Real-time network security threat detection and response system based on artificial intelligence

Abstract

The invention discloses a real-time network security threat detection and response system based on artificial intelligence, which belongs to the technical field of network security, and comprises an abnormal behavior detection subsystem, and the abnormal behavior detection subsystem monitors behavior data in a network in real time by establishing behavior models of a user and a system, identifies abnormal behaviors, and sends the abnormal behaviors to the user. The malicious code detection subsystem adopts a plurality of malicious code detection technologies to scan files and data in the network and detect malicious codes, and the vulnerability detection subsystem regularly scans vulnerabilities of systems and applications in the network to find security vulnerabilities, and the collaborative coping subsystem carries out collaborative coping on the systems and the applications in the network. The collaborative coping subsystem coordinates the work among the subsystems according to the detection results of the subsystems, formulates a unified coping strategy and executes the coping strategy, the effective service cycle of the system can be prolonged, and the risk that the system is attacked due to the old technology is reduced.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security, and specifically relates to a real-time network security threat detection and response system based on artificial intelligence. BACKGROUND

[0002] In the current digital era, network security is of great importance. With the rapid development of network technology, network attack means is increasingly complex and diverse, which puts forward higher requirements for network security protection.

[0003] Firewall technology: A special firewall device or software module is set at the network boundary or key node. According to the network security policy, the technical personnel manually input a series of rules based on source IP address, destination IP address, port number and protocol type, etc. When the network data packet passes through the firewall, the system will automatically extract the corresponding information in the data packet and compare it with the preset rules one by one. If the data packet meets the allowed rules, it will be released; if it meets the blocked rules, it will be intercepted. For example, deploy a firewall at the connection between the enterprise internal network and the external Internet. For access requests from the outside, if the source IP address belongs to a specific trusted network segment and the destination port is the service port allowed in the enterprise internal network (such as 80 port for HTTP service), the data packet is allowed to pass; otherwise, if the source IP address is in the blacklist or the destination port is the port prohibited to access in the enterprise (such as some high-risk ports), the data packet is blocked from entering the internal network.

[0004] Malicious code detection technology: Security manufacturers or research institutions collect a large number of discovered malicious code samples, use professional analysis tools and technical means to extract the unique feature codes of each malicious code, such as specific binary code fragments of viruses, unique function call sequences of malicious software, specific hash values of files, etc., and store these feature codes in the feature library. In the actual detection process, the detection software deployed in the terminal equipment or network key node will scan the files and data in the network one by one. First, get the relevant information of the file or data, then search and compare in the feature library, if a part is found to be completely matched with the feature code of a malicious code in the feature library, it is determined that the file or data contains malicious code; if no matching item is found, it is considered to be a normal file or data. For example, the antivirus software installed on the user's computer will automatically scan and detect the relevant files when the user downloads files, opens programs or accesses network resources.

[0005] Vulnerability scanning technology: The network security managers of enterprises or organizations will regularly (such as every week, every month) start vulnerability scanning tools. These tools have a rich library of known vulnerability features built in advance, covering the vulnerability information of various common software and hardware such as operating systems, applications, network devices, etc. During the scanning process, the tool will conduct comprehensive detection on the target systems and applications in the network according to the set scanning strategy. For example, for servers in the network, the scanning tool will attempt to simulate common attack methods such as SQL injection attacks, buffer overflow attacks, etc., and send specific test data packets to the relevant service ports of the server, and compare and analyze the server's response with the information in the vulnerability feature library. If the server's response matches the characteristics of a certain vulnerability, it is determined that the server has this vulnerability; if no matching vulnerability features are found, it is considered that the server does not have known vulnerabilities within the scope of this scan.

[0006] In the field of network security, traditional security protection technologies mainly include rule-based firewall technology, signature matching malicious code detection technology, and periodic vulnerability scanning technology, etc. Firewall technology allows or blocks network traffic by setting a series of predefined rules, such as access control based on source IP address, destination IP address, port number, and protocol type, etc. This technology can block known malicious network connections to some extent, but it is difficult to effectively identify new attack methods, such as hidden attacks using normal network protocols.

[0007] Signature matching malicious code detection technology relies on collecting specific signatures of known malicious codes, such as binary code fragments of viruses or specific function call sequences of malicious software, etc. During detection, files and data in the network are scanned one by one to find matching signatures. However, with the continuous evolution of malicious code writing technology, a large number of metamorphic and encrypted malicious codes have emerged, which can easily bypass the detection mechanism based on signature matching, resulting in low detection coverage.

[0008] Periodic vulnerability scanning technology usually scans systems and applications in the network at fixed time intervals to find known security vulnerabilities. Scanning tools use predefined vulnerability feature libraries to simulate common attack methods to detect whether the system has exploitable vulnerabilities. However, this approach has obvious time lag, and if a new vulnerability appears or the network is attacked with zero-day attack between two scans, the system will be in an unprotected state. SUMMARY

[0009] To solve the above problems, the present application provides a real-time network security threat detection and response system based on artificial intelligence.

[0010] The technical scheme of the present application is as follows: a real-time network security threat detection and response system based on artificial intelligence, comprising:

[0011] An abnormal behavior detection subsystem, which establishes a behavior model of users and systems, monitors behavior data in the network in real time, and identifies abnormal behavior;

[0012] A malicious code detection subsystem, which uses multiple malicious code detection technologies to scan files and data in the network and detect malicious code;

[0013] A vulnerability detection subsystem, which periodically scans the systems and applications in the network for vulnerabilities and discovers security vulnerabilities;

[0014] A collaborative response subsystem, which coordinates the work between the subsystems according to the detection results of each subsystem, formulates a unified response strategy and executes it.

[0015] Further, the abnormal behavior detection subsystem uses an unsupervised learning algorithm to build a behavior model, collects a large amount of normal user behavior data, extracts and analyzes the features of these data, determines the behavior feature indicators, uses a clustering algorithm to aggregate the normal behavior data into different clusters, and builds a behavior model. In real-time detection, the user behavior data collected is compared with the behavior model. If the data point deviates from the range of the normal cluster, it is determined to be abnormal behavior.

[0016] Further, the abnormal behavior detection subsystem uses an unsupervised learning algorithm to build a behavior model, which is specifically: analyzing the normal behavior patterns of the user end, extracting features that can accurately describe user behavior, including network access frequency, types of access targets, size and number of data packets, login duration, complexity of resource access path, determining behavior feature indicators, and using a clustering algorithm to aggregate normal behavior data into several clusters to describe the distribution characteristics of normal behavior. Let the normal behavior data set be X = {x1, x2, …, x n}, where x i represents the i-th data point, and the data point dimension is equal to the number of features. By selecting K initial cluster centers {μ1, μ2, …, μ K}, the goal of clustering is to minimize the following objective function:

[0017]

[0018] Where r i j is an indicator variable. If the data point x i belongs to cluster j, then r i j = 1, otherwise r ij = 0;

[0019] In the real-time detection process, the user behavior data collected is first converted into feature vectors matching the model, which are compared with the normal behavior clusters that have been constructed. The deviation degree is judged by calculating the distance of the new data point to each cluster center. If the distance of the data point to its nearest cluster center exceeds a certain predefined threshold, it is determined as abnormal behavior.

[0020] Further, the malicious code detection subsystem adopts a detection technology combining feature matching and machine learning. By collecting a feature library of known malicious codes, it performs feature matching detection on files and data in the network. It uses a support vector machine to learn the samples of malicious codes and constructs a malicious code classification model. In the detection process, feature matching detection is performed first. If no matching features are found, the machine learning model is used for detection, improving the accuracy and coverage of malicious code detection.

[0021] Further, the malicious code detection subsystem adopts a detection technology combining feature matching and machine learning. Specifically, malicious code samples are distinguished from normal code samples. By collecting a large number of sample data of malicious codes and normal codes, the features are extracted from these data. The extracted features include static properties of the code such as opcode distribution and function call sequence, as well as dynamic behaviors such as system call frequency and memory operation mode. These features are converted into feature vectors in high-dimensional space for use by the support vector machine model.

[0022] Let the training data set be {(x i , y i )|i = 1, 2,..., n}, where x i is the feature vector, y i ∈{-1, 1} is the classification label, corresponding to normal code and malicious code respectively. The goal of the support vector machine is to find a hyperplane f(x) = W T x + b, so that samples of different classes can be correctly separated as much as possible, while maximizing the classification interval. The optimization objective can be formalized as the following problem:

[0023]

[0024] Where W is the normal vector of the hyperplane, determining the direction of classification; b is the bias term, determining the position of the hyperplane.

[0025] In the detection process, the support vector machine classifies the feature vectors of the input samples based on the classification model obtained by training. By calculating the distance of the sample to the hyperplane and its sign, the support vector machine can determine whether the sample belongs to malicious code or normal code.

[0026] Further, the vulnerability detection subsystem adopts a combination of active scanning and passive monitoring. In terms of active scanning, the operating system, application program, network device, etc. in the network are periodically subjected to comprehensive vulnerability scanning, and potential security vulnerabilities are discovered through simulated attacks. In terms of passive monitoring, network traffic and system log information are monitored in real time to monitor the vulnerability exploitation behavior in the network. When a vulnerability exploitation behavior is discovered, an alarm is given, and the related information of the vulnerability is further analyzed. At the same time, real-time synchronization with the vulnerability database is performed.

[0027] Further, the vulnerability detection subsystem adopts a combination of active scanning and passive monitoring. In terms of active scanning, the operating system, application program, network device, etc. in the network are periodically subjected to comprehensive vulnerability scanning, and potential security vulnerabilities are discovered through simulated attacks. In terms of passive monitoring, network traffic and system log information are monitored in real time to monitor the vulnerability exploitation behavior in the network. When a vulnerability exploitation behavior is discovered, an alarm is given, and the related information of the vulnerability is further analyzed. At the same time, real-time synchronization with the vulnerability database is performed. n i (t) represents the value of a certain feature, and by calculating the difference between these feature values and the historical traffic pattern, it is determined whether an abnormal behavior has occurred. Abnormal traffic detection usually uses clustering methods such as K-means clustering or outlier detection based on statistical analysis.

[0028] In terms of log analysis, the system analyzes each record in the system log in real time. Let the log data set be L = {l1, l2, …, l m} and each log record l i may contain clues of attack behavior. The system will use pattern matching algorithms or rule-based systems to scan the logs against known exploit patterns.

[0029] A comprehensive scoring model is constructed to evaluate whether there is an exploit behavior in the network traffic and logs. S is the exploit risk score calculated by the system for each event, defined as follows:

[0030] S = a · E(X(t)) + b · L(t)

[0031] Where E(X(t)) represents the difference between the traffic features and the normal traffic pattern, L(t) represents the matching degree of the logs with the known exploit patterns, and a and b are the weights of the traffic features and log matching, respectively.

[0032] ​Further, the cooperative coping subsystem adopts a rule-based decision engine, which formulates a series of coping rules in advance, matches the corresponding coping rules according to the detection results of each subsystem, including the type of abnormal behavior, the type of malicious code, and the severity of the vulnerability, and generates coping strategies, including isolating the affected device, blocking network connection, and starting the vulnerability repair process. At the same time, through the analysis and learning of historical coping cases, the coping rules are continuously optimized.

[0033] Further, the cooperative coping subsystem adopts a rule-based decision engine, which formulates a series of coping rules in advance, matches the corresponding coping rules according to the detection results of each subsystem, including the type of abnormal behavior, the type of malicious code, and the severity of the vulnerability, and generates coping strategies, including isolating the affected device, blocking network connection, and starting the vulnerability repair process. At the same time, through the analysis and learning of historical coping cases, the coping rules are continuously optimized.

[0034]

[0035] wherein score i i represents the malicious code score of the i-th feature, weight i represents the importance of the feature, and the final total score R determines whether to perform the blocking operation. When the score exceeds the preset threshold, the firewall will automatically block the traffic,

[0036] When the system detects a serious vulnerability, it downloads the latest security patch, verifies the integrity of the patch, performs patch installation and system restart, etc. The CVSS score of the vulnerability is used as the basis for repair priority, and the CVSS score of the vulnerability is CVSS score . The repair strategy can adjust the repair priority through the following formula:

[0037]

[0038] wherein P is the repair priority, CVSS score is the CVSS score of the current vulnerability, and max(CVSS score ) is the maximum CVSS score of the known vulnerability.

[0039] Further, the system defines the security risk score R i of each subsystem, wherein i∈{1,2,…,k} represents different subsystems, and the system calculates the comprehensive risk score R total through the following formula:

[0040]

[0041] wherein R i is the risk score of the i-th subsystem, and α iis the weight coefficient related to the subsystem, indicating the importance of each subsystem in the comprehensive risk score, by adjusting i , the influence of some subsystems is strengthened or weakened, and the comprehensive risk score R total calculated is mapped by the system to specific visual display forms, the system supports the audit and traceability of the detection and response process, during the operation of the system, all detection operations, execution information of response strategies are recorded, when a security event occurs, the audit log is used to trace the occurrence process of the event, analyze the source, transmission path of the security threat and the effectiveness of the response measures, at the same time, through the analysis of the audit data, the potential problems existing in the system are found, which provides the basis for the optimization and improvement of the system, when the system detects an abnormal behavior, malicious code or vulnerability, all context information related to the event is automatically recorded, including the source IP, attack type, affected device, the system generates a unique identifier for each security event, and associates the time stamp, related device ID, threat type information for each event, assuming that the identifier of a certain event is E i , all data related to the event are associated and searched through E i , an index structure is established, so that the data can be quickly queried by keyword or event identifier, assuming that the affected device ID of the event is d i , the system can quickly locate all events affected by the device through the following query function:

[0042]

[0043] The formula indicates that all events are searched through the device to find all event sets Q(d i ) related to the device.

[0044] The beneficial effects of the present application are:

[0045] 1. In the abnormal behavior detection subsystem, an unsupervised learning algorithm is used to construct a behavior model, and by extracting features and clustering analysis on a large amount of normal user terminal behavior data, the normal behavior pattern can be accurately captured, and the abnormal behavior can be accurately identified based on this as a benchmark, and the false positives can be effectively reduced. The malicious code detection subsystem combines feature matching and support vector machine technology, feature matching detects known malicious code feature library, support vector machine constructs a classification model by learning malicious code samples, can handle complex sample distribution, has good detection ability for new malicious code, and the combination of the two improves the accuracy and coverage of malicious code detection. The vulnerability detection subsystem combines active scanning and passive monitoring, active scanning comprehensively finds potential vulnerabilities, passive monitoring timely discovers vulnerability exploitation behavior through traffic and log analysis, and improves the detection accuracy by using a comprehensive scoring model, and can cope with known and new vulnerability attacks.

[0046] Compared with the single detection method or simple rule judgment that the prior art can have, the application comprehensively uses multiple advanced technologies and multiple dimension detection methods, analyzes network behaviors, file data and system vulnerabilities from different aspects, greatly improves the detection accuracy of various security threats, and can more timely and accurately find potential security problems to provide reliable basis for subsequent response.

[0047] 2. The abnormal behavior detection subsystem is based on the constructed behavior model, calculates the distance between the collected data and the model cluster center in real time, quickly determines the abnormal behavior according to the predefined threshold, and responds immediately once the abnormality is found. The cooperative response subsystem uses a rule-based decision engine to quickly match the response rules and generate strategies according to the detection results of each subsystem, such as isolating the device immediately after detecting abnormal behavior, blocking the propagation path immediately after finding malicious code, identifying serious vulnerabilities and starting the repair process immediately, etc., and each execution unit can quickly perform the corresponding operation.

[0048] The prior art can have a response delay problem after detecting a threat, while the design of the application ensures that effective measures can be taken at the first time when a security threat occurs, prevents the threat from further spreading, and minimizes possible losses, effectively improving the real-time protection capability of network security.

[0049] 3. The application integrates multiple subsystems such as abnormal behavior detection, malicious code detection, vulnerability detection and cooperative response, and each subsystem has clear division of labor and cooperative work. At the same time, it has the function of security situation awareness, can analyze and visualize the detection data of each subsystem, provides a comprehensive network security situation view, and supports the audit and traceability of the detection and response process, and realizes the overall protection, monitoring and management of network security.

[0050] Compared with the single function or scattered modules that the prior art can have, the application builds a complete network security system, solves multiple security problems, avoids security vulnerabilities caused by technology fragmentation, provides a one-stop network security solution for users, and greatly improves the efficiency and effectiveness of network security management.

[0051] 4. The support vector machine in the malicious code detection subsystem can process linearly inseparable data through kernel functions, adapt to complex and variable malicious code sample distribution, and continuously learn new malicious code features. The cooperative response subsystem can optimize the response rules through analysis and learning of historical response cases, and continuously improve the system response capability as the network environment changes and new security problems appear. Each subsystem has certain flexibility in technical architecture, which is convenient for subsequent addition of new detection technology or response strategy module.

[0052] In the context of the continuous evolution of network security threats, the present application can keep up with the development of security situation and timely adapt to new security challenges. Through the learning and optimization mechanism and the scalability of the architecture, the present application can always maintain the effective prevention and response ability to network security threats, prolong the effective use cycle of the system and reduce the risk of being attacked due to outdated technology. BRIEF DESCRIPTION OF DRAWINGS

[0053] Figure 1 It is a schematic diagram of the system architecture.

[0054] Figure 2 It is an abnormal behavior detection flowchart.

[0055] Figure 3 It is a malicious code detection flowchart. DETAILED DESCRIPTION

[0056] It should be noted that in the description of the present application, the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", "clockwise", "counterclockwise" and the like indicate the orientation or positional relationship shown in the drawings, which are only for the convenience of describing the present application and simplifying the description, and do not indicate or imply that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation.

[0057] In the present application, unless otherwise explicitly specified and limited, the terms "arrangement", "installation", "connection", "connection" and the like should be understood broadly, for example, "fixed" can be fixed connection, or detachable connection, or integral; the connection can be mechanical connection, or electrical connection; the connection can be direct connection, or indirect connection through intermediate medium, or the internal communication of two elements or the interaction relationship between two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances.

[0058] An artificial intelligence-based real-time network security threat detection and response system, comprising:

[0059] An abnormal behavior detection subsystem, which establishes a behavior model of the user and the system, monitors the behavior data in the network in real time, and identifies abnormal behavior;

[0060] A malicious code detection subsystem, which uses multiple malicious code detection technologies to scan files and data in the network and detect malicious codes;

[0061] A vulnerability detection subsystem, which periodically scans the system and application in the network for security vulnerabilities;

[0062] Collaborative response subsystem: The collaborative response subsystem coordinates the work between subsystems based on the detection results of each subsystem, formulates a unified response strategy and implements it.

[0063] The abnormal behavior detection subsystem uses an unsupervised learning algorithm to build a behavioral model. First, it collects a large amount of normal user behavior data, extracts and analyzes this data, and identifies behavioral characteristic indicators. Then, using a clustering algorithm, it aggregates the normal behavior data into distinct clusters to construct a behavioral model. During real-time detection, the collected user behavior data is compared with the behavioral model. If a data point deviates from the normal cluster range, it is identified as abnormal behavior.

[0064] Specifically, we analyze normal user behavior patterns and extract features that accurately describe user behavior. These features may include network access frequency, target type, packet size and number, login duration, and the complexity of resource access paths. The goal of feature extraction is to convert raw behavioral data into numerical feature vectors that reflect behavioral patterns, ensuring that the model captures key behavioral regularities and potential changes.

[0065] After the behavioral characteristic indicators are determined, an unsupervised learning algorithm is used to construct a behavioral model. Specifically, a clustering algorithm can be used to aggregate normal behavior data into several clusters to describe the distribution characteristics of normal behavior. In this process, a distance-based clustering method such as K-means clustering can be used. Suppose the normal behavior data set is X = {x1, x2, ..., x n}, where x i Represents the i-th data point, and the data point dimension is equal to the number of features.

[0066] By selecting K initial cluster centers {μ1,μ2,...,μ K}, the goal of clustering is to minimize the following objective function:

[0067]

[0068] Among them, r i j is an indicator variable, if the data point x i belongs to cluster j, then r i j =1, otherwise r i j = 0. The objective function J is to measure the sum of the squares of the Euclidean distances between each data point and the center of its cluster. This function converges through an iterative optimization process so that the cluster division can fit the distribution of normal behavior as closely as possible. The optimized cluster center μ j Together with the distribution of data points, it forms a model of normal behavior.

[0069] In real-time detection process, the collected user behavior data will first be converted into feature vectors matching the model. Then, these feature vectors are compared with the normal behavior clusters that have been constructed, and the degree of deviation is determined by calculating the distance of the new data point to each cluster center. If the distance of the data point to its nearest cluster center exceeds a certain predefined threshold, it is determined as abnormal behavior. This threshold is usually set according to the distance distribution in normal behavior data to ensure that the model has high sensitivity and low false alarm rate to abnormal behavior.

[0070] Through the above process, the abnormal behavior detection subsystem can accurately analyze real-time data based on the patterns of normal behavior. The optimization of the objective function J enables the behavior model to have strong expression ability, and the distance-based discrimination criterion in the real-time detection process ensures that the system can quickly respond to potential threats.

[0071] The malicious code detection subsystem adopts a detection technology combining feature matching and machine learning. On the one hand, by collecting a feature library of known malicious codes, such as the feature codes of viruses and the behavior features of malicious software, feature matching detection is performed on the files and data in the network. On the other hand, a support vector machine is used to learn the samples of malicious codes to construct a malicious code classification model. In the detection process, feature matching detection is performed first, and if no matching features are found, the machine learning model is used for detection to improve the accuracy and coverage of malicious code detection.

[0072] Specifically, the core of the support vector machine is to find an optimal classification hyperplane to distinguish malicious code samples from normal code samples. By collecting a large number of sample data of malicious codes and normal codes, first, the features of these data are extracted, which may include static properties of the code such as opcode distribution, function call sequence, and dynamic behavior such as system call frequency, memory operation mode, etc. These features are converted into feature vectors in high-dimensional space for use by the support vector machine model.

[0073] Let the training data set be {(x i ,y i )|i=1,2,...,n}, where x i is the feature vector, y i ∈{-1,1} is the classification label, corresponding to normal code and malicious code respectively. The goal of the support vector machine is to find a hyperplane f(x)=W T x+b that can separate samples of different classes as correctly as possible while maximizing the classification margin. Its optimization objective can be formalized as the following problem:

[0074]

[0075] where W is the normal vector of the hyperplane, determining the direction of classification; b is the bias term, determining the position of the hyperplane; the constraint condition ensures that the sample points are correctly classified and located outside the margin. The objective function The significance of minimizing the norm of the hyperplane normal vector is to maximize the minimum distance of support vectors to the hyperplane, thereby improving the generalization ability of classification.

[0076] For linearly inseparable data, support vector machines map the original features to a higher dimensional space through kernel functions, and find a linearly separable hyperplane in the high dimensional space. Common kernel functions include Gaussian kernel and polynomial kernel. The introduction of kernel function enables support vector machine to handle complex malicious code sample distribution, further enhancing the detection ability of the model.

[0077] In the detection process, support vector machine classifies the feature vector of the input sample based on the classification model obtained by training. By calculating the distance of the sample to the hyperplane and its sign, support vector machine can judge whether the sample belongs to malicious code or normal code. This classification method not only has high accuracy, but also can achieve good detection effect on new malicious code.

[0078] The introduction of support vector machine provides learning and prediction ability for unknown threats in malicious code detection, and combined with feature matching technology, it can supplement the known threat detection. Through the mechanism of maximizing the classification interval of the optimal classification hyperplane, support vector machine realizes effective learning of the complex patterns of malicious code samples, thereby improving the coverage and accuracy of malicious code detection.

[0079] The vulnerability detection subsystem adopts the combination of active scanning and passive monitoring. In terms of active scanning, it regularly conducts comprehensive vulnerability scanning on operating systems, application programs, network devices and other network components, and discovers potential security vulnerabilities through simulated attacks. In terms of passive monitoring, it monitors potential vulnerability exploitation behaviors in the network by listening to network traffic, system logs and other information in real time. When a vulnerability exploitation behavior is found, it timely alarms and further analyzes the related information of the vulnerability. At the same time, through real-time synchronization with the vulnerability database, it ensures that it can detect the latest security vulnerabilities.

[0080] Specifically, in this process, the system mainly focuses on two aspects: one is to discover malicious requests or abnormal behaviors through traffic analysis, and the other is to reveal potential vulnerability exploitation through log analysis. The key of passive monitoring lies in the effective processing and real-time analysis of traffic and log data, so as to identify the signs of vulnerability exploitation in time.

[0081] First, in the process of monitoring network traffic, the system identifies possible attack behaviors by conducting deep analysis on transmitted packets, combined with attack characteristics of known vulnerabilities. For example, when detecting abnormal traffic on certain specific ports or certain packets with characteristics of known vulnerability exploits, the system will trigger an alarm mechanism. To improve the accuracy and real-time performance of detection, an anomaly detection method for traffic can be used, where the characteristics of traffic usually include packet size, transmission frequency, target address accessed, etc. Let the network traffic at time t be X(t) = {x1(t), x2(t),..., x n (t)}, where x i (t) represents the value of a certain characteristic (such as packet size). By calculating the difference between these characteristic values and historical traffic patterns, it can be determined whether abnormal behavior has occurred. Anomaly traffic detection usually uses clustering methods such as K-means clustering or outlier detection based on statistical analysis.

[0082] In terms of log analysis, the system analyzes each record in the system log in real time, especially logs related to system access, error information, and security events. Let the log data set be L = {l1, l2,..., l m}, and each log record l i may contain clues of attack behavior. The system scans the logs using pattern matching algorithms or rule-based systems against known vulnerability patterns. For example, for some common buffer overflow vulnerabilities, the logs may contain suspicious input data or access abnormal error information. By matching these patterns, the system can quickly identify potential attack behavior.

[0083] On this basis, to further improve the accuracy of detection, passive monitoring systems usually combine traffic and log data for comprehensive analysis. A comprehensive scoring model can be constructed to evaluate whether there is a vulnerability exploit behavior in network traffic and logs. For example, let S be the vulnerability exploit risk score calculated by the system for each event, defined as follows:

[0084] S = α·E(X(t)) + β·L(t)

[0085] where E(X(t)) represents the difference between traffic characteristics and normal traffic patterns, L(t) represents the matching degree of logs with known vulnerability exploit patterns, and α and β are the weights of traffic characteristics and log matching respectively. The purpose of this scoring model is to consider traffic anomalies and attack behaviors in logs comprehensively, thereby generating a unified evaluation result to provide subsequent alarm and analysis systems.

[0086] In this way, the vulnerability detection subsystem can capture potential exploit behaviors in the network in real time through passive monitoring. The parameters a and b in the scoring model are adjusted according to historical attack patterns and system characteristics, thereby improving the accuracy and robustness of detection. The comprehensive use of traffic analysis and log analysis enables the system not only to deal with known vulnerabilities, but also to identify attack behaviors of new vulnerabilities, thereby enhancing the overall detection capability.

[0087] The cooperative response subsystem adopts a rule-based decision engine. A series of response rules are prepared in advance, and the corresponding response rules are matched according to the detection results of each subsystem, such as the type of abnormal behavior, the type of malicious code, and the severity of the vulnerability. The decision engine generates a response strategy based on the matching results, including but not limited to isolating affected devices, blocking network connections, and starting the vulnerability repair process. At the same time, through analysis and learning of historical response cases, the response rules are continuously optimized to improve the effectiveness of the response strategy.

[0088] Specifically, the following three rules are included but not limited to:

[0089] The first rule is "when abnormal behavior is detected, the system administrator should immediately isolate the affected device to prevent the attack from spreading." In this rule, the execution unit is the system administrator, the task is to isolate the affected device, the execution time is immediately after the abnormal behavior is detected, and the execution scene is on the device that detects abnormal traffic or abnormal behavior in the local network. In order to achieve this operation, the system needs to collect the status of each device in the network in real time, and when abnormal behavior is detected, the device is automatically marked as restricted state through network control protocol (such as ARP or DHCP), and the network connection between the device and other devices is disconnected. The effect of this action is to avoid the attacker further expanding the attack range through the device.

[0090] The second rule is "when malicious code is detected, the firewall should automatically block the propagation path of the malicious code." The execution unit is the firewall, the task is to block the propagation path of the malicious code, the execution time is when the malicious code is detected, and the execution scene is when a packet from an untrusted source or containing malicious features is detected. At this time, the firewall needs to set up a strategy at the network boundary according to the propagation characteristics of the malicious code (such as the communication protocol, port number, IP address, etc. of the malicious code), and block the corresponding traffic. The specific rule can be quantified and evaluated by the following formula:

[0091]

[0092] wherein score i represents the malicious code score of the i-th feature (such as port, IP address), weight irepresents the importance of the feature. The final total score R will determine whether to perform the blocking operation. When the score exceeds the preset threshold, the firewall will automatically block the traffic. This mechanism can ensure that the firewall can still respond quickly based on known malicious features when facing new or unknown malicious code.

[0093] The third rule is that "when the system detects a serious vulnerability, the vulnerability repair system should start the automatic repair process." In this rule, the execution unit is the vulnerability repair system, and the task is to start the automatic repair process. The execution time is when the vulnerability is detected and determined to be a high-risk or known vulnerability. The execution scene is when the host or device in the network detects a security vulnerability. The specific execution operations include downloading the latest security patch, verifying the integrity of the patch, performing patch installation, and system restart, etc. In order to ensure the efficiency of the repair process, the CVSS (Common Vulnerability Scoring System) score of the vulnerability can be used as the basis for repair priority. Let the CVSS score of the vulnerability be CVSS score , then the repair strategy can adjust the priority of repair by the following formula:

[0094]

[0095] Where P is the repair priority, CVSS score is the CVSS score of the current vulnerability, and max(CVSS score ) is the maximum CVSS score of known vulnerabilities. The priority P calculated by the formula will determine the start order of the repair process, ensuring that the most serious vulnerabilities are repaired first, reducing the risk of system attacks.

[0096] The system has a security posture awareness function. Through comprehensive analysis and visual display of detection data of each subsystem, it provides users with a real-time view of the network security posture. Users can intuitively understand the distribution of security threats in the network, threat development trends and other information. In terms of visual display, a variety of visualization technologies are used, including but not limited to topology graphs, bar charts, line charts, to display security posture information in different forms, making it easy for users to analyze and make decisions.

[0097] Specifically, the system needs to perform data fusion and comprehensive analysis on the detection data of each subsystem. The detection results provided by each subsystem may have different forms and dimensions, for example, the abnormal behavior detection may provide the deviation degree of behavior characteristics, the malicious code detection may provide the type and propagation path of malicious software, and the vulnerability detection may involve the type and severity of vulnerabilities. Therefore, the system needs to convert these data into a unified security risk score for comprehensive evaluation. For this purpose, the security risk score R iwhere i ∈ {1, 2, …, k} represents different subsystems. The system calculates the comprehensive risk score R total :

[0098]

[0099] where R i is the risk score of the i-th subsystem, α i is the weight coefficient associated with this subsystem, representing the importance of each subsystem in the comprehensive risk score. By adjusting α i , the influence of certain subsystems can be strengthened or weakened according to actual circumstances. For example, if vulnerability detection has a greater impact on overall network security, α i can be set to a higher value, so that the results of vulnerability detection contribute more to the overall risk score.

[0100] By calculating the comprehensive risk score R total , the system can map it to specific visual display forms. For example, a topology graph is used to show the security status of each node in the network, and different risk levels of nodes can be represented by the depth of color; a column chart is used to show the distribution of different types of security threats, and the number and proportion of various threats such as malicious code, vulnerabilities, and abnormal behavior can be clearly seen; a line chart is used to show the trend of threats, helping users understand the rising or falling trend of threats and identify potential security risks in a timely manner.

[0101] In terms of visual display, the system can also update dynamic views according to real-time data, providing more intuitive decision support. For example, the system may mark devices with high-risk vulnerabilities in the network topology graph and highlight devices with abnormal behavior using dynamic identifiers such as flashing red borders. When displaying a column chart, the height of the bars can be dynamically adjusted to represent the real-time number of each threat in the current network, helping users quickly grasp the real-time distribution of threats.

[0102] In addition, the system will provide custom views according to the needs of different users, and users can select specific security dimensions for detailed analysis. For example, administrators can choose to view only vulnerability-related risk scores, focusing on known vulnerabilities in the network for further repair and protection.

[0103] Through such comprehensive analysis and visual display, the system can help users comprehensively understand the security situation in the network. The comprehensive risk score formula R totalAn objective risk assessment indicator is provided, and the visual display converts complex security data into easily understood images through various chart forms, facilitating users to quickly identify potential threats and make decisions. This function makes security situation awareness not only limited to data collection and display, but also emphasizes data analysis and decision support, effectively improving the efficiency of network security management.

[0104] The system supports auditing and tracing of detection and response processes. During system operation, all detection operations, execution of response strategies, and other information are recorded. When a security event occurs, the audit log can be used to trace the event occurrence process, analyze the source of security threats, transmission path, and effectiveness of response measures. At the same time, by analyzing the audit data, potential problems existing in the system can be found, providing a basis for optimization and improvement of the system.

[0105] Specifically, the system needs to quickly search and trace the source of security events, which includes searching all relevant data in the network. Specifically, when the system detects an abnormal behavior, malicious code or vulnerability, it will first automatically record all context information related to the event, such as source IP, attack type, affected devices, etc. In order to quickly locate relevant data, the system needs to generate a unique identifier for each security event, and associate each event with a timestamp, related device ID, threat type, etc. Assuming that the identifier of a certain event is E i , all data related to the event (such as devices, IPs, times, etc.) can be associated and searched through E i .

[0106] In order to achieve this function, the system needs to establish an index structure when storing and querying data, so that data can be quickly queried by keyword or event identifier. For example, assuming that the affected device ID of an event is d i , the system can quickly locate all events affected by this device through the following query function:

[0107] Q(d i )={E j ∣event(E j )involvesdeviced i}

[0108] The formula indicates that all events are searched through device to find all events related to the device Q(d i ). This query process greatly improves the efficiency of event tracing, especially when complex attacks or cross-device attacks occur, all related security events can be quickly located to help analyze the attack path.

[0109] Secondly, the system can help users understand the changing trends of threats through the storage and tracing of historical data. Whenever new data enters, the system compares it with historical data to analyze the evolution path of threats. For example, through time series analysis, the system can calculate the frequency and trend of a specific type of attack (such as a DDOS attack) over a period of time. This analysis result is displayed in the form of a line chart, helping users intuitively see the growth or weakening trend of threats.

[0110] To further enhance the ability of trace analysis, the system can introduce a clustering algorithm to group historical events and identify potential attack patterns or behavioral characteristics. Let the feature vector of each event be x i , the system can cluster events through the K-means clustering algorithm, grouping similar events into a class. Through such clustering, the occurrence pattern of similar attack events and the behavior characteristics of attackers can be quickly identified, helping users make more accurate decisions.

[0111] In this way, the rapid retrieval and traceability function can combine the detection results of each subsystem and historical data to provide a real-time security posture view. Using the query function Q(d i ) in the formula and the clustering algorithm, the system can not only quickly locate the source and evolution trajectory of events, but also provide data support for subsequent defense and decision-making. This method effectively improves the speed of event response and the depth of analysis, enabling users to quickly respond to and handle various security threats in complex network environments.

[0112] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any modification, equivalent replacement and improvement made by those skilled in the art within the technical scope disclosed by the present application, as long as it is within the spirit and principles of the present application, shall be covered within the protection scope of the present application. Meanwhile, the contents not described in detail in the specification are all prior art known to those skilled in the art.

[0113] It should be noted that in this paper, relational terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variant thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device.

Claims

1. A real-time network security threat detection and response system based on artificial intelligence, characterized by: include: Abnormal behavior detection subsystem: The abnormal behavior detection subsystem monitors the behavioral data in the network in real time and identifies abnormal behavior by establishing user and system behavior models; Malicious code detection subsystem: The malicious code detection subsystem uses a variety of malicious code detection technologies to scan files and data in the network and detect malicious code; Vulnerability detection subsystem: The vulnerability detection subsystem regularly scans the systems and applications in the network for vulnerabilities to discover security vulnerabilities; collaborative response subsystem: The collaborative response subsystem coordinates the work between subsystems based on the detection results of each subsystem, formulates a unified response strategy and implements it.

2. A further artificial intelligence-based real-time network security threat detection and response system according to claim 1, characterized in that: The abnormal behavior detection subsystem uses an unsupervised learning algorithm to build a behavior model, collects a large amount of normal user-side behavior data, extracts and analyzes features of this data, determines behavioral characteristic indicators, and uses a clustering algorithm to aggregate normal behavior data into different clusters to build a behavior model. During the real-time detection process, the collected user-side behavior data is compared with the behavior model. If the data point deviates from the range of the normal cluster, it is determined to be abnormal behavior.

3. A further artificial intelligence-based real-time network security threat detection and response system according to claim 2, characterized in that: The abnormal behavior detection subsystem uses an unsupervised learning algorithm to build a behavior model. Specifically, it analyzes the normal behavior patterns of the user end and extracts features that can accurately describe the user behavior. The features include network access frequency, type of access target, size and number of data packets, login time, and complexity of resource access paths. After the behavior feature indicators are determined, the normal behavior data is aggregated into several clusters through a clustering algorithm to describe the distribution characteristics of normal behavior. Suppose the normal behavior data set is X = {x1, x2, ..., x n }, where x i Represents the i-th data point, the data point dimension is equal to the number of features, by selecting K initial cluster centers {μ1,μ2,...,μ K }, the goal of clustering is to minimize the following objective function: Among them, r ij is an indicator variable, if the data point x i belongs to cluster j, then r ij =1, otherwise r ij =0; During the real-time detection process, the collected user-side behavior data will first be converted into feature vectors that match the model. These feature vectors are compared with the established normal behavior clusters. By calculating the distance between the new data point and each cluster center, the degree of deviation is determined. If the distance between the data point and its nearest cluster center exceeds a predefined threshold, it is determined to be abnormal behavior.

4. A real-time network security threat detection and response system based on artificial intelligence according to claim 1, characterized in that: The malicious code detection subsystem uses a detection technology that combines feature matching and machine learning. By collecting a feature library of known malicious codes, feature matching detection is performed on files and data in the network. Support vector machines are used to learn malicious code samples and build a malicious code classification model. During the detection process, feature matching detection is performed first. If no matching features are found, the machine learning model is used for detection to improve the accuracy and coverage of malicious code detection.

5. A further artificial intelligence-based real-time network security threat detection and response system according to claim 4, characterized in that: The malicious code detection subsystem uses a detection technology that combines feature matching and machine learning. Specifically, it distinguishes malicious code samples from normal code samples by collecting a large amount of malicious code and normal code sample data and extracting features from these data. The extracted features include static properties of the code such as opcode distribution and function call sequence, as well as dynamic behaviors such as system call frequency and memory operation mode. These features are converted into feature vectors in high-dimensional space for use by the support vector machine model. Suppose the training data set is {(x i ,y i )|i=1,2,...,n}, where x i is the eigenvector, y i ∈{-1, 1} is the classification label, corresponding to normal code and malicious code respectively. The goal of the support vector machine is to find a hyperplane f(x)=W T x+b, so that samples of different categories can be separated as correctly as possible, while maximizing the classification interval. Its optimization goal can be formalized as the following problem: Among them, W is the normal vector of the hyperplane, which determines the direction of classification; b is the bias term, which determines the position of the hyperplane. During the detection process, the support vector machine classifies the feature vector of the input sample based on the trained classification model. By calculating the distance between the sample and the hyperplane and its sign, the support vector machine can determine whether the sample belongs to malicious code or normal code.

6. A real-time network security threat detection and response system based on artificial intelligence according to claim 1, characterized in that: The vulnerability detection subsystem adopts a combination of active scanning and passive monitoring. In terms of active scanning, it regularly conducts comprehensive vulnerability scans on the operating system, applications, network devices, etc. in the network, and discovers potential security vulnerabilities by simulating attacks. In terms of passive monitoring, it monitors the vulnerability exploitation behavior in the network in real time by listening to network traffic and system log information. When vulnerability exploitation behavior is found, an alarm is issued and the relevant information of the vulnerability is further analyzed. At the same time, it is synchronized with the vulnerability database in real time.

7. A further artificial intelligence-based real-time network security threat detection and response system according to claim 6, characterized in that: The vulnerability detection subsystem adopts a combination of active scanning and passive monitoring. Specifically, during the monitoring of network traffic, the system conducts in-depth analysis of the transmitted data packets and identifies attack behaviors by combining the attack characteristics of known vulnerabilities. When abnormal traffic is detected on a specific port, or certain data packets have the characteristics of known vulnerability exploits, the system will trigger an alarm mechanism and adopt a traffic anomaly detection method. The traffic characteristics usually include the size of the data packet, the transmission frequency, and the target address of the access. The network traffic at time t is set to X(t) = {x1(t), x2(t), ..., x n (t)}, where x i (t) represents the value of a certain feature. By calculating the difference between these feature values ​​and historical traffic patterns, it is determined whether abnormal behavior has occurred. Abnormal traffic detection usually uses clustering methods, such as K-means clustering, or outlier detection based on statistical analysis. In terms of log analysis, the system analyzes each record in the system log in real time. Suppose the log data set is L = {l1,l2,...,l m }, each log record l i The system scans the logs for known vulnerability exploitation patterns using pattern matching algorithms or rule-based systems. A comprehensive scoring model is constructed to evaluate whether there is vulnerability exploitation in network traffic and logs. S is the vulnerability exploitation risk score calculated by the system for each event, which is defined as follows: S=α·E(X(t))+β·L(t) Among them, E(X(t)) represents the degree of difference between traffic characteristics and normal traffic patterns, L(t) represents the degree of matching between logs and known vulnerability exploitation patterns, and α and β are the weights of traffic characteristics and log matching, respectively.

8. A real-time network security threat detection and response system based on artificial intelligence according to claim 1, characterized in that: The collaborative response subsystem adopts a rule-based decision engine and pre-establishes a series of response rules. It matches the corresponding response rules according to the detection results of each subsystem, including the type of abnormal behavior, the type of malicious code, and the severity of the vulnerability. The decision engine generates a response strategy based on the matching results, including isolating the affected devices, blocking network connections, and initiating the vulnerability repair process. At the same time, it continuously optimizes the response rules through analysis and learning of historical response cases.

9. A further artificial intelligence-based real-time network security threat detection and response system according to claim 8, characterized in that: The collaborative response subsystem uses a rule-based decision-making engine. Specifically, the system collects the status of each device in the network in real time. When abnormal behavior is detected, it automatically marks the device as restricted through the network control protocol and disconnects the device from other devices. When malicious code is detected, the firewall quantifies and evaluates it using the following formula: Among them, score i Indicates the malicious code score of the i-th feature, weight i Indicates the importance of the feature. The final total score R will determine whether to perform a blocking operation. When the score exceeds the preset threshold, the firewall will automatically block the traffic. When a serious vulnerability is detected in the system, the system will download the latest security patch, verify the integrity of the patch, install the patch, and restart the system. The CVSS score of the vulnerability will be used as the basis for repair priority. score , the repair strategy can adjust the repair priority through the following formula: Among them, P is the repair priority, CVSS score is the CVSS score of the current vulnerability, max(CVSS score ) is the maximum CVSS score of known vulnerabilities.

10. A real-time network security threat detection and response system based on artificial intelligence according to claim 1, characterized in that: The system defines the security risk score R for each subsystem i , where i∈{1,2,...,k} represents different subsystems. The system calculates the comprehensive risk score R by the following formula total : Among them, R i is the risk score of the ith subsystem, α i is the weight coefficient associated with the subsystem, indicating the importance of each subsystem in the comprehensive risk score. i , strengthen or weaken the impact of certain subsystems, and calculate the comprehensive risk score R total , the system maps it to a specific visual display form. The system supports auditing and tracing of the detection and response process. During the operation of the system, all detection operations and the execution of response strategies are recorded. When a security incident occurs, the occurrence process of the incident is traced through the audit log, and the source, propagation path and effectiveness of the response measures of the security threat are analyzed. At the same time, through the analysis of audit data, potential problems in the system are discovered, providing a basis for the optimization and improvement of the system. When the system detects an abnormal behavior, malicious code or vulnerability, it automatically records all contextual information related to the incident, including the source IP, attack type, and affected devices. The system generates a unique identifier for each security event and associates a timestamp, related device ID, and threat type information for each event. Assume that the identifier of an event is E i , then all data related to the event are passed through E i Perform associated retrieval and establish an index structure so that data can be quickly queried by keyword or event identifier. Let the device ID of the event be d i , the system can quickly locate all events affected by the device through the following query function: Q(d i )={E j ∣event(E j )involvesdeviced i } This formula indicates that through the device Search all events and find all event sets Q(d i ).

Images