Automatic information security protection method and system based on ai and blockchain

Abstract

This invention discloses an automated information security protection method and system based on AI and blockchain, belonging to the field of anomaly detection technology in machine learning. The method includes the following steps: S1, initial configuration; S2, multi-source data collection; S3, intelligence cross-validation; S4, identity authentication; S5, result response and model iteration. This invention, employing the aforementioned automated information security protection method based on AI and blockchain, can effectively enhance the ability to resist AI evasion attacks and ensure the security of response rules. Simultaneously, it can improve the accuracy of threat assessment, reduce false positives and false negatives, and complete the entire protection process without manual intervention, significantly improving the efficiency of information security protection.

Description

Technical Field

[0001] This invention belongs to the field of anomaly detection technology in machine learning, specifically involving an automated information security protection method and system based on AI and blockchain. Background Technology

[0002] Cyber ​​threats are becoming increasingly complex, intelligent, and rapid, making traditional protection methods inadequate. Specifically, traditional threats such as advanced persistent threats (APTs) and ransomware are iterating at an accelerated pace, while new types of "AI escape attacks," such as AI-generated attacks and poisoned data packets, are emerging.

[0003] However, existing technologies have the following shortcomings: traditional IDS / IPS systems rely on manual analysis of alerts, which can easily miss the golden period for containing threats such as ransomware encryption; single AI models lack cross-validation of trusted intelligence, with one company's pure machine learning protection system receiving more than 2,000 false alarms per month, consuming a lot of security personnel's time; they are difficult to deal with AI escape attacks (such as poisoned data packets), have insufficient recognition rate of unknown threats, and cannot defend against new risks such as zero-day vulnerabilities.

[0004] Therefore, a new method is urgently needed. Summary of the Invention

[0005] The purpose of this invention is to provide an automated information security protection method based on AI and blockchain. This method can effectively enhance the ability to resist AI evasion attacks and ensure the security of response rules. At the same time, it can improve the accuracy of threat judgment, reduce false alarms and false negatives, and complete the entire protection process without human intervention, thus significantly improving the efficiency of information security protection.

[0006] To achieve the above objectives, this invention provides an automated information security protection method based on AI and blockchain, comprising the following steps: S1. Initialization of data acquisition channel, blockchain environment, AI detection engine and response rules; S2. Collect network layer data, host layer data and application layer data respectively, and generate a standardized dataset after conversion; calculate the hash value of the standardized dataset, and write the anonymized data and hash value into the blockchain for evidence storage; S3. Train the adversarial LSTM model. Based on the standardized dataset in S2, use the trained adversarial LSTM model to detect abnormal data. Combined with blockchain threat intelligence verification, generate the final detection report and store it on the blockchain. S4. Extract the device identifier and user biometrics from the final test report of S3, calculate the hash value of the device identifier and user biometrics respectively, compare the hash value with the hash value recorded on the blockchain, verify the legality of the device and user identity, generate the identity verification result, and write it to the blockchain for storage. S5. Based on the final detection report generated by S3 and the identity verification result generated by S4, perform automated processing actions and iteratively optimize the anti-training LSTM model based on historical data.

[0007] Preferably, the blockchain environment initialization in S1 is as follows: Deploy no fewer than 3 consensus nodes and no fewer than 2 storage nodes, enable TLS encrypted communication between nodes, and issue identity certificates through a self-built CA center; Configure the encryption algorithm; the private key is stored in an encrypted partition on the server and used for node signing and contract deployment; the public key is distributed across the network and used for data encryption and authentication. Enable the zero-knowledge proof protocol, configure the proof generation time to be no more than 500ms and the verification time to be no more than 100ms, and initialize the on-chain identity registration template.

[0008] Preferably, the standardized dataset generated after transformation in S2 also includes data preprocessing and standardization, specifically: The collected dataset is deduplicated. For network data packets with identical source IP, destination IP, and port number at the same timestamp, the record with the longest data packet is retained, and the other duplicates are removed. The moving average method is used to complete the representation of numeric fields as follows: ; in, For fill value, For missing values, The first three timestamps are valid values; For outliers, use 3. The principle for identifying outliers in numeric fields is as follows: ; in, This is an outlier. The average value of the field; Standard deviation; For fields of different magnitudes, Min-Max normalization is used to transform them to the [0,1] interval.

[0009] Preferably, in S3, the adversarial LSTM model is trained using standardized data from the past 12 months. Adversarial examples are generated using FGSM, with the following formula: ; in, This is the original sample; The disturbance coefficient; L The loss function; These are model parameters; The true label for the sample.

[0010] Preferably, S3 further includes constructing an isolated tree forest, which consists of 100 isolated trees, with each tree having a sample size of 256 and a feature sampling rate set to 0.8; and defining anomaly scoring. The formula is: ; in, For the sample Average path length in the forest; Number of samples N The average path length constant.

[0011] Preferably, in S3, the trained, anti-training LSTM model is used to detect outlier data, specifically as follows: Input the standardized unified dataset from S2 into the trained LSTM model to obtain the classification probabilities. P abn ;like P abn If the value is ≥0.85, it is marked as "highly suspicious data"; if it is ≤0.6, it is marked as "highly suspicious data". P abn If the score is less than 0.85, input the data into the isolated tree forest to calculate the score; if the score is greater than or equal to 0.7, mark it as "medium suspicious data"; if the score is less than 0.7, mark it as "low suspicious data"; generate a preliminary anomaly report.

[0012] Preferably, S3 incorporates blockchain threat intelligence verification, specifically as follows: Send a verification request to the blockchain consensus node to query the malicious IP and malicious process databases in the threat intelligence contract; if the key information matches and the credibility is ≥80%, upgrade to "Confirm Threat"; if not matched but... P abn If the score is ≥0.9 and the score is ≥0.8, it is marked as "suspected zero-day threat"; if the match confidence is <60%, it is marked as "false alarm".

[0013] This invention also provides an automated information security protection system based on AI and blockchain, comprising: The initialization module is used to initialize the data acquisition channel, blockchain environment, AI detection engine, and response rules. The data acquisition and preprocessing module, connected to the initialization module, is used to acquire network layer data, host layer data, and application layer data, convert them to generate a standardized dataset, calculate the hash value of the standardized dataset, and write the anonymized data and hash value into the blockchain for storage. The intelligence verification module is connected to the data acquisition and preprocessing module. It is used to train an adversarial training LSTM model. Based on a standardized dataset, it uses the trained adversarial training LSTM model to detect abnormal data. Combined with blockchain threat intelligence verification, it generates a final detection report and stores it on the blockchain. The identity authentication module, connected to the intelligence verification module, is used to extract the device identifier and user biometrics from the final detection report, calculate the hash values ​​of the device identifier and user biometrics respectively, compare the hash values ​​with the hash values ​​recorded on the blockchain, verify the legality of the device and user identities, generate the identity verification result, and write it to the blockchain for storage. An automated response module, connected to the identity authentication module, performs automated processing actions based on the final detection report and identity verification results, and iteratively optimizes the anti-training LSTM model based on historical data.

[0014] Therefore, the automated information security protection method based on AI and blockchain adopted in this invention has the following advantages compared with the prior art: (1) This invention uses machine learning technology and iteratively optimizes the LSTM model based on the detection reports, identity verification results and response results of the past 7 days. This overcomes the problems of traditional single AI models lacking anti-attack capabilities, being unable to cope with AI escape attacks and model staticization, thereby enhancing the ability to resist AI escape attacks and reducing the risk of the model being bypassed. (2) By deploying a consortium blockchain environment, this invention overcomes the problems of traditional protection systems, such as the easy tampering of detection data and threat intelligence, insufficient privacy protection during data transmission and storage, isolated threat intelligence, inability to conduct cross-node collaborative verification, and the easy illegal modification of response rules, resulting in insufficient security. It achieves cross-organizational synchronization and trusted verification of threat intelligence, providing reliable intelligence support for anomaly detection; ensuring the security of response rules, preventing illegal modification, and guaranteeing the stability of the protection process. (3) This invention deeply integrates the AI ​​dual-layer anomaly detection mechanism with blockchain trusted storage and intelligence verification, overcoming the problem that single AI technology cannot solve the problems of "data credibility" and "intelligence collaborative verification", thereby improving the accuracy of threat judgment and reducing false alarms and false alarms; and can complete the entire process from threat detection to disposal without human intervention, greatly improving protection efficiency.

[0015] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0016] Figure 1 This is a flowchart illustrating an embodiment of the automated information security protection method based on AI and blockchain of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used in the present invention should have the ordinary meaning understood by those skilled in the art.

[0018] Example 1 like Figure 1 As shown, the automated information security protection method based on AI and blockchain of the present invention includes the following steps: S1. Install network probes on target network nodes (such as routers and servers), deploy agent programs on host terminals, and connect to application systems via APIs to complete the construction of data collection channels at the network layer, host layer, and application layer. Deploy consortium blockchain nodes, including consensus nodes and storage nodes. There should be no fewer than 3 consensus nodes to meet fault tolerance requirements, and no fewer than 2 storage nodes to achieve data redundancy. Enable TLS encrypted communication between nodes and issue identity certificates to each node through a self-built Certificate Authority (CA) to ensure the legitimacy of node identities and the security of communication. Configure the RSA-2048 asymmetric encryption algorithm and zero-knowledge proof protocol; for the RSA-2048 asymmetric encryption algorithm, the private key is used for node signing and contract deployment, and the public key is used for data encryption and authentication. The private key is stored in an encrypted partition on the server; for the zero-knowledge proof protocol, the Groth16 algorithm is selected to implement zero-knowledge proof, and the parameters of the "proof generation-verification" process are configured, wherein the proof generation time is no more than 500ms and the verification time is no more than 100ms; initialize the on-chain identity registration template, including device identifier and user biometric features; Import the MITRE ATT&CK basic threat feature library, initialize the parameters of the adversarial training LSTM model and the isolation tree algorithm; set the anomaly detection threshold, and trigger an alert when the anomaly detection threshold is greater than 30%; The "threat level - response action" mapping relationship is entered into the smart contract, as shown in Table 1: Table 1 Threat Level Mapping Table

[0019] The mapping rules are encapsulated into a response strategy contract, deployed to the consortium blockchain through a blockchain node client, and the contract rule writing interface is called to write the standardized mapping relationship into on-chain storage. Setting modifiable mapping rules requires signatures from at least two consensus nodes to prevent unauthorized tampering of the rules, while also recording rule modification logs; S2. Collect network layer data, host layer data, and application layer data respectively; capture TCP / UDP traffic packets using a network probe, and extract key fields, including: source IP (S_IP), destination IP (D_IP), port number (Port), packet length (Len), transmission rate (Rate), and protocol type (Proto); set the collection frequency to 10ms / time to ensure real-time performance; and synchronize router traffic statistics using the NetFlowv9 protocol to obtain the number of sessions (Session_Count) and total bytes (Byte_Total) every 5 minutes, forming a basic network traffic dataset; System process data is collected through an agent program, including: process ID (PID), process name (P_Name), CPU utilization (CPU_Use), memory usage (Mem_Use), file operation path (File_Path), and network connection status (Conn_State); and hardware status data is collected using WMI (Windows) / SNMP (Linux) protocols to form a host dataset; By connecting to business systems via RESTful APIs, user operation data is collected, including: User ID (User_ID), Operation Type (Op_Type), Operation Object (Op_Object), Operation Result (Op_Result), and Interface Response Time (Resp_Time); after filtering invalid requests, an application dataset is formed. The collected dataset is deduplicated using a "timestamp + key field" rule. For network data packets with identical source IP, destination IP, and port number at the same timestamp, the record with the longest data packet is retained, and the other duplicates are removed. The moving average method is used to complete numeric fields, as shown below: ; in, For fill value, For missing values, The first three timestamps are valid values; For character fields, use context matching to complete the text; For outliers, use 3. The principle for identifying outliers in numeric fields is as follows: ; in, This is an outlier. The average value of the field; The standard deviation is calculated based on 30 days of historical data. For fields of different magnitudes, Min-Max normalization is used to transform them to the [0,1] interval, and finally a standardized unified dataset is generated; The standardized unified dataset is transmitted to the AI ​​detection engine via a message queue. The number of message replicas is set to 3 to ensure that no data is lost and the transmission latency is controlled to ≤50ms. The SHA-256 hash value is calculated for the standardized unified dataset. The calculated hash value and the anonymized standardized unified dataset are written to the storage node of the blockchain consortium chain and stored in the LevelDB database. The block generation interval is set to 10 seconds to ensure that the data cannot be tampered with. S3. Collect standardized data from the past 12 months and divide the training set and validation set into a 7:3 ratio, and label each data point. The adversarial LSTM model is trained with the following parameters: input layer dimension is 28, corresponding to 28 features; embedding layer is 64-dimensional; LSTM layer has 2 layers, hidden layer has 128 units, activation function is Tanh; fully connected layer output dimension is 2; output classification probability uses Softmax layer. During training, adversarial examples are generated using FGSM (Fast Gradient Signed Method), with the following formula: ; in, This is the original sample; The disturbance factor is set to 0.01. L The loss function; These are model parameters; The true label of the sample; The loss function and optimizer use the cross-entropy loss function, with the following formula: ; in, The number of samples; The probability that the model predicts an anomaly; L This is the average loss value; Let i be the true label of the i-th sample; The optimizer used was Adam, with a learning rate of 0.001 and 50 iterations. The isolation tree algorithm constructs a forest of 100 isolated trees, with each tree having 256 samples and a feature sampling rate of 0.8; anomaly scoring is defined. The formula is: ; in, For the sample Average path length in the forest; Number of samples N The average path length constant; data with a score ≥ 0.7 is considered potentially abnormal. Receive the standardized unified dataset from S2, input the standardized unified dataset into the trained LSTM model, and obtain the classification probabilities. P abn ;like P abn If the value is ≥0.85, it is marked as "highly suspicious data"; if it is ≤0.6, it is marked as "highly suspicious data". P abn If the score is less than 0.85, input the data into the isolated tree forest to calculate the score; if the score is greater than or equal to 0.7, mark it as "moderately suspicious data"; if the score is less than 0.7, mark it as "lowly suspicious data"; finally, generate a preliminary anomaly report; The AI ​​engine sends an intelligence verification request to the blockchain consensus node, carrying key suspicious information from the preliminary anomaly report; the consensus node queries the on-chain "threat intelligence contract", which stores intelligence data synchronized across institutions, including: malicious IP database, malicious process database, and zero-day vulnerability signature database; If key suspicious information from the initial anomaly report is matched in the threat intelligence contract and the credibility is ≥80, the "high / medium suspicious data" will be upgraded to "confirmed threat". If no match is found, but P abn If the value is ≥0.9 and the score is ≥0.8, it is marked as "suspected zero-day threat"; If a match is found but the confidence level is less than 60, or P abn If the score is less than 0.7 and the score is less than 0.6, it is marked as a "false alarm" and removed. The system compiles information such as threat level, involved objects (device serial number, user ID, suspicious IP), generates a final detection report, and calls the blockchain evidence storage interface to write the final detection report into the blockchain. S4. Extract the entity identifier from the final test report of S3. The entity identifier includes: device identifier and user biometrics; initiate a query request to the blockchain "identity registration contract" to obtain the on-chain identity record corresponding to the device identifier; Calculate the SHA256 hash value of the current device identifier and compare it with the hash value recorded on the chain. If they do not match, it is determined that the device is "forged". If the current device hash is consistent, then calculate the SM3 hash value of the current user's biometrics and compare it with the hash value recorded on the chain, using Hamming distance for fault tolerance. The formula is as follows: ; in, The Hamming distance; The i-th binary bit of the hash value; If HD≤3, the identity is deemed "legitimate"; if HD>3, the identity is deemed "impersonation". Generate the authentication result and write it to the blockchain for storage; S5. Read the final detection report generated by S3 and the authentication result generated by S4, and associate the two information through preset logic to obtain the response result: If the threat level is "high risk", the highest priority response will be triggered regardless of the identity verification result (including device forgery and identity impersonation); If the threat level is "medium risk", basic actions will be taken if the identity is legitimate, and "temporary freezing of the account involved" will be added if the identity is impersonated / the device is forged. If the threat level is "low risk", the alarm recipients will be adjusted only based on whether the identity is legitimate or misused.

[0020] A new training set is formed by extracting the final detection reports, identity verification results, and response results from the past 7 days. The new training set is then used to train the LSTM model. After training, the original model is replaced to ensure the ability to identify new threats. At the same time, the abnormal score distribution is calculated based on the new samples to improve the accuracy of identifying low-frequency abnormal data.

[0021] Therefore, the present invention adopts the above-mentioned automated information security protection method based on AI and blockchain. This method can effectively enhance the ability to resist AI escape attacks and ensure the security of response rules. At the same time, it can improve the accuracy of threat judgment, reduce false alarms and false negatives, and complete the entire protection process without human intervention, thus significantly improving the efficiency of information security protection.

[0022] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0023] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. An automated information security protection method based on AI and blockchain, characterized in that, Includes the following steps: S1. Initialization of data acquisition channel, blockchain environment, AI detection engine and response rules; S2. Collect network layer data, host layer data and application layer data respectively, and generate a standardized dataset after conversion; calculate the hash value of the standardized dataset, and write the anonymized data and hash value into the blockchain for evidence storage; S3. Train the adversarial LSTM model. Based on the standardized dataset in S2, use the trained adversarial LSTM model to detect abnormal data. Combined with blockchain threat intelligence verification, generate the final detection report and store it on the blockchain. The training of the adversarial LSTM model also includes constructing an isolated tree forest, which consists of 100 isolated trees, with each tree having 256 samples and a feature sampling rate of 0.

8. The formula for the anomaly score is defined as follows: ； in, For the sample Average path length in a forest; Number of samples N The average path length constant; Specifically, the detection of outlier data using a trained, anti-training LSTM model is as follows: Input the standardized unified dataset from S2 into the trained LSTM model to obtain the classification probabilities. P abn ;like P abn If the value is ≥0.85, it is marked as "highly suspicious data"; if it is ≤0.6, it is marked as "highly suspicious data". P abn If the score is less than 0.85, input the data into the isolated tree forest to calculate the score; if the score is greater than or equal to 0.7, mark it as "moderately suspicious data"; if the score is less than 0.7, mark it as "lowly suspicious data"; generate a preliminary anomaly report; Specifically, the integration of blockchain threat intelligence verification includes: Send a verification request to the blockchain consensus node to query the malicious IP and malicious process databases in the threat intelligence contract; if the key information matches and the credibility is ≥80%, upgrade to "confirmed threat"; if not matched but... P abn A match confidence level ≥ 0.9 and a score ≥ 0.8 are marked as "suspected zero-day threat"; a match confidence level < 60% is marked as "false positive". S4. Extract the device identifier and user biometrics from the final test report of S3, calculate the hash value of the device identifier and user biometrics respectively, compare the hash value with the hash value recorded on the blockchain, verify the legality of the device and user identity, generate the identity verification result, and write it to the blockchain for storage. S5. Based on the final detection report generated by S3 and the identity verification result generated by S4, perform automated processing actions and iteratively optimize the anti-training LSTM model based on historical data.

2. The automated information security protection method based on AI and blockchain according to claim 1, characterized in that, The blockchain environment initialization in S1 is as follows: Deploy no fewer than 3 consensus nodes and no fewer than 2 storage nodes, enable TLS encrypted communication between nodes, and issue identity certificates through a self-built CA center; Configure the encryption algorithm, and store the private key in the encrypted partition of the server for node signing and contract deployment; Public keys are distributed across the network for data encryption and authentication. Enable the zero-knowledge proof protocol, configure the proof generation time to be no more than 500ms and the verification time to be no more than 100ms, and initialize the on-chain identity registration template.

3. The automated information security protection method based on AI and blockchain according to claim 2, characterized in that, The standardized dataset generated after transformation in S2 also includes data preprocessing and standardization, specifically: The collected dataset is deduplicated. For network data packets with identical source IP, destination IP, and port number at the same timestamp, the record with the longest data packet is retained, and the other duplicates are removed. The moving average method is used to complete the representation of numeric fields as follows: ； in, For fill value, For missing values, The first three timestamps are valid values; For outliers, use 3. The principle for identifying outliers in numeric fields is as follows: ； in, This is an outlier. The average value of the field; Standard deviation; For fields of different magnitudes, Min-Max normalization is used to transform them to the [0,1] interval.

4. The automated information security protection method based on AI and blockchain according to claim 3, characterized in that, In S3, an adversarial LSTM model is trained using standardized data from the past 12 months. Adversarial examples are generated using FGSM, with the following formula: ； in, This is the original sample; The disturbance coefficient; L The loss function; These are model parameters; The true label for the sample.

5. An automated information security protection system based on AI and blockchain, applied to the automated information security protection method based on AI and blockchain as described in any one of claims 1-4, characterized in that, include: The initialization module is used to initialize the data acquisition channel, blockchain environment, AI detection engine, and response rules. A data acquisition and preprocessing module, connected to the initialization module, is used to acquire network layer data, host layer data, and application layer data, and generate a standardized dataset after conversion. Calculate the hash value of the standardized dataset, and write the anonymized data and hash value into the blockchain for evidence storage; The intelligence verification module is connected to the data acquisition and preprocessing module. It is used to train an adversarial training LSTM model. Based on a standardized dataset, it uses the trained adversarial training LSTM model to detect abnormal data. Combined with blockchain threat intelligence verification, it generates a final detection report and stores it on the blockchain. The identity authentication module, connected to the intelligence verification module, is used to extract the device identifier and user biometrics from the final detection report, calculate the hash values ​​of the device identifier and user biometrics respectively, compare the hash values ​​with the hash values ​​recorded on the blockchain, verify the legality of the device and user identities, generate the identity verification result, and write it to the blockchain for storage. An automated response module, connected to the identity authentication module, performs automated processing actions based on the final detection report and identity verification results, and iteratively optimizes the anti-training LSTM model based on historical data.

6. A computer device, characterized in that, include: A processor configured to be coupled to memory, read and execute instructions and / or program code in the memory to perform the method as described in any one of claims 1-4.

7. A computer-readable medium, characterized in that, The computer-readable medium stores computer program code that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1-4.

Images