Network security threat detection system based on artificial intelligence

Abstract

The invention discloses a network security threat detection system based on artificial intelligence. The system comprises a network security data acquisition module, a network security data optimization module, a network security threat prediction model establishment module, a model optimization module and a network security threat intelligent detection module. The invention relates to the technical field of network security data processing, in particular to a network security threat detection system based on artificial intelligence, which innovatively introduces weighted distance measurement driven by field correlation, adaptive neighbor number selection and a distance deviation threshold control strategy. A K-nearest neighbor method is improved to realize data completion, and the accuracy of a network security threat detection result is improved; a double-layer long-short-term memory network and self-adaptive threat threshold calculation are provided, and high-precision threat prediction of network security is realized; a sine smooth attenuation inertia weight strategy and a sine modulation contraction factor strategy are introduced to improve a particle swarm optimization algorithm, and the prediction accuracy and stability of the model are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security data processing, and particularly relates to a network security threat detection system based on artificial intelligence. BACKGROUND

[0002] The network security threat detection system based on artificial intelligence is a comprehensive security protection system that utilizes artificial intelligence technology to automatically perceive, intelligently analyze, accurately identify and efficiently respond to abnormal behaviors, attack features and potential threats in a network environment, realizes early warning, real-time disposal and continuous evolution protection of various security threats, and improves the overall security protection capability of the network space.

[0003] However, the conventional network security threat detection system has the technical problem of data loss caused by network environment abnormalities and attack evasion behaviors, thereby causing the adverse consequence of decreased network threat detection accuracy, the existing network security threat prediction model has the technical problem of being difficult to simultaneously consider long-term behavior patterns and short-term sudden changes, and adopting a fixed decision threshold, lacking self-adaptive capability for network dynamic security situation, thereby leading to low network security threat prediction accuracy in different scenarios, and the existing network security threat prediction model has the technical problem of unreasonable hyperparameter setting, thereby leading to unstable model prediction results and insufficient accuracy. SUMMARY

[0004] In view of the above situation, in order to overcome the defects of the existing technology, the present invention provides an artificial intelligence-based network security threat detection system. In order to solve the technical problem of data missing caused by network environment anomalies and attack avoidance behaviors in traditional network security threat detection systems, which leads to the adverse consequence of reduced accuracy of network threat detection, this solution innovatively proposes a multi-strategy improved K-nearest neighbor method. By introducing a weighted distance metric driven by field correlation, it enhances the similarity evaluation consistent with business semantics, effectively improves the accuracy of missing value prediction, and reduces the interference of weakly correlated fields. By adaptively selecting the number of neighbors, it avoids underfitting and overfitting of fixed K in sparse or dense sample intervals. This improves the robustness and generalization ability of the completion, suppresses the contamination of the completion results by abnormal samples through distance deviation threshold control, significantly enhances the anti-noise performance of the completion, and achieves high-quality completion of missing fields of multi-source heterogeneous network security data, ensuring the integrity and consistency of the input data, improving the accuracy of threat baseline modeling and abnormal behavior detection, and improving the real-time, stability and credibility of network security threat detection results; the existing network security threat prediction models have the problem of being difficult to take into account both long-term behavior patterns and short-term sudden changes, and adopting fixed judgment thresholds and lacking the ability to adapt to the dynamic security situation of the network, resulting in network security threat prediction in different scenarios. The prediction accuracy is not high. This scheme innovatively proposes a network security threat prediction model based on a double-layer long short-term memory network and adaptive threat threshold calculation. Through the double-layer long short-term memory network structure, the global grasp of the attack evolution process and the sensitivity to abnormal outbreaks are improved. By introducing an adaptive threat threshold calculation mechanism, the judgment threshold is dynamically adjusted in combination with basic behavior fluctuations, mutation amplitude and external threat intelligence scores, which effectively reduces the false alarm rate in non-high-risk scenarios and improves the detection sensitivity in high-risk scenarios, achieving high-precision threat prediction for network security, taking into account the recognition ability of long-term latent threats and short-term sudden attacks, and significantly improving the real-time performance of the network security threat detection system. In order to solve the technical problems of unreasonable hyperparameter settings for existing network security threat prediction models, which lead to unstable model prediction results and insufficient accuracy, this solution innovatively introduces a sinusoidal smooth decay inertia weight strategy and a sinusoidal modulation shrinkage factor strategy to improve the particle swarm optimization algorithm, thereby improving the stability and convergence speed of the search process. At the same time, the sinusoidal modulation shrinkage factor is used to periodically adjust the group divergence and convergence strength, thereby enhancing the population diversity and the ability to escape from local optimality, and improving the probability of obtaining the global optimal hyperparameter combination. This realizes efficient, accurate and automated search for the hyperparameters of the network security threat prediction model, thereby improving the prediction accuracy and stability of the model.

[0005] The technical solution adopted by the present invention is as follows: The network security threat detection system based on artificial intelligence provided by the present invention includes a network security data acquisition module, a network security data optimization module, a network security threat prediction model establishment module, a model optimization module and a network security threat intelligent detection module;

[0006] The network security data acquisition module is used to obtain multi-source security-related data from the network environment, specifically to obtain network security threat detection raw data through data acquisition operations;

[0007] The network security data optimization module is used to improve the quality and integrity of raw data, specifically by filtering abnormal and redundant data, normalizing data, completing data integrity, and synchronizing time series to obtain optimized data for network security threat detection;

[0008] The network security threat prediction model module is used to build a time series analysis model capable of identifying and predicting network threats. Specifically, it uses a deep convolutional neural network to extract global behavior trend characteristics and local sensitive behavior response characteristics, uses a long short-term memory network to perform threat baseline modeling and abnormal mutation identification, and performs adaptive threat threshold calculation and network security threat prediction, thereby completing the construction of the network security threat prediction model.

[0009] The model optimization module is used to improve the performance and accuracy of the network security threat prediction model. Specifically, it uses an improved particle swarm optimization method to obtain the optimal hyperparameter combination of the model, adjusts the model hyperparameters based on the optimal hyperparameter combination of the model, and performs model training to obtain a trained network security threat prediction model;

[0010] The network security threat intelligent detection module is used to predict and respond to real-time network threats in a graded manner during the operation phase. Specifically, real-time data is input into the trained model to obtain the current network security threat prediction results and automatically trigger the corresponding security response strategy.

[0011] Furthermore, the network security data collection module specifically obtains network security threat detection raw data by collecting data; the network security threat detection raw data includes historical threat detection data and real-time threat detection data; the historical threat detection data and real-time threat detection data both include network communication data, network log data, user behavior data, network environment context data and network intelligence data; the historical threat detection data also includes historical network security threat detection results.

[0012] Furthermore, the network security data optimization module specifically includes the following steps:

[0013] Abnormal and redundant data filtering, specifically normalizing the data format of network security threat detection raw data, identifying and removing abnormal values, and clearing redundant fields;

[0014] Data standardization is to convert the non-continuous data variables into one-hot codes and use the minimum-maximum normalization method to process the numerical data in the original data to normalize the data values ​​to interval;

[0015] Data integrity completion, specifically using the improved K-nearest neighbor algorithm to fill in missing data, includes the following steps:

[0016] Field correlation calculation, specifically, using the Spearman rank correlation coefficient method to calculate the correlation between any two field variables i and j to obtain their field correlation coefficient;

[0017] Calculate the field weight vector. Specifically, based on the field correlation coefficient, calculate the weighted impact value of each field on the current missing field to obtain the field weight vector. The formula used is as follows:

[0018] ;

[0019] Where, represents the weight vector of field j to be complemented by field i, represents the variance of field j, Represents a very small constant, used to prevent division by zero, represents the correlation coefficient between field i and field j;

[0020] Calculate the weighted distance between samples. Specifically, use the weighted Euclidean distance method to calculate the overall similarity between sample a containing missing fields and historical complete sample b to obtain the weighted distance between samples. The formula used is as follows:

[0021] ;

[0022] Where, Represents the weighted distance calculation function between samples, represents the weighted distance between sample a and sample b, represents the value of sample a on field j, represents the value of sample b on field j, and n represents the total number of fields in the sample;

[0023] The number of adaptive neighbors is determined by setting the initial number of neighbors k=3 and calculating the average distance between the first k samples and the current sample to be completed. , and set the distance deviation threshold , if the distance between the k+1th candidate neighbor sample and the current sample to be completed is satisfy , then update the number of neighbors to , continue to iterate; otherwise, terminate the process of increasing the number of neighbors, and finally determine the optimal number of neighbors to be K=k; where, Indicates the adjustment factor, the value range is , Represents the weighted distance between the current sample to be completed and the first nearest neighbor sample, Represents the weighted distance between the current sample to be completed and the kth nearest neighbor sample;

[0024] Fill in missing values ​​in fields, specifically using distance-weighted average to fill in missing values ​​in the current missing fields;

[0025] Time series synchronization involves standardizing the timestamp fields in the original data to achieve a unified timestamp format, and dividing various types of data into fixed time periods based on a sliding window mechanism to complete time granularity alignment and synchronization operations.

[0026] Furthermore, the establishment of the network security threat prediction model module specifically includes the following steps:

[0027] The network security behavior feature sequence is constructed by using a deep convolutional neural network to extract global behavior trend features and local sensitive behavior response features from network security behavior data, thereby obtaining global behavior trend features and local sensitive behavior response features.

[0028] The threat baseline state is obtained by inputting global behavioral trend characteristics and network environment context data into the first layer of long short-term memory network to generate the threat baseline state. The local sensitive behavioral response characteristics are then fused with the hidden state through the attention mechanism to obtain the threat baseline enhanced state.

[0029] Dynamic differential identification of abnormal network behavior, specifically, the global behavior trend characteristics and threat baseline enhancement state are jointly input into the second-layer long short-term memory network to generate the hidden state and memory unit state of the second layer at the current moment. Then, the difference results of the hidden state and memory unit state at the current moment relative to the previous moment are calculated respectively, and the hidden state and the difference results at the current moment are fused using linear mapping to generate mutation enhancement features. Then, the attention mechanism is introduced to calculate the attention score based on the correlation between the mutation enhancement feature and the local sensitive behavior response features of each channel and the global behavior trend feature. The weighted summation of all local sensitive behavior response features is performed, and the summation result is spliced ​​with the mutation enhancement feature and the global behavior trend feature. The dynamic network threat state vector at the current moment is output through a nonlinear activation function.

[0030] Adaptive threat threshold calculation is used to dynamically generate personalized judgment thresholds to achieve sensitive responses to threat states under different network security situations. Specifically, the basic threshold item, mutation perception item, and external threat sensitivity item are constructed separately, and the adaptive threat threshold is formed through weighted fusion. The formula used is as follows:

[0031] ;

[0032] ;

[0033] Where, Indicates the basic threat threshold item, represents the volatility adjustment coefficient, represents the time variance calculation function, represents the mutation perception term, Indicates external threat sensitive items, Represents the mutation amplitude adjustment factor, which is used to control the influence of the differential increment on the threshold. Represents the intelligence score adjustment factor, which is used to control the influence of external IOC scores on the judgment threshold. and represents the weighted fusion coefficient, It represents the threat sensitivity score obtained by analyzing the current entity behavior based on network intelligence data. represents the adaptive threat threshold, Indicates the threat baseline enhancement status, Represents the global behavioral trend characteristics, Represents the hidden state difference result at the current moment;

[0034] Network security threat prediction involves inputting the dynamic network threat state vector into the fully connected mapping layer, using the Softmax function to calculate the probability value of the multi-category threat state at the current moment, and comparing the probability output with the adaptive threat threshold to obtain the network security threat prediction result.

[0035] Furthermore, the model optimization module specifically includes the following steps:

[0036] Obtaining the optimal hyperparameters of the model includes the following steps:

[0037] Initialize the particle swarm individuals. Specifically, encode the network security threat prediction model hyperparameters into search individual position vectors, and generate L particle individual position vectors through random initialization. Each individual encoding represents a candidate model hyperparameter combination to obtain the initial particle swarm.

[0038] Calculate individual fitness values, specifically calculate the individual fitness values ​​of particles in the population The performance of the network security threat prediction model established based on the search individual position is used as the individual fitness value of the particle;

[0039] Calculate the adaptive inertia weight by introducing a sinusoidal smooth decay inertia weight strategy and controlling the change of the inertia weight through a sinusoidal function. The formula used is as follows:

[0040] ;

[0041] Where, represents the inertia weight at the e-th iteration, and Represent the initial and final inertia weights respectively, e represents the current number of iterations, and E represents the maximum number of iterations;

[0042] Calculate the search shrinkage factor. Specifically, introduce the sinusoidal modulation shrinkage factor strategy to calculate the search shrinkage factor. The formula used is as follows:

[0043] ;

[0044] Where, represents the search shrinkage factor for the e-th iteration, represents the sinusoidal modulation amplitude coefficient, represents the total learning factor;

[0045] Particle velocity and position are updated by using the search shrinkage factor and adaptive inertia weight to update the particle velocity, and then iteratively adjusting the particle position based on the updated velocity. The formula used is as follows:

[0046] ;

[0047] Where, Indicates that the kth particle is in the Iteration speed, Indicates that the kth particle is in the Iteration speed, represents the local optimal position of the individual particle, represents the global optimal position of the particle, and represents a random number in the range [0,1], and represent the individual learning factor and the group learning factor, respectively. represents the position of the kth particle in the eth iteration;

[0048] The optimal position of the particle is updated. Specifically, the fitness value of all updated particles is re-evaluated, and based on the fitness value of the current particle, it is compared with the global optimal position of the current particle. If the fitness value of the current particle is better, the global optimal position of the particle is updated;

[0049] The particle search is terminated, specifically when the particle fitness value When the fitness threshold is exceeded and the maximum number of iterations is reached, the search is terminated and the global optimal position of the particle is obtained; the global optimal position of the particle specifically refers to the optimal hyperparameter combination of the model;

[0050] Updating model hyperparameters, specifically adjusting the hyperparameters of the network security threat prediction model according to the optimal hyperparameter combination of the model to obtain a tuned network security threat prediction model;

[0051] The network security threat prediction model training specifically uses historical threat detection data as training data and adopts the cross-entropy loss function as the supervised training objective function. The weight parameters of the network security threat prediction model are back-propagated and updated through the gradient descent parameter iterative update algorithm, gradually minimizing the loss function value until the training converges, completing the model training, and finally obtaining the trained network security threat prediction model.

[0052] Furthermore, the network security threat intelligent detection module specifically inputs the collected real-time threat detection data into the trained network security threat prediction model to obtain real-time network security threat prediction results. According to the prediction results, it intelligently detects the threat level of network security and triggers corresponding security response strategies, thereby realizing intelligent detection of potential attack behaviors, immediate disposal and active prevention and control of network security risks.

[0053] The beneficial effects achieved by the present invention using the above scheme are as follows:

[0054] (1) Aiming at the technical problem of data missing caused by network environment anomalies and attack evasion behaviors in traditional network security threat detection systems, which leads to the adverse consequence of reduced network threat detection accuracy, this scheme innovatively proposes a multi-strategy improved K-nearest neighbor method. By introducing a weighted distance metric driven by field correlation, the similarity evaluation consistent with business semantics is enhanced, the accuracy of missing value prediction is effectively improved, and the interference of weakly correlated fields is reduced. By adaptively selecting the number of neighbors, underfitting and overfitting of fixed K in sparse or dense sample intervals are avoided, thereby improving the robustness and generalization ability of the completion. By controlling the distance deviation threshold, the contamination of the completion results by abnormal samples is suppressed, and the noise resistance of the completion is significantly enhanced. High-quality completion of missing fields of multi-source heterogeneous network security data is achieved, the integrity and consistency of the input data are guaranteed, the accuracy of threat baseline modeling and abnormal behavior detection is improved, and the real-time, stability and credibility of network security threat detection results are improved.

[0055] (2) In view of the technical problems that the existing network security threat prediction models are difficult to take into account both long-term behavior patterns and short-term sudden changes, and adopt fixed judgment thresholds, lack the ability to adapt to the dynamic security situation of the network, resulting in low accuracy of network security threat prediction in different scenarios, this scheme innovatively proposes a network security threat prediction model based on a double-layer long short-term memory network and adaptive threat threshold calculation. Through the long short-term memory network structure, the ability to grasp the overall attack evolution process and the sensitivity to abnormal outbreaks are improved. By introducing an adaptive threat threshold calculation mechanism, the judgment threshold is dynamically adjusted in combination with basic behavior fluctuations, mutation amplitude and external threat intelligence scores, effectively reducing the false alarm rate in non-high-risk scenarios and improving the detection sensitivity in high-risk scenarios, achieving high-precision threat prediction for network security, taking into account the ability to identify long-term latent threats and short-term sudden attacks, and significantly improving the real-time, accuracy and robustness of the network security threat detection system.

[0056] (3) In order to solve the technical problem that the existing hyperparameter settings of network security threat prediction models are unreasonable, resulting in unstable model prediction results and insufficient accuracy, this solution innovatively introduces a sinusoidal smooth decay inertia weight strategy and a sinusoidal modulation shrinkage factor strategy to improve the particle swarm optimization algorithm, thereby improving the stability and convergence speed of the search process; at the same time, the sinusoidal modulation shrinkage factor is used to periodically adjust the group divergence and convergence strength, thereby enhancing the population diversity and the ability to escape the local optimum, and improving the probability of obtaining the global optimal hyperparameter combination, thereby realizing efficient, accurate and automated search for the hyperparameters of the network security threat prediction model and improving the prediction accuracy and stability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1This is a module diagram of the artificial intelligence-based network security threat detection system provided by the present invention;

[0058] Figure 2 This is a flowchart of the network security data optimization module;

[0059] Figure 3 A flowchart for establishing a network security threat prediction model module;

[0060] Figure 4 Flowchart of the model optimization module;

[0061] Figure 5 A flowchart for completing data integrity in the network security data optimization module;

[0062] Figure 6 A schematic diagram of the process of obtaining the optimal hyperparameters of the model in the model optimization module;

[0063] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention. DETAILED DESCRIPTION

[0064] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0065] In the description of the present invention, it should be understood that terms such as "up", "down", "front", "back", "left", "right", "top", "bottom", "inside" and "outside" indicating directions or positional relationships are based on the directions or positional relationships shown in the accompanying drawings. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the system or element referred to must have a specific direction, be constructed and operated in a specific direction. Therefore, they should not be understood as limiting the present invention.

[0066] Example 1, see Figure 1 The network security threat detection system based on artificial intelligence provided by the present invention includes a network security data acquisition module, a network security data optimization module, a network security threat prediction model establishment module, a model optimization module and a network security threat intelligent detection module;

[0067] The network security data acquisition module is used to obtain multi-source security-related data from the network environment, specifically to obtain network security threat detection raw data through data acquisition operations, and send the data to the network security data optimization module;

[0068] The network security data optimization module receives data sent by the network security data acquisition module and is used to improve the quality and integrity of the original data. Specifically, it obtains network security threat detection optimization data through abnormal and redundant data filtering, data standardization, data integrity completion and time series synchronization, and sends the data to the model optimization module and the network security threat intelligent detection module;

[0069] The network security threat prediction model module is used to build a time series analysis model capable of identifying and predicting network threats. Specifically, it uses a deep convolutional neural network to extract global behavior trend characteristics and local sensitive behavior response characteristics, uses a long short-term memory network to perform threat baseline modeling and abnormal mutation identification, and combines the attention mechanism with adaptive threat threshold calculation to generate network security threat prediction results and send the data to the model optimization module.

[0070] The model optimization module receives data sent by the network security data optimization module and the network security threat prediction model establishment module, and is used to improve the performance and accuracy of the network security threat prediction model. Specifically, the improved particle swarm optimization method is used to search for the optimal hyperparameter combination of the model, and the model is trained to obtain the optimized network security threat prediction model, and the data is sent to the network security threat intelligent detection module;

[0071] The network security threat intelligent detection module receives data sent by the network security data optimization module and the model optimization module, and is used to predict and respond to real-time network threats in a graded manner during the operation phase. Specifically, the module inputs real-time data into the trained model to obtain the current network threat level and automatically triggers the corresponding security response strategy.

[0072] Example 2, see Figure 1, this embodiment is based on the above embodiment, the network security data acquisition module is used to collect multi-source security-related data in the network environment in real time and offline, specifically by deploying acquisition agents, traffic mirroring interfaces, system log listeners and API call interfaces to collect data and obtain network security threat detection raw data; the network security threat detection raw data includes historical threat detection data and real-time threat detection data; the historical threat detection data and real-time threat detection data both include network communication data, network log data, user behavior data, network environment context data and network intelligence data; the historical threat detection data also includes historical network security threat detection results; the network communication data refers to the underlying transmission information reflecting the communication behavior between devices in the network, including source IP address, destination IP address, source port, destination port, protocol type, session duration, DNS request record and HT TP request header information; the network log data is log information generated by network devices, including firewall access logs, IDS / IPS alarm letters, NAT conversion records, WAF logs, VPN connection records and network device system events; the user behavior data includes login behavior, accessed resource type, access frequency, access path, number of login failures and interval time; the network environment context data includes network access method, network proxy geographical area, network area and network device type; the network intelligence data refers to information about attackers, malicious infrastructure, and vulnerability exploits obtained from external intelligence sources. There are five types of threat intrusion indicators IOC, including malicious IP, malicious domain name, malicious URL, malicious behavior pattern signature and malicious file hash; the historical network security threat detection results include high-risk network security threats, medium-risk network security threats, low-risk network security threats, and information-level network security events.

[0073] Example 3, see Figure 1 、 Figure 2 and Figure 5 This embodiment is based on the above embodiment. The network security data optimization module obtains network security threat detection optimization data by filtering abnormal and redundant data, normalizing data, completing data integrity, and synchronizing time series. The module includes the following steps:

[0074] Abnormal and redundant data filtering is used to clean up duplicate items, abnormal values, and invalid fields in the original data of network security threat detection to improve data quality and validity. Specifically, it normalizes the data format, identifies and removes abnormal values, and clears redundant fields of the original data of network security threat detection;

[0075] The data format normalization is used for unifying the naming, types and structures of fields in different data sources, eliminating format differences, specifically for field mapping, format conversion and unit standardization processing of network security threat detection raw data, unifying timestamp format, IP address representation, protocol name abbreviation, port number type;

[0076] The abnormal value identification and elimination is used for identifying and removing abnormal data in the collection due to faults, attack false positives or system abnormalities, specifically for detecting abnormal fluctuation values in the data by box plot method, and marking and removing them;

[0077] The redundant field cleaning is used for deleting fields without actual analysis value and information repetition in threat detection, simplifying data structure, specifically for screening and cleaning invalid identification fields and auxiliary fields duplicated with primary key fields in logs;

[0078] Data standardization processing is used to eliminate the differences in different data value ranges in network security raw data, specifically for numerical conversion of non-continuous data variable One-hot encoding, and processing of normalized data in raw data by using minimum-maximum normalization method, to normalize data values to Interval;

[0079] Data integrity completion is used to repair the field missing problem in network security threat detection raw data caused by network environment abnormalities and attack avoidance behaviors, to ensure the integrity and consistency of data input, specifically for missing data filling by using improved K-nearest neighbor algorithm, including the following steps:

[0080] Field correlation calculation is used to measure the linear dependence degree between fields in network security data, and guide distance weighting; specifically, the correlation between any two field variables i and j is calculated by using Spearman rank correlation coefficient method, to obtain the field correlation coefficient; the formula is as follows:

[0081] ;

[0082] In the formula, represents the correlation coefficient of field i and field j, m represents the total number of samples, represents the value of the kth sample in field i, represents the mean value of the ith field, represents the mean value of the jth field, represents the value of the kth sample in field j;

[0083] Calculate the field weight vector, which is used to measure the relative influence of the non-missing field on the current missing field based on the correlation between the fields. Specifically, based on the field correlation coefficient, calculate the weighted influence value of each field on the current missing field to obtain the field weight vector. The formula used is as follows:

[0084] ;

[0085] Where, represents the weight vector of field j to be complemented by field i, represents the variance of field j, Represents a very small constant, used to prevent division by zero;

[0086] Calculate the weighted distance between samples to find the historical complete sample that is most similar to the missing field sample. Specifically, use the weighted Euclidean distance method to calculate the overall similarity between sample a containing the missing field and historical complete sample b to obtain the weighted distance between samples. The formula used is as follows:

[0087] ;

[0088] Where, Represents the weighted distance calculation function between samples, represents the weighted distance between sample a and sample b, represents the value of sample a on field j, represents the value of sample b on field j, and n represents the total number of fields in the sample;

[0089] Adaptive neighbor number determination is used to dynamically adjust the number of neighbor samples involved in completion. Specifically, the initial number of neighbors is set to k=3, and the average distance between the first k samples and the current sample to be completed is calculated. , and set the distance deviation threshold , if the distance between the k+1th candidate neighbor sample and the current sample to be completed is satisfy , then update the number of neighbors to , continue to iterate; otherwise, terminate the process of increasing the number of neighbors, and finally determine the optimal number of neighbors to be K=k; where, Indicates the adjustment factor, the value range is , used to control the distance deviation threshold, Represents the weighted distance between the current sample to be completed and the first nearest neighbor sample, Represents the weighted distance between the current sample to be completed and the kth nearest neighbor sample;

[0090] The distance deviation threshold is used to limit the distance fluctuation range of new neighbor samples;

[0091] The missing value of the field is completed. Specifically, the missing field is filled in by using the distance weighted average method. The formula used is as follows:

[0092] ;

[0093] Where, Indicates the completion value of sample a on field i, represents the true value of the kth neighbor sample on field i, Represents sample a and sample The weighted distance between

[0094] Time series synchronization is used to align the time axis of multi-source network security data to solve the problems of inconsistent data collection time granularity, clock offset and timing drift. Specifically, the timestamp field in the original data is formatted and standardized to achieve a unified timestamp format. Based on the sliding window mechanism, various types of data are divided into fixed time periods to complete time granularity alignment and synchronization operations.

[0095] By performing the above operations, this solution innovatively proposes a multi-strategy improved K-nearest neighbor method to address the technical problem of data missing caused by network environment anomalies and attack evasion behaviors in traditional network security threat detection systems, which leads to the adverse consequence of reduced network threat detection accuracy. By introducing a weighted distance metric driven by field correlation, it enhances the similarity assessment consistent with business semantics, effectively improves the accuracy of missing value prediction, and reduces the interference of weakly correlated fields. By adaptively selecting the number of neighbors, it avoids underfitting and overfitting of fixed K in sparse or dense sample intervals, thereby improving the robustness and generalization ability of the completion. By controlling the distance deviation threshold, it suppresses the contamination of the completion results by abnormal samples, significantly enhancing the noise resistance of the completion, and achieving high-quality completion of missing fields in multi-source heterogeneous network security data. It ensures the integrity and consistency of the input data, improves the accuracy of threat baseline modeling and abnormal behavior detection, and enhances the real-time, stability and credibility of network security threat detection results.

[0096] Example 4, see Figure 1 and Figure 3 This embodiment is based on the above embodiment, and the establishment of the network security threat prediction model module specifically includes the following steps:

[0097] The network security behavior feature sequence is constructed to extract multi-granularity time series features that can reflect the evolution of network security threat situations. Specifically, a deep convolutional neural network is used to extract global behavior trend features and local sensitive behavior response features from network security behavior data, obtaining global behavior trend features and local sensitive behavior response features.

[0098] The global behavior trend feature extraction is used to characterize the stable behavior pattern of the network subject over a longer time range. Specifically, a single-channel one-dimensional convolution structure is used, and the convolution kernel receptive field is set to 50 time steps;

[0099] The local sensitive behavior response feature extraction is used to identify abnormal behavior responses in a short period of time; specifically, it is implemented using a multi-channel one-dimensional convolution structure, and the convolution kernel receptive field is set to 7 time steps;

[0100] The single-channel one-dimensional convolutional structure and the multi-channel one-dimensional convolutional structure are both embedded in the same deep convolutional neural network framework, and the feature extraction path is constructed through parallel substructures;

[0101] The network security behavior data specifically refers to network communication data, network log data, and user behavior data in network security threat detection optimization data;

[0102] The formula used is as follows:

[0103] ;

[0104] ;

[0105] Where, Represents the global behavioral trend characteristics, represents the local sensitive behavior response feature extracted by the rth channel, represents the global convolution operation, represents the convolution operation of the pth local convolution kernel, Represents network security threat detection optimization data;

[0106] The threat baseline state acquisition is used to perform time series modeling on the historical behavior sequence of network entities under normal operating conditions to form a behavior baseline state. Specifically, the global behavior trend characteristics and network environment context data are input into the first-layer long short-term memory network to generate the threat baseline state. The local sensitive behavior response characteristics are then fused with the hidden state through the attention mechanism to obtain the threat baseline enhancement state. The formula used is as follows:

[0107] ;

[0108] ;

[0109] ;

[0110] Where, Indicates the threat baseline status, Represents the first layer long short-term memory network calculation function, Represents the network environment context data in network security threat detection optimization data, represents the attention weight coefficient of the local sensitive behavior response feature extracted by the rth channel for baseline modeling, represents the hyperbolic tangent activation function, represents the learnable first-layer attention weight vector, T represents the transposition operation, Represents the weight matrix for learning global behavior trend features, represents the weight matrix of the contextual data of the learning network environment, represents the threat baseline enhancement state, R represents the number of local sensitive behavioral response features, represents the local sensitive behavior response feature extracted by the kth channel, The weight matrix representing the enhanced state of the threat baseline is obtained;

[0111] Dynamic differential identification of abnormal network behavior is used to identify sudden changes in network entity behavior in a short period of time. Specifically, the global behavior trend characteristics and threat baseline enhancement state are jointly input into the second-layer long short-term memory network to generate the hidden state and memory unit state of the second layer at the current moment. Then, the difference results of the hidden state and memory unit state at the current moment relative to the previous moment are calculated respectively. The hidden state and the difference results at the current moment are fused with the linear mapping to generate the sudden enhancement feature. Then, the attention mechanism is introduced. Based on the correlation between the sudden enhancement feature and the local sensitive behavior response feature of each channel and the global behavior trend feature, the attention score is calculated, and all local sensitive behavior response features are weighted summed. The sum result is spliced ​​with the sudden enhancement feature and the global behavior trend feature, and the dynamic network threat state vector at the current moment is output through a nonlinear activation function. The formula used is as follows:

[0112] ;

[0113] ;

[0114] ;

[0115] ;

[0116] ;

[0117] ;

[0118] Where, represents the hidden state of the second layer at the current moment, Represents the current state of the memory unit in the second layer, Represents the second-layer long short-term memory network calculation function, represents the hidden state of the second layer at the previous moment, represents the state of the memory unit of the second layer at the previous moment, Represents the hidden state difference result at the current moment, Represents the difference result of the memory unit state at the current moment, Indicates mutation enhancement characteristics, 、 and Represent the weight matrices of the mapping difference result and the hidden state at the current moment, represents the learnable second-layer attention weight vector, and represents the mapping weights of various inputs in the attention layer, Represents the weight matrix for obtaining dynamic network threat status, represents the attention weight coefficient of the local sensitive behavior response feature extracted by the rth channel for mutation recognition, Represents the dynamic network threat state vector at the current moment, Represents the Sigmoid activation function;

[0119] Adaptive threat threshold calculation is used to dynamically generate personalized judgment thresholds based on the long-term behavior patterns and current abnormal status of network entities, achieving sensitive responses to threat states under different security situations. Specifically, the basic threshold item, mutation perception item, and external threat sensitivity item are constructed separately, and the adaptive threat threshold is formed through weighted fusion. The formula used is as follows:

[0120] ;

[0121] ;

[0122] ;

[0123] Where, Indicates the basic threat threshold item, represents the volatility adjustment coefficient, represents the time variance calculation function, represents the mutation perception term, Indicates external threat sensitive items, Represents the mutation amplitude adjustment factor, which is used to control the influence of the differential increment on the threshold. Represents the intelligence score adjustment factor, which is used to control the influence of external IOC scores on the judgment threshold. and represents the weighted fusion coefficient, It represents the threat sensitivity score obtained by analyzing the current entity behavior based on network intelligence data. represents the adaptive threat threshold; IOC quantity hit at current time t, threat type risk weight of the i-th IOC, intelligence source reliability coefficient of the i-th IOC, hit frequency of the i-th IOC in current behavior, preset normalization coefficient;

[0124] The network security threat prediction specifically inputs a dynamic network threat state vector into a fully connected mapping layer, adopts a Softmax function, calculates a multi-class threat state probability value at a current time, compares the probability output with an adaptive threat threshold, and obtains a network security threat prediction result. The formula used is as follows:

[0125] ;

[0126] ;

[0127] In the formula, probability value of the i-th threat state at time t, network security threat prediction result at a current time, weight parameter matrix of the fully connected mapping layer, bias term of the fully connected mapping layer.

[0128] By performing the above operation, in view of the technical problems that the existing network security threat prediction model is difficult to simultaneously consider long-term behavior patterns and short-term sudden changes, and a fixed determination threshold is adopted, lacking adaptive ability to the network dynamic security situation, resulting in low network security threat prediction accuracy in different scenarios, the present scheme innovatively proposes a network security threat prediction model based on a double-layer long short-term memory network and adaptive threat threshold calculation. Through the long short-term memory network structure, the global grasping ability of the attack evolution process and the sensitivity to abnormal outbursts are improved. Through the introduction of the adaptive threat threshold calculation mechanism, the determination threshold is dynamically adjusted in combination with the basic behavior fluctuation, mutation amplitude and external threat intelligence score, effectively reducing the false positive rate in non-high-risk scenarios and improving the detection sensitivity in high-risk scenarios, realizing high-precision threat prediction of network security, considering the recognition ability of long-term latent threats and short-term sudden attacks, and significantly improving the real-time performance, accuracy and robustness of the network security threat detection system.

[0129] Embodiment five, refer to Figure 1 , Figure 4 and Figure 6 This embodiment is based on the above-mentioned embodiments. The model optimization module is used for parameter updating and performance improvement of the network security threat prediction model, specifically including the following steps:

[0130] Model optimal hyperparameter acquisition for improving the performance of network security threat prediction model, specifically comprising the following steps:

[0131] Initialize the particle swarm individuals, specifically encode the network security threat prediction model hyperparameters into search individual position vectors, and generate L particle individual position vectors through random initialization, each individual code represents a candidate model hyperparameter combination, and obtain the initial particle swarm; the network security threat prediction model hyperparameters include convolution kernel size, convolution kernel number, fully connected layer neuron number, learning rate and maximum iteration number;

[0132] Calculate the individual fitness value, specifically calculate the particle individual fitness value in the population ; The performance of the network security threat prediction model based on the search individual position is taken as the particle individual fitness value;

[0133] Calculate the adaptive inertia weight, which is used to balance the global exploration ability of the particle swarm algorithm in the early search and the local convergence precision in the later search, specifically introduce the sine smooth decay inertia weight strategy, control the change of inertia weight through the sine function; the formula is as follows:

[0134] ;

[0135] In the formula, indicates the inertia weight at the e-th iteration, and respectively indicate the initial and final inertia weight, e represents the current iteration number, and E represents the maximum iteration number;

[0136] Calculate the search contraction factor, which is used to enhance the diversity of particle search process and prevent premature convergence of the algorithm, specifically introduce the sine modulation contraction factor strategy, and calculate the search contraction factor; the formula is as follows:

[0137] ;

[0138] ;

[0139] In the formula, indicates the search contraction factor at the e-th iteration, and respectively indicate the individual learning factor and the group learning factor, indicates the sine modulation amplitude coefficient, indicates the total learning factor;

[0140] Particle velocity and position update, specifically update the particle velocity using the search contraction factor and the adaptive inertia weight, and iteratively adjust the particle position according to the updated velocity; the formula is as follows:

[0141] ;

[0142] Where, Indicates that the kth particle is in the Iteration speed, Indicates that the kth particle is in the Iteration speed, represents the position of the kth particle in the eth iteration, represents the local optimal position of the individual particle, represents the global optimal position of the particle, and represents a random number in the range [0,1], Indicates that the kth particle is in the Position in iteration;

[0143] The optimal position of the particle is updated. Specifically, the fitness value of all updated particles is re-evaluated, and based on the fitness value of the current particle, it is compared with the global optimal position of the current particle. If the fitness value of the current particle is better, the global optimal position of the particle is updated;

[0144] The particle search is terminated, specifically when the particle fitness value When the fitness threshold is exceeded and the maximum number of iterations is reached, the search is terminated and the global optimal position of the particle is obtained; the global optimal position of the particle specifically refers to the optimal hyperparameter combination of the model;

[0145] Updating model hyperparameters, specifically adjusting the hyperparameters of the network security threat prediction model according to the optimal hyperparameter combination of the model to obtain a tuned network security threat prediction model;

[0146] Network security threat prediction model training is used to build a prediction model with network threat identification capabilities. Specifically, historical threat detection data is used as training data, and the cross-entropy loss function is adopted as the supervised training objective function. The weight parameters of the network security threat prediction model are back-propagated and updated through the gradient descent parameter iterative update algorithm, gradually minimizing the loss function value until the training converges and the model training is completed, and finally the trained network security threat prediction model is obtained.

[0147] By performing the above operations, in order to address the technical problem that the existing hyperparameter settings applicable to network security threat prediction models are unreasonable, resulting in unstable model prediction results and insufficient accuracy, this solution innovatively introduces a sinusoidal smooth decay inertia weight strategy and a sinusoidal modulation shrinkage factor strategy to improve the particle swarm optimization algorithm, thereby improving the stability and convergence speed of the search process; at the same time, the sinusoidal modulation shrinkage factor is used to periodically adjust the group divergence and convergence strength, thereby enhancing the population diversity and the ability to escape local optimality, and increasing the probability of obtaining the global optimal hyperparameter combination, thereby realizing efficient, accurate and automated search for the hyperparameters of the network security threat prediction model, and improving the prediction accuracy and stability of the model.

[0148] Example 6, see Figure 1 This embodiment is based on the network security threat intelligent detection module described in the above embodiment. Specifically, the collected real-time threat detection data is input into the trained network security threat prediction model to obtain real-time network security threat prediction results. According to the prediction results, the threat level of network security is intelligently detected and the corresponding security response strategy is triggered, thereby realizing intelligent detection of potential attack behaviors, immediate disposal and active prevention and control of network security risks.

[0149] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0150] While the embodiments of the present invention have been shown and described, it will be apparent to those skilled in the art that various changes, modifications, substitutions, and alterations can be made to the embodiments without departing from the principles and spirit of the invention.

[0151] The present invention and its embodiments are described above. This description is not restrictive. The drawings show only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this and, without departing from the purpose of the present invention, designs structures and embodiments similar to this technical solution without inventiveness, they shall fall within the scope of protection of the present invention.

Claims

1. An artificial intelligence-based network security threat detection system, characterized by: It includes network security data acquisition module, network security data optimization module, network security threat prediction model building module, model optimization module and network security threat intelligent detection module; The network security data acquisition module specifically obtains the original data of network security threat detection through data acquisition operations; The network security data optimization module specifically filters abnormal and redundant data and normalizes data. It then introduces multiple strategies such as field correlation-driven weighted distance measurement, adaptive neighbor number selection, and distance deviation threshold control to improve the K-nearest neighbor method to achieve data integrity and completion. Finally, it synchronizes time series to obtain optimized data for network security threat detection. The network security threat prediction model module is established by extracting global behavior trend characteristics and local sensitive behavior response characteristics through deep convolutional neural networks, using long short-term memory networks to perform threat baseline modeling and abnormal mutation identification, and performing adaptive threat threshold calculation and network security threat prediction, thereby completing the construction of the network security threat prediction model; The model optimization module specifically introduces a sinusoidal smooth decay inertia weight strategy and a sinusoidal modulation shrinkage factor strategy to improve the particle swarm optimization method, obtain the optimal model hyperparameter combination, and perform model hyperparameter update and model training to obtain a trained network security threat prediction model; The network security threat intelligent detection module specifically inputs real-time data into the trained model to obtain the current network security threat prediction results and automatically trigger the corresponding security response strategy.

2. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The network security data optimization module specifically includes the following steps: Abnormal and redundant data filtering, specifically normalizing the data format of network security threat detection raw data, identifying and removing abnormal values, and clearing redundant fields; Data standardization is to convert the non-continuous data variables into one-hot codes and use the minimum-maximum normalization method to process the numerical data in the original data to normalize the data values ​​to interval; Data integrity completion; Time series synchronization involves standardizing the timestamp fields in the original data to achieve a unified timestamp format, and dividing various types of data into fixed time periods based on a sliding window mechanism to complete time granularity alignment and synchronization operations.

3. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The data integrity completion specifically includes the following steps: Field correlation calculation, specifically, using the Spearman rank correlation coefficient method to calculate the correlation between any two field variables i and j to obtain their field correlation coefficient; Calculate the field weight vector. Specifically, based on the field correlation coefficient, calculate the weighted impact value of each field on the current missing field to obtain the field weight vector. The formula used is as follows: ； Where, represents the weight vector of field j to be complemented by field i, represents the variance of field j, Represents a very small constant, used to prevent division by zero, represents the correlation coefficient between field i and field j; Calculate the weighted distance between samples. Specifically, use the weighted Euclidean distance method to calculate the overall similarity between sample a containing missing fields and historical complete sample b to obtain the weighted distance between samples. The formula used is as follows: ； Where, Represents the weighted distance calculation function between samples, represents the weighted distance between sample a and sample b, represents the value of sample a on field j, represents the value of sample b on field j, and n represents the total number of fields in the sample; The number of adaptive neighbors is determined by setting the initial number of neighbors k=3 and calculating the average distance between the first k samples and the current sample to be completed. , and set the distance deviation threshold , if the distance between the k+1th candidate neighbor sample and the current sample to be completed is satisfy , then update the number of neighbors to , continue to iterate; otherwise, terminate the process of increasing the number of neighbors, and finally determine the optimal number of neighbors to be K=k; where, Indicates the adjustment factor, the value range is , Represents the weighted distance between the current sample to be completed and the first nearest neighbor sample, Represents the weighted distance between the current sample to be completed and the kth nearest neighbor sample; Field missing value completion, specifically, using distance weighted average to complete the value of the current missing field.

4. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The establishment of the network security threat prediction model module specifically includes the following steps: The network security behavior feature sequence is constructed by using a deep convolutional neural network to extract global behavior trend features and local sensitive behavior response features from network security behavior data, thereby obtaining global behavior trend features and local sensitive behavior response features. The threat baseline state is obtained by inputting global behavioral trend characteristics and network environment context data into the first layer of long short-term memory network to generate the threat baseline state. The local sensitive behavioral response characteristics are then fused with the hidden state through the attention mechanism to obtain the threat baseline enhanced state. Dynamic differential identification of abnormal network behavior, specifically, the global behavior trend characteristics and threat baseline enhancement state are jointly input into the second-layer long short-term memory network to generate the hidden state and memory unit state of the second layer at the current moment. Then, the difference results of the hidden state and memory unit state at the current moment relative to the previous moment are calculated respectively, and the hidden state and the difference results at the current moment are fused using linear mapping to generate mutation enhancement features. Then, the attention mechanism is introduced to calculate the attention score based on the correlation between the mutation enhancement feature and the local sensitive behavior response features of each channel and the global behavior trend feature. The weighted summation of all local sensitive behavior response features is performed, and the summation result is spliced ​​with the mutation enhancement feature and the global behavior trend feature. The dynamic network threat state vector at the current moment is output through a nonlinear activation function. Adaptive threat threshold calculation; Network security threat prediction involves inputting the dynamic network threat state vector into the fully connected mapping layer, using the Softmax function to calculate the probability value of the multi-category threat state at the current moment, and comparing the probability output with the adaptive threat threshold to obtain the network security threat prediction result.

5. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The adaptive threat threshold calculation is used to dynamically generate personalized judgment thresholds to achieve sensitive responses to threat states under different network security situations. Specifically, the basic threshold item, mutation perception item, and external threat sensitivity item are constructed separately, and the adaptive threat threshold is formed through weighted fusion. The formula used is as follows: ； ； Where, Indicates the basic threat threshold item, represents the volatility adjustment coefficient, represents the time variance calculation function, represents the mutation perception term, Indicates external threat sensitive items, Represents the mutation amplitude adjustment factor, which is used to control the influence of the differential increment on the threshold. Represents the intelligence score adjustment factor, which is used to control the influence of external IOC scores on the judgment threshold. and represents the weighted fusion coefficient, It represents the threat sensitivity score obtained by analyzing the current entity behavior based on network intelligence data. represents the adaptive threat threshold, Indicates the threat baseline enhancement status, Represents the global behavioral trend characteristics, Represents the hidden state difference result at the current moment.

6. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The model optimization module specifically includes the following steps: Obtaining the optimal hyperparameters of the model, specifically by improving the particle swarm optimization method to obtain the optimal hyperparameter combination of the model; Updating model hyperparameters, specifically adjusting the hyperparameters of the network security threat prediction model according to the optimal hyperparameter combination of the model to obtain a tuned network security threat prediction model; The network security threat prediction model training specifically uses historical threat detection data as training data and adopts the cross-entropy loss function as the supervised training objective function. The weight parameters of the network security threat prediction model are back-propagated and updated through the gradient descent parameter iterative update algorithm, gradually minimizing the loss function value until the training converges, completing the model training, and finally obtaining the trained network security threat prediction model.

7. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The optimal hyperparameter acquisition of the model specifically includes the following steps: Initialize the particle swarm individuals. Specifically, encode the network security threat prediction model hyperparameters into search individual position vectors, and generate L particle individual position vectors through random initialization. Each individual encoding represents a candidate model hyperparameter combination to obtain the initial particle swarm. Calculate individual fitness values, specifically calculate the individual fitness values ​​of particles in the population The performance of the network security threat prediction model established based on the search individual position is used as the individual fitness value of the particle; Calculate the adaptive inertia weight by introducing a sinusoidal smooth decay inertia weight strategy and controlling the change of the inertia weight through a sinusoidal function. The formula used is as follows: ； Where, represents the inertia weight at the e-th iteration, and Represent the initial and final inertia weights respectively, e represents the current number of iterations, and E represents the maximum number of iterations; Calculate the search shrinkage factor. Specifically, introduce the sinusoidal modulation shrinkage factor strategy to calculate the search shrinkage factor. The formula used is as follows: ； Where, represents the search shrinkage factor for the e-th iteration, represents the sinusoidal modulation amplitude coefficient, represents the total learning factor; Particle velocity and position are updated by using the search shrinkage factor and adaptive inertia weight to update the particle velocity, and then iteratively adjusting the particle position based on the updated velocity. The formula used is as follows: ； Where, Indicates that the kth particle is in the Iteration speed, Indicates that the kth particle is in the Iteration speed, represents the local optimal position of the individual particle, represents the global optimal position of the particle, and represents a random number in the range [0,1], and represent the individual learning factor and the group learning factor, respectively. represents the position of the kth particle in the eth iteration; The optimal position of the particle is updated. Specifically, the fitness value of all updated particles is re-evaluated, and based on the fitness value of the current particle, it is compared with the global optimal position of the current particle. If the fitness value of the current particle is better, the global optimal position of the particle is updated; The particle search is terminated, specifically when the particle fitness value When the fitness threshold is exceeded and the maximum number of iterations is reached, the search is terminated and the global optimal position of the particle is obtained; the global optimal position of the particle specifically refers to the optimal hyperparameter combination of the model.

8. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The network security threat intelligent detection module specifically inputs the collected real-time threat detection data into the trained network security threat prediction model to obtain real-time network security threat prediction results. Based on the prediction results, it intelligently detects the threat level of network security and triggers corresponding security response strategies, thereby realizing intelligent detection and immediate disposal of potential attack behaviors and active prevention and control of network security risks.

9. The artificial intelligence-based network security threat detection system according to claim 1, characterized in that: The network security data collection module specifically obtains network security threat detection raw data by collecting data; the network security threat detection raw data includes historical threat detection data and real-time threat detection data; the historical threat detection data and real-time threat detection data both include network communication data, network log data, user behavior data, network environment context data and network intelligence data; the historical threat detection data also includes historical network security threat detection results.

Images