Computer network security data processing method and system based on artificial intelligence

Abstract

The invention discloses a computer network security data processing method and system based on artificial intelligence, and the method comprises the steps: building a multi-channel deep learning fusion model, extracting spatial local features in a traffic sequence through employing a 1D-CNN one-dimensional convolutional neural network, capturing a long-range time sequence dependence relation between log events, and carrying out the recognition of the long-range time sequence dependence relation between log events; modeling the user operation behavior sequence based on an LSTM (Long Short-Term Memory) network, and fusing the feature weight by using an attention mechanism to obtain a fused feature vector; inputting the fusion feature vector into a classifier established based on an OS-ELM online sequence extreme learning machine to perform real-time threat assessment, and outputting a probability index of network attacks occurring in a short time in the future; and generating a cooperative defense decision according to the network attack probability index, and sending the cooperative defense decision to security equipment for execution. Excessive defense or insufficient protection is avoided, and the cooperation efficiency of safety equipment is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to computer network security data processing methods and systems based on artificial intelligence. Background Technology

[0002] The cybersecurity field primarily relies on rule-based detection systems and simple machine learning models. Rule-based systems require extensive manual maintenance of rule bases and cannot respond promptly to new types of attacks; while machine learning-based systems typically require large amounts of labeled data for training and perform poorly against unknown attacks. Current technologies using deep learning algorithms for network intrusion detection rely on a single data source, cannot adaptively adjust detection parameters, and lack real-time dynamic adjustment capabilities. They exhibit significant limitations in handling new and variant attacks, failing to effectively predict attack paths and leading to lagging security protection. Summary of the Invention

[0003] The purpose of this invention is to solve the above-mentioned problems by designing a computer network security data processing method and system based on artificial intelligence.

[0004] To achieve the above objectives, the technical solution of the present invention further includes the following steps in the above-mentioned artificial intelligence-based computer network security data processing method: The system acquires network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data. A multi-channel deep learning fusion model is established. The spatial local features in the traffic sequence are extracted by using a 1D-CNN one-dimensional convolutional neural network. The long-range temporal dependencies between log events are captured by a Transformer encoder. The user operation behavior sequence is modeled based on an LSTM long short-term memory network. The feature weights are fused using an attention mechanism to obtain a fused feature vector. The fused feature vector is input into a classifier built on OS-ELM online sequence extreme learning machine for real-time threat assessment, and the probability index of network attacks that will occur in the near future is output. Based on the network attack probability index, a collaborative defense decision is generated and sent to the security device for execution.

[0005] Furthermore, in the aforementioned AI-based computer network security data processing method, the acquisition of network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network, followed by cleaning and normalization of the collected data and conversion into time-series feature vectors, yields multimodal security data, including: Acquire network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network; use forward imputation to fill in missing numerical values ​​in the traffic data; and mark missing text values ​​in the log data. The Z-score algorithm is used to identify the size of abnormal data packets in traffic data, the IQR algorithm is used to filter redundant records in the logs that are repeated more than 100 times, the timestamps of different time zones are converted to UTC time and the IP addresses are formatted to obtain cleaned data.

[0006] Furthermore, in the aforementioned AI-based computer network security data processing method, the acquisition of network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network, followed by cleaning and normalization of the collected data and conversion into time-series feature vectors, yields multimodal security data, including: Min-Max normalization is used to map the numerical data in the cleaned data to the [0,1] interval. One-hot encoding is used to convert the categorical data into binary vectors. The TF-IDF algorithm is used to extract keywords from the text data and convert them into numerical feature vectors to obtain standard data. The standard data is sliced ​​over time, and the statistical features within each window are extracted to obtain multimodal security data.

[0007] Furthermore, in the aforementioned AI-based computer network security data processing method, the step of establishing a multi-channel deep learning fusion model and using a 1D-CNN one-dimensional convolutional neural network to extract spatial local features from the traffic sequence includes: The input layer of the 1D-CNN flow feature extraction channel is used to receive the flow sub-vector in the temporal feature vector; The convolutional layer has two convolutional blocks. The first block contains 16 convolutional kernels of size 3 and the activation function is ReLU. It extracts spatial local features of packet size change trend and port access local correlation. The second convolutional block contains 32 convolutional kernels of size 2 to further refine the features. Each convolutional block of the pooling layer is followed by a max pooling layer, and the output layer outputs a dimensionality flow feature vector through a fully connected layer.

[0008] Furthermore, in the aforementioned AI-based computer network security data processing method, the step of capturing long-range temporal dependencies between log events using a Transformer encoder includes: The Transformer encoder embedding layer converts the log subvectors in the temporal feature vector into embedding vectors and adds positional encoding; The encoder layer consists of two Transformer encoders, each containing four attention heads to capture long-range temporal dependencies. The output layer outputs log feature vectors through LayerNorm and fully connected layers.

[0009] Furthermore, in the aforementioned AI-based computer network security data processing method, the modeling of user operation behavior sequences based on LSTM (Long Short-Term Memory) networks, and the fusion of feature weights using an attention mechanism to obtain a fused feature vector, includes: The input layer of the LSTM (Long Short-Term Memory) network receives user sub-vectors from the temporal feature vectors and assembles them into a sequence according to the time window order. The hidden layer has 64 nodes. It controls the transmission of temporal information through input gate, forget gate, and output gate. The output layer takes the output of the last time step of the LSTM and outputs the user behavior feature vector through a fully connected layer. The attention layer is input with three types of feature vectors: traffic, logs, and user behavior. The weight of each type of feature is calculated using the Softmax function to obtain the fused feature vector.

[0010] Furthermore, in the aforementioned AI-based computer network security data processing method, the step of inputting the fused feature vector into a classifier built on an OS-ELM online sequence extreme learning machine for real-time threat assessment and outputting a probability index of network attacks occurring in the near future includes: The real-time generated fused feature vector is input into the OS-ELM classifier to update the hidden layer output matrix and output layer weights. The classifier outputs the probability value of the sample belonging to each type of attack, and the weighted average method is used to calculate the overall threat index.

[0011] Furthermore, in the AI-based computer network security data processing system, the AI-based computer network security data processing system includes the following modules: The network data acquisition module is used to acquire network traffic data, host system logs, user behavior data and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data. The feature vector extraction module is used to build a multi-channel deep learning fusion model. It uses a 1D-CNN one-dimensional convolutional neural network to extract spatial local features in the traffic sequence, captures long-range temporal dependencies between log events through a Transformer encoder, models user operation behavior sequences based on an LSTM long short-term memory network, and uses an attention mechanism to fuse feature weights to obtain a fused feature vector. The network attack assessment module is used to input the fused feature vector into a classifier based on OS-ELM online sequence extreme learning machine for real-time threat assessment and output a probability index of network attacks that will occur in the near future. The collaborative defense decision module is used to generate collaborative defense decisions based on the network attack probability index and send them to the security device for execution.

[0012] Furthermore, in an AI-based computer network security data processing system, the network attack assessment module includes the following sub-modules: The receiving submodule is used by the input layer of the LSTM long short-term memory network to receive user subvectors from the temporal feature vectors and form a sequence according to the time window order. The output submodule is used for a hidden layer with 64 nodes. It controls the transmission of temporal information through input gate, forget gate, and output gate. The output layer takes the output of the last time step of the LSTM and outputs the user behavior feature vector through a fully connected layer. The fusion submodule is used to input three types of feature vectors—traffic, logs, and user behavior—into the attention layer, and calculate the weight of each type of feature using the Softmax function to obtain the fused feature vector.

[0013] Furthermore, in an AI-based computer network security data processing system, the collaborative defense decision module includes the following sub-modules: The computation submodule is used to input the real-time generated fused feature vector into the OS-ELM classifier, update the hidden layer output matrix and output layer weights, the classifier outputs the probability value of the sample belonging to each type of attack, and calculates the overall threat index using a weighted average method.

[0014] Its beneficial effects lie in the fact that by cleaning, normalizing, and transforming temporal features, it solves the problems of data fragmentation and inconsistent formats, providing a high-quality data foundation for subsequent analysis and significantly reducing the risk of misjudgment due to poor data quality; it accurately extracts local traffic features, long-term log dependencies, and temporal patterns of user behavior, and combines an attention mechanism to focus on key features, improving feature extraction accuracy compared to single models and enhancing the accuracy of identifying complex attacks; the OS-ELM classifier enables real-time threat assessment, shortening assessment time by 90% compared to traditional models, and can quickly output attack probability indices, buying precious time for defense decisions; hierarchical collaborative defense decisions and closed-loop monitoring match differentiated strategies according to threat levels, avoiding over-defense or under-protection, significantly improving the collaborative efficiency of security devices, reducing enterprise security incident losses, and ensuring the continuous and stable operation of core businesses. (See attached diagram.) Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0015] Figure 1 This is a schematic diagram of the first embodiment of the computer network security data processing method based on artificial intelligence in this invention. Figure 2 This is a schematic diagram of a second embodiment of the computer network security data processing method based on artificial intelligence in this invention. Figure 3 This is a schematic diagram of the first embodiment of the computer network security data processing system based on artificial intelligence in this invention. Attached Figure Description

[0016] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the invention.

[0017] Figure 1 This is a schematic diagram of the first embodiment of the computer network security data processing method based on artificial intelligence in this invention. Figure 2 This is a schematic diagram of a second embodiment of the computer network security data processing method based on artificial intelligence in this invention. Figure 3 This is a schematic diagram of the first embodiment of the computer network security data processing system based on artificial intelligence in this invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0019] Those skilled in the art will understand that, unless specifically stated otherwise, the singular forms "one," "an," and "this" used herein may also include the plural forms. It should be further understood that the terminology used in this specification includes the presence of features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0020] The present invention will now be described in detail with reference to the accompanying drawings. Figure 1 As shown, an artificial intelligence-based computer network security data processing method includes the following steps: Step 101: Obtain network traffic data, host system logs, user behavior data and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, convert it into a time-series feature vector to obtain multimodal security data. Specifically, this embodiment acquires network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network. Forward imputation is used to fill in missing numerical values ​​in the traffic data, and missing text values ​​in the log data are marked. The Z-score algorithm is used to identify the size of abnormal data packets in the traffic data, and the IQR algorithm is used to filter redundant records in the logs that are repeated more than 100 times. Timestamps from different time zones are converted to UTC time, and IP addresses are formatted to obtain cleaned data. Min-Max normalization is used to map the numerical data in the cleaned data to the [0,1] interval. One-hot encoding is used to convert the categorized data into binary vectors. The TF-IDF algorithm is used to extract keywords from the text data and convert them into numerical feature vectors to obtain standard data. The standard data is then time-sliced, and statistical features within each window are extracted to obtain multimodal security data.

[0021] During the data acquisition phase, core network data across all scenarios is obtained through a multi-dimensional acquisition system: For network traffic data, NetFlow / sFlow traffic probes are deployed on core switches and routers, and bypass mirror ports are enabled simultaneously to capture key information such as source and destination IPs, port numbers, packet sizes, transmission rates, and session durations of TCP / UDP packets in real time; For host system logs, lightweight collection agents such as Fluentd / Logstash are installed on servers and terminal hosts to collect operating system event logs, Windows login records, Linux process logs, application logs, web server access logs, and database operation logs in batches; User behavior data is collected through the identity authentication system, LDAP / OAuth2.0, and API interfaces with business systems and OA / CRM to synchronize user login time, operation modules, command types, and operation objects in real time; External threat intelligence is obtained by connecting to platforms such as MITREATT&CK and the Threat Intelligence Alliance to regularly update malicious IPs, domains, hash values, and attack family characteristics, with real-time push notifications triggered by urgent threats. After data collection, the data undergoes initial cleaning: forward imputation is used to complete transmission rates and other missing numerical values ​​in traffic data; missing textual values ​​in log data are marked as unknown events; outliers in traffic data are removed using the Z-score algorithm with a threshold of ±3; redundant log records are filtered using the IQR algorithm; and timestamps are standardized to UTC format and IP addresses are standardized to standard base. Next, normalization is performed: numerical data is mapped to the [0,1] interval using Min-Max normalization; categorized data is converted to binary vectors using one-hot encoding; and textual threat intelligence descriptions are extracted using TF-IDF and converted into numerical features. Finally, with a fixed 10-minute time window, statistical features are extracted from the four types of processed data: average transmission rate of traffic data, percentage of abnormal events in log data, operation frequency of user behavior data, and malicious feature matching tags for threat intelligence. All features within the window are concatenated in the order of traffic-log-user-threat intelligence to form a structured time-series feature vector, ultimately yielding multimodal security data covering multiple scenarios and with a unified format.

[0022] Step 102: Establish a multi-channel deep learning fusion model, use 1D-CNN one-dimensional convolutional neural network to extract spatial local features in traffic sequences, use Transformer encoder to capture long-range temporal dependencies between log events, use LSTM long short-term memory network to model user operation behavior sequences, and use attention mechanism to fuse feature weights to obtain fused feature vectors. Specifically, in this embodiment, the input layer of the 1D-CNN traffic feature extraction channel receives the traffic sub-vectors from the temporal feature vector; the convolutional layer has two convolutional blocks, the first block contains 16 convolutional kernels of size 3 with ReLU activation function, extracting spatial local features of packet size change trends and local port access correlations, and the second convolutional block contains 32 convolutional kernels of size 2 to further refine the features; each convolutional block of the pooling layer is followed by a max pooling layer, and the output layer outputs the dimensionality traffic feature vector through a fully connected layer. The Transformer encoder embedding layer converts the log sub-vectors in the temporal feature vector into embedding vectors and adds positional encoding; the encoder layer builds two Transformer encoders, each containing four attention heads to capture long-range temporal dependencies, and the output layer outputs the log feature vector through a LayerNorm layer and a fully connected layer. The input layer of the LSTM (Long Short-Term Memory) network receives the user sub-vectors from the temporal feature vectors and arranges them into a sequence according to the time window order. The hidden layer has 64 nodes and controls the transmission of temporal information through the input gate, forget gate, and output gate. The output layer takes the output of the last time step of the LSTM and outputs the user behavior feature vector through a fully connected layer. The three types of feature vectors, namely traffic, logs, and user behavior, are input into the attention layer, and the weight of each type of feature is calculated through the Softmax function to obtain the fused feature vector.

[0023] The input layer of the 1D-CNN traffic feature extraction channel specifically receives the traffic sub-vector from the preprocessed temporal feature vector. This sub-vector originates from the previous deep processing of network traffic data, has a dimension of 15, and covers core indicators such as average transmission rate within the window, variance of packet quantity, and top 3 port access frequencies. These indicators directly reflect the real-time status of network transmission; for example, the top 3 port access frequencies can initially identify whether there is abnormal access behavior at high-frequency communication ports. The input layer receives this sub-vector through a standardized interface, ensuring that the data format matches the computational requirements of subsequent convolutional layers. This lays the foundation for accurately extracting local features in the traffic space and avoids feature extraction bias caused by incompatible data dimensions or missing indicators.

[0024] The convolutional layer employs a two-stage progressive convolutional block design to achieve hierarchical extraction of traffic features. The first convolutional block is configured with 16 convolutional kernels of size 3, paired with the ReLU activation function. The kernel size of 3 accurately captures the traffic correlation features within three adjacent time windows, such as the local trend of normal packet size in the first window and a sudden increase in packet size in the next two windows. The ReLU activation function effectively filters out invalid feature values, highlighting key spatial features such as packet size fluctuations and concentrated access to specific ports. The second convolutional block further optimizes the feature granularity by using 32 convolutional kernels of size 2. The smaller kernel size can focus on traffic details over a shorter time span, such as the access sequence correlation of different ports within a single window. The larger number of convolutional kernels can cover a richer variety of feature types, including traffic differences under TCP / UDP protocols. Through the progressive two-stage convolution, the raw traffic data is transformed into more discernible high-order features.

[0025] Pooling layers and convolutional layers form a collaborative extraction-compression mechanism: each convolutional block is followed by a max-pooling layer with a kernel size of 2. Its core function is to retain key features extracted by the convolutional layers, such as peak abnormal port access times and sudden changes in packet size, while removing redundant information and reducing feature dimensionality. For example, after pooling, the feature map output from the first convolutional block can be compressed from 16×N to 16×(N / 2), reducing subsequent computation and avoiding model overfitting. The output layer integrates features through a fully connected layer, mapping the pooled multi-dimensional features to a unified 64-dimensional traffic feature vector. The fully connected layer uses a weight matrix to correlate and fuse local features extracted by different convolutional kernels. For example, it combines port access features with packet size features to form a compact vector that comprehensively reflects abnormal traffic conditions, providing standardized input for subsequent multimodal feature fusion.

[0026] The embedding layer of the Transformer encoder performs the dual tasks of increasing the dimensionality of log features and adding temporal labeling. First, this layer receives an 8-dimensional log sub-vector from the temporal feature vector, containing metrics such as the proportion of abnormal events and the number of process starts. This is then converted into a 64-dimensional embedding vector using an embedding matrix. The higher dimension allows for richer log semantic information, such as more clearly presenting the feature differences between login failures and file tampering. Second, the embedding layer incorporates positional encoding based on sine and cosine functions. Since the temporal sequence of log events is crucial for attack detection, the risk level of a login failure immediately followed by a permission change is significantly different from a permission change followed by a login failure. Positional encoding adds unique temporal labels to the embedding vectors of different time windows, ensuring the model accurately captures the chronological order of log events and avoiding misjudgments due to neglecting temporal information.

[0027] The encoder layer employs multi-layer, multi-head attention structures to deeply mine long-term temporal dependencies in log events. The two-layer Transformer encoder design achieves progressively deeper feature extraction. Each layer has four attention heads that can focus on different dimensions of log associations in parallel. For example, one attention head focuses on the association between process operations and file operations, while another focuses on the association between login events and system errors. The outputs of the four attention heads are concatenated to comprehensively cover the complex dependencies between log events, such as the potential correlation between an abnormal process startup a few days ago and a database data leak today. The output layer optimizes feature quality through a combination of LayerNorm and fully connected layers. The LayerNorm layer normalizes the features output by the encoder, preventing differences in feature value distribution from affecting model stability. The fully connected layer maps the normalized features to a 64-dimensional log feature vector, maintaining consistency with the dimension of the traffic feature vector to ensure compatibility in subsequent fusion stages while preserving the core information of long-term dependencies in log events.

[0028] The input layer of the LSTM user behavior feature extraction channel receives user behavior data in the form of a time-series sequence. This layer first extracts a 6-dimensional user sub-vector from the time-series feature vector, containing indicators such as operation frequency and cross-module operation count. Then, it concatenates these sub-vectors into a time series of length 10, following the first 10 10-minute windows. This serialized input method can completely preserve the temporal change trajectory of user behavior. For example, the difference between a user's regular operations from 9 am to 6 pm on weekdays and sudden batch deletion of files outside of working hours can be intuitively reflected through the sequence. This lays the data foundation for LSTM to capture long-term user behavior habits and short-term anomalies, avoiding misjudgments caused by viewing data from a single window in isolation.

[0029] LSTM's hidden layers employ a three-gating mechanism to accurately transmit temporal information about user behavior: the 64 hidden layer nodes balance feature representation and computational efficiency, while the collaborative work of the input gate, forget gate, and output gate solves the gradient vanishing problem of traditional RNNs. Specifically, the input gate determines whether to include new information in the hidden state based on the current user behavior characteristics, specifically whether unauthorized operations have occurred; the forget gate determines whether to retain historical behavior information based on the user's long-term lack of cross-module operation habits; and the output gate controls the output of information related to subsequent time steps from the hidden state. For example, when a user suddenly modifies data across modules in batches, the input gate strengthens the inclusion of this abnormal feature, the forget gate weakens historical information about no cross-module operations, and the output gate propagates the anomaly to the next time step, ensuring the model can continuously track abnormal changes in user behavior.

[0030] The output layer of the LSTM user behavior feature extraction channel generates a standardized feature vector through time step filtering and feature integration. This layer specifically selects the hidden state output of the last time step of the LSTM because the output of the last time step has integrated user behavior information from all previous time windows. Whether there are continuous abnormal operations and the evolution trend of abnormal operations in the first 10 windows can comprehensively reflect the overall user behavior characteristics. Subsequently, the fully connected layer maps this hidden state into a 64-dimensional user behavior feature vector. On the one hand, by adjusting the weights of the fully connected layer, the importance of key features such as the frequency of abnormal operations and the number of cross-permission operations is highlighted. On the other hand, the vector dimension is unified to ensure that it can be directly fused with traffic and log feature vectors, providing a guarantee for the complementarity of multimodal features.

[0031] The attention layer achieves efficient fusion of three types of features through dynamic weight allocation: First, 64-dimensional traffic, log, and user behavior feature vectors are input into the attention calculation module. The fully connected layer within the module scores the importance of each feature vector. When traffic data exhibits typical characteristics of a DDoS attack, the score of the traffic feature will be significantly higher than that of other features. Subsequently, the Softmax function normalizes these scores into weights in the 0-1 range, ensuring that the sum of the weights of the three types of features is 1. This achieves dynamic adjustment, where important features contribute more and secondary features cause less interference. For example, when user behavior is normal but logs show abnormal permission changes, the weight of the log feature will increase to above 0.5, while the weights of traffic and user behavior features will decrease accordingly. Finally, the 64-dimensional fused feature vector is generated by weighted summation according to the formula: traffic feature × traffic weight + log feature × log weight + user behavior feature × user weight. This vector integrates the advantages of multimodal data and focuses on key information for threat identification, significantly improving the accuracy of subsequent threat assessment.

[0032] Step 103: Input the fused feature vector into a classifier built on the OS-ELM online sequence extreme learning machine for real-time threat assessment, and output the probability index of network attacks that will occur in the near future. Specifically, in this embodiment, the fused feature vector generated in real time is input into the OS-ELM classifier to update the hidden layer output matrix and output layer weights. The classifier outputs the probability value of the sample belonging to each type of attack, and the weighted average method is used to calculate the overall threat index.

[0033] After completing the multimodal feature fusion, the 64-dimensional fused feature vector, weighted by an attention mechanism and encompassing local features in the traffic space, long-term log time-series dependencies, and user behavior time-series patterns, is first input into a classifier built on the OS-ELM online sequence extreme learning machine at a frequency of once every 10 minutes. This classifier has been initialized using historical offline data, including normal network data and known attack samples. The preset input layer node count is 64, precisely matching the fused feature vector dimension, and the hidden layer node count is 128. Cross-validation optimization was used to balance fitting performance and computational efficiency. The sigmoid activation function was chosen to adapt to the probability output scenario. The output layer supports multiple attack types, including probability determinations for DDoS attacks, SQL injection, and privilege escalation. During real-time evaluation, the OS-ELM classifier, leveraging its online learning characteristics, does not require retraining the entire model. It dynamically updates the hidden layer output matrix H and output layer weights β only for the newly input fused feature vector, with a single update time controlled within 0.1 seconds, meeting the requirements for real-time response to cybersecurity threats. The classifier first outputs the independent probability values ​​of each type of attack corresponding to the feature vector: 0.82 for DDoS attack, 0.05 for SQL injection, and 0.13 for normal state. Then, based on preset attack severity weights, DDoS attacks are weighted at 0.8 due to their wide impact, and SQL injection is weighted at 0.7 due to the risk of data leakage. Using the weighted average formula, the overall attack probability index P = Σ, which is the probability of a certain type of attack multiplied by the corresponding severity weight, is calculated to obtain the final result. Finally, the probability index of a network attack occurring within the next 10-30 minutes is output, with a value range of 0-1, where 0 represents no threat and 1 represents extremely high threat, providing a quantitative basis for subsequent collaborative defense decisions.

[0034] Step 104: Generate a collaborative defense decision based on the network attack probability index and send it to the security device for execution.

[0035] Specifically, in this embodiment, after obtaining the network attack probability index in the near future (range 0-1), the system first matches corresponding collaborative defense decisions based on preset threat level classification rules: minor threat P∈[0,0.3], moderate threat P∈[0.3,0.7], and severe threat P∈[0.7,1]. For minor threats, the decision focuses on early warning and lightweight monitoring, generating an instruction set that includes pushing emails / operations platform warnings to security administrators, attaching threat characteristics such as 'suspected malicious IP access records', increasing the log collection frequency of the corresponding node from 5 minutes / time to 1 minute / time, and enabling abnormal traffic capture function. For minor threats, the system first obtains the network attack probability index in the near future (range 0-1), then obtains the network attack probability index in the near future. For moderate threats, the system first ... For moderate threats, the decision-making focus is on coordinated blocking and resource restriction. Instructions include issuing malicious IP / domain blocking rules to firewalls, pushing 'abnormal port scanning' and 'bulk login' interception policies to IDS / IPS, and limiting the outbound transmission bandwidth of affected hosts to 50% of normal levels. For severe threats, the decision-making escalates to emergency isolation and business protection, including sending instructions to switches to assign infected hosts to isolated VLANs, issuing rules to WAF to disable high-risk functions such as 'file upload' and 'SQL execution', triggering real-time backup instructions to database servers, and initiating business switching processes to migrate threatened services to backup servers, among other core operations.

[0036] After a decision is generated, the system uses standardized communication protocols—SNMP for network devices and REST API for application-layer security devices—to push commands to the corresponding security devices, such as firewalls, IDS / IPS, WAFs, switches, and endpoint security software. Leveraging a lightweight command transmission mechanism, the system ensures that command delivery time is controlled within one second, meeting the timeliness requirements of threat response. Simultaneously, the system receives real-time feedback from security devices on execution results: the firewall has blocked IP 192.168.1.100, with a cumulative blocking request of 15 times; the isolated VLAN has been successfully assigned to 3 abnormal hosts. This feedback data is synchronized to the security management platform, providing a basis for subsequent defense effectiveness evaluation and strategy optimization, ensuring the effective implementation of defense decisions.

[0037] Its beneficial effects lie in the fact that by cleaning, normalizing, and transforming temporal features, it solves the problems of data fragmentation and inconsistent formats, providing a high-quality data foundation for subsequent analysis and significantly reducing the risk of misjudgment due to poor data quality; it accurately extracts local traffic features, long-term log dependencies, and temporal patterns of user behavior, and combines attention mechanisms to focus on key features, improving feature extraction accuracy compared to single models and enhancing the accuracy of identifying complex attacks; the OS-ELM classifier enables real-time threat assessment, shortening the assessment time by 90% compared to traditional models, and can quickly output attack probability indices, buying precious time for defense decisions; hierarchical collaborative defense decisions and closed-loop monitoring match differentiated strategies according to threat levels, avoiding over-defense or under-protection, significantly improving the collaborative efficiency of security devices, reducing enterprise security incident losses, and ensuring the continuous and stable operation of core businesses.

[0038] Please see Figure 2 In the AI-based computer network security data processing method, a multi-channel deep learning fusion model is established, and a 1D-CNN one-dimensional convolutional neural network is used to extract spatial local features from the traffic sequence, including the following steps: Step 201: The input layer of the 1D-CNN flow feature extraction channel is used to receive the flow sub-vector in the temporal feature vector; Step 202: The convolutional layer is set with two convolutional blocks. The first block contains 16 convolutional kernels of size 3 and the activation function is ReLU to extract spatial local features of packet size change trend and port access local correlation. The second convolutional block includes 32 convolutional kernels of size 2 to further refine the features. Step 203: Each convolutional block of the pooling layer is followed by a max pooling layer, and the output layer outputs the dimensionality flow feature vector through a fully connected layer.

[0039] The above describes embodiments of the artificial intelligence-based computer network security data processing method of the present invention. Please refer to [link / reference]. Figure 3 In an AI-based computer network security data processing system, the system includes the following modules: The network data acquisition module is used to acquire network traffic data, host system logs, user behavior data and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data. The feature vector extraction module is used to build a multi-channel deep learning fusion model. It uses a 1D-CNN one-dimensional convolutional neural network to extract spatial local features in the traffic sequence, captures long-range temporal dependencies between log events through a Transformer encoder, models user operation behavior sequences based on an LSTM long short-term memory network, and uses an attention mechanism to fuse feature weights to obtain a fused feature vector. The network attack assessment module is used to input the fused feature vector into a classifier built on the OS-ELM online sequence extreme learning machine for real-time threat assessment and output the probability index of network attacks that will occur in the near future. The collaborative defense decision module is used to generate collaborative defense decisions based on the network attack probability index and send them to security devices for execution.

[0040] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network security data processing method based on artificial intelligence, characterized in that, The artificial intelligence-based computer network security data processing method includes the following steps: The system acquires network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data. A multi-channel deep learning fusion model is established. The spatial local features in the traffic sequence are extracted by using a 1D-CNN one-dimensional convolutional neural network. The long-range temporal dependencies between log events are captured by a Transformer encoder. The user operation behavior sequence is modeled based on an LSTM long short-term memory network. The feature weights are fused using an attention mechanism to obtain a fused feature vector. The fused feature vector is input into a classifier built on OS-ELM online sequence extreme learning machine for real-time threat assessment, and the probability index of network attacks that will occur in the near future is output. Based on the network attack probability index, a collaborative defense decision is generated and sent to the security device for execution.

2. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The process involves acquiring network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data, including: Acquire network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network; use forward imputation to fill in missing numerical values ​​in the traffic data; and mark missing text values ​​in the log data. The Z-score algorithm is used to identify the size of abnormal data packets in traffic data, the IQR algorithm is used to filter redundant records in the logs that are repeated more than 100 times, the timestamps of different time zones are converted to UTC time and the IP addresses are formatted to obtain cleaned data.

3. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The process involves acquiring network traffic data, host system logs, user behavior data, and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data, including: Min-Max normalization is used to map the numerical data in the cleaned data to the [0,1] interval. One-hot encoding is used to convert the categorical data into binary vectors. The TF-IDF algorithm is used to extract keywords from the text data and convert them into numerical feature vectors to obtain standard data. The standard data is sliced ​​over time, and the statistical features within each window are extracted to obtain multimodal security data.

4. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The establishment of a multi-channel deep learning fusion model, utilizing a 1D-CNN one-dimensional convolutional neural network to extract spatial local features from the traffic sequence, includes: The input layer of the 1D-CNN flow feature extraction channel is used to receive the flow sub-vector in the temporal feature vector; The convolutional layer has two convolutional blocks. The first block contains 16 convolutional kernels of size 3 and the activation function is ReLU. It extracts spatial local features of packet size change trend and port access local correlation. The second convolutional block contains 32 convolutional kernels of size 2 to further refine the features. Each convolutional block of the pooling layer is followed by a max pooling layer, and the output layer outputs a dimensionality flow feature vector through a fully connected layer.

5. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The method of capturing long-range temporal dependencies between log events using a Transformer encoder includes: The Transformer encoder embedding layer converts the log subvectors in the temporal feature vector into embedding vectors and adds positional encoding; The encoder layer consists of two Transformer encoders, each containing four attention heads to capture long-range temporal dependencies. The output layer outputs log feature vectors through LayerNorm and fully connected layers.

6. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The LSTM (Long Short-Term Memory) network is used to model user action sequences, and an attention mechanism is used to fuse feature weights to obtain... The fused feature vectors include: The input layer of the LSTM (Long Short-Term Memory) network receives user sub-vectors from the temporal feature vectors and assembles them into a sequence according to the time window order. The hidden layer has 64 nodes. It controls the transmission of temporal information through input gate, forget gate, and output gate. The output layer takes the output of the last time step of the LSTM and outputs the user behavior feature vector through a fully connected layer. The attention layer is input with three types of feature vectors: traffic, logs, and user behavior. The weight of each type of feature is calculated using the Softmax function to obtain the fused feature vector.

7. The computer network security data processing method based on artificial intelligence as described in claim 1, characterized in that, The process of inputting the fused feature vector into a classifier built on the OS-ELM online sequence extreme learning machine for real-time threat assessment, and outputting a probability index of network attacks occurring in the near future, includes: The real-time generated fused feature vector is input into the OS-ELM classifier to update the hidden layer output matrix and output layer weights. The classifier outputs the probability value of the sample belonging to each type of attack, and the weighted average method is used to calculate the overall threat index.

8. A computer network security data processing system based on artificial intelligence, characterized in that, The artificial intelligence-based computer network security data processing system includes the following modules: The network data acquisition module is used to acquire network traffic data, host system logs, user behavior data and external threat intelligence from different nodes in the network. After cleaning and normalizing the collected data, it is converted into time-series feature vectors to obtain multimodal security data. The feature vector extraction module is used to build a multi-channel deep learning fusion model. It uses a 1D-CNN one-dimensional convolutional neural network to extract spatial local features in the traffic sequence, captures long-range temporal dependencies between log events through a Transformer encoder, models user operation behavior sequences based on an LSTM long short-term memory network, and uses an attention mechanism to fuse feature weights to obtain a fused feature vector. The network attack assessment module is used to input the fused feature vector into a classifier based on OS-ELM online sequence extreme learning machine for real-time threat assessment and output a probability index of network attacks that will occur in the near future. The collaborative defense decision module is used to generate collaborative defense decisions based on the network attack probability index and send them to the security device for execution.

9. The computer network security data processing system based on artificial intelligence as described in claim 8, characterized in that, The network attack assessment module includes the following sub-modules: The receiving submodule is used by the input layer of the LSTM long short-term memory network to receive user subvectors from the temporal feature vectors and form a sequence according to the time window order. The output submodule is used for a hidden layer with 64 nodes. It controls the transmission of temporal information through input gate, forget gate, and output gate. The output layer takes the output of the last time step of the LSTM and outputs the user behavior feature vector through a fully connected layer. The fusion submodule is used to input three types of feature vectors—traffic, logs, and user behavior—into the attention layer, and calculate the weight of each type of feature using the Softmax function to obtain the fused feature vector.

10. The computer network security data processing system based on artificial intelligence as described in claim 8, characterized in that, The collaborative defense decision-making module includes the following sub-modules: The computation submodule is used to input the real-time generated fused feature vector into the OS-ELM classifier, update the hidden layer output matrix and output layer weights, the classifier outputs the probability value of the sample belonging to each type of attack, and calculates the overall threat index using a weighted average method.

Images