Network security prediction method and system based on artificial intelligence

Abstract

The invention relates to the technical field of network security, in particular to a network security prediction method and system based on artificial intelligence. The method comprises the following steps: carrying out network total acquisition and structured network feature mapping on a target network to generate structured network security feature data; constructing an initial network security prediction model based on an artificial intelligence network framework, and performing pre-training to obtain a pre-trained security prediction model; performing threat feature recursive extraction and network attack identification classification on the structured network security feature data to obtain target network attack type classification data; and carrying out network attack contact analysis and network security occurrence probability prediction based on the target network attack type classification data, constructing target network security defense strategy scheme data and carrying out iterative optimization prediction at the same time, so as to output a corresponding target network security prediction optimization result, and synchronizing the result to a terminal to guide target network security protection. According to the invention, intelligent prediction and defense of network security threats can be realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an artificial intelligence-based network security prediction method and system. Background Art

[0002] With the rapid development of artificial intelligence (AI), particularly breakthroughs in machine learning and deep learning in data analysis, AI-based network security prediction methods have gradually become a research hotspot. By learning and analyzing massive amounts of network data, AI can identify potential attack patterns, abnormal behaviors, and potential vulnerabilities, thereby predicting network security threats. However, traditional network security prediction methods mostly rely on rule bases and feature matching. While they can mine potential attack risks from large amounts of network traffic data, their poor ability to identify unknown threats means that the accuracy and timeliness of prediction results cannot meet the requirements of modern network security protection. Summary of the Invention

[0003] Based on this, it is necessary for the present invention to provide a network security prediction method and system based on artificial intelligence to solve at least one of the above technical problems.

[0004] To achieve the above objectives, a network security prediction method based on artificial intelligence includes the following steps:

[0005] Step S1: Full network data of the target network is collected through distributed network probes to obtain full data of the target network; structured network feature mapping is performed on the full data of the target network to generate structured network security feature data; an initial network security prediction model is constructed based on an artificial intelligence network framework, and the structured network security feature data is input into the initial network security prediction model for pre-training to obtain a pre-trained security prediction model;

[0006] Step S2: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features; perform network attack identification and classification based on the multi-dimensional threat feature data and the pre-trained security prediction model to obtain target network attack type classification data;

[0007] Step S3: Perform network attack contact analysis based on the target network attack type classification data to obtain a target network attack behavior trigger node set; perform network security occurrence probability prediction on the target network based on the target network attack behavior trigger node set and the pre-trained security prediction model to obtain target network security event probability prediction data;

[0008] Step S4: Construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

[0009] Furthermore, step S1 includes the following steps:

[0010] Step S11: Deploy distributed network probes on the core nodes, border gateways, and terminal devices corresponding to the target network, and collect corresponding network data including TCP / UDP session data, packet payloads, port access records, user operation logs, and application call records based on the distributed network probes to obtain the full data of the target network;

[0011] Step S12: pre-processing the full amount of target network data, performing data cleaning, format standardization, and structure conversion in sequence to obtain the full amount of target structured network data;

[0012] Step S13: extracting static features and dynamic features from the full data of the target structured network, where the static features include IP address, port number, and protocol type, and the dynamic features include session duration, packet size distribution, and request frequency, to obtain structured network security feature data;

[0013] Step S14: Based on the artificial intelligence network framework, a bidirectional long short-term memory network combined with an attention mechanism is used to construct an initial network security prediction model, and the structured network security feature data is divided into a training set and a validation set according to the time series;

[0014] Step S15: Use the training set to iteratively train the initial network security prediction model, and use the validation set to adjust the hyperparameters corresponding to the initial network security prediction model in real time, including the number of hidden layer neurons and the learning rate, until the prediction accuracy corresponding to the initial network security prediction model reaches a preset threshold, thereby obtaining a pre-trained security prediction model.

[0015] Furthermore, step S2 includes the following steps:

[0016] Step S21: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and authority abuse features;

[0017] Step S22: Build an initial threat signature library based on the multi-dimensional threat signature data to structure the multi-dimensional threat signature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and privilege abuse features according to feature type, frequency of occurrence, and degree of harm, and associate the corresponding CVE vulnerability numbers with ATT&CK attack framework labels to obtain target network threat signature library data;

[0018] Step S23: By setting up a signature database update mechanism to regularly collect the latest network threat data and update the corresponding target network threat signature database data through federated learning technology without leaking local data, to obtain dynamically updated threat signature database data;

[0019] Step S24: identifying network attack behaviors by combining the dynamically updated threat signature database data with the structured network security signature data corresponding to the target network predicted by the pre-trained security prediction model to obtain target network attack behavior identification data;

[0020] Step S25: classify the target network attack behavior identification data into attack types to obtain target network attack type classification data.

[0021] Furthermore, step S21 includes the following steps:

[0022] Performing feature distribution set statistics on each network security feature in the structured network security feature data to obtain a distribution density set corresponding to each network security feature;

[0023] Based on the distribution density set corresponding to each network security feature, each network security feature in the structured network security feature data is recursively screened in one stage to obtain the first-order feature data of the target network threat;

[0024] Perform distribution statistical analysis on each remaining network feature in the first-order feature data of the target network threat to calculate the distribution mean, distribution standard deviation, and distribution kurtosis corresponding to each remaining network feature and construct the corresponding feature vector to obtain the distribution vector corresponding to each remaining network feature;

[0025] Obtain a preset target network security threat feature library, and calculate the feature matching similarity between the distribution vector corresponding to each remaining network feature and the corresponding threat feature in the target network security threat feature library. At the same time, based on the feature matching similarity corresponding to each remaining network feature, perform a two-stage recursive screening on each remaining network feature in the target network threat first-order feature data to obtain the target network core threat feature data;

[0026] Based on the target network's core threat feature data, abnormal pattern mining is performed to identify threat feature combinations corresponding to deviations from normal behavior patterns through the isolation forest algorithm to obtain target network threat abnormal feature pattern data; based on the target network threat abnormal feature pattern data, feature classification and annotation are performed to distinguish multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and authority abuse features.

[0027] Furthermore, step S3 includes the following steps:

[0028] Step S31: obtaining network traffic, intrusion logs, and historical attack events corresponding to different attack types based on the target network attack type classification data;

[0029] Step S32: extracting network attack behaviors from the target network attack type classification data based on the network traffic, intrusion logs, and historical attack events corresponding to different attack types, so as to obtain the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network;

[0030] Step S33: Obtain the network topology and defense mechanism corresponding to the target network;

[0031] Step S34: performing network attack contact analysis based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and combining the network topology and defense mechanism corresponding to the target network to obtain a target network attack behavior trigger node set;

[0032] Step S35: Based on the target network attack behavior trigger node set and the pre-trained security prediction model, the target network is subjected to network security probability prediction to obtain target network security event probability prediction data.

[0033] Furthermore, step S34 includes the following steps:

[0034] Step S341: Based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and in combination with the network topology structure corresponding to the target network, a network attack topology mapping is performed to map the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types to network nodes corresponding to the network topology structure, so as to obtain a target attack path node set corresponding to different attack types of the target network;

[0035] Step S342: Based on the defense mechanism corresponding to the target network, a node attack assessment analysis is performed on the target attack pass node set corresponding to different attack types of the target network to obtain the attack reachability, attack importance, and defense security level corresponding to each node in the target network;

[0036] Step S343: Based on the attack reachability, attack importance and defense security level corresponding to each node in the target network, a network attack contact analysis is performed on the corresponding target attack node set to associate the corresponding attack reachability, attack importance and defense security level with the target network nodes that may be triggered, determine all the corresponding network attack trigger nodes that may occur for this attack type, and obtain the target network attack behavior trigger node set.

[0037] Furthermore, step S35 includes the following steps:

[0038] Step S351: performing an attack diffusion risk assessment on the corresponding network topology structure on the target network based on the target network attack behavior trigger node set to obtain target network attack diffusion risk assessment data;

[0039] Step S352: Based on the target network attack diffusion risk assessment data, corresponding core indicators for network attack risk prediction are obtained, including attack success rate, vulnerability exploitation difficulty, defense measure effectiveness, and attack duration, to obtain the target network attack risk initial indicator set data;

[0040] Step S353: Performing index screening and dimensionality reduction on the target network attack risk initial indicator set data, using principal component analysis to eliminate multicollinearity between indicators, and retaining principal components whose cumulative contribution rates exceed a threshold, to obtain target network attack risk prediction indicator data;

[0041] Step S354: By adding a time series prediction module on the basis of the pre-trained security prediction model, and using a gated recurrent unit to process the time series features corresponding to the target network attack risk prediction index data to construct a corresponding target network security event prediction model, and at the same time, dividing the target network attack risk prediction index data into time windows to input the target network security event prediction model for training, the sliding window method is used to predict the event type, prediction time, occurrence probability and impact range corresponding to the network security event in the future time period, and the target network security event probability prediction data is obtained.

[0042] Furthermore, step S4 includes the following steps:

[0043] Step S41: Obtaining a network security probabilistic risk assessment standard, and classifying the target network security event probability prediction data into four levels of low risk, medium risk, high risk, and extremely high risk based on the network security probabilistic risk assessment standard, thereby obtaining target network security event risk level data;

[0044] Step S42: Develop differentiated defense strategy data for different risk levels corresponding to the target network security incident risk level data, including: using a conventional monitoring strategy for low risk levels, initiating vulnerability remediation and access control enhancement for medium risk levels, deploying an intrusion prevention system and traffic cleaning for high risk levels, and implementing an emergency response strategy of isolating the affected area for extremely high risk levels;

[0045] Step S43: Perform security defense strategy evaluation on the differentiated defense strategy solution data to obtain a target network security defense strategy evaluation score; select the optimal target network defense strategy based on the target network security defense strategy evaluation score to generate target network defense initial strategy solution data including specific operation steps, execution subjects, and corresponding time nodes;

[0046] Step S44: Inputting the target network defense initial strategy data into a preset network attack and defense simulation platform for simulation verification to simulate the target network defense effect after the target network defense initial strategy data is implemented, and calculating the reduction in attack success rate and the reduction ratio of security incidents to obtain target network defense strategy verification data;

[0047] Step S45: Optimize the corresponding target network defense initial strategy plan data based on the target network defense strategy verification data to obtain the target network security defense strategy plan data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

[0048] Furthermore, the security defense strategy evaluation of the differentiated defense strategy solution data in step S43 includes the following steps:

[0049] Determine a defense strategy evaluation indicator system, including primary and secondary indicators. Primary indicators include defense effectiveness, implementation completion, and resource consumption; secondary indicators include attack interception rate, vulnerability repair rate, strategy deployment time, and hardware resource utilization.

[0050] Using the Delphi method, cybersecurity experts were invited to weight and score the corresponding first-level indicators in the defense strategy program evaluation index system. This was used to construct a judgment matrix and determine the indicator weights of each first-level indicator through consistency testing, thus obtaining the weight data of the first-level indicators of the defense strategy.

[0051] Based on the corresponding secondary indicators within the defense strategy evaluation index system, each defense strategy within the differentiated defense strategy data is quantified using the primary indicators. The corresponding defense effectiveness is quantified by the attack interception rate, the implementation completion is quantified based on the strategy deployment time combined with the vulnerability repair rate, and the corresponding resource consumption is quantified by the hardware resource utilization rate. The quantitative results of the defense strategy evaluation are obtained.

[0052] Based on the weight data of the first-level indicators of the defense strategy and the quantitative results of the defense strategy scheme evaluation, a weighted sum is performed to standardize the evaluation quantitative results corresponding to each defense strategy scheme and calculate the corresponding comprehensive evaluation score with the corresponding weight to obtain the target network security defense strategy evaluation score.

[0053] Furthermore, the present invention also provides an artificial intelligence-based network security prediction system for executing the artificial intelligence-based network security prediction method described above. The artificial intelligence-based network security prediction system includes:

[0054] The security prediction model training module is used to collect full network data of the target network through distributed network probes to obtain full data of the target network; perform structured network feature mapping on the full data of the target network to generate structured network security feature data; construct an initial network security prediction model based on the artificial intelligence network framework, and input the structured network security feature data into the initial network security prediction model for pre-training, thereby obtaining a pre-trained security prediction model;

[0055] The network attack classification module is used to recursively extract threat features from structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features. Based on the multi-dimensional threat feature data and the pre-trained security prediction model, network attacks are identified and classified to obtain target network attack type classification data.

[0056] The network security probability prediction module is used to analyze network attack touchpoints based on the target network attack type classification data to obtain the target network attack behavior trigger node set; based on the target network attack behavior trigger node set and the pre-trained security prediction model, the network security occurrence probability of the target network is predicted to obtain the target network security event probability prediction data;

[0057] The security defense iterative optimization module is used to construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization results, which are synchronized to the terminal to guide the target network security protection.

[0058] Beneficial effects of the present invention:

[0059] 1. The network security prediction method based on artificial intelligence proposed in the present invention has the beneficial effect of being able to acquire all the data of the target network in real time and comprehensively through distributed network probes, which provides strong data support for subsequent security analysis and prediction. The collection of the full data of the target network not only covers all kinds of connection information and protocol usage in the network, but also includes all network traffic and access logs and other data, which are crucial for identifying potential security risks. By performing structured network feature mapping on these raw data, complex network information can be converted into standardized, easy-to-process and analyze network security feature data, which provides high-quality data input for subsequent model training and prediction. The initial network security prediction model constructed based on the artificial intelligence network framework can learn the input data through machine learning algorithms to identify potential security threats. The pre-training process not only improves the prediction ability of the model, but also provides sufficient training samples for the model, so that the network security prediction model can accurately predict and classify potential threats to the target network, realize early warning and accurate assessment of target network security threats, and lay a solid foundation for subsequent defense and response measures. Secondly, the recursive threat signature extraction process can deeply mine network threat information at different levels and dimensions from structured network security feature data. These threat features include abnormal connection characteristics, malicious code characteristics, SQL injection characteristics, DDoS attack characteristics, and privilege abuse characteristics. By extracting multi-dimensional threat signature data, we can more comprehensively and accurately capture various types of attack behaviors within the target network. The multi-dimensional combination of these threat signatures can help network security prediction models more accurately identify different types of network attacks. By combining them with pre-trained security prediction models, we can achieve efficient identification and classification of network attacks. This process not only helps accurately identify attack types, but also determines the severity and impact of attacks based on the specific characteristics of attack behaviors, thus providing a scientific basis for formulating specific defense strategies. Then, by analyzing network attack touchpoints based on the target network attack type classification data, we can gain a deeper understanding of the key links and root causes of the attack behavior. Network attack touchpoints refer to the specific nodes or system components involved in the intrusion process. By analyzing these touchpoints, we can accurately identify the attack path and attack method, providing a direct basis for the subsequent defense strategy formulation. By focusing on the trigger points of attack behavior on the target network, we can identify weak links in network protection and provide precise guidance for vulnerability remediation, traffic monitoring, and security protection. Furthermore, by combining these attack behavior trigger points with pre-trained security prediction models, we can predict the probability of security incidents on the target network. This not only allows for timely identification of the timing of network attacks, but also allows for assessment of the impact of different attack types on network security.Finally, based on the probability prediction data of the target network security incident, the constructed security defense strategy can formulate targeted protection measures that adapt to the characteristics of the target network. This strategy not only includes the specific content of the defense measures, but also can be dynamically adjusted according to changes in the prediction data to cope with the ever-changing network security threats. By feeding the target network security defense strategy data into the pre-trained security prediction model for iterative optimization, it can achieve two-way feedback and optimization of the model and strategy, continuously improving the prediction accuracy and protection capabilities. Each optimization enables the security prediction model to better adapt to the specific security needs of the target network, thereby enhancing the ability to respond to network security incidents. At the same time, the optimized security prediction results can be synchronized to the network terminal in real time to guide the actual network security protection work. In this way, through continuous strategy optimization and prediction feedback, it is possible to maintain a high level of protection in a changing network environment and promptly detect potential network security incidents, thereby improving the accuracy and timeliness of the prediction results and making network security management more flexible and real-time.

[0060] 2. The artificial intelligence-based network security prediction system proposed in the present invention is composed of a security prediction model training module, a network attack classification module, a network security probability prediction module, and a security defense iterative optimization module. It can implement any one of the artificial intelligence-based network security prediction methods described in the present invention, and is used to combine the operations between the computer programs running on each module to implement an artificial intelligence-based network security prediction method. The internal structures of the system cooperate with each other, which can greatly reduce duplication of work and manpower investment, and can quickly and effectively provide a more accurate and efficient artificial intelligence-based network security prediction process, thereby simplifying the operation process of the artificial intelligence-based network security prediction system. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Other features, objects and advantages of the present invention will become more apparent upon reading the detailed description of non-limiting embodiments thereof made with reference to the following drawings:

[0062] Figure 1 The figure is a flowchart of the steps of the network security prediction method based on artificial intelligence of the present invention. DETAILED DESCRIPTION

[0063] The following is a clear and complete description of the technical method of the present invention in conjunction with the accompanying drawings. It is obvious that the embodiments described are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts are within the scope of protection of the present invention.

[0064] In addition, the accompanying drawings are merely schematic illustrations of the present invention and are not necessarily drawn to scale. Identical reference numerals in the figures denote identical or similar parts, and thus repetitive descriptions thereof will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities that do not necessarily correspond to physically or logically separate entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor and / or microcontroller approaches.

[0065] It should be understood that although the terms "first," "second," and the like may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used solely to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the scope of the exemplary embodiments. The term "and / or" as used herein includes any and all combinations of one or more of the listed associated items.

[0066] To achieve the above purpose, the present invention provides a network security prediction method based on artificial intelligence. In the embodiment of the present invention, please refer to Figure 1 FIG. 1 is a flow chart of the steps of the network security prediction method based on artificial intelligence of the present invention. In this example, the network security prediction method based on artificial intelligence includes the following steps:

[0067] Step S1: Full network data of the target network is collected through distributed network probes to obtain full data of the target network; structured network feature mapping is performed on the full data of the target network to generate structured network security feature data; an initial network security prediction model is constructed based on an artificial intelligence network framework, and the structured network security feature data is input into the initial network security prediction model for pre-training to obtain a pre-trained security prediction model;

[0068] In an embodiment of the present invention, distributed network probes are deployed in the target network (including 10 core nodes, 5 border gateways, and 200 terminals). The core node probes are connected to the switch mirror port, the border gateway probes are connected in series to the entry and exit links, and the terminal probes are embedded in the operating system kernel. The collection frequency is set to 1000 times per second. TCP sessions (the session between source IP 192.168.1.100 and destination IP 203.0.113.50 lasts for 15 seconds), UDP payloads (DNS query example.com, length 51 bytes), port access (source port 54321 accesses port 80 20 times), user operation logs (administrator logged in at 10:15), and application call records (process 1234 calls the libcurl library) are collected for 72 consecutive hours to generate 80GB of full data. The entire data set was structured and mapped, with duplicate records removed (retaining the beginning and end of TCP sessions), timestamps corrected (synchronized to the NTP server time with a maximum deviation of 0.3 seconds), and converted to JSON format (including fields such as timestamp and src_ip). A session table (associating session IDs with start and end times), a packet table (recording payload length), and an operation table (storing user behavior) were established to generate structured network security feature data (including six features: session duration and request frequency). An initial model was constructed based on the BiLSTM framework (input layer with 6 neurons, two bidirectional LSTM layers with 32 neurons each, an attention layer, a fully connected layer with 16 neurons, and an output layer with 1 neuron). The feature data was split into a training set (7000 normal samples and 3000 abnormal samples) and a validation set with a 7:3 ratio. The model was iterated 1000 times (learning rate 0.001, batch size 32), stopping when the validation set accuracy reached 95%. This resulted in a pre-trained security prediction model with a 98% recognition rate for port scans and a 94% recognition rate for abnormal traffic.

[0069] Step S2: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features; perform network attack identification and classification based on the multi-dimensional threat feature data and the pre-trained security prediction model to obtain target network attack type classification data;

[0070] In this embodiment of the present invention, threat signatures are recursively extracted from structured network security signature data. In the first phase, session duration (variance 8.2%), request frequency (7.5%), and packet size mean (6.1%) are filtered based on the feature distribution variance (threshold 5%). In the second phase, cosine similarity with a pre-defined threat library is calculated (threshold 0.7), retaining session duration (0.89) and request frequency (0.76). An isolation forest algorithm (100 trees, 256 samples each) is used to mine abnormal patterns, identifying combinations with a request frequency greater than 8 times / minute and a duration less than 2 seconds (normal samples account for 0.5%). This pattern is categorized and labeled: a frequency >20 times / minute and stable is a DDoS attack signature (e.g., 25 times / minute + 1.5 seconds); a duration <1 second and random port is an abnormal connection signature (e.g., 0.8 seconds + port 54321); a payload containing "UNIONSELECT" is a SQL injection signature; calls to malicious IP addresses are malicious code signatures; and non-administrators executing root commands are privilege abuse signatures, resulting in multi-dimensional threat signature data. This data is fed into a pre-trained security prediction model, which outputs attack type probabilities (e.g., DDoS 30%, abnormal connection 25%, etc.). The highest probability classification results in 30 records being DDoS attacks (probability >80%), 25 being abnormal connections, 15 being SQL injections, 20 being malicious code, and 10 being privilege abuse. This yields a classification of target network attack types, with each record containing a feature combination and a corresponding type.

[0071] Step S3: Perform network attack contact analysis based on the target network attack type classification data to obtain a target network attack behavior trigger node set; perform network security occurrence probability prediction on the target network based on the target network attack behavior trigger node set and the pre-trained security prediction model to obtain target network security event probability prediction data;

[0072] In an embodiment of the present invention, network attack contact analysis is performed based on target network attack type classification data. The DDoS attack path is border router R1 → core switch S1. R1 limits ICMP to 100 per second, and S1 limits the number of connections to 1000. When the attack traffic exceeds the threshold (e.g., 150 per second), R1 becomes a trigger node; when the number of connections exceeds 1000, S1 becomes a trigger node, forming the node set {R1, S1}. The SQL injection attack path is firewall F1 → load balancer L1 → web server W1. F1 detects "UNION SELECT", the L1 session times out for 30 seconds, and W1 filters malicious strings. When F1 detects a feature, the L1 session times out, or W1 interception fails, each becomes a trigger node, forming the node set {F1, L1, W1}. Similarly, the trigger node sets for abnormal connections (terminals 100-200), malicious code (D1), and authority abuse (authentication server) are determined to obtain the target network attack behavior trigger node set. The node set attributes (attack reachability, importance, and defense level) are input into the pre-trained model. The model combines features such as diffusion probability (such as S1 is 29.8%) and attack success rate (15%) to predict events in the next 24 hours: 10:00-12:00 DDoS attack (probability 25%, affecting R1 and S1), 14:00-16:00 SQL injection (15%, affecting F1 and W1), 08:00-10:00 abnormal connection (20%, affecting terminal 105), etc., to obtain the target network security event probability prediction data. Each record contains the event type, time (accurate to the minute), probability (%), and affected node.

[0073] Step S4: Construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

[0074] In an embodiment of the present invention, based on the target network security event probability prediction data (DDoS 25%, SQL injection 15%, etc.), the levels are divided according to the evaluation criteria (low risk <5%, medium risk 5%-15%, high risk 15%-30%, and extremely high risk >30%): DDoS, SQL injection, and abnormal connections are high risk, and malicious code (5%) and authority abuse (8%) are medium risk. Develop differentiated defense strategies: medium-risk starts vulnerability repair (repairing high-risk vulnerabilities within 24 hours) and access control enhancement (12-digit password + two-factor authentication); high-risk deployment of intrusion prevention system (500 rules, detecting 1000 packets per second) and traffic cleaning (filtering ICMP traffic with a proportion of >30%). Evaluate the strategy score (the high-risk solution has the highest score of 79.6 points), select it as the optimal strategy, and generate the initial plan (steps: deploy the intrusion prevention system from 09:00 to 10:00, configure traffic cleaning rules from 10:00 to 12:00, and execute the main network security group). The solution was input into a network attack and defense simulation platform (1:1 topology, 72-hour simulation). The attack success rate dropped from 25% to 8% (a 68% decrease), security incidents decreased from 30 / day to 9 (a 70% decrease), and latency increased from 10ms to 15ms (a 50% increase). The optimized solution (20 new DDoS rules, a 25% scrubbing threshold, and a 0.05-second detection time) was simulated again, yielding a 72% decrease, a 75% reduction, and a 30% increase in latency, resulting in the target network security defense strategy solution data. This feedback was fed back into the pre-trained model for retraining (including parameters such as the number of rules, 520), and the optimized results (8% DDoS probability) were output and synchronized to the terminal (including an operation manual and verification report), guiding hourly device log checks to ensure the rules are effective.

[0075] Furthermore, step S1 includes the following steps:

[0076] Step S11: Deploy distributed network probes on the core nodes, border gateways, and terminal devices corresponding to the target network, and collect corresponding network data including TCP / UDP session data, packet payloads, port access records, user operation logs, and application call records based on the distributed network probes to obtain the full data of the target network;

[0077] In this embodiment of the present invention, distributed network probes are deployed in the target network (covering 10 core nodes, 5 border gateways, and 200 terminal devices). The core node probes are connected to the switch mirror port, the border gateway probes are connected in series to the ingress and egress links, and the terminal device probes are installed at the bottom layer of the operating system. The probe collection frequency is set to 1000 times per second, and the collection scope includes: TCP session data (recording source IP 192.168.1.100, destination IP 203.0.113.50, session establishment time 08:30:00, end time 08:30:15), UDP packet payload (extracting DNS query content example.com, payload length 51 bytes), port access records (source port 54321 accesses destination port 80, cumulative access times 20 times), user operation logs (administrator performs login operation at 10:15:00), and application call records (process ID 1234 calls the libcurl library to initiate an HTTPS request). All collected data is sorted by timestamp (accurate to milliseconds) and stored in binary stream format, generating 80GB of data within 24 hours, ensuring that all data of the target network is captured without omission and completely covering the interactive information of the network layer, transport layer and application layer.

[0078] Step S12: pre-processing the full amount of target network data, performing data cleaning, format standardization, and structure conversion in sequence to obtain the full amount of target structured network data;

[0079] In an embodiment of the present invention, by pre-processing the full amount of data on the target network, duplicate records are removed in the data cleaning stage (such as duplicate reported data of the same TCP session, retaining the first and last records), invalid data packets are filtered (UDP packets with checksum errors, a total of 1200), and timestamp deviations are corrected (the terminal device time is synchronized to the core node NTP server time, with a maximum correction value of 0.3 seconds). In the format standardization stage, all data are converted into JSON format, and the fields include "timestamp", "src_ip", "dst_port", etc., where the IP address is represented by a dotted decimal string, the port number is an integer, and the timestamp is in ISO8601 format (such as 2024-05-20T08:30:00.123Z). During the structured conversion phase, relational data tables are established, divided into a session table (storing the start and end time, source and destination addresses of TCP / UDP sessions), a data packet table (storing payload length and protocol type), and an operation table (storing user behavior and application calls). The tables are linked through session IDs, and each record is assigned a unique identifier. Ultimately, the full target structured network data of 10 million records is generated, with no missing field values ​​and a unified format.

[0080] Step S13: extracting static features and dynamic features from the full data of the target structured network, where the static features include IP address, port number, and protocol type, and the dynamic features include session duration, packet size distribution, and request frequency, to obtain structured network security feature data;

[0081] In an embodiment of the present invention, static features and dynamic features are extracted from the entire data of the target structured network. Static features are directly extracted from the following fields: IP address (source IP 192.168.1.0 / 24 is an internal network segment, 203.0.113.0 / 24 is an external network segment), port number (80 is HTTP service, 443 is HTTPS service, 3306 is MySQL service), protocol type (marked as 1 for TCP, 2 for UDP, and 3 for ICMP). Dynamic features are obtained by calculation: session duration (end time minus start time, such as a TCP session lasting 15.2 seconds), packet size distribution (the mean length of packets in the UDP stream is 51 bytes, and the standard deviation is 8 bytes), and request frequency (a certain IP accesses port 80 200 times within 1 hour, which is calculated to be 3.33 times / minute). During the feature extraction process, IP addresses are aggregated by network segments (192.168.1.1-254 is classified as internal network segment feature value 1), and port numbers are classified by service type (80 and 443 are classified as Web service feature value 2). Finally, structured network security feature data is generated. Each record contains 6 feature values, and the data type is uniformly floating point or integer.

[0082] Step S14: Based on the artificial intelligence network framework, a bidirectional long short-term memory network combined with an attention mechanism is used to construct an initial network security prediction model, and the structured network security feature data is divided into a training set and a validation set according to the time series;

[0083] In an embodiment of the present invention, an initial network security prediction model is constructed based on an artificial intelligence network framework, and a bidirectional long short-term memory network (BiLSTM) is used as the basic structure, including an input layer (6 neurons, corresponding to 6 features), two bidirectional LSTM layers (32 neurons per layer, forward and backward outputs are spliced ​​into 64-dimensional vectors), an attention mechanism layer (weights are assigned to the outputs of different time steps, with a weight of 0.8 for recent data and a weight of 0.2 for long-term data), a fully connected layer (16 neurons), and an output layer (1 neuron, outputting 0 or 1 to indicate whether it is abnormal). The structured network security feature data is sorted in time series (one time step per hour, for a total of 30 days of data), the first 25 days of data are used as a training set (containing 7,000 normal samples and 3,000 abnormal samples), and the last 5 days of data are used as a validation set (containing 1,400 normal samples and 600 abnormal samples). The sample distribution of the training set is consistent with that of the validation set, and the abnormal samples include typical attack features such as port scanning (accessing multiple ports in a short time) and abnormal traffic (mutation in the size of UDP data packets), to ensure that the data distribution of model training and validation is representative.

[0084] Step S15: Use the training set to iteratively train the initial network security prediction model, and use the validation set to adjust the hyperparameters corresponding to the initial network security prediction model in real time, including the number of hidden layer neurons and the learning rate, until the prediction accuracy corresponding to the initial network security prediction model reaches a preset threshold, thereby obtaining a pre-trained security prediction model.

[0085] In an embodiment of the present invention, the initial network security prediction model is iteratively trained by utilizing the training set, using the Adam optimizer, the initial learning rate is set to 0.001, the batch size is 32, and a 24-hour feature sequence (24 time steps) is input for each iteration. During the training process, the prediction accuracy of the validation set is calculated every 100 iterations. When the accuracy is lower than 90%, the hyperparameters are adjusted: the number of hidden layer neurons is increased from 32 to 64 (at the 300th iteration), and the learning rate is reduced from 0.001 to 0.0005 (at the 500th iteration). When it is iterated to 1000 times, the validation set accuracy reaches 95% (preset threshold 95%), and training is stopped. At this time, the attention weight of the model shows that the feature contribution of the last 3 hours accounts for 60%, and the interaction feature weight of the internal IP and the external IP is higher than the interaction between the internal IPs. The final pre-trained security prediction model has a recognition rate of 98% for port scans and a recognition rate of 94% for abnormal traffic, which meets the accuracy requirements of network security prediction.

[0086] Furthermore, step S2 includes the following steps:

[0087] Step S21: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and authority abuse features;

[0088] In an embodiment of the present invention, threat features are recursively extracted from structured network security feature data (including six features such as session duration and request frequency). The first stage of recursive screening is based on the variance of the feature distribution density set (threshold 5%), retaining session duration (variance 8.2%), request frequency (7.5%), and packet size mean (6.1%). The second stage of recursive screening calculates the cosine similarity (threshold 0.7) with the preset threat feature library. Session duration (0.89) and request frequency (0.76) pass the screening to form the core threat feature. The isolation forest algorithm (100 trees, 256 samples per tree) is used to mine abnormal patterns and identify combinations with a request frequency greater than 8 times / minute and a duration less than 2 seconds (normal samples account for 0.5%). This pattern is categorized and labeled: a request frequency >20 requests / minute with a stable duration is a DDoS attack signature; a duration <1 second with a random port is an abnormal connection signature; a payload containing "UNIONSELECT" is a SQL injection signature; calls to malicious IP addresses are a malicious code signature; and non-administrators executing root commands are a privilege abuse signature. This ultimately yields multi-dimensional threat signature data, with each signature combination corresponding to a unique type. For example, a DDoS signature would be recorded as "25 requests / minute with a duration of 1.5 seconds."

[0089] Step S22: Build an initial threat signature library based on the multi-dimensional threat signature data to structure the multi-dimensional threat signature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and privilege abuse features according to feature type, frequency of occurrence, and degree of harm, and associate the corresponding CVE vulnerability numbers with ATT&CK attack framework labels to obtain target network threat signature library data;

[0090] In this embodiment of the present invention, an initial threat signature library is constructed based on multi-dimensional threat signature data. The library is divided into five major folders by signature type, each storing structured data related to the corresponding signature. The abnormal connection signature folder contains 120 records, each with fields such as "duration < 1 second + random port," "occurrence frequency 3 times / hour," and "medium severity," and is associated with the CVE-2023-1234 vulnerability number and the ATT&CK tag T1040. The malicious code signature folder contains 80 records with fields such as "calling IP 198.51.100.10," "occurrence frequency 1 time / day," and "high severity," and is associated with CVE-2023-5678 and the tag T1204. SQL injection signature records include "payload contains 'OR1=1'" and "occurrence frequency 5 times / hour," and are associated with CVE-2023-9012 and the tag T1546. DDoS signature records include "frequency 50 times / second" and "extreme severity," and are associated with CVE-2023-4567 and the tag T1498. The privilege abuse signature "Non-administrator executing sudo" has a frequency of 0.5 times per day and is associated with CVE-2023-8901 and the tag T1078. All data is stored in CSV format, with each row corresponding to a signature, ensuring complete fields and accurate associations.

[0091] Step S23: By setting up a signature database update mechanism to regularly collect the latest network threat data and update the corresponding target network threat signature database data through federated learning technology without leaking local data, to obtain dynamically updated threat signature database data;

[0092] In an embodiment of the present invention, by setting up a feature library update mechanism, the update program is started at 3 am every Monday, and the latest network threat data (sources include CVEDetails and the MITREATT&CK official website) is collected through distributed crawlers. The collection scope is the threat features newly added in the past 7 days, such as the "frequency 100 times / second + UDP fragmented packet" feature of the new DDoS attack. Using federated learning technology, an encrypted connection is established with the local feature libraries of 10 cooperative units. Each unit calculates the similarity between the newly added features and the features in the library locally (threshold 0.85), and only uploads feature parameters with a similarity greater than 0.85 (excluding original data). The federal server aggregates the parameters and generates an update package: 20 new DDoS features, 15 SQL injection features, and the frequency of occurrence of 5 malicious code features is corrected (from 2 times / day to 4 times / day). The update package is merged into the target network threat feature library according to the feature type, replacing the old record, such as updating the "frequency 50 times / second" of the DDoS feature to "50-100 times / second". After the update, the feature library contains 580 records, ensuring data timeliness and without leaking any unit's local original data.

[0093] Step S24: identifying network attack behaviors by combining the dynamically updated threat signature database data with the structured network security signature data corresponding to the target network predicted by the pre-trained security prediction model to obtain target network attack behavior identification data;

[0094] In an embodiment of the present invention, by combining the dynamically updated threat feature library data with the pre-trained security prediction model, the model outputs the structured security features of the target network (such as "frequency 18 times / minute + duration 2.3 seconds"). The cosine similarity of this feature with the DDoS attack feature in the library (0.92) and the similarity with the abnormal connection feature (0.65) are calculated. A similarity of > 0.8 is set as a successful match, and the feature is determined to correspond to a DDoS attack behavior. At the same time, the model predicts that the abnormal probability of this feature is 98% (threshold 80%), and double verification confirms the attack behavior. During the identification process, the specific fields of the feature matching are recorded: "Frequency 18 times / minute is close to 20 times / minute in the library" and "Duration 2.3 seconds is within the range of 1.5-3 seconds", and the CVE-2023-4567 vulnerability and T1498 label are associated. Finally, the target network attack behavior identification data is obtained, including attack type, matching features, probability value and associated labels, such as "DDoS attack + similarity 0.92 + probability 98% + T1498".

[0095] Step S25: classify the target network attack behavior identification data into attack types to obtain target network attack type classification data.

[0096] In this embodiment of the present invention, attack type classification is performed on target network attack behavior identification data (100 records), and classification rules are established based on feature matching similarity (>0.8), model prediction probability (>80%), and feature parameter range. The DDoS attack type classification rule is "frequency >15 times / minute, duration 1.5-3.0 seconds, similarity >0.85, probability >90%." There are 30 records that meet this rule. The feature parameters include "frequency 18-30 times / minute, duration 1.8-2.5 seconds, source IP mostly 198.51.100.0 / 24 network segment." A typical record is "2024-05-2009:15:00, frequency 25 times / minute, duration 2.0 seconds, similarity 0.92, probability 98%." The classification rule for abnormal connection types is "duration < 1.2 seconds, access port > 1024, similarity 0.8-0.85, probability 85%-90%". There are 25 records that meet the rule, and the characteristic parameters are "duration 0.6-1.0 seconds, port 54321-65535 changes randomly". The typical record is "2024-05-2014:30:00, duration 0.8 seconds, port 56789, similarity 0.82, probability 88%". The SQL injection type classification rule is "data packet payload contains strings such as 'UNIONSELECT' and 'OR1=1', port 80 / 443". There are 15 records that meet the rule. The characteristic parameters include "POST request, URL path contains ' / login.php', parameter 'username' is abnormal". The typical record is "2024-05-2011:45:00, payload 'UNIONSELECT1,2,3', similarity 0.88, probability 92%", which is associated with the CVE-2023-9012 vulnerability. The malicious code type classification rule is "the calling IP belongs to the 198.51.100.0 / 24 or 203.0.113.0 / 24 network segment, and the process ID is 1000-2000." There are 20 records that meet the rule, with the characteristic parameters being "TCP connection, communication frequency 1 time / 5 minutes." The typical record is "2024-05-2002:10:00, calling IP 203.0.113.50, similarity 0.86, probability 95%." The privilege abuse type classification rule is "non-administrator users (ID1001-1010) execute privileged commands such as 'sudo' and 'su'". There are 10 records that meet the rule, with the characteristic parameters being "commands containing 'sudoaptinstall' and 'suroot'". The typical record is "2024-05-2018:30:00, user 1005 executes 'sudorm -rf / tmp / *', similarity 0.83, probability 89%), and is associated with the T1078 label.After classification, the proportion of each type is calculated: DDoS attacks 30%, abnormal connections 25%, malicious code 20%, SQL injection 15%, and permission abuse 10%. A bar chart of the attack type distribution is generated. Each type is accompanied by 5 detailed characteristic parameter examples and related vulnerability information to ensure that the classification results fully reflect the attack situation of the target network.

[0097] Furthermore, step S21 includes the following steps:

[0098] Performing feature distribution set statistics on each network security feature in the structured network security feature data to obtain a distribution density set corresponding to each network security feature;

[0099] In an embodiment of the present invention, feature distribution set statistics are performed on structured network security feature data (including six features: internal network segment, Web service port, TCP protocol, session duration, mean packet size, and request frequency). The value range of each feature is divided into 10 equally spaced intervals, and the proportion of samples in each interval is counted. For example, the value range of the session duration feature is 0-30 seconds, and the intervals are divided into 0-3 seconds, 3-6 seconds, and 27-30 seconds. Statistics show that the samples in the 0-3 second interval account for 60%, 3-6 seconds account for 20%, and the proportions of the remaining intervals decrease in sequence. The distribution density set number is 10 (i.e., the density distribution of 10 intervals). Among the interval sample proportions of the request frequency feature (0-10 times / minute), 1-2 times / minute accounts for 40%, 2-3 times / minute accounts for 30%, and the distribution density set number is also 10. Among the static features, the samples of the internal network segment feature (value 1) account for 80%, and the external network segment (value 0) accounts for 20%. The distribution density set number is 2 (only two values). The distribution density set of each feature forms a distribution curve with the interval number as the horizontal axis and the sample proportion as the vertical axis. The specific proportion value of each interval is fully recorded (accurate to 0.1%) to obtain the distribution density set corresponding to each network security feature.

[0100] Preferably, a first-stage recursive screening is performed on each network security feature in the structured network security feature data based on the distribution density set corresponding to each network security feature to obtain the first-order feature data of the target network threat;

[0101] In an embodiment of the present invention, a one-stage recursive screening is performed based on the distribution density set of each feature, and the screening threshold is set to a distribution density set variance of >5% (the variance calculation formula is the sum of the squares of the differences between the proportion of each interval and the mean / number of intervals). The variances of the six features are calculated: the session duration distribution variance is 8.2% (the interval proportion difference is large), the request frequency variance is 7.5%, the packet size mean variance is 6.1%, the TCP protocol feature variance is 1.2% (only two values, the proportion is stable), the internal network segment feature variance is 2.0%, and the Web service port feature variance is 1.8%. Features with a variance >5% are screened out, namely session duration, request frequency, and packet size mean. The distribution density set fluctuations of these three features are more significant and are more likely to contain threat information. Static features with a variance ≤5% (TCP protocol, internal network segment, Web service port) are eliminated to obtain the first-order feature data of the target network threat containing 3 features. Each feature retains the interval division and proportion data of the original distribution density set to ensure that the filtered features have the potential to distinguish normal from abnormal behavior.

[0102] Preferably, a distribution statistical analysis is performed on each remaining network feature in the first-order feature data of the target network threat to calculate the distribution mean, distribution standard deviation, and distribution kurtosis corresponding to each remaining network feature and construct a corresponding feature vector to obtain a distribution vector corresponding to each remaining network feature;

[0103] In this embodiment of the present invention, a distribution statistical analysis was performed on the three remaining features (session duration, request frequency, and mean packet size) in the first-order signature data of the target network threat. The session duration distribution was calculated to have a mean of 8.5 seconds (sum of all sample durations / number of samples), a standard deviation of 5.2 seconds (sum of the squared deviations of each sample from the mean / square root of the number of samples), and a kurtosis of 2.3 (higher than the normal distribution of 3, showing a peaked distribution). The request frequency had a mean of 3.2 times / minute, a standard deviation of 1.8 times / minute, and a kurtosis of 1.9. The packet size had a mean of 51 bytes, a standard deviation of 8 bytes, and a kurtosis of 0.5. A three-dimensional distribution vector was constructed for each feature in the format [mean, standard deviation, kurtosis], namely, the session duration vector was [8.5, 5.2, 2.3], the request frequency vector was [3.2, 1.8, 1.9], and the mean packet size vector was [51, 8, 0.5]. The vector value is accurate to one decimal place, fully reflecting the distribution concentration trend, discreteness and morphological characteristics of each feature, providing a quantitative basis for subsequent feature matching.

[0104] Preferably, a preset target network security threat feature library is obtained, and feature matching similarity is calculated based on the distribution vector corresponding to each remaining network feature and the corresponding threat feature in the target network security threat feature library. At the same time, based on the feature matching similarity corresponding to each remaining network feature, each remaining network feature in the target network threat first-order feature data is subjected to a two-stage recursive screening to obtain the target network core threat feature data;

[0105] In the embodiment of the present invention, the preset target network security threat feature library contains the distribution vectors of known threat features: DDoS attack request frequency vector [15.0, 4.5, 3.0], SQL injection packet size vector [200, 50, 2.5], abnormal connection session duration vector [0.5, 0.3, 4.0]. Calculate the cosine similarity (similarity = vector dot product / module length product) between the remaining feature distribution vector and the threat feature library vector: The similarity between the session duration and the abnormal connection vector is 0.89(0.5×8.5+0.3×5.2+4.0×2.3) / (√(0.5 2 +0.3 2 +4.0 2 )×√(8.5 2 +5.2 2 +2.3 2 The similarity between request frequency and DDoS vectors was 0.76, and the similarity between packet size and SQL injection vectors was 0.12. A similarity threshold of 0.7 was set, and a two-stage recursive filter was performed to select features with a similarity ≥ 0.7: session duration (0.89) and request frequency (0.76). The mean packet size (0.12) was removed. Core threat signature data for the target network, containing these two features, was obtained. The feature name, distribution vector, and matching similarity were recorded to ensure that features highly relevant to known threats were retained.

[0106] Preferably, abnormal pattern mining is performed based on the core threat feature data of the target network to identify the threat feature combination corresponding to the deviation from the normal behavior pattern through the isolation forest algorithm to obtain the target network threat abnormal feature pattern data; feature classification and labeling are performed based on the target network threat abnormal feature pattern data to distinguish multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features and authority abuse features.

[0107] In an embodiment of the present invention, anomaly pattern mining is performed based on the core threat feature data of the target network (session duration, request frequency). The isolation forest algorithm sets 100 trees, each tree has 256 training samples, and the anomaly threshold is set to the average path length>80% quantile. The algorithm identifies a feature combination with a request frequency>8 times / minute and a session duration<2 seconds (deviation from the normal pattern: request frequency 1-3 times / minute, duration 5-10 seconds). This type of combination accounts for 0.5% of normal samples and 30% of abnormal samples, and is determined to be a threat feature combination, thereby obtaining the target network threat anomaly feature pattern data. The pattern data is classified and labeled: a combination with an extremely high request frequency (>20 times / minute) and a stable duration is labeled as a DDoS attack feature; a combination with a session duration of <1 second and random port access is labeled as an abnormal connection feature; a packet payload containing the "UNIONSELECT" string is labeled as an SQL injection feature; a process calling a malicious IP list is labeled as a malicious code feature; and a non-administrator account executing a root command is labeled as a privilege abuse feature. Finally, multi-dimensional threat feature data is obtained, and each feature combination corresponds to a unique annotation type, accurately matching the typical pattern of threat behavior.

[0108] Furthermore, step S3 includes the following steps:

[0109] Step S31: obtaining network traffic, intrusion logs, and historical attack events corresponding to different attack types based on the target network attack type classification data;

[0110] In an embodiment of the present invention, by classifying data based on the target network attack type (including 30 DDoS attacks, 25 abnormal connections, 15 SQL injections, etc.), the corresponding network traffic, intrusion logs and historical attack events are obtained. The network traffic record of the DDoS attack is "source IP198.51.100.0 / 24, destination IP192.168.1.2 (core switch), ICMP protocol, 50 data packets per second, lasting 180 seconds", a total of 30 traffic samples, each containing a timestamp, data packet size (56 bytes) and port number (none). The DDoS attack record in the intrusion log is "2024-05-2009:15:30, the number of connections on core switch S1 port 1 exceeds 1000, triggering an alarm", a total of 25, each containing an alarm level (emergency) and a triggering rule (port security). Among historical attack events, the DDoS attack record is "2024-05-10 14:30-17:30, causing S1 bandwidth to be fully utilized and service to be interrupted for 2 hours", with a total of 5 records, each of which includes the impact range and resolution time. The network traffic of the SQL injection attack is "source IP 203.0.113.5, destination IP 192.168.1.10 (web server), TCP protocol, port 80, POST request containing 'UNIONSELECT'", with a total of 15 records, and a packet size of 120 bytes. The intrusion log record is "2024-05-2011:45:00, firewall F1 detected a malicious SQL statement and successfully intercepted it", with a total of 18 records. The historical event record is "2024-05-05 10:00-10:30, attempted to steal database information, intercepted by W1", with a total of 3 records. All data is archived by attack type, with traffic data accurate to bytes and seconds, log data containing complete trigger conditions, and event data recording the specific impact duration.

[0111] Step S32: extracting network attack behaviors from the target network attack type classification data based on the network traffic, intrusion logs, and historical attack events corresponding to different attack types, so as to obtain the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network;

[0112] In an embodiment of the present invention, attack behavior is extracted from attack type classification data based on network traffic, intrusion logs, and historical attack events of different attack types. For a DDoS attack, the target is extracted from the traffic as core switch S1 (IP 192.168.1.2), and the attack method is "ICMP Flood, occupying bandwidth through a large number of echo requests." From the logs, the attack path is "border router R1 (192.168.1.1) → core switch S1." Historical events confirm that the attack tool is Hping3 (characterized by a fixed packet size of 56 bytes). For a SQL injection attack, the target is extracted from the traffic as web server W1 (192.168.1.10), and the attack method is "inserting malicious SQL statements such as 'UNION SELECT' into POST parameters." The attack path is determined from the log record's path of "firewall F1 → load balancer L1 → W1," and the tool's features (generating a specific string) identify the attack tool as SQLMap. The target of the abnormal connection attack is the terminal device (192.168.1.100-200), the method is "randomly accessing high ports (1024-65535) in a short period of time", the path is "R1→Terminal", and the tool is a port scanner (characterized by a scanning interval of 0.1 seconds). The target of the malicious code attack is the database server D1 (192.168.1.20), the method is "transmitting malicious payload through TCP port 445", the path is "F1→L1→D1", and the tool is ransomware (characterized by the encrypted file suffix .lock). The target of the privilege abuse attack is the administrator account, the method is "unauthorized execution of sudo commands", the path is "Terminal→Authentication Server", and the tool is a local privilege escalation script (characterized by calling / usr / bin / sudo). Finally, we get the attack target (including IP), method (specific technical means), path (node ​​sequence) and tool (feature parameters) of each attack type. For example, the extraction result of DDoS attack is "target S1, method ICMPFlood, path R1→S1, tool Hping3".

[0113] Step S33: Obtain the network topology and defense mechanism corresponding to the target network;

[0114] In this embodiment of the present invention, by obtaining the network topology and defense mechanism of the target network, the topology adopts a star architecture, including one core switch S1 (192.168.1.2), one border router R1 (192.168.1.1), one firewall F1 (192.168.1.3), one load balancer L1 (192.168.1.4), two web servers W1-W2 (192.168.1.10-11), one database server D1 (192.168.1.20) and 200 terminals (192.168.1.100-299). The nodes are connected via Gigabit Ethernet. S1 is directly connected to R1, F1, and L1. L1 connects to W1-W2, W1 connects to D1, and all terminals are connected to S1. The link bandwidth (1000Mbps) and physical location (computer room A, office area B, etc.) are marked in the topology diagram. Defense mechanisms include: R1 enables ACL rules, allowing only TCP port 80 / 443 and UDP port 53 traffic, and limiting ICMP packets to 100 per second; F1 deploys an intrusion detection system with 500 built-in rules (including a SQL injection signature library) and an interception response time of 0.1 seconds; S1 enables port security, with a maximum number of connections per port of 1000, after which the port is closed for 30 seconds; L1 sets a session timeout of 30 seconds and processes 1000 requests per second; W1 installs a web application firewall, filters strings such as "UNIONSELECT," and retains logs for 7 days; terminals install antivirus software, monitors process calls in real time, and prohibits access to the 198.51.100.0 / 24 network segment. All defense mechanisms record specific parameters, effective dates, and coverage. For example, F1's rule update date is 2024-05-01, covering all inbound traffic.

[0115] Step S34: performing network attack contact analysis based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and combining the network topology and defense mechanism corresponding to the target network to obtain a target network attack behavior trigger node set;

[0116] In an embodiment of the present invention, network attack contact analysis is performed based on the attack targets, methods, paths, and tools of different attack types, combined with the network topology and defense mechanism. DDoS attack target S1, path R1→S1, tool Hping3, R1 and S1 are directly connected in the topology, R1 limits ICMP to 100 per second in the defense mechanism, and S1 limits the number of connections to 1000. When the attack traffic exceeds the R1 threshold (such as 150 ICMP packets per second), R1 becomes the attack trigger node; when the number of S1 connections exceeds 1000, S1 becomes the trigger node, forming the node set {R1, S1}. SQL injection attack target W1, path F1→L1→W1, tool SQLMap, F1 rule detects "UNIONSELECT", L1 session timeout is 30 seconds, and W1 filters malicious strings. When F1 detects a characteristic string, F1 is triggered; when the L1 session does not end after 30 seconds, L1 is triggered; when W1 interception fails, W1 is triggered, forming the node set {F1, L1, W1}. The abnormal connection attack path is R1→terminal. R1 has no high port restrictions, and the terminal firewall does not block random access. When the terminal port is scanned more than 5 times / minute, the terminal becomes a trigger node, forming the node set {terminal 100-200}. The malicious code attack path is F1→L1→D1. F1 does not block port 445, L1 does not detect the payload, and D1 has no ransomware protection. When D1 receives the malicious payload, D1 is triggered, forming the node set {D1}. The privilege abuse attack path is terminal→authentication server. When the terminal executes the sudo command and the user ID is not 0, the authentication server is triggered, forming the node set {authentication server}. All node sets record the trigger conditions (such as R1's "ICMP packets > 100 / second") and the node IP to obtain the target network attack behavior trigger node set.

[0117] Step S35: Based on the target network attack behavior trigger node set and the pre-trained security prediction model, the target network is subjected to network security probability prediction to obtain target network security event probability prediction data.

[0118] In an embodiment of the present invention, the target network is predicted for the probability of security events by using a set of triggering nodes based on the target network attack behavior and a pre-trained security prediction model (BiLSTM+GRU structure). The attribute data of the triggering node set (attack reachability, importance, and defense level) are input into the model. The model input layer receives features such as the diffusion probability of the node set (such as S1 is 29.8%) and the attack success rate (15%). After processing by the hidden layer (32 neurons), the output layer outputs the probability of security events in the next 24 hours. For the DDoS attack triggering node set {R1, S1}, the following predictions are made: from 10:00 to 12:00, the ICMP packet flow of R1 reaches 120 per second (exceeding the threshold of 100), the number of connections of S1 is 1100 (exceeding 1000), and the probability of occurrence is 25%; from 16:00 to 18:00, the probability is 10%. For the SQL injection attack trigger node set {F1, L1, W1}, the following predictions are made: 14:00-16:00, F1 detects "UNION SELECT" but doesn't block it, and the L1 session lasts 35 seconds, with a 15% probability. The probability for other time periods is less than 5%. For the abnormal connection attack trigger node set, the following predictions are made: 08:00-10:00, terminal 105 is scanned 8 times per minute, with a 20% probability. For the malicious code attack trigger node set {D1}, the following predictions are made: 20:00-22:00, D1 receives a malicious payload, with a 5% probability. For the privilege abuse attack trigger node set, the following predictions are made: 12:00-14:00, the authentication server detects user 1001 executing sudo, with an 8% probability. All prediction results record the event type, time period (accurate to the minute), probability (accurate to the 1%), and affected nodes, such as "DDoS attack, 10:00-12:00, 25%, affecting R1 and S1," to form target network security event probability prediction data.

[0119] Furthermore, step S34 includes the following steps:

[0120] Step S341: Based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and in combination with the network topology structure corresponding to the target network, a network attack topology mapping is performed to map the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types to network nodes corresponding to the network topology structure, so as to obtain a target attack path node set corresponding to different attack types of the target network;

[0121] In an embodiment of the present invention, a network attack topology mapping is performed based on the characteristics of different attack types on the target network (DDoS attack targets the core switch, the attack method is ICMP Flood, the attack path is from the border router to the core switch, and the attack tool is Hping3; SQL injection attack targets the web server, the attack method is malicious SQL statement injection, the attack path is from the firewall to the load balancer to the web server, and the attack tool is SQLMap). In combination with the network topology (comprising 10 nodes, including the border router R1, the core switch S1, the firewall F1, the load balancer L1, the web server W1, and the database server D1, the nodes are connected via Gigabit Ethernet, the topology is distributed in a star shape, and the core switch S1 connects all other nodes). The DDoS attack target core switch S1, the attack path R1→S1, and the attack tool Hping3 are mapped to the topology, with R1 marked as the entry node and S1 as the target node; the SQL injection attack target W1, the attack path F1→L1→W1, and the attack tool SQLMap are mapped to the topology, with F1 marked as the entry node, L1 as the transit node, and W1 as the target node. Abnormal connections, malicious code, and privilege abuse attacks are mapped in the same way to obtain the target attack node sets corresponding to different attack types on the target network. For example, the node set through which a DDoS attack passes is {R1, S1}, and the node set through which a SQL injection attack passes is {F1, L1, W1}. Each node set records the node name, node IP (R1 is 192.168.1.1, S1 is 192.168.1.2, etc.) and the inter-node connection bandwidth (1000Mbps).

[0122] Step S342: Based on the defense mechanism corresponding to the target network, a node attack assessment analysis is performed on the target attack pass node set corresponding to different attack types of the target network to obtain the attack reachability, attack importance, and defense security level corresponding to each node in the target network;

[0123] In an embodiment of the present invention, a target network-based defense mechanism is implemented (border router R1 enables ACL rules to only allow traffic on ports 80 and 443; core switch S1 enables port security to limit the maximum number of connections per port to 1,000; firewall F1 is configured with an intrusion detection system to detect 1,000 rules per second; load balancer L1 sets a session timeout to 30 seconds; and web server W1 is installed with antivirus software to monitor process calls in real time). A node attack assessment and analysis is performed on the set of nodes through which the target attack passes. Attack reachability is calculated based on the probability of a node being successfully attacked. R1's ACL rules have an ICMP packet interception rate of 90% and an attack reachability of 10%. S1's port security can resist 80% of connection attacks and has an attack reachability of 20%. F1's intrusion detection system has an SQL injection feature recognition rate of 95% and an attack reachability of 5%. L1's session timeout has a persistent attack interception rate of 70% and an attack reachability of 30%. W1's antivirus software has an malicious process interception rate of 85% and an attack reachability of 15%. Attack importance is calculated based on the centrality of a node in the topology. S1 connects all nodes, has a centrality of 1.0 (the highest), and an importance level of 5; W1 is the business core, has a centrality of 0.8, and an importance level of 4; R1 and F1 have a centrality of 0.6, an importance level of 3; and L1 has a centrality of 0.4, an importance level of 2. The defense security level is scored based on the strength of the defense measures (out of a maximum of 10 points): F1 is 9, R1 is 8, S1 is 7, W1 is 6, and L1 is 5. Ultimately, each node is assigned an attack reachability (10%-30%), attack importance (2-5), and defense security level (5-9). For example, S1 is evaluated as "reachability 20%, importance level 5, and security level 7."

[0124] Step S343: Based on the attack reachability, attack importance and defense security level corresponding to each node in the target network, a network attack contact analysis is performed on the corresponding target attack node set to associate the corresponding attack reachability, attack importance and defense security level with the target network nodes that may be triggered, determine all the corresponding network attack trigger nodes that may occur for this attack type, and obtain the target network attack behavior trigger node set.

[0125] In this embodiment of the present invention, a network attack contact analysis is performed on the target attack node set based on the node's attack reachability, attack importance, and defense security level, and these attributes are associated with possible triggering nodes. For a DDoS attack node set {R1, S1}, R1 has an attack reachability of 10%, an importance of 3, and a security level of 8. When the attack traffic exceeds R1's ACL rule threshold (1000 ICMP packets per second), R1's alarm mechanism is triggered, and R1 becomes an attack triggering node. S1 has an attack reachability of 20%, an importance of 5, and a security level of 7. When the number of connections exceeds 1000, port security restrictions are triggered, and S1 becomes an attack triggering node. For a SQL injection attack passing through the node set {F1, L1, W1}, F1 has an attack reachability of 5%, an importance of 3, and a security level of 9. When the "UNIONSELECT" signature is detected, an intrusion detection alarm is triggered, and F1 becomes the trigger node. L1 has an attack reachability of 30%, an importance of 2, and a security level of 5. When a malicious session lasts for more than 30 seconds, a session timeout is triggered, and L1 becomes the trigger node. W1 has an attack reachability of 15%, an importance of 4, and a security level of 6. When an abnormal SQL statement is executed, an application firewall interception is triggered, and W1 becomes the trigger node. After analyzing all attack types, all possible trigger nodes for each attack type are determined. For example, the DDoS attack trigger node set is {R1, S1}, and the SQL injection attack trigger node set is {F1, L1, W1}. The target network attack behavior trigger node set is obtained. Each node set records the trigger condition (for example, "ICMP packets > 1000 / second" for R1) and the response action after the trigger (such as alarm or interception).

[0126] Furthermore, step S35 includes the following steps:

[0127] Step S351: performing an attack diffusion risk assessment on the corresponding network topology structure on the target network based on the target network attack behavior trigger node set to obtain target network attack diffusion risk assessment data;

[0128] In this embodiment of the present invention, an attack diffusion risk assessment is performed on the network topology structure based on the target network attack behavior trigger node set (DDoS attack trigger node set {R1, S1}, SQL injection attack trigger node set {F1, L1, W1}, etc.). The assessment uses an attack diffusion probability algorithm to calculate the probability of the trigger node spreading to adjacent nodes: diffusion probability = (trigger node attack reachability × 0.4 + inverse of the adjacent node defense security level × 0.6) × 100%. R1's adjacent nodes are S1 and F1. R1's attack reachability is 10%, S1's defense security level is 7 points, and F1's defense security level is 9 points. The calculated probability of R1 spreading to S1 is (10% × 0.4 + 1 / 7 × 0.6) × 100% ≈ (4% + 8.57%) = 12.57%, and the probability of spreading to F1 is (10% × 0.4 + 1 / 9 × 0.6) × 100% ≈ (4% + 6.67%) = 10.67%. S1's neighboring nodes are all other nodes (8), S1's attack reachability is 20%, and the average defense security level of its neighboring nodes is 6.5. The diffusion probability = (20% × 0.4 + 1 / 6.5 × 0.6) × 100% ≈ (8% + 9.23%) = 17.23%. For the SQL injection trigger node set, the probability of F1 spreading to L1 is calculated to be 8.33%, the probability of L1 spreading to W1 is 20%, and the probability of W1 spreading to D1 is 15%. The cumulative probability of each node being attacked by the diffusion attack is calculated as 17.23% + 12.57% = 29.8% for S1, 20% + 8.33% = 28.33% for W1, and 10.67% for F1. This generates the target network attack diffusion risk assessment data, recording the diffusion source, diffusion probability, and cumulative risk value for each node. For example, the assessment result for S1 is "12.57% diffusion from R1, 17.23% self-triggered diffusion, and a cumulative risk of 29.8%."

[0129] Step S352: Based on the target network attack diffusion risk assessment data, corresponding core indicators for network attack risk prediction are obtained, including attack success rate, vulnerability exploitation difficulty, defense measure effectiveness, and attack duration, to obtain the target network attack risk initial indicator set data;

[0130] In an embodiment of the present invention, the core indicators for predicting network attack risks are extracted based on the target network attack diffusion risk assessment data. The attack success rate is calculated as the ratio of the number of successful attacks on the triggering node to the total number of attacks. The DDoS attack was triggered 30 times in R1, 3 of which were successful, with a success rate of 10%; it was triggered 25 times in S1, 5 of which were successful, with a success rate of 20%, and an average of 15%. The difficulty of exploiting the vulnerability is scored according to the number of steps the attack tool takes to break through the defense measures (1-5 points, the more steps, the higher the difficulty). The SQL injection attack requires breaking through the F1 rule, L1 session restriction, and W1 protection, a total of 3 steps, with a difficulty of 3 points; the DDoS attack requires breaking through the R1ACL and S1 port restriction, a total of 2 steps, with a difficulty of 2 points. The effectiveness of the defense measures is calculated as the ratio of the number of successful interceptions to the total number of attacks. F1 intercepted 95 SQL injection attacks, with a total of 100 attacks, with an effectiveness of 95%; R1 intercepted 90 DDoS attacks, with a total of 100 attacks, with an effectiveness of 90%. Attack duration measures the time from the triggering of each attack to its interception. DDoS attacks last an average of 180 seconds, while SQL injection attacks last an average of 60 seconds. These metrics are quantified to form the initial set of indicators for target network attack risk, including an attack success rate of 15%, vulnerability exploitation difficulty of 2.5, defense effectiveness of 92.5%, and attack duration of 120 seconds. All data is rounded to one decimal place to accurately reflect the attack risk characteristics.

[0131] Step S353: Performing index screening and dimensionality reduction on the target network attack risk initial indicator set data, using principal component analysis to eliminate multicollinearity between indicators, and retaining principal components whose cumulative contribution rates exceed a threshold, to obtain target network attack risk prediction indicator data;

[0132] In an embodiment of the present invention, the principal component analysis method is used to screen and reduce the initial indicator set data of the target network attack risk (attack success rate, vulnerability exploitation difficulty, effectiveness of defense measures, and attack duration). The correlation coefficient matrix between the indicators is calculated. The correlation coefficient between the attack success rate and the effectiveness of defense measures is -0.85 (strong negative correlation), and the correlation coefficient between the duration of attack and the difficulty of vulnerability exploitation is 0.72 (strong positive correlation), indicating the existence of multicollinearity. The principal components are extracted by eigenvalue decomposition. The eigenvalue of the first principal component is 2.8 (variance contribution rate 70%), which contains comprehensive information on the attack success rate and the effectiveness of defense measures; the eigenvalue of the second principal component is 0.9 (variance contribution rate 22.5%), which contains comprehensive information on the difficulty of vulnerability exploitation and the duration of attack. The cumulative contribution rate threshold is set to 85%, the first two principal components are retained (cumulative contribution rate 92.5%), and the third principal component with an eigenvalue of 0.3 is discarded. The original indicator data is converted into principal component scores. The first principal component score = attack success rate × 0.6 + defense measure effectiveness × (-0.4), and the second principal component score = vulnerability exploitation difficulty × 0.5 + attack duration × 0.5. The target network attack risk prediction indicator data is obtained, which includes the score values ​​of the two principal components. Two decimal places are retained to eliminate the impact of collinearity.

[0133] Step S354: By adding a time series prediction module on the basis of the pre-trained security prediction model, and using a gated recurrent unit to process the time series features corresponding to the target network attack risk prediction index data to construct a corresponding target network security event prediction model, and at the same time, dividing the target network attack risk prediction index data into time windows to input the target network security event prediction model for training, the sliding window method is used to predict the event type, prediction time, occurrence probability and impact range corresponding to the network security event in the future time period, and the target network security event probability prediction data is obtained.

[0134] In an embodiment of the present invention, a time series prediction module is added to the pre-trained security prediction model. The module adopts a gated recurrent unit (GRU) structure, including an input layer (2 neurons, corresponding to two principal components), a GRU layer (32 neurons, with an activation function of tanh), a fully connected layer (4 neurons) and an output layer (4 neurons, corresponding to event type, time, probability, and range). The target network attack risk prediction index data is divided into time windows, with one time step per hour. The data of the past 72 hours (3 days) is taken as the input sequence (72 time steps) to predict security events in the next 24 hours. The sliding window method is used for training, with a window size of 72 and a sliding step size of 1. A total of 1,000 training samples are generated, each sample containing an input sequence and a corresponding output label (such as "DDoS attack, 10:00, 20%, affecting S1 and R1"). The model is iterated 100 times, the loss function uses mean square error, the learning rate is 0.001, and the batch size is 32. After training is complete, the model inputs the latest 72 hours of indicator data, and outputs predictions for the next 24 hours: a DDoS attack is likely to occur between 10:00 and 12:00, with a 25% probability, affecting nodes R1 and S1; a SQL injection attack is likely to occur between 14:00 and 16:00, with a 15% probability, affecting nodes F1 and W1. The resulting target network security event probability prediction data records each event's type, specific time (accurate to the minute), probability of occurrence (accurate to 1%), and the set of affected nodes, ensuring both temporal and spatial accuracy.

[0135] Furthermore, step S4 includes the following steps:

[0136] Step S41: Obtaining a network security probabilistic risk assessment standard, and classifying the target network security event probability prediction data into four levels of low risk, medium risk, high risk, and extremely high risk based on the network security probabilistic risk assessment standard, thereby obtaining target network security event risk level data;

[0137] In an embodiment of the present invention, a network security probability risk assessment standard is obtained, which stipulates that: a security incident probability of less than 5% is low risk, 5%-15% is medium risk, 15%-30% is high risk, and >30% is extremely high risk. The risk level is determined by the product of the attack impact range (core node interruption duration, data leakage amount) and the probability of occurrence. Based on this standard, the target network security incident probability prediction data (DDoS attack 25%, SQL injection 15%, abnormal connection 20%, malicious code 5%, and authority abuse 8%) are graded: a DDoS attack probability of 25%, affecting the core switch S1 for 120 minutes, is classified as high risk; a SQL injection attack of 15%, affecting the web server W1 for 30 minutes, is classified as high risk; an abnormal connection of 20%, affecting 10 terminal devices, is classified as high risk; a malicious code of 5%, affecting the database server D1, is classified as medium risk; and an authority abuse of 8%, affecting the authentication server, is classified as medium risk. All events are calculated using the formula "probability x impact duration" to determine their risk value. For example, a DDoS attack risk value = 25% x 120 = 30, which meets the high-risk threshold (15-30). This generates risk level data for targeted network security events. Each record includes the event type, probability, impact scope, and corresponding level, ensuring that the grading fully matches the standards.

[0138] Step S42: Develop differentiated defense strategy data for different risk levels corresponding to the target network security incident risk level data, including: using a conventional monitoring strategy for low risk levels, initiating vulnerability remediation and access control enhancement for medium risk levels, deploying an intrusion prevention system and traffic cleaning for high risk levels, and implementing an emergency response strategy of isolating the affected area for extremely high risk levels;

[0139] In an embodiment of the present invention, differentiated defense strategy solutions are formulated based on the target network security incident risk level data: a low-risk level (probability <5%) adopts a conventional monitoring strategy, with specific operations including hourly collection of firewall logs, server CPU usage (threshold 80%), and memory usage (threshold 70%), and daily generation of security reports. The monitoring tool is the server's own performance monitoring module, and the log storage period is 7 days. A medium-risk level (5%-15%) initiates vulnerability remediation and access control enhancement. Vulnerability remediation requires remediation of high-risk vulnerabilities (CVSS score > 9.0) within 24 hours, and remediation of medium-risk vulnerabilities (7.0-9.0) within 48 hours. Vulnerability scanning tools are used to scan once a week. Access control enhancement includes increasing the length of administrator account passwords to 12 characters (including uppercase and lowercase letters, numbers, and symbols), enabling two-factor authentication, and forcing password changes every 90 days. For high-risk levels (15%-30%), an intrusion prevention system and traffic scrubbing are deployed. The intrusion prevention system is configured with 500 signature rules (including DDoS and SQL injection signatures) and detects 1,000 packets per second. Traffic scrubbing equipment filters out abnormal traffic (ICMP packet ratio > 30%, TCP connection requests > 500 times per second), retaining normal traffic and forwarding it to the core switch. For extremely high-risk levels (> 30%), an emergency response strategy of isolating the affected area is implemented. Using the VLAN partitioning function of core switch S1, the attacked node (such as S1 port 1) is added to the isolation VLAN (ID100), cutting off communication with other network segments. Simultaneously, a backup server (192.168.1.30) is started to take over the service. The isolation operation must be completed within 5 minutes.

[0140] Step S43: Perform security defense strategy evaluation on the differentiated defense strategy solution data to obtain a target network security defense strategy evaluation score; select the optimal target network defense strategy based on the target network security defense strategy evaluation score to generate target network defense initial strategy solution data including specific operation steps, execution subjects, and corresponding time nodes;

[0141] In this embodiment of the present invention, a security defense strategy evaluation is performed on differentiated defense strategy solution data (low-risk monitoring solution, medium-risk remediation solution, high-risk defense solution, and extremely high-risk isolation solution), using the indicator system and method of steps S431-S434. The low-risk solution evaluation score is: defense effectiveness 60 points (interception rate 60%), implementation completion 90 points (deployment time 30 minutes), resource consumption 95 points (CPU usage 5%), with a total score of 60 × 42% + 90 × 27% + 95 × 31% = 76.5 points. The medium-risk solution score is: defense effectiveness 75 points (remediation rate 75%), implementation completion 80 points (deployment time 60 minutes), resource consumption 85 points (CPU usage 10%), with a total score of 75 × 42% + 80 × 27% + 85 × 31% = 79.0 points. The high-risk solution scored: 90 points for defense effectiveness (90% interception rate), 70 points for implementation completion (120 minutes of deployment), and 70 points for resource consumption (20% CPU usage). The overall score was 90 × 42% + 70 × 27% + 70 × 31% = 79.6. The extremely high-risk solution scored: 85 points for defense effectiveness (85% isolation success rate), 60 points for implementation completion (5 minutes of deployment but complex operations), and 80 points for resource consumption (15% CPU usage). The overall score was 85 × 42% + 60 × 27% + 80 × 31% = 77.5. The high-risk solution was selected as the optimal strategy, and the initial target network defense strategy plan data was generated. The specific steps included "1. Deploy the intrusion prevention system from 9:00 AM to 10:00 AM, 2. Configure traffic cleaning rules from 10:00 AM to 12:00 PM." The network security team was the primary actor, and timelines were accurate to the minute to ensure that the steps were executable and traceable.

[0142] Step S44: Inputting the target network defense initial strategy data into a preset network attack and defense simulation platform for simulation verification to simulate the target network defense effect after the target network defense initial strategy data is implemented, and calculating the reduction in attack success rate and the reduction ratio of security incidents to obtain target network defense strategy verification data;

[0143] In an embodiment of the present invention, the target network defense initial strategy plan data (high-risk plan) is input into a preset network attack and defense simulation platform. The platform constructs a virtual environment according to the target network topology structure 1:1, including 10 core nodes, 5 border gateways and 200 terminal devices. The simulation duration is set to 72 hours, and the attack traffic is generated according to the predicted data (DDoS attack 50 ICMP packets per second, SQL injection 10 times per hour). During the simulation process, the intrusion prevention system intercepted 180 DDoS attacks (200 total attacks), and the traffic cleaning device filtered 30% of the abnormal traffic. The attack success rate was 25% before implementation and dropped to 8% after implementation. The success rate decreased by (25%-8%) ÷ 25% × 100 = 68%. The number of security incidents was 30 times / day before implementation and 9 times / day after implementation, and the reduction ratio was (30-9) ÷ 30 × 100 = 70%. The simulation also recorded the impact of the defense strategy on normal business operations. The latency of core switch S1 increased from 10ms to 15ms (a 50% increase), which is within the acceptable range (threshold 20ms). The target network defense strategy validation data obtained included a 68% decrease in attack success rate, a 70% reduction in security incidents, and a 50% increase in business latency. All data was rounded to accurately reflect the defense's effectiveness and side effects.

[0144] Step S45: Optimize the corresponding target network defense initial strategy plan data based on the target network defense strategy verification data to obtain the target network security defense strategy plan data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

[0145] In an embodiment of the present invention, by optimizing the initial strategy scheme based on the target network defense strategy verification data, the intrusion prevention system rules are adjusted to address the fact that the attack success rate has not decreased as expected (target 70%), 20 new DDoS features are added (such as the ICMP packet size is fixed at 56 bytes), and the abnormal traffic filtering threshold of the traffic cleaning device is reduced from 30% to 25%; in response to the 50% increase in service delay, the traffic cleaning algorithm is optimized to reduce the data packet detection time (from 0.1 seconds to 0.05 seconds). The optimized scheme is simulated again, and the attack success rate has decreased by 72%, the security incidents have decreased by 75%, and the delay has increased by 30%, which is in line with the expected goals. The target network security defense strategy scheme data is obtained, and the specific operation steps are updated to "1. Add 20 new DDoS feature rules, 2. Adjust the traffic cleaning threshold to 25%, 3. Optimize the detection algorithm to 0.05 seconds", and the execution subject is still the network security group, and the time node is advanced to 08:00 to start deployment. This solution data was fed back into a pre-trained security prediction model, which was retrained to incorporate the parameters of the new defense strategy (520 rules, 25% cleaning threshold). The resulting network security prediction optimization results showed that the probability of DDoS attacks dropped to 8% and the probability of SQL injection attacks dropped to 5%. Content synchronized to the terminal included an operation manual for the optimized strategy, a simulation verification report, and a comparison table of prediction results. This guided the network security team to implement protection actions according to the new strategy and to check defense device logs hourly to ensure the rules were effective.

[0146] Furthermore, the security defense strategy evaluation of the differentiated defense strategy solution data in step S43 includes the following steps:

[0147] Determine a defense strategy evaluation indicator system, including primary and secondary indicators. Primary indicators include defense effectiveness, implementation completion, and resource consumption; secondary indicators include attack interception rate, vulnerability repair rate, strategy deployment time, and hardware resource utilization.

[0148] In an embodiment of the present invention, by determining the defense strategy program evaluation index system, the first-level indicators include defense effect, implementation completion, and resource consumption, and corresponding second-level indicators are set under each first-level indicator. The second-level indicators of defense effect are attack interception rate (unit%, calculation formula is the number of attacks successfully intercepted ÷ total number of attacks × 100) and vulnerability repair rate (unit%, calculation formula is the number of repaired vulnerabilities ÷ total number of vulnerabilities × 100); the second-level indicators of implementation completion are strategy deployment time (unit minutes, the time from the start of deployment to full effectiveness) and vulnerability repair rate (sharing this indicator with the defense effect to reflect the implementation progress); the second-level indicator of resource consumption is hardware resource occupancy rate (unit%, including CPU usage, memory usage, and taking the average of the two). All second-level indicators in the index system are set with clear calculation methods and data sources. The attack interception rate extracts the number of attacks from the logs of the firewall and intrusion detection system, the vulnerability repair rate obtains vulnerability data from the vulnerability management platform, the strategy deployment time is recorded by the timestamp of the deployment process, and the hardware resource occupancy rate is collected in real time by the server monitoring tool. For example, the attack interception rate must be accurate to one decimal place, and the strategy deployment time must be accurate to seconds, to ensure that all parameters of the indicator system are quantifiable and verifiable.

[0149] Preferably, the Delphi method is used to invite network security experts to weight and score the corresponding first-level indicators in the defense strategy program evaluation index system, so as to construct a judgment matrix and determine the indicator weight of each first-level indicator through consistency test, thereby obtaining the weight data of the first-level indicators of the defense strategy;

[0150] In an embodiment of the present invention, five network security experts (with more than 10 years of experience in network security and CISSP or CSSLP certification) are invited to weight and score the first-level indicators of the defense strategy program evaluation index system by using the Delphi method. The experts are required to rank the three first-level indicators of defense effectiveness, implementation completion, and resource consumption according to their importance and assign a total score of 100 points. The scoring range is 0-100 points, and the total score must be 100. The results of the first round of scoring are: Expert 1 gave 40 points for defense effectiveness, 30 points for implementation completion, and 30 points for resource consumption; Expert 2 gave 45 points, 25 points, and 30 points; Expert 3 gave 50 points, 20 points, and 30 points; Expert 4 gave 35 points, 35 points, and 30 points; Expert 5 gave 40 points, 25 points, and 35 points. The scoring results were organized into a judgment matrix, with matrix element a_ij representing the importance ratio of indicator i to indicator j (e.g., defense effectiveness / implementation completion = (40+45+50+35+40)÷(30+25+20+35+25) = 210÷135≈1.556). The maximum eigenvalue λ_max of the calculated matrix was 3.02, the consistency index CI = (3.02-3)÷(3-1) = 0.01, the random consistency index RI = 0.58, and the consistency ratio CR = 0.01÷0.58≈0.017<0.1, passing the consistency test. Finally, the average value of the experts' scores was taken as the indicator weight. The defense effect weight was (40+45+50+35+40)÷5=42 points, the implementation completion weight was (30+25+20+35+25)÷5=27 points, and the resource consumption weight was (30+30+30+30+35)÷5=31 points. The first-level indicator weight data of the defense strategy was obtained. The weights were accurate to integers, and the total was 100.

[0151] Preferably, the first-level indicators of each defense strategy in the differentiated defense strategy data are quantified based on the corresponding second-level indicators in the defense strategy evaluation indicator system, so as to quantify the corresponding defense effect by attack interception rate, quantify the corresponding implementation completion by strategy deployment time combined with vulnerability repair rate, and quantify the corresponding resource consumption by hardware resource utilization rate, thereby obtaining the quantitative results of the defense strategy evaluation.

[0152] In this embodiment of the present invention, data from differentiated defense strategies (including Strategies A: Enhanced Firewall Rules + Vulnerability Scanning, Strategies B: Intrusion Prevention System Deployment + Automatic Remediation, and Strategies C: Traffic Cleaning + Manual Remediation) are quantified using secondary indicators based on a defense strategy evaluation index system. Calculation of defense effectiveness: Strategies A's attack interception rate, extracted from firewall logs, intercepted 180 attacks, out of a total of 200 attacks, for an interception rate of 90.0%. Its vulnerability repair rate, obtained from the vulnerability platform, repaired 18 vulnerabilities, out of a total of 20 vulnerabilities, for a repair rate of 90.0%. Strategies B's attack interception rate, extracted from intrusion prevention system logs, intercepted 190 attacks, out of a total of 200 attacks, for an interception rate of 95.0%. Its vulnerability repair rate repaired 19 vulnerabilities, out of a total of 20 vulnerabilities, for a repair rate of 95.0%. Strategies C's attack interception rate, extracted from traffic cleaning device logs, intercepted 170 attacks, out of a total of 200 attacks, for an interception rate of 85.0%. Its vulnerability repair rate repaired 16 vulnerabilities, out of a total of 20 vulnerabilities, for a repair rate of 80.0%. Calculating implementation completion: Plan A's deployment time was 120 minutes, Plan B's was 60 minutes, and Plan C's was 180 minutes. Combined with the vulnerability remediation rate, Plan A's implementation completion is (60 ÷ 120) × 90.0% = 45.0%, Plan B's is (60 ÷ 60) × 95.0% = 95.0%, and Plan C's is (60 ÷ 180) × 80.0% = 26.7%. Calculating resource consumption: Plan A's CPU utilization was 15%, and its memory utilization was 20%, for an average of 17.5%; Plan B's was 25%, and its memory utilization was 30%, for an average of 27.5%; and Plan C's was 10%, and its memory utilization was 15%, for an average of 12.5%. This provides the quantitative results of the defense strategy evaluation, with all figures rounded to one decimal place.

[0153] Preferably, a weighted sum is performed based on the weight data of the first-level indicators of the defense strategy and the quantitative evaluation results of the defense strategy scheme, so that the corresponding comprehensive evaluation scores are calculated based on the corresponding weights after the quantitative evaluation results corresponding to each defense strategy scheme are standardized to obtain the target network security defense strategy evaluation score.

[0154] In the embodiment of the present invention, a weighted sum is performed based on the weighted data of the first-level indicators of the defense strategy (defense effect 42%, implementation completion 27%, resource consumption 31%) and the quantitative results of the defense strategy scheme evaluation. First, the quantitative results are standardized and the actual values ​​of each indicator are converted into scores from 0 to 100: an attack interception rate of 95% corresponds to 100 points, 90% corresponds to 90 points, and 85% corresponds to 80 points; a vulnerability repair rate of 95% corresponds to 100 points, 90% corresponds to 90 points, and 80% corresponds to 80 points; a strategy deployment time of 60 minutes corresponds to 100 points, 120 minutes corresponds to 50 points, and 180 minutes corresponds to 0 points; a hardware resource utilization rate of 12.5% ​​corresponds to 100 points, 17.5% corresponds to 80 points, and 27.5% corresponds to 50 points. Plan A's defensive effectiveness score = (90 × 0.5 + 90 × 0.5) = 90 points, implementation completion score = (50 × 0.5 + 90 × 0.5) = 70 points, resource consumption score = 80 points, and overall score = 90 × 42% + 70 × 27% + 80 × 31% = 37.8 + 18.9 + 24.8 = 81.5 points. Plan B's defensive effectiveness score = (100 × 0.5 + 100 × 0.5) = 100 points, implementation completion score = (100 × 0.5 + 100 × 0.5) = 100 points, resource consumption score = 50 points, and overall score = 100 × 42% + 100 × 27% + 50 × 31% = 42 + 27 + 15.5 = 84.5 points. Plan C's defense effectiveness score = (80 × 0.5 + 80 × 0.5) = 80 points, its implementation completion score = (0 × 0.5 + 80 × 0.5) = 40 points, its resource consumption score = 100 points, and its overall score = 80 × 42% + 40 × 27% + 100 × 31% = 33.6 + 10.8 + 31 = 75.4 points. All scores were rounded to one decimal place to obtain the target network security defense strategy assessment score. Plan B scored the highest (84.5 points), followed by Plan A (81.5 points), and Plan C the lowest (75.4 points), clearly reflecting the overall strengths and weaknesses of each defense strategy.

[0155] Furthermore, the present invention also provides an artificial intelligence-based network security prediction system for executing the artificial intelligence-based network security prediction method described above. The artificial intelligence-based network security prediction system includes:

[0156] The security prediction model training module is used to collect full network data of the target network through distributed network probes to obtain full data of the target network; perform structured network feature mapping on the full data of the target network to generate structured network security feature data; construct an initial network security prediction model based on the artificial intelligence network framework, and input the structured network security feature data into the initial network security prediction model for pre-training, thereby obtaining a pre-trained security prediction model;

[0157] The network attack classification module is used to recursively extract threat features from structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features. Based on the multi-dimensional threat feature data and the pre-trained security prediction model, network attacks are identified and classified to obtain target network attack type classification data.

[0158] The network security probability prediction module is used to analyze network attack touchpoints based on the target network attack type classification data to obtain the target network attack behavior trigger node set; based on the target network attack behavior trigger node set and the pre-trained security prediction model, the network security occurrence probability of the target network is predicted to obtain the target network security event probability prediction data;

[0159] The security defense iterative optimization module is used to construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization results, which are synchronized to the terminal to guide the target network security protection.

[0160] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is to be construed in the widest possible manner consistent with the principles and novel features disclosed herein.

Claims

1. A network security prediction method based on artificial intelligence, characterized in that: The following steps are involved: Step S1: Full network data collection is performed on the target network through distributed network probes to obtain full data of the target network; Perform structured network feature mapping on the entire target network data to generate structured network security feature data; An initial network security prediction model is constructed based on an artificial intelligence network framework, and structured network security feature data is input into the initial network security prediction model for pre-training to obtain a pre-trained security prediction model; Step S2: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features; perform network attack identification and classification based on the multi-dimensional threat feature data and the pre-trained security prediction model to obtain target network attack type classification data; Step S3: Perform network attack contact analysis based on the target network attack type classification data to obtain a target network attack behavior trigger node set; perform network security occurrence probability prediction on the target network based on the target network attack behavior trigger node set and the pre-trained security prediction model to obtain target network security event probability prediction data; Step S4: Construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

2. The network security prediction method based on artificial intelligence according to claim 1, characterized in that: Step S1 includes the following steps: Step S11: Deploy distributed network probes on the core nodes, border gateways, and terminal devices corresponding to the target network, and collect corresponding network data including TCP / UDP session data, packet payloads, port access records, user operation logs, and application call records based on the distributed network probes to obtain the full data of the target network; Step S12: pre-processing the full amount of target network data, performing data cleaning, format standardization, and structure conversion in sequence to obtain the full amount of target structured network data; Step S13: extracting static features and dynamic features from the full data of the target structured network, where the static features include IP address, port number, and protocol type, and the dynamic features include session duration, packet size distribution, and request frequency, to obtain structured network security feature data; Step S14: Based on the artificial intelligence network framework, a bidirectional long short-term memory network combined with an attention mechanism is used to construct an initial network security prediction model, and the structured network security feature data is divided into a training set and a validation set according to the time series; Step S15: Use the training set to iteratively train the initial network security prediction model, and use the validation set to adjust the hyperparameters corresponding to the initial network security prediction model in real time, including the number of hidden layer neurons and the learning rate, until the prediction accuracy corresponding to the initial network security prediction model reaches a preset threshold, thereby obtaining a pre-trained security prediction model.

3. The network security prediction method based on artificial intelligence according to claim 1, characterized in that: Step S2 includes the following steps: Step S21: recursively extract threat features from the structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and authority abuse features; Step S22: Build an initial threat signature library based on the multi-dimensional threat signature data to structure the multi-dimensional threat signature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and privilege abuse features according to feature type, frequency of occurrence, and degree of harm, and associate the corresponding CVE vulnerability numbers with ATT&CK attack framework labels to obtain target network threat signature library data; Step S23: By setting up a signature database update mechanism to regularly collect the latest network threat data and update the corresponding target network threat signature database data through federated learning technology without leaking local data, to obtain dynamically updated threat signature database data; Step S24: identifying network attack behaviors by combining the dynamically updated threat signature database data with the structured network security signature data corresponding to the target network predicted by the pre-trained security prediction model to obtain target network attack behavior identification data; Step S25: classify the target network attack behavior identification data into attack types to obtain target network attack type classification data.

4. The network security prediction method based on artificial intelligence according to claim 3 is characterized in that: Step S21 includes the following steps: Performing feature distribution set statistics on each network security feature in the structured network security feature data to obtain a distribution density set corresponding to each network security feature; Based on the distribution density set corresponding to each network security feature, each network security feature in the structured network security feature data is recursively screened in one stage to obtain the first-order feature data of the target network threat; Perform distribution statistical analysis on each remaining network feature in the first-order feature data of the target network threat to calculate the distribution mean, distribution standard deviation, and distribution kurtosis corresponding to each remaining network feature and construct the corresponding feature vector to obtain the distribution vector corresponding to each remaining network feature; Obtain a preset target network security threat feature library, and calculate the feature matching similarity between the distribution vector corresponding to each remaining network feature and the corresponding threat feature in the target network security threat feature library. At the same time, based on the feature matching similarity corresponding to each remaining network feature, perform a two-stage recursive screening on each remaining network feature in the target network threat first-order feature data to obtain the target network core threat feature data; Based on the target network's core threat feature data, abnormal pattern mining is performed to identify threat feature combinations corresponding to deviations from normal behavior patterns through the isolation forest algorithm to obtain target network threat abnormal feature pattern data; based on the target network threat abnormal feature pattern data, feature classification and annotation are performed to distinguish multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and authority abuse features.

5. The network security prediction method based on artificial intelligence according to claim 1 is characterized in that: Step S3 includes the following steps: Step S31: obtaining network traffic, intrusion logs, and historical attack events corresponding to different attack types based on the target network attack type classification data; Step S32: extracting network attack behaviors from the target network attack type classification data based on the network traffic, intrusion logs, and historical attack events corresponding to different attack types, so as to obtain the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network; Step S33: Obtain the network topology and defense mechanism corresponding to the target network; Step S34: performing network attack contact analysis based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and combining the network topology and defense mechanism corresponding to the target network to obtain a target network attack behavior trigger node set; Step S35: Based on the target network attack behavior trigger node set and the pre-trained security prediction model, the target network is subjected to network security probability prediction to obtain target network security event probability prediction data.

6. The network security prediction method based on artificial intelligence according to claim 5 is characterized in that: Step S34 includes the following steps: Step S341: Based on the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types of the target network and in combination with the network topology structure corresponding to the target network, a network attack topology mapping is performed to map the attack targets, attack methods, attack paths, and attack tools corresponding to different attack types to network nodes corresponding to the network topology structure, so as to obtain a target attack path node set corresponding to different attack types of the target network; Step S342: Based on the defense mechanism corresponding to the target network, a node attack assessment analysis is performed on the target attack pass node set corresponding to different attack types of the target network to obtain the attack reachability, attack importance, and defense security level corresponding to each node in the target network; Step S343: Based on the attack reachability, attack importance and defense security level corresponding to each node in the target network, a network attack contact analysis is performed on the corresponding target attack node set to associate the corresponding attack reachability, attack importance and defense security level with the target network nodes that may be triggered, determine all the corresponding network attack trigger nodes that may occur for this attack type, and obtain the target network attack behavior trigger node set.

7. The network security prediction method based on artificial intelligence according to claim 5 is characterized in that: Step S35 includes the following steps: Step S351: performing an attack diffusion risk assessment on the corresponding network topology structure on the target network based on the target network attack behavior trigger node set to obtain target network attack diffusion risk assessment data; Step S352: Based on the target network attack diffusion risk assessment data, corresponding core indicators for network attack risk prediction are obtained, including attack success rate, vulnerability exploitation difficulty, defense measure effectiveness, and attack duration, to obtain the target network attack risk initial indicator set data; Step S353: Performing index screening and dimensionality reduction on the target network attack risk initial indicator set data, using principal component analysis to eliminate multicollinearity between indicators, and retaining principal components whose cumulative contribution rates exceed a threshold, to obtain target network attack risk prediction indicator data; Step S354: By adding a time series prediction module on the basis of the pre-trained security prediction model, and using a gated recurrent unit to process the time series features corresponding to the target network attack risk prediction index data to construct a corresponding target network security event prediction model, and at the same time, dividing the target network attack risk prediction index data into time windows to input the target network security event prediction model for training, the sliding window method is used to predict the event type, prediction time, occurrence probability and impact range corresponding to the network security event in the future time period, and the target network security event probability prediction data is obtained.

8. The network security prediction method based on artificial intelligence according to claim 1, characterized in that: Step S4 includes the following steps: Step S41: Obtaining a network security probabilistic risk assessment standard, and classifying the target network security event probability prediction data into four levels of low risk, medium risk, high risk, and extremely high risk based on the network security probabilistic risk assessment standard, thereby obtaining target network security event risk level data; Step S42: Develop differentiated defense strategy data for different risk levels corresponding to the target network security incident risk level data, including: using a conventional monitoring strategy for low risk levels, initiating vulnerability remediation and access control enhancement for medium risk levels, deploying an intrusion prevention system and traffic cleaning for high risk levels, and implementing an emergency response strategy of isolating the affected area for extremely high risk levels; Step S43: Perform security defense strategy evaluation on the differentiated defense strategy solution data to obtain a target network security defense strategy evaluation score; select the optimal target network defense strategy based on the target network security defense strategy evaluation score to generate target network defense initial strategy solution data including specific operation steps, execution subjects, and corresponding time nodes; Step S44: Inputting the target network defense initial strategy data into a preset network attack and defense simulation platform for simulation verification to simulate the target network defense effect after the target network defense initial strategy data is implemented, and calculating the reduction in attack success rate and the reduction ratio of security incidents to obtain target network defense strategy verification data; Step S45: Optimize the corresponding target network defense initial strategy plan data based on the target network defense strategy verification data to obtain the target network security defense strategy plan data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization result, which is synchronized to the terminal to guide the target network security protection.

9. The network security prediction method based on artificial intelligence according to claim 8, characterized in that: The security defense strategy evaluation of the differentiated defense strategy solution data in step S43 includes the following steps: Determine a defense strategy evaluation indicator system, including primary and secondary indicators. Primary indicators include defense effectiveness, implementation completion, and resource consumption; secondary indicators include attack interception rate, vulnerability repair rate, strategy deployment time, and hardware resource utilization. Using the Delphi method, cybersecurity experts were invited to weight and score the corresponding first-level indicators in the defense strategy program evaluation index system. This was used to construct a judgment matrix and determine the indicator weights of each first-level indicator through consistency testing, thus obtaining the weight data of the first-level indicators of the defense strategy. Based on the corresponding secondary indicators within the defense strategy evaluation index system, each defense strategy within the differentiated defense strategy data is quantified using the primary indicators. The corresponding defense effectiveness is quantified by the attack interception rate, the implementation completion is quantified based on the strategy deployment time combined with the vulnerability repair rate, and the corresponding resource consumption is quantified by the hardware resource utilization rate. The quantitative results of the defense strategy evaluation are obtained. Based on the weight data of the first-level indicators of the defense strategy and the quantitative results of the defense strategy scheme evaluation, a weighted sum is performed to standardize the evaluation quantitative results corresponding to each defense strategy scheme and calculate the corresponding comprehensive evaluation score with the corresponding weight to obtain the target network security defense strategy evaluation score.

10. A network security prediction system based on artificial intelligence, characterized in that: For executing the artificial intelligence-based network security prediction method according to claim 1, the artificial intelligence-based network security prediction system comprises: The security prediction model training module is used to collect full network data of the target network through distributed network probes to obtain full data of the target network; perform structured network feature mapping on the full data of the target network to generate structured network security feature data; construct an initial network security prediction model based on the artificial intelligence network framework, and input the structured network security feature data into the initial network security prediction model for pre-training, thereby obtaining a pre-trained security prediction model; The network attack classification module is used to recursively extract threat features from structured network security feature data to obtain multi-dimensional threat feature data corresponding to abnormal connection features, malicious code features, SQL injection features, DDoS attack features, and permission abuse features. Based on the multi-dimensional threat feature data and the pre-trained security prediction model, network attacks are identified and classified to obtain target network attack type classification data. The network security probability prediction module is used to analyze network attack touchpoints based on the target network attack type classification data to obtain the target network attack behavior trigger node set; based on the target network attack behavior trigger node set and the pre-trained security prediction model, the network security occurrence probability of the target network is predicted to obtain the target network security event probability prediction data; The security defense iterative optimization module is used to construct target network security defense strategy plan data based on the target network security event probability prediction data, and feed the target network security defense strategy plan data back to the pre-trained security prediction model for iterative optimization prediction to output the corresponding target network security prediction optimization results, which are synchronized to the terminal to guide the target network security protection.

Images