An artificial intelligence-based system network security evaluation system and method

Abstract

The application relates to the technical field of network security, in particular to a system network security evaluation system and method based on artificial intelligence, which comprises a data acquisition unit, a data analysis unit, a security monitoring unit, a security evaluation unit and a data processing unit. Through multi-dimensional space-time feature topology mapping, probability state transition analysis and entropy weight dynamic optimization technology, accurate analysis and abnormal identification of user behavior are realized. The data analysis unit constructs a space-time feature topology structure, analyzes operation state transition probability, and calculates feature weights based on information entropy. The security monitoring unit deeply detects abnormal operations and determines the type of security risks. The security evaluation unit generates a risk rectification form and evaluates the rectification situation. The data processing unit dynamically updates the sensitive operation threshold according to the rectification feedback, forms a closed-loop optimization, and the application can effectively reduce the false positive rate, improve the detection rate of hidden attacks, has strong adaptive ability, and can discover potential threats in advance.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a system network security evaluation system and method based on artificial intelligence. Background Technology

[0002] With the rapid development of information technology, cybersecurity issues are becoming increasingly prominent. Traditional cybersecurity assessment systems mainly rely on preset rules and signature databases for security detection, which often suffers from the following problems: First, the detection rules are fixed, making it difficult to cope with constantly changing security threats; second, the false positive and false negative rates are high, affecting the assessment results; third, there is a lack of comprehensive analysis of user behavior, making it difficult to identify complex attack behaviors; and fourth, the security assessment results lack an adaptive optimization mechanism, making it difficult to adjust with changes in the environment.

[0003] In existing technologies, common cybersecurity assessment methods include rule-based assessment methods, statistical feature-based assessment methods, and simple machine learning assessment methods. Rule-based assessment methods rely on expert experience to build rule bases, making it difficult to cope with new types of attacks; statistical feature-based assessment methods only focus on surface features and have limited ability to identify covert attacks; simple machine learning assessment methods, while possessing some learning capabilities, lack a deep understanding and analysis of user behavior, and model adjustments lack feedback mechanisms.

[0004] Therefore, there is an urgent need for an assessment system and method that can deeply analyze user behavior patterns, has adaptive learning capabilities, and can accurately identify security risks. Summary of the Invention

[0005] The purpose of this invention is to provide a system network security evaluation system and method based on artificial intelligence. Through technologies such as multi-dimensional spatiotemporal feature topology mapping, probabilistic state transition analysis and entropy weight dynamic optimization, it can achieve accurate evaluation of network security status and adaptively optimize the evaluation criteria based on user feedback.

[0006] This invention proposes an artificial intelligence-based network security evaluation system, comprising:

[0007] The data acquisition unit is used to acquire user behavior data;

[0008] The data analysis unit, connected to the data acquisition unit, is used to construct a multi-dimensional spatiotemporal feature topology based on the behavioral data, analyze the user's operation state transition probability, and determine whether the user has an operation abnormality risk at the current moment based on the spatiotemporal feature topology, state transition probability and preset data analysis rules.

[0009] A safety monitoring unit, connected to the data analysis unit, is used to perform safety detection on the user's operation process when there is a risk of abnormal operation by the user at the current moment;

[0010] A safety assessment unit, connected to the safety monitoring unit, is used to issue warnings to users based on the type of potential safety hazards during user operations, generate risk rectification forms, and assess the user's rectification completion status; wherein the risk rectification form includes the type of potential hazard, rectification suggestions, and rectification completion deadline;

[0011] The data processing unit, connected to the security assessment unit and the data analysis unit, is used to update the sensitive operation thresholds based on the user's rectification completion status each time.

[0012] Preferably, the data analysis unit includes:

[0013] The feature extraction module is used to extract multi-dimensional features from the user's behavior data, including source device address, target device address, operation method, and operation type.

[0014] The topology mapping module, connected to the feature extraction module, is used to map the multidimensional features to the feature space to construct a spatiotemporal topology.

[0015] The state transition analysis module, connected to the feature extraction module, is used to construct a state transition probability matrix based on the user's continuous operation sequence.

[0016] The entropy weight optimization module, connected to the topology mapping module and the state transition analysis module, is used to calculate the information entropy of each feature and assign dynamic weights.

[0017] The risk assessment module, connected to the topology mapping module, the state transition analysis module, and the entropy weight optimization module, is used to comprehensively analyze multidimensional results and determine whether there is any risk of abnormal operation by the user at the current moment.

[0018] Preferably, the data analysis unit further includes:

[0019] The data classification unit is used to divide user behavior data into normal behavior data, operation request data and abnormal behavior data, wherein the normal behavior data is normal interaction data of completed operations;

[0020] The time feature unit is used to calculate the operation time difference based on the user's operation time;

[0021] The data fusion unit, connected to the topology mapping module, the state transition analysis module, and the time feature unit, is used to perform multi-dimensional fusion of topological features, state transition features, and time features to form a comprehensive feature vector.

[0022] Preferably, the topology mapping module includes:

[0023] A feature space construction unit is used to construct a five-dimensional feature space based on the multi-dimensional features, wherein the fifth dimension is the operation time.

[0024] The nearest neighbor relationship construction unit, connected to the feature space construction unit, is used to construct a k-nearest neighbor graph based on the distance calculation between feature vectors;

[0025] The topology feature extraction unit, connected to the nearest neighbor relationship construction unit, is used to analyze the topology of the nearest neighbor graph and extract topology invariants including the number of connected components and the number of loops.

[0026] The behavior pattern clustering unit, connected to the topology feature extraction unit, is used to cluster the topology features of historical behaviors to establish a normal behavior pattern library.

[0027] An anomaly measurement unit, connected to the behavior pattern clustering unit and the topology feature extraction unit, is used to calculate the topology deviation between new behaviors and normal behavior patterns.

[0028] Preferably, the state transition analysis module includes:

[0029] State coding unit is used to encode sensitive operation types into a finite state space;

[0030] A transition statistics unit, connected to the state encoding unit, is used to count the transition frequency between states in historical data.

[0031] A probability matrix construction unit, connected to the transition statistics unit, is used to construct a state transition probability matrix based on the transition frequency;

[0032] A sequence analysis unit, connected to the probability matrix construction unit and the state encoding unit, is used to evaluate the probability value of a new operation sequence under the state transition model.

[0033] A low-probability path identification unit, connected to the sequence analysis unit, is used to identify state transition paths with abnormally low probabilities and mark them as potential risks.

[0034] Preferably, the entropy weight optimization module includes:

[0035] Information entropy calculation unit, used to evaluate the information content and discriminative ability of each feature;

[0036] The mutual information analysis unit, connected to the information entropy calculation unit, is used to calculate the redundancy between features;

[0037] The weight allocation unit, connected to the information entropy calculation unit and the mutual information analysis unit, is used to assign differentiated weights to different features;

[0038] A dynamic adjustment unit, connected to the weight allocation unit, is used to dynamically adjust feature weights based on system security status and historical feedback.

[0039] The decision fusion unit, connected to the dynamic adjustment unit, is used to integrate multi-source analysis results based on weighted features to form the final risk assessment result.

[0040] Preferably, the safety monitoring unit includes:

[0041] The log detection module is used to obtain user operation logs;

[0042] The log analysis module, connected to the log detection module, is used to determine that there is a vulnerability in the user's operation process and generate vulnerability warning information when the operation log meets the preset log vulnerability judgment rules.

[0043] The operation record module is used to acquire the user's operation record and convert the operation record into an operation record chart.

[0044] The hazard judgment module, connected to the operation record module, is used to determine the type of operation with potential hazard by the user based on the operation record chart and topology analysis results, and to construct a hazard judgment model based on the type of operation with potential hazard.

[0045] The vulnerability patching module, connected to the log analysis module and the vulnerability assessment module, is used to patch the vulnerabilities corresponding to the operation log when there are security risks in the operation process.

[0046] Preferably, the vulnerability patching module performs a patching completion test after patching the vulnerability, including:

[0047] The first test unit is used to determine whether the user's operation log has been repaired;

[0048] A path analysis unit is connected to the first test unit and is used to obtain operation records that maliciously modify the operation log when the operation log is detected to be unrepaired, and to determine the modification path of the operation log.

[0049] The rule application unit, connected to the modification path analysis unit, is used to obtain the log vulnerability judgment rules for the corresponding vulnerability patching location, and modify the vulnerability at the vulnerability patching location through the modification path;

[0050] The repair verification unit, connected to the rule application unit, is used to perform a repair completion test on the repaired operation log to determine whether the repair is complete.

[0051] Preferably, the data processing unit includes:

[0052] The rectification data acquisition module is used to obtain the rectification completion status of each user.

[0053] The credibility calculation module is connected to the rectification data acquisition module and is used to calculate the credibility of each sensitive operation threshold update data of the user.

[0054] The weight allocation module, connected to the credibility calculation module, is used to obtain the weight of the threshold for each sensitive operation by the user;

[0055] The threshold update module, connected to the weight allocation module and the credibility calculation module, is used to calculate the weighted credibility of the sensitive operation threshold update based on the credibility of each sensitive operation threshold and the weight of each sensitive operation threshold, and generate the updated sensitive operation threshold based on the weighted credibility.

[0056] Artificial intelligence-based system cybersecurity assessment methods include:

[0057] Obtain user behavior data;

[0058] Constructing a multidimensional spatiotemporal feature topology based on the behavioral data includes: extracting multidimensional features including source device address, target device address, operation mode and operation type, and mapping the multidimensional features to the feature space to construct a spatiotemporal topology structure;

[0059] Analyze the state transition probability of user operations, including: encoding sensitive operation types into a finite state space, statistically analyzing the transition frequency between states in historical data, and constructing a state transition probability matrix;

[0060] The dynamic weights of each feature are calculated based on the information entropy of the feature.

[0061] Based on the spatiotemporal topology, the state transition probability, the dynamic weight, and the preset data analysis rules, determine whether there is a risk of abnormal operation by the user at the current moment;

[0062] When there is a risk of abnormal operation by the user at the current moment, a security check is performed on the user's operation process;

[0063] When a user's operation process has security risks, the system will issue a warning to the user based on the type of risk, generate a risk rectification form, and evaluate the user's rectification completion status. The risk rectification form includes the type of risk, rectification suggestions, and rectification completion deadline.

[0064] The threshold for sensitive operations is updated based on the user's completion of each rectification.

[0065] The present invention has the following beneficial effects:

[0066] 1. Through a multi-dimensional spatiotemporal feature topology mapping mechanism, it can capture user behavior patterns from the perspective of spatial structure, effectively identify structural anomalies that are difficult to detect by traditional methods, and is particularly suitable for the detection of advanced persistent threats (APTs) in complex network environments.

[0067] 2. By adopting a probabilistic state transition analysis framework, we can deeply explore the probabilistic characteristics of user operation sequences, identify low-probability abnormal paths, and significantly improve the detection rate of covert attacks. Experiments show that the detection rate of covert attacks is improved by about 35%.

[0068] 3. An entropy weight dynamic optimization mechanism is introduced to automatically adjust the weights based on the information content of the features, thereby reducing the false alarm rate. Actual deployment tests show that the false alarm rate is reduced by about 45% compared to traditional rule-based systems.

[0069] 4. By using a sensitive operation threshold update mechanism driven by user feedback, a closed-loop optimization is formed, enabling the system to learn and adapt on its own, thus solving the problem of performance degradation of traditional systems over time.

[0070] 5. The multi-dimensional collaborative analysis method provides a more comprehensive security situation awareness capability, and on average can detect potential threats 12 to 24 hours earlier than traditional systems, providing security teams with more time to respond. Attached Figure Description

[0071] Figure 1 This is an overall architecture diagram of a system network security evaluation system based on artificial intelligence, as proposed in this invention.

[0072] Figure 2 This is an internal structural diagram of the data analysis unit of the present invention.

[0073] Figure 3 This is a flowchart of the multidimensional spatiotemporal feature topology mapping module of the present invention.

[0074] Figure 4 This is a flowchart of the probabilistic state transition analysis module of the present invention.

[0075] Figure 5 This is a flowchart of the entropy weight dynamic optimization module of the present invention.

[0076] Figure 6 This is an internal structural diagram of the safety monitoring unit of the present invention.

[0077] Figure 7 This is an internal structural diagram of the data processing unit of the present invention.

[0078] Figure 8 This is a flowchart of a system network security evaluation method based on artificial intelligence according to the present invention. Detailed Implementation

[0079] Please refer to Figure 1 - Figure 8 The preferred embodiments of the present invention will now be described in detail with reference to the accompanying drawings. It should be understood that the preferred embodiments described herein are for illustration and explanation only and are not intended to limit the scope of the invention.

[0080] Reference Figure 1 The present invention provides a system network security evaluation system based on artificial intelligence, including a data acquisition unit 100, a data analysis unit 200, a security monitoring unit 300, a security evaluation unit 400, and a data processing unit 500.

[0081] The data acquisition unit 100 is used to acquire user behavior data. In one embodiment of the present invention, the user behavior data includes, but is not limited to, user access records of system resources, network connection records, file operation records, login and logout records, etc. The data acquisition unit 100 can collect user behavior data through various methods such as system logs, network traffic capture, and terminal proxies.

[0082] The data analysis unit 200 is connected to the data acquisition unit 100 and is used to construct a multi-dimensional spatiotemporal feature topology based on the behavioral data, analyze the probability of user operation state transitions, and determine whether there is a risk of abnormal operation by the user at the current moment according to the spatiotemporal feature topology, state transition probabilities, and preset data analysis rules. The data analysis unit 200 is the core innovative module of this system, which achieves accurate identification of abnormal behavior through multi-dimensional feature analysis and deep behavioral pattern mining.

[0083] The safety monitoring unit 300 is connected to the data analysis unit 200 and is used to perform safety checks on the user's operation process when there is a risk of abnormal operation at the current moment. Once the data analysis unit 200 determines that there is a risk of abnormal operation by the user, the safety monitoring unit 300 initiates a deep detection process to further confirm the safety hazards.

[0084] The safety assessment unit 400 is connected to the safety monitoring unit 300. It is used to issue warnings to users based on the type of potential safety hazards during user operations, generate risk rectification forms, and assess the user's rectification progress. The risk rectification form includes the hazard type, rectification suggestions, and a rectification completion deadline. The safety assessment unit 400 converts the detection results into actionable rectification suggestions and tracks the rectification progress.

[0085] The data processing unit 500 is connected to the security assessment unit 400 and the data analysis unit 200, and is used to update the sensitive operation thresholds based on the user's rectification completion status each time. The data processing unit 500 forms a closed-loop optimization through rectification feedback, enabling the system to have adaptive learning capabilities.

[0086] Reference Figure 2 The data analysis unit 200 includes a feature extraction module 210, a topology mapping module 220, a state transition analysis module 230, an entropy weight optimization module 240, and a risk assessment module 250.

[0087] The feature extraction module 210 is used to extract multi-dimensional features from the user's behavior data, including source device address, target device address, operation method, and operation type. In one embodiment of the present invention, the feature extraction module 210 further includes a data classification unit 211, used to classify the user's behavior data into normal behavior data, operation request data, and abnormal behavior data, wherein the normal behavior data is normal interaction data of completed operations. Furthermore, the feature extraction module 210 also includes a time feature unit 212, used to calculate the operation time difference based on the user's operation time. The operation time difference refers to the time interval between adjacent operations on the same device and is an important feature for identifying abnormal behavior.

[0088] The topology mapping module 220 is connected to the feature extraction module 210 and is used to map the multidimensional features to the feature space to construct a spatiotemporal topology. The topology mapping module 220 is one of the important innovations of this invention, as it analyzes the structural characteristics of user behavior from a topological perspective.

[0089] The state transition analysis module 230 is connected to the feature extraction module 210 and is used to construct a state transition probability matrix based on the user's continuous operation sequence. State transition analysis characterizes the sequence characteristics of user operations from a probabilistic perspective and can detect abnormal operation paths.

[0090] The entropy weight optimization module 240 is connected to the topology mapping module 220 and the state transition analysis module 230, and is used to calculate the information entropy of each feature and assign dynamic weights. Entropy weight optimization is another innovation of this system, which assigns optimal weights to features based on the principles of information theory.

[0091] The risk assessment module 250 is connected to the topology mapping module 220, the state transition analysis module 230, and the entropy weight optimization module 240 to integrate multi-dimensional analysis results and determine whether there is any operational anomaly risk for the user at the current moment. The risk assessment module 250 integrates multiple analysis results to form the final risk assessment conclusion.

[0092] In addition, the data analysis unit 200 also includes a data fusion unit 260, which is connected to the topology mapping module 220, the state transition analysis module 230, and the time feature unit 212. This fusion unit is used to perform multi-dimensional fusion of topological features, state transition features, and time features to form a comprehensive feature vector. Data fusion is a crucial step in multi-dimensional anomaly detection; by fusing features from different dimensions, the comprehensiveness and accuracy of the detection are improved.

[0093] Reference Figure 3The topology mapping module 220 includes a feature space construction unit 221, a nearest neighbor relationship construction unit 222, a topology feature extraction unit 223, a behavior pattern clustering unit 224, and an anomaly measurement unit 225.

[0094] The feature space construction unit 221 is used to construct a five-dimensional feature space based on the multi-dimensional features, where the fifth dimension is operation time. In a preferred embodiment of the present invention, the feature space construction unit 221 first performs standardization processing on the features of each dimension to eliminate the influence of dimensions. The standardization processing can adopt the following formula:

[0095] ,

[0096] in, These are the standardized eigenvalues. These are the original eigenvalues. and These are the minimum and maximum values ​​of the feature, respectively. For example, if the timestamp of an operation is 1626782400 seconds (July 20, 2021, 10:00:00), and the minimum value of this feature in the dataset is 1626739200 seconds (July 20, 2021, 00:00:00), and the maximum value is 1626825600 seconds (July 21, 2021, 00:00:00), then the standardized value is... .

[0097] For non-numerical features such as IP addresses, they are first converted into numerical representations using a mapping function. For example, network topology distance or geographical location information can be used for encoding. Preferably, IP addresses can be converted into network distances, such as calculating relative distances based on the mask matching degree of IP addresses. IP addresses in the same subnet are closer together, while those in different subnets are farther apart.

[0098] The nearest neighbor construction unit 222 is connected to the feature space construction unit 221 and is used to construct a k-nearest neighbor graph based on the distance calculation between feature vectors. In one embodiment of the present invention, the distance calculation uses weighted Euclidean distance:

[0099] ,

[0100] in, Representing the eigenvector and The distance between them It is the weight of the k-th dimension. and They are vectors and In the k-th dimension, 5 represents the number of dimensions of the feature (source device address, target device address, operation method, operation type, and operation time). In the initial stage, the weights of each dimension can be set to be equal, such as 0.2 for all. As the system runs, these weights will be dynamically adjusted by the entropy weight optimization module 240.

[0101] The nearest neighbor graph is constructed using the k-nearest neighbor method, that is, for each operation point... The process involves identifying the k nearest neighbors of a network. The choice of k is crucial; too large a value leads to increased noise, while too small a value may result in the loss of critical connections. Preferably, k is set to an integer between 5 and 15, depending on the network size and number of users. For example, in a medium-sized enterprise network with 100 active users, k could be set to 10, while in a large network with over 1000 users, k could be increased to 15.

[0102] The topology feature extraction unit 223 is connected to the nearest neighbor relationship construction unit 222, and is used to analyze the topology of the nearest neighbor graph and extract topology invariants, including the number of connected components and the number of cycles. Topology invariants are properties of the topological space that remain unchanged under continuous transformations, and are important indicators for characterizing the essential features of behavioral patterns.

[0103] In one embodiment of the present invention, topological feature extraction mainly focuses on the following types of topological invariants:

[0104] (1) Number of connected components: This represents the number of interconnected subgraphs in the nearest neighbor graph, reflecting the clustering of operations. Normal user operations usually form a small number of connected components, while abnormal behavior may manifest as isolated operation points or abnormal connectivity patterns.

[0105] (2) Betti numbers: These represent the number of holes in different dimensions. Zero-dimensional Betti numbers equal the number of connected components, one-dimensional Betti numbers represent the number of loops, and two-dimensional Betti numbers represent the number of cavities. These metrics can capture the complex topological structure of behavioral patterns.

[0106] (3) Continuous homology features: By constructing simple complexes under different distance thresholds, the birth and death of topological features are analyzed to form a continuous barcode, which characterizes the stability of topological features.

[0107] The calculation of these topological features can be achieved using computational topology tools. For example, for a typical user action sequence, the system may extract 3 connected components and 2 one-dimensional Betty numbers (loops), indicating that the user action contains 3 relatively independent action clusters and 2 cyclic action patterns.

[0108] The behavior pattern clustering unit 224 is connected to the topology feature extraction unit 223, and is used to cluster the topology features of historical behaviors to establish a normal behavior pattern library. In one embodiment of the present invention, the clustering adopts a density clustering algorithm, which can discover clusters of arbitrary shapes and handle noise points. The clustering distance threshold can be determined based on historical data statistics, for example, taking the 85th percentile of the feature distance distribution as the threshold, preferably in the range of 0.15-0.25.

[0109] Anomaly measurement unit 225 is connected to behavior pattern clustering unit 224 and topology feature extraction unit 223, and is used to calculate the topology deviation between new behavior and normal behavior patterns. In one embodiment of the present invention, the topology deviation measurement can be expressed as:

[0110] ,

[0111] in, Indicates new behavior Set of normal behavioral patterns Topological deviation, This represents the i-th pattern center in the set of normal behavior patterns. This represents the distance in the topological feature space. Specifically, Euclidean distance or Mahalanobis distance can be used as the metric.

[0112] When the topology deviation exceeds a preset threshold, a potential anomaly is considered to exist. The threshold can be determined through historical data analysis, preferably the mean distance within normal behavior patterns plus 2-3 times the standard deviation. The specific threshold can be adjusted according to the stringency of the security policy. For example, for high-security financial systems, 2 times the standard deviation can be used as the threshold; for general enterprise networks, 3 times the standard deviation can be used.

[0113] Reference Figure 4 The state transition analysis module 230 includes a state encoding unit 231, a transition statistics unit 232, a probability matrix construction unit 233, a sequence analysis unit 234, and a low-probability path identification unit 235.

[0114] State encoding unit 231 is used to encode sensitive operation types into a finite state space. In one embodiment of the invention, the state space is defined as a combination of operation type and target resource. For example, read-configuration file, modify-user permission, delete-system log, etc. For a typical enterprise network, the state space size is typically between 50 and 200 states, depending on the system complexity and the granularity of the security policy.

[0115] The transition statistics unit 232 is connected to the state encoding unit 231 and is used to count the transition frequency between states in historical data. For each pair of states (i,j), the number of times the state i directly transitions to state j is recorded, forming a transition frequency matrix F. Preferably, to avoid data sparsity problems, a time window mechanism can be used, such as considering only the data of the most recent 90 days, and using smoothing techniques to process low-frequency transitions.

[0116] The probability matrix construction unit 233 is connected to the transition statistics unit 232 and is used to construct the state transition probability matrix based on the transition frequency. The formula for calculating the state transition probability matrix P is:

[0117] ,

[0118] in, Let represent the conditional probability of transitioning from state i to state j. This represents the frequency of historical transitions from state i to state j, where n is the size of the state space. This represents the total number of transitions starting from state i. For example, if the historical number of transitions from state "Query - User Information" to state "Modify - User Permissions" is 10, and the total number of transitions starting from "Query - User Information" is 100, then the probability of this transition is 0.1.

[0119] To address the issue of data sparsity, Laplace smoothing can be used:

[0120] ,

[0121] in, Let represent the conditional probability of transitioning from state i to state j. This represents the frequency of historical transitions from state i to state j, where n is the size of the state space. For smoothing parameters, the preferred range is 0.1-1.0. For systems with sufficient data, a smaller value such as 0.1 can be used; for new systems with less data, a larger value such as 0.5-1.0 can be used.

[0122] The sequence analysis unit 234 is connected to the probability matrix construction unit 233 and the state encoding unit 231, and is used to evaluate the probability values ​​of a new operation sequence under the state transition model. Given an operation sequence... The probability is calculated as follows:

[0123] ,

[0124] in, Let S represent the probability of sequence S. Initial state The probability of this can be determined by the frequency of each state in historical data. For the state transition probability matrix, from state to state The transition probability, where m represents the sequence length. This indicates a series multiplication operation.

[0125] Considering that the probability value of long sequences may be very small, logarithmic form is often used in actual calculations:

[0126] ,

[0127] in, The natural logarithm of the probability of sequence S. Represents the initial state natural logarithm of probability The natural logarithm of the state transition probability. This indicates a summation operation.

[0128] The low-probability path identification unit 235 is connected to the sequence analysis unit 234 and is used to identify state transition paths with abnormally low probabilities and mark them as potential risks. In one embodiment of the present invention, low-probability paths can be identified by the following method:

[0129] (1) Single-step transition probability threshold: If a certain transition step Below the threshold If so, it is marked as an exception. The preferred value is 0.01-0.05, adjusted according to the strictness of the security policy. For example, if the probability of a user directly moving from "Query - Financial Data" to "Delete - Audit Log" is 0.003, which is lower than the threshold of 0.01, it is marked as an abnormal transfer.

[0130] (2) Sequence probability normalization: Calculate the geometric mean of the sequence probabilities:

[0131] ,

[0132] like Below the threshold If it is, then it is marked as an exception. The geometric mean of the probabilities of sequence S. This represents an exponential function with base e. Indicates the sequence length. The natural logarithm of the probability of sequence S. The sequence probability threshold is preferably 0.1-0.2.

[0133] (3) Context-dependent evaluation: Considering longer operational contexts, such as triplet transition models, calculate This further improves the accuracy of anomaly detection. Among other things, This indicates that the first two states are known. and Under the given conditions, the next state is The conditional probability.

[0134] Reference Figure 5 The entropy weight optimization module 240 includes an information entropy calculation unit 241, a mutual information analysis unit 242, a weight allocation unit 243, a dynamic adjustment unit 244, and a decision fusion unit 245.

[0135] The information entropy calculation unit 241 is used to evaluate the information content and discriminative ability of each feature. In one embodiment of the present invention, the information entropy of feature j is calculated as follows:

[0136] ,

[0137] in, Information entropy of features, Let j be the probability distribution of feature j at the i-th value. For the sample size, Represents the natural logarithm function. This represents a summation operation. For example, if the "Operation Type" feature has three values: "Read," "Modify," and "Delete," and their frequencies in the sample are 0.5, 0.3, and 0.2 respectively, then the information entropy of this feature is... .

[0138] probability distribution Estimation via eigenvalue frequency:

[0139] ,

[0140] in, This represents the probability of feature j at the i-th value. Let the value of feature j on the i-th sample be normalized appropriately. This represents the sum of all values ​​that feature j can take.

[0141] The mutual information analysis unit 242 is connected to the information entropy calculation unit 241 and is used to calculate the redundancy between features. In one embodiment of the present invention, the mutual information between feature i and feature j is calculated as follows:

[0142] ,

[0143] in, Representation of features and Mutual information between them yes Values and Values The joint probability distribution and They are Values and Values Marginal probability distribution Represents the logarithmic function (usually base 2). Indicates to Sum of all possible values, Indicates to The summation of all possible values ​​is calculated. A higher mutual information value indicates greater redundancy between the two features. For example, there may be high mutual information between the features "source IP address" and "user ID" because a user typically uses a fixed IP address.

[0144] The weight allocation unit 243 is connected to the information entropy calculation unit 241 and the mutual information analysis unit 242, and is used to assign differentiated weights to different features. In a preferred embodiment of the present invention, the weight calculation comprehensively considers information entropy and mutual information:

[0145] ,

[0146] in, The weights of feature j The normalized information entropy, This is the normalized value of the average mutual information between feature j and other features. For the total number of features, This represents summing over all features. and The calculation is as follows:

[0147] ,

[0148] ,

[0149] in, The normalized information entropy of feature j is represented. Let the information entropy of feature j be , This represents the maximum value of information entropy among all features; The normalized average mutual information of feature j is represented. This represents the average mutual information between feature j and all other features. This represents the maximum average mutual information among all features. This formula ensures that features with high information content (low entropy) and low redundancy with other features receive higher weights.

[0150] The dynamic adjustment unit 244 is connected to the weight allocation unit 243 and is used to dynamically adjust the feature weights based on the system security status and historical feedback. In one embodiment of the present invention, the dynamic adjustment employs the following strategy:

[0151] ,

[0152] ,

[0153] in, The updated weights for feature j Let the current weight of feature j be , This is the weight adjustment amount. The learning rate (preferred range 0.01-0.1) The detection accuracy is when only feature j is used. This represents the average detection accuracy across all features. This mechanism enhances the weights of well-performing features and suppresses the weights of poorly performing features. For example, if the detection accuracy of the operation time feature is 0.85, and the average accuracy of all features is 0.7, with a learning rate of 0.05 and a current weight of 0.2, then the weight adjustment would be 0.05 × (0.85 - 0.7) × 0.2 = 0.0015, and the updated weight would be 0.2 + 0.0015 = 0.2015.

[0154] The decision fusion unit 245 is connected to the dynamic adjustment unit 244 and is used to integrate multi-source analysis results based on weighted features to form a final risk assessment result. In one embodiment of the present invention, the decision fusion adopts a weighted voting mechanism:

[0155] ,

[0156] Where Risk is the final risk assessment value, and its value ranges from [0,1]. These represent the risk assessment values ​​for topology analysis, state transition analysis, and time characteristic analysis, respectively, and are all values ​​within the range of [0,1]. Let be the weighting coefficients for each analytical method, satisfying This represents the summation over three analysis methods. Initial settings can be configured. The results will be dynamically adjusted based on the performance of each method.

[0157] When Risk exceeds the preset threshold When the threshold is within the preferred range of 0.6-0.8, the system determines that the user's operation poses a risk of abnormality at the current moment. The threshold can be adjusted according to the strictness of the security policy; for example, it can be set to 0.6 for financial systems and 0.75 for general enterprise networks.

[0158] Reference Figure 6The security monitoring unit 300 includes a log detection module 310, a log analysis module 320, an operation record module 330, a hidden danger judgment module 340, and a vulnerability patching module 350.

[0159] The log detection module 310 is used to acquire user operation logs. Operation logs are an important data source for system security analysis, containing detailed records of user operations. The log detection module 310 acquires various types of system logs through the security log interface, including but not limited to system logs, application logs, and security logs.

[0160] The log analysis module 320 is connected to the log detection module 310 and is used to determine that the user's operation process has vulnerabilities when the operation log meets the preset log vulnerability judgment rules, and to generate vulnerability warning information. The log vulnerability judgment rules are a set of pre-defined pattern matching rules used to identify abnormal patterns in the logs. For example, missing log entries, abnormal timestamps, abnormal permission changes, etc.

[0161] The operation record module 330 is used to acquire the user's operation records and convert the operation records into an operation record chart. The operation record chart is a visual representation of the user's operation sequence, which facilitates the detection of abnormal operation patterns. In one embodiment of the present invention, the operation record chart can be represented as a directed graph, where nodes represent operations, edges represent the temporal relationships between operations, and the attributes of nodes and edges represent the detailed characteristics of the operations.

[0162] The hazard assessment module 340 is connected to the operation record module 330 and is used to determine the type of user operation with potential safety hazards based on the operation record charts and topology analysis results, and to construct a hazard assessment model based on the type of operation with potential safety hazards. The hazard assessment model, combined with the characteristics of the operation record charts and the topology analysis results provided by the data analysis unit, further assesses the safety hazards during the operation process.

[0163] The vulnerability patching module 350 is connected to the log analysis module 320 and the potential security vulnerability assessment module 340, and is used to patch the vulnerabilities corresponding to the operation log when security vulnerabilities exist in the operation process. Vulnerability patching is an important measure to prevent the expansion of security vulnerabilities.

[0164] According to claim 8, after patching the vulnerability, the vulnerability patching module 350 performs a patching completion test on the patching process, including a first test unit 351, a modification path analysis unit 352, a rule application unit 353, and a repair verification unit 354.

[0165] The first test unit 351 is used to determine whether the user's operation log has been repaired. The judgment criteria include log integrity, continuity, and consistency checks.

[0166] The modification path analysis unit 352 is connected to the first testing unit 351 and is used to obtain operation records of malicious modifications to the operation log when the operation log is detected to be unrepaired, and to determine the modification path of the operation log. The modification path is the sequence of operations by which a malicious operator tampered with the log; by analyzing the modification path, the repair location can be accurately located.

[0167] The rule application unit 353 is connected to the modification path analysis unit 352, and is used to obtain the log vulnerability judgment rules for the corresponding vulnerability patching location, and modify the vulnerability at the vulnerability patching location through the modification path. In one embodiment of the present invention, the log vulnerability judgment rules include regular expression matching rules, integrity verification rules, time series rules, etc.

[0168] The repair verification unit 354 is connected to the rule application unit 353 and is used to perform a repair completion test on the repaired operation log to determine whether the repair is complete. The repair verification adopts multi-angle detection, including integrity verification, consistency verification, and functional verification.

[0169] Reference Figure 7 The data processing unit 500 includes a rectification data acquisition module 510, a credibility calculation module 520, a weight allocation module 530, and a threshold update module 540.

[0170] The rectification data acquisition module 510 is used to acquire the rectification completion status of each user. The rectification completion status includes indicators such as rectification status (completed / incomplete), rectification quality score, and rectification timeliness.

[0171] The credibility calculation module 520 is connected to the rectification data acquisition module 510 and is used to calculate the credibility of each sensitive operation threshold update data of the user. Credibility calculation is an important mechanism for evaluating the reliability of threshold updates. In one embodiment of the present invention, the credibility calculation uses the following formula:

[0172] ,

[0173] in, The confidence level of the i-th threshold update is defined, with a value ranging from [0,1]. The rectification quality score is given (between 0 and 1). Timeliness rating (between 0 and 1) For consistency score (between 0 and 1), , and For the weighting coefficients, satisfying The preferred setting is... , , It emphasizes the importance of rectification quality in credibility assessment.

[0174] For example, if a rectification effort receives a quality score of 0.8 (indicating good rectification results), a timeliness score of 0.9 (indicating timely completion of rectification), and a consistency score of 0.7 (indicating good consistency with the system security policy), then the reliability of this threshold update is: This indicates a high degree of credibility.

[0175] The weight allocation module 530 is connected to the credibility calculation module 520 and is used to obtain the weight of the threshold for each sensitive operation by the user. In one embodiment of the present invention, the weight allocation adopts a time decay model:

[0176] ,

[0177] in, The weights for the i-th threshold update, The base of the natural logarithm is approximately 2.718. The attenuation coefficient (preferred range 0.01-0.1) The current time (usually in days). The time (in days) for the i-th threshold update. Decay coefficient. The choice depends on the rate of change of the system's security environment. For rapidly changing environments, a larger value, such as 0.1, can be used, while for stable environments, a smaller value, such as 0.01, can be used.

[0178] For example, if the current date is July 15, 2023, and a threshold update occurred on July 10, 2023 (i.e., 5 days ago), the decay coefficient... If we set it to 0.05, then the weight for this update is... This indicates that the update still has high reference value.

[0179] The threshold update module 540 is connected to the weight allocation module 530 and the credibility calculation module 520. It is used to calculate a weighted credibility of the sensitive operation threshold update based on the credibility of each sensitive operation threshold and the weight of each sensitive operation threshold, and to generate an updated sensitive operation threshold based on the weighted credibility. In one embodiment of the present invention, the weighted credibility is calculated as follows:

[0180] ,

[0181] Where WTrust is the weighted confidence level, with a value range of [0,1]. The weights for the i-th threshold update are: Let be the confidence level of the i-th threshold update. This represents the number of times the historical threshold has been updated. This indicates that all historical threshold updates are summed.

[0182] Based on weighted confidence, the new threshold is calculated using a linear combination:

[0183] ,

[0184] in, For the updated threshold, The baseline threshold (usually set by the system's initial configuration or security policy), This is a threshold recommended based on the rectification progress. When the weighted confidence level is high, the new threshold is closer to the recommended threshold; when the weighted confidence level is low, the new threshold is closer to the baseline threshold, ensuring system stability.

[0185] For example, if the baseline threshold for a certain type of operation is 0.75 (meaning that a risk score exceeding 0.75 is considered abnormal), and the recommended threshold based on the rectification situation is 0.65 (meaning that it is recommended to lower the threshold to improve detection sensitivity), and the weighted confidence level is 0.8, then the updated threshold is (1-0.8)×0.75+0.8×0.65=0.15+0.52=0.67, achieving a smooth transition of the threshold.

[0186] Reference Figure 8 The present invention also provides a system network security evaluation method based on artificial intelligence, comprising the following steps:

[0187] Step S1: Obtain user behavior data. This step uses various data collection methods to obtain user behavior data within the system, including login records, resource access records, and operation command records.

[0188] Step S2: Construct a multidimensional spatiotemporal feature topology based on the behavioral data. This step includes: extracting multidimensional features including source device address, target device address, operation mode, and operation type, and mapping the multidimensional features to the feature space to construct a spatiotemporal topology structure.

[0189] Multidimensional feature extraction is the foundation of the analysis. This method extracts features from four key dimensions: source device address (such as user IP or device ID), target device address (the address of the accessed server or resource), operation method (such as read, modify, delete, etc.), and operation type (such as file operation, permission change, network connection, etc.).

[0190] The innovative aspect of this method lies in its spatiotemporal feature topology construction, which analyzes the structural characteristics of user behavior using topological methods. First, a five-dimensional feature space is constructed (four basic dimensions plus a time dimension). Then, a nearest neighbor graph is built based on feature vector distances. Finally, topological features such as the number of connected components and loops are extracted as topological invariants. These topological features effectively capture the structural patterns of user behavior.

[0191] Step S3: Analyze the state transition probabilities of user operations. This step includes: encoding sensitive operation types into a finite state space, statistically analyzing the transition frequencies between states in historical data, and constructing a state transition probability matrix.

[0192] State transition analysis describes the characteristics of user operation sequences from a probabilistic perspective. First, the operation type and target resource combination are defined as operation states. Then, the transition frequency between states is statistically analyzed from historical data to construct a transition probability matrix. For a new operation sequence, its probability under this model is calculated, and transition paths with abnormally low probabilities are identified as potential risks.

[0193] Step S4: Calculate the dynamic weights of each feature based on the information entropy of the features. This step uses information theory principles to assign optimal weights to the features, making the detection more accurate.

[0194] Information entropy calculation is a key method for evaluating feature importance. First, the information entropy of each feature is calculated to quantify its information content; then, the mutual information between features is analyzed to avoid redundancy; finally, these two aspects are combined to assign dynamic weights to the features. This weight allocation mechanism based on information theory can automatically highlight key features and suppress secondary features.

[0195] Step S5: Based on the spatiotemporal topology, the state transition probability, the dynamic weight, and the preset data analysis rules, determine whether there is a risk of abnormal operation by the user at the current moment.

[0196] This step integrates the results of multi-dimensional analysis to form a comprehensive risk assessment. First, the results of each analysis are dynamically weighted, and then combined with preset rules for judgment. These preset rules include expert knowledge and historical experience, providing a benchmark for anomaly detection. Finally, if the comprehensive risk score exceeds a threshold, it is determined that the user is at risk of operational anomalies at that moment.

[0197] Step S6: If there is a risk of abnormal operation by the user at the current moment, perform a security check on the user's operation process.

[0198] Security testing involves in-depth verification of abnormal risks, encompassing both log inspection and operation record analysis. Log inspection checks operation logs for vulnerabilities using pre-defined rules; operation record analysis transforms user actions into visual charts and, combined with data analysis results, determines the type of vulnerability.

[0199] Step S7: When there is a security risk in the user's operation process, issue a warning to the user according to the type of risk, generate a risk rectification form, and evaluate the user's rectification completion status; wherein the risk rectification form includes the type of risk, rectification suggestions, and rectification completion deadline.

[0200] This step transforms the detection results into actionable corrective measures. Targeted warnings are generated based on the type of hazard, along with a risk rectification form containing specific suggestions. For example, for hazards related to abuse of permissions, suggestions might include adjusting user permission scopes or adding approval processes for sensitive operations. The rectification completion timeframe is set based on the severity of the hazard, typically ranging from 1 to 14 days. The system also tracks the rectification progress and evaluates the completion status.

[0201] Step S8: Update the sensitive operation threshold based on the user's rectification completion status each time.

[0202] This step forms a feedback loop, enabling the system to adapt. The system calculates credibility based on the completion status of rectification (such as completion quality and timeliness), and updates the sensitive operation thresholds by incorporating time decay weights. This dynamic threshold adjustment mechanism allows the system to adapt to changes in the network environment and user behavior, maintaining detection accuracy.

[0203] The network security evaluation system and method of this invention achieve accurate evaluation of network security status through innovative technologies such as multi-dimensional spatiotemporal feature topology mapping, probabilistic state transition analysis, and entropy weight dynamic optimization. The system can deeply analyze user behavior patterns from both spatial structure and time series dimensions, effectively identifying concealed abnormal behaviors. Simultaneously, through closed-loop optimization driven by rectification feedback, the system possesses adaptive learning capabilities, enabling continuous optimization of the evaluation standards.

[0204] In practical applications, this system exhibits a lower false alarm rate, higher detection accuracy, and stronger adaptability compared to traditional methods. For example, in a real-world deployment test at a financial institution, the system's false alarm rate was reduced by approximately 45% compared to traditional rule-based systems, its detection rate of covert attacks was increased by approximately 35%, and it was able to detect potential threats on average 12 to 24 hours earlier than traditional systems. These advantages provide more effective technical support for network security protection.

[0205] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of the present invention should be included within the scope of protection of the present invention.

Claims

1. An artificial intelligence-based system network security evaluation system, characterized in that, include: The data acquisition unit is used to acquire user behavior data; The data analysis unit, connected to the data acquisition unit, is used to construct a multi-dimensional spatiotemporal feature topology based on the behavioral data, analyze the user's operation state transition probability, and determine whether the user has an operation abnormality risk at the current moment based on the spatiotemporal feature topology, state transition probability and preset data analysis rules. A safety monitoring unit, connected to the data analysis unit, is used to perform safety detection on the user's operation process when there is a risk of abnormal operation by the user at the current moment; A safety assessment unit, connected to the safety monitoring unit, is used to issue warnings to users based on the type of potential safety hazards during user operations, generate risk rectification forms, and assess the user's rectification completion status; wherein the risk rectification form includes the type of potential hazard, rectification suggestions, and rectification completion deadline; The data processing unit, connected to the security assessment unit and the data analysis unit, is used to update the sensitive operation thresholds based on the user's rectification completion status each time. The data analysis unit includes: The feature extraction module is used to extract multi-dimensional features from the user's behavior data, including source device address, target device address, operation method, and operation type. The topology mapping module, connected to the feature extraction module, is used to map the multidimensional features to the feature space to construct a spatiotemporal topology structure. The state transition analysis module, connected to the feature extraction module, is used to construct a state transition probability matrix based on the user's continuous operation sequence. The entropy weight optimization module, connected to the topology mapping module and the state transition analysis module, is used to calculate the information entropy of each feature and assign dynamic weights. The risk assessment module, connected to the topology mapping module, the state transition analysis module, and the entropy weight optimization module, is used to comprehensively analyze multidimensional results and determine whether there is any risk of abnormal operation by the user at the current moment.

2. The system of claim 1, wherein, The data analysis unit also includes: The data classification unit is used to divide user behavior data into normal behavior data, operation request data and abnormal behavior data, wherein the normal behavior data is normal interaction data of completed operations; The time feature unit is used to calculate the operation time difference based on the user's operation time; The data fusion unit, connected to the topology mapping module, the state transition analysis module, and the time feature unit, is used to perform multi-dimensional fusion of topological features, state transition features, and time features to form a comprehensive feature vector.

3. The system of claim 1, wherein, The topology mapping module includes: A feature space construction unit is used to construct a five-dimensional feature space based on the multi-dimensional features, wherein the fifth dimension is the operation time. The nearest neighbor relationship construction unit, connected to the feature space construction unit, is used to construct a k-nearest neighbor graph based on the distance calculation between feature vectors; The topology feature extraction unit, connected to the nearest neighbor relationship construction unit, is used to analyze the topology of the nearest neighbor graph and extract topology invariants including the number of connected components and the number of loops. The behavior pattern clustering unit, connected to the topology feature extraction unit, is used to cluster the topology features of historical behaviors to establish a normal behavior pattern library. Anomaly measurement unit, connected with the behavior pattern clustering unit and the topology feature extraction unit, is configured to calculate a topology deviation degree between a new behavior and a normal behavior pattern.

4. The system of claim 1, wherein, The state transition analysis module comprises: State encoding unit, configured to encode the sensitive operation type into a finite state space; Transition statistics unit, connected with the state encoding unit, is configured to count the transition frequency between states in the historical data; Probability matrix construction unit, connected with the transition statistics unit, is configured to construct a state transition probability matrix based on the transition frequency; Sequence analysis unit, connected with the probability matrix construction unit and the state encoding unit, is configured to evaluate the probability value of a new operation sequence under the state transition model; Low-probability path identification unit, connected with the sequence analysis unit, is configured to identify a state transition path with abnormally low probability and mark it as a potential risk.

5. The system of claim 1, wherein, The entropy weight optimization module comprises: Information entropy calculation unit, configured to evaluate the information amount and distinguishing ability of each feature; Mutual information analysis unit, connected with the information entropy calculation unit, is configured to calculate the redundancy between features; Weight allocation unit, connected with the information entropy calculation unit and the mutual information analysis unit, is configured to allocate differentiated weights to different features; Dynamic adjustment unit, connected with the weight allocation unit, is configured to dynamically adjust the feature weights according to the system security state and historical feedback; Decision fusion unit, connected with the dynamic adjustment unit, is configured to integrate multi-source analysis results based on the weighted features to form a final risk assessment result.

6. The system of claim 1, wherein, The security monitoring unit comprises: Log detection module, configured to obtain operation logs of a user; Log analysis module, connected with the log detection module, is configured to determine that there is a vulnerability in the operation process of the user when the operation logs meet a pre-set log vulnerability judgment rule, and generate a vulnerability prompt information; Operation record module, configured to obtain operation records of the user and convert the operation records into an operation record chart; Hidden danger judgment module, connected with the operation record module, is configured to determine that there is an operation abnormal hidden danger operation type of the user according to the operation record chart and the topology analysis result, and construct a hidden danger judgment model based on the operation abnormal hidden danger operation type; Vulnerability repair module, connected with the log analysis module and the hidden danger judgment module, is configured to perform vulnerability repair corresponding to the operation logs when there is a security hidden danger in the operation process.

7. The system of claim 6, wherein, The vulnerability repair module performs a repair completion test on the repair process after the vulnerability repair, comprising: First test unit, configured to determine whether the operation logs of the user are repaired; Modification path analysis unit, connected with the first test unit, is configured to obtain operation records for malicious modification of the operation logs when it is detected that the operation logs are not repaired, and determine a modification path of the operation logs; Rule application unit, connected with the modification path analysis unit, is configured to obtain a log vulnerability judgment rule corresponding to a vulnerability repair position, and modify the vulnerability of the vulnerability repair position through the modification path. The repair verification unit is connected with the rule application unit and is configured to perform a repair completion test on the repaired operation log to determine whether the repair is completed.

8. The system of claim 1, wherein, The data processing unit comprises: The rectification data acquisition module is configured to acquire the rectification completion condition of the user each time; The credibility calculation module is connected with the rectification data acquisition module and is configured to perform credibility calculation on the sensitive operation threshold update data of the user each time; The weight allocation module is connected with the credibility calculation module and is configured to acquire the weight of the sensitive operation threshold of the user each time; The threshold update module is connected with the weight allocation module and the credibility calculation module and is configured to calculate the weighted credibility of the sensitive operation threshold update according to the credibility of the sensitive operation threshold each time and the weight of the sensitive operation threshold each time, and generate the updated sensitive operation threshold based on the weighted credibility.

9. The system network security evaluation method based on artificial intelligence, characterized in that, It comprises: Acquire the behavior data of the user; Construct a multi-dimensional space-time feature topology based on the behavior data, including: extracting multi-dimensional features including source device address, target device address, operation mode and operation type, and mapping the multi-dimensional features to a feature space to construct a space-time topology structure; Analyze the user operation state transition probability, including: encoding the sensitive operation type into a finite state space, counting the transition frequency between states in the historical data, and constructing a state transition probability matrix; Calculate the dynamic weight of each feature based on the information entropy of the feature; Determine whether the user has an operation abnormal risk at the current moment based on the space-time feature topology, the state transition probability, the dynamic weight and the preset data analysis rule; When the user has an operation abnormal risk at the current moment, perform security detection on the operation process of the user; When the operation process of the user has a security risk, pre-warning the user according to the risk type, generating a risk rectification form, and evaluating the rectification completion condition of the user; wherein the risk rectification form comprises the risk type, the rectification suggestion and the rectification completion time limit; Update the sensitive operation threshold according to the rectification completion condition of the user each time.

Images