Artificial intelligence-based network security data analysis system and method

Abstract

The application discloses an artificial intelligence-based network security data analysis system and method, relates to the technical field of network security, and constructs a structured triple, is mapped into a graph node and an edge, and is stored into a graph database; graph data is extracted from the graph database, a node feature matrix, an adjacency matrix and an edge feature matrix are generated; a node representation vector is trained by using a graph attention mechanism, and a semantic propagation matrix is constructed; a predicted attack path model is obtained; a candidate attack path set is generated; a trusted scoring model is constructed and optimized, high-trust paths with scores exceeding a threshold value are screened; a multilayer perception machine model is constructed, an attack source prediction model is obtained; real-time graph data is acquired, nodes exceeding the threshold value are marked as risk nodes, and are uploaded to a protection system to trigger an alarm and an inspection, and the automation and real-time performance of attack source identification are improved.

Description

TECHNICAL FIELD

[0001] The application relates to the technical field of network security, and particularly relates to a network security data analysis system and method based on artificial intelligence. BACKGROUND

[0002] In the existing network security protection system, detection and response to various network attacks usually depend on traditional rule matching, signature analysis or traffic behavior analysis, etc. When facing complex attack paths, horizontal penetration or multi-stage attacks, the traditional network security protection mechanism is difficult to trace and dispose attacks in real time and effectively, and security vulnerabilities are easily caused.

[0003] The current security protection architecture mostly adopts a static analysis model based on feature matching or behavior pattern, and problems such as attack detection lag, frequent false positives, and inability to effectively distinguish attacks and normal traffic exist, which leads to slow security event response speed, low disposal efficiency, and difficulty in quickly identifying attack sources, locating the root of attack behavior, and effectively preventing the spread of subsequent attacks through dynamic adjustment of protection strategies.

[0004] Therefore, it is necessary to use a graph structure and reasoning mechanism to perform deep analysis on attack events, dynamically construct an attack path graph, automatically perform path scoring and attack chain tracing, so as to significantly improve the reliability, robustness and emergency response capability of the network security protection system. SUMMARY

[0005] The application aims to provide a network security data analysis system and method based on artificial intelligence to solve the problems in the prior art.

[0006] In order to solve the above technical problems, the application provides the following technical scheme: a network security data analysis method based on artificial intelligence, the method comprising:

[0007] Step S100: When starting the network security protection system, terminal logs, traffic logs and host audit records are collected at a preset interval, network behavior events are identified, sending entities and receiving entity information are extracted, structured triples are constructed and standardized, are mapped into graph nodes and edges, time labels and context attributes are attached, and are stored into a graph database;

[0008] Step S200: graph data is extracted from the graph database, node attributes, edge types and time stamps are coded, node feature matrices, adjacency matrices and edge feature matrices are generated, node representation vectors are trained using a graph attention mechanism, a semantic propagation matrix is constructed, historical attack paths are taken as positive samples and normal paths are taken as negative samples, a graph neural network is supervisedly trained, and a predicted attack path model is obtained;

[0009] Step S300: infer the training period graph with the predicted attack path model to generate a candidate attack path set; extract the path node risk level, abnormal frequency, path length, edge confidence and time consistency factor, construct a trusted scoring model and train and optimize, and screen high-trust paths with scores exceeding a threshold;

[0010] Step S400: extract the preposition, connection breadth and propagation strength of the starting node from the high-trust path, normalize and label the attack source tag; construct a multi-layer perception model with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function for training, to obtain an attack source prediction model;

[0011] Step S500: obtain real-time graph data, generate a candidate path set through the predicted attack path model; input the trusted scoring model to calculate real-time trusted scores and screen high-trust paths; input the attack source prediction model to output node probabilities, mark nodes exceeding a threshold as risk nodes, and upload them to a protection system to trigger alarms and inspections.

[0012] Further, step S100 includes:

[0013] Step S101: when a network device is connected to a network, start a network security protection system, in which a time interval for collecting network data is preset, when the time interval is reached, automatically collect parsed terminal logs, network traffic logs and host behavior audit records of the network device, analyze the collected log data, identify events corresponding to network behaviors, and extract information of sending entities and receiving entities in the events;

[0014] Step S102: according to the events of network behaviors identified in step S101, compose the extracted sending entities, behavior types and receiving entities of each event into structured triples, establish a triple set, construct an original behavior relationship database, and perform field standardization and semantic normalization processing;

[0015] Step S103: map each entity object in the triple set constructed in step S102 to a node in the graph, and map each behavior relationship type to an edge in the graph, thereby constructing a network behavior graph, and assigning a node type label to each node and an edge type label to each edge during the graph construction process;

[0016] Step S104: on the constructed graph, introduce a time label associated with each edge, extract context field information at the time of behavior occurrence as an additional attribute of the edge, and at the same time, extract attribute information related to each node and attach the attribute information to the corresponding node, construct a directed graph structure, and store the graph structure in a graph database;

[0017] Through analysis of these log data, the system can identify events related to network behavior and extract information of sending entities and receiving entities therefrom. Specifically, the system identifies behavior events through in-depth analysis of traffic, log and host audit data and extracts information of related entities as basic data for subsequent processing.

[0018] The system standardizes data fields and adopts semantic normalization methods to ensure that behavior relationship data in the database has a unified format and consistent semantic expression. The sending entities and receiving entities become nodes in the graph, and the behavior types are connected as edges between the nodes. The system also allocates node type labels to each node and edge type labels to each edge to ensure that the structure of the graph is clear, facilitating subsequent analysis and processing.

[0019] By regularly and automatically collecting network device log data and performing structured analysis, network behavior events can be identified in real time, ensuring that the protection system obtains the latest network behavior information in a timely manner, providing an efficient data source for subsequent security analysis. Structured data facilitates subsequent processing and graph construction, ensuring data consistency and standardization, and facilitating sharing and application in various systems.

[0020] The graph structure can provide clear entity relationships for network security analysis, supporting subsequent behavior prediction and attack path inference. The introduction of time labels and context attributes not only makes the graph structure more rich, but also improves the timeliness and context awareness of the graph. The time label can accurately record the timing information of the behavior occurrence, helping the system better understand the evolution process of the behavior. The additional context attributes of the nodes provide more background information, further enhancing the semantic depth of the graph data.

[0021] Further, step S200 includes:

[0022] Step S201: Extract the graph corresponding to each event from the graph database, extract the attribute and feature information of each node in the graph, count the behavior type, timestamp of each edge, and extract the context semantic features of the edge. Encode the nodes and edges and convert them into input data formats recognizable by the graph neural network model to generate node feature matrices, adjacency matrices and edge feature matrices, construct input tensors of the graph neural network, use node attributes, adjacent node contexts, edge behavior semantics and time sequence information, use the graph attention mechanism for multi-layer embedding training, generate node representation vectors, and use the propagation mechanism in the graph neural network to construct a semantic propagation matrix between edges.

[0023] Step S202: taking the node feature matrix extracted in step S201 as input, initializing the representation vector of each node, constructing a relation propagation matrix based on the semantic information of the edge, the behavior type and the timing feature, aggregating the features of the neighboring nodes and the relation propagation matrix through each layer in the graph neural network, and calculating the updated representation vector of the node according to the following formula:

[0024]

[0025] wherein, represents the representation vector of node a at the d+1th layer, represents the attention weight of the neighboring node c to node a at the dth layer, D d represents the trainable weight matrix of the dth layer, represents the representation vector of the neighboring node c at the dth layer, F ac represents the propagation weight of node c to node a for propagating information;

[0026] Step S203: taking the confirmed attack path in the historical data as a positive sample, taking a non-attack path or a normal operation path as a negative sample, labeling the path level corresponding to the positive sample and the negative sample based on the label data, retraining the graph neural network model based on the label data, optimizing the node representation vector and the relation propagation matrix, and obtaining a predicted attack path model after training is completed;

[0027] By the semantic information of the edge, the behavior type and the timing feature, a relation propagation matrix is constructed, in each layer of the graph neural network, the system will aggregate the features of the neighboring nodes and the relation propagation matrix, through the iteration of each layer, the representation vector of the node will be updated gradually, and finally an embedding representation with global context information is generated for each node;

[0028] The graph neural network is retrained using the label data to optimize the node representation vector and the relation propagation matrix, in the training process, the system adjusts the model parameters through supervised learning to ensure that the prediction results of the positive sample path and the negative sample path have high accuracy, after the training is completed, the graph neural network can identify the potential attack path, thereby obtaining an attack path prediction model, which can provide automatic attack path identification and early warning capability for network security protection;

[0029] By extracting relevant graph data from the graph database and performing encoding conversion, the original log data can be quickly converted into an input format suitable for the graph neural network, greatly improving the data processing efficiency;

[0030] By employing a graph attention mechanism for multi-layer embedding training, the node representation vector can effectively aggregate the feature information of neighboring nodes, and attention weights are assigned according to the importance of different neighboring nodes, thereby making the model's learning of relationships between nodes more accurate and flexible.

[0031] By constructing a relation propagation matrix and aggregating the features of neighboring nodes at each layer, the system can generate node representation vectors with global context information. These vectors not only consider the features of the node itself, but also fully integrate the context information of neighboring nodes, thus improving the expressive power of the model.

[0032] By retraining and combining positive and negative sample data from historical attack paths, the system can optimize node representation vectors and relation propagation matrices, enabling the model to accurately predict potential attack paths. This predictive capability helps security systems automatically identify and block network attacks.

[0033] Furthermore, step S300 includes:

[0034] Step S301: Set a training period of several consecutive days, and based on the prediction attack path model constructed in step S203, perform inference on the graph data within the training period to generate a set of candidate attack paths. Obtain the representation vector of the path nodes, semantic information of the associated edges, behavior type and temporal features of each candidate attack path.

[0035] Step S302: Perform structured analysis on each candidate attack path to extract key feature information. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal node behavior, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. Use this key feature information as input data for the credibility scoring model, which is expressed as follows:

[0036] S = σ(e×R + f×G + g×T);

[0037] Where S represents the credibility score, R represents the path node risk score, G represents the path behavior sequence confidence, T represents the path time consistency factor, and e, f, and g represent the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor, respectively.

[0038] Step S303: Based on the graph data within the training period and the candidate attack path key feature information extracted in step S302, the trusted score model is trained and parameter optimized. In the training process, the key feature information is input into the trusted score model as a training sample, and the labeled trust level of each path is used as a supervision signal. By minimizing the loss function between the predicted trust score and the labeled trust level, the weights corresponding to the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned, and the trained trusted score model is obtained.

[0039] Step S304: A trusted score threshold is preset, and the candidate attack path with a trusted score exceeding the trusted score threshold is set as a high-trust path.

[0040] The system performs a structured analysis operation on each candidate attack path to extract key feature information that is discriminative in the path. The length of the path, i.e., the number of nodes or edges, and the time consistency factor of the path behavior sequence are used to measure the regularity or rationality of the time interval between events in the path.

[0041] The system sets a trusted score threshold to filter the scoring results of the candidate attack paths. Paths with a score exceeding the set threshold are marked as "high-trust attack paths" and are the core focus of the subsequent threat response module. This step significantly reduces the false positive rate and processing resource consumption, ensuring that the system prioritizes paths with the highest potential risk and improves overall response efficiency.

[0042] Further, step S400 includes:

[0043] Step S401: Extract analysis data from the filtered high-trust paths, analyze the behavior starting node in the path, collect the preposition, connection breadth, and propagation intensity, and perform normalization processing. According to whether the node is an attack source, it is classified into two categories.

[0044] Step S402: An attack source prediction model is constructed. The attack source prediction model is based on a multi-layer perception model, uses a sigmoid activation function as the activation function of the output layer, and uses a ReLU activation function as the activation function of the hidden layer. The normalized node preposition, connection breadth, and propagation intensity are used as input vectors,

[0045] Step S403: Train the attack source prediction model based on the graph data within the training period. Use binary cross-entropy as the loss function, and continuously update the parameters through the backpropagation algorithm and the optimizer to obtain the trained attack source prediction model.

[0046] For each high-trust path, the system identifies the behavior starting node in the path and performs multi-dimensional feature analysis on the node in combination with the graph structure and behavior records. The core features extracted include: preposition: indicating the degree of the node's behavior position in the path, used to measure its potential as a starting point; connection breadth: indicating the number of neighbor nodes connected by the node in the graph, used to reflect the range of its behavior propagation; propagation intensity: indicating the strength or density of the node and its adjacent edge in the path to deliver behavior impact;

[0047] After extraction, the system performs numerical normalization on the above features to make them conform to the neural network model input standard. At the same time, according to whether the node is identified as an attack origin in the historical labeled data, each sample node is labeled with a binary classification label such as attack source or non-attack source, which is used for subsequent supervised learning process;

[0048] After obtaining the sample features, the system constructs an attack source prediction model for identifying potential attack originating nodes. The model uses a multi-layer perceptron (MLP) structure, which consists of several hidden layers and an output layer:

[0049] Input layer: receives the normalized vector of the three node features preposition, connection breadth, and propagation intensity; Hidden layer: uses ReLU rectified linear unit as the activation function to introduce non-linear expression ability; Output layer: uses Sigmoid activation function to limit the model output value between [0, 1], which is used to express the probability of the current node being an attack source;

[0050] The above model structure combines structured input and non-linear mapping ability, has good fitting effect and classification ability, and can adapt to attack source identification tasks in various types of network structures;

[0051] The system trains the constructed attack source prediction model based on the graph data collected during the training period and the labeled attack source information. During the training process, the model takes the normalized features of the nodes as input and the binary classification label as the supervision signal. The binary cross-entropy loss function is used as the optimization objective to measure the deviation between the model prediction probability and the actual label. During the training process, the system applies the backpropagation algorithm combined with a specific optimizer to iteratively update the weight and bias parameters in the model, constantly minimizing the loss function value, thereby improving the prediction accuracy. After training is completed, the system obtains an attack source prediction model with converged parameters and good generalization ability.

[0052] Further, step S500 includes:

[0053] Step S501: Obtain real-time graph data and generate a set of real-time attack paths by the attack path prediction model;

[0054] Step S502: input each candidate attack path in the real-time candidate attack path set into the trust score model, calculate the real-time trust score of each candidate attack path, and screen out high-trust paths;

[0055] Step S503: input the high-trust paths into the attack source prediction model to obtain the predicted attack source probability corresponding to each node, set a preset attack source probability threshold, mark the nodes exceeding the attack source probability threshold as risk nodes, and upload them to the network security protection system to prompt the staff to check;

[0056] The system continuously monitors real-time behavior data in the network environment and integrates these data into the graph database, dynamically updates the network behavior graph, and after updating the graph, the system calls the trained attack path prediction model to perform real-time inference analysis on the current graph. Based on the graph neural network, the model generates a plurality of real-time candidate attack path sets. These candidate paths are the comprehensive inference results based on the entity interaction behavior in the current network environment, reflecting the current potential attack behavior chain.

[0057] The system inputs each candidate attack path obtained in step S501 as input into the trained trust score model. The model calculates the real-time trust score of each path according to key elements in the path structure such as node risk score, behavior sequence confidence, time consistency factor, etc. Then, the system automatically screens out paths with a trust score higher than the threshold according to the set trust score threshold, and marks them as high-trust paths. This process can prioritize the most likely paths that pose a security threat among a large number of candidate paths for further analysis and processing by downstream modules.

[0058] For each high-trust path screened out, the system calls the trained attack source prediction model to analyze each node in the path and outputs the predicted probability of each node being an attack source. The system identifies nodes exceeding the threshold according to the preset attack source probability threshold and marks them as risk nodes. To achieve rapid response, the system automatically uploads risk node information including node identification, predicted probability, and path to the network security protection system, prompting the operation and maintenance personnel or security analysts to check, trace, and dispose. As an alarm triggering mechanism, this significantly improves the intelligent level and response efficiency of the early warning system.

[0059] To better implement the above method, an artificial intelligence-based network security data analysis system is also proposed. The system includes a graph construction module, an attack path module, a trust score module, an attack source module, and a real-time monitoring module.

[0060] The atlas construction module: when the network security protection system is started, the terminal log, traffic log and host audit record are collected at a preset interval, the network behavior event is identified, the sending entity and receiving entity information are extracted, the structured triple is constructed and standardized, is mapped to the atlas node and edge, the time label and context attribute are attached, and is stored to the graph database;

[0061] The attack path module: the atlas data is extracted from the graph database, the node attribute, edge type and time stamp are coded, the node feature matrix, adjacency matrix and edge feature matrix are generated; the node representation vector is trained by using the graph attention mechanism, and the semantic propagation matrix is constructed; the historical attack path is taken as the positive sample, and the normal path is taken as the negative sample, the graph neural network is supervised and trained, and the prediction attack path model is obtained;

[0062] The trusted score module: the prediction attack path model is used to infer the training period atlas, and a candidate attack path set is generated; the path node risk level, abnormal frequency, path length, edge confidence and time consistency factor are extracted, the trusted score model is constructed and optimized, and the high-trust path with a score exceeding a threshold is selected;

[0063] The attack source module: the preposition, connection breadth and propagation intensity of the starting node are extracted from the high-trust path, and the attack source label is labeled after normalization; a multilayer perception model is constructed, ReLU is taken as the hidden layer activation function, Sigmoid is taken as the output layer, and the binary cross entropy is taken as the loss function training, and the attack source prediction model is obtained;

[0064] The real-time monitoring module: real-time atlas data is obtained, a candidate path set is generated by the prediction attack path model; the real-time trusted score is calculated by inputting the trusted score model, and the high-trust path is selected; the node probability is output by inputting the attack source prediction model, and the node exceeding the threshold is marked as a risk node and uploaded to the protection system to trigger an alarm and inspection.

[0065] Further, the atlas construction module includes a triple unit and a graph database unit:

[0066] The triple unit: when the network device is connected to the network, the network security protection system is started, the network data is collected at a preset time interval, when the time interval is reached, the parsed terminal log, network traffic log and host behavior audit record of the network device are automatically collected, the collected log data is analyzed, the corresponding network behavior event is identified, the information of the sending entity and the receiving entity in the event is extracted, according to the identified network behavior event, the sending entity, behavior type and receiving entity extracted from each event are composed into a structured triple, a triple set is established, an original behavior relationship database is constructed, and field standardization and semantic normalization processing are performed;

[0067] The graph database unit: each entity object in the constructed triad set is mapped to a node in the graph, each behavior relationship type is mapped to an edge in the graph, thereby constructing a graph of network behavior, in the graph construction process, each node is assigned a node type label, each edge is assigned an edge type label, a time label associated with each edge is introduced on the constructed graph, context field information at the time of behavior occurrence is extracted and used as an additional attribute of the edge, at the same time, attribute information related to each node is extracted and attached to the corresponding node, a directed graph structure is constructed, and the graph structure is stored in the graph database.

[0068] Further, the attack path module includes a semantic propagation matrix unit and a predicted attack path model unit.

[0069] The semantic propagation matrix unit: the graph corresponding to each event is extracted from the graph database, the attribute and feature information of each node in the graph is extracted, the behavior type, timestamp of each edge, and the context semantic features of the edge are counted, the nodes and edges are coded and converted into an input data format recognizable by the graph neural network model, a node feature matrix, an adjacency matrix, and an edge feature matrix are generated, an input tensor of the graph neural network is constructed, the node attribute, adjacent node context, behavior semantic and time sequence information of the edge are used for multi-layer embedding training by using the graph attention mechanism, a node representation vector is generated, and a semantic propagation matrix between edges is constructed by using the propagation mechanism in the graph neural network.

[0070] The predicted attack path model unit: the extracted node feature matrix is used as input, the representation vector of each node is initialized, the relationship propagation matrix is constructed based on the semantic information, behavior type, and time sequence features of the edge, the representation vector of the node is updated by aggregating the features and relationship propagation matrix of the neighbor nodes through each layer of the graph neural network, the confirmed attack path in the historical data is used as a positive sample, and the non-attack path or normal operation path is used as a negative sample, the path level corresponding to the positive sample and the negative sample is labeled, the graph neural network model is retrained based on the label data, the node representation vector and the relationship propagation matrix are optimized, and the predicted attack path model is obtained after training.

[0071] Further, the trusted score module includes a training period unit and a trusted score model generation unit.

[0072] The training period unit: a predetermined number of consecutive days is set as the training period, the graph data in the training period is inferred based on the constructed predicted attack path model, a candidate attack path set is generated, the representation vector of the path node, the semantic information of the associated edge, the behavior type, and the time sequence features of each candidate attack path are obtained.

[0073] The trusted score model generation unit: structured analysis is performed on each candidate attack path, key feature information in the candidate attack path is extracted, the key feature information includes a risk level of an entity node in the candidate attack path, a node historical abnormal behavior frequency, a path length, a behavior sequence confidence of an edge, and a time consistency factor of a path behavior sequence, the key feature information is used as input data of a trusted score model, the trusted score model is trained and parameter optimized based on graph data in a training period and the extracted key feature information of the candidate attack path, in the training process, the key feature information is input into the trusted score model as a training sample, and a labeled trust level of each path is used as a supervision signal, by minimizing a loss function between a predicted trust score and the labeled trust level, weights corresponding to path node risk scores, path behavior sequence confidences and path time consistency factors are automatically learned, and a trained trusted score model is obtained.

[0074] Compared with the prior art, the present application has the following beneficial effects:

[0075] I. Most of the existing network security methods only support threat detection based on rules or static models, and cannot form a complete chain from behavior data collection, attack path modeling, risk scoring to attack source identification. The present application builds a closed-loop system covering data collection→graph modeling→path prediction→attack source positioning→real-time alarm linkage, which breaks through the whole process of network security analysis "perception—modeling—decision";

[0076] II. Traditional methods rely on static features or rules set by experts, and it is difficult to capture complex semantic and structural relationships in attack paths. The present application trains multiple layers of graph embedding through graph neural network combined with graph attention mechanism, which can integrate node attributes, adjacent context, behavior timing, edge semantics and other multi-dimensional information, realize deep understanding and high-precision prediction of attack paths;

[0077] III. The existing attack detection mechanism is difficult to quantitatively sort multiple potential paths. The present application innovatively introduces a trusted score model, which integrates path node risk score, behavior sequence confidence and time consistency factor, and builds a risk measurement model to quantitatively evaluate the risk level of the path, effectively improving the accuracy and efficiency of high-risk path screening;

[0078] IV. In the traditional system, attack source positioning often relies on manual tracing, and the response cycle is long. The present application proposes an attack source prediction model based on multilayer perception, which combines structural features, behavior location and influence, etc. to realize high-accuracy prediction of the starting node in the path, significantly improving the automation and real-time performance of attack source identification. BRIEF DESCRIPTION OF DRAWINGS

[0079] Figure 1A flowchart of the network security data analysis method based on artificial intelligence of the present application is shown in the figure.

[0080] Figure 2 A structural diagram of the network security data analysis system based on artificial intelligence of the present application is shown in the figure. DETAILED DESCRIPTION

[0081] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the accompanying drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0082] Please refer to Figure 1 and Figure 2 The present application provides a technical solution: a network security data analysis method based on artificial intelligence, which comprises the following steps:

[0083] Step S100: When the network security protection system is started, collect terminal logs, traffic logs and host audit records at preset intervals, identify network behavior events, extract information of sending entities and receiving entities, construct structured triples and standardize them, map them into graph nodes and edges, add time labels and context attributes, and store them into a graph database.

[0084] In the step S100, the following steps are included:

[0085] Step S101: When a network device is connected to a network, start the network security protection system, preset the time interval for collecting network data in the network security protection system, and automatically collect parsed terminal logs, network traffic logs and host behavior audit records of the network device when the time interval is reached, analyze the collected log data, identify events corresponding to network behaviors, and extract information of sending entities and receiving entities in the events.

[0086] Step S102: According to the network behavior events identified in step S101, compose the extracted sending entities, behavior types and receiving entities of each event into structured triples, establish a triple set, construct an original behavior relationship database, and perform field standardization and semantic normalization processing.

[0087] Step S103: Map each entity object in the triple set constructed in step S102 into a node in the graph, map each behavior relationship type into an edge in the graph, thereby constructing a network behavior graph, and assign a node type label to each node and an edge type label to each edge in the graph construction process.

[0088] Step S104: On the constructed graph, introduce time tags associated with each edge, extract the context field information when the behavior occurs, and use it as an additional attribute of the edge. At the same time, extract the attribute information related to each node, and attach the attribute information to the corresponding node to construct a directed graph structure, and store the graph structure in the graph database.

[0089] For example, extract key information for each event from the logs. Suppose the system identifies an event: "User A sends an entity to receive entity C from server B as a behavior type for downloading file C."

[0090] Constructing triples: Transform events into structured triples, for example:

[0091] Issuing entity: User A;

[0092] Behavior type: Download file;

[0093] Receiving entity: Server B;

[0094] The mapping nodes in the graph: The system maps the entity objects in each triple, such as user A and server B, to nodes in the graph;

[0095] Mapped edges: The behavior type in each event, such as "download file", is mapped to an edge in the graph. For example, the edge between user A and server B could be the behavior of "downloading file";

[0096] Assign a node type label to each node: for example, a user node can be labeled "User" and a server node can be labeled "Device";

[0097] Assign an edge type label to each edge: for example, the edge type for downloading files is "behavior".

[0098] Step S200: Extract graph data from the graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model.

[0099] Step S200 includes:

[0100] Step S201: Extract the graph corresponding to each event from the graph database, extract the attribute and feature information of each node in the graph, count the behavior type, timestamp of each edge, and extract the context semantic features of the edge, encode the nodes and edges, and convert them into input data formats recognizable by the graph neural network model, generate node feature matrix, adjacency matrix and edge feature matrix, construct the input tensor of the graph neural network, use node attributes, adjacent node context, edge behavior semantics and time sequence information, use graph attention mechanism for multi-layer embedding training, generate node representation vector, and use the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges;

[0101] Step S202: The node feature matrix extracted in step S201 is used as input to initialize the representation vector of each node, and a relationship propagation matrix is constructed based on the semantic information, behavior type and time sequence features of the edge. Through each layer in the graph neural network, the features and relationship propagation matrix of the neighbor nodes are aggregated, and the representation vector of the updated node is calculated according to the following formula:

[0102]

[0103] Wherein, represents the representation vector of node a at the d+1 layer, represents the attention weight of adjacent node c to node a in the d layer, D d represents the trainable weight matrix of the d layer, represents the representation vector of adjacent node c in the d layer, F ac represents the propagation weight of node c to node a;

[0104] Step S203: The confirmed attack path in the historical data is taken as a positive sample, and the non-attack path or normal operation path is taken as a negative sample. The path level corresponding to the positive sample and the negative sample is labeled, and the graph neural network model is retrained based on the label data, and the node representation vector and the relationship propagation matrix are optimized. After training, the predicted attack path model is obtained;

[0105] For example, the system extracts graph data in the last 7 days from the graph database, including about 20,000 nodes such as users, terminals, servers, applications and 40,000 edges such as login, download, upload, communication and other behaviors; Each node carries attribute information such as user role, permission level, historical behavior frequency, etc.; Each edge records the behavior type such as "remote login", timestamp, context information such as source IP, destination port, etc.

[0106] Discrete attributes such as role type and asset type are One-Hot encoded, and numerical attributes such as abnormal times and operation frequency are normalized,

[0107] Edge feature encoding: behavior type→One-Hot encoding; timestamp→discretized into time periods such as working hours / non-working hours, context semantics such as port type, protocol→vectorization;

[0108] Multi-layer training using graph attention mechanism, integrating node itself attributes, adjacent node context, edge semantic information and time sequence, to obtain the representation vector of each node;

[0109] Suppose, positive samples: attack paths reproduced in historical attack events, usually including path chains initiated by attack sources and gradually infected, for example: attacker IP→jump host→business server→database;

[0110] Negative samples: normal network behavior paths, such as user login→access system→file upload;

[0111] Each sample path is composed of a set of nodes and edges, and is uniformly labeled with label 1 for attack path and 0 for normal path; using the node representation output by the aforementioned GNN and the propagation matrix, construct a vector representation at the path level, input the path vector sequence to a classifier such as MLP or path attention pooling layer, and use cross-entropy loss function for supervised training.

[0112] Step S300: infer the training period graph using the predicted attack path model to generate a set of candidate attack paths; extract path node risk level, abnormal frequency, path length, edge confidence and time consistency factor, construct a credibility scoring model and train and optimize, and select high-credible paths with scores exceeding a threshold;

[0113] Wherein, step S300 comprises:

[0114] Step S301: preset a continuous number of days as a training period, based on the predicted attack path model constructed in step S203, infer the graph data in the training period to generate a set of candidate attack paths, and obtain the representation vector of each candidate attack path, the semantic information of the associated edge, the behavior type and the time sequence feature;

[0115] Step S302: structurally analyze each candidate attack path and extract key feature information in the candidate attack path, the key feature information including risk level of entity nodes in the candidate attack path, historical abnormal behavior frequency of the nodes, path length, behavior sequence confidence of the edges, and time consistency factor of the path behavior sequence, and the key feature information is used as input data of the credibility scoring model, and the credibility scoring model is represented as:

[0116] S=σ(e×R+f×G+g×T);

[0117] Wherein S represents a trust score, R represents a path node risk score, G represents a path behavior sequence confidence, T represents a path time consistency factor, and e, f, and g represent weights of the path node risk score, the path behavior sequence confidence, and the path time consistency factor, respectively;

[0118] Step S303: Based on the graph data in the training period and the candidate attack path key feature information extracted in step S302, the trust score model is trained and the parameters are optimized. In the training process, the key feature information is input into the trust score model as a training sample, and the labeled trust level of each path is used as a supervision signal. By minimizing the loss function between the predicted trust score and the labeled trust level, the weights of the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned, and the trained trust score model is obtained.

[0119] Step S304: A trust score threshold is preset, and a candidate attack path whose trust score exceeds the trust score threshold is set as a high trust path.

[0120] For example, assuming that the data of the past 30 days is selected as the training period, the historical attack path data such as common attack means, intrusion detection system logs, behavior analysis logs, etc. are used as the training data.

[0121] The model infers the network graph data in the training period to generate a candidate attack path set. These paths may include various potential attack paths, such as from external intrusion to internal control, from a certain machine to database access, etc.

[0122] For each candidate path, the following features are extracted: the representation vector of the path node: for example, the “attacker IP” node and the “infected host” node;

[0123] The semantic information of the associated edge: for example, data transmission, malicious command execution, etc.

[0124] Behavior type: for example, horizontal movement, data theft, etc.

[0125] Timing feature: for example, the time distribution of attack activities;

[0126] Risk level: the risk level of each node, which can be calculated based on the node type such as external IP, sensitive data node, or node historical behavior such as whether it has been attacked in the past;

[0127] Historical abnormal behavior frequency: for example, whether a certain host has appeared multiple unauthorized accesses in the past 30 days, whether it has a high frequency of malicious activities;

[0128] Path length: the length of the path from the attack origin to the target, e.g., the number of steps an attacker needs to take to reach a critical asset;

[0129] Edge behavior sequence confidence: whether a certain behavior, such as remote login, has high confidence, which is usually based on the confidence score output by the behavior analysis model;

[0130] Temporal consistency factor: whether the times of all behaviors in the path are reasonable, e.g., an attacker controlling multiple nodes at the same time within a short period of time may trigger an alarm;

[0131] These feature information will be used as input to build a trust score model;

[0132] Based on historical graph data and known labeled attack paths, such as whether the path is confirmed as a real attack path, the extracted key feature information will be input into the trust score model as training samples;

[0133] The model is trained using supervised learning methods, such as minimizing the loss function, which measures the difference between the predicted trust score and the actual labeled trust level;

[0134] Through training, the model automatically optimizes the feature weights so that the predicted trust score is as close as possible to the actual label;

[0135] Set the trust score threshold: for example, assume a threshold (such as 0.8) is set, indicating that when the trust score of a candidate attack path is greater than the threshold, the path is considered a high-trust path;

[0136] For each candidate attack path, calculate its trust score and compare it with the threshold. If the trust score exceeds the threshold, the path is marked as a "high-trust path", meaning it is a potential high-risk attack path that needs further monitoring or response.

[0137] Step S400: Extract the preposition, connection breadth and propagation strength of the starting node from the high-trust path, normalize and label the attack source tag; build a multi-layer perception model with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function training, to obtain an attack source prediction model;

[0138] Wherein, step S400 comprises:

[0139] Step S401: Extract analysis data from the high-trust path selected, analyze the behavior starting node in the path, collect the preposition, connection breadth and propagation strength, and perform normalization processing, and perform binary classification labeling according to whether the node is an attack source;

[0140] Step S402: Construct an attack source prediction model based on a multi-layer perception model, using a sigmoid activation function as the activation function of the output layer, using a ReLU activation function as the activation function of the hidden layer, using the normalized node preposition, connection breadth and propagation intensity as the input vector,

[0141] Step S403: Train the attack source prediction model based on the graph data in the training period, use binary cross entropy as the loss function, constantly update the parameters through the back propagation algorithm and the optimizer, and get the trained attack source prediction model;

[0142] For example, 1000 high-trust attack path samples, each path includes several nodes and edges, and the system focuses on the starting node of the path, i.e. the first behavior initiation node;

[0143] For each starting node, the system extracts the following features: preposition: whether the node is often used as the "behavior starting point" in the entire graph, and the probability of being the first initiator in multiple paths is counted, for example, if the node appears in the first place 50 times in 1000 paths, the preposition is 0.05;

[0144] Connection breadth: the number of connections of the node, out-degree + in-degree, reflecting its activity in the network, and the attack source is often widely connected to quickly spread;

[0145] Propagation intensity: the maximum depth / path expansion capability of the behavior propagation from the node, for example, if an attack path of a node expands to the 4th layer, the propagation intensity is 4;

[0146] If the starting node is confirmed as an attack source node in the historical confirmed attack samples, it is labeled as 1;

[0147] Otherwise, it is a normal node or an infected relay node, labeled as 0;

[0148] A simple and efficient multi-layer neural network is used to construct the attack source prediction model:

[0149] Input layer (3D) -> hidden layer 1 (64D, ReLU) -> hidden layer 2 (32D, ReLU) -> output layer (1D, Sigmoid);

[0150] Input vector: the input of each node is [preposition, connection breadth, propagation intensity] (after normalization),

[0151] Output result: Sigmoid outputs a probability [0, 1], indicating the likelihood of the node being an attack source;

[0152] Training data: A total of 1000 node samples, positive samples (real attack source nodes): 200, negative samples (non-attack source nodes): 800;

[0153] Model training settings: loss function binary cross-entropy, optimizer: Adam (learning rate 0.001), training rounds: 50 rounds, regularization: Dropout 0.3 to prevent overfitting.

[0154] Step S500: Obtain real-time graph data, generate a candidate path set through the predicted attack path model; input the trusted score model to calculate the real-time trusted score, filter the high-trusted path; input the attack source prediction model to output the node probability, mark the nodes exceeding the threshold value as risk nodes, and upload to the protection system to trigger alarm and inspection.

[0155] Among them, step S500 includes:

[0156] Step S501: Obtain real-time graph data, generate a real-time candidate attack path set through the predicted attack path model;

[0157] Step S502: input each candidate attack path in the real-time candidate attack path set into the trusted score model, calculate the real-time trusted score of each candidate attack path, and filter out the high-trusted path;

[0158] Step S503: input the high-trusted path into the attack source prediction model to obtain the predicted attack source probability corresponding to each node, preset an attack source probability threshold, mark the nodes exceeding the attack source probability threshold as risk nodes, upload to the network security protection system, and prompt the staff to perform inspection;

[0159] For example, the system pulls the recent 5-minute graph changes such as newly added behavior edges and node updates from the real-time log stream and graph database incremental update interface every 5 minutes;

[0160] Build an incremental graph snapshot: about 1000 new edges, 500 new / changed nodes;

[0161] Input graph snapshot node features, edge features, adjacency structure, etc., and output a candidate attack path set such as path P1, P2,..., Pn, each path being a group of node sequences + edge sequences.

[0162] Example output path (part): P1: external IP_X→gateway G1→internal host H1→DB_A;

[0163] P2: employee terminal T1→file server F2→management platform C3;

[0164] Extract key features: node risk level (R), behavior sequence confidence (G), time consistency factor (T) for each candidate path, e.g. 100 paths

[0165] Assuming that the R of path P1 is 0.82, G is 0.76, and T is 0.90, the calculated confidence score is 0.845; the R of path P2 is 0.25, G is 0.45, and T is 0.51, the calculated confidence score is 0.394; the R of path P3 is 0.73, G is 0.70, and T is 0.65, the calculated confidence score is 0.726;

[0166] Set the confidence score threshold to 0.7, and filter out high-confidence paths P1 and P3;

[0167] Extract the input features of each node, the preposition of external IP_X in path P1 is 0.95, the connection breadth is 0.88, the propagation intensity is 0.75, and the attack source probability is 0.91;

[0168] The preposition of gateway G1 is 0.20, the connection breadth is 0.45, the propagation intensity is 0.30, and the attack source probability is 0.33;

[0169] The preposition of employee terminal T is 0.62, the connection breadth is 0.70, the propagation intensity is 0.66, and the attack source probability is 0.58;

[0170] Set the attack source threshold to 0.8, and consider external IP_X as a "high-risk attack source node" and report it to the network security platform.

[0171] In order to better implement the above method, an artificial intelligence-based network security data analysis system is also proposed, which includes a graph construction module, an attack path module, a confidence score module, an attack source module, and a real-time monitoring module;

[0172] Graph construction module: when starting the network security protection system, collect terminal logs, traffic logs and host audit records at preset intervals, identify network behavior events, extract sending entity and receiving entity information, construct structured triples and standardize, map to graph nodes and edges, add time labels and context attributes, and store to graph database;

[0173] Among them, the graph construction module includes a triple unit and a graph database unit:

[0174] Triplet unit: when the network device is connected to the network, a network security protection system is started, in which a preset time interval for collecting network data is set, when the time interval is reached, the parsed terminal log, network traffic log and host behavior audit record of the network device are automatically collected, the collected log data is analyzed, the events corresponding to the network behavior are identified, and the information of the sending entity and the receiving entity in the events are extracted, according to the identified network behavior events, the sending entity, behavior type and receiving entity extracted from each event are composed into a structured triplet, a triplet set is established, an original behavior relationship database is constructed, and field standardization and semantic normalization processing are performed;

[0175] Graph database unit: each entity object in the constructed triplet set is mapped as a node in the graph, each behavior relationship type is mapped as an edge in the graph, thereby constructing a graph of network behavior, in the graph construction process, a node type label is assigned to each node, an edge type label is assigned to each edge, a time label associated with each edge is introduced on the constructed graph, the context field information at the time of behavior occurrence is extracted and used as an additional attribute of the edge, at the same time, the attribute information related to each node is extracted and attached to the corresponding node, a directed graph structure is constructed, and the graph structure is stored in the graph database.

[0176] Attack path module: graph data is extracted from the graph database, node attributes, edge types and timestamps are encoded, node feature matrix, adjacency matrix and edge feature matrix are generated; node representation vectors are trained using graph attention mechanism, and semantic propagation matrix is constructed; historical attack paths are used as positive samples and normal paths are used as negative samples to supervise the training of graph neural network, and a predicted attack path model is obtained;

[0177] Among them, the attack path module includes a semantic propagation matrix unit and a predicted attack path model unit:

[0178] Semantic propagation matrix unit: the graph corresponding to each event is extracted from the graph database, the attribute and feature information of each node in the graph is extracted, the behavior type, timestamp and context semantic feature of each edge are extracted, the nodes and edges are encoded and converted into input data format recognizable by the graph neural network model, node feature matrix, adjacency matrix and edge feature matrix are generated, input tensor of the graph neural network is constructed, node attributes, adjacent node context, behavior semantics and time sequence information of the edge are used, multi-layer embedding training is performed using graph attention mechanism, node representation vectors are generated, and semantic propagation matrix between edges is constructed using propagation mechanism in the graph neural network;

[0179] The prediction attack path model unit: taking the extracted node feature matrix as input, initializing the representation vector of each node, constructing a relation propagation matrix based on the semantic information, behavior type and timing characteristics of the edge, aggregating the features and relation propagation matrix of the neighbor nodes through each layer in the graph neural network, calculating the updated representation vector of the node, taking the confirmed attack path in the historical data as the positive sample, taking the non-attack path or normal operation path as the negative sample, labeling the path level corresponding to the positive sample and the negative sample, retraining the graph neural network model based on the label data, optimizing the node representation vector and the relation propagation matrix, and obtaining the prediction attack path model after training.

[0180] The trusted score module: reasoning the training period graph atlas with the prediction attack path model to generate a candidate attack path set; extracting the path node risk level, abnormal frequency, path length, edge confidence and time consistency factor, constructing a trusted score model and training and optimizing, and screening high-trust paths with a score exceeding a threshold;

[0181] The trusted score module includes a training period unit and a trusted score model generation unit:

[0182] The training period unit: a continuous number of days is preset as the training period, the graph atlas data in the training period is reasoned based on the constructed prediction attack path model, a candidate attack path set is generated, and the representation vector of the path node, the semantic information, the behavior type and the timing characteristics of the associated edge included in each candidate attack path are obtained;

[0183] The trusted score model generation unit: each candidate attack path is structurally analyzed, and the key feature information in the candidate attack path is extracted, the key feature information including the risk level of the entity node in the candidate attack path, the node historical abnormal behavior frequency, the path length, the edge behavior sequence confidence, and the path behavior sequence time consistency factor, the key feature information is taken as the input data of the trusted score model, the graph atlas data in the training period and the extracted key feature information of the candidate attack path are used to train and optimize the parameters of the trusted score model, in the training process, the key feature information is input into the trusted score model as a training sample, and the labeled trust level of each path is taken as a supervision signal, by minimizing the loss function between the predicted trust score and the labeled trust level, the weights corresponding to the path node risk score, the path behavior sequence confidence and the path time consistency factor are automatically learned, and the trained trusted score model is obtained.

[0184] The attack source module: extracting the preposition, connection breadth and propagation intensity of the starting node from the high-trust path, and labeling the attack source label after normalization; constructing a multi-layer perception model, taking ReLU as the hidden layer activation function and Sigmoid as the output layer, training with binary cross entropy as the loss function, and obtaining an attack source prediction model;

[0185] Real-time monitoring module: obtain real-time atlas data, generate candidate path set through predicted attack path model; input trusted score model to calculate real-time trusted score, filter high trusted path; input attack source prediction model to output node probability, mark nodes exceeding threshold value as risk nodes, upload to protection system to trigger alarm and inspection.

[0186] It will be obvious to a person skilled in the art that the application is not limited to the details of the foregoing exemplary embodiments, and that the application can be implemented in other concrete forms without departing from the spirit or essential characteristics of the application. Therefore, the embodiments should be considered as exemplary and not limiting in any way, the scope of the application being defined by the claims appended hereto rather than the foregoing description, and all changes falling within the meaning and range of equivalency of the elements of the claims are therefore intended to be embraced therein. Any reference signs in the claims should not be construed as limiting the claims concerned.

Claims

1. A cybersecurity data analysis method based on artificial intelligence, characterized in that, The methods include: Step S100: When the network security protection system is started, terminal logs, traffic logs and host audit records are collected at preset intervals to identify network behavior events, extract information of sending and receiving entities, construct structured triples and standardize them, map them as graph nodes and edges, attach time tags and context attributes, and store them in the graph database. Step S200: Extract graph data from the graph database, encode node attributes, edge types and time stamps, and generate node feature matrix, adjacency matrix and edge feature matrix; train node representation vectors using graph attention mechanism to construct semantic propagation matrix; supervise the training of graph neural network with historical attack paths as positive samples and normal paths as negative samples to obtain the attack path prediction model. Step S300: Use the predicted attack path model to infer and train the periodic graph, and generate a set of candidate attack paths; extract the risk level, anomaly frequency, path length, edge confidence and time consistency factor of the path nodes, construct a credibility scoring model and train and optimize it, and screen high credibility paths with scores exceeding the threshold. Step S400: Extract the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalize them, and label them with attack source tags; construct a multilayer perceptron model, train it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function to obtain the attack source prediction model; Step S500: Obtain real-time graph data, generate a candidate path set through the attack path prediction model; input the trust score model to calculate the real-time trust score, and filter high trust paths; input the attack source prediction model to output the node probability, mark nodes exceeding the threshold as risk nodes, and upload them to the protection system to trigger alarms and verification.

2. The artificial intelligence-based network security data analysis method according to claim 1, characterized in that, Step S100 includes the following steps: Step S101: When a network device connects to the network, the network security protection system is started. In the network security protection system, the time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior and to extract the information of the sending entity and the receiving entity in the event. Step S102: Based on the network behavior events identified in step S101, the sending entity, behavior type and receiving entity extracted from each event are combined into structured triples, a set of triples is established, the original behavior relation database is constructed, and field standardization and semantic normalization are performed. Step S103: Map each entity object in the triplet set constructed in step S102 to a node in the graph, and map each behavior relation type to an edge in the graph, thereby constructing a graph of network behavior. During the graph construction process, assign a node type label to each node and an edge type label to each edge. Step S104: On the constructed graph, introduce time tags associated with each edge, extract the context field information when the behavior occurs, and use it as an additional attribute of the edge. At the same time, extract the attribute information related to each node, and attach the attribute information to the corresponding node to construct a directed graph structure, and store the graph structure in the graph database.

3. The artificial intelligence-based network security data analysis method according to claim 2, characterized in that, Step S200 includes the following steps: Step S201: Extract the graph corresponding to each event from the graph database, extract the attributes and feature information of each node in the graph, count the behavior type and timestamp of each edge, and extract the contextual semantic features of the edges. Encode the nodes and edges and convert them into input data formats that can be recognized by the graph neural network model. Generate node feature matrix, adjacency matrix and edge feature matrix. Construct the input tensor of the graph neural network. Utilize node attributes, adjacent node context, edge behavior semantics and time sequence information, and use the graph attention mechanism to perform multi-layer embedding training to generate node representation vectors. Utilize the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges. Step S202: Using the node feature matrix extracted in step S201 as input, initialize the representation vector of each node. Based on the semantic information, behavior type, and temporal features of the edges, construct a relation propagation matrix. Through each layer of the graph neural network, aggregate the features of neighboring nodes and the relation propagation matrix, and calculate and update the node's representation vector according to the following formula: in, This is represented as the representation vector of node a at the (d+1)th layer. Let D represent the attention weight of neighboring node c to node a in layer d. d Let d be the trainable weight matrix of the d-th layer. Let F be the representation vector of the adjacent node c at the d-th layer. ac This is represented as the propagation weight of information from node c to node a; Step S203: Take the confirmed attack paths in the historical data as positive samples and the non-attack paths or normal operation paths as negative samples. Label the path level corresponding to the positive and negative samples. Based on the labeled data, retrain the graph neural network model to optimize the node representation vector and relation propagation matrix. After training, the predicted attack path model is obtained.

4. The artificial intelligence-based network security data analysis method according to claim 3, characterized in that, Step S300 includes the following steps: Step S301: Set a training period of several consecutive days, and based on the prediction attack path model constructed in step S203, perform inference on the graph data within the training period to generate a set of candidate attack paths. Obtain the representation vector of the path nodes, semantic information of the associated edges, behavior type and temporal features of each candidate attack path. Step S302: Perform structured analysis on each candidate attack path to extract key feature information. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal node behavior, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. Use this key feature information as input data for the credibility scoring model, which is expressed as follows: S = σ(e×R + f×G + g×T); Where S represents the credibility score, R represents the path node risk score, G represents the path behavior sequence confidence, T represents the path time consistency factor, and e, f, and g represent the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor, respectively. Step S303: Based on the graph data during the training period and the key feature information of the candidate attack paths extracted in step S302, the credibility scoring model is trained and its parameters are optimized. During the training process, the key feature information is used as training samples to input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, the path behavior sequence confidence, and the path time consistency factor are automatically learned to obtain the trained credibility scoring model. Step S304: Set a preset trust score threshold, and set candidate attack paths with trust scores exceeding the trust score threshold as high trust paths.

5. The artificial intelligence-based network security data analysis method according to claim 4, characterized in that, Step S400 includes the following steps: Step S401: Extract analysis data from the selected high-confidence paths, analyze the behavior starting nodes in the paths, collect the pre-emptiveness, connection breadth and propagation strength, and perform normalization processing, and perform binary classification labeling based on whether the node is an attack source. Step S402: Construct an attack source prediction model. The attack source prediction model is based on a multilayer perceptron model, using the sigmoid activation function as the output layer activation function and the ReLU activation function as the hidden layer activation function. Normalized node pre-existence, connection breadth, and propagation strength are used as input vectors. Step S403: Train the attack source prediction model based on the graph data within the training period, using binary cross-entropy as the loss function, and continuously update the parameters through the backpropagation algorithm and optimizer to obtain the trained attack source prediction model.

6. The artificial intelligence-based network security data analysis method according to claim 5, characterized in that, Step S500 includes the following steps: Step S501: Obtain real-time graph data and generate a set of real-time candidate attack paths through the attack path prediction model; Step S502: Input each candidate attack path in the real-time candidate attack path set into the credibility scoring model, calculate the real-time credibility score of each candidate attack path, and select high credibility paths. Step S503: Input the high-confidence path into the attack source prediction model to obtain the predicted attack source probability for each node. Set a preset attack source probability threshold, mark nodes that exceed the attack source probability threshold as risk nodes, upload them to the network security protection system, and prompt staff to check them.

7. An artificial intelligence-based network security data analysis system, used to implement the artificial intelligence-based network security data analysis method according to any one of claims 1-6, characterized in that, The system includes a graph construction module, an attack path module, a credibility scoring module, an attack source module, and a real-time monitoring module. The graph construction module: When the network security protection system is started, it collects terminal logs, traffic logs and host audit records at preset intervals, identifies network behavior events, extracts information of sending and receiving entities, constructs structured triples and standardizes them, maps them as graph nodes and edges, adds time tags and context attributes, and stores them in the graph database. The attack path module extracts graph data from the graph database, encodes node attributes, edge types, and time stamps, and generates a node feature matrix, an adjacency matrix, and an edge feature matrix. Node representation vectors are trained using graph attention mechanism to construct a semantic propagation matrix; a graph neural network is trained under supervision with historical attack paths as positive samples and normal paths as negative samples to obtain a model for predicting attack paths. The credibility scoring module: uses the predicted attack path model to infer and train the periodic graph, generates a set of candidate attack paths; extracts the risk level, anomaly frequency, path length, edge confidence and time consistency factor of path nodes, constructs a credibility scoring model and trains and optimizes it, and filters high credibility paths with scores exceeding the threshold. The attack source module extracts the preceding nature, connection breadth, and propagation strength of the starting node from the high-confidence path, normalizes them, and labels them with attack source tags; it constructs a multilayer perceptron model, trains it with ReLU as the hidden layer activation function, Sigmoid as the output layer, and binary cross-entropy as the loss function, and obtains the attack source prediction model. The real-time monitoring module acquires real-time graph data, generates a candidate path set through a predicted attack path model, calculates a real-time credibility score using a credibility scoring model, and filters high-credibility paths. It also inputs the node probability from the attack source prediction model, marks nodes exceeding the threshold as risk nodes, and uploads the data to the protection system to trigger alarms and verification.

8. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The graph construction module includes triplet units and graph database units: The triplet unit: When a network device connects to the network, a network security protection system is activated. In the network security protection system, a time interval for collecting network data is preset. When the time interval is reached, the parsing terminal log, network traffic log, and host behavior audit record of the network device are automatically collected. The collected log data is analyzed to identify the events corresponding to the network behavior, and the information of the sending entity and the receiving entity in the event is extracted. Based on the identified network behavior events, the sending entity, behavior type, and receiving entity extracted from each event are combined into a structured triplet to establish a triplet set, construct the original behavior relation database, and perform field standardization and semantic normalization processing. The graph database unit maps each entity object in the constructed triplet set to a node in the graph, and maps each behavior relation type to an edge in the graph, thereby constructing a graph of network behaviors. During the graph construction process, a node type label is assigned to each node, and an edge type label is assigned to each edge. On the completed graph, a time label associated with each edge is introduced, and the context field information when the behavior occurs is extracted and used as an additional attribute of the edge. At the same time, attribute information related to each node is extracted and attached to the corresponding node, thus constructing a directed graph structure, and storing the graph structure in the graph database.

9. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The attack path module includes a semantic propagation matrix unit and a predictive attack path model unit: The semantic propagation matrix unit extracts the graph corresponding to each event from the graph database, extracts the attributes and feature information of each node in the graph, counts the behavior type and timestamp of each edge, and extracts the contextual semantic features of the edges. It encodes the nodes and edges and converts them into an input data format that can be recognized by the graph neural network model, generates a node feature matrix, an adjacency matrix, and an edge feature matrix, constructs the input tensor of the graph neural network, and uses the node attributes, adjacent node context, edge behavior semantics, and time sequence information to perform multi-layer embedding training using a graph attention mechanism to generate node representation vectors. Finally, it uses the propagation mechanism in the graph neural network to construct the semantic propagation matrix between edges. The attack path prediction model unit: using the extracted node feature matrix as input, initializes the representation vector of each node; constructs a relation propagation matrix based on the semantic information, behavior type, and temporal features of the edges; aggregates the features of neighboring nodes and the relation propagation matrix through each layer of the graph neural network; calculates and updates the node's representation vector; uses confirmed attack paths in historical data as positive samples and non-attack paths or normal operation paths as negative samples; labels the path levels corresponding to the positive and negative samples; and retrains the graph neural network model based on the labeled data to optimize the node representation vector and relation propagation matrix. After training, the attack path prediction model is obtained.

10. The artificial intelligence-based network security data analysis system according to claim 7, characterized in that, The credible scoring module includes a training cycle unit and a credible scoring model generation unit: The training cycle unit: a set of consecutive days is preset as the training cycle. Based on the prediction attack path model constructed in step S203, the graph data within the training cycle is inferred to generate a set of candidate attack paths. The representation vector of the path node, the semantic information of the associated edge, the behavior type and the temporal features of each candidate attack path are obtained. The unit generating the credibility scoring model performs structured analysis on each candidate attack path, extracting key feature information from the candidate attack path. This key feature information includes the risk level of entity nodes in the candidate attack path, the frequency of historical abnormal behavior of nodes, path length, edge behavior sequence confidence, and the time consistency factor of the path behavior sequence. This key feature information is used as input data for the credibility scoring model. Based on the graph data within the training period and the extracted key feature information of the candidate attack paths, the credibility scoring model is trained and its parameters are optimized. During training, the key feature information is used as training samples input into the credibility scoring model, and the labeled credibility level of each path is used as a supervision signal. By minimizing the loss function between the predicted credibility score and the labeled credibility level, the weights corresponding to the path node risk score, path behavior sequence confidence, and path time consistency factor are automatically learned, resulting in the trained credibility scoring model.

Images