Smart park multi-dimensional risk early warning method and system based on AI big data

Abstract

The invention relates to the technical field of smart park risk prediction, and provides a smart park multi-dimensional risk early warning method and system based on AI big data, and the method comprises the steps: collecting the historical data of a plurality of factors corresponding to a network security accident of a smart park; wherein the factors comprise hardware equipment, a software system, network attack, data security, personnel operation and third-party service; based on historical data of various factors, risk coupling values of the factors are calculated through an N-K model; collecting various monitoring data and identifying abnormal monitoring data; determining a factor type to which the abnormal monitoring data belongs; determining a target risk coupling value from the factor risk coupling values based on the factor type to which each abnormal monitoring data belongs; and on the basis of the abnormal monitoring data and the target risk coupling value, network security accident risk level prediction is carried out through a network security accident risk level prediction model, and corresponding early warning is carried out. The accuracy of risk level prediction of the smart park is improved.

Description

Technical Field

[0001] The present application relates to the technical field of risk prediction for smart parks, and in particular to a multi-dimensional risk warning method and system for smart parks based on AI big data. Background Art

[0002] With the rapid development of IoT technology, the construction of smart campuses has become a key trend in modern campus management. However, a cybersecurity incident in a smart campus can severely impact its operational management, data security, and user privacy. Traditional network security monitoring methods predict risk levels based on a single factor, lacking in-depth analysis of the coupling relationships between these factors and overlooking the interactions between different risk factors. This results in inaccurate predictions of smart campus risk levels, and consequently, inaccurate early warnings. Therefore, improving the accuracy of smart campus risk level predictions and, therefore, early warnings, is a pressing technical challenge. Summary of the Invention

[0003] In response to the above technical problems, the purpose of this application is to provide a multi-dimensional risk warning method and system for smart parks based on AI big data, aiming to improve the accuracy of risk level prediction of smart parks and thus improve the accuracy of risk warning of smart parks.

[0004] In a first aspect, the present application provides a multi-dimensional risk warning method for a smart park based on AI big data, including:

[0005] Collect historical data on various factors related to cybersecurity incidents in smart parks, including hardware, software systems, network attacks, data security, human operations, and third-party services.

[0006] Based on the historical data of the multiple factors, the risk coupling value of each factor is calculated using the NK model;

[0007] Collect various monitoring data used to predict cybersecurity incident risks and identify abnormal monitoring data;

[0008] Determining the factor type to which the abnormal monitoring data belongs;

[0009] Based on the factor type to which each abnormal monitoring data belongs, the target risk coupling value is determined from the risk coupling values ​​of each factor;

[0010] Based on the abnormal monitoring data and the target risk coupling value, a network security accident risk level prediction model is used to predict the network security accident risk level and a corresponding warning is issued according to the prediction result.

[0011] Furthermore, the step of calculating the risk coupling value of each factor by using the NK model based on the historical data of the multiple factors includes:

[0012] The six-factor risk coupling value is calculated based on the following formula:

[0013] ;

[0014] h=1,2,...,H;i=1,2,...,I;j=1,2,...,J;k=1,2,...,K;l=1,2,...,L;m=1,2,...,M;

[0015] Among them, a represents hardware equipment factors, b represents software system factors, c represents network attack factors, d represents data security factors, e represents human operation factors, and f represents third-party service factors; It represents the probability of coupling of network security incident risks when the hardware device factor is in the hth state, the software system factor is in the ith state, the network attack factor is in the jth state, the data security factor is in the kth state, the human operation factor is in the lth state, and the third-party service is in the fth state. It represents the probability of hardware equipment coupling with cybersecurity incident risk in state h. represents the probability of network security accident risk coupling occurring in the software system in state i, represents the probability of network attack occurring under the j-state network security incident risk coupling, represents the probability of data security coupling with cybersecurity incident risk in state k, It represents the probability of network security accident risk coupling occurring when personnel operate in state l. represents the probability of network security incident risk coupling occurring in the third-party service under state m, Represents the six-factor risk coupling value.

[0016] Furthermore, the network security incident risk level prediction model includes an input layer, a feature extraction layer, a fusion layer, and a classification layer. The feature extraction layer is used to extract features from the abnormal monitoring data to obtain features of each abnormal monitoring data.

[0017] The fusion layer is used to nonlinearly fuse the features of each abnormal monitoring data with the target risk coupling value;

[0018] The classification layer is used to predict the network security incident risk level based on the fused features and output the network security incident risk level.

[0019] Furthermore, the step of nonlinearly fusing the features of each abnormal monitoring data with the target risk coupling value includes:

[0020] The features of each abnormal monitoring data are nonlinearly fused with the target risk coupling value according to the following formula to obtain the fused features:

[0021] ;

[0022] ;

[0023] in, is the fused feature, X is the vector composed of the features of the abnormal monitoring data, s is the coupling coefficient, W is the weight matrix obtained by model training, R is the target risk coupling value, and k is the dynamic adjustment parameter determined by the intensity of the abnormal monitoring data. The calculation formula is: , N is the number of abnormal factors, is the intensity value of the nth abnormal factor, .

[0024] Furthermore, the training loss function of the cybersecurity incident risk level prediction model adopts a classification loss function with an ordinal relationship.

[0025] Furthermore, the step of determining the factor type to which the abnormal monitoring data belongs includes:

[0026] Obtaining a mapping rule table between pre-set factor types and monitoring data;

[0027] Based on the abnormal monitoring data, the factor type to which the abnormal monitoring data belongs is determined through a mapping rule table between the factor type and the monitoring data.

[0028] Furthermore, the step of determining a target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs includes:

[0029] Determine a unique coupling pattern consisting of factor types belonging to all of the abnormal monitoring data;

[0030] Obtaining pre-calculated risk coupling values ​​of the various factors;

[0031] A risk coupling value corresponding to the unique coupling mode is found from the risk coupling values ​​of each factor as the target risk coupling value.

[0032] In a second aspect, an embodiment of the present application provides a multi-dimensional risk warning system for a smart park based on AI big data, the system comprising:

[0033] The collection module is used to collect historical data on various factors related to network security incidents in smart parks, including hardware equipment, software systems, network attacks, data security, human operations, and third-party services.

[0034] A calculation module, configured to calculate the risk coupling value of each factor using the NK model based on the historical data of the multiple factors;

[0035] The collection module is used to collect various monitoring data used to predict network security incident risks and identify abnormal monitoring data;

[0036] A first determining module is used to determine the factor type to which the abnormal monitoring data belongs;

[0037] The second determination module is used to determine the target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs;

[0038] The prediction and warning module is used to predict the network security accident risk level based on the abnormal monitoring data and the target risk coupling value through the network security accident risk level prediction model and issue corresponding warnings according to the prediction results.

[0039] The embodiment of the present application is aimed at network security incidents in smart parks, and collects corresponding multi-factor historical data, including hardware equipment, software systems, network attacks, data security, personnel operations and third-party services, to lay a data foundation for the subsequent calculation of the risk coupling value of each factor through the NK model. The multi-factor historical data such as hardware equipment, software, network attacks, data security, personnel operations and third-party services improves the comprehensiveness of risk identification. Based on the above multi-factor historical data, the risk coupling value of each factor is calculated through the NK model, which can evaluate the possibility of network security incidents caused by different factor combinations. The larger the risk coupling value, the greater the possibility of a network security incident. By real-time monitoring of various monitoring data used to predict network security risks and identifying abnormal data therefrom, as well as determining the factor type to which the abnormal monitoring data belongs, and based on the factor type to which each abnormal monitoring data belongs, determining the target risk coupling value from the risk coupling value of each factor; based on the abnormal monitoring data and the target risk coupling value, the network security risk level is predicted through an artificial intelligence model and corresponding warnings are issued according to the prediction results. The risk coupling values ​​corresponding to various combinations of abnormal monitoring data are taken into account in the artificial intelligence model. The artificial intelligence model can learn the risk coupling values ​​of various combinations of abnormal factors, the relationship between abnormal monitoring data and risk levels, so that the prediction of network security risk levels is more accurate, thereby improving the accuracy of risk warnings in smart parks. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] In order to more clearly illustrate the technical solution of the present application, the following is a brief introduction to the drawings required for use in the implementation. Obviously, the drawings described below are only some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 This is a flow chart of a multi-dimensional risk warning method for a smart park based on AI big data provided by an embodiment of the present application;

[0042] Figure 2 This is a structural diagram of the multi-dimensional risk warning system for smart parks based on AI big data provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0044] Those skilled in the art will understand that, unless expressly stated otherwise, the singular forms "a", "an", "above", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of this application refers to the presence of features, integers, steps, operations, elements, modules, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, modules, components, and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be intermediate elements. In addition, "connected" or "coupled" as used herein may include wireless connections or wireless couplings. The term "and / or" used herein includes all or any module and all combinations of one or more associated listed items.

[0045] Those skilled in the art will understand that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in common dictionaries should be understood to have meanings consistent with their meanings in the context of the prior art and, unless specifically defined as such, will not be interpreted in an idealized or overly formal sense.

[0046] See also Figure 1 , an embodiment of the present application provides a multi-dimensional risk warning method for a smart park based on AI big data, the method comprising:

[0047] S1. Collect historical data on various factors related to cybersecurity incidents in smart parks, including hardware, software systems, network attacks, data security, human operations, and third-party services.

[0048] S2. Calculating the risk coupling value of each factor using the NK model based on the historical data of the multiple factors;

[0049] S3. Collect various monitoring data used to predict cybersecurity incident risks and identify abnormal monitoring data;

[0050] S4. Determine the factor type to which the abnormal monitoring data belongs;

[0051] S5. Based on the factor type to which each abnormal monitoring data belongs, determine the target risk coupling value from the risk coupling values ​​of each factor;

[0052] S6. Based on the abnormal monitoring data and the target risk coupling value, a network security incident risk level prediction model is used to predict the network security incident risk level and a corresponding warning is issued according to the prediction result.

[0053] In step S1, a large amount of historical data on various factors related to cybersecurity incidents in the smart park is collected, such as integrating cybersecurity incidents in the park over the past three years. After collecting this historical data, predictive preprocessing is performed, such as removing outliers and distributing the data for easy retrieval and use, as well as to avoid single points of failure. Hardware devices include servers and network equipment. For example, in a cybersecurity incident, a server hardware failure caused service interruption. Software systems include operating systems, application software, and middleware. In a cybersecurity incident, a system vulnerability was exploited to cause malicious code execution. Network attacks include external and internal malicious network activities. In one cybersecurity incident, a DDoS attack paralyzed the network. Human operations include human error or violations. In one cybersecurity incident, an administrator accidentally deleted a system file, causing service interruption. Third-party services include outsourced services, API interfaces, and other third-party dependencies. In one cybersecurity incident, a vulnerability in a third-party cloud service led to data theft. Data security includes the confidentiality and integrity of data storage, processing, and processing. In one cybersecurity incident, a database leak led to the leakage of sensitive information. Among these six risk factors, there are correlations between them, and coupled risk scenarios between them can include, for example, an old server failing to support the latest security patches, allowing vulnerabilities to be exploited. Managers failing to close test ports promptly creates entry points for attacks. The present application improves the comprehensiveness of risk identification by integrating historical data from multiple factors, including hardware devices, software, network attacks, data security, human operations, and third-party services.

[0054] In step S2, to quantify the degree of coupling between (risk) factors in cybersecurity incidents, cybersecurity incident risks are categorized into six categories: hardware equipment, software systems, network attacks, data security, human operations, and third-party services. The NK model is then used to calculate the risk coupling value for each factor. Using the NK model to calculate the risk coupling value for each factor, the likelihood of a cybersecurity incident occurring due to different factor combinations can be assessed. A higher risk coupling value indicates a greater coupling risk and a higher likelihood of a cybersecurity incident. Risk coupling values ​​for each factor include two-factor, three-factor, four-factor, five-factor, and six-factor risk coupling values. Two-factor risk coupling values ​​include multiple values ​​corresponding to the risk coupling between two different factors. The same applies to three-factor, four-factor, and five-factor risk coupling values.

[0055] In steps S3-S5 above, various monitoring data used to predict network security risks are collected and abnormal monitoring data is identified. In one example, the monitoring data includes hardware device data, software system data, network attack data, data security data, human operation data, and third-party service data. Hardware device data includes CPU usage, software system data includes the number of operating system vulnerabilities, network attack data includes DDoS attack traffic, data security data includes the number of illegal accesses, human operation data includes the number of incorrect operations, and third-party service data includes the number of third-party response errors. In this example, abnormal monitoring data is identified through threshold comparison.

[0056] The embodiment of the present application is aimed at network security incidents in smart parks, and collects corresponding multi-factor historical data, including hardware equipment, software systems, network attacks, data security, personnel operations and third-party services, to lay a data foundation for the subsequent calculation of the risk coupling value of each factor through the NK model. The multi-factor historical data such as hardware equipment, software, network attacks, data security, personnel operations and third-party services improves the comprehensiveness of risk identification. Based on the above multi-factor historical data, the risk coupling value of each factor is calculated through the NK model, which can evaluate the possibility of network security incidents caused by different factor combinations. The larger the risk coupling value, the greater the possibility of a network security incident. By real-time monitoring of various monitoring data used to predict network security risks and identifying abnormal data therefrom, as well as determining the factor type to which the abnormal monitoring data belongs, and based on the factor type to which each abnormal monitoring data belongs, determining the target risk coupling value from the risk coupling value of each factor; based on the abnormal monitoring data and the target risk coupling value, the network security risk level is predicted through an artificial intelligence model and corresponding warnings are issued according to the prediction results. The risk coupling values ​​corresponding to various combinations of abnormal monitoring data are taken into account in the artificial intelligence model. The artificial intelligence model can learn the risk coupling values ​​of various combinations of abnormal factors, the relationship between abnormal monitoring data and risk levels, so that the prediction of network security risk levels is more accurate, thereby improving the accuracy of risk warnings in smart parks.

[0057] In the embodiment of the present application, before calculating the risk coupling value of each factor, the coupling combination mode and frequency of the six factors of hardware equipment, software system, network attack, data security, personnel operation and third-party service in a large number of network security incidents are analyzed. Each factor has two states: not occurring (0) and occurring (1), forming 63 coupling combinations. The frequency of each coupling combination can be calculated by counting the number of couplings of various coupling combinations. Using the frequency of various coupling combinations and the calculation formula of the mutual information T in information theory to represent the coupling between security risks, the risk coupling value of each factor can be calculated. For example, the risk coupling value of the six factors can be calculated by the following formula.

[0058] ;

[0059] h=1,2,...,H;i=1,2,...,I;j=1,2,...,J;k=1,2,...,K;l=1,2,...,L;m=1,2,...,M;

[0060] Among them, a represents hardware equipment factors, b represents software system factors, c represents network attack factors, d represents data security factors, e represents human operation factors, and f represents third-party service factors; It represents the probability of coupling of network security incident risks when the hardware device factor is in the hth state, the software system factor is in the ith state, the network attack factor is in the jth state, the data security factor is in the kth state, the human operation factor is in the lth state, and the third-party service is in the fth state. It represents the probability of hardware equipment coupling with cybersecurity incident risk in state h. represents the probability of network security accident risk coupling occurring in the software system in state i, represents the probability of network attack occurring under the j-state network security incident risk coupling, represents the probability of data security coupling with cybersecurity incident risk in state k, It represents the probability of network security accident risk coupling occurring when personnel operate in state l. represents the probability of network security incident risk coupling occurring in the third-party service under state m, Represents the six-factor risk coupling value.

[0061] Similarly, when two risk factors are coupled, there are 15 coupling combinations, namely hardware equipment-software system, hardware equipment-network attack, hardware equipment-hardware equipment, ..., human operation and third-party service. According to the calculation formula of interaction information, the risk coupling value of equipment-software system is calculated according to the formula ;

[0062] h=1,2,...,H;i=1,2,...,I;

[0063] T(a,b) represents the risk coupling value of the equipment-software system. It represents the probability of risk coupling between hardware device factors in the hth state and software system factors in the ith state. represents the probability that the hardware device is in state h, Represents the probability that the software system is in state i.

[0064] The calculation of the coupling values ​​between other factors is similar, and is calculated according to the mutual information calculation formula, which will not be described in detail in the present invention.

[0065] In one embodiment, the network security incident risk level prediction model includes an input layer, a feature extraction layer, a fusion layer, and a classification layer. The feature extraction layer is used to extract features from the abnormal monitoring data to obtain features of each abnormal monitoring data.

[0066] The fusion layer is used to nonlinearly fuse the features of each abnormal monitoring data with the target risk coupling value;

[0067] The classification layer is used to predict the network security incident risk level based on the fused features and output the network security incident risk level.

[0068] In one example, the feature extraction layer extracts features such as the ratio of the current CPU usage to the maximum abnormal CPU usage, the ratio of the current number of operating system vulnerabilities to the maximum abnormal number of operating system vulnerabilities, the ratio of the current number of illegal accesses to the maximum abnormal number of illegal accesses, the ratio of the current number of erroneous operations to the maximum abnormal number of erroneous operations, and the current number of third-party response errors to the maximum abnormal number of third-party response errors. In one example, the feature extraction layer includes multiple channels for receiving each type of abnormal monitoring data and calculating the features of each type of abnormal monitoring data using a normalization module. The fusion layer includes a fully connected layer and a coupling coefficient calculation module, wherein the coupling coefficient calculation module is used to calculate the coupling coefficient. The classification layer uses a multi-layer perceptron.

[0069] In one embodiment, the step of nonlinearly fusing the features of each abnormal monitoring data with the target risk coupling value includes:

[0070] The features of each abnormal monitoring data are nonlinearly fused with the target risk coupling value according to the following formula to obtain the fused features:

[0071] ;

[0072] ;

[0073] in, is the fused feature, X is the vector composed of the features of the abnormal monitoring data, s is the coupling coefficient, W is the weight matrix obtained by model training, R is the target risk coupling value, and k is the dynamic adjustment parameter determined by the intensity of the abnormal monitoring data. The calculation formula is: , N is the number of abnormal factors, is the intensity value of the nth abnormal factor, .

[0074] In this application, the accuracy of risk prediction is improved by nonlinearly fusing the characteristics of each abnormal monitoring data with the target risk coupling value. By dynamically adjusting the coupling coefficient using a Sigmoid function, an intelligent balance between the severity of anomalies and the coupling effect is achieved in smart park risk warnings, improving the accuracy and precision of risk prediction.

[0075] In one embodiment, the training loss function of the network security incident risk level prediction model adopts a classification loss function with an ordinal relationship.

[0076] In this embodiment of the present application, a classification loss function with an ordinal relationship decomposes the ordered K-class classification task into K-1 binary classification tasks, enhancing classification robustness and reducing the overall false positive rate. Each task uses a separate BCE loss (Binary Cross-Entropy).

[0077] In the embodiment of the present application, specifically, the samples for training the network security incident risk level prediction model include abnormal monitoring data, target risk coupling values, and corresponding risk levels. During training, a classification loss function with an ordinal relationship is used for training.

[0078] In one embodiment, the step of determining the factor type to which the abnormal monitoring data belongs includes:

[0079] Obtaining a mapping rule table between pre-set factor types and monitoring data;

[0080] Based on the abnormal monitoring data, the factor type to which the abnormal monitoring data belongs is determined through a mapping rule table between the factor type and the monitoring data.

[0081] In one embodiment, the step of determining the target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs includes:

[0082] Determine a unique coupling pattern consisting of factor types belonging to all of the abnormal monitoring data;

[0083] Obtaining pre-calculated risk coupling values ​​of the various factors;

[0084] A risk coupling value corresponding to the unique coupling mode is found from the risk coupling values ​​of each factor as the target risk coupling value.

[0085] In the embodiment of the present application, the factor types of abnormal monitoring data include hardware device factor a, software system factor b, and network attack factor c. Then the unique coupling mode of these three is abc, and the target risk coupling value is the risk coupling value between abc. In addition, if the corresponding risk coupling value cannot be found from the risk coupling values ​​of each factor, its risk coupling value is set to 0. Since the NK model calculates the risk coupling value between two or more factors, its risk coupling value is set to 0 under its single factor.

[0086] See also Figure 2 The present application also provides a multi-dimensional risk warning system for smart parks based on AI big data, the system comprising:

[0087] Collection Module 1 is used to collect historical data on various factors related to network security incidents in smart parks, including hardware devices, software systems, network attacks, data security, human operations, and third-party services.

[0088] Calculation module 2, used to calculate the risk coupling value of each factor through the NK model based on the historical data of the multiple factors;

[0089] Collection module 3, used to collect various monitoring data used to predict network security incident risks and identify abnormal monitoring data;

[0090] A first determining module 4 is used to determine the factor type to which the abnormal monitoring data belongs;

[0091] The second determination module 5 is configured to determine a target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs;

[0092] The prediction and warning module 6 is used to predict the network security accident risk level based on the abnormal monitoring data and the target risk coupling value through the network security accident risk level prediction model and issue corresponding warnings according to the prediction results.

[0093] In one embodiment, the calculation module 2 is specifically configured to:

[0094] The six-factor risk coupling value is calculated based on the following formula:

[0095] ;

[0096] h=1,2,...,H;i=1,2,...,I;j=1,2,...,J;k=1,2,...,K;l=1,2,...,L;m=1,2,...,M;

[0097] Among them, a represents hardware equipment factors, b represents software system factors, c represents network attack factors, d represents data security factors, e represents human operation factors, and f represents third-party service factors; It represents the probability of coupling of network security incident risks when the hardware device factor is in the hth state, the software system factor is in the ith state, the network attack factor is in the jth state, the data security factor is in the kth state, the human operation factor is in the lth state, and the third-party service is in the fth state. It represents the probability of hardware equipment coupling with cybersecurity incident risk in state h. represents the probability of network security accident risk coupling occurring in the software system in state i, represents the probability of network attack occurring under the j-state network security incident risk coupling, represents the probability of data security coupling with cybersecurity incident risk in state k, It represents the probability of network security accident risk coupling occurring when personnel operate in state l. represents the probability of network security incident risk coupling occurring in the third-party service under state m, Represents the six-factor risk coupling value.

[0098] In one embodiment, the network security incident risk level prediction model includes an input layer, a feature extraction layer, a fusion layer, and a classification layer. The feature extraction layer is used to extract features from the abnormal monitoring data to obtain features of each abnormal monitoring data.

[0099] The fusion layer is used to nonlinearly fuse the features of each abnormal monitoring data with the target risk coupling value;

[0100] The classification layer is used to predict the network security incident risk level based on the fused features and output the network security incident risk level.

[0101] In one embodiment, the fusion layer is specifically used for:

[0102] The features of each abnormal monitoring data are nonlinearly fused with the target risk coupling value according to the following formula to obtain the fused features:

[0103] ;

[0104] ;

[0105] in, is the fused feature, X is the vector composed of the features of the abnormal monitoring data, s is the coupling coefficient, W is the weight matrix obtained by model training, R is the target risk coupling value, and k is the dynamic adjustment parameter determined by the intensity of the abnormal monitoring data. The calculation formula is: , N is the number of abnormal factors, is the intensity value of the nth abnormal factor, .

[0106] In one embodiment, the training loss function of the network security incident risk level prediction model adopts a classification loss function with an ordinal relationship.

[0107] In one embodiment, the first determining module 4 includes:

[0108] An acquisition unit, configured to acquire a mapping rule table between preset factor types and monitoring data;

[0109] The first determining unit is configured to determine, based on the abnormal monitoring data, the factor type to which the abnormal monitoring data belongs through a mapping rule table between the factor type and the monitoring data.

[0110] In one embodiment, the second determining module 5 includes:

[0111] A second determining unit is used to determine a unique coupling mode composed of factor types to which all abnormal monitoring data belong;

[0112] An acquiring unit, configured to acquire the risk coupling values ​​of the factors calculated in advance;

[0113] The matching unit is used to find the risk coupling value corresponding to the unique coupling mode from the risk coupling values ​​of each factor as the target risk coupling value.

[0114] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiment methods can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media provided in this application and used in the embodiments may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (SSRSDRAM), enhanced SDRAM (ESDRAM), Synchronous Link DRAM (SLDRAM), Rambus direct RAM (RDRAM), direct RAM bus dynamic RAM (DRDRAM), and RAM bus dynamic RAM (RDRAM).

[0115] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, apparatus, article, or method comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, apparatus, article, or method. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, apparatus, article, or method comprising the element.

[0116] The above description is only a preferred embodiment of the present application and does not limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A multi-dimensional risk warning method for smart parks based on AI big data, characterized by: The method comprises: Collect historical data on various factors related to cybersecurity incidents in smart parks, including hardware, software systems, network attacks, data security, human operations, and third-party services. Based on the historical data of the multiple factors, the risk coupling value of each factor is calculated using the NK model; Collect various monitoring data used to predict cybersecurity incident risks and identify abnormal monitoring data; Determining the factor type to which the abnormal monitoring data belongs; Based on the factor type to which each abnormal monitoring data belongs, the target risk coupling value is determined from the risk coupling values ​​of each factor; Based on the abnormal monitoring data and the target risk coupling value, a network security accident risk level prediction model is used to predict the network security accident risk level and a corresponding warning is issued according to the prediction result.

2. The multi-dimensional risk warning method for smart parks based on AI big data according to claim 1 is characterized in that: The step of calculating the risk coupling value of each factor by using the NK model based on the historical data of the multiple factors includes: The six-factor risk coupling value is calculated based on the following formula: ； h=1,2,...,H;i=1,2,...,I;j=1,2,...,J;k=1,2,...,K;l=1,2,...,L;m=1,2,...,M; Among them, a represents hardware equipment factors, b represents software system factors, c represents network attack factors, d represents data security factors, e represents human operation factors, and f represents third-party service factors; It represents the probability of coupling of network security incident risks when the hardware device factor is in the hth state, the software system factor is in the ith state, the network attack factor is in the jth state, the data security factor is in the kth state, the human operation factor is in the lth state, and the third-party service is in the fth state. It represents the probability of hardware equipment coupling with cybersecurity incident risk in state h. represents the probability of network security accident risk coupling occurring in the software system in state i, represents the probability of network attack occurring under the j-state network security incident risk coupling, represents the probability of data security coupling with cybersecurity incident risk in state k, It represents the probability of network security accident risk coupling occurring when personnel operate in state l. represents the probability of network security incident risk coupling occurring in the third-party service under state m, Represents the six-factor risk coupling value.

3. The multi-dimensional risk early warning method for smart parks based on AI big data according to claim 1 is characterized in that: The network security incident risk level prediction model includes an input layer, a feature extraction layer, a fusion layer, and a classification layer. The feature extraction layer is used to extract features from the abnormal monitoring data to obtain features of each abnormal monitoring data. The fusion layer is used to nonlinearly fuse the features of each abnormal monitoring data with the target risk coupling value; The classification layer is used to predict the network security incident risk level based on the fused features and output the network security incident risk level.

4. The multi-dimensional risk warning method for smart parks based on AI big data according to claim 3 is characterized in that: The step of nonlinearly fusing the features of each abnormal monitoring data with the target risk coupling value comprises: The features of each abnormal monitoring data are nonlinearly fused with the target risk coupling value according to the following formula to obtain the fused features: ； ； in, is the fused feature, X is the vector composed of the features of the abnormal monitoring data, s is the coupling coefficient, W is the weight matrix obtained by model training, R is the target risk coupling value, and k is the dynamic adjustment parameter determined by the intensity of the abnormal monitoring data. The calculation formula is: , N is the number of abnormal factors, is the intensity value of the nth abnormal factor, .

5. The multi-dimensional risk warning method for smart parks based on AI big data according to claim 3 is characterized in that: The training loss function of the cybersecurity incident risk level prediction model adopts a classification loss function with ordinal relationship.

6. The multi-dimensional risk early warning method for smart parks based on AI big data according to claim 1 is characterized in that: The step of determining the factor type to which the abnormal monitoring data belongs includes: Obtaining a mapping rule table between pre-set factor types and monitoring data; Based on the abnormal monitoring data, the factor type to which the abnormal monitoring data belongs is determined through a mapping rule table between the factor type and the monitoring data.

7. The multi-dimensional risk warning method for smart parks based on AI big data according to claim 1 is characterized in that: The step of determining the target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs includes: Determine a unique coupling pattern consisting of factor types belonging to all of the abnormal monitoring data; Obtaining pre-calculated risk coupling values ​​of the various factors; A risk coupling value corresponding to the unique coupling mode is found from the risk coupling values ​​of each factor as the target risk coupling value.

8. A multi-dimensional risk warning system for smart parks based on AI big data, characterized by: The system comprises: The collection module is used to collect historical data on various factors related to network security incidents in smart parks, including hardware equipment, software systems, network attacks, data security, human operations, and third-party services. A calculation module, configured to calculate the risk coupling value of each factor using the NK model based on the historical data of the multiple factors; The collection module is used to collect various monitoring data used to predict network security incident risks and identify abnormal monitoring data; A first determining module is used to determine the factor type to which the abnormal monitoring data belongs; The second determination module is used to determine the target risk coupling value from the risk coupling values ​​of each factor based on the factor type to which each abnormal monitoring data belongs; The prediction and warning module is used to predict the network security accident risk level based on the abnormal monitoring data and the target risk coupling value through the network security accident risk level prediction model and issue corresponding warnings according to the prediction results.

Images