Network security data analysis system and method based on artificial intelligence

Abstract

The invention discloses a network security data analysis system and method based on artificial intelligence, and relates to the technical field of network security, and the method comprises the steps: constructing a structured triple, mapping the structured triple into graph nodes and edges, and storing the graph nodes and edges in a graph database; extracting graph data from the graph database, and generating a node feature matrix, an adjacent matrix and an edge feature matrix; utilizing a graph attention mechanism to train a node representation vector, and constructing a semantic propagation matrix; obtaining a predicted attack path model; generating a candidate attack path set; constructing a credible scoring model, training and optimizing, and screening high-credibility paths with scores exceeding a threshold value; constructing a multi-layer perceptron model to obtain an attack source prediction model; according to the method, real-time atlas data is obtained, the nodes exceeding the threshold value are marked as risk nodes, the risk nodes are uploaded to a protection system to trigger alarm and check, and the automation and real-time performance of attack source recognition are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security data analysis system and method based on artificial intelligence. Background Technology

[0002] In existing network security protection systems, the detection and response to various network attacks usually rely on traditional methods such as rule matching, signature analysis, or traffic behavior analysis. When faced with complex attack paths, lateral penetration, or multi-stage attacks, traditional network security protection mechanisms are difficult to trace and handle attacks in real time and effectively, which can easily lead to security vulnerabilities.

[0003] Most current security architectures adopt static analysis models based on feature matching or behavioral patterns, which have problems such as delayed attack detection, frequent false alarms, and inability to effectively distinguish between attacks and normal traffic. This results in slow response speed and low handling efficiency for security incidents. It is also difficult to quickly identify the source of the attack, locate the root cause of the attack behavior, and effectively prevent the spread of subsequent attacks by dynamically adjusting the protection strategy.

[0004] Therefore, there is a need for a method that utilizes graph structures and reasoning mechanisms to perform in-depth analysis of attack events, dynamically construct attack path graphs, automatically score paths and trace attack chains, thereby significantly improving the reliability, robustness and emergency response capabilities of network security protection systems. Summary of the Invention

[0005] The purpose of this invention is to provide an artificial intelligence-based network security data analysis system and method to solve the problems raised in the prior art.

[0006] To address the aforementioned technical problems, this invention provides the following technical solution: a network security data analysis method based on artificial intelligence, the method comprising:

[0007] Step S100: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals to identify network behavior events, extract information of sending and receiving entities, construct structured triples and standardize them, map them as graph nodes and edges, attach time tags and context attributes, and store them in the graph database.

[0008] Step S200: Extract graph data from the graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model.

[0009] Step S300: Use the predicted attack path model to infer and train the periodic graph, and generate a set of candidate attack paths; extract the risk level, anomaly frequency, path length, edge confidence and time consistency factor of the path nodes, construct a credibility scoring model and train and optimize it, and screen high credibility paths with scores exceeding the threshold.

[0010] Step S400: Extract the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalize them, and label them with attack source tags; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function to obtain the attack source prediction model;

[0011] Step S500: Obtain real-time graph data, generate a candidate path set through the attack path prediction model; input the trust score model to calculate the real-time trust score, and filter high trust paths; input the attack source prediction model to output the node probability, mark nodes exceeding the threshold as risk nodes, and upload them to the protection system to trigger alarms and verification.

[0012] Furthermore, step S100 includes:

[0013] Step S101: When a network device connects to the network, the network security protection system is started. In the network security protection system, the time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior and to extract the information of the sending entity and the receiving entity in the event.

[0014] Step S102: Based on the network behavior events identified in step S101, the sending entity, behavior type and receiving entity extracted from each event are combined into structured triples, a set of triples is established, the original behavior relation database is constructed, and field standardization and semantic normalization are performed.

[0015] Step S103: Map each entity object in the triplet set constructed in step S102 to a node in the graph, and map each behavior relation type to an edge in the graph, thereby constructing a graph of network behavior. During the graph construction process, assign a node type label to each node and an edge type label to each edge.

[0016] Step S104: On the constructed graph, introduce time tags associated with each edge, extract the context field information when the behavior occurs, and use it as an additional attribute of the edge. At the same time, extract the attribute information related to each node, and attach the attribute information to the corresponding node to construct a directed graph structure, and store the graph structure in the graph database.

[0017] By analyzing these log data, the system can identify events related to network behavior and extract information about the sending and receiving entities. Specifically, the system identifies behavioral events and extracts information about relevant entities through in-depth analysis of traffic, logs, and host audit data, which serves as the basis for subsequent processing.

[0018] The system standardizes data fields and uses semantic normalization to ensure that behavioral relationship data in the database has a unified format and consistent semantic expression. The sending and receiving entities will become nodes in the graph, and the behavior type will be used as an edge to connect the nodes. The system also assigns a node type label to each node and an edge type label to each edge to ensure that the graph structure is clear and facilitates subsequent analysis and processing.

[0019] By regularly and automatically collecting network device log data and performing structured analysis, network behavior events can be identified in real time. This ensures that the protection system can obtain the latest network behavior information in a timely manner, providing an efficient data source for subsequent security analysis. The structured data facilitates subsequent processing and graph construction, ensures data consistency and standardization, and is easy to share and apply in multiple systems.

[0020] The graph structure provides clear entity relationships for network security analysis, supporting subsequent behavior prediction and attack path inference. The introduction of time tags and contextual attributes not only enriches the graph structure but also improves its timeliness and contextual awareness. Time tags can accurately record the timing information of behavior occurrences, helping the system better understand the evolution of behavior. The contextual attributes attached to nodes provide more background information, further enhancing the semantic depth of the graph data.

[0021] Furthermore, step S200 includes:

[0022] Step S201: Extract the graph corresponding to each event from the graph database, extract the attributes and feature information of each node in the graph, count the behavior type and timestamp of each edge, and extract the contextual semantic features of the edges. Encode the nodes and edges and convert them into input data formats that can be recognized by the graph neural network model. Generate node feature matrix, adjacency matrix and edge feature matrix. Construct the input tensor of the graph neural network. Utilize node attributes, adjacent node context, edge behavior semantics and time sequence information, and use the graph attention mechanism to perform multi-layer embedding training to generate node representation vectors. Utilize the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges.

[0023] Step S202: Using the node feature matrix extracted in step S201 as input, initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, construct a relation propagation matrix. Through each layer of the graph neural network, aggregate the features of neighboring nodes and the relation propagation matrix, and calculate and update the node's representation vector according to the following formula:

[0024]

[0025] in, This is represented as the representation vector of node a at the (d+1)th layer. Let D represent the attention weight of neighboring node c to node a in layer d. d Let d be the trainable weight matrix of the d-th layer. Let F be the representation vector of the adjacent node c at the d-th layer. ac This is represented as the propagation weight of information from node c to node a;

[0026] Step S203: Take the confirmed attack paths in the historical data as positive samples and the non-attack paths or normal operation paths as negative samples. Label the path level corresponding to the positive and negative samples. Based on the label data, retrain the graph neural network model to optimize the node representation vector and the relation propagation matrix. After training, the predicted attack path model is obtained.

[0027] By using the semantic information, behavior type, and temporal features of edges, a relation propagation matrix is ​​constructed. In each layer of the graph neural network, the system aggregates the features of neighboring nodes and the relation propagation matrix. Through the iteration of each layer, the representation vector of the node will be updated step by step, and finally an embedded representation with global context information will be generated for each node.

[0028] By retraining the graph neural network using labeled data, the node representation vector and relation propagation matrix are optimized. During the training process, the system adjusts the model parameters through supervised learning to ensure high accuracy in the prediction results of positive and negative sample paths. After training, the graph neural network can identify potential attack paths, thereby obtaining an attack path prediction model. This model can provide automated attack path identification and early warning capabilities for network security protection.

[0029] By extracting relevant graph data from graph databases and performing encoding conversion, raw log data can be quickly converted into an input format suitable for graph neural networks, greatly improving data processing efficiency.

[0030] By employing a graph attention mechanism for multi-layer embedding training, the node representation vector can effectively aggregate the feature information of neighboring nodes, and attention weights are assigned according to the importance of different neighboring nodes, thereby making the model's learning of relationships between nodes more accurate and flexible.

[0031] By constructing a relation propagation matrix and aggregating the features of neighboring nodes at each layer, the system can generate node representation vectors with global context information. These vectors not only consider the features of the node itself, but also fully integrate the context information of neighboring nodes, thus improving the expressive power of the model.

[0032] By retraining and combining positive and negative sample data from historical attack paths, the system can optimize node representation vectors and relation propagation matrices, enabling the model to accurately predict potential attack paths. This predictive capability helps security systems automatically identify and block network attacks.

[0033] Furthermore, step S300 includes:

[0034] Step S301: Set a training period of several consecutive days, and based on the prediction attack path model constructed in step S203, perform inference on the graph data within the training period to generate a set of candidate attack paths. Obtain the representation vector of the path nodes, semantic information of the associated edges, behavior type and temporal features of each candidate attack path.

[0035] Step S302: Perform structured analysis on each candidate attack path to extract key feature information. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal node behavior, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. Use this key feature information as input data for the credibility scoring model, which is expressed as follows:

[0036] S = σ(e×R + f×G + g×T);

[0037] Where S represents the credibility score, R represents the path node risk score, G represents the path behavior sequence confidence, T represents the path time consistency factor, and e, f, and g represent the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor, respectively.

[0038] Step S303: Based on the graph data during the training period and the key feature information of the candidate attack paths extracted in step S302, the credibility scoring model is trained and its parameters are optimized. During the training process, the key feature information is used as training samples to input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned to obtain the trained credibility scoring model.

[0039] Step S304: Set a preset trust score threshold, and set candidate attack paths with trust scores exceeding the trust score threshold as high trust paths;

[0040] The system performs structured analysis on each candidate attack path, extracting key discriminative features from the path. The path length is the number of nodes or edges, and the time consistency factor of the path behavior sequence is used to measure the regularity or rationality of the time interval between events in the path.

[0041] The system sets a trust score threshold to filter the score results of candidate attack paths. Paths with scores exceeding the set threshold are marked as "high trust attack paths" and become the core focus of the subsequent threat response module. This step significantly reduces the false alarm rate and processing resource consumption, ensures that the system prioritizes the paths with the highest potential risks, and improves overall response efficiency.

[0042] Furthermore, step S400 includes:

[0043] Step S401: Extract analysis data from the selected high-confidence paths, analyze the behavior starting nodes in the paths, collect the pre-emptiveness, connection breadth and propagation strength, and perform normalization processing, and perform binary classification labeling based on whether the node is an attack source.

[0044] Step S402: Construct an attack source prediction model. This model is based on a multilayer perceptron model, using the sigmoid activation function as the output layer activation function and the ReLU activation function as the hidden layer activation function. Normalized node pre-existence, connection breadth, and propagation strength are used as input vectors.

[0045] Step S403: Train the attack source prediction model based on the graph data within the training period, using binary cross-entropy as the loss function, and continuously update the parameters through the backpropagation algorithm and optimizer to obtain the trained attack source prediction model.

[0046] For each high-confidence path, the system identifies the starting node of the behavior in the path and performs multi-dimensional feature analysis on that node by combining the graph structure and behavior records. The core features extracted include: Precedence: indicating the degree to which the node's behavior position is earlier in the path, used to measure its potential as a starting point; Connection breadth: indicating the number of neighboring nodes connected to the node in the graph, used to reflect the range of its behavior propagation; Propagation intensity: indicating the strength or density of the influence of the behavior transmitted by the node and its adjacent edges in the path;

[0047] After extraction, the system performs numerical normalization on the above features to make them conform to the input standards of the neural network model. At the same time, based on whether the node was identified as the origin of the attack in the historical labeled data, the system labels each sample node with a binary classification label, such as attack source or non-attack source, for use in the subsequent supervised learning process.

[0048] After acquiring sample features, the system constructs an attack source prediction model to identify potential attack initiation nodes. This model employs a multilayer perceptron (MLP) structure, specifically consisting of several hidden layers and one output layer.

[0049] Input layer: Receives a vector composed of the normalized features of three nodes: pre-features, connectivity breadth, and propagation strength; Hidden layer: Uses ReLU modified linear units as activation functions to introduce non-linear expressive power; Output layer: Uses the Sigmoid activation function to restrict the model output value to [0,1], which is used to express the probability that the current node is the attack source;

[0050] The above model structure combines structured input and nonlinear mapping capabilities, has good fitting effect and classification ability, and can be adapted to attack source identification tasks in various types of network structures.

[0051] The system trains the constructed attack source prediction model based on the graph data collected during the training period and the labeled attack source information. During training, the model uses the normalized features of nodes as input, binary classification labels as supervision signals, and a binary cross-entropy loss function as the optimization objective to measure the deviation between the model's predicted probability and the actual label. During training, the system applies the backpropagation algorithm combined with a specific optimizer to iteratively update the weights and bias parameters in the model, continuously minimizing the loss function value, thereby improving the prediction accuracy. After training, the system obtains an attack source prediction model with converged parameters and good generalization ability.

[0052] Furthermore, step S500 includes:

[0053] Step S501: Obtain real-time graph data and generate a set of real-time candidate attack paths through the attack path prediction model;

[0054] Step S502: Input each candidate attack path in the real-time candidate attack path set into the credibility scoring model, calculate the real-time credibility score of each candidate attack path, and filter out the high credibility paths.

[0055] Step S503: Input the high-confidence path into the attack source prediction model to obtain the predicted attack source probability corresponding to each node, preset the attack source probability threshold, mark the nodes that exceed the attack source probability threshold as risk nodes, upload them to the network security protection system, and prompt the staff to check.

[0056] The system continuously monitors real-time behavioral data in the network environment and integrates this data into the graph database to dynamically update the network behavior graph. After the graph is updated, the system calls the trained attack path prediction model to perform real-time reasoning analysis on the current graph. Based on the graph neural network's ability to fuse and model node behavior, edge relationships, and temporal context, the model generates multiple sets of real-time candidate attack paths. These candidate paths are based on the comprehensive reasoning results of entity interaction behavior in the current network environment, reflecting the current potential attack behavior chain.

[0057] The system takes each candidate attack path obtained in step S501 as input and inputs it into the trained trust scoring model. The model calculates the real-time trust score of each path based on key elements in the path structure, such as node risk score, behavior sequence confidence, and time consistency factor. Then, the system automatically filters out paths with trust scores higher than the set trust score threshold and marks them as high trust paths. This process can identify the paths most likely to pose a security threat from a large number of candidate paths for further analysis and processing by downstream modules.

[0058] For each selected high-confidence path, the system calls the pre-trained attack source prediction model to analyze each node in the path and output the predicted probability that each node is an attack source. Based on the preset attack source probability threshold, the system identifies nodes that exceed the threshold and marks them as risk nodes. To achieve rapid response, the system automatically uploads the information of these risk nodes, including node identifier, predicted probability, and location path, to the network security protection system, prompting operation and maintenance personnel or security analysts to verify, trace, and handle the issue. This serves as an alarm triggering mechanism, significantly improving the intelligence level and response efficiency of the early warning system.

[0059] To better implement the above methods, an artificial intelligence-based network security data analysis system is also proposed. The system includes a graph construction module, an attack path module, a trust scoring module, an attack source module, and a real-time monitoring module.

[0060] Graph construction module: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals, network behavior events are identified, information of sending and receiving entities is extracted, structured triples are constructed and standardized, mapped to graph nodes and edges, time tags and context attributes are attached, and stored in the graph database.

[0061] Attack path module: Extract graph data from graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model.

[0062] Trustworthy scoring module: Uses the predictive attack path model to infer and train the periodic graph, generating a set of candidate attack paths; extracts the risk level, anomaly frequency, path length, edge confidence and time consistency factor of path nodes, constructs a trustworthy scoring model and trains and optimizes it, and filters high-trustworthy paths with scores exceeding the threshold.

[0063] Attack source module: Extract the preceding nature, connection breadth and propagation strength of the starting node from the high-confidence path, and label the attack source after normalization; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer and binary cross-entropy as the loss function to obtain the attack source prediction model.

[0064] Real-time monitoring module: acquires real-time graph data, generates a candidate path set through the attack path prediction model; calculates real-time trust scores by inputting the trust scoring model, and filters high-trust paths; inputs the attack source prediction model to output node probabilities, marks nodes exceeding the threshold as risk nodes, and uploads them to the protection system to trigger alarms and verification.

[0065] Furthermore, the graph construction module includes triplet units and graph database units:

[0066] Triple Unit: When a network device connects to the network, the network security protection system is activated. In the network security protection system, a preset time interval for collecting network data is established. When the time interval is reached, the parsing terminal log, network traffic log, and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior, and the information of the sending entity and the receiving entity in the event is extracted. Based on the identified network behavior events, the sending entity, behavior type, and receiving entity extracted from each event are combined into a structured triple, a triple set is established, the original behavior relation database is constructed, and field standardization and semantic normalization processing are performed.

[0067] Graph Database Unit: Each entity object in the constructed triplet set is mapped to a node in the graph, and each behavior relation type is mapped to an edge in the graph, thereby constructing a graph of network behaviors. During the graph construction process, a node type label is assigned to each node, and an edge type label is assigned to each edge. On the completed graph, a time label associated with each edge is introduced, and the context field information when the behavior occurs is extracted and used as an additional attribute of the edge. At the same time, attribute information related to each node is extracted and attached to the corresponding node, constructing a directed graph structure, and storing the graph structure in the graph database.

[0068] Furthermore, the attack path module includes a semantic propagation matrix unit and a predictive attack path model unit:

[0069] Semantic propagation matrix unit: Extracts the graph corresponding to each event from the graph database, extracts the attributes and feature information of each node in the graph, counts the behavior type and timestamp of each edge, and extracts the contextual semantic features of the edges. Encodes the nodes and edges and converts them into input data formats that can be recognized by the graph neural network model. Generates node feature matrix, adjacency matrix and edge feature matrix, constructs the input tensor of the graph neural network, and uses the node attributes, adjacent node context, edge behavior semantics and time sequence information to perform multi-layer embedding training using the graph attention mechanism to generate node representation vectors. Finally, it uses the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges.

[0070] The attack path prediction model unit uses the extracted node feature matrix as input to initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, a relation propagation matrix is ​​constructed. Through each layer of the graph neural network, the features of neighboring nodes and the relation propagation matrix are aggregated to calculate and update the node representation vector. Confirmed attack paths in historical data are used as positive samples, and non-attack paths or normal operation paths are used as negative samples. The path levels corresponding to the positive and negative samples are labeled. Based on the labeled data, the graph neural network model is retrained to optimize the node representation vector and relation propagation matrix. After training, the attack path prediction model is obtained.

[0071] Furthermore, the credible scoring module includes a training cycle unit and a unit for generating a credible scoring model:

[0072] Training cycle unit: A set of consecutive days is preset as the training cycle. Based on the constructed predictive attack path model, the graph data within the training cycle is inferred to generate a set of candidate attack paths. The representation vector of the path node, the semantic information of the associated edge, the behavior type and temporal features of each candidate attack path are obtained.

[0073] The unit generating the credibility scoring model performs structured analysis on each candidate attack path, extracting key feature information from the candidate attack path. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal behavior of nodes, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. This key feature information is used as input data for the credibility scoring model. Based on the graph data within the training period and the extracted key feature information of the candidate attack paths, the credibility scoring model is trained and its parameters are optimized. During training, the key feature information is used as training samples input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor are automatically learned, resulting in the trained credibility scoring model.

[0074] Compared with the prior art, the beneficial effects of the present invention are:

[0075] I. Most existing network security methods only support threat detection based on rules or static models, and cannot form a complete chain from behavioral data collection, attack path modeling, risk scoring to attack source identification. This invention constructs a closed-loop system covering data collection → graph modeling → path prediction → attack source location → real-time alarm linkage, and opens up the entire process of "perception-modeling-decision" in network security analysis.

[0076] Second, traditional methods often rely on static features or rules set by experts, which makes it difficult to capture the complex semantic and structural relationships in the attack path. This invention uses graph neural networks combined with graph attention mechanisms to perform multi-layer embedding training on the graph, which can integrate multi-dimensional information such as node attributes, adjacency context, behavior sequence, and edge semantics to achieve deep understanding and high-precision prediction of the attack path.

[0077] Third, existing attack detection mechanisms are difficult to quantify and rank multiple potential paths. This invention innovatively introduces a trustworthy scoring model, which integrates path node risk scores, behavioral sequence confidence, and time consistency factors to construct a risk measurement model, quantitatively assessing the risk level of a path, and effectively improving the accuracy and efficiency of high-risk path screening.

[0078] Fourth, in traditional systems, attack source localization often relies on manual tracing, which has a long response cycle. This invention proposes an attack source prediction model based on a multilayer perceptron, which combines structural features, behavioral location and influence indicators to achieve highly accurate prediction of the starting node in the path, significantly improving the automation and real-time performance of attack source identification. Attached Figure Description

[0079] Figure 1This is a flowchart illustrating the AI-based network security data analysis method of the present invention.

[0080] Figure 2 This is a schematic diagram of the structure of the artificial intelligence-based network security data analysis system of the present invention. Detailed Implementation

[0081] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0082] See also Figure 1 and Figure 2 This invention provides a technical solution: a network security data analysis method based on artificial intelligence, the method comprising:

[0083] Step S100: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals to identify network behavior events, extract information of sending and receiving entities, construct structured triples and standardize them, map them as graph nodes and edges, attach time tags and context attributes, and store them in the graph database.

[0084] Step S100 includes:

[0085] Step S101: When a network device connects to the network, the network security protection system is started. In the network security protection system, the time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior and to extract the information of the sending entity and the receiving entity in the event.

[0086] Step S102: Based on the network behavior events identified in step S101, the sending entity, behavior type and receiving entity extracted from each event are combined into structured triples, a set of triples is established, the original behavior relation database is constructed, and field standardization and semantic normalization are performed.

[0087] Step S103: Map each entity object in the triplet set constructed in step S102 to a node in the graph, and map each behavior relation type to an edge in the graph, thereby constructing a graph of network behavior. During the graph construction process, assign a node type label to each node and an edge type label to each edge.

[0088] Step S104: On the constructed graph, introduce time tags associated with each edge, extract the context field information when the behavior occurs, and use it as an additional attribute of the edge. At the same time, extract the attribute information related to each node, and attach the attribute information to the corresponding node to construct a directed graph structure, and store the graph structure in the graph database.

[0089] For example, extract key information for each event from the logs. Suppose the system identifies an event: "User A sends an entity to receive entity B to download file C, which is a behavior type."

[0090] Constructing triples: Transform events into structured triples, for example:

[0091] Issuing entity: User A;

[0092] Behavior type: Download file;

[0093] Receiving entity: Server B;

[0094] The mapping nodes in the graph: The system maps the entity objects in each triple, such as user A and server B, to nodes in the graph;

[0095] Mapped edges: The behavior type in each event, such as "download file", is mapped to an edge in the graph. For example, the edge between user A and server B could be the behavior of "downloading file";

[0096] Assign a node type label to each node: for example, a user node can be labeled "User" and a server node can be labeled "Device";

[0097] Assign an edge type label to each edge: for example, the edge type for downloading files is "behavior".

[0098] Step S200: Extract graph data from the graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model.

[0099] Step S200 includes:

[0100] Step S201: Extract the graph corresponding to each event from the graph database, extract the attributes and feature information of each node in the graph, count the behavior type and timestamp of each edge, and extract the contextual semantic features of the edges. Encode the nodes and edges and convert them into input data formats that can be recognized by the graph neural network model. Generate node feature matrix, adjacency matrix and edge feature matrix. Construct the input tensor of the graph neural network. Utilize node attributes, adjacent node context, edge behavior semantics and time sequence information, and use the graph attention mechanism to perform multi-layer embedding training to generate node representation vectors. Utilize the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges.

[0101] Step S202: Using the node feature matrix extracted in step S201 as input, initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, construct a relation propagation matrix. Through each layer of the graph neural network, aggregate the features of neighboring nodes and the relation propagation matrix, and calculate and update the node's representation vector according to the following formula:

[0102]

[0103] in, This is represented as the representation vector of node a at the (d+1)th layer. Let D represent the attention weight of neighboring node c to node a in layer d. d Let d be the trainable weight matrix of the d-th layer. Let F be the representation vector of the adjacent node c at the d-th layer. ac This is represented as the propagation weight of information from node c to node a;

[0104] Step S203: Take the confirmed attack paths in the historical data as positive samples and the non-attack paths or normal operation paths as negative samples. Label the path level corresponding to the positive and negative samples. Based on the label data, retrain the graph neural network model to optimize the node representation vector and the relation propagation matrix. After training, the predicted attack path model is obtained.

[0105] For example, the system extracts graph data from the graph database for the past 7 days, including approximately 20,000 nodes such as users, terminals, servers, and applications, and 40,000 edges such as login, download, upload, and communication behaviors. Each node carries attribute information, such as user role, permission level, and historical behavior frequency. Each edge records behavior type such as "remote login", timestamp, and context information such as source IP and destination port.

[0106] Discrete attributes such as character type and asset type are One-Hot encoded, while numerical attributes such as the number of exceptions and operation frequency are normalized.

[0107] Edge feature encoding: Behavior type → One-Hot encoding; Timestamp → Discretized into time periods such as working hours / non-working hours; Contextual semantics such as port type and protocol → Vectorization;

[0108] Multi-layer training is performed using a graph attention mechanism, which integrates the node's own attributes, the context of adjacent nodes, edge semantic information, and temporal order to obtain the representation vector of each node;

[0109] Assume that positive samples are attack paths that are reproduced in historical attack events, which usually include a path chain that is initiated by the attack source and gradually infected, for example: attacker IP → jump host → business server → database;

[0110] Negative samples: Normal network behavior paths, such as user login—system access—file upload;

[0111] Each sample path consists of a set of nodes and edges, uniformly labeled as an attack path (1) and a normal path (0). Using the node representation and propagation matrix output by the aforementioned GNN, a path-level vector representation is constructed. The path vector sequence is input to a classifier such as an MLP or a path attention pooling layer, and supervised training is performed using the cross-entropy loss function.

[0112] Step S300: Use the predicted attack path model to infer and train the periodic graph, and generate a set of candidate attack paths; extract the risk level, anomaly frequency, path length, edge confidence and time consistency factor of the path nodes, construct a credibility scoring model and train and optimize it, and screen high credibility paths with scores exceeding the threshold.

[0113] Step S300 includes:

[0114] Step S301: Set a training period of several consecutive days, and based on the prediction attack path model constructed in step S203, perform inference on the graph data within the training period to generate a set of candidate attack paths. Obtain the representation vector of the path nodes, semantic information of the associated edges, behavior type and temporal features of each candidate attack path.

[0115] Step S302: Perform structured analysis on each candidate attack path to extract key feature information. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal node behavior, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. Use this key feature information as input data for the credibility scoring model, which is expressed as follows:

[0116] S = σ(e×R + f×G + g×T);

[0117] Where S represents the credibility score, R represents the path node risk score, G represents the path behavior sequence confidence, T represents the path time consistency factor, and e, f, and g represent the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor, respectively.

[0118] Step S303: Based on the graph data during the training period and the key feature information of the candidate attack paths extracted in step S302, the credibility scoring model is trained and its parameters are optimized. During the training process, the key feature information is used as training samples to input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned to obtain the trained credibility scoring model.

[0119] Step S304: Set a preset trust score threshold, and set candidate attack paths with trust scores exceeding the trust score threshold as high trust paths;

[0120] For example, suppose we choose data from the past 30 days as the training period, based on historical attack path data such as common attack methods, intrusion detection system logs, and behavioral analysis logs;

[0121] The model infers from the network graph data during the training period to generate a set of candidate attack paths. These paths may include various potential attack paths, such as from external intrusion to internal network control, or from access to a database from a machine.

[0122] For each candidate path, extract the following features: the representation vector of the path nodes: for example, representing the "attacker IP" node and the "infected host" node;

[0123] Semantic information of associated edges: for example, data transmission, malicious command execution, etc.;

[0124] Behavior types: for example, lateral movement, data theft, etc.;

[0125] Temporal characteristics: for example, the temporal distribution of attack activities;

[0126] Risk Level: The risk level of each node may be calculated based on node type, such as external IP, sensitive data node, or node historical behavior, such as whether it has been attacked in the past.

[0127] Frequency of historical abnormal behavior: For example, has a host experienced multiple unauthorized accesses in the past 30 days, or has there been a high frequency of malicious activity;

[0128] Path length: The length of the path from the attack origin to the target, such as the number of steps required for an attacker to reach a critical asset;

[0129] Behavioral sequence confidence: Whether a behavior, such as remote login, has high confidence is usually based on the confidence score output by the behavioral analysis model;

[0130] Time consistency factor: Whether the timing of all actions in the path is reasonable. For example, an attacker controlling multiple nodes simultaneously in a short period of time may trigger an alarm.

[0131] These features will be used as input to build a reliable scoring model;

[0132] Based on historical graph data and known labeled attack paths, such as whether the path is confirmed to be a real attack path, the extracted key feature information is used as training samples and input into the credibility scoring model.

[0133] Supervised learning methods, such as minimizing a loss function, are used to train the model. The loss function measures the difference between the confidence score of the model's predictions and the confidence level of the actual labels.

[0134] Through training, the model automatically optimizes feature weights so that the predicted confidence score is as close as possible to the actual label.

[0135] Set a trust score threshold: For example, suppose a threshold (such as 0.8) is set, which means that when the trust score of a candidate attack path is greater than the threshold, the path is considered a high trust path;

[0136] For each candidate attack path, its trust score is calculated and compared with a threshold. If the trust score exceeds the threshold, the path is marked as a "high trust path," meaning it is a potentially high-risk attack path that requires further monitoring or response.

[0137] Step S400: Extract the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalize them, and label them with attack source tags; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function to obtain the attack source prediction model;

[0138] Step S400 includes:

[0139] Step S401: Extract analysis data from the selected high-confidence paths, analyze the behavior starting nodes in the paths, collect the pre-emptiveness, connection breadth and propagation strength, and perform normalization processing, and perform binary classification labeling based on whether the node is an attack source.

[0140] Step S402: Construct an attack source prediction model. This model is based on a multilayer perceptron model, using the sigmoid activation function as the output layer activation function and the ReLU activation function as the hidden layer activation function. Normalized node pre-existence, connection breadth, and propagation strength are used as input vectors.

[0141] Step S403: Train the attack source prediction model based on the graph data within the training period, using binary cross-entropy as the loss function, and continuously update the parameters through the backpropagation algorithm and optimizer to obtain the trained attack source prediction model.

[0142] For example, there are 1,000 highly reliable attack path samples. Each path includes several nodes and edges. The system focuses on the starting node of the path, that is, the node that initiates the first action.

[0143] For each starting node, the system extracts the following features: Precedence: whether the node frequently serves as the "beginning point" in the entire graph, and calculates the probability of it being the first initiator in multiple paths. For example, if the node appears at the first position 50 times in 1000 paths, then the precedence is 0.05.

[0144] Connection breadth: The number of connections a node has, including out-degree and in-degree, reflecting its activity in the network. Attack sources often have a wide range of connections to spread rapidly.

[0145] Propagation strength: The maximum depth / path expansion capability of the behavior propagating from this node. For example, if the attack path of a certain node extends to the 4th layer, the propagation strength is 4.

[0146] If the starting node is identified as the attack source node in the historical confirmed attack samples, it is marked as 1.

[0147] Otherwise, it is a normal node or an infected relay node → marked as 0;

[0148] A simple and efficient multi-layer neural network is used to build an attack source prediction model:

[0149] Input layer (3D) → Hidden layer 1 (64D, ReLU) → Hidden layer 2 (32D, ReLU) → Output layer (1D, Sigmoid);

[0150] Input vector: The input for each node is [precedence, connection breadth, propagation strength] (after normalization).

[0151] Output: The Sigmoid outputs a probability [0,1], representing the likelihood that the node is the source of an attack;

[0152] Training data: A total of 1000 node samples, including 200 positive samples (real attack source nodes) and 800 negative samples (non-attack source nodes);

[0153] Model training settings: loss function: binary cross-entropy, optimizer: Adam (learning rate 0.001), training epochs: 50 epochs, regularization: Dropout 0.3 to prevent overfitting.

[0154] Step S500: Obtain real-time graph data, generate a candidate path set through the attack path prediction model; input the trust score model to calculate the real-time trust score, and filter high trust paths; input the attack source prediction model to output the node probability, mark nodes exceeding the threshold as risk nodes, and upload them to the protection system to trigger alarms and verification.

[0155] Step S500 includes:

[0156] Step S501: Obtain real-time graph data and generate a set of real-time candidate attack paths through the attack path prediction model;

[0157] Step S502: Input each candidate attack path in the real-time candidate attack path set into the credibility scoring model, calculate the real-time credibility score of each candidate attack path, and filter out the high credibility paths.

[0158] Step S503: Input the high-confidence path into the attack source prediction model to obtain the predicted attack source probability corresponding to each node, preset the attack source probability threshold, mark the nodes that exceed the attack source probability threshold as risk nodes, upload them to the network security protection system, and prompt the staff to check.

[0159] For example, the system pulls graph changes from the real-time log stream and graph database incremental update interface every 5 minutes, such as the addition of behavior edges and node updates.

[0160] Construct an incremental graph snapshot: containing approximately 1000 new edges and 500 new / changed nodes;

[0161] Input the node features, edge features, and adjacency structure of the graph snapshot, and output a set of candidate attack paths such as paths P1, P2, ..., Pn, where each path is a set of node sequence + edge sequence;

[0162] Example output path (partial): P1: External IP_X → Gateway G1 → Internal Host H1 → DB_A;

[0163] P2: Employee terminal T1 → File server F2 → Management platform C3;

[0164] Traverse each candidate path, for example, 100 paths, and extract key features: node risk level (R), behavioral sequence confidence (G), and time consistency factor (T).

[0165] Assuming path P1 has an R-value of 0.82, a G-value of 0.76, and a T-value of 0.90, the calculated credibility score is 0.845; path P2 has an R-value of 0.25, a G-value of 0.45, and a T-value of 0.51, the calculated credibility score is 0.394; and path P3 has an R-value of 0.73, a G-value of 0.70, and a T-value of 0.65, the calculated credibility score is 0.726.

[0166] Set the credibility score threshold to 0.7 and select high credibility paths P1 and P3;

[0167] The input features of each node are extracted. In path P1, the pre-existence of external IP_X is 0.95, the connection breadth is 0.88, the propagation strength is 0.75, and the attack source probability is 0.91.

[0168] Gateway G1 has a front-end strength of 0.20, a connection breadth of 0.45, a propagation strength of 0.30, and an attack source probability of 0.33.

[0169] The front-end property of employee terminal T is 0.62, the connection breadth is 0.70, the propagation strength is 0.66, and the attack source probability is 0.58.

[0170] The attack source threshold is set to 0.8, and external IP_X is regarded as a "high-risk attack source node" and reported to the network security platform.

[0171] To better implement the above methods, an artificial intelligence-based network security data analysis system is also proposed. The system includes a graph construction module, an attack path module, a trust scoring module, an attack source module, and a real-time monitoring module.

[0172] Graph construction module: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals, network behavior events are identified, information of sending and receiving entities is extracted, structured triples are constructed and standardized, mapped to graph nodes and edges, time tags and context attributes are attached, and stored in the graph database.

[0173] The graph construction module includes triplet units and graph database units:

[0174] Triple Unit: When a network device connects to the network, the network security protection system is activated. In the network security protection system, a preset time interval for collecting network data is established. When the time interval is reached, the parsing terminal log, network traffic log, and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior, and the information of the sending entity and the receiving entity in the event is extracted. Based on the identified network behavior events, the sending entity, behavior type, and receiving entity extracted from each event are combined into a structured triple, a triple set is established, the original behavior relation database is constructed, and field standardization and semantic normalization processing are performed.

[0175] Graph Database Unit: Each entity object in the constructed triplet set is mapped to a node in the graph, and each behavior relation type is mapped to an edge in the graph, thereby constructing a graph of network behaviors. During the graph construction process, a node type label is assigned to each node, and an edge type label is assigned to each edge. On the completed graph, a time label associated with each edge is introduced, and the context field information when the behavior occurs is extracted and used as an additional attribute of the edge. At the same time, attribute information related to each node is extracted and attached to the corresponding node, constructing a directed graph structure, and storing the graph structure in the graph database.

[0176] Attack path module: Extract graph data from graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model.

[0177] The attack path module includes a semantic propagation matrix unit and a predictive attack path model unit.

[0178] Semantic propagation matrix unit: Extracts the graph corresponding to each event from the graph database, extracts the attributes and feature information of each node in the graph, counts the behavior type and timestamp of each edge, and extracts the contextual semantic features of the edges. Encodes the nodes and edges and converts them into input data formats that can be recognized by the graph neural network model. Generates node feature matrix, adjacency matrix and edge feature matrix, constructs the input tensor of the graph neural network, and uses the node attributes, adjacent node context, edge behavior semantics and time sequence information to perform multi-layer embedding training using the graph attention mechanism to generate node representation vectors. Finally, it uses the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges.

[0179] The attack path prediction model unit uses the extracted node feature matrix as input to initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, a relation propagation matrix is ​​constructed. Through each layer of the graph neural network, the features of neighboring nodes and the relation propagation matrix are aggregated to calculate and update the node representation vector. Confirmed attack paths in historical data are used as positive samples, and non-attack paths or normal operation paths are used as negative samples. The path levels corresponding to the positive and negative samples are labeled. Based on the labeled data, the graph neural network model is retrained to optimize the node representation vector and relation propagation matrix. After training, the attack path prediction model is obtained.

[0180] Trustworthy scoring module: Uses the predictive attack path model to infer and train the periodic graph, generating a set of candidate attack paths; extracts the risk level, anomaly frequency, path length, edge confidence and time consistency factor of path nodes, constructs a trustworthy scoring model and trains and optimizes it, and filters high-trustworthy paths with scores exceeding the threshold.

[0181] The credible scoring module includes a training cycle unit and a credible scoring model generation unit:

[0182] Training cycle unit: A set of consecutive days is preset as the training cycle. Based on the constructed predictive attack path model, the graph data within the training cycle is inferred to generate a set of candidate attack paths. The representation vector of the path node, the semantic information of the associated edge, the behavior type and temporal features of each candidate attack path are obtained.

[0183] The unit generating the credibility scoring model performs structured analysis on each candidate attack path, extracting key feature information from the candidate attack path. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal behavior of nodes, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. This key feature information is used as input data for the credibility scoring model. Based on the graph data within the training period and the extracted key feature information of the candidate attack paths, the credibility scoring model is trained and its parameters are optimized. During training, the key feature information is used as training samples input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor are automatically learned, resulting in the trained credibility scoring model.

[0184] Attack source module: Extract the preceding nature, connection breadth and propagation strength of the starting node from the high-confidence path, and label the attack source after normalization; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer and binary cross-entropy as the loss function to obtain the attack source prediction model.

[0185] Real-time monitoring module: acquires real-time graph data, generates a candidate path set through the attack path prediction model; calculates real-time trust scores by inputting the trust scoring model, and filters high-trust paths; inputs the attack source prediction model to output node probabilities, marks nodes exceeding the threshold as risk nodes, and uploads them to the protection system to trigger alarms and verification.

[0186] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A cybersecurity data analysis method based on artificial intelligence, characterized in that, The methods include: Step S100: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals to identify network behavior events, extract information of sending and receiving entities, construct structured triples and standardize them, map them as graph nodes and edges, attach time tags and context attributes, and store them in the graph database. Step S200: Extract graph data from the graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model. Step S300: Use the predicted attack path model to infer and train the periodic graph, and generate a set of candidate attack paths; extract the risk level, anomaly frequency, path length, edge confidence and time consistency factor of the path nodes, construct a credibility scoring model and train and optimize it, and screen high credibility paths with scores exceeding the threshold. Step S400: Extract the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalize them, and label them with attack source tags; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function to obtain the attack source prediction model; Step S500: Obtain real-time graph data, generate a candidate path set through the attack path prediction model; input the trust score model to calculate the real-time trust score, and filter high trust paths; input the attack source prediction model to output the node probability, mark nodes exceeding the threshold as risk nodes, and upload them to the protection system to trigger alarms and verification.

2. The artificial intelligence-based network security data analysis method according to claim 1, characterized in that, Step S100 includes the following steps: Step S101: When a network device connects to the network, the network security protection system is started. In the network security protection system, the time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior and to extract the information of the sending entity and the receiving entity in the event. Step S102: Based on the network behavior events identified in step S101, the sending entity, behavior type and receiving entity extracted from each event are combined into structured triples, a set of triples is established, the original behavior relation database is constructed, and field standardization and semantic normalization are performed. Step S103: Map each entity object in the triplet set constructed in step S102 to a node in the graph, and map each behavior relation type to an edge in the graph, thereby constructing a graph of network behavior. During the graph construction process, assign a node type label to each node and an edge type label to each edge. Step S104: On the constructed graph, introduce time tags associated with each edge, extract the context field information when the behavior occurs, and use it as an additional attribute of the edge. At the same time, extract the attribute information related to each node, and attach the attribute information to the corresponding node to construct a directed graph structure, and store the graph structure in the graph database.

3. The artificial intelligence-based network security data analysis method according to claim 2, characterized in that, Step S200 includes the following steps: Step S201: Extract the graph corresponding to each event from the graph database, extract the attributes and feature information of each node in the graph, count the behavior type and timestamp of each edge, and extract the contextual semantic features of the edges. Encode the nodes and edges and convert them into input data formats that can be recognized by the graph neural network model. Generate node feature matrix, adjacency matrix and edge feature matrix. Construct the input tensor of the graph neural network. Utilize node attributes, adjacent node context, edge behavior semantics and time sequence information, and use the graph attention mechanism to perform multi-layer embedding training to generate node representation vectors. Utilize the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges. Step S202: Using the node feature matrix extracted in step S201 as input, initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, construct a relation propagation matrix. Through each layer of the graph neural network, aggregate the features of neighboring nodes and the relation propagation matrix, and calculate and update the node's representation vector according to the following formula: in, This is represented as the representation vector of node a at the (d+1)th layer. Let D represent the attention weight of neighboring node c to node a in layer d. d Let d be the trainable weight matrix of the d-th layer. Let F be the representation vector of the adjacent node c at the d-th layer. ac This is represented as the propagation weight of information from node c to node a; Step S203: Take the confirmed attack paths in the historical data as positive samples and the non-attack paths or normal operation paths as negative samples. Label the path level corresponding to the positive and negative samples. Based on the labeled data, retrain the graph neural network model to optimize the node representation vector and relation propagation matrix. After training, the predicted attack path model is obtained.

4. The artificial intelligence-based network security data analysis method according to claim 3, characterized in that, Step S300 includes the following steps: Step S301: Set a training period of several consecutive days, and based on the prediction attack path model constructed in step S203, perform inference on the graph data within the training period to generate a set of candidate attack paths. Obtain the representation vector of the path nodes, semantic information of the associated edges, behavior type and temporal features of each candidate attack path. Step S302: Perform structured analysis on each candidate attack path to extract key feature information. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal node behavior, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. Use this key feature information as input data for the credibility scoring model, which is expressed as follows: S = σ(e×R + f×G + g×T); Where S represents the credibility score, R represents the path node risk score, G represents the path behavior sequence confidence, T represents the path time consistency factor, and e, f, and g represent the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor, respectively. Step S303: Based on the graph data during the training period and the key feature information of the candidate attack paths extracted in step S302, the credibility scoring model is trained and its parameters are optimized. During the training process, the key feature information is used as training samples to input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned to obtain the trained credibility scoring model. Step S304: Set a preset trust score threshold, and set candidate attack paths with trust scores exceeding the trust score threshold as high trust paths.

5. The artificial intelligence-based network security data analysis method according to claim 4, characterized in that, Step S400 includes the following steps: Step S401: Extract analysis data from the selected high-confidence paths, analyze the behavior starting nodes in the paths, collect the pre-emptiveness, connection breadth and propagation strength, and perform normalization processing, and perform binary classification labeling based on whether the node is an attack source. Step S402: Construct an attack source prediction model. This model is based on a multilayer perceptron model, using the sigmoid activation function as the output layer activation function and the ReLU activation function as the hidden layer activation function. Normalized node pre-existence, connection breadth, and propagation strength are used as input vectors. Step S403: Train the attack source prediction model based on the graph data within the training period, using binary cross-entropy as the loss function, and continuously update the parameters through the backpropagation algorithm and optimizer to obtain the trained attack source prediction model.

6. The artificial intelligence-based network security data analysis method according to claim 5, characterized in that, Step S500 includes the following steps: Step S501: Obtain real-time graph data and generate a set of real-time candidate attack paths through the attack path prediction model; Step S502: Input each candidate attack path in the real-time candidate attack path set into the credibility scoring model, calculate the real-time credibility score of each candidate attack path, and filter out the high credibility paths. Step S503: Input the high-confidence path into the attack source prediction model to obtain the predicted attack source probability for each node. Set a preset attack source probability threshold, mark nodes that exceed the attack source probability threshold as risk nodes, upload them to the network security protection system, and prompt staff to check them.

7. An artificial intelligence-based network security data analysis system, used to implement the artificial intelligence-based network security data analysis method according to any one of claims 1-6, characterized in that, The system includes a graph construction module, an attack path module, a credibility scoring module, an attack source module, and a real-time monitoring module. The graph construction module: When the network security protection system is started, it collects terminal logs, traffic logs and host audit records at preset intervals, identifies network behavior events, extracts information of sending and receiving entities, constructs structured triples and standardizes them, maps them to graph nodes and edges, adds time tags and context attributes, and stores them in the graph database. The attack path module extracts graph data from the graph database, encodes node attributes, edge types, and time stamps, and generates a node feature matrix, an adjacency matrix, and an edge feature matrix. Node representation vectors are trained using graph attention mechanism to construct a semantic propagation matrix; a graph neural network is trained under supervision with historical attack paths as positive samples and normal paths as negative samples to obtain a model for predicting attack paths. The credibility scoring module: uses the predicted attack path model to infer and train the periodic graph, generates a set of candidate attack paths; extracts the risk level, anomaly frequency, path length, edge confidence and time consistency factor of path nodes, constructs a credibility scoring model and trains and optimizes it, and filters high credibility paths with scores exceeding the threshold. The attack source module extracts the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalizes them, and labels them with attack source tags; it constructs a multilayer perceptron model, trains it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function, and obtains the attack source prediction model. The real-time monitoring module acquires real-time graph data, generates a candidate path set through a predicted attack path model, calculates a real-time credibility score using a credibility scoring model, and filters high-credibility paths. It also inputs the node probability from the attack source prediction model, marks nodes exceeding the threshold as risk nodes, and uploads the data to the protection system to trigger alarms and verification.

8. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The graph construction module includes triplet units and graph database units: The triplet unit: When a network device connects to the network, a network security protection system is activated. In the network security protection system, a time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log, and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior, and the information of the sending entity and the receiving entity in the event is extracted. Based on the identified network behavior events, the sending entity, behavior type, and receiving entity extracted from each event are combined into a structured triplet to establish a triplet set, construct the original behavior relation database, and perform field standardization and semantic normalization processing. The graph database unit maps each entity object in the constructed triplet set to a node in the graph, and maps each behavior relation type to an edge in the graph, thereby constructing a graph of network behaviors. During the graph construction process, a node type label is assigned to each node, and an edge type label is assigned to each edge. On the completed graph, a time label associated with each edge is introduced, and the context field information when the behavior occurs is extracted and used as an additional attribute of the edge. At the same time, attribute information related to each node is extracted and attached to the corresponding node, thus constructing a directed graph structure, and storing the graph structure in the graph database.

9. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The attack path module includes a semantic propagation matrix unit and a predictive attack path model unit: The semantic propagation matrix unit extracts the graph corresponding to each event from the graph database, extracts the attributes and feature information of each node in the graph, counts the behavior type and timestamp of each edge, and extracts the contextual semantic features of the edges. It encodes the nodes and edges and converts them into an input data format that can be recognized by the graph neural network model, generates a node feature matrix, an adjacency matrix, and an edge feature matrix, constructs the input tensor of the graph neural network, and uses the node attributes, adjacent node context, edge behavior semantics, and time sequence information to perform multi-layer embedding training using a graph attention mechanism to generate node representation vectors. Finally, it uses the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges. The attack path prediction model unit: using the extracted node feature matrix as input, initializes the representation vector of each node; constructs a relation propagation matrix based on the semantic information, behavior type, and temporal features of the edges; aggregates the features of neighboring nodes and the relation propagation matrix through each layer of the graph neural network; calculates and updates the node's representation vector; uses confirmed attack paths in historical data as positive samples and non-attack paths or normal operation paths as negative samples; labels the path levels corresponding to the positive and negative samples; and retrains the graph neural network model based on the labeled data to optimize the node representation vector and relation propagation matrix. After training, the attack path prediction model is obtained.

10. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The credible scoring module includes a training cycle unit and a credible scoring model generation unit: The training cycle unit: a set of consecutive days is preset as the training cycle. Based on the prediction attack path model constructed in step S203, the graph data within the training cycle is inferred to generate a set of candidate attack paths. The representation vector of the path node, the semantic information of the associated edge, the behavior type and the temporal features of each candidate attack path are obtained. The unit generating the credibility scoring model performs structured analysis on each candidate attack path, extracting key feature information from the candidate attack path. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal behavior of nodes, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. This key feature information is used as input data for the credibility scoring model. Based on the graph data within the training period and the extracted key feature information of the candidate attack paths, the credibility scoring model is trained and its parameters are optimized. During training, the key feature information is used as training samples input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor are automatically learned, resulting in the trained credibility scoring model.

Images