Artificial intelligence based network security enhancement method and system

Abstract

The application relates to the field of network security, and particularly relates to a network security enhancement method and system based on artificial intelligence, which comprises the following steps: security data fusion, attack path modeling, node risk identification, abnormality detection model construction and dynamic response decision-making.The application introduces a learnable disturbance sensitive factor on the basis of a consistent attack graph, dynamically adjusts node relations output by a graph attention mechanism, improves the expression capability of a graph structure and the accuracy of attack path identification, and generates attack path information with stronger noise resistance through graph neural network modeling after structure enhancement, and realizes high-precision reasoning of a cross-stage and multi-path attack chain in combination with feature alignment and path fusion technology.The system comprises a security data fusion module, an attack path modeling module, a node risk identification module, an abnormality detection model construction module and a dynamic response decision-making module.

Description

Technical Field

[0001] This invention relates to the field of network security, specifically to a network security enhancement method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of the Internet and information infrastructure, cybersecurity threats are showing trends of increasing frequency, intelligence, and concealment. Graph neural networks (GNNs), due to their advantages in processing graph-structured data, have been gradually introduced into the cybersecurity field. However, existing GNN-based security analysis methods still have the following problems in practical applications:

[0003] (1) Insufficient fusion of multi-source heterogeneous data makes it difficult for existing solutions to simultaneously utilize the complementary characteristics of multiple views such as network traffic, host logs, and alarm information, resulting in low accuracy of attack chain reconstruction.

[0004] (2) Graph structure learning lacks dynamic optimization. Most methods directly propagate features after constructing the graph structure, ignoring the importance of dynamically adjusting the graph structure according to the semantic relationship between nodes during training, which easily introduces noisy relationships.

[0005] (3) The attack path reasoning is not robust enough. When faced with noisy data or missing edges, the identification results of the attack path are prone to degradation, resulting in the omission of high-risk nodes or key assets. Summary of the Invention

[0006] To address the above issues and overcome the shortcomings of existing technologies, this invention provides an artificial intelligence-based network security enhancement method and system. Addressing the insufficient fusion of multi-source heterogeneous data, this invention introduces multiple independent security views, such as network traffic views, host log views, and alarm information views. It constructs an adjacency matrix using similarity calculation and the KNN method, and generates a consistent attack graph through adjacency matrix fusion and feature matrix fusion, significantly improving the ability to reconstruct cross-view attack chains. Addressing the lack of dynamic optimization in graph structure learning, this invention introduces a learnable perturbation sensitivity factor based on the consistent attack graph, dynamically adjusting the node relationships output by the graph attention mechanism to achieve fine-grained optimization of the structure, reduce noise edge interference, and improve the expressive power of the graph structure and the accuracy of attack path identification. Addressing the insufficient robustness of attack path inference, this invention generates more noise-resistant attack path information through graph neural network modeling with enhanced structure, and combines feature alignment and path fusion techniques to achieve high-precision inference of cross-stage, multi-path attack chains.

[0007] The technical solution adopted by this invention is as follows: The network security enhancement method based on artificial intelligence provided by this invention includes the following steps:

[0008] Step S1: Security data fusion. Raw security data is collected from network traffic, terminal logs, user behavior, system calls and honeypot systems. An adaptive weighted fusion strategy is introduced to obtain fused security data.

[0009] Step S2: Attack path modeling. Based on the fused security data, construct the interaction graph between network nodes, use graph neural networks to model attack paths, capture potential chain propagation paths of attack behavior, and generate possible attack path maps.

[0010] Step S3: Node risk identification. Based on the attack path graph, analyze the importance indicators of nodes in the attack path, including betweenness centrality, neighborhood activity and historical threat events. Combine the node embedding representation output by the graph convolutional network to score and classify network nodes to identify high-risk nodes or key assets.

[0011] Step S4: Anomaly detection model construction. Construct an anomaly detection model based on deep neural networks. Input the fused security data into the Transformer model and introduce an adversarial example training mechanism to identify hidden abnormal behaviors.

[0012] Step S5: Dynamic response decision-making, constructing an attack state space model, and introducing reinforcement learning algorithms to generate response strategies for the current threat context.

[0013] Furthermore, step S2 specifically includes the following steps:

[0014] Step S21: Multi-view construction. Based on the fused security data, construct three independent security views, including network traffic view, host log view, and alarm information view. Use similarity calculation and KNN to construct an adjacency matrix and generate three graph structures corresponding to the three independent security views.

[0015] Step S22: Attack chain learning. In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including the nodes and edges of the attack graph.

[0016] Step S23: Graph structure enhancement. Based on the consistency attack graph, an attention-guided structure optimization method is introduced to obtain attack path information.

[0017] Step S24: Path fusion, which involves aligning and fusing the attack path information to generate a fused attack path map.

[0018] Furthermore, step S22 specifically includes the following steps:

[0019] Step S221: Local view modeling. For each independent security view, where nodes represent network entities and edges represent relationships between entities, let the first node be denoted as 'i'. The matrix characteristics of each independent security view are: The adjacency matrix is The GCN model is used to train each independent security view separately to obtain the node interaction representation, and the formula used is as follows:

[0020] ;

[0021] in, For the first The interaction representation of nodes in an independent security view. Represents natural numbers, This indicates the number of nodes in the independent security view. Indicates the initial feature dimension of the node;

[0022] Step S222: Adjacency Matrix Fusion. A structure fusion operation is introduced to jointly model the adjacency structures under independent security views, constructing the adjacency matrix of the consistency attack graph. The formula used is as follows:

[0023] ;

[0024] ;

[0025] in, The first The structural weights of the independent security view The adjacency matrix of the consistency attack graph. This is the total number of independent security views;

[0026] Step S223: Feature matrix fusion. Attention-weighted combination of node features from independent security views is applied to generate the feature matrix of the consistency attack graph. The formula used is as follows:

[0027]

[0028] in, The input feature matrix represents the consistency attack graph. Indicates the first Feature fusion weights for each independent security view;

[0029] Step S224: Consistency Attack Graph Generation. The adjacency matrix and feature matrix of the consistency attack graph are input into the graph neural network model to generate a representation of the consistency attack path graph. The formula used is as follows:

[0030] ;

[0031] in, This is a graph for a consistency attack.

[0032] Furthermore, step S23 specifically includes the following steps:

[0033] Step S231: Initialize graph attention weights. Using the adjacency matrix and feature matrix of the consistency attack graph as input, a graph attention mechanism is introduced to calculate the dynamic aggregation weights between nodes. The formula used is as follows:

[0034] ;

[0035] ;

[0036] in, and For nodes in the attack graph, and For nodes and nodes eigenvectors, The weight matrix is ​​a linear transformation of the GCN model. This is the parameter vector in the attention mechanism. This represents the transpose of the attention vector matrix. For nodes and nodes Unnormalized attention relevance score For nodes For nodes Normalized attention weights Let be the set of neighboring nodes of a node.

[0037] Step S232: Introduce structural perturbation sensitive factors, and introduce perturbation sensitive factors to... For learnable enhancement, the update formula is expressed as follows:

[0038] ;

[0039] in, This is the perturbed attention vector matrix. This is a node and nodes The learnable perturbation sensitivity factor has a value range of . ,in To preset the maximum disturbance amplitude, Enhanced attention weights after introducing perturbation-sensitive factors;

[0040] Step S233: Graph structure optimization and reconstruction. Based on the perturbed attention vector matrix, reconstruct the adjacency structure of the consistency attack graph, as shown below:

[0041] ;

[0042] in, This is the graph structure matrix after structural enhancement. The perturbed attention weight matrix among all nodes;

[0043] Step S234: Output attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate attack path information. The formula used is as follows:

[0044] ;

[0045] in, This is the attack path information.

[0046] The artificial intelligence-based network security enhancement system provided by this invention includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model construction module, and a dynamic response decision-making module, specifically including the following:

[0047] The security data fusion module collects raw security data, introduces an adaptive weighted fusion strategy, and obtains fused security data.

[0048] The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, captures the potential chain propagation path of the attack behavior, and generates a possible attack path map.

[0049] The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network.

[0050] The anomaly detection model construction module constructs an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial example training mechanism to identify hidden abnormal behaviors.

[0051] The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate response strategies for the current threat situation.

[0052] The beneficial effects achieved by the present invention using the above solution are as follows:

[0053] (1) To address the problem of insufficient fusion of multi-source heterogeneous data, this invention introduces multiple independent security views such as network traffic view, host log view, and alarm information view. It combines similarity calculation and KNN method to construct an adjacency relationship matrix, and generates a consistency attack graph through adjacency matrix fusion and feature matrix fusion, which significantly improves the ability to restore cross-view attack chains.

[0054] (2) To address the lack of dynamic optimization in graph structure learning, this invention introduces a learnable perturbation sensitive factor on the basis of consistency attack graph, dynamically adjusts the node relationship output by the graph attention mechanism, realizes fine-grained optimization of the structure, reduces noise edge interference, and improves the expressive power of graph structure and the accuracy of attack path identification.

[0055] (3) To address the problem of insufficient robustness of attack path reasoning, this invention generates attack path information with stronger noise resistance by modeling a graph neural network with enhanced structure, and combines feature alignment and path fusion technology to achieve high-precision reasoning of cross-stage and multi-path attack chains. Attached Figure Description

[0056] Figure 1 A flowchart illustrating the AI-based network security enhancement method provided by this invention;

[0057] Figure 2 This is a flowchart illustrating step S2;

[0058] Figure 3 This is a schematic diagram of a network security enhancement module based on artificial intelligence provided by the present invention.

[0059] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used together with the embodiments of the invention to explain the invention and do not constitute a limitation thereof. Detailed Implementation

[0060] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0061] In the description of this invention, it should be understood that the terms "upper", "lower", "front", "rear", "left", "right", "top", "bottom", "inner", "outer", etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on this invention.

[0062] Example 1, see Figure 1 The present invention provides an artificial intelligence-based network security enhancement method, which includes the following steps:

[0063] Step S1: Security data fusion. Raw security data is collected from network traffic, terminal logs, user behavior, system calls and honeypot systems. An adaptive weighted fusion strategy is introduced to obtain fused security data.

[0064] Step S2: Attack path modeling. Based on the fused security data, construct the interaction graph between network nodes, use graph neural networks to model attack paths, capture potential chain propagation paths of attack behavior, and generate possible attack path maps.

[0065] Step S3: Node risk identification. Based on the attack path graph, analyze the importance indicators of nodes in the attack path, including betweenness centrality, neighborhood activity and historical threat events. Combine the node embedding representation output by the graph convolutional network to score and classify network nodes to identify high-risk nodes or key assets.

[0066] Step S4: Anomaly detection model construction. Construct an anomaly detection model based on deep neural networks. Input the fused security data into the Transformer model and introduce an adversarial example training mechanism to identify hidden abnormal behaviors.

[0067] Step S5: Dynamic response decision-making, constructing an attack state space model, and introducing reinforcement learning algorithms to generate response strategies for the current threat context.

[0068] Example 2, see Figure 2 This embodiment is based on the above embodiment. Step S2 specifically includes the following steps:

[0069] Step S21: Multi-view construction. Based on the fused security data, construct three independent security views, including network traffic view, host log view, and alarm information view. Use similarity calculation and KNN to construct an adjacency matrix and generate three graph structures corresponding to the three independent security views.

[0070] Step S22: Attack chain learning. In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including the nodes and edges of the attack graph.

[0071] Step S23: Graph structure enhancement. Based on the consistency attack graph, an attention-guided structure optimization method is introduced to obtain attack path information.

[0072] Step S24: Path fusion, which involves aligning and fusing the attack path information to generate a fused attack path map.

[0073] In this embodiment, the system collects raw security data from multiple data sources within a certain monitoring period:

[0074] Network Traffic View: Collects NetFlow data from firewalls and switches, and extracts features such as IP address, port, number of communication bytes, and connection duration;

[0075] Host Log View: Collects Windows and Linux host logs, including user login, file access, process startup, and permission change events;

[0076] Alarm information view: Collects alarm records from IDS, honeypot systems, and antivirus software, including alarm type, timestamp, and associated IP information;

[0077] For each view, the similarity between nodes is calculated based on cosine similarity. The KNN method is then used to select the k most similar neighbors for each node, thus constructing a corresponding adjacency matrix and forming three independent graph structures. Each graph's nodes represent network entities, including servers, terminal devices, and user accounts, while edges represent the interaction relationships between entities.

[0078] Graph neural network models are built on three independent graph structures, and trained by inputting their respective feature matrices and adjacency matrices:

[0079] In the network traffic view, GCN learned the characteristics of abnormally high frequency communication between a server and multiple terminals;

[0080] In the host log view, GCN captured a pattern of the same user account frequently logging in across departments within a short period of time;

[0081] In the alarm information view, GCN found that multiple nodes had similar "port scanning" and "dictionary attack" alarms;

[0082] By fusing adjacency matrices and feature matrices, a consistent attack graph is generated, which uniformly describes attack signs from different views and preserves the node and edge relationships in the attack graph.

[0083] The consistency attack graph is input into the graph attention mechanism (GAT) to calculate the attention weight between nodes. There are abnormal login and data access behaviors between the node "financial server" and the node "human resources terminal" in multiple views. The attention mechanism assigns a higher weight to this edge.

[0084] By introducing a perturbation-sensitive factor, the attention weights are enhanced in a learnable way, emphasizing edges that show signs of attack in multiple views and weakening edges that are only occasionally abnormal.

[0085] Based on the enhanced attention weight matrix, the adjacency structure of the consistency attack graph is reconstructed and then input into GCN encoding again to obtain clearer and more robust attack path information, namely the potential attack path of "external attack host → HR terminal → financial server → database server".

[0086] The attack path information extracted from each view is feature-aligned and fused, the lateral movement path in network traffic is aligned with the privilege escalation path in host logs, and combined with the high-risk vulnerability exploitation events in the alarm information to form a fused attack path map.

[0087] The generated attack path graph shows that the attacker first controlled an employee's terminal via email phishing, then used the terminal's network access permissions to laterally penetrate the financial server and perform database theft operations on the financial server.

[0088] Example 3, this example is based on the above example, step S22 specifically includes the following steps:

[0089] Step S221: Local view modeling. For each independent security view, where nodes represent network entities and edges represent relationships between entities, let the first node be denoted as 'i'. The matrix characteristics of each independent security view are: The adjacency matrix is The GCN model is used to train each independent security view separately to obtain the node interaction representation, and the formula used is as follows:

[0090] ;

[0091] in, This represents the node interaction representation for the i-th independent security view. Represents natural numbers, This indicates the number of nodes in the independent security view. Indicates the initial feature dimension of the node;

[0092] Step S222: Adjacency Matrix Fusion. A structure fusion operation is introduced to jointly model the adjacency structures under independent security views, constructing the adjacency matrix of the consistency attack graph. The formula used is as follows:

[0093] ;

[0094] ;

[0095] in, No. The structural weights of each independent security view The adjacency matrix of the consistency attack graph. This is the total number of independent security views;

[0096] Step S223: Feature matrix fusion. Attention-weighted combination of node features from independent security views is applied to generate the feature matrix of the consistency attack graph. The formula used is as follows:

[0097] ;

[0098] ;

[0099] in, The input feature matrix represents the consistency attack graph. Indicates the first Feature fusion weights for each independent security view;

[0100] Step S224: Consistency Attack Graph Generation. The adjacency matrix and feature matrix of the consistency attack graph are input into the graph neural network model to generate a representation of the consistency attack path graph. The formula used is as follows:

[0101] ;

[0102] in, This is a graph for a consistency attack.

[0103] In this embodiment, a variety of security data collection devices, including network traffic collectors, host log collection agents, and security alarm systems, are deployed in the internal network of a municipal government's data center to monitor security events across the entire network.

[0104] The network security center discovered abnormal access signs in some business systems. In order to analyze the attack chain and locate potential threats, the method of the present invention was used to generate a consistency attack graph by executing steps S221 to S224.

[0105] During the monitoring period, the fused security data is divided into three independent security views:

[0106] Network traffic view: Nodes represent network entities such as servers, workstations, and routers, and edges represent the communication relationships between nodes;

[0107] Host log view: Nodes represent hosts or user accounts, and edges represent login or process interaction relationships between accounts;

[0108] Alarm information view: Nodes represent the devices involved in the alarm, and edges represent the device relationships that occur in the alarm event;

[0109] Record No. The matrix characteristics of each independent security view are: ,in ;

[0110] Graph Convolutional Networks (GCNs) are constructed and trained on each independent security view to obtain node interaction representations.

[0111] In the network traffic view, the GCN model detected a large number of abnormal data packet transmissions between the "Government Affairs Portal Server" and the "Archives Management Server" during the early morning hours. This connection was also reflected in the host log view and alarm information view.

[0112] Introducing structural fusion weights The adjacency matrices of the three views are weighted and summed.

[0113] Weights set to ;

[0114] ;

[0115] ;

[0116] The node feature matrices of the three views are weighted and fused, and the result is obtained through a formula. ;

[0117] The fused adjacency matrix and feature matrix are then input into the graph convolutional network:

[0118] The resulting consistency attack graph clearly depicts the attack chain: external attack host (node ​​12) → government portal server (node ​​85) → archive management server (node ​​230) → internal database server (node ​​402).

[0119] Example 4, this example is based on the above example, step S23 specifically includes the following steps:

[0120] Step S231: Initialize graph attention weights. Using the adjacency matrix and feature matrix of the consistency attack graph as input, a graph attention mechanism is introduced to calculate the dynamic aggregation weights between nodes. The formula used is as follows:

[0121] ;

[0122] ;

[0123] in, and For nodes in the attack graph, and Let the nodes and their feature vectors be denoted as . The weight matrix is ​​a linear transformation of the GCN model. This is the parameter vector in the attention mechanism. This represents the transpose of the attention vector matrix. For nodes and nodes Unnormalized attention relevance score For nodes For nodes Normalized attention weights For nodes The set of neighboring nodes.

[0124] Step S232: Introduce structural perturbation sensitive factors, and introduce perturbation sensitive factors to... For learnable enhancement, the update formula is expressed as follows:

[0125] ;

[0126] in, This is the perturbed attention vector matrix. This is a node and nodes The learnable perturbation sensitivity factor has a value range of . ,in To preset the maximum disturbance amplitude, Enhanced attention weights after introducing perturbation-sensitive factors;

[0127] Step S233: Graph structure optimization and reconstruction. Based on the perturbed attention vector matrix, reconstruct the adjacency structure of the consistency attack graph, as shown below:

[0128] ;

[0129] in, This is the graph structure matrix after structural enhancement. The perturbed attention weight matrix among all nodes;

[0130] Step S234: Output attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate attack path information. The formula used is as follows:

[0131] ;

[0132] in, This is the attack path information.

[0133] In this embodiment, the core code used is as follows:

[0134] import torch

[0135] import torch.nn.functional as F

[0136] # ========= Input Data =========

[0137] # A_con: Adjacency matrix (n x n) of the consistency attack graph

[0138] # X_con: Node feature matrix (nxd) of the consistency attack graph

[0139] # n: Number of nodes, d: Dimension of node features

[0140] # For example, from S22 we get:

[0141] n, d = 500, 64

[0142] A_con = torch.rand((n, n)) # Adjacency matrix

[0143] X_con = torch.rand((n, d)) # Node feature matrix

[0144] # ========= Step S231: Initialize Graph Attention Weights =========

[0145] # Parameter Definition

[0146] d_hidden = 128 # Hidden layer dimension

[0147] W = torch.nn.Parameter(torch.randn(d, d_hidden)) # GCN linear transformation weight matrix

[0148] a = torch.nn.Parameter(torch.randn(2 * d_hidden, 1)) # Attention mechanism parameter vector

[0149] # Perform linear transformation on node features

[0150] X_transformed = torch.mm(X_con, W) # (nx d_hidden)

[0151] # Calculate the attention score for node pair (i, j)

[0152] # Concatenate feature vectors: [W·x_i || W·x_j]

[0153] # Here, broadcasting is used to generate all combinations of i, j pairs.

[0154] X_i = X_transformed.unsqueeze(1).repeat(1, n, 1) # (n, n, d_hidden)

[0155] X_j = X_transformed.unsqueeze(0).repeat(n, 1, 1) # (n, n, d_hidden)

[0156] X_cat = torch.cat([X_i, X_j], dim=-1) # (n, n, 2*d_hidden)

[0157] # e_{ij} = LeakyReLU(a^T [W·x_i || W·x_j])

[0158] e_ij = F.leaky_relu(torch.matmul(X_cat, a).squeeze(-1)) # (n, n)

[0159] # α_{ij} = softmax_j(e_{ij})

[0160] alpha_ij = torch.softmax(e_ij.masked_fill(A_con == 0, float('-inf')),dim=1)

[0161] # ========= Step S232: Introduction of Structural Disturbance Sensitive Factors =========

[0162] epsilon = 0.1 # Maximum perturbation amplitude

[0163] delta_ij = torch.nn.Parameter(torch.empty((n, n)).uniform_(-epsilon,epsilon)) # Learnable perturbation matrix

[0164] # {\widetilde{\alpha}}_{ij} = α_{ij} * (1 + δ_{ij})

[0165] alpha_tilde = alpha_ij * (1 + delta_ij)

[0166] # ========= Step S233: Graph Structure Optimization and Reconstruction =========

[0167] # A^{enh} = \widetilde{\alpha} ⊙ A^{con}

[0168] A_enh = alpha_tilde * A_con # Element-wise multiplication

[0169] # ========= Step S234: Output attack path information =========

[0170] # Define a simple GCN layer

[0171] class SimpleGCN(torch.nn.Module):

[0172] def __init__(self, in_dim, out_dim):

[0173] super().__init__()

[0174] self.weight = torch.nn.Parameter(torch.randn(in_dim, out_dim))

[0175] def forward(self, A, X):

[0176] # Normalized adjacency matrix

[0177] I = torch.eye(A.size(0))

[0178] A_hat = A + I

[0179] D_hat = torch.diag(torch.pow(A_hat.sum(1), -0.5))

[0180] A_norm = D_hat @ A_hat @ D_hat

[0181] return torch.relu(A_norm @X @self.weight)

[0182] # Initialize the GCN model and generate attack path information

[0183] gcn_model = SimpleGCN(in_dim=d, out_dim=64)

[0184] Z_enh = gcn_model(A_enh, X_con) # (n, 64)

[0185] # ========= Output =========

[0186] print("Shape of the enhanced attack path information matrix:", Z_enh.shape).

[0187] Example 5, see Figure 3 The artificial intelligence-based network security enhancement system provided by this invention includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model construction module, and a dynamic response decision module, specifically including the following:

[0188] The security data fusion module collects raw security data, introduces an adaptive weighted fusion strategy, and obtains fused security data.

[0189] The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, captures the potential chain propagation path of the attack behavior, and generates a possible attack path map.

[0190] The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network.

[0191] The anomaly detection model construction module constructs an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial example training mechanism to identify hidden abnormal behaviors.

[0192] The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate response strategies for the current threat situation.

[0193] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0194] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

[0195] The present invention and its embodiments have been described above. This description is not restrictive, and the accompanying drawings are only one embodiment of the present invention; the actual structure is not limited thereto. In conclusion, if those skilled in the art are inspired by this description and design similar structures and embodiments without departing from the spirit of the invention, such designs should fall within the protection scope of the present invention.

Claims

1. A network security enhancement method based on artificial intelligence, characterized in that: The method includes the following steps: Step S1: Security data fusion. Collect raw security data, introduce an adaptive weighted fusion strategy, and obtain fused security data. Step S2: Attack path modeling. Based on the fused security data, construct the interaction graph between network nodes, use graph neural networks to model attack paths, capture potential chain propagation paths of attack behavior, and generate possible attack path maps. Step S3: Node risk identification. Based on the attack path graph, analyze the importance indicators of nodes in the attack path, and combine the node embedding representation output by the graph convolutional network to score and classify network nodes to identify high-risk nodes or key assets. Step S4: Anomaly detection model construction. Construct an anomaly detection model based on deep neural networks. Input the fused security data into the Transformer model and introduce an adversarial example training mechanism to identify hidden abnormal behaviors. Step S5: Dynamic response decision-making, constructing an attack state space model, and introducing reinforcement learning algorithms to generate response strategies for the current threat context; Step S2 specifically includes the following steps: Step S21: Multi-view construction. Based on the fused security data, construct three independent security views, including network traffic view, host log view, and alarm information view. Use similarity calculation and KNN to construct an adjacency matrix and generate three graph structures corresponding to the three independent security views. Step S22: Attack chain learning. In each independent security view, a consistent attack graph is obtained by constructing and training a graph neural network model, including the nodes and edges of the attack graph. Step S23: Graph structure enhancement. Based on the consistency attack graph, an attention-guided structure optimization method is introduced to obtain attack path information. Step S24: Path fusion, which involves aligning and fusing the attack path information to generate a fused attack path map.

2. The artificial intelligence-based network security enhancement method according to claim 1, characterized in that: Step S22 specifically includes the following steps: Step S221: Local view modeling. For each independent security view, where nodes represent network entities and edges represent relationships between entities, let the first node be denoted as 'i'. The matrix characteristics of each independent security view are: The adjacency matrix is The GCN model is used to train each independent security view separately to obtain the node interaction representation, and the formula used is as follows: ； in, For the first The interaction representation of nodes in an independent security view. Represents natural numbers, This indicates the number of nodes in the independent security view. Indicates the initial feature dimension of the node; Step S222: Adjacency Matrix Fusion. A structure fusion operation is introduced to jointly model the adjacency structures under independent security views, constructing the adjacency matrix of the consistency attack graph. The formula used is as follows: ； ； in, No. The structural weights of each independent security view The adjacency matrix of the consistency attack graph. This is the total number of independent security views; Step S223: Feature matrix fusion. Attention-weighted combination of node features from independent security views is applied to generate the feature matrix of the consistency attack graph. The formula used is as follows: ； ； in, The input feature matrix represents the consistency attack graph. Indicates the first Feature fusion weights for each independent security view; Step S224: Consistency Attack Graph Generation. The adjacency matrix and feature matrix of the consistency attack graph are input into the graph neural network model to generate a representation of the consistency attack path graph. The formula used is as follows: ； in, This is a graph for a consistency attack.

3. The artificial intelligence-based network security enhancement method according to claim 1, characterized in that: Step S23 specifically includes the following steps: Step S231: Initialize graph attention weights. Using the adjacency matrix and feature matrix of the consistency attack graph as input, a graph attention mechanism is introduced to calculate the dynamic aggregation weights between nodes. The formula used is as follows: ； ； in, , and For nodes in the attack graph, and For nodes and nodes eigenvectors, The weight matrix is ​​a linear transformation of the GCN model. This is the parameter vector in the attention mechanism. This represents the transpose of the attention vector matrix. For nodes and nodes Unnormalized attention relevance score For nodes For nodes Normalized attention weights For nodes The set of neighboring nodes; Step S232: Introduce structural perturbation sensitive factors, and introduce perturbation sensitive factors to... For learnable enhancement, the update formula is expressed as follows: ； in, This is the perturbed attention vector matrix. This is a node and nodes The learnable perturbation sensitivity factor has a value range of . ,in To preset the maximum disturbance amplitude, Enhanced attention weights after introducing perturbation-sensitive factors; Step S233: Graph structure optimization and reconstruction. Based on the perturbed attention vector matrix, reconstruct the adjacency structure of the consistency attack graph, as shown below: ； in, This is the graph structure matrix after structural enhancement. The perturbed attention weight matrix among all nodes; Step S234: Output attack path information. Input the enhanced graph structure matrix and the input feature matrix of the consistency attack graph into the GCN model for re-encoding to generate attack path information. The formula used is as follows: ； in, This is attack path information.

4. An AI-based network security enhancement system, used to implement the AI-based network security enhancement method according to any one of claims 1-3, characterized in that: It includes a security data fusion module, an attack path modeling module, a node risk identification module, an anomaly detection model building module, and a dynamic response decision-making module, specifically including the following: The security data fusion module collects raw security data and introduces an adaptive weighted fusion strategy to obtain fused security data. The attack path modeling module constructs an interaction graph between network nodes based on the fused security data, and uses a graph neural network to model the attack path of the interaction graph, captures the potential chain propagation path of the attack behavior, and generates a possible attack path map. The node risk identification module performs risk scoring and classification on network nodes based on the possible attack path map and the node embedding representation output by the graph convolutional network. The anomaly detection model construction module constructs an anomaly detection model based on a deep neural network, inputs the fused security data into the Transformer model, and introduces an adversarial example training mechanism to identify hidden abnormal behaviors. The dynamic response decision module constructs an attack state space model and introduces a reinforcement learning algorithm to generate response strategies for the current threat situation.

Images