An AI large model-based network security data management system and method

Abstract

The application belongs to the technical field of data security management, and discloses a network security data management system and method based on an AI large model, which comprises the following steps: obtaining historical network behavior data, corresponding time information and network environment data, performing feature processing on the network behavior data in time periods, obtaining network security features and forming a historical database; training a baseline model to predict network security features; obtaining real-time time information and network environment data, obtaining expected and current actual network security features; comparing the current network security features with the expected network security features to generate a risk assessment result; and dynamically adjusting data access control and encryption strategies according to the risk assessment result.The method can accurately identify security threats by comparing predicted normal network behavior with actual behavior, and adaptively adjusts security strategies according to the risk level, thereby achieving a balance between security and availability.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security management, more particularly, the present application relates to a network security data management system and method based on AI large model. BACKGROUND

[0002] With the rapid development of information technology and the popularity of network applications, network security problems have become increasingly prominent. Various network attack methods have been upgraded from early simple virus attacks to today's advanced persistent threats (APT), ransomware attacks and supply chain attacks and other complex forms. Under this background, traditional network security protection methods based on rules and feature libraries have been difficult to cope with the increasingly complex security threats, and network security solutions based on artificial intelligence technology have gradually become a research hotspot and development trend.

[0003] The existing network security monitoring and protection technology mainly has the following problems: the existing anomaly detection method is usually based on statistical analysis of historical data or simple behavior pattern matching, which lacks the ability to accurately model the normal state of network behavior under different time and environmental conditions, making it difficult to distinguish between real security threats and normal business fluctuations, resulting in a large number of false positives or false negatives. At the same time, the existing network security system lacks intelligent and adaptive capabilities in data management, most systems use fixed data access control and encryption strategies, which cannot be dynamically adjusted according to the actual risk level. Such static security strategies are either too strict or too lenient, unable to provide adequate protection in high-risk situations, affecting system availability and user experience. SUMMARY

[0004] In order to overcome the problem of affecting system availability and user experience in the prior art, the present application proposes a network security data management system and method based on AI large model to solve the above problems.

[0005] The present application provides the following technical solutions:

[0006] A network security data management method based on AI large model, comprising:

[0007] Obtain historical network behavior data and corresponding time information and network environment data, and perform feature processing on the network behavior data by time period to obtain corresponding network security features and form a historical database;

[0008] According to the historical database, train a baseline model for predicting network security features according to time information and network environment data;

[0009] Obtaining real-time time information and network environment data, obtaining expected network security features through a baseline model, obtaining current network security features through feature processing of real-time collected network environment data;

[0010] Generating a risk assessment result according to the current network security features and the expected network security features;

[0011] Adjusting data access control and encryption strategies according to the risk assessment result.

[0012] Preferably, the network environment data includes network access records, data flow features, and user operation behaviors; the network access records include access users, access resources, access times, and access permissions; the data flow features include flow sizes, flow directions, protocol types, and data packet features; and the user operation behaviors include operation types, operation objects, operation time intervals, and operation sequence patterns.

[0013] The time information includes months, weeks, hours, and workday labels; and the network environment data includes network flow loads, active user numbers, and external connection request frequencies.

[0014] Preferably, the feature processing includes:

[0015] For network access records: a frequency matrix of different users accessing various resources is counted; an access diversity index is obtained by a ratio of a number of different users accessing a resource to a total number of access times; an abnormal access index is obtained by weighting an access time outside a regular time and an access time exceeding a permission; and a network access feature vector is obtained by combining the access diversity index and the abnormal access index.

[0016] For data flow features: a flow total amount index is obtained by a flow total value; a protocol distribution entropy index is obtained by a proportion of flow of different protocol types; a flow burstiness index is obtained by a ratio of an instantaneous maximum flow to an average flow; data packet feature indexes are obtained by an average packet size value, a packet size standard deviation value, and a large packet proportion value; and a data flow feature vector is obtained by combining the four indexes.

[0017] For user operation behaviors: an operation timing index is obtained by an average operation interval length and an operation interval standard deviation value; an operation type distribution index is obtained by frequency statistics of various operations; an operation coverage index is obtained by a ratio of different objects operated to a total number of system objects; an operation sequence pattern index is obtained by counting a number of times of most and least frequently occurring operation sequences; an operation complexity index is obtained by a number of operation types; and a user operation behavior feature vector is obtained by combining the five indexes.

[0018] The network access feature, the data flow feature, and the user operation behavior feature are combined to form a network security feature.

[0019] Preferably, the baseline model for predicting the network security feature according to the time information and the network environment data comprises:

[0020] Data without a security event from the historical database is screened out as normal operation data;

[0021] The normal operation data is divided into a training set and a validation set, time information and network environment data are extracted from the training set and the validation set at different time periods to construct feature vectors as model inputs, and corresponding network security features are used as model outputs;

[0022] A deep neural network architecture is used to design the baseline model, the model structure parameters are initialized, and the model hyperparameters are set;

[0023] The training set data is used for iterative training, the model prediction value is calculated by forward propagation in each iteration, the error between the prediction value and the real network security feature is calculated, the model loss is calculated based on a predefined loss function, and the model parameters are updated using the back propagation algorithm and the optimizer to minimize the loss function;

[0024] The model performance is evaluated using the validation set periodically, if the performance of the model on the validation set reaches a preset threshold, the training is completed, otherwise the hyperparameters and model structure parameters are adjusted and the training process is repeated; and finally a trained baseline model is obtained.

[0025] Preferably, the risk assessment result is generated according to the current network security feature and the expected network security feature, comprising:

[0026] The deviation degree of each dimension feature in the current network security feature and the expected network security feature is calculated, and the feature dimension whose deviation degree exceeds a preset threshold is determined;

[0027] The comprehensive risk score is obtained by weighted summation based on the size of the feature deviation of different dimensions, wherein the weights of different dimensions are set according to historical security event data;

[0028] The distribution characteristics of the feature deviation of different dimensions are analyzed, including the deviation concentration and the deviation direction;

[0029] The risk type is determined according to the distribution characteristics and a pre-established historical attack mode library;

[0030] A current risk assessment result containing the risk score and the risk type is generated.

[0031] Preferably, the deviation concentration is represented by the proportion of the deviation degree of each dimension in the total deviation degree, and the deviation direction is represented by the ratio of the deviation degree of each dimension to the deviation degrees of the other two dimensions.

[0032] Preferably, the pre-established historical attack mode library includes typical deviation distributions of different types of attacks; and the typical deviation distribution is a classified core obtained by clustering analysis on the deviation distribution corresponding to each type of attack in history.

[0033] The determining of the risk type according to the distribution feature and the pre-established historical attack mode library includes: matching a typical deviation distribution closest to the distribution feature in the historical attack mode library, and taking the attack type corresponding to the typical deviation distribution as the risk type.

[0034] Preferably, the adjusting of the data access control and encryption strategy according to the risk assessment result includes:

[0035] According to the risk score, the system security level is divided into three levels of low, medium and high, and the affected data resources are determined according to the risk type;

[0036] The dynamic adjustment of the access control strategy for the affected data resources based on the security level includes: maintaining the original strategy for the low level, increasing the authentication requirement for the medium level, and limiting the access permission and recording all operations for the high level;

[0037] The adjustment of the encryption strategy for the affected data resources according to the security level includes: keeping the existing encryption for the low level, improving the encryption strength for the medium level, and implementing multi-layer encryption and starting the data isolation mechanism for the high level.

[0038] The application also provides a network security data management system based on an AI large model, which is used to realize a network security data management method based on an AI large model, and includes:

[0039] A historical data module is configured to obtain network behavior data in history and corresponding time information and network environment data, perform feature processing on the network behavior data in time periods, obtain corresponding network security features, and form a historical database.

[0040] A model training module is configured to train a baseline model for predicting network security features according to time information and network environment data according to the historical database.

[0041] A feature acquisition module is configured to obtain real-time time information and network environment data, obtain expected network security features through the baseline model, and obtain current network security features by performing feature processing on the real-time collected network environment data.

[0042] a risk assessment module configured to generate a risk assessment result based on the current network security features and the expected network security features;

[0043] a security policy adjustment module configured to adjust the data access control and encryption policy based on the risk assessment result.

[0044] The present application provides a network security data management system and method based on AI large model, which has the following beneficial effects:

[0045] Through comprehensive feature processing of network access records, data flow features, and user operation behaviors in three dimensions, the system can comprehensively capture security-related information in the network environment. Combined with time information and network environment data, the baseline model trained can predict normal network security features based on time information and network environment data. This prediction model fully considers the time regularity and environmental dependence of network behavior, and can help distinguish between real security threats and normal business fluctuations, thereby reducing false positives and false negatives.

[0046] By comparing the actual observed network security features with the expected features predicted by the model, the system can calculate the precise degree of deviation and conduct risk assessment in combination with the historical attack pattern library. The dynamic security policy adjustment mechanism based on the risk assessment result enables the data protection measures to be flexible in response to actual threat situations. In low-risk situations, the system maintains relatively relaxed access control and encryption policies to ensure system availability and user experience; in high-risk situations, the system automatically increases security levels and implements strict access restrictions and multi-layer encryption protection. This adaptive security policy ensures data security in high-risk situations while avoiding excessive protection that affects normal system operation, achieving a balance between security and availability. BRIEF DESCRIPTION OF DRAWINGS

[0047] Figure 1 is a flowchart of a network security data management method based on an AI large model of the present application;

[0048] Figure 2 is a module diagram of a network security data management system based on an AI large model of the present application. DETAILED DESCRIPTION

[0049] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative labor fall within the scope of the present application.

[0050] Embodiment 1

[0051] Referring to Figure 1 In this embodiment, an AI large model-based network security data management method includes:

[0052] S1, historical network behavior data and corresponding time information and network environment data are obtained, the network behavior data is processed by time period to obtain corresponding network security features, and a historical database is formed;

[0053] The network environment data includes network access records, data flow characteristics, and user operation behaviors; the network access records include access users, access resources, access times, and access permissions, the data flow characteristics include flow sizes, flow directions, protocol types, and data packet characteristics, and the user operation behaviors include operation types, operation objects, operation time intervals, and operation sequence patterns;

[0054] The time information includes months, weeks, hours, and workday labels, and the network environment data includes network traffic loads, active user numbers, and external connection request frequencies.

[0055] The feature processing includes:

[0056] For network access records: the access frequency matrix of different users to each resource is counted; the access diversity index is obtained by the ratio of the number of different users accessing the resource to the total access times; the abnormal access index is obtained by weighting the access times at irregular times and the number of access times exceeding the authority; and the network access feature vector is obtained by combining the access diversity index and the abnormal access index;

[0057] For data flow characteristics: the total flow amount index is obtained by the total flow sum value; the protocol distribution entropy index is calculated by the proportion of flow of different protocol types; the flow burstiness index is obtained by the ratio of the maximum instantaneous flow to the average flow; the data packet characteristic index is obtained by the average packet size value, the packet size standard deviation value, and the large packet proportion value; and the data flow feature vector is formed by combining the above four indexes;

[0058] For user operation behaviors: the operation timing index is obtained by the average operation interval length and the operation interval standard deviation value; the operation type distribution index is obtained by the frequency statistical value of each type of operation; the operation coverage index is obtained by the ratio of the number of different objects operated to the total number of objects; the operation sequence pattern index is obtained by counting the number of times the most and least frequent operation sequences appear; the operation complexity index is obtained by the number of operation types; and the user operation behavior feature vector is formed by combining the above five indexes;

[0059] The network access features, data flow features, and user operation behavior features in three dimensions are combined to form network security features.

[0060] In this embodiment, first, network access records, data flow characteristics, and user operation behavior data are collected by network data collection devices or software, while corresponding time information and network environment data are recorded.

[0061] The access of each user to each resource is recorded, including the user ID, the accessed resource URI, the specific time when the access occurs, and the permission level the user has at the time of access. The amount of data transmitted in the network, the flow direction of the data (such as inbound or outbound), the network protocol used (such as HTTP, HTTPS, FTP, etc.), and the size distribution of the data packets are recorded by the network monitoring device. The various operations performed by the user are recorded by the terminal security agent and the application layer log, including the type of operation (such as query, modification, deletion, etc.), the object being operated (such as files, database tables, etc.), the time interval between consecutive operations, and the sequence pattern of operations.

[0062] Detailed time information and specific network environment data are marked for each piece of network behavior data to analyze the normal network behavior characteristics under different time characteristics and different network environment characteristics, providing data support for subsequent analysis of whether the actual network behavior characteristics are normal.

[0063] For the feature processing of network access records, first, the access frequency matrix of different users to each resource is counted. By analyzing this matrix, the user's regular access pattern can be found, for example, some users often access specific resources, or some resources are widely accessed. This statistics helps to establish the baseline of user access behavior, providing a reference for subsequent anomaly detection. Then, the access diversity index is calculated, which is the ratio of the number of different users accessing the resource to the total number of accesses. This index reflects the dispersion degree of resource access, which helps to identify abnormal access patterns. For example, a resource that is usually accessed by only a few users is suddenly accessed by a large number of different users, which may indicate an attack on the resource. Next, the abnormal access index is calculated, which is weighted by the number of accesses at irregular times and the number of accesses beyond the user's authority. Access at irregular times (such as non-working hours during weekdays or weekends) and access beyond the user's authority (the user's permission is lower than the required permission of the resource) are often related to unauthorized use or attack behavior, so this index can directly reflect potential security threats. Finally, the access diversity index and the abnormal access index are combined into a network access feature vector, which comprehensively reflects the security status of network access.

[0064] For the characterization of data traffic features, first, the sum of traffic values is calculated to obtain the total traffic indicator. Abnormal fluctuations in total traffic may indicate data breaches, denial-of-service attacks, or other network security issues. Then, the protocol distribution entropy indicator is calculated by the proportion of traffic of different protocol types. Protocol distribution entropy reflects the degree of dispersion of network traffic among different protocols, and sudden changes in protocol distribution may indicate changes in network behavior patterns, such as attackers using unconventional protocols for communication. Next, the traffic burstiness indicator is obtained by the ratio of instantaneous maximum traffic to average traffic. High burstiness may indicate a sudden large amount of data transmission, which may be a signal of data breaches or DDoS attacks. Finally, the packet characteristics indicator is obtained by the average packet size value, packet size standard deviation value, and large packet proportion value, and the above four indicators are combined to form a data traffic feature vector. These features can reflect the pattern of data transmission, and abnormal packet size distribution may indicate the use of covert channels or other abnormal network behavior.

[0065] For the characterization of user operation behavior, first, the operation timing indicator is obtained by the average operation interval duration and operation interval standard deviation. This indicator can reflect the user's operation rhythm, and abnormal operation rhythm may indicate the use of automated tools or unauthorized user operations. Then, the operation type distribution indicator is obtained by the frequency statistics of each type of operation. Changes in operation type distribution may reflect changes in user behavior, such as a sudden increase in delete operations, which may indicate data destruction behavior. Next, the operation coverage indicator is obtained by the ratio of different objects operated to the total number of objects. High coverage may indicate that the user is extensively exploring resources, which may be a signal of information collection or lateral movement in some cases. Then, the operation sequence pattern indicator is obtained by counting the number of occurrences of the most and least frequent operation sequences. This indicator reflects the regularity of user operations, and irregular operation sequences may indicate exploratory attack behavior. Finally, the operation complexity indicator is obtained by the number of operation types, and the above five indicators are combined to form a user operation behavior feature vector.

[0066] Finally, the network access features, data traffic features, and user operation behavior features are combined to form network security features. It comprehensively captures security-related information in the network environment from different angles. Network security features integrate static features (such as access permissions, protocol types) and dynamic features (such as access frequency, traffic burstiness, operation timing), and combine rule-based indicators and statistical-based indicators, which can effectively identify various types of network security threats, including unauthorized access, data breaches, denial-of-service attacks, internal threats, and advanced persistent threats.

[0067] S2, according to the historical database, training a baseline model for predicting network security features according to time information and network environment data;

[0068] The training of the baseline model for predicting network security features according to time information and network environment data includes:

[0069] Data without security incidents from the historical database is selected as normal operation data;

[0070] The normal operation data is divided into a training set and a validation set, from which time information and network environment data are extracted in time periods to construct feature vectors as model inputs, and corresponding network security features are used as model outputs;

[0071] A deep neural network architecture is used to design the baseline model, the model structure parameters are initialized, and the model hyperparameters are set;

[0072] The training set data is used for iterative training, in each iteration, the model prediction value is calculated by forward propagation, the error between the prediction value and the true network security feature is calculated, the model loss is calculated based on the predefined loss function, and the model parameters are updated using the backpropagation algorithm and the optimizer to minimize the loss function;

[0073] The model performance is evaluated periodically using the validation set, if the model performance on the validation set reaches the preset threshold, the training is completed, otherwise the hyperparameters and model structure parameters are adjusted and the training process is repeated; finally, the trained baseline model is obtained.

[0074] In this embodiment, first, data without security incidents from the historical database is selected as normal operation data. These data represent the behavior characteristics of the network in the normal state, which is the basis for establishing the baseline model.

[0075] The selected normal operation data is randomly divided into a training set and a validation set according to an 8:2 ratio. From these data, time information (such as month, week, hour, and whether it is a weekday) and network environment data (such as network traffic load, number of active users, and external connection request frequency) are extracted in time periods to construct feature vectors as model inputs. At the same time, the corresponding network security features (including network access features, data traffic features, and user operation behavior features) are used as model outputs. This input-output mapping relationship enables the model to learn the characteristics that normal network behavior should have under certain time and network environment.

[0076] A deep neural network architecture is used to design the baseline model. The model contains multiple fully connected layers, which can effectively capture the complex nonlinear relationship between time information and network environment data and network security features. The model structure parameters are initialized, such as the number of neurons in each layer, the type of activation function, etc., and the learning rate, batch size, number of training rounds, etc. are set as hyperparameters.

[0077] The training set data is used for iterative training. In each iteration, the model calculates the predicted network security features through forward propagation and compares them with the true network security features to calculate the prediction error. Based on a predefined loss function (such as mean square error), the model loss is calculated, then the gradient is calculated using the backpropagation algorithm, and the model parameters are updated by the optimizer (such as Adam) to minimize the loss function. This process enables the model to gradually learn the mapping relationship between time information and network environment data and network security features.

[0078] During training, the model performance is evaluated periodically using the validation set. If the model performance (such as prediction accuracy or mean square error) on the validation set reaches a pre-set threshold, the training is considered complete. If the threshold is not reached, the learning rate, batch size, and other hyperparameters are adjusted or the network structure parameters (such as the number of layers and neurons) are modified, and then the training process is repeated. This iterative optimization ensures that the model has good generalization ability and can accurately predict normal network security features under different times and network environments.

[0079] The final baseline model can predict the normal network security features that should occur under given time information and network environment data. This model captures the time regularity and environmental dependence of network behavior, such as the difference in network behavior between weekdays and weekends, or the normal behavior patterns under different network loads. By comparing the actual observed network security features with the model predicted features, potential abnormal behavior can be identified, providing important reference for network security management.

[0080] S3, obtaining real-time time information and network environment data, obtaining expected network security features through the baseline model; obtaining real-time collected network environment data, and performing feature processing to obtain current network security features;

[0081] First, automatically obtain the current time information and collect real-time network environment data,

[0082] The obtained time information and network environment data are combined to form a feature vector, which is input into the trained baseline model. The baseline model predicts the normal network security features that should occur under the current time and network environment, including expected network access features, data traffic features, and user operation behavior features. This prediction result represents the normal state under the current conditions and is an important reference benchmark for subsequent risk assessment.

[0083] Simultaneously, real-time behavioral data within the network is collected, including network access records, data traffic characteristics, and user actions. This real-time data is processed using the same feature generation methods as historical data to calculate current network access feature vectors, data traffic feature vectors, and user action behavior feature vectors, which are then combined to form the current network security feature. This feature reflects the current actual state of the network.

[0084] In this way, two sets of cybersecurity characteristics are obtained simultaneously: expected characteristics based on time and environmental predictions, and current characteristics calculated based on actual observation data. This provides the necessary data foundation for subsequent risk assessment, enabling the identification of potential anomalies and risks by comparing expected and current characteristics.

[0085] S4. Generate risk assessment results based on current and expected cybersecurity characteristics;

[0086] The process of generating risk assessment results based on current and anticipated network security characteristics includes:

[0087] Calculate the degree of deviation between the current network security characteristics and the expected network security characteristics in each dimension, and determine the characteristic dimensions whose deviation exceeds a preset threshold;

[0088] A comprehensive risk score is obtained by weighted summation based on the magnitude of feature deviations in different dimensions, where the weights of different dimensions are set according to historical security event data.

[0089] Analyze the distribution characteristics of feature deviations in different dimensions, including deviation concentration and deviation direction;

[0090] Risk types are determined based on distribution characteristics and a pre-established database of historical attack patterns.

[0091] Generate a current risk assessment result that includes a risk score and risk type.

[0092] The deviation concentration is represented by the proportion of the deviation degree in each dimension to the total deviation degree, and the deviation direction is represented by the ratio of the deviation degree in each dimension to the deviation degree in the other two dimensions.

[0093] The pre-established historical attack pattern library includes typical deviation distributions of different types of attacks; the typical deviation distributions are the classification kernels of the deviation distributions corresponding to various types of attacks in history after cluster analysis.

[0094] The step of determining the risk type based on the distribution characteristics and the pre-established historical attack pattern library includes: matching the typical deviation distribution that is closest to the distribution characteristics in the historical attack pattern library, and taking the attack type corresponding to the typical deviation distribution as the risk type.

[0095] In this embodiment, firstly, the degree of deviation between the current network security characteristics and the expected network security characteristics is calculated. Specifically, for the three dimensions of network access characteristics, data traffic characteristics, and user operation behavior characteristics, the difference between the current characteristic value and the expected characteristic value is calculated for each. Euclidean distance can be used to calculate the degree of deviation for each dimension, and the calculation results are compared with a pre-set threshold to determine which dimensions have deviations exceeding the normal range.

[0096] Then, based on the magnitude of feature deviations across different dimensions, a comprehensive risk score is calculated through a weighted summation. The weights are derived from historical security event data analysis, reflecting the degree to which different dimensional features contribute to security risk. For example, historically, when high-risk events occur, data traffic typically exhibits a higher probability of anomalies, thus warranting a higher weight.

[0097] Next, the distribution characteristics of the deviations across different dimensions are analyzed, including deviation concentration and deviation direction. Deviation concentration is calculated as the proportion of each dimension's deviation to the total deviation, reflecting whether the anomaly is concentrated in one dimension or distributed across multiple dimensions. For example, if the deviation in the network access dimension accounts for 80% of the total deviation, while the deviations in the other two dimensions are smaller, it indicates that the anomaly is mainly concentrated in network access behavior. Deviation direction is calculated as the ratio of the deviation in each dimension to the deviations in the other two dimensions, reflecting the deviation relationship between different dimensions. These distribution characteristics are crucial for identifying specific types of attacks.

[0098] Based on the calculated distribution characteristics, the most matching pattern is searched in a pre-established historical attack pattern library to determine the risk type. The historical attack pattern library contains typical deviation distributions of different attack types, obtained through cluster analysis of historical security event data. For example, DDoS attacks typically exhibit high deviation in the data traffic dimension, while insider threats may exhibit high deviation in the user behavior dimension. The similarity between the current distribution characteristics and each pattern in the library is calculated, and the attack type corresponding to the pattern with the highest similarity is selected as the current risk type.

[0099] Finally, a risk assessment result is generated, including a risk score and risk type. The risk score reflects the degree of anomaly in the current network state; a higher score indicates a greater risk. The risk type specifies the possible attack categories, such as unauthorized access, data breaches, and denial-of-service attacks.

[0100] S5. Adjust the data access control and encryption strategies based on the risk assessment results.

[0101] The adjustment of data access control and encryption strategies based on risk assessment results includes:

[0102] The system security level is divided into three levels of low, medium and high according to the risk score, and the affected data resources are determined according to the risk type;

[0103] For the affected data resources, the access control policy is dynamically adjusted based on the security level, including maintaining the original policy for the low level, increasing the authentication requirement for the medium level, and limiting the access permission and recording all operations for the high level;

[0104] For the affected data resources, the encryption policy is adjusted according to the security level, including keeping the existing encryption for the low level, increasing the encryption strength for the medium level, and implementing multi-layer encryption and starting the data isolation mechanism for the high level.

[0105] In this embodiment, the system security level is divided into three levels of low, medium and high according to the risk score. The score range corresponding to each level can be set in a way of past records and expert experience. At the same time, the affected data resources are determined according to the risk type. For example, if the risk type is unauthorized access, the resources related to user authentication are mainly affected; if the risk type is data leakage, the sensitive data storage area is mainly affected.

[0106] For the affected data resources, the access control policy is dynamically adjusted based on the security level. When the security level is low, the original access control policy is maintained. When the security level is medium, the affected resources are increased in authentication requirement, such as requiring the user to perform secondary authentication, shortening the session timeout time, increasing the verification code and other measures to improve the access threshold. When the security level is high, the access permission to the affected resources is strictly limited, only allowing necessary administrators to access, and recording all operation logs, while monitoring all access behaviors in real time.

[0107] At the same time, the encryption policy of the affected data resources is adjusted according to the security level. When the security level is low, the existing encryption method is kept unchanged, but the rotation frequency of the encryption key is increased. When the security level is medium, the encryption strength is increased, such as upgrading the encryption algorithm from AES-128 to AES-256, or increasing the encryption level. When the security level is high, multi-layer encryption protection is implemented, including transmission layer encryption, application layer encryption and storage layer encryption, and the data isolation mechanism is started, migrating high-risk data to isolated storage area and limiting exchange with other data.

[0108] Through this dynamic adjustment mechanism based on risk assessment, the data protection measures can be flexibly changed according to the actual threat situation, which not only ensures the data security in high-risk situation, but also avoids the influence on usability and user experience due to over-protection in low-risk situation. Compared with the traditional static security strategy, this dynamic adjustment mechanism can better balance security and usability, and improve the overall security protection effect.

[0109] Embodiment 2

[0110] Referring to Figure 2 The application provides an AI large model-based network security data management system for implementing an AI large model-based network security data management method, comprising:

[0111] A historical data module is configured to acquire historical network behavior data, corresponding time information and network environment data, perform feature processing on the network behavior data in time periods, obtain corresponding network security features, and form a historical database.

[0112] A model training module is configured to train a baseline model for predicting network security features according to time information and network environment data according to the historical database.

[0113] A feature acquisition module is configured to acquire real-time time information and network environment data, obtain expected network security features through the baseline model, and acquire network environment data collected in real time, perform feature processing and obtain current network security features.

[0114] A risk assessment module is configured to generate a risk assessment result according to the current network security features and the expected network security features.

[0115] A security policy adjustment module is configured to adjust data access control and encryption strategies according to the risk assessment result.

[0116] In the several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the units is only one, and actual implementation can have another division manner, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0117] The above description is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be included in the protection scope of the present application.

[0118] Finally, the above description is only a preferred embodiment of the present application, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A method for AI large model-based network security data management, characterized by, The method comprises the following steps: Obtain historical network behavior data and corresponding time information and network environment data, and perform feature processing on the network behavior data in time periods to obtain corresponding network security features and form a historical database; Combine the network access features, data flow features, and user operation behavior features in three dimensions to form corresponding network security features; Train a baseline model for predicting network security features based on time information and network environment data according to the historical database; Select data that has not occurred security events from the historical database as normal operation data; Divide the normal operation data into a training set and a validation set, extract time information and network environment data in time periods from the training set and the validation set to construct feature vectors as model inputs, and use corresponding network security features as model outputs; Design a baseline model using a deep neural network architecture, initialize model structure parameters, and set model hyperparameters; Use the training set data for iterative training, calculate the predicted value of the model through forward propagation in each iteration, calculate the error between the predicted value and the true network security features, calculate the model loss based on a predefined loss function, and update the model parameters using the backpropagation algorithm and the optimizer to minimize the loss function; Periodically evaluate the model performance using the validation set, and if the model performance on the validation set reaches a preset threshold, the training is completed, otherwise adjust the hyperparameters and model structure parameters and repeat the training process; finally, a trained baseline model is obtained; Obtain real-time time information and network environment data, and obtain the expected network security features through the baseline model; Obtain real-time network behavior data, perform feature processing to obtain the current network security features; Generate a risk assessment result based on the current network security features and the expected network security features; Generating a risk assessment result based on the current network security features and the expected network security features comprises: Calculate the deviation degree of each dimension feature in the current network security features and the expected network security features, and determine the feature dimension whose deviation degree exceeds a preset threshold; Based on the size of the feature deviation in different dimensions, a comprehensive risk score is obtained by weighted summation, wherein the weights of different dimensions are set according to historical security event data; Analyze the distribution characteristics of the feature deviation in different dimensions, including deviation concentration and deviation direction; Determine the risk type according to the distribution characteristics and a pre-established historical attack pattern library; Generate a current risk assessment result containing a risk score and a risk type; Adjust the data access control and encryption strategy according to the risk assessment result; Adjusting the data access control and encryption strategy according to the risk assessment result comprises: Divide the system security level into three levels of low, medium, and high according to the risk score, and determine the affected data resources according to the risk type; For the affected data resources, dynamically adjust the access control strategy based on the security level, including maintaining the original strategy for the low level, increasing the authentication requirement for the medium level, and limiting the access permission and recording all operations for the high level; For the affected data resources, adjust the encryption strategy according to the security level, including maintaining the existing encryption for the low level, improving the encryption strength for the medium level, and implementing multi-layer encryption and starting the data isolation mechanism for the high level.

2. The network security data management method based on an AI large model according to claim 1, characterized in that, The network behavior data includes network access records, data flow characteristics, and user operation behaviors; the network access records include access users, access resources, access times, and access permissions; the data flow characteristics include flow sizes, flow directions, protocol types, and data packet characteristics; and the user operation behaviors include operation types, operation objects, operation time intervals, and operation sequence patterns. The time information includes months, weeks, hours, and workday labels; and the network environment data includes network flow loads, active user numbers, and external connection request frequencies.

3. The network security data management method based on an AI large model according to claim 2, characterized in that, The feature processing includes: For network access records: a frequency matrix of accesses of different users to various resources is counted; an access diversity index is obtained by a ratio of a number of different users accessing a resource to a total number of accesses; an abnormal access index is obtained by weighting an access number at an irregular time and an access number exceeding a permission; and an access diversity index and an abnormal access index are combined to obtain a network access feature vector; For data flow characteristics: a flow total amount index is obtained by a flow sum value; a protocol distribution entropy index is obtained by a proportion of flow of different protocol types; a flow burstiness index is obtained by a ratio of an instantaneous maximum flow to an average flow; data packet characteristic indexes are obtained by an average packet size value, a packet size standard deviation value, and a large packet proportion value; and the four indexes are combined to form a data flow feature vector; For user operation behaviors: an operation timing index is obtained by an average operation interval length and an operation interval standard deviation value; an operation type distribution index is obtained by frequency statistical values of various operations; an operation coverage index is obtained by a ratio of different objects operated to a total number of system objects; an operation sequence pattern index is obtained by counting occurrence numbers of most and least frequent operation sequences; an operation complexity index is obtained by a number of operation types; and the five indexes are combined to form a user operation behavior feature vector.

4. The network security data management method based on an AI large model according to claim 1, characterized in that, The deviation concentration degree is represented by a proportion of a deviation degree of each dimension to a total deviation degree, and the deviation direction is represented by a ratio of a deviation degree of each dimension to deviation degrees of other two dimensions.

5. The network security data management method based on an AI large model according to claim 4, characterized in that, The pre-established historical attack pattern library includes typical deviation distributions of different types of attacks; and the typical deviation distribution is a classification core obtained by clustering analysis of historical deviation distributions corresponding to various attacks; The determination of a risk type according to the distribution characteristics and the pre-established historical attack pattern library includes: matching a typical deviation distribution closest to the distribution characteristics in the historical attack pattern library, and taking an attack type corresponding to the typical deviation distribution as the risk type.

6. An AI large model-based network security data management system for implementing an AI large model-based network security data management method according to any one of claims 1-5, characterized in that, The method includes: a historical data module configured to obtain historical network behavior data, corresponding time information, and network environment data, perform feature processing on the network behavior data in time periods, obtain corresponding network security features, and form a historical database; a model training module configured to train, according to the historical database, a baseline model for predicting network security features according to time information and network environment data; a feature acquisition module configured to obtain real-time time information and network environment data, and obtain expected network security features by using the baseline model. Obtaining network environment data collected in real time, performing feature processing to obtain current network security features; A risk assessment module is configured to generate a risk assessment result according to the current network security features and expected network security features; A security policy adjustment module is configured to adjust data access control and encryption policies according to the risk assessment result.

Images