Artificial intelligence-based network security threat analysis data transmission system and method

Abstract

The application relates to the field of data safe transmission, in particular to a network security threat analysis data transmission system and method based on artificial intelligence, which comprises a double-layer isolation module, a safety analysis module, a program injection module, a protection memory module and a cluster sharing module; the double-layer isolation module is used for setting a virtual machine and asynchronously transmitting a data stream; the safety analysis module is used for generating a destructive instruction; the program injection module is used for setting threat conditions and a wake-up key of different levels; the protection memory module is used for comparing historical attack data and generating a memory program; and the cluster sharing module is used for sharing the memory program; the application can effectively curb unknown threats while guaranteeing system performance, improves the safety performance of a data transmission network, improves the ability of a host to resist persistent data threats, and balances transmission efficiency and system reliability under the premise of guaranteeing safe transmission.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of data security transmission, in particular to a network security threat analysis data transmission system and method based on artificial intelligence. BACKGROUND

[0002] Network security threats refer to data execution behaviors that may cause harm to computer systems or networks. During the transmission of related security data and information, threat assessment of the transmitted data is required. Through real-time monitoring of network traffic and updating of network security policies, monitoring and early warning of malicious software, traffic detection or attack surface analysis are realized.

[0003] Common security transmission methods include SIEM system integration, log forwarding and dedicated proxy, etc. However, with the diversification of threat means, malicious data camouflage is becoming more powerful, and these transmission methods still have security risks. Within a server cluster, data transmission is frequent, and it is very difficult to find and monitor these abnormal data. After the incubation period ends, it is also difficult to locate threat data in a timely manner, and the supervision of threat behaviors such as credential theft and man-in-the-middle attacks is not strong.

[0004] In addition, the improvement of data transmission security will inevitably lead to a decrease in transmission efficiency. For a network cluster, real-time monitoring of a part of the transmission process and access behavior of a large amount of data will cause certain network delay and data loss. It is necessary to balance data integrity and transmission security to make part of the high-efficiency demand host obtain better data transmission performance. SUMMARY

[0005] The purpose of the present application is to provide a network security threat analysis data transmission system and method based on artificial intelligence to solve the problems raised in the background.

[0006] In order to solve the above technical problems, the present application provides the following technical scheme: a network security threat analysis data transmission system based on artificial intelligence, comprising: a double-layer isolation module, a security analysis module, a program injection module, a protection memory module and a cluster sharing module.

[0007] The double-layer isolation module is used to set up a virtual machine simulating the running of the host in the host address through a lightweight container, and to embed a supervision program Hook in the system call and network I / O interface in the virtual machine. During data transmission, the host and the virtual machine asynchronously transmit the same data at fixed intervals, and the non-blocking queue is used to protect the host performance. The hash tree is used to compare the asynchronous transmission data stream, and the data segment with differences is located and identified.

[0008] The security analysis module is used for detecting CPU instruction set, memory page signature and system call sequence of the virtual machine, analyzing time sequence behavior anomaly by using an LSTM neural network, generating metadata describing threat types when there is an abnormal or unrecognizable running result, inputting virtual machine parameters into a threat analysis model, determining a data segment of an abnormal data source, and generating a destructive instruction for the data segment at a corresponding position of a host data pool;

[0009] The program injection module is used for injecting a destructive program into a virtual machine data pool corresponding to an offset address through a host hot patch mechanism, triggering virtual machine execution flow termination or rollback, analyzing behavior logs in a data transmission process, clustering network interfaces of data access by using a DBSCAN algorithm, setting threat conditions and wake-up keys of different levels inside the clustered interfaces, and starting the injection program to destroy data threatened when the data transmission process meets the threat conditions;

[0010] The protection memory module is used for fixing high-frequency attack patterns to an FPGA or eBPF program of the host by comparing historical attack data through SimHash or cosine similarity, recording a control flow graph of data access during data transmission, comparing historical attack paths with current behaviors by using a SimHash algorithm, locating an injection point in a data process by using a binary search and a taint tracking algorithm when a consistency rate is higher than a threshold value, and quickly completing a supervision program injection process;

[0011] The cluster sharing module is used for establishing an ADC performance evaluation model for hosts in a service cluster, evaluating running reliability, security and data transmission performance, layering the hosts, making the security performance of all hosts in a previous layer higher than that of a next layer of hosts, making the total data transmission speed higher than the data access speed of the next layer of hosts, and making the probability of completing a task of the service cluster higher than a threshold value, performing data transmission and sharing memory programs according to the layers.

[0012] Further, the double-layer isolation module comprises a virtual machine unit and an asynchronous transmission unit.

[0013] The virtual machine unit is used for establishing a low-overhead running virtual machine outside the host by using a lightweight virtualization technology based on KVM or Docker.

[0014] The asynchronous transmission unit is used for performing differential data transmission between the host and the virtual machine at a fixed time interval, and performing consistency checking by using a hash or a digital signature.

[0015] Further, the security analysis module comprises a threat model unit and a program destruction unit.

[0016] The threat model unit is used for predefining threat types, and the threat types comprise buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering.

[0017] The program destruction unit is used to generate deterministic destruction instructions for threat data segments, including NOP padding, pointer hijacking, and packet dropping.

[0018] Further, the program injection module includes a log supervision unit, an interface clustering unit, and a key wake-up unit.

[0019] The log supervision unit is used to inject a supervision program to collect access logs of data segments in network interfaces, including access frequency, protocol type, packet size, and source IP features.

[0020] The interface clustering unit is used to cluster interfaces using DBSCAN or K-means, and divide risk interface groups.

[0021] The key wake-up unit is used to generate a session key based on a PUF function, and when the threat condition is met, the execution authority is decrypted by the supervision program.

[0022] Further, the protection memory module includes a self-similarity analysis unit and a memory program unit.

[0023] The self-similarity analysis unit is used to match data behavior with known attack features or historical abnormal access, and output the matching consistency rate.

[0024] The memory program unit is used to generate a memory program based on an injection point control flow graph, and the memory program is stored in the host using Rootkit hiding technology.

[0025] Further, the cluster sharing module includes an efficiency evaluation unit, a service layering unit, and a memory sharing unit.

[0026] The efficiency evaluation unit is used to quantitatively evaluate the running reliability, security, and data transmission efficiency of the host using a sliding window mechanism.

[0027] The service layering unit is used to layer the hosts in the service cluster to form a data transmission chain, and inject supervision programs in the chain.

[0028] The memory sharing unit is used to share memory programs among servers at the same level to balance security and service reliability.

[0029] The network security threat analysis data transmission method based on artificial intelligence includes the following steps:

[0030] Step S1. Set up a virtual machine in the host address to simulate the running of the host, and embed a supervision program in the system call and network I / O interface in the virtual machine. During data transmission, the host and the virtual machine asynchronously transmit the same data at fixed intervals and perform consistency checking.

[0031] Step S2. Detect the running parameters of the virtual machine, analyze the timing behavior anomaly, input the abnormal or unrecognizable running results in the virtual machine into the threat analysis model, determine the source of the abnormal data, and inject a supervision program for the data segment at the corresponding position of the host data pool, wherein the supervision program contains destructive instructions;

[0032] Step S3. The supervision program collects the access log of the data segment in the network interface, clusters the network interfaces of data access, sets different levels of threat conditions and wake-up keys on each interface according to the clustering results, and destroys the execution of the data segment when the threat condition is met;

[0033] Step S4. Compare historical attack data, and solidify high-frequency attack patterns into the FPGA or eBPF program of the host to obtain a memory program. When the data stream matches the memory program, the injection point of the supervision program in the data stream is quickly located;

[0034] Step S5. Evaluate the running reliability, security and data transmission efficiency of each host in the service cluster, layer the hosts according to the evaluation results, form a data transmission chain between layers, and share the memory program among servers in the same layer.

[0035] Further, step S1 includes:

[0036] Step S11. A lightweight virtualization technology based on KVM or Docker is used to establish a virtual machine running outside the host with low overhead. The supervision program Hook is embedded in the system call and network I / O interface in the virtual machine to monitor the data stream in real time. When there is no abnormal data stream, the data execution of the virtual machine is used to replace the data execution of the host;

[0037] Step S12. Fixed time interval differential data transmission is used between the host and the virtual machine to make the host data processing lag behind the virtual machine, and a non-blocking queue is used to protect the host performance. Hash tree is used to compare the asynchronous transmission data stream for consistency check, locate and identify the data segment with differences, and execute the data synchronization program.

[0038] Further, step S2 includes:

[0039] Step S21. Detect the CPU instruction set, memory page signature and system call sequence of the virtual machine, analyze the timing behavior anomaly by using LSTM neural network, and predefine threat types, including buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering;

[0040] Step S22. Calculate the system call entropy value in real time within the sliding window. For data segments with a change rate of entropy value higher than a threshold value, read the call log, memory access pattern, and process behavior tree of the virtual machine system during data segment execution, unpack the key API call parameters and exception instruction set from the call data through the supervisor program hook, fit the attack sample through supervised learning, and build a threat analysis model;

[0041] Step S23. When there is an abnormal or unidentifiable running result, input the abnormal data segment into the threat analysis model to generate metadata describing the threat type, inject a supervisor program into the abnormal data segment position of the host data pool, and generate deterministic destruction instructions in the supervisor program according to the threat type. The destruction instructions include: NOP padding, pointer hijacking, and data packet discarding.

[0042] Further, step S3 includes:

[0043] Step S31. Collect access logs of abnormal data segments in network interfaces, including access frequency, protocol type, packet size, and source IP features. Use DBSCAN or K-means algorithm to divide interface groups, and cluster data access network interfaces according to interface access frequency to determine interface protection levels;

[0044] Step S32. Set different levels of threat conditions and keys inside interfaces of each protection level. The threat conditions include: threat features meeting preset parameters, abnormal access frequency, protocol violation, and geographic anomaly. When data transmission process meets the threat conditions, generate a session key based on a PUF function. When the threat conditions are met, decrypt the destruction instruction execution authority by the supervisor program, block the connection from the inside of the data segment, and destroy the data.

[0045] Further, step S4 includes:

[0046] Step S41. Match data behavior with known attack features or historical abnormal access by comparing historical attack data using SimHash or cosine similarity. Output the consistency rate, and solidify attack patterns with a consistency rate higher than a threshold value to the FPGA or eBPF program of the host to generate a memory program. The memory program is stored in the host using Rootkit hiding technology;

[0047] Step S42. During data transmission, the memory program records the control flow graph of data access, compares historical attack paths with current behavior using the SimHash algorithm, and when the consistency rate is higher than a threshold value, locates the injection point in the data process through binary search and taint tracking algorithms to quickly complete the supervisor program injection process.

[0048] Further, step S5 includes:

[0049] Step S51. An ADC performance evaluation model is established for the host in the service cluster, the running reliability, safety and data transmission performance are evaluated, the host is layered, the safety performance of all hosts in the upper layer is higher than that of the host in the lower layer, the total data transmission speed is higher than the data access speed of the host in the lower layer, and the probability of completing the task of the service cluster is higher than the threshold value;

[0050] Step S52. A data transmission chain is formed between the hosts in different levels, the virtual machine is dispersed in the chain to establish the overhead and the supervision program injection process, and the memory program is shared in the server host in the same level.

[0051] Compared with the prior art, the beneficial effects achieved by the present application are:

[0052] The present application sets up a virtual machine simulating the operation of the host in the host address, the same data is transmitted asynchronously by the host and the virtual machine for a fixed time length during data transmission, the data segment of the unknown data source is determined, and the destruction program injection for the data segment is generated, the hardware level isolation is realized through the virtualization layer, the asynchronous monitoring and the destruction injection mechanism are combined, the unknown threat can be effectively suppressed while the system performance is ensured, and the safety performance of the data transmission network is improved.

[0053] The present application can analyze the behavior log in the data transmission process, cluster the network interface of data access, set different levels of threat conditions and wake-up keys, start the injection program to destroy the data execution when the data meets the threat condition, and generate the memory program, so that the system forms a continuously evolving defense system, improves the ability to resist persistent data threats, realizes the safety monitoring and early warning of malicious software, traffic detection and attack surface analysis, and is suitable for high security demand scenes.

[0054] The present application can establish an ADC performance evaluation model for the host in the service cluster, evaluate the running reliability, safety and data transmission performance, layer the host, share the memory program according to the level, and realize the balance between transmission performance and system reliability under the premise of ensuring safe transmission by combining quantitative evaluation and dynamic control technology. BRIEF DESCRIPTION OF DRAWINGS

[0055] The accompanying drawings are used to provide a further understanding of the present application, and constitute a part of the specification, together with the embodiments of the present application, to explain the present application, and do not constitute a limitation on the present application. In the drawings:

[0056] Figure 1 is a structure diagram of the network security threat analysis data transmission system based on artificial intelligence of the present application;

[0057] Figure 2 is a step diagram of the network security threat analysis data transmission method based on artificial intelligence of the present application. DETAILED DESCRIPTION

[0058] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0059] Please refer to Figure 1 The present application provides a technical solution: a network security threat analysis data transmission system based on artificial intelligence, comprising a double-layer isolation module, a security analysis module, a program injection module, a protection memory module and a cluster sharing module.

[0060] The double-layer isolation module is used to set up a virtual machine simulating the operation of a host through a lightweight container in the host address, and to embed a supervision program Hook in system calls and network I / O interfaces in the virtual machine. During data transmission, the host and the virtual machine asynchronously transmit the same data at fixed intervals, and the performance of the host is protected by using a non-blocking queue. The data stream transmitted asynchronously is compared by using a hash tree, and the data segment with differences is located and identified.

[0061] The double-layer isolation module comprises a virtual machine unit and an asynchronous transmission unit.

[0062] The virtual machine unit is used to establish a virtual machine running at low cost outside the host by using lightweight virtualization technology based on KVM or Docker.

[0063] The asynchronous transmission unit is used to perform differential data transmission between the host and the virtual machine at fixed time intervals, and to perform consistency verification by using hash or digital signature.

[0064] The security analysis module is used to detect the CPU instruction set, memory page signature and system call sequence of the virtual machine, analyze the timing behavior anomaly by using an LSTM neural network, generate metadata describing the threat type when there is an abnormal or unidentifiable operation result, input the virtual machine parameters into a threat analysis model, determine the data segment of the abnormal data source, and generate a destructive instruction for the data segment at the corresponding position of the host data pool.

[0065] The security analysis module comprises a threat model unit and a program destruction unit.

[0066] The threat model unit is used to predefine threat types, and the threat types include buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering.

[0067] The program destruction unit is used to generate deterministic destruction instructions for the threat data segment, including NOP filling, pointer hijacking and packet discarding.

[0068] The program injection module is used to inject the destruction program into the offset address corresponding to the virtual machine data pool through the host hot patch mechanism, trigger the execution flow termination or rollback of the virtual machine, analyze the behavior log in the data transmission process, divide the interface group through the DBSCAN algorithm, cluster the network interfaces of data access, set different levels of threat conditions and wake-up keys inside the clustered interfaces, and start the injection program to destroy the data threatened when the data transmission process meets the threat condition.

[0069] The program injection module includes a log supervision unit, an interface clustering unit and a key wake-up unit.

[0070] The log supervision unit is used to inject a supervision program, collect access logs of data segments in network interfaces, including access frequency, protocol type, packet size and source IP features.

[0071] The interface clustering unit is used to cluster the interfaces using DBSCAN or K-means, and divide the risk interface group.

[0072] The key wake-up unit is used to generate a session key based on a PUF function, and the execution authority is decrypted by the supervision program when the threat condition is met.

[0073] The protection memory module is used to compare historical attack data through SimHash or cosine similarity, and solidify high-frequency attack patterns to the FPGA or eBPF program of the host, record the control flow graph of data access during data transmission, compare the historical attack path with the current behavior using the SimHash algorithm, and when the consistency rate is higher than the threshold, locate the injection point in the data process through binary search and taint tracking algorithm, and complete the supervision program injection process quickly.

[0074] The protection memory module includes a self-similarity analysis unit and a memory program unit.

[0075] The self-similarity analysis unit is used to match data behavior with known attack features or historical abnormal access, and output the consistency rate of comparison.

[0076] The memory program unit is used to generate a memory program according to the injection point control flow graph, and the memory program is stored in the host using Rootkit hiding technology.

[0077] The cluster sharing module is used to establish an ADC performance evaluation model for the hosts in the service cluster, evaluate the operation reliability, security and data transmission performance, stratify the hosts, make the security performance of all hosts in the upper layer higher than that of the hosts in the lower layer, the total data transmission speed higher than the data access speed of the hosts in the lower layer, and the probability of completing the task of the service cluster higher than a threshold, and perform data transmission and share the memory program according to the level.

[0078] The cluster sharing module comprises an performance evaluation unit, a service stratification unit and a memory sharing unit.

[0079] The performance evaluation unit is used to quantitatively evaluate the operation reliability, security and data transmission performance of the hosts by using a sliding window mechanism.

[0080] The service stratification unit is used to stratify the hosts in the service cluster, form a data transmission chain, and inject a supervision program in the chain.

[0081] The memory sharing unit is used to share the memory program in the servers of the same level, balance the security and service reliability.

[0082] As shown in Figure 2 The network security threat analysis data transmission method based on artificial intelligence comprises the following steps:

[0083] Step S1. A virtual machine simulating the operation of the host is set in the host address, a supervision program is embedded in the system call and network I / O interface in the virtual machine, and during the data transmission process, the host and the virtual machine asynchronously transmit the same data at a fixed interval and perform consistency check.

[0084] Step S1 comprises:

[0085] Step S11. A virtual machine with low overhead is established outside the host by using a lightweight virtualization technology based on KVM or Docker, a supervision program Hook is embedded in the system call and network I / O interface in the virtual machine, and the data flow in and out is monitored in real time;

[0086] Step S12. Fixed-time interval differential data transmission is adopted between the host and the virtual machine, so that the host data processing lags behind the virtual machine, a non-blocking queue is used to protect the host performance, the asynchronous transmission data flow is compared through a hash tree, consistency check is performed, the data segment with difference is located and identified, and a data synchronization program is executed.

[0087] Step S2. The running parameters of the virtual machine are detected, the time sequence behavior anomaly is analyzed, the abnormal or unidentifiable running result in the virtual machine is input into a threat analysis model, the abnormal data source is determined, a supervision program for the data segment is injected at the corresponding position of the host data pool, and the supervision program contains destructive instructions.

[0088] Step S2 includes:

[0089] Step S21. Detect the CPU instruction set, memory page signature and system call sequence of the virtual machine, analyze the timing behavior anomaly using the LSTM neural network, predefine the threat type, which includes: buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering;

[0090] Step S22. Real-time calculation of system call entropy value in sliding window, for data segment with entropy value change rate higher than threshold, read the system call log, memory access mode and process behavior tree of the virtual machine system during data segment execution, unpack the key API call parameters and abnormal instruction set from the call data through the supervisor hook, fit the attack sample through supervised learning, and build a threat analysis model;

[0091] Step S23. When there is an abnormal or unidentifiable running result, input the abnormal data segment into the threat analysis model to generate metadata describing the threat type, inject a supervisor program at the abnormal data segment location of the host data pool, and generate deterministic destruction instructions in the supervisor program according to the threat type, the destruction instructions include: NOP padding, pointer hijacking and packet dropping.

[0092] Step S3. The supervisor program collects access logs of the data segment in the network interface, clusters the network interfaces accessed by the data, sets different levels of threat conditions and wake-up keys according to the clustering results on each interface, and destroys the execution of the data segment when the threat conditions are met;

[0093] Step S3 includes:

[0094] Step S31. Collect access logs of abnormal data segments in network interfaces, including access frequency, protocol type, packet size, source IP features, use DBSCAN or K-means algorithm to divide interface groups, and cluster network interfaces accessed by data according to access frequency of interfaces to determine interface protection level;

[0095] Step S32. Set different levels of threat conditions and keys inside each protection level interface, the threat conditions include: threat features meet preset parameters, access frequency is abnormal, protocol is violated and geography is abnormal, generate session keys based on PUF function when data transmission process meets threat conditions, and execute destruction instructions by supervisor program when threat conditions are met. The destruction instructions include: NOP padding, pointer hijacking and packet dropping.

[0096] Step S4. Compare historical attack data, and solidify high-frequency attack patterns into FPGA or eBPF programs of the host to obtain a memory program, and quickly locate the injection point of the supervisor program in the data stream when the data stream matches the memory program.

[0097] Step S4 comprises:

[0098] Step S41. Match the data behavior with known attack features or historical abnormal access by comparing historical attack data through SimHash or cosine similarity, output the matching consistency rate, and solidify the attack mode with a consistency rate higher than the threshold to the FPGA or eBPF program of the host, generate a memory program, and store the memory program in the host using Rootkit hiding technology;

[0099] Step S42. During data transmission, the memory program records the control flow graph of data access, compares the historical attack path with the current behavior using the SimHash algorithm, and when the consistency rate is higher than the threshold, locates the injection point in the data process through binary search and taint tracking algorithm, and quickly completes the supervision program injection process.

[0100] Step S5. Evaluate the running reliability, security and data transmission efficiency of each host in the service cluster, and divide the hosts into layers according to the evaluation results to form a data transmission chain between layers, and share the memory program among servers in the same layer.

[0101] Step S5 comprises:

[0102] Step S51. Establish an ADC performance evaluation model for the hosts in the service cluster, evaluate the running reliability, security and data transmission efficiency, and divide the hosts into layers so that the security performance of all hosts in the upper layer is higher than that of the hosts in the lower layer, the total data transmission speed is higher than the data access speed of the hosts in the lower layer, and the probability of completing the task of the service cluster is higher than the threshold;

[0103] Step S52. Form a data transmission chain between hosts at different levels, disperse virtual machines in the chain to establish overhead and supervision program injection process, and share the memory program among server hosts in the same level.

[0104] Embodiment: When the virtual machine processes data, it is determined that there is an abnormal data segment at the (2001, 1072) field, and the supervision program is injected at the corresponding position of the host. After clustering, it is determined that the data segment access interface 2001 and 8001, the interface 2001 stores the underlying text data, and the interface 8001 stores the key execution data. The threat condition is set as: the single packet entropy value of interface 2001 data segment > 7.5 and the same fingerprint request > 10 times / sec, and the interface 8001 detects ROP instruction fragments or memory segment hash mutations. When the threat condition is met, execute the destruction program to avoid data threats.

[0105] It is to be noted that, in the present text, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0106] Finally, it should be noted that the above-mentioned only constitutes the preferred embodiments of the present application and is not intended to limit the present application. Although the present application has been described in detail with reference to the foregoing embodiments, it will be apparent to those skilled in the art that modifications, equivalent replacements, improvements and the like of the technical solutions described in the foregoing embodiments can still be made. Any modifications, equivalent replacements, improvements and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for network security threat analysis data transmission based on artificial intelligence, characterized in that, The method comprises the following steps: Step S1. Setting up a virtual machine running in the host address, embedding a monitoring program in the system call and network I / O interface in the virtual machine, and transmitting the same data asynchronously at fixed intervals between the host and the virtual machine during data transmission, and performing consistency check; Step S2. Detecting the running parameters of the virtual machine, analyzing the timing behavior anomaly, inputting the abnormal or unrecognizable running results in the virtual machine into a threat analysis model, determining the source of abnormal data, and injecting a monitoring program for the data segment at the corresponding position of the host data pool, the monitoring program containing destructive instructions; Step S3. The monitoring program collects access logs of the data segment in the network interface, clusters the network interfaces of data access, sets different levels of threat conditions and wake-up keys according to the clustering results in each interface, and destroys the execution of the data segment when the threat conditions are met; Step S4. Comparing historical attack data, solidifying high-frequency attack patterns into the FPGA or eBPF program of the host to obtain a memory program, and quickly locating the injection point of the monitoring program in the data stream when the data stream matches the memory program; Step S5. Evaluating the running reliability, security and data transmission efficiency of each host in the service cluster, layering the hosts according to the evaluation results to form a data transmission chain between layers, and sharing the memory program among servers at the same level. 2.The artificial intelligence-based network security threat analysis data transmission method of claim 1, wherein: Step S1 comprises: Step S11. Using lightweight virtualization technology based on KVM or Docker to establish a low-overhead running virtual machine outside the host, embedding a monitoring program Hook in the system call and network I / O interface in the virtual machine, and monitoring the data flow in real time; Step S12. Using fixed time interval differential data transmission between the host and the virtual machine to make the host data processing lag behind the virtual machine, using a non-blocking queue to protect the host performance, comparing the asynchronous transmission data stream through a hash tree, performing consistency check, locating and identifying the data segment with differences, and executing a data synchronization program. 3.The artificial intelligence-based network security threat analysis data transmission method of claim 2, wherein: Step S2 comprises: Step S21. Detecting the CPU instruction set, memory page signature and system call sequence of the virtual machine, analyzing the timing behavior anomaly using an LSTM neural network, and predefining threat types, including buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering; Step S22. Real-time calculation of system call entropy in the sliding window, reading the system call log, memory access mode and process behavior tree of the virtual machine system during data segment execution for data segments with entropy value change rate higher than the threshold, unpacking key API call parameters and abnormal instruction set from the call data through the monitoring program hook, fitting attack samples through supervised learning, and building a threat analysis model; Step S23. When there is abnormal or unrecognizable running result, inputting the abnormal data segment into the threat analysis model to generate metadata describing the threat type, injecting a monitoring program at the abnormal data segment position of the host data pool, and generating deterministic destructive instructions in the monitoring program according to the threat type, the destructive instructions including NOP padding, pointer hijacking and data packet dropping.

4. The artificial intelligence-based network security threat analysis data transmission method of claim 3, characterized in that: Step S3 comprises: Step S31. Collect the access log of the abnormal data segment in the network interface, including access frequency, protocol type, packet size, source IP feature, divide the interface group using DBSCAN or K-means algorithm, cluster the data access network interface according to the access frequency of the interface to determine the interface protection level; Step S32. Set different levels of threat conditions and keys in the interface of each protection level, the threat conditions include: threat features meet the preset parameters, access frequency is abnormal, protocol is violated and geography is abnormal, when the data transmission process meets the threat condition, generate a session key based on the PUF function, when the threat condition is met, the supervisory program is decrypted to execute the authority of the destruction instruction, and the connection is blocked and the data is destroyed from the inside of the data segment.

5. The artificial intelligence-based network security threat analysis data transmission method of claim 4, wherein: Step S4 includes: Step S41. Match the data behavior with known attack features or historical abnormal access by comparing historical attack data through SimHash or cosine similarity, output the consistency rate, and solidify the attack mode with a consistency rate higher than the threshold to the FPGA or eBPF program of the host to generate a memory program, which is stored in the host using Rootkit hiding technology; Step S42. During data transmission, the memory program records the control flow graph of data access, compares the historical attack path with the current behavior using the SimHash algorithm, and when the consistency rate is higher than the threshold, locates the injection point in the data process through binary search and taint tracking algorithm to quickly complete the supervisory program injection process; Step S5 includes: Step S51. Establish an ADC performance evaluation model for the hosts in the service cluster to evaluate the running reliability, security and data transmission performance, divide the hosts into layers, make the security performance of all hosts in the upper layer higher than that of the lower layer hosts, the total data transmission speed higher than the data access speed of the lower layer hosts, and the probability of completing the task of the service cluster higher than the threshold; Step S52. Form a data transmission chain between hosts at different levels, disperse virtual machines in the chain to establish the overhead and supervisory program injection process, and share the memory program in the same level of server host.

6. An artificial intelligence based cyber security threat analysis data transfer system characterized in that, The system includes the following modules: double-layer isolation module, security analysis module, program injection module, protection memory module and cluster sharing module; The double-layer isolation module is used to set up a virtual machine simulating the operation of the host in the host address through a lightweight container, embed a supervisory program Hook in the system call and network I / O interface in the virtual machine, during data transmission, the host and the virtual machine asynchronously transmit the same data at fixed intervals, and use a non-blocking queue to protect the performance of the host, compare the data stream of asynchronous transmission through a hash tree, and locate and identify the data segment with differences; The security analysis module is used to detect the CPU instruction set, memory page signature and system call sequence of the virtual machine, analyze the time sequence behavior anomaly using an LSTM neural network, generate metadata describing the threat type when there is an abnormal or unidentifiable running result, input the virtual machine parameters into the threat analysis model to determine the data segment of the abnormal data source, and generate a destructive instruction for the data segment at the corresponding position of the host data pool. The program injection module is used for injecting a breaking program into an offset address corresponding to a virtual machine data pool through a host hot patch mechanism, triggering a virtual machine execution flow termination or rollback, analyzing a behavior log in a data transmission process, dividing an interface group through a DBSCAN algorithm, clustering network interfaces of data access, setting different levels of threat conditions and wake-up keys inside the clustered interfaces, and starting the injection program to break the threatened data when the data transmission process meets the threat conditions; The protection memory module is used for fixing a high-frequency attack mode to an FPGA or eBPF program of the host through SimHash or cosine similarity comparison of historical attack data, recording a control flow graph of data access during data transmission, comparing a historical attack path with a current behavior through a SimHash algorithm, locating an injection point in a data process through a binary search and a taint tracking algorithm when a consistency rate is higher than a threshold, and quickly completing a supervision program injection process; The cluster sharing module is used for establishing an ADC performance evaluation model for the hosts in a service cluster, evaluating running reliability, security and data transmission performance, layering the hosts, making the security performance of all the hosts in an upper layer higher than that of a lower layer host, the total data transmission speed higher than a data access speed of the lower layer host, and a task completion probability of the service cluster higher than a threshold, and performing data transmission and sharing memory programs according to the layers.

7. The artificial intelligence-based cyber security threat analysis data transmission system of claim 6, wherein: The double-layer isolation module comprises a virtual machine unit and an asynchronous transmission unit. The virtual machine unit is used for establishing a low-overhead running virtual machine outside the host by using a lightweight virtualization technology based on KVM or Docker; The asynchronous transmission unit is used for adopting fixed-time-interval differential data transmission between the host and the virtual machine, and performing consistency checking by using a hash or a digital signature; The security analysis module comprises a threat model unit and a program breaking unit. The threat model unit is used for predefining threat types, and the threat types comprise buffer overflow, abnormal port access, high-frequency short connection request and memory segment permission tampering. The program breaking unit is used for generating deterministic breaking instructions for threat data segments, including NOP padding, pointer hijacking and data packet discarding.

8. The artificial intelligence-based cyber security threat analysis data transmission system of claim 7, wherein: The program injection module comprises a log supervision unit, an interface clustering unit and a key wake-up unit. The log supervision unit is used for injecting a supervision program, collecting access logs of data segments in network interfaces, including access frequency, protocol type, data packet size and source IP features; The interface clustering unit is used for clustering interfaces by using DBSCAN or K-means, and dividing risk interface groups; The key wake-up unit is used for generating a session key based on a PUF function, and the supervision program decrypts an execution permission when a threat condition is met.

9. The artificial intelligence-based cyber security threat analysis data transmission system of claim 8, wherein: The protection memory module comprises a self-similarity analysis unit and a memory program unit. The self-similarity analysis unit is used for matching data behaviors with known attack features or historical abnormal access, and outputting a comparison consistency rate; The memory program unit is used for generating a memory program according to an injection point control flow graph, and the memory program is stored in the host by using a Rootkit hiding technology.

10. The artificial intelligence-based network security threat analysis data transmission system according to claim 9, characterized in that: The cluster sharing module comprises an efficiency evaluation unit, a service layering unit and a memory sharing unit; The efficiency evaluation unit is configured to quantitatively evaluate the operation reliability, safety and data transmission efficiency of the host by using a sliding window mechanism; The service layering unit is configured to layer the hosts in the service cluster to form a data transmission chain, and inject a supervision program in the chain; The memory sharing unit is configured to share memory programs among servers in the same layer to balance safety and service reliability.

Images