Network security enhancement method and system based on artificial intelligence

Abstract

The invention relates to the field of network security, in particular to a network security enhancement method and system based on artificial intelligence, and the method comprises the following steps: security data fusion, attack path modeling, node risk identification, anomaly detection model construction and dynamic response decision. A learnable disturbance sensitive factor is introduced, a node relation output by a graph attention mechanism is dynamically adjusted, and the expression ability of a graph structure and the accuracy of attack path recognition are improved; according to the method, modeling is performed through the graph neural network after structure enhancement, attack path information with higher noise immunity is generated, and cross-stage and multi-path attack chain high-precision reasoning is realized in combination with a feature alignment and path fusion technology; the system comprises a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model construction module and a dynamic response decision module.

Description

Technical Field

[0001] The present invention relates to the field of network security, and specifically to an artificial intelligence-based network security enhancement method and system. Background Art

[0002] With the rapid development of the Internet and information infrastructure, network security threats are becoming more frequent, intelligent, and covert. Graph neural networks (GNNs) are gradually being introduced into the field of network security due to their advantages in processing graph-structured data. However, existing GNN-based security analysis methods still have the following problems in practical applications: (1) Insufficient fusion of multi-source heterogeneous data. Existing solutions are unable to simultaneously utilize the complementary characteristics of multiple views such as network traffic, host logs, and alarm information, resulting in low accuracy in attack chain reconstruction. (2) Graph structure learning lacks dynamic optimization. Most methods directly perform feature propagation after constructing the graph structure, ignoring the importance of dynamically adjusting the graph structure according to the semantic relationships between nodes during training, which easily introduces noise relationships. (3) The attack path reasoning is not robust enough. In the face of noisy data or missing edges, the attack path identification results are easily degraded, resulting in the omission of high-risk nodes or key assets. Summary of the Invention

[0003] In response to the above situation, in order to overcome the defects of the prior art, the present invention provides an artificial intelligence-based network security enhancement method and system. To address the problem of insufficient fusion of multi-source heterogeneous data, the present invention introduces multiple independent security views such as network traffic view, host log view, and alarm information view, and combines similarity calculation with the KNN method to construct an adjacency relationship matrix. The adjacency matrix is ​​fused with the feature matrix to generate a consistent attack graph, which significantly improves the ability to restore cross-view attack chains. To address the problem of lack of dynamic optimization in graph structure learning, the present invention introduces a learnable perturbation-sensitive factor on the basis of the consistent attack graph, dynamically adjusts the node relationship output by the graph attention mechanism, realizes fine-grained optimization of the structure, reduces noise edge interference, and improves the expression ability of the graph structure and the accuracy of attack path identification. To address the problem of insufficient robustness of attack path reasoning, the present invention generates attack path information with stronger noise resistance through structurally enhanced graph neural network modeling, and combines feature alignment and path fusion technology to achieve high-precision reasoning of cross-stage and multi-path attack chains.

[0004] The technical solution adopted by the present invention is as follows: The network security enhancement method based on artificial intelligence provided by the present invention comprises the following steps: Step S1: Security data fusion: collect original security data from network traffic, terminal logs, user behavior, system calls and honeypot systems, introduce an adaptive weighted fusion strategy to obtain fused security data; Step S2: Attack path modeling: Based on the fused security data, an interaction graph between network nodes is constructed. Graph neural networks are used to model the attack path, capture the potential chain propagation path of the attack behavior, and generate a possible attack path map. Step S3: Node risk identification: Based on the attack path graph, the importance indicators of nodes in the attack path are analyzed, including betweenness centrality, neighborhood activity, and historical threat events. Combined with the node embedding representation output by the graph convolutional network, the risk of network nodes is scored and classified to identify high-risk nodes or key assets. Step S4: Anomaly detection model construction: Build an anomaly detection model based on a deep neural network, input the fused security data into the Transformer model, introduce an adversarial sample training mechanism, and identify hidden abnormal behaviors; Step S5: Dynamic response decision-making, building an attack state space model, and introducing a reinforcement learning algorithm to generate a response strategy for the current threat situation.

[0005] Furthermore, step S2 specifically includes the following steps: Step S21: Multi-view construction: Based on the fused security data, three independent security views are constructed, including a network traffic view, a host log view, and an alarm information view. Similarity calculation and KNN are used to construct an adjacency matrix, generating three graph structures corresponding to the three independent security views. Step S22: Attack chain learning: In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including nodes and edges of the attack graph. Step S23: Graph structure enhancement: Based on the consistent attack graph, an attention-guided structure optimization method is introduced to obtain attack path information; Step S24: Path fusion, feature alignment and fusion of attack path information to generate a fused attack path map.

[0006] Furthermore, step S22 specifically includes the following steps: Step S221: Local view modeling. For each independent security view, nodes represent network entities and edges represent relationships between entities. The matrix characteristics of an independent security view are , the adjacency matrix is , use the GCN model to train each independent security view separately to obtain the node interaction representation. The formula used is as follows: ; in, For the Node interaction representation of independent security views, represents a natural number, Indicates the number of nodes in the independent security view, Represents the initial feature dimension of the node; Step S222: Adjacency matrix fusion, introducing a structural fusion operation, jointly modeling the adjacency structures under independent security views, and constructing the adjacency matrix of the consistent attack graph. The formula used is as follows: ; ; in, The first The structural weight of the independent security view, is the adjacency matrix of the consistency attack graph, is the total number of independent security views; Step S223: Feature matrix fusion: perform attention-weighted combination on the node features of the independent security views to generate a feature matrix of the consistent attack graph. The formula used is as follows:

[0007] in, represents the input feature matrix of the consistency attack graph, Indicates the Feature fusion weights of independent security views; Step S224: Generate a consistent attack graph. Input the adjacency matrix and feature matrix of the consistent attack graph into the graph neural network model to generate a consistent attack path graph. The formula used is as follows: ; in, is the consistency attack graph.

[0008] Furthermore, step S23 specifically includes the following steps: Step S231: Initialize the graph attention weight. Take the adjacency matrix and feature matrix of the consistent attack graph as input and introduce the graph attention mechanism to calculate the dynamic aggregation weight between nodes. The formula used is as follows: ; ; in, and is the node of the attack graph, and For nodes and nodes The eigenvector of is the linear transformation weight matrix of the GCN model, is the parameter vector in the attention mechanism, represents the transpose of the attention vector matrix, For nodes and nodes The unnormalized attention relevance score of For nodes For Node The normalized attention weight of is the set of neighbor nodes of the node.

[0009] Step S232: Introduce the structural disturbance sensitive factor. Perform learnable enhancement and update the formula as follows: ; in, is the attention vector matrix after perturbation, It is a node and nodes The learnable perturbation sensitivity factor ranges from ,in is the preset maximum disturbance amplitude, To enhance the attention weight after introducing the perturbation-sensitive factor; Step S233: Graph structure optimization and reconstruction. Based on the perturbed attention vector matrix, the adjacency structure of the consistent attack graph is reconstructed, which is expressed as follows: ; in, is the graph structure matrix after structure enhancement, The perturbed attention weight matrix between all nodes; Step S234: Output the attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate the attack path information. The formula used is as follows: ; in, Attack path information.

[0010] The artificial intelligence-based network security enhancement system provided by the present invention includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model construction module, and a dynamic response decision module, specifically including the following: The security data fusion module collects original security data and introduces an adaptive weighted fusion strategy to obtain fused security data; The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, capturing the potential chain propagation path of the attack behavior and generating a possible attack path map; The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network; The anomaly detection model building module builds an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial sample training mechanism to identify hidden abnormal behaviors; The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate a response strategy for the current threat situation.

[0011] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0012] (1) To address the problem of insufficient fusion of multi-source heterogeneous data, this paper introduces multiple independent security views such as network traffic view, host log view, and alarm information view, combines similarity calculation with the KNN method to construct an adjacency relationship matrix, and generates a consistent attack graph through adjacency matrix fusion and feature matrix fusion, significantly improving the ability to restore cross-view attack chains; (2) To address the problem of lack of dynamic optimization in graph structure learning, this paper introduces a learnable perturbation sensitivity factor based on the consistency attack graph, dynamically adjusts the node relationship output by the graph attention mechanism, achieves fine-grained optimization of the structure, reduces noise edge interference, and improves the expressiveness of the graph structure and the accuracy of attack path identification; (3) To address the problem of insufficient robustness in attack path reasoning, the present invention generates attack path information with stronger noise resistance through structurally enhanced graph neural network modeling, and combines feature alignment and path fusion technology to achieve high-precision reasoning of cross-stage, multi-path attack chains. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 A schematic diagram of the process of the artificial intelligence-based network security enhancement method provided by the present invention; Figure 2 Schematic diagram of the process of step S2; Figure 3 A schematic diagram of the module for artificial intelligence-based network security enhancement provided by the present invention.

[0014] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0015] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0016] In the description of the present invention, it should be understood that terms such as "upper", "lower", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0017] Example 1, see Figure 1 The present invention provides an artificial intelligence-based network security enhancement method, which includes the following steps: Step S1: Security data fusion: collect original security data from network traffic, terminal logs, user behavior, system calls and honeypot systems, introduce an adaptive weighted fusion strategy to obtain fused security data; Step S2: Attack path modeling: Based on the fused security data, an interaction graph between network nodes is constructed. Graph neural networks are used to model the attack path, capture the potential chain propagation path of the attack behavior, and generate a possible attack path map. Step S3: Node risk identification: Based on the attack path graph, the importance indicators of nodes in the attack path are analyzed, including betweenness centrality, neighborhood activity, and historical threat events. Combined with the node embedding representation output by the graph convolutional network, the risk of network nodes is scored and classified to identify high-risk nodes or key assets. Step S4: Anomaly detection model construction: Build an anomaly detection model based on a deep neural network, input the fused security data into the Transformer model, introduce an adversarial sample training mechanism, and identify hidden abnormal behaviors; Step S5: Dynamic response decision-making, building an attack state space model, and introducing a reinforcement learning algorithm to generate a response strategy for the current threat situation.

[0018] Example 2, see Figure 2 This embodiment is based on the above embodiment, and step S2 specifically includes the following steps: Step S21: Multi-view construction: Based on the fused security data, three independent security views are constructed, including a network traffic view, a host log view, and an alarm information view. Similarity calculation and KNN are used to construct an adjacency matrix, generating three graph structures corresponding to the three independent security views. Step S22: Attack chain learning: In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including nodes and edges of the attack graph. Step S23: Graph structure enhancement: Based on the consistent attack graph, an attention-guided structure optimization method is introduced to obtain attack path information; Step S24: Path fusion, feature alignment and fusion of attack path information to generate a fused attack path map.

[0019] In this embodiment, during a certain monitoring period, the system collects raw security data from multiple data sources: Network flow view: Collect NetFlow data from firewalls and switches, and extract features such as IP address, port, number of communication bytes, and connection duration; Host log view: collects Windows and Linux host logs, including user login, file access, process startup, and permission change events; Alarm information view: collects alarm records from IDS, honeypot systems, and antivirus software, including alarm type, timestamp, and associated IP information; For each view, we calculate the similarity between nodes based on cosine similarity. We then use the KNN method to select the k most similar neighbors for each node, constructing the corresponding adjacency matrix and forming three independent graph structures. The nodes in each graph represent network entities, including servers, terminal devices, and user accounts, while the edges represent the interactions between entities. Build graph neural network models on three independent graph structures, and input their respective feature matrices and adjacency matrices for training: In the network traffic view, GCN learned the characteristics of abnormally high-frequency communication between a server and multiple terminals; In the host log view, GCN captured a pattern of frequent logins across departments from the same user account within a short period of time; In the alarm information view, GCN found similar "port scan" and "dictionary attack" alarms on multiple nodes; By fusion of adjacency matrices and feature matrices, a consistent attack graph is generated, which uniformly describes attack signs from different views and preserves the node and edge relationships in the attack graph. The consistency attack graph is fed into the Graph Attention Mechanism (GAT) to calculate the attention weights between nodes. Since abnormal login and data access behaviors exist between the "Finance Server" node and the "Human Resources Terminal" node in multiple views, the attention mechanism assigns a higher weight to this edge. A perturbation-sensitive factor is introduced to perform learnable enhancement on the attention weights, emphasizing edges that show signs of attack in multiple views and weakening edges that only occasionally show abnormalities. Based on the enhanced attention weight matrix, the adjacency structure of the consistency attack graph is reconstructed and input into the GCN encoding again to obtain clearer and more robust attack path information, including the potential attack path of "external attack host → personnel terminal → financial server → database server"; Align and fuse the attack path information extracted from each view, aligning the lateral movement path in network traffic with the privilege escalation path in host logs. Combined with high-risk vulnerability exploitation events in alert information, this creates a fused attack path map. The generated attack path map shows that the attacker first controlled an employee's terminal through email phishing, then used the terminal's network access rights to infiltrate the financial server and perform database theft operations on the financial server.

[0020] Embodiment 3: This embodiment is based on the above embodiment, and step S22 specifically includes the following steps: Step S221: Local view modeling. For each independent security view, nodes represent network entities and edges represent relationships between entities. The matrix characteristics of an independent security view are , the adjacency matrix is , use the GCN model to train each independent security view separately to obtain the node interaction representation. The formula used is as follows: ; in, is the node interaction representation of the th independent security view, represents a natural number, Indicates the number of nodes in the independent security view, Represents the initial feature dimension of the node; Step S222: Adjacency matrix fusion, introducing a structural fusion operation, jointly modeling the adjacency structures under independent security views, and constructing the adjacency matrix of the consistent attack graph. The formula used is as follows: ; ; in, No. The structural weight of each independent security view, is the adjacency matrix of the consistency attack graph, is the total number of independent security views; Step S223: Feature matrix fusion: perform attention-weighted combination on the node features of the independent security views to generate a feature matrix of the consistent attack graph. The formula used is as follows: ; ; in, represents the input feature matrix of the consistency attack graph, Indicates the Feature fusion weights of independent security views; Step S224: Generate a consistent attack graph. Input the adjacency matrix and feature matrix of the consistent attack graph into the graph neural network model to generate a consistent attack path graph. The formula used is as follows: ; in, is the consistency attack graph.

[0021] In this embodiment, a variety of security data collection devices are deployed in the internal network of a city government's data center, including network traffic collectors, host log collection agents, and security alarm systems to monitor security events across the entire network; The network security center discovered signs of abnormal access to some business systems. To analyze the attack chain and locate potential threats, the method of the present invention was used to execute steps S221 to S224 to generate a consistent attack graph. During the monitoring cycle, the integrated security data is divided into three independent security views: Network traffic view: Nodes represent network entities such as servers, workstations, and routers, and edges represent communication relationships between nodes; Host log view: Nodes represent hosts or user accounts, and edges represent logins or process interactions between accounts. Alarm information view: Nodes represent devices involved in the alarm, and edges represent device associations in the alarm event. Record The matrix characteristics of an independent security view are ,in ; Build and train a graph convolutional network (GCN) on each independent security view to obtain node interaction representation; In the network traffic view, the GCN model detected a large number of abnormal data packet transmissions between the "Government Portal Server" and the "Archive Management Server" during the early morning hours. This connection showed signs in both the host log view and the alarm information view. Introducing structural fusion weights , perform weighted summation of the adjacency matrices of the three views; The weight is set to ; ; ; The node feature matrices of the three views are weighted and fused, and the formula is used to calculate ; Input the fused adjacency matrix and feature matrix into the graph convolutional network: The resulting consistent attack graph clearly depicts the attack chain: external attack host (node ​​12) → government portal server (node ​​85) → archive management server (node ​​230) → internal database server (node ​​402).

[0022] Embodiment 4: This embodiment is based on the above embodiment, and step S23 specifically includes the following steps: Step S231: Initialize the graph attention weight. Take the adjacency matrix and feature matrix of the consistent attack graph as input and introduce the graph attention mechanism to calculate the dynamic aggregation weight between nodes. The formula used is as follows: ; ; in, and is the node of the attack graph, and are the feature vectors of nodes and nodes, is the linear transformation weight matrix of the GCN model, is the parameter vector in the attention mechanism, represents the transpose of the attention vector matrix, For nodes and nodes The unnormalized attention relevance score of For nodes For Node The normalized attention weight of For nodes The set of neighbor nodes.

[0023] Step S232: Introduce the structural disturbance sensitive factor. Perform learnable enhancement and update the formula as follows: ; in, is the attention vector matrix after perturbation, It is a node and nodes The learnable perturbation sensitivity factor ranges from ,in is the preset maximum disturbance amplitude, To enhance the attention weight after introducing the perturbation-sensitive factor; Step S233: Graph structure optimization and reconstruction. Based on the perturbed attention vector matrix, the adjacency structure of the consistent attack graph is reconstructed, which is expressed as follows: ;

[0024] in, is the graph structure matrix after structure enhancement, The perturbed attention weight matrix between all nodes; Step S234: Output the attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate the attack path information. The formula used is as follows: ; in, Attack path information.

[0025] In this embodiment, the core code used is as follows: import torch import torch.nn.functional as F # ========= Input data ========= # A_con: adjacency matrix of the consistency attack graph (nxn) # X_con: Node feature matrix of the consistency attack graph (nxd) # n: number of nodes, d: node feature dimension # For example, from S22: n, d = 500, 64 A_con = torch.rand((n, n)) # adjacency matrix X_con = torch.rand((n, d)) # node feature matrix # ========= Step S231: Graph Attention Weight Initialization ========== # Parameter definition d_hidden = 128 # Hidden dimension W = torch.nn.Parameter(torch.randn(d, d_hidden)) # GCN linear transformation weight matrix a = torch.nn.Parameter(torch.randn(2 * d_hidden, 1)) # Attention mechanism parameter vector # Perform linear transformation on node features X_transformed = torch.mm(X_con, W) # (nx d_hidden) # Calculate the attention score of node pair (i, j) # Concatenate feature vectors: [W·x_i || W·x_j] # Here we use broadcasting to generate all combinations of i,j pairs X_i = X_transformed.unsqueeze(1).repeat(1, n, 1) # (n, n, d_hidden) X_j = X_transformed.unsqueeze(0).repeat(n, 1, 1) # (n, n, d_hidden) X_cat = torch.cat([X_i, X_j], dim=-1) # (n, n, 2*d_hidden) # e_{ij} = LeakyReLU(a^T [W·x_i || W·x_j]) e_ij = F.leaky_relu(torch.matmul(X_cat, a).squeeze(-1)) # (n, n) # α_{ij} = softmax_j(e_{ij}) alpha_ij = torch.softmax(e_ij.masked_fill(A_con == 0, float('-inf')),dim=1) # ========= Step S232: Introduction of structural disturbance sensitivity factor ========= epsilon = 0.1 # Maximum perturbation amplitude delta_ij = torch.nn.Parameter(torch.empty((n, n)).uniform_(-epsilon,epsilon)) # Learnable perturbation matrix # {\widetilde{\alpha}}_{ij} = α_{ij} * (1 + δ_{ij}) alpha_tilde = alpha_ij * (1 + delta_ij) # ========= Step S233: Graph structure optimization and reconstruction ========= # A^{enh} = \widetilde{\alpha} ⊙ A^{con} A_enh = alpha_tilde * A_con # element-wise multiplication # ========= Step S234: Output attack path information ========= # Define a simple GCN layer class SimpleGCN(torch.nn.Module): def __init__(self, in_dim, out_dim): super().__init__() self.weight = torch.nn.Parameter(torch.randn(in_dim, out_dim)) def forward(self, A, X): # Normalize the adjacency matrix I = torch.eye(A.size(0)) A_hat = A + I D_hat = torch.diag(torch.pow(A_hat.sum(1), -0.5)) A_norm = D_hat @ A_hat @ D_hat return torch.relu(A_norm @X @self.weight) # Initialize the GCN model and generate attack path information gcn_model = SimpleGCN(in_dim=d, out_dim=64) Z_enh = gcn_model(A_enh, X_con) # (n, 64) # ========= Output ========= print("Shape of the enhanced attack path information matrix:", Z_enh.shape).

[0026] Example 5, see Figure 3 The artificial intelligence-based network security enhancement system provided by the present invention includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model construction module, and a dynamic response decision module, specifically including the following contents: The security data fusion module collects original security data and introduces an adaptive weighted fusion strategy to obtain fused security data; The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, capturing the potential chain propagation path of the attack behavior and generating a possible attack path map; The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network; The anomaly detection model building module builds an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial sample training mechanism to identify hidden abnormal behaviors; The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate a response strategy for the current threat situation.

[0027] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0028] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

[0029] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. A network security enhancement method based on artificial intelligence, characterized by: The method comprises the following steps: Step S1: security data fusion, collecting original security data, introducing adaptive weighted fusion strategy to obtain fused security data; Step S2: Attack path modeling: Based on the fused security data, an interaction graph between network nodes is constructed. Graph neural networks are used to model the attack path, capture the potential chain propagation path of the attack behavior, and generate a possible attack path map. Step S3: Node risk identification: Based on the attack path graph, the importance indicators of the nodes in the attack path are analyzed. Combined with the node embedding representation output by the graph convolutional network, the network nodes are scored and classified to identify high-risk nodes or key assets. Step S4: Anomaly detection model construction: Build an anomaly detection model based on a deep neural network, input the fused security data into the Transformer model, introduce an adversarial sample training mechanism, and identify hidden abnormal behaviors; Step S5: Dynamic response decision-making, building an attack state space model, and introducing a reinforcement learning algorithm to generate a response strategy for the current threat situation.

2. The network security enhancement method based on artificial intelligence according to claim 1, characterized in that: Step S2 specifically includes the following steps: Step S21: Multi-view construction: Based on the fused security data, three independent security views are constructed. Similarity calculation and KNN are used to build an adjacency matrix to generate three graph structures corresponding to the three independent security views. Step S22: Attack chain learning: In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including nodes and edges of the attack graph. Step S23: Graph structure enhancement: Based on the consistent attack graph, an attention-guided structure optimization method is introduced to obtain attack path information; Step S24: Path fusion, feature alignment and fusion of attack path information to generate a fused attack path map.

3. The network security enhancement method based on artificial intelligence according to claim 1, characterized in that: Step S22 specifically includes the following steps: Step S221: Local view modeling. For each independent security view, nodes represent network entities and edges represent relationships between entities. The matrix characteristics of an independent security view are , the adjacency matrix is , use the GCN model to train each independent security view separately to obtain the node interaction representation. The formula used is as follows: ； in, For the Node interaction representation of independent security views, represents a natural number, Indicates the number of nodes in the independent security view, Represents the initial feature dimension of the node; Step S222: Adjacency matrix fusion, introducing a structural fusion operation, jointly modeling the adjacency structures under independent security views, and constructing the adjacency matrix of the consistent attack graph. The formula used is as follows: ； ； in, No. The structural weight of each independent security view, is the adjacency matrix of the consistency attack graph, is the total number of independent security views; Step S223: Feature matrix fusion: perform attention-weighted combination on the node features of the independent security views to generate a feature matrix of the consistent attack graph. The formula used is as follows: in, represents the input feature matrix of the consistency attack graph, Indicates the Feature fusion weights of independent security views; Step S224: Generate a consistent attack graph. Input the adjacency matrix and feature matrix of the consistent attack graph into the graph neural network model to generate a consistent attack path graph. The formula used is as follows: ； in, is the consistency attack graph.

4. The network security enhancement method based on artificial intelligence according to claim 1, characterized in that: Step S23 specifically includes the following steps: Step S231: Initialize the graph attention weight. Take the adjacency matrix and feature matrix of the consistent attack graph as input and introduce the graph attention mechanism to calculate the dynamic aggregation weight between nodes. The formula used is as follows: ； ； in, and is the node of the attack graph, and For nodes and nodes The eigenvector of is the linear transformation weight matrix of the GCN model, is the parameter vector in the attention mechanism, represents the transpose of the attention vector matrix, For nodes and nodes The unnormalized attention relevance score of For nodes For Node The normalized attention weight of For nodes Neighbor node set; Step S232: structural disturbance sensitive factor is introduced, and the disturbance sensitive factor is introduced to Perform learnable enhancement and update the formula as follows: ； in, is the attention vector matrix after perturbation, It is a node and nodes The learnable perturbation sensitivity factor ranges from ,in is the preset maximum disturbance amplitude, To enhance the attention weight after introducing the perturbation-sensitive factor; Step S233: Graph structure optimization and reconstruction. Reconstruct the adjacency structure of the consistent attack graph based on the perturbed attention vector matrix, as shown below: ； in, is the graph structure matrix after structure enhancement, The perturbed attention weight matrix between all nodes; Step S234: Output the attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate the attack path information. The formula used is as follows: ； in, Attack path information.

5. An artificial intelligence-based network security enhancement system, configured to implement the artificial intelligence-based network security enhancement method according to any one of claims 1 to 4, characterized in that: It includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model building module, and a dynamic response decision module, specifically including the following: The security data fusion module collects original security data and introduces an adaptive weighted fusion strategy to obtain fused security data; The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, capturing the potential chain propagation path of the attack behavior and generating a possible attack path map; The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network; The anomaly detection model building module builds an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial sample training mechanism to identify hidden abnormal behaviors; The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate a response strategy for the current threat situation.

Images