in the embodiments of the present application can be used to implement fusion processing.

[0083] In an example, the guidance information in the embodiments of the present application can include general multi-modal data such as text description, behavior pattern, history record, etc. related to the security type, and accordingly, the standard feature can be extracted from standard multi-modal data corresponding to the security type, which is different from the general multi-modal data and has a higher correlation with the security type and is higher than a preset correlation threshold (i.e. the noise content in the standard multi-modal data irrelevant to the corresponding security type is less), and the general multi-modal data usually also contains a large amount of noise irrelevant to the corresponding security type, so that the artificial intelligence model trained can accurately distinguish and eliminate the noise in the input data.

[0084] In an example, the plurality of security types can include different types of security risks that may exist in communication connections, such as data leakage risks on some communication relay points, and / or forms of the data leakage risks (such as data transmission encryption methods being cracked, insufficient physical access control, etc.), and / or some communication relay points being subject to DDoS attack risks, supply chain attack risks, etc.

[0085] In an optional implementation, the determination of the guidance feature corresponding to each security type in the plurality of security types by using the recurrent neural network based on the guidance information associated with each security type includes:

[0086] For each security type in the plurality of security types,

[0087] For each guidance information associated with the security type, the guidance information is input into the recurrent neural network to obtain a global feature of the guidance information output by the recurrent neural network, and a local feature corresponding to the security type is extracted from the global feature.

[0088] The determination of the guidance feature corresponding to each security type based on the local feature corresponding to the security type.

[0089] In an example, the recurrent neural network can obtain the global feature of the guidance information through encoding processing / feature extraction processing.

[0090] In an example, the local feature can be a feature vector in the global feature with a similarity to the security type higher than a corresponding threshold.

[0091] In an example, the local feature corresponding to the security type can be used as the guidance feature corresponding to the security type.

[0092] In an optional implementation, the association processing of the first identification information and the probability information to obtain the second identification information includes:

[0093] cluster the first identification information based on target information of the at least one communication relay point, to obtain at least one first cluster, wherein the target information comprises communication capability information and / or geographic information;

[0094] perform association processing on the first identification information and the probability information based on the first cluster, to obtain second identification information.

[0095] It can be understood that in the embodiment, first, the first identification information (i.e., the preliminary threat identification result) obtained from the network timing data is clustered in combination with the target information (including but not limited to communication capability information, geographic information, etc.) of each communication relay point, which aims to classify the identification information with similar characteristics (determined by the target information) into a category to form at least one first cluster. Then, the first cluster is used to further analyze the first identification information and the probability information corresponding to each communication relay point calculated previously, so as to more effectively associate these information to generate more accurate and useful second identification information. Here, the obtained second identification information is a more accurate and comprehensive security evaluation result than the first identification information, so as to more accurately locate the potential security threat source, understand its propagation path, and take corresponding protection measures subsequently.

[0096] In an example, the clustering in any embodiment of the present application can be implemented by any one of the following: K-means clustering, spectral clustering, clustering based on kernel density estimation.

[0097] In an optional implementation, the performing association processing on the first identification information and the probability information based on the first cluster, to obtain second identification information, comprises:

[0098] selecting a second cluster from the at least one first cluster according to the probability information;

[0099] performing association processing on the first identification information and the probability information based on the second cluster, to obtain second identification information.

[0100] In some cases, since the first cluster is obtained based on the target information of each communication relay point, at least one communication relay point can correspond to at least one first cluster (i.e., each first cluster represents the first identification information corresponding to a corresponding communication relay point), and since each communication relay point has corresponding probability information, each probability information can also correspond to each first cluster.

[0101] As used in the above example, since each first cluster can be regarded as information in the first identification information classified to the corresponding communication relay point (i.e. each first cluster corresponds to a part of the first identification information), and the first identification information can contain the threat event identification result of each data point in the network time series data, the part of the first identification information (i.e. the threat event identification result of a part of data points) corresponding to each first cluster has a corresponding relationship with a part of data points in the network time series data. Accordingly, the probability that the data points corresponding to each first cluster match the communication relay point corresponding to the first cluster can be extracted from the probability information corresponding to each first cluster, and the mean of the extracted probabilities is calculated, and finally the first cluster with a mean value higher than a set probability threshold is taken as a second cluster. Thus, this embodiment further combines probability information on the basis of clustering to exclude the influence of first clusters with low probability, thereby avoiding the influence of communication relay points with low abnormal probability and improving the pertinence of the security protection strategy.

[0102] As used in the above example, it can be known that the second cluster also corresponds to a probability information and a part of the first identification information (i.e. the threat event identification result of a part of data points), and therefore, in the association processing, the information in the first identification information corresponding to the second cluster can be associated and fused with the probability information corresponding to the second cluster to obtain the second identification information, so that the second identification information can eliminate the noise in the first identification information and improve the pertinence of the security protection strategy generated subsequently.

[0103] In an optional implementation, the target information at least includes the communication capability information and the geographic information, and the clustering of the first identification information based on the target information of each of the at least one communication relay point to obtain at least one first cluster includes:

[0104] clustering the first identification information based on the geographic information of each of the at least one communication relay point to obtain at least one third cluster;

[0105] determining the farthest communication distance of each of the at least one communication relay point under a specified communication strategy based on the communication capability information of each of the at least one communication relay point;

[0106] clustering the at least one third cluster based on the farthest communication distance of each of the at least one communication relay point to obtain the at least one first cluster.

[0107] In an optional implementation, the at least one communication relay point is contained in the distributed system;

[0108] Before the determination of the probability information corresponding to the communication relay point based on the network time series data and the characteristic information of the communication relay point, the method further includes:

[0109] determine an architecture graph of the distributed system, wherein the architecture graph comprises a plurality of nodes and edges between the plurality of nodes, the plurality of nodes comprising a first node, a second node, and at least one third node, the first node representing the cloud, the second node representing the gateway, and the at least one third node representing the at least one communication relay point;

[0110] determine the respective characteristic information of the at least one communication relay point based on the architecture graph.

[0111] In an example, the architecture graph can be obtained by converting an architecture relationship of a distributed system into a graph structure.

[0112] In an example, determining the respective characteristic information of the at least one communication relay point based on the architecture graph can comprise performing graph structure analysis and / or key node analysis on the architecture graph to identify the respective characteristic information of the at least one communication relay point.

[0113] In an alternative implementation, determining the respective characteristic information of the at least one communication relay point based on the architecture graph comprises:

[0114] identifying the respective characteristic information of the at least one communication relay point based on the architecture graph using a graph neural network, wherein the graph neural network is pre-trained based on sample data, the sample data comprising a sample architecture graph and a label, the label being adapted to indicate sample node characteristic information corresponding to the sample architecture graph, the sample architecture graph comprising a plurality of sample nodes and edges between the plurality of sample nodes, a part of the plurality of sample nodes corresponding to a sample communication connection, and the sample node characteristic information representing a characteristic of the part of the plurality of sample nodes corresponding to the sample communication connection.

[0115] In an example, the edges between the plurality of sample nodes mean that each sample node of the plurality of sample nodes has a corresponding edge for connection with at least one of the other sample nodes. In other words, edges do not necessarily exist between any two sample nodes.

[0116] It can be understood that the graph neural network of the present embodiment can take an architecture graph as input and output characteristic information of a communication relay point after being trained.

[0117] In an example, the sample architecture graph described above can correspond to a sample distributed system, and the related description can refer to the distributed system described above, which will not be repeated here.

[0118] In an alternative implementation, the training method of the graph neural network comprises:

[0119] acquire the sample data;

[0120] based on the sample architecture diagram, a to-be-trained graph neural network is used to identify the predicted characteristic information corresponding to the part of sample nodes;

[0121] based on the difference between the sample node characteristic information indicated by the label and the predicted characteristic information, the to-be-trained graph neural network is trained to obtain the graph neural network.

[0122] In an example, based on the difference, training the to-be-trained graph neural network can include: based on the difference, using a preset loss function to calculate a corresponding loss value, and using a back propagation algorithm to train the to-be-trained graph neural network according to the loss value.

[0123] In a second aspect, accordingly, the embodiments of the present application also provide a cloud network collaborative distributed secure communication system based on artificial intelligence, which can realize all processes of the cloud network collaborative distributed secure communication method based on artificial intelligence provided by the above embodiments.

[0124] Referring to Figure 2 , a structure schematic diagram of the cloud network collaborative distributed secure communication system based on artificial intelligence provided by the embodiments of the present application is shown.

[0125] The embodiments of the present application provide a cloud network collaborative distributed secure communication system based on artificial intelligence, which is suitable for a cloud end in a distributed system, the distributed system further includes a gateway having a communication connection with the cloud end, the communication connection is constructed based on at least one communication relay point, and the communication system includes:

[0126] a data acquisition module 201, configured to acquire network timing data corresponding to the communication connection;

[0127] a threat identification module 202, configured to perform threat event identification on the network timing data to obtain first identification information;

[0128] a probability module 203, configured to, for each communication relay point, determine probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection;

[0129] an association module 204, configured to perform association processing on the first identification information and the probability information to obtain second identification information;

[0130] The protection module 205 is configured to determine a cloud-network collaborative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and send the cloud-network collaborative distributed security protection strategy to the gateway.

[0131] In an optional implementation, the artificial intelligence model to be trained includes a recurrent neural network and an attention mechanism network, and the training process of the artificial intelligence model includes:

[0132] obtaining sample identification information and a plurality of guidance information corresponding to the sample identification information, wherein the plurality of guidance information is associated with a plurality of security types, each guidance information is associated with at least one of the plurality of security types, at least two guidance information in the plurality of guidance information are associated with different security types, and the attention mechanism network has pre-stored standard features corresponding to each of the plurality of security types;

[0133] determining, by using the recurrent neural network, guidance features corresponding to each of the plurality of security types based on the guidance information associated with each of the plurality of security types;

[0134] determining, by using the attention mechanism network, security guidance features corresponding to each of the plurality of security types based on the guidance features corresponding to each of the plurality of security types and the standard features;

[0135] training the artificial intelligence model to be trained based on the sample identification information and the security guidance features corresponding to each of the plurality of security types, to obtain the artificial intelligence model.

[0136] In an optional implementation, the determining, by using the recurrent neural network, guidance features corresponding to each of the plurality of security types based on the guidance information associated with each of the plurality of security types includes:

[0137] for each of the plurality of security types,

[0138] for each of the guidance information associated with the security type, inputting the guidance information into the recurrent neural network to obtain global features of the guidance information output by the recurrent neural network, and extracting local features corresponding to the security type from the global features;

[0139] determining the guidance features corresponding to the security type based on the local features corresponding to the security type.

[0140] In an optional implementation, the associating processing of the first identification information and the probability information to obtain second identification information includes:

[0141] cluster the first identification information based on target information of the at least one communication relay point, to obtain at least one first cluster, wherein the target information comprises communication capability information and / or geographical information;

[0142] perform association processing on the first identification information and the probability information based on the first cluster, to obtain second identification information.

[0143] In an optional implementation, the performing association processing on the first identification information and the probability information based on the first cluster, to obtain second identification information, comprises:

[0144] selecting a second cluster from the at least one first cluster according to the probability information;

[0145] performing association processing on the first identification information and the probability information based on the second cluster, to obtain second identification information.

[0146] In an optional implementation, the target information at least comprises the communication capability information and the geographical information, and the clustering the first identification information based on target information of the at least one communication relay point, to obtain at least one first cluster, comprises:

[0147] clustering the first identification information based on geographical information of the at least one communication relay point, to obtain at least one third cluster;

[0148] determining a farthest communication distance of the at least one communication relay point under a specified communication strategy based on communication capability information of the at least one communication relay point;

[0149] clustering the at least one third cluster based on the farthest communication distance of the at least one communication relay point, to obtain the at least one first cluster.

[0150] In an optional implementation, the at least one communication relay point is contained in the distributed system;

[0151] The communication system further comprises a characteristic information module, which is configured to:

[0152] determining an architecture diagram of the distributed system before the determining the probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the architecture diagram comprises a plurality of nodes and edges between the plurality of nodes, the plurality of nodes comprise a first node, a second node and at least one third node, the first node represents the cloud, the second node represents the gateway, and the at least one third node represents the at least one communication relay point;

[0153] determine the respective characteristic information of the at least one communication relay point based on the architecture graph.

[0154] In an optional implementation, the determining the respective characteristic information of the at least one communication relay point based on the architecture graph comprises:

[0155] recognize the respective characteristic information of the at least one communication relay point based on the architecture graph by using a graph neural network, wherein the graph neural network is obtained by pre-training based on sample data, the sample data comprises a sample architecture graph and a label, the label is adapted to indicate sample node characteristic information corresponding to the sample architecture graph, the sample architecture graph comprises a plurality of sample nodes and edges between the plurality of sample nodes, part of the sample nodes correspond to sample communication connections, and the sample node characteristic information represents characteristics of the part of the sample nodes corresponding to the sample communication connections.

[0156] In an optional implementation, the training manner of the graph neural network comprises:

[0157] obtaining the sample data;

[0158] recognizing predicted characteristic information corresponding to the part of the sample nodes by using a to-be-trained graph neural network based on the sample architecture graph;

[0159] training the to-be-trained graph neural network based on a difference between the sample node characteristic information indicated by the label and the predicted characteristic information, to obtain the graph neural network.

[0160] In a third aspect, an embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement steps of the cloud network collaborative distributed secure communication method based on artificial intelligence.

[0161] In a fourth aspect, an embodiment of the present application provides a computer program product, which comprises computer instructions, and the computer instructions are executed by a processor to implement steps of the cloud network collaborative distributed secure communication method based on artificial intelligence.

[0162] In a fifth aspect, an embodiment of the present application provides a computer device, which comprises a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, and the processor executes the computer program to implement steps of the cloud network collaborative distributed secure communication method based on artificial intelligence.

[0163] Reference is made to Figure 3The computer device of this embodiment comprises a processor 301, a memory 302, and a computer program stored in the memory 302 and executable on the processor 301, for example, an artificial intelligence-based cloud network collaborative distributed security communication program. The processor 301 implements the steps in each of the above artificial intelligence-based cloud network collaborative distributed security communication method embodiments when executing the computer program, for example Figure 1 The steps S101-S105 shown.

[0164] For example, the computer program can be divided into one or more modules / units, which are stored in the memory 302 and executed by the processor 301 to complete the present application. The one or more modules / units can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the computer device.

[0165] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The computer device can include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art can understand that the schematic diagram is only an example of the computer device, and does not limit the computer device, which can include more or fewer components than the diagram, or combine certain components, or different components, for example, the computer device can also include an input / output device, a network access device, a bus, and the like.

[0166] The processor 301 can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. The general-purpose processor can be a microprocessor or the processor 301 can also be any conventional processor, and the like. The processor 301 is the control center of the computer device, which connects all parts of the computer device through various interfaces and lines.

[0167] The memory 302 can be used to store the computer programs and / or modules, and the processor 301 realizes various functions of the computer device by running or executing the computer programs and / or modules stored in the memory 302, and calling the data stored in the memory 302. The memory 302 can mainly include a program storage area and a data storage area, wherein the program storage area can store operating systems, at least one application program required by a function (such as a sound playing function, an image playing function, etc.), and the like; and the data storage area can store data created according to the use of the mobile phone (such as audio data, a phone book, etc.), and the like. In addition, the memory 302 can include a high-speed random access memory, and can also include a nonvolatile memory, for example, a hard disk, a memory, a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, at least one disk storage device, a flash memory device, or other volatile solid-state memory devices.

[0168] The modules / units integrated in the computer device, if realized in the form of software function units and sold or used as independent products, can be stored in a computer readable storage medium. Based on this understanding, all or part of the processes in the above-mentioned embodiment methods can also be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. When the processor 301 executes the computer program, the steps of the above-mentioned various method embodiments can be realized. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or some intermediate forms, etc. The computer readable medium can include any entity or device capable of carrying the computer program code, recording media, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, etc.

[0169] In summary, the embodiments of the present application have at least the following beneficial effects:

[0170] By adopting the embodiment of the application, network timing data corresponding to the communication connection is acquired; threat event identification is performed on the network timing data to obtain first identification information; for each communication relay point, probability information corresponding to the communication relay point is determined based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection; the first identification information and the probability information are associated to obtain second identification information; a pre-trained artificial intelligence model is used to determine a cloud-network collaborative distributed security protection strategy according to the second identification information, and the cloud-network collaborative distributed security protection strategy is sent to the gateway, so that the communication security of the distributed security communication system can be improved.

[0171] Through the above description of the embodiments, those skilled in the art can clearly understand that the application can be implemented by means of software and necessary hardware platforms, and of course, it can also be implemented entirely by hardware. Based on such understanding, all or part of the technical solutions of the application that contribute to the background art can be embodied in the form of a software product. The computer software product can be stored in a storage medium, such as a ROM (Read-Only Memory), a RAM (Random Access Memory), a magnetic disk, an optical disk, etc., and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0172] The above is the preferred embodiment of the application. It should be noted that, for those skilled in the art, without departing from the principles of the application, a number of improvements and refinements can be made, which are also considered within the protection scope of the application.

Claims

1. An artificial intelligence-based cloud network collaborative distributed security communication method, characterized in that, The method is suitable for a cloud in a distributed system, the distributed system further comprising a gateway having a communication connection with the cloud, the communication connection being built based on at least one communication relay point, the method comprising: obtaining network timing data corresponding to the communication connection; performing threat event identification on the network timing data to obtain first identification information; for each communication relay point, determining probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection; performing association processing on the first identification information and the probability information to obtain second identification information; determining a cloud-network collaborative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and sending the cloud-network collaborative distributed security protection strategy to the gateway.

2. The method of claim 1, wherein, The to-be-trained artificial intelligence model comprises a recurrent neural network and an attention mechanism network, and a training process of the artificial intelligence model comprises: obtaining sample identification information and a plurality of guide information corresponding thereto, wherein the plurality of guide information is associated with a plurality of security types, each guide information is associated with at least one of the plurality of security types, at least two guide information in the plurality of guide information are associated with different security types, and standard features corresponding to the plurality of security types are pre-stored in the attention mechanism network; determining guide features corresponding to each security type in the plurality of security types by using the recurrent neural network based on the guide information associated with each security type; determining security guide features corresponding to each security type by using the attention mechanism network based on the guide features and the standard features corresponding to each security type; training the to-be-trained artificial intelligence model based on the sample identification information and the security guide features corresponding to each security type of the plurality of security types to obtain the artificial intelligence model.

3. The method of claim 2, wherein, The method comprises: for each security type, for each guide information associated with the security type, inputting the guide information into the recurrent neural network to obtain global features of the guide information output by the recurrent neural network, and extracting local features corresponding to the security type from the global features; determining guide features corresponding to the security type based on the local features corresponding to the security type.

4. The method of claim 1, wherein, The method comprises: performing clustering on the first identification information based on target information of each of the at least one communication relay point to obtain at least one first cluster, wherein the target information comprises communication capability information and / or geographic information; Based on the first cluster, the first identification information and the probability information are associated to obtain second identification information.

5. The method of claim 4, wherein, The association processing of the first identification information and the probability information based on the first cluster to obtain the second identification information comprises: According to the probability information, a second cluster is selected from the at least one first cluster; Based on the second cluster, the first identification information and the probability information are associated to obtain second identification information.

6. The method of claim 4, wherein, The target information at least includes the communication capability information and the geographic information, and the clustering of the first identification information based on the target information of each of the at least one communication relay point to obtain at least one first cluster comprises: Based on the geographic information of each of the at least one communication relay point, the first identification information is clustered to obtain at least one third cluster; Based on the communication capability information of each of the at least one communication relay point, the farthest communication distance of each of the at least one communication relay point under the specified communication strategy is determined; Based on the farthest communication distance of each of the at least one communication relay point, the at least one third cluster is clustered to obtain the at least one first cluster.

7. The method according to any one of claims 1 to 6, characterized in that, The at least one communication relay point is included in the distributed system; Before the probability information corresponding to the communication relay point is determined based on the network timing data and the characteristic information of the communication relay point, the method further comprises: Determine the architecture diagram of the distributed system, wherein the architecture diagram comprises a plurality of nodes and edges between the plurality of nodes, the plurality of nodes comprising a first node, a second node and at least one third node, the first node representing the cloud, the second node representing the gateway, and the at least one third node representing the at least one communication relay point; Based on the architecture diagram, the characteristic information of each of the at least one communication relay point is determined.

8. The method of claim 7, wherein, The determination of the characteristic information of each of the at least one communication relay point based on the architecture diagram comprises: Based on the architecture diagram, the characteristic information of each of the at least one communication relay point is identified by a graph neural network, wherein the graph neural network is pre-trained based on sample data, the sample data comprising sample architecture diagram and label, the label being adapted to indicate sample node characteristic information corresponding to the sample architecture diagram, the sample architecture diagram comprising a plurality of sample nodes and edges between the plurality of sample nodes, part of the plurality of sample nodes corresponding to sample communication connection, and the sample node characteristic information representing the characteristics of the part of the plurality of sample nodes corresponding to the sample communication connection.

9. The method of claim 8, wherein, The training method of the graph neural network comprises: Obtain the sample data; Based on the sample architecture diagram, the predicted characteristic information corresponding to the part of the plurality of sample nodes is identified by a to-be-trained graph neural network; Based on the difference between the sample node characteristic information indicated by the label and the predicted characteristic information, the to-be-trained graph neural network is trained to obtain the graph neural network.

10. An artificial intelligence-based cloud network cooperative distributed security communication system, characterized in that, The application is suitable for a cloud in a distributed system, the distributed system further comprising a gateway having a communication connection with the cloud, the communication connection being built based on at least one communication relay point, and the communication system comprising: a data acquisition module configured to acquire network timing data corresponding to the communication connection; a threat identification module configured to identify a threat event from the network timing data to obtain first identification information; a probability module configured to determine, for each communication relay point, probability information corresponding to the communication relay point based on the network timing data and characteristic information of the communication relay point, wherein the probability information represents a probability that each data point in the network timing data matches the communication relay point, and the characteristic information represents characteristics possessed by the communication relay point in the communication connection; an association module configured to perform association processing on the first identification information and the probability information to obtain second identification information; a protection module configured to determine a cloud-network collaborative distributed security protection strategy according to the second identification information by using a pre-trained artificial intelligence model, and send the cloud-network collaborative distributed security protection strategy to the gateway.

Images