An artificial intelligence-based network security level protection evaluation method and system

Abstract

This invention discloses an artificial intelligence-based method and system for assessing network security level protection. Relating to the field of internet security technology, this invention extracts key operations through time-granular adaptive slicing, traces the triggering, propagation, and influencing sub-genes in reverse, and constructs a risk gene chain. It calculates propagation power scores based on an asset resistance matrix, defines the risk impact range using an elastic boundary radius, and dynamically adjusts it. Finally, it dynamically adjusts thresholds by combining network environment factors and similarity with the gene chain library to classify security risk levels. This invention improves the automation and dynamic adaptability of the assessment, enhances the accuracy of risk assessment, and provides effective support for network security protection.

Description

Technical Field

[0001] This invention relates to the field of internet security technology, specifically to a network security level protection assessment method and system based on artificial intelligence. Background Technology

[0002] Cybersecurity level protection assessment is a crucial step in ensuring network system security, its core being the accurate identification of risks and the quantification of risk levels. However, existing cybersecurity level protection assessment methods have several limitations:

[0003] First, the evaluation process relies too heavily on manual analysis, lacks an automated extraction mechanism for key operations in cybersecurity incidents, and has a fixed time slice granularity, making it difficult to adapt to events of different durations, resulting in the loss of details in short events and data redundancy in long events.

[0004] Secondly, the risk factor tracing is not systematic, the extraction of triggering, propagation and impact sub-genes lacks a standardized process, the matching of attack patterns and vulnerabilities relies on simple comparisons and is not verified in conjunction with asset configuration, which is prone to false alarms.

[0005] Third, the failure to dynamically correlate asset resilience with threat propagation characteristics leads to distorted risk boundary assessments; rigid security level thresholds fail to consider the correlation between business scenario fluctuations and historical risk patterns, making it difficult to adapt to dynamic risk changes in complex network environments, resulting in biased final evaluation results.

[0006] Therefore, there is an urgent need for an intelligent and dynamic assessment method to improve the accuracy of cybersecurity level protection assessment. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides an artificial intelligence-based network security level protection assessment method and system, which solves the problems of existing network security level protection assessments relying on manual labor and having poor dynamic adaptability.

[0008] To achieve the above objectives, the present invention provides the following technical solution: a network security level protection assessment method based on artificial intelligence, comprising:

[0009] S1. For cybersecurity incidents, key operations are extracted by time-granular adaptive slicing, triggering sub-genes, propagation sub-genes and influencing sub-genes are traced in reverse, and spliced ​​into risk gene chains and stored in gene chain library.

[0010] S2. Construct an asset resilience matrix, calculate the propagation power score based on the propagation sub-genes of the risk gene chain, define the scope of risk impact through the elastic boundary radius, and dynamically adjust the boundary.

[0011] S3. Based on the preset security level threshold, combined with the network environment factor drift threshold, and combined with the current state and the similarity of the gene library to dynamically adjust the threshold, the final security risk level is determined.

[0012] As a further aspect of the present invention, the slice granularity G is dynamically adjusted according to the event duration T, and the specific formula is as follows:

[0013]

[0014] in, This is the floor symbol.

[0015] As a further aspect of the present invention, the specific steps for tracing the trigger gene are as follows:

[0016] Extract abnormal commands from key slicing operations and standardize them;

[0017] The attack patterns in the CVE vulnerability database are analyzed in a structured manner, and typical attack command templates, affected asset types, and triggering conditions corresponding to each CVE vulnerability are extracted.

[0018] The standardized abnormal commands and typical attack command templates for CVE vulnerabilities are compared by string similarity calculation, where the similarity is 1 - (edit distance / length of the longer string).

[0019] Based on historical attack data, a preset similarity threshold is set to filter out CVE vulnerabilities with similarity ≥ the threshold, forming a candidate vulnerability list. The candidate list is then sorted in descending order of similarity, with high-similarity vulnerabilities being retained first.

[0020] Extract the configuration information of the current network assets and verify the matching between candidate vulnerabilities and assets;

[0021] Based on the similarity of candidate vulnerabilities and the verification results, the final triggering sub-gene is determined: if only one meets the conditions, it is output directly; if multiple meet the conditions, the vulnerability with the highest similarity and that has passed verification is selected.

[0022] As a further aspect of the present invention, the specific steps for tracing the propagation of daughter genes are as follows:

[0023] Extract network connection records from event slices and construct a network traffic graph, where nodes represent assets, edges represent connections, and edge weights represent transmission frequencies.

[0024] The K-means algorithm is used to cluster paths in the network traffic graph to identify high-frequency propagation paths, and the propagation carrier is determined by combining protocol analysis.

[0025] As a further aspect of the present invention, the specific steps for tracing the influence of daughter genes are as follows:

[0026] An asset valuation matrix is ​​established based on business coreness and data sensitivity. Business coreness is divided into core, important, and peripheral, with weights of 5, 3, and 1 respectively. Sensitivity is divided into high, medium, and low, with weights of 5, 3, and 1 respectively.

[0027] The asset value coefficient K is calculated based on the asset valuation matrix, where K = business core weight + sensitivity weight;

[0028] According to the formula

[0029] The service interruption loss L2 is calculated using the formula L2 = Interruption duration × Hourly business revenue × K.

[0030] The repair cost L3 is calculated using the formula L3 = emergency response manpower cost + system repair cost.

[0031] Calculate the total business loss value L = L1 + L2 + L3;

[0032] According to the formula L(t)=L×e -λt Adjust the loss value of the business over time, where t is the time after the attack occurs and λ is the decay coefficient;

[0033] Output the influencing subgenes and the loss value L after decay.

[0034] As a further aspect of the present invention, the specific steps for calculating the propagation force score are as follows:

[0035] Extract the propagation vector, frequency factor, and range factor from the propagation gene;

[0036] The propagation vectors are classified into high-quality vectors, medium-quality vectors, and low-quality vectors, with corresponding baseline scores of 70, 50, and 30, respectively. The vector type can be directly matched through the network log in the propagation gene.

[0037] The frequency factor = number of propagations per unit time / industry benchmark number of propagations, with a value range of [0.3, 1.5]. Values ​​outside the range are taken from the boundary values ​​of the range.

[0038] The range factor is calculated as (number of affected asset types / 3) + 0.5, with a value range of [0.5, 1.8]. Values ​​outside this range are taken from the boundary values ​​of the range.

[0039] The transmissibility score F is obtained by formula F = (base score of propagation vector × influence factor × range factor). If there is an intercepted record in the propagation gene, F needs to be multiplied by 0.7, where F ∈ [0, 100]. If it exceeds the range, the boundary value of the range is taken.

[0040] As a further aspect of the present invention, the average asset resistance is calculated. And according to the formula Calculate the elastic boundary radius S, where [] represents the floor function, S∈[0,5]. If S exceeds the range, then take the boundary value of the range.

[0041] As a further aspect of the present invention, a preset security level basic thresholds Fmin and Fmax are constructed with S as the independent variable, and the specific formula is Fmin. min =50-5S-S 2 F max =90-10S.

[0042] As a further aspect of the present invention, the specific steps for obtaining the final threshold are as follows:

[0043] According to the formula Calculate the network environment factor p(q), where q is the business activity index;

[0044] The drift threshold is obtained as: threshold × (1 + p(q));

[0045] The similarity Sim with the gene library is calculated. Based on Sim, the thresholds after drift are further dynamically adjusted to obtain the final thresholds Fmin' and Fmax'. The specific adjustment rules are as follows:

[0046] If Sim > 0.8, then the threshold after drift is multiplied by 0.8;

[0047] If 0.5 ≤ Sim ≤ 0.8, the threshold remains unchanged after drifting;

[0048] If Sim < 0.5, then the threshold after drift is multiplied by 1.1;

[0049] Security risk levels are determined by a final threshold:

[0050] If F < Fmin', it is judged as low risk; if Fmin' ≤ F ≤ Fmax', it is judged as medium risk; if F > Fmax', it is judged as high risk.

[0051] An artificial intelligence-based cybersecurity level protection assessment system includes:

[0052] The gene chain extraction module, targeting cybersecurity incidents, uses time-granular adaptive slicing to extract key operations, reverse-traces triggering sub-genes, propagation sub-genes and influencing sub-genes, splices them into risk gene chains and stores them in the gene chain library.

[0053] The boundary definition module constructs an asset resilience matrix, calculates the propagation power score based on the propagation sub-genes of the risk gene chain, defines the scope of risk impact through the elastic boundary radius, and dynamically adjusts the boundary.

[0054] The security risk classification module, based on a preset security level threshold, combined with a network environment factor drift threshold, and dynamically adjusted by combining the current state with the similarity of the gene library, determines the final security risk level.

[0055] This invention provides a network security level protection assessment method and system based on artificial intelligence, which has the following advantages compared with the prior art:

[0056] (1) This invention extracts key operations by time-granular adaptive slicing and generates risk gene chains by combining reverse tracing mechanism, thereby realizing refined analysis of network security incidents, avoiding information loss and redundancy caused by fixed slice granularity, and improving the accuracy of risk factor extraction.

[0057] (2) This invention constructs an asset resistance matrix and dynamically calculates the elastic boundary radius, thereby linking the propagation force with the asset defense capability and achieving precise definition of the scope of risk impact;

[0058] (3) This invention introduces gene chain library similarity comparison and environmental factor drift mechanism, so that the evaluation threshold can be dynamically adjusted according to business scenarios and historical risk patterns, which improves the adaptability of grade protection evaluation to complex network environment and reduces false alarms and false alarms. Attached Figure Description

[0059] Figure 1 This is a flowchart of the steps of the present invention;

[0060] Figure 2 This is a system framework diagram of the present invention. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0062] like Figure 1 This invention provides an artificial intelligence-based network security level protection assessment method, comprising:

[0063] S1. For cybersecurity incidents, key operations are extracted by time-granular adaptive slicing, triggering sub-genes, propagation sub-genes and influencing sub-genes are traced in reverse, and spliced ​​into risk gene chains and stored in gene chain library.

[0064] The duration and information density of cybersecurity incidents vary greatly. A fixed granularity cannot balance the preservation of details with efficiency. Short events have high information density, and a fixed coarse granularity will lose temporal details, while long events have low information density, and a fixed fine granularity will generate a large amount of invalid data, increasing the computational burden.

[0065] Therefore, the slice granularity G needs to be dynamically adjusted according to the event duration T, and the specific formula is as follows:

[0066]

[0067] in, This is the floor symbol;

[0068] When 0 < T ≤ 60, it indicates a short event, requiring a fixed fine-grained timeframe.

[0069] Critical operations in short events are concentrated within a short period of time, such as sudden SQL injection attacks, which have high information density. In this case, fine-grained slicing can retain more details and avoid the merging of critical operations due to overly coarse slicing.

[0070] When 60 < T ≤ 720, it indicates a medium-to-long-term event, where the granularity increases linearly with time, but the increase is relatively slow.

[0071] The key operations in medium- to long-term events are relatively dispersed, such as DDoS attacks lasting several hours. Information density decreases over time, as shown in the formula above. It can be seen that for every 48 minutes, the granularity increases by 1 minute, which avoids overly fine granularity for short events while ensuring that the slices for critical stages are sufficiently fine.

[0072] When T > 720, it indicates a long event, where the granularity increases linearly with time, but the growth rate accelerates.

[0073] Long events may be in a low-activity state for most of the time, such as the spread of a worm virus lasting for several days, with extremely low information density, as shown in the above formula. It can be seen that for every 24 minutes increase, the particle size increases by 1 minute, which can quickly improve the particle size to reduce the total number of slices;

[0074] Because critical operations in cybersecurity incidents have strict temporal sequences, it is necessary to extract the raw logs of system calls, network connections, file operations, etc., from each slice using a sliding window to ensure the temporal continuity and operational integrity of the logs and avoid the breakage of critical information due to abrupt segmentation. The specific operation steps are as follows:

[0075] Starting from the event start time t0, the window size is G, the window movement step is G, windows cannot overlap, and data duplication is avoided.

[0076] Starting from t0, sequentially extract time segments [t0, t0+G), [t0+G, t0+2G), ..., [t0+(n-1)G, t0+nG) until the event end time t is covered. end When the last window is less than G, the actual remaining time is used as the granularity;

[0077] For each window, extract the system call logs, network connection logs, and file operation logs for that time period to form the operation set for that slice;

[0078] The operations in each slice are converted into feature vectors, and key operations are selected.

[0079] For text-based operations, the specific steps to convert them into feature vectors are as follows:

[0080] Split the command string into a list of words by spaces and special characters;

[0081] Count the unique words that appear in all slices and generate a vocabulary list;

[0082] Each operation is converted into a vector with a vocabulary dimension, where the vector value is the number of times the word appears.

[0083] TF-IDF weighting of bag-of-words vectors enhances feature discriminative power;

[0084] According to the formula Calculate the operation weights;

[0085] For numerical operations, the specific steps to convert them into feature vectors are as follows:

[0086] Standardize the numerical features using Z-score;

[0087] The standardized numerical features are concatenated into a complete feature vector;

[0088] According to the formula Calculate the operation weights;

[0089] The dynamic threshold is calculated using the formula ((median of global operation weights) × (1 + anomaly coefficient α)).

[0090] If the operation weight is greater than or equal to the dynamic threshold, it is directly marked as a key weight;

[0091] The specific steps for tracing the trigger gene are as follows:

[0092] Extract abnormal commands from key slicing operations and standardize them, including removing redundant parameters and unifying command formats;

[0093] The attack patterns in the CVE vulnerability database are analyzed in a structured manner, and typical attack command templates, affected asset types, and triggering conditions corresponding to each CVE vulnerability are extracted.

[0094] The string similarity between the standardized abnormal command and the typical attack command template of CVE vulnerability is calculated. The edit distance algorithm, such as Levenshtein distance, is used to calculate the minimum number of insertion, deletion and replacement operations required to convert the abnormal command into the template command. The specific formula is: similarity = 1 - (edit distance / length of the longer string).

[0095] Based on historical attack data, a preset similarity threshold is set to filter out CVE vulnerabilities with similarity ≥ the threshold, forming a candidate vulnerability list. The candidate list is then sorted in descending order of similarity, with high-similarity vulnerabilities being retained first.

[0096] Extract the configuration information of current network assets, including asset type, version number, open ports, and installed patches;

[0097] Verifying the match between candidate vulnerabilities and assets can be done from the following three aspects: checking whether the asset type is within the range of asset types affected by the vulnerability; checking whether the asset version is within the range of versions affected by the vulnerability; and checking whether the triggering conditions are met.

[0098] False positives may occur if command matching is used alone, such as matching the attack command for a vulnerability, but the target asset is not affected by the vulnerability. Combining asset configuration verification can eliminate such false positives.

[0099] Based on the similarity of candidate vulnerabilities and the verification results, the final triggering sub-gene is determined: if only one meets the condition, it is output directly; if multiple meet the condition, the vulnerability with the highest similarity and that has passed verification is selected.

[0100] The specific steps for tracing the propagation of daughter genes are as follows:

[0101] Extract network connection records from event slices and construct a network traffic graph, where nodes represent assets, edges represent connections, and edge weights represent transmission frequencies.

[0102] The K-means algorithm is used to cluster paths in the network traffic graph to identify high-frequency propagation paths, such as a certain IP frequently sending requests to multiple database servers. Combined with protocol analysis, the propagation carrier is determined.

[0103] For example, the traffic graph shows that the attack started from the web server (IP 192.168.1.10) and connected to the database server (IP 192.168.1.20) through port 3306 (MySQL). The number of bytes transmitted surged during the attack period. Cluster analysis marked this path as a high-frequency propagation path. Combined with protocol analysis, it was determined that the propagation carrier was to exploit web vulnerabilities to gain database privileges.

[0104] The specific steps for tracing the influence of daughter genes are as follows:

[0105] An asset valuation matrix was established, taking into account two dimensions: business coreness and data sensitivity. Business coreness was divided into core, important, and peripheral, with weights of 5, 3, and 1 respectively. Sensitivity was divided into high, medium, and low, with weights of 5, 3, and 1 respectively.

[0106] The asset value coefficient K is assigned based on the matrix, which is the business core weight + sensitivity weight, and its range is [2,10].

[0107] According to the formula

[0108] The service interruption loss L2 is calculated using the formula L2 = Interruption duration × Hourly business revenue × K.

[0109] The repair cost L3 is calculated using the formula L3 = emergency response manpower cost + system repair cost.

[0110] Calculate the total business loss value L = L1 + L2 + L3;

[0111] The time decay function is used to adjust the loss value of the service over time. The specific formula is L(t) = L × e -λt , where t is the time after the attack occurs, and λ is the attenuation coefficient;

[0112] Exponential decay aligns with the impact patterns of cybersecurity incidents, with core assets decaying slowly and peripheral assets decaying quickly, better reflecting the actual evolution of risks.

[0113] The output influences sub-genes, which can be structurally described as "loss type + initial loss point + current loss point after decay + duration of influence";

[0114] The Needleman-Wunsch algorithm was used to perform sequence alignment of trigger genes, propagation genes, and impact genes to construct a complete risk gene chain, such as CVE-2024-1234 (trigger gene) → Web vulnerability exploitation (propagation gene) → database record tampering of 1.6 million yuan (impact gene).

[0115] The newly generated gene chain needs to have its cosine similarity Sim calculated with the existing chains in the library. If Sim < 80%, a new record is added; if Sim ≥ 80%, the occurrence frequency of the corresponding chain is updated.

[0116] S2. Construct an asset resilience matrix, calculate the propagation power score based on the propagation sub-genes of the risk gene chain, define the scope of risk impact through the elastic boundary radius, and dynamically adjust the boundary;

[0117] The protection foundation of different assets varies naturally. It is usually related to three factors: the strength of protection measures (A), the vulnerability repair rate (B), and the number of historical attacks resisted (C). The asset's resilience can be calculated using the formula R = A × 0.4 + B × 0.3 + C × 0.3.

[0118] A protection score of A can be calculated from four aspects: firewall rules, intrusion detection, data encryption measures, and access control mechanisms, each accounting for 25 points.

[0119] Firewall rules deduct 5 points for each missing critical port, and deduct 3 points for every 5% or more of redundant rules.

[0120] For intrusion detection, 4 points are deducted for every 10% decrease in core asset coverage, and 2 points are deducted for every 1% increase in false alarm rate.

[0121] Data encryption measures must be implemented; failure to encrypt data transmission or storage will result in a deduction of 15 points.

[0122] Access control mechanism: 10 points will be deducted if multi-factor authentication is not enabled, and 5 points will be deducted for each unauthorized account found.

[0123] Vulnerability remediation score: B, based on Find B;

[0124] The attack resistance score is C, and the number of attacks successfully intercepted (su) and the maximum number of successful interceptions (Sumax) in the past 6 months are obtained based on... Calculate C;

[0125] After calculating the resistance R of each asset, the resistance values ​​of all assets are mapped into a two-dimensional matrix by IP address or hostname, and the physical location of the assets is marked.

[0126] The specific steps for calculating the transmissibility score based on the transmissibility subgenes of the risk gene chain are as follows:

[0127] Extract the propagation vector efficiency, frequency factor, and range factor from the propagation gene;

[0128] The transmission carriers are classified into three categories based on their concealment, diffusion speed, and coverage area, corresponding to the following basic scores:

[0129] For high-quality carriers, a score of 70 is set, such as email attachments, phishing links, and supply chain implants, which are highly concealed and can spread across networks.

[0130] For medium-sized carriers, a score of 50 is set, such as port scanning and weak password brute-force, which usually rely on network connections and have a moderate spread speed.

[0131] For low-optimal carriers, a score of 30 is set, such as USB flash drive transfers and physical access, which usually rely on physical contact and have a limited diffusion range.

[0132] Vector types, such as mail server records and port connection records, can be directly matched through the network logs in the propagation subgenes without subjective adjustment;

[0133] Frequency factor = number of propagations per unit time / industry benchmark number of propagations. The result is rounded to one decimal place and the value range is [0.3, 1.5]. Values ​​outside the range are taken directly from the boundary values.

[0134] The propagation frequency directly reflects the diffusion speed. Under the same carrier, an attack that propagates 100 times per hour is much more threatening than an attack that propagates once per hour. The factor coefficient can quantify this speed difference.

[0135] Scope factor = (number of affected asset types / 3) + 0.5. Asset types include servers, terminals, network equipment, and IoT devices, with a maximum of 4 types. The value range is [0.5, 1.8]. For those outside the range, the boundary value is taken directly.

[0136] The wider the asset types covered, the greater the destructive reach of the spread. For example, simultaneous attacks on servers and network devices may paralyze the entire network segment. Factor coefficients can quantify this difference in breadth.

[0137] The propagation power score F is obtained according to the formula F = (propagation vector base score × influence factor × range factor). If there is a record of propagation interception in the propagation gene, F needs to be multiplied by 0.7, where F ∈ [0, 100]. If it exceeds the interval, the interval boundary value is taken.

[0138] The product relationship reflects the synergistic effect of carrier capability, speed, and breadth. A high-quality carrier + high-frequency + wide-coverage attack will have an exponentially enhanced propagation power, which is consistent with the actual law of attack diffusion. However, if the propagation is blocked by defense measures, the actual propagation power will be directly reduced. Multiplying by 0.7 can avoid overestimating the attack that has been partially intercepted.

[0139] The specific steps for defining the scope of risk impact using the flexible boundary radius are as follows:

[0140] Calculate the average asset resistance

[0141] According to the formula Calculate the elastic boundary radius S, where [] represents the floor function, S∈[0,5]. If S exceeds the range, take the boundary value of the range. For example, S=2 represents the central asset + directly adjacent assets + adjacent assets of adjacent assets.

[0142] Assets within a radius S centered on the asset containing the trigger gene are considered high-probability affected areas.

[0143] S directly reflects the antagonistic relationship between the spread of risk and the asset's defensive capabilities: the stronger the spread, the weaker the asset's resistance, and the larger the boundary range, which conforms to the actual law of risk diffusion;

[0144] It is necessary to monitor changes in asset resistance R and transmissibility F in real time in order to update S in a timely manner;

[0145] For example, a company's network has 10 assets with an average resilience of... With a propagation force F = 45 and an initial boundary radius S = [45 / 40] = 1, the defined area is the central asset plus directly adjacent assets. One hour later, all 5 core assets have patched the vulnerability. The score is raised to 95 points, the new boundary radius S = [45 / 95] = 0, and the scope shrinks to only the central asset.

[0146] S3. Preset the basic threshold of security level, combine it with the basic threshold of network environment factor drift, and dynamically adjust the threshold by comparing the current state with the similarity Sim of the gene chain library to classify the security risk level.

[0147] The severity of a risk is determined by two core dimensions: the scope of impact (S) and the spread (F). S quantifies the boundaries that the risk may reach and directly determines the scale of the consequences that the risk may cause once it spreads.

[0148] For example, when S=1, the impact is localized and small-scale; even if the transmissibility F is high, the overall risk is limited. When S=5, the impact is nationwide; even if the transmissibility F is moderate, the overall risk may be very high.

[0149] Therefore, using S as the independent variable, the preset security level basic thresholds Fmin and Fmax are constructed, with the specific formula being F min =50-5S-S 2 F max =90-10s;

[0150] The quadratic term in Fmin causes Fmin to decrease rapidly as S increases, reflecting the rapid reduction of the low-risk threshold when the range expands.

[0151] Fmax uses a linear decreasing formula, with the absolute value of the slope being less than the non-linear decreasing rate of Fmin, to ensure that Fmax is always higher than Fmin.

[0152] If F < Fmin, it is judged as low risk; if Fmin ≤ F ≤ Fmax, it is judged as medium risk; if F > Fmax, it is judged as high risk.

[0153] The core function of environmental factors is to adapt risk assessment criteria to the real-time state of the business scenario, avoiding mechanical thresholds that are detached from actual business realities.

[0154] During peak business periods, core systems must be prioritized for operation. If the basic thresholds are too strict, frequent alarms may cause business interruptions. By relaxing the thresholds through environmental factors, a large number of redundant responses can be reduced, balancing security and business.

[0155] During non-working hours, when business activities are suspended, abnormal system behavior is more likely to be an attack. At this time, it is necessary to tighten the threshold so that even minor threats can trigger attention, and avoid missed attacks due to overly broad thresholds. For example, a slow scanning attack in the early morning may be harmless during the day, but it may be a precursor to an intrusion at night.

[0156] The basic thresholds Fmin and Fmax are set only based on the scope of influence S, without taking into account the time sensitivity and importance of the business. Therefore, it is necessary to use environmental factors to drift them.

[0157] Define a business activity index q to indirectly indicate the time sensitivity and importance of the business. Here, we select three core indicators: system load, transaction frequency, and number of online users, and standardize them respectively.

[0158] System load, i.e. CPU utilization, is standardized to a score of 0-30.

[0159] Transaction frequency, i.e., the number of business transactions per hour, is standardized to 0-35 minutes;

[0160] The number of online users, i.e., the number of real-time online users, is standardized to a score of 0-35.

[0161] The business activity index q is calculated as follows: system load score + transaction frequency score + number of online users score.

[0162] According to the formula Calculate the network environment factors, where the scaling factor is expressed as a fraction. To control the rate of change of the e-base function, 0.3 is used as a scaling factor to keep the function value range within (-0.3, 0.3).

[0163] Business activity changes continuously, and the e-base function can accurately capture this non-linear relationship:

[0164] When q is far from 50, that is, during off-peak or off-peak periods, the function value changes slowly, avoiding large fluctuations in the factor due to short-term business fluctuations.

[0165] When q approaches 50, which is during normal periods, the function value is more sensitive to changes in q, reflecting the need to quickly adjust the threshold during business state transitions.

[0166] The calculated threshold after drift is: threshold = base threshold × (1 + p(q));

[0167] For example, at 14:00 on a weekday, a bank's business activity index q = 70, and the environmental factor p(70) = 0.14 is calculated. At this time, S = 3, F = 28, and the basic thresholds Fmin = 26 and Fmax = 60 are calculated. After the environmental factor is applied, the thresholds are Fmin = 29.6 and Fmax = 68.4. If the risk level is classified according to the original threshold, it is classified as medium risk. After the environmental factor is applied to the basic threshold, the risk level is classified as low risk.

[0168] Based on the similarity Sim obtained from S1 and the gene library, the drifted thresholds are further dynamically corrected to obtain the final corrected thresholds Fmin' and Fmax'. The specific correction rules are as follows:

[0169] If Sim > 0.8, then the threshold after drift is multiplied by 0.8;

[0170] If 0.5 ≤ Sim ≤ 0.8, the threshold remains unchanged after drifting;

[0171] If Sim < 0.5, then the threshold after drift is multiplied by 1.1;

[0172] The higher the similarity, the more the current state conforms to known normal patterns, and the more predictable the system behavior is. In this case, tightening the threshold can more sensitively capture minor anomalies to avoid missed detections.

[0173] The lower the similarity, the more likely a new pattern exists in the current state. Relaxing the threshold can reduce false alarms by misjudging reasonable states.

[0174] The specific rules for classifying security risk levels are as follows:

[0175] If F < Fmin', it is considered low risk and can be recorded in the log; if Fmin' ≤ F ≤ Fmax', it is considered medium risk and requires triggering an alarm and notifying relevant operators; if F > Fmax', it is considered high risk and will automatically trigger isolation, blocking and other measures.

[0176] like Figure 2 A cybersecurity level protection assessment system based on artificial intelligence includes:

[0177] The gene chain extraction module, targeting cybersecurity incidents, uses time-granular adaptive slicing to extract key operations, reverse-traces triggering sub-genes, propagation sub-genes and influencing sub-genes, splices them into risk gene chains and stores them in the gene chain library.

[0178] The boundary definition module constructs an asset resilience matrix, calculates the propagation power score based on the propagation sub-genes of the risk gene chain, defines the scope of risk impact through the elastic boundary radius, and dynamically adjusts the boundary.

[0179] The security risk classification module, based on a preset security level threshold, combined with a network environment factor drift threshold, and dynamically adjusted by combining the current state with the similarity of the gene library, determines the final security risk level.

[0180] Some of the data in the above formulas are numerical calculations with dimensions removed, and the contents not described in detail in this specification are all prior art known to those skilled in the art.

[0181] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A cybersecurity level protection assessment method based on artificial intelligence, characterized in that, include: S1. For cybersecurity incidents, key operations are extracted by time-granular adaptive slicing, triggering sub-genes, propagation sub-genes and influencing sub-genes are traced in reverse, and spliced ​​into risk gene chains and stored in gene chain library. S2. Construct an asset resilience matrix, calculate the propagation power score based on the propagation sub-genes of the risk gene chain, define the risk impact range through the elastic boundary radius, and dynamically adjust the boundary. The specific steps for calculating the propagation power score are as follows: The propagation vector, frequency factor, and range factor are extracted from the propagation subgene. The propagation vector is divided into high-quality vector, medium-quality vector, and low-quality vector, with corresponding base scores of 70, 50, and 30, respectively. The vector type can be directly matched through the network log in the propagation subgene. The frequency factor = number of propagations per unit time / industry benchmark number of propagations, with a value range of [0.3, 1.5]. If the value exceeds the range, the boundary value of the range is taken. The range factor = (number of affected asset types / 3) + 0.5, with a value range of [0.5, 1.8]. If the value exceeds the range, the boundary value of the range is taken. The transmissibility score F is obtained according to the formula F=(transmission vector base score × impact factor × range factor). If there is an intercepted record in the transmissive gene, F needs to be multiplied by 0.7, where F∈[0,100]. If it exceeds the interval, the interval boundary value is taken. The process of defining the scope of risk impact by using the flexible boundary radius specifically includes calculating the average asset resistance = the sum of the resistance of all assets / the total number of assets, and calculating the flexible boundary radius S according to the formula, where [] represents the rounding symbol, S∈[0,5], and if S exceeds the range of values, the boundary value of the range is taken. S3. Based on the preset security level threshold, combined with the network environment factor drift threshold, and dynamically adjusted thresholds based on the similarity between the current state and the gene library, the final security risk level is determined. The specific steps are as follows: According to the formula Calculate the network environment factor p(q), where q is the business activity index; The drift threshold is obtained as: base threshold × (1 + p(q)). The similarity Sim with the gene library is calculated. The drift threshold is further dynamically adjusted based on Sim to obtain the final thresholds Fmin' and Fmax'. The specific adjustment rules are as follows: if Sim > 0.8, the drift threshold is multiplied by 0.8; if 0.5 ≤ Sim ≤ 0.8, the drift threshold remains unchanged; if Sim < 0.5, the drift threshold is multiplied by 1.

1. Safety risk levels are determined by the final threshold: if F < Fmin', it is considered low risk; if Fmin' ≤ F ≤ Fmax', it is considered medium risk; if F > Fmax', it is considered high risk.

2. The method for assessing network security level protection based on artificial intelligence according to claim 1, characterized in that, The slice granularity G is dynamically adjusted based on the event duration T, using the following formula: in, This is the floor symbol.

3. The method for assessing network security level protection based on artificial intelligence according to claim 1, characterized in that, The specific steps for tracing the trigger gene are as follows: Extract abnormal commands from key slicing operations and standardize them; The attack patterns in the CVE vulnerability database are analyzed in a structured manner, and typical attack command templates, affected asset types, and triggering conditions corresponding to each CVE vulnerability are extracted. The standardized abnormal commands and typical attack command templates for CVE vulnerabilities are compared by string similarity calculation, where the similarity is 1 - (edit distance / length of the longer string). Based on historical attack data, a preset similarity threshold is set to filter out CVE vulnerabilities with similarity ≥ the threshold, forming a candidate vulnerability list. The candidate list is then sorted in descending order of similarity, with high-similarity vulnerabilities being retained first. Extract the configuration information of the current network assets and verify the matching between candidate vulnerabilities and assets; Based on the similarity of candidate vulnerabilities and the verification results, the final triggering sub-gene is determined: if only one meets the conditions, it is output directly; if multiple meet the conditions, the vulnerability with the highest similarity and that has passed verification is selected.

4. The method for assessing network security level protection based on artificial intelligence according to claim 1, characterized in that, The specific steps for tracing the propagation of daughter genes are as follows: Extract network connection records from event slices and construct a network traffic graph, where nodes represent assets, edges represent connections, and edge weights represent transmission frequencies. The K-means algorithm is used to cluster paths in the network traffic graph to identify high-frequency propagation paths, and the propagation carrier is determined by combining protocol analysis.

5. The method for assessing network security level protection based on artificial intelligence according to claim 1, characterized in that, The specific steps for tracing the influence of daughter genes are as follows: An asset valuation matrix is ​​established based on business coreness and data sensitivity. Business coreness is divided into core, important, and peripheral, with weights of 5, 3, and 1 respectively. Sensitivity is divided into high, medium, and low, with weights of 5, 3, and 1 respectively. The asset value coefficient K is calculated based on the asset valuation matrix, where K = business core weight + sensitivity weight; According to the formula Calculate the data loss ; According to the formula =Interruption duration × Hourly revenue × K Calculate the service interruption loss ; According to the formula =Repair cost =Emergency response manpower cost +System repair cost Calculate the repair cost ; Calculate the total business loss value ; According to the formula Adjust the business loss value over time, where t is the time after the attack occurred. The attenuation coefficient; Output the influencing subgenes and the loss value L after decay.

6. The method for assessing network security level protection based on artificial intelligence according to claim 1, characterized in that, Using S as the independent variable, construct the preset security level basic thresholds Fmin and Fmax, the specific formula is as follows: , .

7. An AI-based network security level protection assessment system, used to execute the AI-based network security level protection assessment method according to any one of claims 1-6, characterized in that, include: The gene chain extraction module, targeting cybersecurity incidents, uses time-granular adaptive slicing to extract key operations, reverse-traces triggering sub-genes, propagation sub-genes and influencing sub-genes, splices them into risk gene chains and stores them in the gene chain library. The boundary definition module constructs an asset resilience matrix, calculates the propagation power score based on the propagation sub-genes of the risk gene chain, defines the scope of risk impact through the elastic boundary radius, and dynamically adjusts the boundary. The security risk classification module, based on a preset security level threshold, combined with a network environment factor drift threshold, and dynamically adjusted by combining the current state with the similarity of the gene library, determines the final security risk level.

Images