A network data security protection system based on artificial intelligence and big data

Abstract

The application relates to the technical field of network data security, and discloses a network data security protection system based on artificial intelligence and big data. The system comprises a security hub engine which receives real-time traffic mirroring and asset state snapshots of a data collection probe, wherein the real-time traffic mirroring comprises application layer protocol metadata and original load byte streams, and the asset state snapshots comprise host process trees and configuration compliance indicators; meanwhile, current entries of an active index library of a threat intelligence platform and a vulnerability database are synchronously accessed. The security hub engine extracts behavior characteristics from the real-time traffic mirroring to generate a network session behavior vector sequence, quantifies asset criticality of the asset state snapshots to generate an asset importance score matrix, and fuses the two to generate a joint protection feature tensor; based on the tensor, a multi-modal anomaly detection is performed to output a suspicious operation event identifier, and according to the identifier, terminal isolation instructions or traffic cleaning rules are selected from an adaptive response strategy library and distributed to a strategy executor.

Description

Technical Field

[0001] This invention relates to the field of network data security technology, specifically a network data security protection system based on artificial intelligence and big data. Background Technology

[0002] With the widespread adoption of digital technologies, various enterprises, institutions, and individuals are increasingly reliant on the network environment, and the scale of network data is growing exponentially. At the same time, the complexity and diversity of network security threats are also intensifying, and traditional network data security protection methods are gradually becoming inadequate to cope with the current complex security situation.

[0003] In the current network environment, traditional protection systems mostly employ signature-based detection methods. These methods rely on signature databases of known threats and lack the ability to effectively identify unknown new attack methods. Once malicious code or attack patterns not included in the signature database appear, the protection system easily becomes passive, unable to detect potential security risks in a timely manner, resulting in a significant lag in security protection. For example, some attackers bypass signature-based detection mechanisms by constantly changing the structure and characteristics of malicious code, launching attacks on assets such as hosts and servers in the network, causing serious consequences such as data breaches and system paralysis.

[0004] Traditional security systems often separate network traffic monitoring from asset status management. In actual network operation, abnormal changes in network traffic and instability in asset status are often correlated. Monitoring only one aspect makes it difficult to comprehensively grasp the network security situation. Some security systems only focus on abnormal data packets in network traffic, ignoring abnormal changes in host process trees, unauthorized additions or removals of open ports, and other asset status information, making it impossible to accurately determine the source and scope of security threats. Furthermore, the response strategies of traditional security systems are relatively fixed, lacking flexibility and adaptability. When suspicious events are detected, they often can only execute a preset single response action, such as simply blocking traffic, without dynamically adjusting the response strategy based on factors such as the importance of the asset and the severity of the threat. This may result in important assets not receiving priority protection, or over-protection affecting normal business operations.

[0005] Traditional security systems do not make full use of threat intelligence. Currently, there are numerous threat intelligence platforms and vulnerability databases in the network, constantly updating various active threat indicators and the latest vulnerability information. However, many security systems fail to synchronize this information in a timely manner and integrate it into their detection and protection processes. This results in a lack of effective early warning and interception capabilities against new threats and exploitation of known vulnerabilities, further reducing the overall effectiveness of network data security protection. Summary of the Invention

[0006] The purpose of this invention is to provide a network data security protection system based on artificial intelligence and big data to solve the problems mentioned in the background art.

[0007] To achieve the above objectives, the present invention provides a network data security protection system based on artificial intelligence and big data, the system comprising:

[0008] The security central engine receives real-time traffic images and asset status snapshots from data acquisition probes. The real-time traffic images include application layer protocol metadata and raw payload byte streams, while the asset status snapshots include host process trees, open port lists, and configuration compliance indicators. The security central engine also synchronously accesses the current entries in the threat intelligence platform's active indicator library and vulnerability database.

[0009] The security central engine extracts behavioral features from the real-time traffic mirror to generate a network session behavior vector sequence, and quantifies the asset criticality of the asset status snapshot to generate an asset importance scoring matrix; the security central engine merges the network session behavior vector sequence and the asset importance scoring matrix to generate a joint protection feature tensor.

[0010] The security central engine performs multimodal anomaly detection based on the joint protection feature tensor to output suspicious operation event identifiers; the security central engine selects terminal isolation instructions or traffic scrubbing rules from the adaptive response policy library according to the suspicious operation event identifiers, and distributes the terminal isolation instructions or traffic scrubbing rules to the policy executor.

[0011] Preferably, the real-time traffic mirroring includes transport layer connection duration, application layer transaction throughput, encrypted channel handshake parameters, and a payload byte distribution histogram, and the asset status snapshot includes software version hash value, permission configuration snapshot, and historical patch application records.

[0012] Preferably, the security central engine extracts behavioral features from the real-time traffic mirror to generate a network session behavior vector sequence, including: normalizing and scaling the transport layer connection duration and application layer transaction throughput of each network session to obtain time-dimensional normalized features; encoding the cryptographic suite strength of the encrypted channel handshake parameters to obtain a security negotiation feature vector; calculating statistical moments from the payload byte distribution histogram to obtain a payload distribution feature vector; and orthogonally concatenating the time-dimensional normalized features, the security negotiation feature vector, and the payload distribution feature vector to generate the network session behavior vector sequence.

[0013] Preferably, the security central engine performs asset criticality quantification on the asset status snapshot to generate an asset importance scoring matrix, including: matching the software version hash value with the current entry in the vulnerability database to generate a known vulnerability exposure score; measuring the deviation between the permission configuration snapshot and the configuration compliance index to generate a configuration risk coefficient; extracting patch application latency and critical patch coverage from historical patch application records to generate a maintenance health index; and inputting the known vulnerability exposure score, configuration risk coefficient, and maintenance health index into a multilayer perceptron network to calculate the asset importance scoring matrix.

[0014] Preferably, the security central engine fuses the network session behavior vector sequence with the asset importance score matrix to generate a joint protection feature tensor, including: performing temporal feature enhancement on the network session behavior vector sequence through a temporal convolutional network to obtain an enhanced behavior feature sequence; broadcasting and aligning the asset importance score matrix along the feature dimension to match the dimension of the enhanced behavior feature sequence; and performing feature weighted fusion of the enhanced behavior feature sequence and the broadcast asset importance score matrix through an attention mechanism to generate the joint protection feature tensor.

[0015] Preferably, the security central engine performs multimodal anomaly detection based on the joint protection feature tensor to output a suspicious operation event identifier, including: inputting the joint protection feature tensor into a deep anomaly detection model, the deep anomaly detection model including a graph neural network branch and a temporal autoencoder branch; extracting inter-asset relationship features through the graph neural network branch and extracting behavioral temporal features through the temporal autoencoder branch; fusing the inter-asset relationship features and behavioral temporal features to calculate an anomaly confidence score; and generating the suspicious operation event identifier when the anomaly confidence score exceeds a dynamic threshold.

[0016] Preferably, the security central engine selects an endpoint isolation command or traffic scrubbing rule from the adaptive response policy library based on the suspicious operation event identifier, including: querying the active indicator library of the threat intelligence platform to obtain the associated threat behavior pattern based on the suspicious operation event identifier; matching the threat behavior pattern with the response action index in the adaptive response policy library to determine the response action type; generating an endpoint isolation command when the response action type is host-level protection, and generating a traffic scrubbing rule when the response action type is network-level protection.

[0017] Preferably, the security central engine distributes the terminal isolation command or traffic scrubbing rule to the policy executor, including: digitally signing and timestamping the terminal isolation command to generate a security command message; performing rule syntax verification and conflict detection on the traffic scrubbing rule to generate a valid rule set; and distributing the security command message or valid rule set to the policy executor through a secure channel.

[0018] Preferably, when the policy executor executes the terminal isolation instruction, it includes: parsing the target host identifier and isolation level parameters in the security instruction message; calling the host proxy interface to suspend the target process and disable the network interface; generating an isolation event log and sending it back to the security central engine.

[0019] Preferably, when the policy executor executes the traffic scrubbing rules, it includes: loading a valid rule set into the rule engine of the traffic scrubbing device; dynamically adjusting the detection mode of the traffic scrubbing device to the deep packet inspection state; and sampling the scrubbing traffic in real time and calculating the malicious traffic drop rate to feed back to the security central engine.

[0020] Compared with the prior art, the beneficial effects of the present invention are:

[0021] This network data security protection system, through the establishment of a security central engine, achieves comprehensive integration and in-depth analysis of network traffic and asset status information, effectively improving the comprehensiveness and accuracy of network security protection. The security central engine can receive real-time traffic images and asset status snapshots from data acquisition probes. The real-time traffic images cover application layer protocol metadata and raw payload byte streams, while the asset status snapshots include host process trees, open port lists, and configuration compliance indicators. This comprehensive data acquisition method breaks down the separation between traffic monitoring and asset management in traditional protection systems, enabling the system to simultaneously grasp the dynamics of network data transmission and the operational status of assets. This provides a rich and complete data foundation for subsequent security analysis, avoiding misjudgments or omissions of security threats due to incomplete information.

[0022] In the data processing stage, the security central engine extracts behavioral features from real-time traffic mirrors to generate network session behavior vector sequences, quantifies asset criticality from asset state snapshots to generate an asset importance scoring matrix, and further integrates the two to generate a joint protection feature tensor. This multi-dimensional data fusion and feature extraction approach closely links the behavioral characteristics of network traffic with the importance of assets. When analyzing the security posture, the system not only focuses on the anomalies of the traffic itself but also combines the importance of assets to more accurately identify operational behaviors that pose a real threat to network security. Compared to traditional protection systems that rely on only a single data dimension for detection, this system can more deeply uncover potential security risks in the network, especially those subtle anomalies hidden within normal traffic targeting important assets, significantly improving the accuracy of anomaly detection.

[0023] The security central engine performs multimodal anomaly detection based on the joint protection feature tensor to output suspicious operation event identifiers. This multimodal anomaly detection method fully integrates information from various aspects of network session behavior and asset importance, enabling it to adapt to the detection needs of different types and complexities of cybersecurity threats. Whether it's a variant of a known threat or a new, unknown attack method, the system can promptly detect and mark suspicious operation events through comprehensive analysis of multi-dimensional features. This changes the traditional protection system's reliance on signature codes and insufficient ability to detect unknown threats, significantly enhancing the system's identification range and response speed for various security threats.

[0024] The security central engine synchronously accesses the current entries in the threat intelligence platform's active indicator database and vulnerability database, enabling the system to acquire the latest threat intelligence and vulnerability information in real time and integrate this information into the detection and protection process. When analyzing network session behavior vector sequences, asset importance scoring matrices, and joint protection feature tensors, the system can combine the latest threat indicators and vulnerability data to more accurately determine whether suspicious operation events are related to currently active threats or known vulnerabilities, provide early warnings of potential security risks, effectively intercept exploitation of known vulnerabilities, and further enhance the system's early warning and defense capabilities against emerging threats.

[0025] Regarding response strategy execution, the security central engine selects endpoint isolation commands or traffic scrubbing rules from the adaptive response strategy library based on the suspicious operation event identifier and distributes them to the policy executor for execution. This adaptive response method can flexibly select appropriate response strategies based on different suspicious operation event types, threat severity, and the importance of the assets involved. When a suspicious operation event involves important assets and has a high threat level, the system can promptly issue endpoint isolation commands to prevent the threat from spreading; when a suspicious operation event only manifests as partial traffic anomalies and has a low threat level, the system can execute traffic scrubbing rules to filter abnormal traffic and ensure that normal business operations are not affected. This dynamically adjusted response mechanism avoids the drawbacks of traditional protection systems' fixed and inflexible response strategies. While effectively responding to security threats, it minimizes interference with normal network operation and business operations, achieving an effective balance between security protection and business continuity. Attached Figure Description

[0026] Figure 1 This is a timing diagram of the network data security protection system based on artificial intelligence and big data described in this invention;

[0027] Figure 2 A schematic diagram illustrating the working principle of generating network session behavior vector sequences for the security central engine;

[0028] Figure 3 A schematic diagram illustrating the working principle of generating joint protection feature tensors for the security central engine. Detailed Implementation

[0029] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0030] Please see Figure 1 This invention provides a network data security protection system based on artificial intelligence and big data. The system includes a module integrating multi-source data input and intelligent analysis to achieve proactive security protection. The core component of the system is a security central engine, which is responsible for coordinating the entire process of data acquisition, feature processing, anomaly detection, and response strategy execution. The security central engine receives real-time traffic images and asset status snapshots from data acquisition probes deployed at key network nodes. The real-time traffic image captures application layer protocol metadata and raw payload byte streams, while the asset status snapshot records host process trees, open port lists, and configuration compliance indicators. Simultaneously, the security central engine establishes real-time connections with external threat intelligence platforms and vulnerability databases, synchronizing the active indicator library with current vulnerability entries to enhance context awareness. The security central engine performs behavioral feature extraction operations on the real-time traffic image to generate a network session behavior vector sequence, which represents the temporal and statistical characteristics of network traffic; it performs asset criticality quantification operations on the asset status snapshot to generate an asset importance scoring matrix, which reflects the security status and business value of the assets. Subsequently, the security central engine performs feature-level fusion of the network session behavior vector sequence and the asset importance scoring matrix to generate a joint protection feature tensor, which serves as the input for multimodal anomaly detection. Based on the joint protection feature tensor, the security central engine employs a deep learning model for anomaly detection, outputting suspicious operation event identifiers to identify potential threats. Finally, the security central engine queries the adaptive response policy library based on the suspicious operation event identifiers, selects endpoint isolation instructions or traffic scrubbing rules as response actions, and distributes the instructions or rules to the policy executor through a secure channel. The policy executor then implements isolation or scrubbing operations at the endpoint or network layer to contain security events.

[0031] Example 1: See Figure 2Real-time traffic mirroring captures traffic through data acquisition probes deployed at key network nodes. These probes are configured to mirror bidirectional traffic at the network link layer, ensuring a complete record of the data transmission process. The mirrored data includes core fields such as transport layer connection duration, application layer transaction throughput, encrypted channel handshake parameters, and a payload byte distribution histogram. The transport layer connection duration field quantifies the time interval from the establishment to the termination of a TCP or UDP session, reflecting session persistence and potential anomalies. The application layer transaction throughput field measures the amount of data exchanged per unit time for a specific application protocol, used to identify traffic bursts or bottlenecks. The encrypted channel handshake parameter field extracts the cipher suite list, key exchange algorithm, and certificate information from the security protocol negotiation process. The payload byte distribution histogram field generates a distribution chart by statistically analyzing the frequency of payload byte values, characterizing the statistical characteristics of the traffic load. Asset status snapshots are collected and uploaded periodically by the system agent. Their data structure includes software version hash values, permission configuration snapshots, and historical patch application records. The software version hash value is calculated using a hash function to obtain a digital fingerprint of the executable file or library file, thus achieving a unique version identifier. The permission configuration snapshot records the current system's user permission settings, file access control lists, and service configuration status. The historical patch application records store the time-series data of patch installations, including patch identifiers and application timestamps.

[0032] The security central engine employs a multi-stage feature engineering pipeline to extract behavioral features from real-time traffic mirroring to generate network session behavior vector sequences. Each stage processes a specific type of raw data. The first stage processes transport layer connection duration and application layer transaction throughput. It converts the raw values ​​into dimensionless features through normalization scaling and uses a min-max normalization method to linearly map the input values ​​to the zero-to-one interval, eliminating biases caused by different dimensions while preserving the relative order of values, generating time-dimensional normalized features. The second stage processes encrypted channel handshake parameters, performing cipher suite strength encoding. This operation maps cipher suite identifiers to discrete strength levels, such as weak, medium, or strong, based on a predefined strength classification standard. Then, it uses one-hot encoding to convert the levels into fixed-length binary vectors, generating a security negotiation feature vector that encodes channel security strength information.

[0033] The third stage processes the payload byte distribution histogram, performs statistical moment calculations to extract key characteristics of the distribution, calculates the first moment (mean) to describe the average level of byte values, the second moment (variance) to measure the dispersion of the distribution, and higher-order moments such as skewness and kurtosis to capture the shape characteristics of the distribution, generating a payload distribution feature vector. The final stage orthogonally concatenates the time-dimensional normalized features, security negotiation feature vector, and payload distribution feature vector. Orthogonal concatenation uses vector outer product operations to achieve interaction between different feature dimensions, producing a high-dimensional composite vector. These vectors are sorted by network session timestamps to form a network session behavior vector sequence, which is stored in a circular buffer to support streaming access. The behavior feature extraction module adopts a distributed pipeline architecture, allowing each submodule to process data streams in parallel to improve throughput. The normalization scaling module integrates a sliding window mechanism to dynamically adjust normalization parameters to adapt to temporal changes in network traffic, avoiding feature distortion caused by static parameters. The cipher suite strength encoding module uses international standards such as the NIST guidelines to define strength mapping relationships, ensuring consistency of encoding results. The statistical moment calculation module implements an incremental algorithm, supporting real-time streaming data processing without requiring a complete data cache.

[0034] The dimensions of the network session behavior vector sequence dynamically adapt to the number of network sessions. Each vector integrates multi-dimensional features of time, security, and load. The sequence length is controlled by a configurable time window to ensure the timeliness of feature extraction. The data acquisition probe implementation considers the diversity of network environments and supports multiple deployment modes such as bypass mirroring or port mirroring to ensure the integrity of traffic capture. The calculation of transport layer connection duration is based on the timestamp difference of session control messages. The measurement of application layer transaction throughput is associated with the application protocol parser to identify protocol-specific transaction boundaries. The parsing of encrypted channel handshake parameters involves deep packet inspection technology, decrypting handshake messages to extract security parameters. The generation of the payload byte distribution histogram uses a sliding window to count byte occurrence frequency, and the number of bins in the histogram is adjustable to balance accuracy and computational overhead. Asset status snapshots are collected through a lightweight agent that periodically scans the system status to generate snapshots. The calculation of software version hash values ​​uses encrypted hash functions such as SHA-256 to ensure the immutability of version identifiers. The comparison of permission configuration snapshots is based on the configuration baseline to detect changes deviating from compliance status. The maintenance of historical patch application records uses database storage and supports querying by time range. Orthogonal concatenation during feature extraction enhances feature interaction, and the feature vector generated by outer product operations contains combined information of the original features, improving the performance of subsequent models. The storage management of network session behavior vector sequences adopts a circular buffer structure, supporting cyclic overwriting of old data to maintain efficient memory usage; the buffer size is configurable to adapt to different network sizes, and intermediate results are output at each stage of the feature extraction pipeline for verification and debugging.

[0035] Example 2: See Figure 3The specific implementation path of asset criticality quantification and feature fusion involves the security central engine quantifying asset criticality from asset status snapshots to generate an asset importance scoring matrix. This process begins with the parsing and correlation analysis of various data in the asset status snapshots. The software version hash value field is matched with a continuously updated vulnerability database, which integrates data feeds from multiple official vulnerability sources. The matching algorithm uses an efficient hash index structure to quickly compare software fingerprints. When a known vulnerability is identified, the system extracts metadata such as the vulnerability's public vulnerability scoring system score, exploitability, and impact scope. This metadata, combined with the asset's location in the business topology, calculates a known vulnerability exposure score, reflecting the potential threat level faced by the asset due to the software vulnerability. Permission configuration snapshots are compared with predefined configuration compliance indicators, typically based on industry security baselines. The comparison process calculates the difference between actual configuration items and standard configuration items. The difference measurement may use a weighted bias algorithm, assigning a risk value to each configuration deviation, ultimately aggregating to generate a configuration risk coefficient. This coefficient quantifies the security risks introduced by improper configuration. The analysis of historical patch application records focuses on timeliness and completeness. The system calculates the time delay from the release of critical security patches to their application on the asset, and counts the proportion of critical patches that have been applied to all patches that should be applied. A maintenance health index is calculated through a weighted model that combines latency and coverage. This index represents the health status of the asset at the patch maintenance level.

[0036] The known vulnerability exposure score, configuration risk coefficient, and maintenance health index obtained from the above calculations are used as feature inputs to a multilayer perceptron network for fusion calculation. This network structure includes an input layer receiving three feature values, one or more hidden layers with nonlinear activation functions for feature transformation and abstraction, and an output layer that generates the final score. During the training phase, the network uses supervised learning with a large amount of historical data containing labeled asset risk levels, enabling it to learn the complex nonlinear relationship between different feature combinations and asset importance. The final output is an asset importance score matrix, which records the quantitative importance value of each monitored asset in a structured form. After generating the network session behavior vector sequence and the asset importance score matrix, the system performs a feature fusion step to create a joint protection feature tensor. The network session behavior vector sequence is first fed into a temporal convolutional network for processing. This network uses its causal convolutional structure to capture the dynamic patterns and long-term dependencies of traffic behavior in the temporal dimension. Through multilayer convolution and nonlinear activation function learning, it outputs an enhanced behavioral feature sequence that is temporally enhanced and contains richer contextual information. Since the dimensions of the asset importance scoring matrix are usually inconsistent with the augmented behavior feature sequence, the system adopts a feature dimension broadcast alignment operation to expand the values ​​of the scoring matrix along the time and asset dimensions, so that each time step and each asset entity has corresponding scoring information, thereby forming a broadcast asset importance scoring matrix that perfectly matches the dimensions of the augmented behavior feature sequence.

[0037] The final fusion step is accomplished through an attention mechanism. This mechanism first calculates the relevance weights between each feature element in the enhanced behavioral feature sequence and its corresponding element in the broadcast scoring matrix. These weights reflect the influence of asset importance information on behavioral features within a specific context. Then, these weights are used to perform a weighted summation of the features, adaptively fusing the asset's critical information into the network behavioral features. This generates a high-dimensional, multimodal joint protection feature tensor, which simultaneously encodes the dynamic behavioral patterns of network traffic and the static security status of assets, providing more comprehensive and discriminative input features for subsequent anomaly detection. The entire asset criticality quantification and feature fusion process is designed to be executed automatically and periodically, ensuring that the scoring matrix reflects the latest changes in asset status. The feature fusion module is implemented using an efficient tensor computation library to guarantee computational performance when processing large-scale network data. The calculation process of the attention weights is interpretable, providing security analysts with the possibility of understanding the model's decision-making basis. The vulnerability database and configuration compliance indicator library involved in the quantification process both support online update mechanisms to adapt to the ever-evolving threat environment and technical standards. The parameters of the multilayer perceptron network can be fine-tuned through incremental learning, thereby gradually improving the accuracy of asset importance assessment. The temporal convolutional network structure parameters and attention mechanism hyperparameters in the feature fusion stage have been carefully designed and optimized to balance the model's expressive power and computational complexity.

[0038] Example 3: The deep anomaly detection model serves as the core processing unit. The model employs a dual-branch architecture to handle spatial relationships and temporal series patterns respectively. The joint protection feature tensor is fed into both the graph neural network branch and the temporal autoencoder branch. The graph neural network branch focuses on extracting interaction features between assets. It abstracts assets in the network as graph nodes, with node features derived from static attributes encoded by the asset importance scoring matrix. Edge features are dynamically constructed based on historical session data, reflecting the communication strength and dependencies between assets. Through multi-layer graph convolution operations, neighbor node information is aggregated, outputting an asset relationship feature vector that captures abnormal association patterns within the asset group. The temporal autoencoder branch models the temporal characteristics of the behavior sequence. This branch consists of an encoder and a decoder. The encoder uses long short-term memory network layers to progressively compress the temporal dimension of the joint protection feature tensor, generating a low-dimensional temporal latent representation. The decoder attempts to reconstruct the original input sequence from the latent representation, quantifying the degree of anomaly by comparing the reconstructed sequence with the original sequence, and outputting a behavioral temporal feature vector. This vector contains information about the temporal deviation of traffic behavior from normal patterns.

[0039] After the feature outputs from the two branches, they enter the fusion stage. The asset relationship feature vector and the behavioral time series feature vector are concatenated into a composite feature vector. This composite vector is then subjected to a nonlinear transformation through a fully connected layer to calculate the anomaly confidence score. The anomaly confidence score is defined by the following mathematical formula:

[0040]

[0041] in: This represents the anomaly confidence score, with a value range of [0,1]. The higher the score, the greater the likelihood of an anomaly. This represents the Sigmoid activation function, used to map linear outputs to a probability space; It is a learnable weight vector responsible for adjusting the contribution of different feature dimensions; It is the feature vector of inter-asset relationships output by the branch of the graph neural network, with dimension . It encodes the topological relationship characteristics between assets; It is the behavioral temporal feature vector output by the branch of the temporal autoencoder, with dimension 1. This reflects the temporal dynamics of the behavioral sequence; This represents the vector concatenation operation, which... and Connect them into a length of ; This is the bias term, used to adjust the model's baseline output. This formula ensures a linear and non-linear combination of feature fusion, adapting to the learning of complex anomaly patterns.

[0042] The dynamic threshold calculation module automatically adjusts the threshold level based on the distribution of historical anomaly confidence scores. It uses a sliding window to calculate the percentile (e.g., 95th percentile) of the score sequence as the dynamic threshold, while real-time calculations... When a value exceeds the current dynamic threshold, the system generates a suspicious operation event identifier. The identifier uses a universally unique identifier format and includes a timestamp, source asset identifier, and anomaly type label for easy tracking and response. The entire detection process runs in a streaming manner, with model parameters updated periodically through an online learning mechanism to adapt to changes in the network environment. The specific implementation of the graph neural network branch involves a dynamic graph construction algorithm. This algorithm updates the edge weights between asset nodes in real time based on network session data, considering factors such as session frequency, data volume, and protocol type in weight calculation. The graph convolutional layer uses an attention mechanism to enhance feature extraction, allowing the model to focus on important neighbor nodes. The output vector dimension of the graph neural network branch is unified to a fixed size through a global average pooling layer to ensure compatibility with the temporal branch. The temporal autoencoder branch is trained unsupervised. The loss function combines reconstruction error and temporal smoothing constraints. The reconstruction error uses mean squared error to measure the difference between input and output. The temporal smoothing constraint reduces sequence fluctuations by adding a regularization term, improving the model's accuracy in modeling normal patterns. The number of LSTM layers in the encoder is configurable, and the number of hidden units is adaptively adjusted according to the input dimension. The decoder uses deconvolutional layers or LSTM layers for sequence reconstruction.

[0043] The fully connected layer in the feature fusion stage is designed with a multi-layer structure. The first layer maps the concatenated vector to the hidden space, the second layer outputs a scalar score, and the hidden layer uses the ReLU activation function to introduce non-linearity. The model training process uses historical normal data for pre-training, and then incorporates new data through incremental learning to prevent model drift. The dynamic threshold module employs robust statistical methods to avoid the influence of extreme values; the threshold update cycle is configurable and is typically synchronized with the data acquisition frequency. The generation logic for suspicious operation event identifiers includes a deduplication mechanism to prevent the same event from being triggered multiple times. Identifiers are stored in the event database and pushed to the response module for further processing. The deployment of the multimodal anomaly detection model considers computational efficiency. The graph neural network branch uses sampling techniques to process large-scale graph data, the temporal autoencoder branch uses segmented processing of long sequences, and the fusion operation uses GPU-accelerated matrix operations. The model inference results are output to the event management interface in real time, supporting manual review and automated response linkage. The entire implementation emphasizes end-to-end low-latency processing, ensuring that the entire process from feature input to identifier generation is completed within seconds, meeting the timeliness requirements of real-time security protection. The interpretability of the model is enhanced by visualizing attention weights, allowing security analysts to view the contribution of features and improve system transparency.

[0044] Example 4: Upon receiving a suspicious operation event identifier from the anomaly detection module, the security central engine immediately initiates a response policy selection procedure. This identifier is typically associated with the event time that triggered the anomaly, source target asset information, and a preliminary classification label. The engine first uses this metadata to initiate a query to the integrated threat intelligence platform. Consider a specific scenario: the anomaly detection module generates a suspicious event with the identifier "Alert-2024-Q3-88731," associated with the source IP address 192.168.12.45, the target asset ID "SVN-Prod-01," and the preliminary behavior label "abnormal high-frequency encrypted external connection." The security central engine uses this identifier and associated metadata as the query key to request the active indicator database of the threat intelligence platform. This indicator database may return multiple relevant records; for example, it may match an intelligence report about a known malicious C2 (command and control) server, describing its communication pattern as "establishing TLS connections with multiple internal servers within a short period and conducting small-scale data infiltration." The "malicious C2 communication" described in this intelligence constitutes the associated threat behavior pattern identified by the system. Next, the system needs to match this threat behavior pattern with the adaptive response policy library. The adaptive response policy library is essentially a structured rule mapping table that associates different types of threat patterns with preset response action types. See Table 1, which shows a simplified fragment of the policy library.

[0045] Table 1: Threat Behavior Patterns and Response Actions Mapping Table

[0046]

[0047] In this example, the system compares the matched "malicious C2 communication" pattern with the "threat behavior pattern classification" field in the table above. By calculating text feature similarity (such as an algorithm based on keyword co-occurrence), the system determines the most matching classification entry. The matching process finds that this pattern has the highest similarity to the "malicious C2 communication" category, and then retrieves the corresponding response action type, which is defined as "host-level protection / network-level protection," and associated with two specific response action index IDs: "RSP-HOST-ISO-03" and "RSP-NET-SCRUB-04." According to the design logic of the policy library, when the response action type is "host-level protection," the system generates an endpoint isolation command; when the type is "network-level protection," it generates traffic scrubbing rules.

[0048] In this case, because the matching result is of two types, the system may decide to first generate an "endpoint isolation command" to quickly isolate the suspected controlled source host (the machine with IP address 192.168.12.45) based on predefined priorities (such as prioritizing source containment) or asset criticality (such as the target server being a core asset). The process of generating the endpoint isolation command involves filling in specific parameters. The command content needs to explicitly specify the target host identifier (e.g., hostname "DESKTOP-AB123CD" or IP address "192.168.12.45"), isolation level parameters (e.g., "Complete Isolation: Disconnect all network connections and suspend non-core processes"), and the command's validity period (e.g., "Duration: 60 minutes"). To ensure the non-repudiation and integrity of the command during transmission and execution, the security central engine digitally signs and timestamps this structured command. The digital signature uses the engine's private key to sign the command content, while the timestamp encryption embeds an authoritative timestamp provided by a trusted time source, together generating a secure command message. The message is an encrypted and signed data packet containing plaintext instructions, a digital signature, a timestamp, and certificate information. Any tampering will cause the signature verification to fail.

[0049] If the scenario requires generating traffic scrubbing rules, the rule content will include matching conditions (e.g., a source IP of "192.168.12.45", a destination IP of "SVN-Prod-01", TCP protocol, and destination port 443) and scrubbing actions (e.g., "drop" or "reroute to the scrubbing center"). Before distribution, the system will perform strict syntax validation on the rules to ensure they conform to the syntax specifications supported by the traffic scrubbing equipment, and perform conflict detection to avoid contradictions between new and existing rules (e.g., both allowing and denying the same traffic). Both security command messages and valid rule sets are distributed to the corresponding policy executors through a pre-established secure channel. The secure channel typically uses the two-way authenticated TLS protocol to ensure the confidentiality of transmission and the authenticity of the channel endpoints. The distribution mechanism employs a publish-subscribe model. The security central engine acts as the publisher, distributing instructions or rules to different message topics (such as "host-isolation-commands" or "traffic-scrubbing-rules"). Policy executors deployed on target terminals or network devices act as subscribers, receiving and executing instructions from their subscribed topics. This mechanism ensures reliable delivery and targeted distribution of instructions. The entire process, from threat identification to instruction issuance, is completed within an automated framework, significantly reducing threat response time.

[0050] Example 5: The policy executor, acting as a proxy for the system on terminals or network devices, receives instructions that are securely encapsulated and verified before final execution. When the policy executor needs to execute a terminal isolation instruction, the process begins with parsing and verifying the secure instruction message. Assume a received instruction message points to a suspected compromised web server with the host identifier "WEB-SRV-08" and an isolation level of "LEVEL_3_COMPLETE". The executor first uses a pre-built security central engine public key certificate to verify the message's digital signature, confirming the authenticity and integrity of the instruction's source, and simultaneously checks the timestamp to ensure the instruction is not a replay attack. After successful verification, the parser extracts the target host identifier, confirming it as the local hostname "WEB-SRV-08", and then reads the isolation level parameter "LEVEL_3_COMPLOSE". This level, defined in the policy library, suspends all non-core user processes and disables all network interfaces except the management port.

[0051] After parsing, the executor calls the host agent interface deployed on the server to perform specific operations. The host agent interface implements management functions through system calls provided by the operating system. Suspending the target process involves obtaining a list of currently active processes, comparing it against a predefined whitelist of core processes (such as system core processes and security software processes), and sending suspension signals (e.g., SIGSTOP on Linux systems) to user-level processes not on the whitelist (such as abnormal web service child processes or unknown script interpreters). Disabling network interfaces is achieved by programmatically modifying the system's network configuration. For the "LEVEL_3_COMPLETE" level, the executor identifies all non-management network interfaces (such as eth0 and eth1) and calls commands (such as ifconfig eth0down) or uses firewall rules (such as iptables) to block all traffic to and from these interfaces, leaving only one designated management interface (such as eth2) for remote management. The entire execution process is atomic; it either succeeds completely or rolls back to a previous state upon failure, ensuring the system does not remain in an inconsistent intermediate state. After the operation is completed, the policy executor immediately generates a structured isolation event log. The log records the event ID (associated with the suspicious operation event identifier), the target host identifier, a detailed list of the executed isolation operations (e.g., "Process PID4415 (named 'suspicious_daemon') has been suspended," "Network interfaces eth0 and eth1 have been disabled"), the timestamp of the operation execution, and the final execution result status ("success" or "failure," with an error code such as "ERR_ACCESS_DENIED" recorded if it fails). This log is sent back to the event management database of the security central engine via a secure channel, providing audit clues for security analysts and data feedback for subsequent security posture assessments and model self-learning. When the policy executor needs to execute traffic scrubbing rules, the scenario typically involves network-level attack traffic, such as a distributed denial-of-service attack targeting an application service.

[0052] The executor first loads the received valid rule set into the rule engine of a dedicated traffic scrubbing device or a network device that supports scrubbing. Assume the rule set contains a rule requiring deep scrubbing of traffic destined for "10.0.1.100" using the TCP protocol. The loading process is not a simple append; the executor integrates and verifies the new rule with existing rule sets on the device to ensure it doesn't conflict with existing critical business protection rules. Then, the rule is distributed through the device's configuration management interface (such as CLI or NETCONF). After successful rule loading, the executor dynamically adjusts the traffic scrubbing device's detection mode, upgrading it from basic statistical detection to deep packet inspection. Deep packet inspection mode uses a more sophisticated analysis engine to perform in-depth checks on the traffic load matching the rule, including application layer protocol parsing, regular expression matching, and behavioral analysis, to more accurately identify malicious packets from massive attack traffic. For example, in a DDoS attack, deep packet inspection can distinguish between simple flooding traffic and more threatening application layer attack requests. To evaluate the cleaning effect and achieve closed-loop control, the strategy actuator samples the flow rate after the cleaning equipment has been processed in real time, with a sampling ratio of, for example, 1:1000, to reduce processing overhead.

[0053] Sampling data is used to calculate a key metric—the malicious traffic drop rate. This rate is estimated by comparing the total amount of traffic entering the scrubbing device with the amount of "clean" traffic ultimately forwarded to the target server. The calculated drop rate, sampling timestamps, and associated attack event IDs are encapsulated into feedback messages and periodically sent back to the security central engine. The security central engine uses this data to determine the effectiveness of the response strategy. If the drop rate remains persistently high, it may indicate a change in attack patterns or a need to adjust the scrubbing strategy, triggering the generation of new response instructions. The policy executor is designed with fault tolerance and status reporting mechanisms. Before executing isolation instructions, it checks the current load and connection status of the target host to avoid aggressive operations under high load that could cause system crashes. During scrubbing rule execution, it monitors the CPU and memory utilization of the traffic scrubbing device itself to prevent overload. Whether for isolation or scrubbing operations, the executor maintains a heartbeat mechanism, periodically reporting its own liveness and resource usage to the security central engine to ensure the visibility and controllability of the entire response chain. This sophisticated operational execution and feedback mechanism accurately translates high-level security strategies into effective, low-level control actions, forming the final link in the proactive defense closed loop.

[0054] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An artificial intelligence and big data based cyber security system, characterized in that, Comprise: A security hub engine receives real-time traffic mirroring and asset state snapshots from data collection probes, the real-time traffic mirroring containing application layer protocol metadata and raw payload byte streams, the asset state snapshots containing host process trees, open port lists, and configuration compliance indicators; the security hub engine synchronizes with a threat intelligence platform for active indicator feeds and a vulnerability database for current entries; The security hub engine extracts behavioral features from the real-time traffic mirroring to generate a sequence of network session behavior vectors, and quantifies asset criticality from the asset state snapshots to generate an asset importance score matrix; the security hub engine fuses the sequence of network session behavior vectors and the asset importance score matrix to generate a joint protection feature tensor; The security hub engine performs multi-modal anomaly detection based on the joint protection feature tensor to output suspicious operation event identifiers; the security hub engine selects terminal isolation instructions or traffic cleaning rules from an adaptive response policy library according to the suspicious operation event identifiers, and distributes the terminal isolation instructions or traffic cleaning rules to a policy enforcer; The security hub engine extracts behavioral features from the real-time traffic mirroring to generate a sequence of network session behavior vectors, including: normalizing and scaling the transport layer connection duration and application layer transaction throughput of each network session to obtain time dimension normalized features; performing cryptographic suite strength encoding on encrypted channel handshake parameters to obtain security negotiation feature vectors; performing statistical matrix calculation on load byte distribution histograms to obtain payload distribution feature vectors; orthogonally splicing the time dimension normalized features, security negotiation feature vectors, and payload distribution feature vectors to generate the sequence of network session behavior vectors; The security hub engine quantifies asset criticality from the asset state snapshots to generate an asset importance score matrix, including: matching software version hash values with current entries of a vulnerability database to generate a known vulnerability exposure score; measuring deviation based on permission configuration snapshots and configuration compliance indicators to generate a configuration risk coefficient; extracting patch application time delay and key patch coverage from historical patch application records to generate a maintenance health index; inputting the known vulnerability exposure score, configuration risk coefficient, and maintenance health index into a multi-layer perceptron network to calculate the asset importance score matrix; The security hub engine fuses the sequence of network session behavior vectors and the asset importance score matrix to generate a joint protection feature tensor, including: performing time series feature enhancement on the sequence of network session behavior vectors through a time convolution network to obtain enhanced behavior feature sequences; aligning the asset importance score matrix along the feature dimension to match the dimension of the enhanced behavior feature sequences; performing feature weighted fusion on the enhanced behavior feature sequences and the broadcasted asset importance score matrix through an attention mechanism to generate the joint protection feature tensor.

2. The network data security protection system based on artificial intelligence and big data according to claim 1, characterized in that: The real-time traffic mirror includes transport layer connection duration, application layer transaction throughput, encrypted channel handshake parameters and load byte distribution histogram, and the asset state snapshot includes software version hash value, permission configuration snapshot and historical patch application record.

3. The network data security protection system based on artificial intelligence and big data according to claim 1, characterized in that, The security hub engine performs multi-modal anomaly detection based on the joint protection feature tensor to output a suspicious operation event identifier, including: inputting the joint protection feature tensor into a deep anomaly detection model, the deep anomaly detection model including a graph neural network branch and a time series autoencoder branch; extracting inter-asset relationship features through the graph neural network branch and behavior time series features through the time series autoencoder branch; fusing the inter-asset relationship features and the behavior time series features to calculate an anomaly confidence score; and generating the suspicious operation event identifier when the anomaly confidence score exceeds a dynamic threshold.

4. The network data security protection system based on artificial intelligence and big data according to claim 3, characterized in that, The security hub engine selects terminal isolation instructions or traffic cleaning rules from an adaptive response strategy library according to the suspicious operation event identifier, including: querying an active index library of a threat intelligence platform according to the suspicious operation event identifier to obtain an associated threat behavior pattern; matching the threat behavior pattern with a response action index in the adaptive response strategy library to determine a response action type; generating terminal isolation instructions when the response action type is host-level protection, and generating traffic cleaning rules when the response action type is network-level protection.

5. The network data security protection system based on artificial intelligence and big data according to claim 4, characterized in that, The security hub engine distributes the terminal isolation instructions or traffic cleaning rules to a policy executor, including: digitally signing and timestamping the terminal isolation instructions to generate a security instruction message; performing rule syntax verification and conflict detection on the traffic cleaning rules to generate a valid rule set; and distributing the security instruction message or the valid rule set to the policy executor through a secure channel.

6. The network data security system based on artificial intelligence and big data according to claim 5, characterized in that, When the policy executor executes the terminal isolation instructions, including: parsing the target host identifier and isolation level parameters in the security instruction message; calling a host agent interface to suspend the target process and disable the network interface; generating an isolation event log and returning it to the security hub engine.

7. The network data security system based on artificial intelligence and big data according to claim 6, characterized in that, When the policy executor executes the traffic cleaning rules, including: loading the valid rule set into the rule engine of the traffic cleaning device; dynamically adjusting the detection mode of the traffic cleaning device to the deep packet inspection state; real-time sampling of the cleaned traffic and calculating the malicious traffic discard rate feedback to the security hub engine.

Images