Artificial intelligence-based data security posture analysis system and method

Abstract

The application discloses a data security situation analysis system and method based on artificial intelligence, and relates to the technical field of artificial intelligence.The application extracts feature data of network flow data by setting a network flow monitoring sliding window and a period, generates comprehensive features by normalization and a feature fusion model, calculates abnormal values by using Mahalanobis distance and constructs a situation curve graph, realizes comprehensive capture and quantitative analysis of flow features, analyzes time series data of abnormal values in the current window by using a time series prediction model, predicts abnormal values and generates a prediction curve, realizes pre-caching of a data security interactive cache area in combination with historical data, achieves data pre-caching of a situation, and finally calculates the prediction error of real-time abnormal values of flow in the cache area in real time, locks and controls early warning data and updates asynchronously, realizes real-time monitoring and risk control of abnormal flow, and guarantees the safe and stable interaction of a database.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, specifically to a data security situation analysis system and method based on artificial intelligence. Background Technology

[0002] Data security posture analysis is a crucial step in ensuring the security of core database assets. It can detect potential security threats in network traffic in real time, accurately identify abnormal access behavior and data leakage risks, and provide core basis for dynamically adjusting security protection strategies and providing early warning of security incidents. It is directly related to the integrity and confidentiality of data assets and the stable operation of business systems.

[0003] In current data security posture analysis, traditional methods rely on static rules and localized data monitoring, making it difficult to capture dynamic changes and potential threats in database access traffic in real time and comprehensively. Faced with complex and ever-changing cyberattack methods, such as new ransomware, targeted zero-day vulnerability attacks, and unauthorized operations by internal personnel, existing methods cannot detect anomalies in a timely manner, resulting in serious lags in security protection and making it difficult to guarantee the integrity and confidentiality of data assets. Therefore, there is an urgent need for a data security posture analysis system and methodology that can, through in-depth analysis of historical and real-time network traffic data, proactively detect risks and achieve precise control and efficient protection of the data security posture. Summary of the Invention

[0004] The purpose of this invention is to provide a data security situation analysis system and method based on artificial intelligence to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a data security situation analysis method based on artificial intelligence, the data security situation analysis method comprising the following steps:

[0006] Step S1: Set the network traffic monitoring sliding window and network traffic monitoring period, and based on the network traffic monitoring period, obtain network traffic data from multiple historical access databases. After feature extraction of the obtained network traffic data, analyze it to obtain the comprehensive characteristics of the network traffic data. Obtain the feature data of the network traffic data in the current network traffic monitoring sliding window, archive and store it to build a data security situation analysis set.

[0007] Step S1-1: Based on the network traffic monitoring cycle, obtain network traffic data for accessing the database through a network packet capture tool. The network traffic data represents the network communication data transmitted between the client and the database. Specifically, the network communication data is a structured message encapsulated based on a database-specific protocol, which includes database operation instructions sent by the client and result set data returned by the server.

[0008] Steps S1-2: Obtain network traffic data from multiple historical access databases; process the obtained network traffic data using traffic analysis tools to obtain basic statistical characteristics; process the obtained network traffic data using time series analysis tools to obtain access behavior characteristics; parse the obtained network traffic data using deep packet inspection tools to obtain load characteristics; and mine the obtained network traffic data using graph convolutional networks to obtain correlation characteristics.

[0009] Traffic analysis tools include, but are not limited to, Wireshark and Ntopng; timing analysis tools include, but are not limited to, ELKStack and Prophet; deep packet inspection tools include, but are not limited to, Snort and Suricata.

[0010] Steps S1-3: Normalize the features of the obtained network traffic data and construct a feature fusion model to map basic statistical features, access behavior features, load features, and correlation features to a unified feature space, forming a multi-dimensional feature vector set; calculate the weight values ​​of each dimension feature in the multi-dimensional feature vector set through a feature importance evaluation mechanism; multiply the calculated weight values ​​with the corresponding dimension feature vectors to obtain weighted dimension feature vectors; and then use a feature space orthogonal transformation algorithm to compress the dimensions of the multi-dimensional feature vector set to generate comprehensive features of the network traffic data.

[0011] The formula for calculating the dimensional feature vector is as follows:

[0012] V w (i) = u(i) × V(i);

[0013] In the formula, V w (i) represents the weighted feature vector of the i-th dimension; u(i) represents the weight value of the feature of the i-th dimension; V(i) represents the original feature vector of the i-th dimension;

[0014] Step S1-4: Obtain network traffic data accessing the database in the current network traffic monitoring sliding window using a network packet capture tool. Process the data in step S1-2 to obtain the feature data of the network traffic data in the current network traffic monitoring sliding window. Select the timestamp data of the network traffic data accessing the database as the first-level index, select the session ID of the network traffic data accessing the database as the second-level index, and select the feature data of the network traffic data in the current network traffic monitoring sliding window as the value to perform a data security posture analysis set.

[0015] By storing the feature data of network traffic data in the current network traffic monitoring sliding window using timestamps as the primary index and session IDs as the secondary index, the constructed data security situation analysis set can realize the rapid location and correlation query of feature data, providing structured, traceable and accurate data support for data security situation analysis, and effectively improving analysis efficiency and accuracy.

[0016] Step S2: Traverse and read the feature data in the data security situation analysis set, and analyze it in combination with the comprehensive features of network traffic data to obtain the data security situation curve in the current network traffic monitoring sliding window;

[0017] Step S2-1: Extract the feature data of the current network traffic monitoring sliding window from the data security situation analysis set. Simultaneously with step S1-3, process the feature data of the current network traffic monitoring sliding window to construct a feature vector, denoted as the real-time feature. Call the comprehensive feature of the network traffic data, calculate the Mahalanobis distance between the current feature and the comprehensive feature, and use the calculated Mahalanobis distance of the comprehensive feature as the deviation value of the current network traffic data to obtain the outlier value of the current network traffic data.

[0018] The formula for calculating the Mahalanobis distance based on comprehensive features is as follows:

[0019] ;

[0020] In the formula, D M The distance is represented by the Mahalanobis distance, which is the outlier of the current network traffic data; X represents the real-time feature vector of the current network traffic monitoring sliding window; h represents the comprehensive feature vector of the network traffic data. It is represented as the inverse matrix of the covariance matrix; T represents the transpose operation of the eigenvector, which means to interchange the rows and columns of the matrix, that is, the element located in the i-th row and j-th column of the original matrix is ​​located in the j-th row and i-th column of the transposed matrix;

[0021] Step S2-2: Select the timestamp data of the current network traffic data as the horizontal axis to construct the x-axis, and select the outlier values ​​of the current network traffic data as the vertical axis to construct the y-axis. Based on the constructed x-axis and y-axis, obtain the data security status curve in the current network traffic monitoring sliding window.

[0022] By extracting the feature data of the current network traffic monitoring sliding window to construct real-time features, calculating the Mahalanobis distance between the features and the comprehensive features to obtain the outlier value, and then constructing a data security situation curve with the timestamp as the x-axis and the outlier value as the y-axis, it can intuitively present the time distribution and degree of network traffic anomalies within the current window, providing a clear and quantitative visualization basis for data security situation analysis, and improving the intuitiveness and efficiency of anomaly identification.

[0023] Step S3: Based on the data security status curve in the current network traffic monitoring sliding window, the data security status of the next network traffic monitoring cycle in the current network traffic monitoring sliding window is predicted by analyzing the time series prediction model. This prediction is denoted as the predicted data security status.

[0024] Step S3-1: Sample the data security status curve in the current network traffic monitoring sliding window, and extract the outliers corresponding to each timestamp in the curve to construct a time series dataset;

[0025] Step S3-2: Input the time series data into the time series prediction model for analysis, and output the outlier prediction value for the next network traffic monitoring period. Combine the timestamp information of the next period to generate the predicted data security situation. Select the timestamp as the horizontal axis and the outlier prediction value as the vertical axis to form a prediction curve segment that is consistent with the trend of the current data security situation curve. This gives the data security situation for the next network traffic monitoring period in the current network traffic monitoring sliding window, and is recorded as the predicted data security situation.

[0026] The time series forecasting model uses the following formula for forecasting calculations:

[0027] ;

[0028] In the formula, N T+1 N represents the outlier prediction value for forecasting the data security posture in the next network traffic monitoring cycle; T-i+1 This represents the outlier value from the end time T of the current network traffic monitoring period, tracing back to the i-th historical network traffic monitoring period; c represents the constant term, specifically the long-term average of the time series; p represents the autoregressive order; q represents the moving average order; A i Represented as autoregressive coefficient; B j Represented as the moving average coefficient; z T+1 This represents the random error at time T+1, the end point of the current network traffic monitoring cycle; T-j+1 This represents the prediction error at time T-j+1, the end point of the current network traffic monitoring cycle.

[0029] By sampling the current sliding window data security situation curve to construct a time series dataset, and smoothing it using the moving average method, the dataset is input into a time series prediction model to obtain the predicted outlier values ​​for the next period. Combined with the timestamp, a prediction curve segment consistent with the current curve trend is generated, forming a predicted data security situation. This allows for early perception of subsequent changes in the data security situation, providing a forward-looking basis for proactive defense and improving the predictability and timeliness of data security protection.

[0030] Step S4: Create a data security interaction cache area. Based on the predicted data security situation in the current network traffic monitoring cycle, extract outliers of comprehensive features. Analyze the data security situation based on the outliers of comprehensive features in multiple historical network traffic monitoring cycles. Pre-cache the data security interaction cache area based on the analysis results.

[0031] Step S4-1: Create a data security interaction cache and initialize the data security interaction cache; extract the outlier prediction value for the next network traffic monitoring cycle from the predicted data security situation; based on the feature processing logic of step S1-3, reverse analyze the network traffic feature data corresponding to the outlier prediction value; the network traffic feature data obtained by reverse analysis includes basic statistical features, access behavior features, load features and correlation features.

[0032] Step S4-2: Obtain the data security status of multiple historical network traffic monitoring periods. Based on the feature processing logic of step S1-3, extract the network traffic feature data corresponding to each historical period, including basic statistical features, access behavior features, load features and correlation features. Archive and store the data using the storage method of step S1-4 to obtain a data pre-cached reference set.

[0033] Step S4-3: Use the network traffic feature data obtained by reverse parsing in step S4-1 to extract load features. Match the extracted load features with the load features of historical network traffic feature data in the data pre-caching reference set, filter out network traffic data with the same features, and record them as pre-cached network traffic data. Use a deep packet inspection tool to parse the database operation instructions and corresponding result set identifiers contained in the load features of the pre-cached network traffic data to obtain the target data identifier for pre-caching.

[0034] Step S4-4: Based on the target data identifier obtained in step S4-3, extract the corresponding result set data from the database, and write the extracted result set data into the corresponding storage unit of the data security interaction cache area after integrity verification to complete the data pre-caching; at the same time, set the data cleanup time, which is the end time of the next network traffic monitoring cycle. After the network traffic monitoring cycle ends, the cleanup mechanism will be automatically triggered to release cache resources.

[0035] By creating and initializing a data security interaction cache, outlier predictions are extracted from the predicted data security situation, and network traffic characteristic data is reverse-analyzed. This data is then matched with a historical data pre-cached reference set to filter pre-cached network traffic data. The database operation instructions and result set identifiers in the load characteristics are parsed to obtain the target data identifier. After extracting and verifying the corresponding result set data, it is written into the cache and a cleanup time is set. This allows for the early caching of potentially related data, improving the efficiency of data interaction response. At the same time, a timed cleanup mechanism avoids resource waste, ensuring the efficiency and rationality of data security interaction.

[0036] Step S5: Real-time characteristics of network traffic data in the data security interaction buffer are obtained, and outliers of the real-time characteristics are extracted. The outliers of the comprehensive characteristics extracted from the predicted data security situation are analyzed to monitor and warn of network traffic data in the network traffic monitoring period.

[0037] Step S5-1: Obtain the real-time characteristics of network traffic data in the data security interaction buffer in real time, and calculate the real-time outlier value through the processing logic of step S2-1; compare the real-time outlier value with the outlier prediction value in the predicted data security situation to obtain the real-time error value of the current network traffic monitoring cycle; extract the prediction error value of each network traffic monitoring cycle from the data security situation of multiple historical network traffic monitoring cycles, calculate the average value of the statistical prediction error value, and form an error benchmark.

[0038] The formula for calculating the error baseline is as follows:

[0039] ;

[0040] In the formula, Eavg represents the error baseline; n represents the number of historical network traffic data monitoring periods; Ek represents the prediction error value of the k-th network traffic data monitoring period, specifically the difference between the real-time outlier and the predicted outlier value.

[0041] Step S5-2: Compare the real-time error value with the error benchmark. When the real-time error value exceeds the error benchmark, issue an early warning signal. The early warning signal includes the timestamp of the current network traffic data, the session ID, and the database operation instruction. Add an early warning identifier to the pre-cached data in the data security interaction cache area and record it as early warning data to be verified.

[0042] Step S5-3: Lock the data to be verified for the early warning and restrict direct access of the data security interaction cache to the database; after the early warning signal processing is completed, clear the early warning flag of the verified data to be verified and update it to the database according to the preset asynchronous writing strategy.

[0043] The specific process of the early warning signal processing flow is as follows: Security management personnel manually review the abnormal characteristics of the data to be verified in the early warning to confirm whether it is a real security threat. If it is a false alarm, the early warning label is lifted; if it is a real threat, corresponding defensive measures are taken. Real-time characteristics of network traffic data in the data security interaction buffer are acquired and real-time anomaly values ​​are calculated. The real-time error value is compared with the anomaly prediction value in the predicted data security situation. An error benchmark is formed by combining the average value of the historical periodic prediction error values. When the real-time error value exceeds the benchmark, an early warning signal containing a timestamp, session ID, and database operation instructions is issued. The data to be verified in the early warning is locked to restrict direct access. After processing, the verified data is cleared of the label and updated to the database according to an asynchronous strategy. This can promptly detect network traffic anomalies and control risks, ensuring data interaction security and database stability.

[0044] Furthermore, an artificial intelligence-based data security situation analysis system is provided, which includes a traffic feature extraction module, a situation curve generation module, a situation prediction module, a data pre-caching module, and a monitoring and early warning module.

[0045] The traffic feature extraction module is used to set the network traffic monitoring sliding window and period, extract historical and current traffic features, and construct a data security situation analysis set; the situation curve generation module is used to read the feature data of the data security situation analysis set and generate a data security situation curve based on the comprehensive features; the situation prediction module is used to obtain the predicted data security situation for the next period based on the current data security situation curve and through a time series prediction model; the data pre-caching module is used to create a data security interactive cache area, extract target data based on the predicted data security situation, and complete the pre-caching; the monitoring and early warning module is used to analyze the error of the traffic data in the cache area in real time, trigger early warnings, and control the database writing of cached data;

[0046] The output of the flow feature extraction module is electrically connected to the input of the situation curve generation module; the output of the situation curve generation module is electrically connected to the input of the situation prediction module; the output of the situation prediction module is electrically connected to the input of the data pre-caching module; and the output of the data pre-caching module is electrically connected to the input of the monitoring and early warning module.

[0047] The traffic feature extraction module includes a historical traffic feature processing unit and a real-time traffic feature storage unit. The historical traffic feature processing unit is used to acquire network traffic data from historical access databases, extract features, and analyze them to obtain comprehensive features of the network traffic data. The real-time traffic feature storage unit is used to acquire feature data of network traffic data in the current network traffic monitoring sliding window, and store it by index to construct a data security situation analysis set.

[0048] The situation curve generation module includes a real-time outlier calculation unit and a curve construction unit; the real-time outlier calculation unit is used to extract the current sliding window feature data, construct real-time features, and calculate the Mahalanobis distance with the comprehensive features to obtain outliers; the curve construction unit is used to construct a data security situation curve of the current sliding window with the timestamp as the horizontal axis and the outlier value as the vertical axis.

[0049] The situation prediction module includes a time series data processing unit and an outlier prediction unit; the time series data processing unit is used to sample the current situation curve, extract outliers to construct a time series dataset; the outlier prediction unit is used to input the time series data into the prediction model, output the outlier prediction value for the next period, and map it to generate the predicted data security situation.

[0050] The data pre-caching module includes a cache initialization unit and a pre-caching execution unit; the cache initialization unit is used to create and initialize a data security interaction cache, and reverse-parse the network traffic feature data corresponding to the outlier prediction value; the pre-caching execution unit is used to match historical features to obtain the target data identifier, extract the result set data and write it into the cache, and set the cleanup time.

[0051] The monitoring and early warning module includes an error analysis unit and an early warning processing unit. The error analysis unit is used to calculate the real-time error between the real-time outlier and the predicted value, generate a historical error benchmark, and perform error comparison. The early warning processing unit is used to issue an early warning when the real-time error exceeds the benchmark, identify cached data, and control its asynchronous writing to the database.

[0052] Compared with the prior art, the beneficial effects of the present invention are:

[0053] 1. This invention sets a sliding window and period for network traffic monitoring, and combines network traffic analysis tools, time series analysis tools, deep packet inspection tools, and graph mining tools to extract basic statistical features, access behavior features, load features, and correlation features. These features are then normalized and fused using a feature fusion model to generate comprehensive features. Outliers are calculated using Mahalanobis distance, and a situational curve is constructed. This method achieves comprehensive capture and quantitative analysis of network traffic features, providing accurate multi-dimensional data support for data security situational awareness and improving the comprehensiveness and accuracy of anomaly identification.

[0054] 2. This invention analyzes the time-series data of outliers in the current window using a time-series prediction model, outputs predicted outlier values ​​for the next period, and generates a prediction curve. It also incorporates a historical data pre-caching reference set to achieve pre-caching of the data security interaction cache. This mechanism enables proactive perception of data security status and advance caching of potentially related data, improving data interaction response efficiency and proactive defense capabilities.

[0055] 3. This invention calculates real-time anomalies in traffic within the data security interaction buffer, compares these anomalies with predicted anomalies to obtain a real-time error value, and uses historical error benchmarks to determine whether to issue an alert. The alert data is then locked and updated asynchronously. This process enables real-time monitoring and risk control of abnormal traffic, ensuring the security and stability of database interactions and reducing the risk of data leakage and attacks. Attached Figure Description

[0056] Figure 1 This is a flowchart illustrating a data security situation analysis method based on artificial intelligence according to the present invention.

[0057] Figure 2 This is a schematic diagram of the structure of a data security situation analysis system based on artificial intelligence according to the present invention. Detailed Implementation

[0058] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0059] Example 1: As Figure 1 As shown, this invention provides a technical solution: a data security situation analysis method based on artificial intelligence. The data security situation analysis method includes the following steps:

[0060] Step S1: Set the network traffic monitoring sliding window and network traffic monitoring period, and based on the network traffic monitoring period, obtain network traffic data from multiple historical access databases. After feature extraction of the obtained network traffic data, analyze it to obtain the comprehensive characteristics of the network traffic data. Obtain the feature data of the network traffic data in the current network traffic monitoring sliding window, archive and store it to build a data security situation analysis set.

[0061] Step S1-1: Based on the network traffic monitoring cycle, obtain network traffic data for accessing the database through a network packet capture tool. The network traffic data represents the network communication data transmitted between the client and the database. Specifically, the network communication data is a structured message encapsulated based on a database-specific protocol, which includes database operation instructions sent by the client and result set data returned by the server.

[0062] Steps S1-2: Obtain network traffic data from multiple historical access databases; process the obtained network traffic data using traffic analysis tools to obtain basic statistical characteristics; process the obtained network traffic data using time series analysis tools to obtain access behavior characteristics; parse the obtained network traffic data using deep packet inspection tools to obtain load characteristics; and mine the obtained network traffic data using graph convolutional networks to obtain correlation characteristics.

[0063] Steps S1-3: Normalize the features of the obtained network traffic data and construct a feature fusion model to map basic statistical features, access behavior features, load features, and correlation features to a unified feature space, forming a multi-dimensional feature vector set; calculate the weight values ​​of each dimension feature in the multi-dimensional feature vector set through a feature importance evaluation mechanism; multiply the calculated weight values ​​with the corresponding dimension feature vectors to obtain weighted dimension feature vectors; and then use a feature space orthogonal transformation algorithm to compress the dimensions of the multi-dimensional feature vector set to generate comprehensive features of the network traffic data.

[0064] Step S1-4: Obtain network traffic data accessing the database in the current network traffic monitoring sliding window using a network packet capture tool. Process the data in step S1-2 to obtain the feature data of the network traffic data in the current network traffic monitoring sliding window. Select the timestamp data of the network traffic data accessing the database as the first-level index, select the session ID of the network traffic data accessing the database as the second-level index, and select the feature data of the network traffic data in the current network traffic monitoring sliding window as the value to perform a data security posture analysis set.

[0065] In specific implementation, step S1 obtains historical database access traffic data by setting a sliding window and monitoring period, captures network packets with Wireshark and extracts basic statistical features such as traffic transmission rate and number of packets, aggregates and analyzes time-series data using ELKStack to obtain access behavior features such as access frequency and time period distribution, performs deep parsing of data packets with Snort to obtain load features such as SQL command type and parameter length, and models the interaction relationship between client and database nodes using graph convolutional networks to obtain correlation features. After processing, comprehensive features are generated and an analysis set is constructed. It is important to note that the tool configuration should be adapted to the database-specific protocol to ensure the completeness of feature extraction.

[0066] Step S2: Traverse and read the feature data in the data security situation analysis set, and analyze it in combination with the comprehensive features of network traffic data to obtain the data security situation curve in the current network traffic monitoring sliding window;

[0067] Step S2-1: Extract the feature data of the current network traffic monitoring sliding window from the data security situation analysis set. Simultaneously with step S1-3, process the feature data of the current network traffic monitoring sliding window to construct a feature vector, denoted as the real-time feature. Call the comprehensive feature of the network traffic data, calculate the Mahalanobis distance between the current feature and the comprehensive feature, and use the calculated Mahalanobis distance of the comprehensive feature as the deviation value of the current network traffic data to obtain the outlier value of the current network traffic data.

[0068] Step S2-2: Select the timestamp data of the current network traffic data as the horizontal axis to construct the x-axis, and select the outlier values ​​of the current network traffic data as the vertical axis to construct the y-axis. Based on the constructed x-axis and y-axis, obtain the data security status curve in the current network traffic monitoring sliding window.

[0069] In practical implementation, the current window feature data is mapped to the same unified feature space as the comprehensive features through a feature fusion model. The deviation between the real-time feature vector and the comprehensive feature vector is calculated using the Mahalanobis distance formula. This distance reflects the relative position of the sample in the multi-dimensional space. When the real-time feature vector of a session deviates from the center of the historical distribution, the distance value increases significantly. The distance values ​​at each time point are used as outliers, and a curve is plotted with the timestamp as the horizontal axis and the outliers as the vertical axis. It is necessary to ensure that the real-time features and comprehensive features maintain strict consistency in feature selection, normalization processing, and dimensionality reduction algorithms to avoid deviations in outlier calculations due to inconsistencies in the feature space.

[0070] Step S3: Based on the data security status curve in the current network traffic monitoring sliding window, the data security status of the next network traffic monitoring cycle in the current network traffic monitoring sliding window is predicted by analyzing the time series prediction model. This prediction is denoted as the predicted data security status.

[0071] Step S3-1: Sample the data security status curve in the current network traffic monitoring sliding window, and extract the outliers corresponding to each timestamp in the curve to construct a time series dataset;

[0072] Step S3-2: Input the time series data into the time series prediction model for analysis, and output the outlier prediction value for the next network traffic monitoring period. Combine the timestamp information of the next period to generate the predicted data security situation. Select the timestamp as the horizontal axis and the outlier prediction value as the vertical axis to form a prediction curve segment that is consistent with the trend of the current data security situation curve. This gives the data security situation for the next network traffic monitoring period in the current network traffic monitoring sliding window, and is recorded as the predicted data security situation.

[0073] In practice, the ARIMA time series forecasting model is used to analyze the outlier sequence in the trend curve. The autoregressive term captures the periodic variation of historical outliers, the moving average term handles random fluctuations, and the differencing operation eliminates the non-stationarity of the sequence. The model predicts the outlier at the next time point based on the outliers at n historical time points, generating a prediction curve segment that is logically consistent with the current curve trend. The model is trained using historical data from multiple network traffic monitoring periods. The optimal model parameters are determined using the AIC / BIC information criteria, and a fixed calibration period is set to recalibrate the model to adapt to the dynamic changes in network traffic patterns.

[0074] Step S4: Create a data security interaction cache area. Based on the predicted data security situation in the current network traffic monitoring cycle, extract outliers of comprehensive features. Analyze the data security situation based on the outliers of comprehensive features in multiple historical network traffic monitoring cycles. Pre-cache the data security interaction cache area based on the analysis results.

[0075] Step S4-1: Create a data security interaction cache and initialize the data security interaction cache; extract the outlier prediction value for the next network traffic monitoring cycle from the predicted data security situation; based on the feature processing logic of step S1-3, reverse analyze the network traffic feature data corresponding to the outlier prediction value; the network traffic feature data obtained by reverse analysis includes basic statistical features, access behavior features, load features and correlation features.

[0076] Step S4-2: Obtain the data security status of multiple historical network traffic monitoring periods. Based on the feature processing logic of step S1-3, extract the network traffic feature data corresponding to each historical period, including basic statistical features, access behavior features, load features and correlation features. Archive and store the data using the storage method of step S1-4 to obtain a data pre-cached reference set.

[0077] Step S4-3: Use the network traffic feature data obtained by reverse parsing in step S4-1 to extract load features. Match the extracted load features with the load features of historical network traffic feature data in the data pre-caching reference set, filter out network traffic data with the same features, and record them as pre-cached network traffic data. Use a deep packet inspection tool to parse the database operation instructions and corresponding result set identifiers contained in the load features of the pre-cached network traffic data to obtain the target data identifier for pre-caching.

[0078] Step S4-4: Based on the target data identifier obtained in step S4-3, extract the corresponding result set data from the database, and write the extracted result set data into the corresponding storage unit of the data security interaction cache area after integrity verification to complete the data pre-caching; at the same time, set the data cleanup time, which is the end time of the next network traffic monitoring cycle. After the network traffic monitoring cycle ends, the cleanup mechanism will be automatically triggered to release cache resources.

[0079] In practice, the original feature vector corresponding to the outlier is reverse-analyzed through the feature mapping matrix to extract the load features, such as SQL statement structure or operation type. These features are then matched with the load features in the historical pre-cached reference set using cosine similarity. When the similarity exceeds a set threshold, the data is filtered as pre-cached network traffic data. The database operation instructions and result set identifiers are parsed using deep packet inspection tools. The relevant data blocks are quickly located and extracted using the database index. After CRC32 verification, the data is written to the cache. The TTL is set as the termination time of the next monitoring cycle. The LRU cache eviction policy ensures the rational utilization of resources.

[0080] Step S5: Real-time characteristics of network traffic data in the data security interaction buffer are obtained, and outliers of the real-time characteristics are extracted. The outliers of the comprehensive characteristics extracted from the predicted data security situation are analyzed to monitor and warn of network traffic data in the network traffic monitoring period.

[0081] Step S5-1: Obtain the real-time characteristics of network traffic data in the data security interaction buffer in real time, and calculate the real-time outlier value through the processing logic of step S2-1; compare the real-time outlier value with the outlier prediction value in the predicted data security situation to obtain the real-time error value of the current network traffic monitoring cycle; extract the prediction error value of each network traffic monitoring cycle from the data security situation of multiple historical network traffic monitoring cycles, calculate the average value of the statistical prediction error value, and form an error benchmark.

[0082] Step S5-2: Compare the real-time error value with the error benchmark. When the real-time error value exceeds the error benchmark, issue an early warning signal. The early warning signal includes the timestamp of the current network traffic data, the session ID, and the database operation instruction. Add an early warning identifier to the pre-cached data in the data security interaction cache area and record it as early warning data to be verified.

[0083] Step S5-3: Lock the data to be verified for the early warning and restrict direct access of the data security interaction cache to the database; after the early warning signal processing is completed, clear the early warning flag of the verified data to be verified and update it to the database according to the preset asynchronous writing strategy.

[0084] In practice, the real-time characteristics of the buffer traffic are acquired, and real-time outliers are obtained according to the calculation logic of step S2. The real-time error value is obtained by comparing it point by point with the predicted outlier. At the same time, the predicted error value of the last n periods is extracted from historical data, and its moving average is calculated as the error benchmark. When the real-time error value exceeds the error benchmark, the early warning mechanism is triggered. The system automatically adds a write protection lock to the cached data associated with the early warning, restricting its direct access to the database. After security audit confirmation, the verified data is updated to the database using an asynchronous batch write strategy. At the same time, the calculation window of the error benchmark is dynamically adjusted to adapt to normal system fluctuations.

[0085] Example 2, as Figure 2 As shown, the present invention provides a data security situation analysis system based on artificial intelligence. The data security situation analysis system includes a traffic feature extraction module, a situation curve generation module, a situation prediction module, a data pre-caching module, and a monitoring and early warning module.

[0086] The traffic feature extraction module is used to set the network traffic monitoring sliding window and period, extract historical and current traffic features, and construct a data security situation analysis set; the situation curve generation module is used to read the feature data of the data security situation analysis set and generate a data security situation curve based on the comprehensive features; the situation prediction module is used to obtain the predicted data security situation for the next period based on the current data security situation curve and through a time series prediction model; the data pre-caching module is used to create a data security interactive cache area, extract target data based on the predicted data security situation, and complete the pre-caching; the monitoring and early warning module is used to analyze the error of the traffic data in the cache area in real time, trigger early warnings, and control the database writing of cached data;

[0087] The output of the flow feature extraction module is electrically connected to the input of the situation curve generation module; the output of the situation curve generation module is electrically connected to the input of the situation prediction module; the output of the situation prediction module is electrically connected to the input of the data pre-caching module; and the output of the data pre-caching module is electrically connected to the input of the monitoring and early warning module.

[0088] The traffic feature extraction module includes a historical traffic feature processing unit and a real-time traffic feature storage unit. The historical traffic feature processing unit is used to acquire network traffic data from historical access databases, extract features, and analyze them to obtain comprehensive features of the network traffic data. The real-time traffic feature storage unit is used to acquire feature data of network traffic data in the current network traffic monitoring sliding window, and store it by index to construct a data security situation analysis set.

[0089] The situation curve generation module includes a real-time outlier calculation unit and a curve construction unit; the real-time outlier calculation unit is used to extract the current sliding window feature data, construct real-time features, and calculate the Mahalanobis distance with the comprehensive features to obtain outliers; the curve construction unit is used to construct a data security situation curve of the current sliding window with the timestamp as the horizontal axis and the outlier value as the vertical axis.

[0090] The situation prediction module includes a time series data processing unit and an outlier prediction unit; the time series data processing unit is used to sample the current situation curve, extract outliers to construct a time series dataset; the outlier prediction unit is used to input the time series data into the prediction model, output the outlier prediction value for the next period, and map it to generate the predicted data security situation.

[0091] The data pre-caching module includes a cache initialization unit and a pre-caching execution unit; the cache initialization unit is used to create and initialize a data security interaction cache, and reverse-parse the network traffic feature data corresponding to the outlier prediction value; the pre-caching execution unit is used to match historical features to obtain the target data identifier, extract the result set data and write it into the cache, and set the cleanup time.

[0092] The monitoring and early warning module includes an error analysis unit and an early warning processing unit. The error analysis unit is used to calculate the real-time error between the real-time outlier and the predicted value, generate a historical error benchmark, and perform error comparison. The early warning processing unit is used to issue an early warning when the real-time error exceeds the benchmark, identify cached data, and control its asynchronous writing to the database.

[0093] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. An artificial intelligence-based data security posture analysis method, characterized in that: The data security situation analysis method comprises the following steps: Step S1, setting a network traffic monitoring sliding window and a network traffic monitoring period, and based on the network traffic monitoring period, obtaining historical network traffic data of accessing a database, performing feature extraction on the obtained network traffic data, and analyzing to obtain comprehensive features of the network traffic data; obtaining feature data of network traffic data in the current network traffic monitoring sliding window, archiving and storing to construct a data security situation analysis set; Step S2, traversing and reading the feature data in the data security situation analysis set, and analyzing in combination with the comprehensive features of the network traffic data to obtain a data security situation curve graph in the current network traffic monitoring sliding window; Step S3, according to the data security situation curve graph in the current network traffic monitoring sliding window, analyzing by a time series prediction model to predict a data security situation of a next network traffic monitoring period in the current network traffic monitoring sliding window, denoted as a predicted data security situation; Step S4, creating a data security interaction cache area, extracting an abnormal value of the comprehensive features according to the predicted data security situation in the current network traffic monitoring period, analyzing the abnormal value of the comprehensive features based on the data security situation of the historical multiple network traffic monitoring periods, and pre-caching the data security interaction cache area according to the analysis result; Step S5, obtaining real-time features of network traffic data in the data security interaction cache area in real time, extracting an abnormal value of the real-time features, analyzing in combination with the abnormal value of the comprehensive features extracted from the predicted data security situation, and monitoring and warning the network traffic data in the network traffic monitoring period.

2. The method of claim 1, wherein: The specific steps of step S1 are as follows: Step S1-1, based on the network traffic monitoring period, obtaining network traffic data of accessing a database through a network packet capturing tool, wherein the network traffic data represents network communication data transmitted between a client and a database, and the network communication data is specifically a structured packet encapsulated based on a database special protocol, containing database operation instructions sent by the client and result set data returned by the server; Step S1-2, obtaining historical network traffic data of accessing a database, processing the obtained network traffic data by a traffic analysis tool to obtain basic statistical features; processing the obtained network traffic data by a time series analysis tool to obtain access behavior features; using a deep packet inspection tool to analyze the obtained network traffic data to obtain load features; using a graph convolution network to mine the obtained network traffic data to obtain correlation features; Step S1-3, normalize the features of the obtained network traffic data, and construct a feature fusion model to map the basic statistical features, access behavior features, load features and correlation features to a unified feature space to form a multi-dimensional feature vector set; the weight values of each dimension feature in the multi-dimensional feature vector set are calculated through a feature importance evaluation mechanism; the calculated weight values are multiplied with the corresponding dimension feature vectors to obtain weighted dimension feature vectors, and then a feature space orthogonal transformation algorithm is used to compress the dimensions of the multi-dimensional feature vector set to generate comprehensive features of the network traffic data; Step S1-4, obtain the network traffic data of the access database in the current network traffic monitoring sliding window through a network packet capture tool, process the feature data of the network traffic data in the current network traffic monitoring sliding window through step S1-2, select the timestamp data of the network traffic data accessing the database as the first index, select the session ID of the network traffic data accessing the database as the second index, and select the feature data of the network traffic data in the current network traffic monitoring sliding window as the value, and perform storage data security posture analysis set.

3. The method of claim 2, wherein: The specific steps of step S2 are as follows: Step S2-1, extract the feature data of the current network traffic monitoring sliding window in the data security posture analysis set, and simultaneously process the feature data of the current network traffic monitoring sliding window to construct a feature vector, denoted as real-time feature, according to step S1-3; Call the comprehensive features of the network traffic data, calculate the Mahalanobis distance between the current features and the comprehensive features, and use the calculated Mahalanobis distance of the comprehensive features as the deviation value of the current network traffic data to obtain the abnormal value of the current network traffic data; Step S2-2, select the timestamp data of the current network traffic data as the horizontal coordinate to construct the x-axis, select the abnormal value of the current network traffic data as the vertical coordinate to construct the y-axis, and obtain the data security posture curve in the current network traffic monitoring sliding window according to the constructed x-axis and y-axis.

4. The method of claim 3, wherein the method further comprises: The specific steps of step S3 are as follows: Step S3-1, sample the data security posture curve in the current network traffic monitoring sliding window, and extract the abnormal value corresponding to each timestamp in the curve to construct a time series data set; Step S3-2, input the time series data into a time series prediction model for analysis, output the abnormal value prediction value of the next network traffic monitoring period, combine the timestamp information of the next period, map to generate a predicted data security posture, select the timestamp as the horizontal coordinate, select the abnormal value prediction value as the vertical coordinate, form a prediction curve segment consistent with the trend of the current data security posture curve, and obtain the data security posture of the next network traffic monitoring period in the current network traffic monitoring sliding window, denoted as predicted data security posture.

5. The method of claim 4, wherein: The specific steps of step S4 are as follows: Step S4-1, create a data security interaction cache area and initialize the data security interaction cache area; extract an abnormal value prediction value of a next network traffic monitoring period from the predicted data security situation, inversely analyze network traffic feature data corresponding to the abnormal value prediction value based on the feature processing logic of step S1-3, and the inversely analyzed network traffic feature data includes basic statistical features, access behavior features, load features and correlation features; Step S4-2, obtain data security situations of historical multiple network traffic monitoring periods, extract corresponding network traffic feature data of each period according to the feature processing logic of step S1-3, including basic statistical features, access behavior features, load features and correlation features, and archive storage is performed on the network traffic feature data to obtain a data pre-cache reference set through the storage mode of step S1-4.

6. The method of claim 5, wherein: In step S4, it further includes: Step S4-3, load feature extraction is performed on the network traffic feature data inversely analyzed in step S4-1, matching is performed on the extracted load features and load features of historical network traffic feature data in the data pre-cache reference set, network traffic data with the same features are screened out and recorded as pre-cache network traffic data, database operation instructions and corresponding result set identifiers included in the load features are analyzed in the pre-cache network traffic data through a deep packet inspection tool, and target data identifiers of the pre-cache are obtained; Step S4-4, according to the target data identifiers analyzed in step S4-3, corresponding result set data is extracted from the database, the extracted result set data is written into a corresponding storage unit of the data security interaction cache area after integrity verification, and data pre-caching is completed; meanwhile, a data cleaning time is set, the data cleaning time is a termination time point of a next network traffic monitoring period, and a cleaning mechanism is triggered to release cache resources automatically after the network traffic monitoring period ends.

7. The method of claim 6, wherein: The specific steps of step S5 are as follows: Step S5-1, real-time features of network traffic data in the data security interaction cache area are obtained in real time, real-time abnormal values are calculated through the processing logic of step S2-1; the real-time abnormal values are compared with the abnormal value prediction values in the predicted data security situation, real-time error values of a current network traffic monitoring period are obtained; prediction error values of each network traffic monitoring period are extracted from the data security situations of the historical multiple network traffic monitoring periods, an average value of the statistical prediction error values is calculated, and an error benchmark is formed; Step S5-2, the real-time error values are compared with the error benchmark, a warning signal is sent when the real-time error values exceed the error benchmark, the warning signal includes a timestamp, a session ID and a database operation instruction of current network traffic data, and pre-warning identifiers are added to pre-cache data in the data security interaction cache area, recorded as pre-warning to be verified data; Step S5-3, the pre-warning to be verified data is locked and controlled, direct access of the data security interaction cache area to the database is limited; after the pre-warning signal processing flow is completed, the pre-warning to be verified data that passes the verification is cleared of the pre-warning identifiers, and is updated to the database according to a preset asynchronous writing strategy.

8. An artificial intelligence-based data security posture analysis system applied to the artificial intelligence-based data security posture analysis method of any one of claims 1-7, characterized in that: The data security situation analysis system comprises a traffic feature extraction module, a situation curve generation module, a situation prediction module, a data pre-cache module and a monitoring and early warning module. The traffic feature extraction module is configured to set a network traffic monitoring sliding window and a period, extract historical and current traffic features and construct a data security situation analysis set; the situation curve generation module is configured to read feature data of the data security situation analysis set, combine comprehensive features to generate a data security situation curve graph; the situation prediction module is configured to obtain a predicted data security situation of a next period based on a current data security situation curve graph through a time series prediction model; and the data pre-cache module is configured to create a data security interaction cache area, extract target data based on the predicted data security situation and complete pre-caching. The monitoring and early warning module is configured to analyze errors of cache area traffic data in real time, trigger early warning and control database writing of cache data. An output end of the traffic feature extraction module is electrically connected to an input end of the situation curve generation module; an output end of the situation curve generation module is electrically connected to an input end of the situation prediction module; an output end of the situation prediction module is electrically connected to an input end of the data pre-cache module; and an output end of the data pre-cache module is electrically connected to an input end of the monitoring and early warning module.

9. The data security situation analysis system based on artificial intelligence according to claim 8, characterized in that: The traffic feature extraction module comprises a historical traffic feature processing unit and a real-time traffic feature storage unit; the historical traffic feature processing unit is configured to obtain network traffic data of a historical access database, extract features and analyze to obtain comprehensive features of the network traffic data; and the real-time traffic feature storage unit is configured to obtain feature data of network traffic data in a current network traffic monitoring sliding window, store and construct a data security situation analysis set according to indexes; The situation curve generation module comprises a real-time abnormal value calculation unit and a curve construction unit; the real-time abnormal value calculation unit is configured to extract current sliding window feature data, construct real-time features and calculate Mahalanobis distances with the comprehensive features to obtain abnormal values; and the curve construction unit is configured to construct a data security situation curve graph of the current sliding window with time stamps as horizontal coordinates and abnormal values as vertical coordinates; The situation prediction module comprises a time series data processing unit and an abnormal value prediction unit; the time series data processing unit is configured to sample a current situation curve graph, extract abnormal values and construct a time series data set; and the abnormal value prediction unit is configured to input the time series data into a prediction model, output abnormal value prediction values of a next period and map to generate a predicted data security situation.

10. The data security situation analysis system based on artificial intelligence according to claim 8, characterized in that: The data pre-cache module comprises a cache area initialization unit and a pre-cache execution unit; the cache area initialization unit is configured to create and initialize a data security interaction cache area, and inversely analyze network traffic feature data corresponding to abnormal value prediction values; The pre-cache execution unit is configured to match historical features to obtain target data identifiers, extract result set data to write into the cache area and set a cleaning time. The monitoring and early warning module comprises an error analysis unit and an early warning processing unit; the error analysis unit is used for calculating real-time errors of real-time abnormal values and predicted values, generating a historical error benchmark and performing error comparison; the early warning processing unit is used for issuing an early warning when the real-time error exceeds the benchmark, identifying cache data and controlling asynchronous writing of the cache data into a database.

Images