An artificial intelligence-based network security dynamic evaluation system and method

Abstract

The application discloses a network security dynamic evaluation system and method based on artificial intelligence, and relates to the technical field of network security dynamic evaluation.The method comprises the following steps: extracting network security related data according to a basic collection period; cleaning and preprocessing the obtained network security related data, and extracting features from the cleaned data; constructing a network security evaluation model based on a machine learning algorithm to identify network security risks, analyzing the features of the identified network risks, and screening two models through comparison, wherein the features of the network risks are divided into first and second risk features; calculating the coverage degree proportion of the risk features of the two screened models, and the proportion of the first risk features in the features involved in each model; calculating the comprehensive evaluation scores of each model based on the two proportion results; comparing the comprehensive evaluation scores of the two models; and selecting the model with a higher comprehensive score for network security evaluation, so that the network security dynamic evaluation is realized.

Description

Technical Field

[0001] This invention relates to the field of dynamic network security assessment technology, specifically to a dynamic network security assessment system and method based on artificial intelligence. Background Technology

[0002] With the rapid development of information technology, cybersecurity threats are becoming increasingly complex and diverse. From traditional exploitation of technical vulnerabilities to management deficiencies and human factors, risks such as data leakage and service interruption may occur. To address these threats, cybersecurity assessment technology based on artificial intelligence has gradually become a research hotspot.

[0003] However, traditional network security assessment methods often face the following problems when dealing with complex and ever-changing network environments and the processing and analysis of massive amounts of network data: First, the assessment efficiency is low. Modern network systems are large-scale, generating massive amounts of network traffic data and device status information every moment. Traditional assessment methods rely heavily on human experience or simple rule matching, which results in slow processing speeds and makes real-time assessment difficult in the face of such a large amount of data. Second, existing technologies mostly adopt a uniform processing strategy in feature engineering, without prioritizing high-risk and low-risk features. Finally, when multiple models are available for network security assessment, existing technologies lack a scientific and standardized model selection mechanism, relying too heavily on expert experience. This makes model selection susceptible to the influence of personal subjective preferences, leading to significant differences in assessment results from different experts. Summary of the Invention

[0004] The purpose of this invention is to provide a network security dynamic assessment system and method based on artificial intelligence to solve the problems raised in the prior art.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a dynamic network security assessment method based on artificial intelligence, the method comprising the following steps:

[0006] Extract network security-related data based on the basic data collection cycle;

[0007] The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data.

[0008] A network security assessment model is built based on machine learning algorithms to identify network security risks. The characteristics of the identified network risks are analyzed, and two network security assessment models are selected by comparison. The characteristics of network risks are divided into first and second risk characteristics according to the probability threshold of risk occurrence.

[0009] The coverage percentage of risk features for the two selected models is calculated separately, as well as the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, a comprehensive evaluation score for each model is obtained. The comprehensive evaluation scores of the two models are compared, and the model with the higher comprehensive score is selected for cybersecurity evaluation.

[0010] Based on historical data related to network security, a basic data collection period is determined. Network traffic data and device status data related to network security are then extracted according to this period. Specific steps include:

[0011] Acquire historical data related to cybersecurity, sort it by timestamp to generate a time-series dataset, and mark each data type in a Cartesian coordinate system with the horizontal axis representing the time sequence number and the vertical axis representing the cybersecurity-related data value at the corresponding time. Connect adjacent data points to generate a historical security trend chart. For each historical security trend chart, identify the minimum and maximum values ​​of the cybersecurity-related data values, extract the time intervals between them, sort all time intervals from largest to smallest, and select the minimum value as the basic collection period.

[0012] Based on the basic data collection cycle, network traffic data and device status data related to network security are extracted using traffic monitoring software and system performance monitoring tools. The network traffic data includes the proportion of traffic from different source IPs in the total traffic, the proportion of traffic from TCP / UDP ports in the total traffic, the total number of bytes of traffic in a single basic data collection cycle, the average traffic rate in a single basic data collection cycle, and the number of traffic anomalies. The device status data includes the average CPU utilization and memory usage in a single basic data collection cycle. The collected multi-dimensional data is organized in chronological order into a time-series dataset X={x1,x2,...xn}, where x1,x2,...xn represent the 1st, 2nd,...,nth network security-related data points.

[0013] The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data. Specific steps include:

[0014] The acquired network security-related data is cleaned and preprocessed. When a data value is missing at a certain moment, a time series-based interpolation method is used to fill it in based on the data values ​​of the preceding and following moments. The data format is standardized and all data is stored in a unified database table structure.

[0015] The Min-Max normalization algorithm is used to process the acquired network security-related data, and the data is uniformly mapped to the [0,1] interval;

[0016] Key security features are extracted from the cleaned data to form a feature vector X'={x1',x2',...xe'}, where x1',x2',...xe' represent the normalized values ​​of the 1st, 2nd,...,eth extracted features.

[0017] A network security assessment model is constructed based on machine learning algorithms to identify network security risks. The characteristics of the identified network risks are analyzed, and usable models are determined through comparison. Based on a risk occurrence probability threshold, the characteristics of network risks are divided into first and second risk characteristics. Specific steps include:

[0018] A network security assessment model is constructed based on machine learning algorithms to identify network security risks. The constructed network security assessment model is denoted as (m,w), where m represents the m-th network security assessment model and w represents the network security risk identified by the model. By constructing z network security assessment models, the identification status of the constructed network security assessment models is recorded as {(m1,w1),(m2,w2),...,(mz,wz)}, where (m1,w1),(m2,w2),...,(mz,wz) represent the network security risks w1,w2,...,wz identified by the constructed network security assessment models m1,m2,...,mz, respectively, and z represents the total number of network security assessment models constructed.

[0019] For the cybersecurity risks identified through the cybersecurity assessment model, it was determined through analysis that the cybersecurity risk wa has q technical features. By comparing the constructed cybersecurity assessment model with each of the q technical features of the cybersecurity risk wa, it was determined that the constructed cybersecurity assessment models mi and mj can both be used to identify the cybersecurity risk wa. Here, q represents the number of technical features of the cybersecurity risk wa, wa represents the cybersecurity risk number, and mi and mj represent the i-th and j-th constructed cybersecurity assessment models, respectively.

[0020] The q features of cybersecurity risk wa are divided into first risk feature S1 and second risk feature S2. The first risk feature is defined as the probability of occurrence of some features of cybersecurity risk wa in historical data being greater than or equal to a set risk probability threshold. The second risk feature is defined as the probability of occurrence of some features of cybersecurity risk wa in historical data being less than a set risk probability threshold. S1 represents the set of first risk features and S2 represents the set of second risk features.

[0021] Calculate the coverage percentage of the risk features for the two selected models, and the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, derive a comprehensive evaluation score for each model. Compare the comprehensive evaluation scores of the two models, and select the model with the higher comprehensive score for cybersecurity assessment. Specific steps include:

[0022] Let Ti = {t1(i,j),t2(i,j),...,td(i,j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Ti = {t1(i),t2(i,j),...,tb(i)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Tj = {t1(j),t2(j),...,tc(j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. ), t2(i,j),...,td(i,j) represent the 1st, 2nd,...,dth features used in both network security assessment model mi and network security assessment model mj, respectively; Ti represents the feature set of network security risk wa used in network security assessment model mi; t1(i), t2(i),...,tb(i) represent the features of the 1st, 2nd,...,bth network security risk wa used in network security assessment model mi; Tj represents the feature set of network security risk wa used in network security assessment model mj; t1(j), t2(j),...,tc(j) represent the features of the 1st, 2nd,...,cth network security risk wa used in network security assessment model mj.

[0023] The coverage weight is calculated using the following formula: Ci = (b + d) / q; where Ci represents the proportion of the features specific to the network security assessment model mi in the features of network security risks, b represents the number of features specific to the network security assessment model mi, d represents the number of features used in both network security assessment model mi and network security assessment model mj, and q represents the total number of features of network security risks; similarly, the coverage weight Cj of the network security assessment model mj is calculated.

[0024] The priority weight is calculated using the following formula: Pi = |b∩S1| / b; where Pi represents the ratio of the number of first-risk features among the unique features of network security assessment model mi to the total number of unique features of network security assessment model mi, i.e., the priority weight of network security assessment model mi; similarly, the priority weight Pj of network security assessment model mj is calculated.

[0025] The comprehensive score is calculated by combining coverage weight and priority weight, as defined below: Ri=α*Ci+(1-α)*Pi; where Ri represents the comprehensive score of network security assessment model mi, α ​​represents the weight parameter, 0≤α≤1; similarly, the comprehensive score Rj of network security assessment model mj is calculated.

[0026] When Ri > Rj, select network security assessment model mi for network security risk assessment; when Ri < Rj, select network security assessment model mj for network security risk assessment; when Ri = Rj, select either network security assessment model mi or network security assessment model mj for network security risk assessment.

[0027] An AI-based dynamic cybersecurity assessment system includes a data acquisition module, a data processing module, a risk assessment module, and a model selection module. The data acquisition module determines a basic data collection cycle based on historical cybersecurity data and extracts cybersecurity-related data according to the cycle. The data processing module cleans and preprocesses the acquired cybersecurity-related data, extracting features from the cleaned data. The risk assessment module constructs a cybersecurity assessment model based on machine learning algorithms to identify cybersecurity risks, analyzes the characteristics of the identified risks, and selects two cybersecurity assessment models through comparison. Based on a risk occurrence probability threshold, the network risk features are categorized into first and second risk features. The model selection module calculates the coverage percentage of the risk features for each of the two selected models, as well as the percentage of the first risk feature among the features involved in each model. Based on these percentages, a comprehensive assessment score is derived for each model. The comprehensive assessment scores of the two models are compared, and the model with the higher comprehensive score is selected for cybersecurity assessment.

[0028] The data acquisition module includes a period determination unit and a data collection unit. The period determination unit is used to acquire historical data related to network security, generate a time-series dataset by sorting by timestamp, label the data in a Cartesian coordinate system, draw a historical security trend chart, identify the time intervals corresponding to the minimum and maximum values ​​of the data, and select the minimum value as the basic collection period after sorting. The data collection unit is used to collect network traffic data and device status data according to the basic collection period, using traffic monitoring software and system performance monitoring tools.

[0029] The data processing module includes a preprocessing unit and a feature extraction unit. The preprocessing unit is used to clean and preprocess the collected data, and uses the Min-Max normalization algorithm to uniformly map the data to the [0,1] interval. The feature extraction unit is used to extract key security features from the cleaned data to form a feature vector.

[0030] The risk assessment module includes a model building unit and a risk analysis unit. The model building unit is used to build a network security assessment model based on machine learning algorithms and record the network security risks identified by the built network security assessment model. The risk analysis unit is used to analyze the characteristics of the identified network security risks, determine the risk number and the number of technical features present, and divide the risk features into first risk features and second risk features based on the risk occurrence probability threshold.

[0031] The model selection module includes a weight calculation unit, a comprehensive scoring unit, and a model decision unit. The weight calculation unit is used to determine the distribution set of cybersecurity risk characteristics in the constructed cybersecurity assessment model and calculate the coverage weight and priority weight. The comprehensive scoring unit is used to combine the coverage weight and priority weight and calculate the comprehensive score of the constructed cybersecurity assessment model according to the set weight parameters. The model decision unit is used to compare the comprehensive scores of different models and select the model with the higher comprehensive score for cybersecurity assessment.

[0032] Compared with the prior art, the beneficial effects of the present invention are:

[0033] 1. This invention constructs a quantitative model selection engine and combines a scoring mechanism that considers the breadth of coverage and risk priority to dynamically recommend assessment models for cybersecurity assessments. Unlike existing technologies that rely on subjective selection based on expert experience, this invention makes decisions based on objective calculation formulas.

[0034] 2. This invention classifies risk characteristics by combining historical threat occurrence probabilities with real-time threat situations to divide them into high-risk and low-risk characteristics, thereby improving the detection efficiency of high-risk vulnerabilities while avoiding over-responding to low-risk characteristics. Attached Figure Description

[0035] Figure 1 This is a flowchart illustrating an artificial intelligence-based dynamic network security assessment method according to the present invention.

[0036] Figure 2 This is a schematic diagram of the structure of a network security dynamic assessment system based on artificial intelligence according to the present invention. Detailed Implementation

[0037] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0038] In the embodiment: such as Figures 1-2 As shown, this invention provides a technical solution: a dynamic network security assessment method based on artificial intelligence, which includes the following steps:

[0039] Extract network security-related data based on the basic data collection cycle;

[0040] The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data.

[0041] A network security assessment model is built based on machine learning algorithms to identify network security risks. The characteristics of the identified network risks are analyzed, and two network security assessment models are selected by comparison. The characteristics of network risks are divided into first and second risk characteristics according to the probability threshold of risk occurrence.

[0042] The coverage percentage of risk features for the two selected models is calculated separately, as well as the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, a comprehensive evaluation score for each model is obtained. The comprehensive evaluation scores of the two models are compared, and the model with the higher comprehensive score is selected for cybersecurity evaluation.

[0043] Based on historical data related to network security, a basic data collection period is determined. Network traffic data and device status data related to network security are then extracted according to this period. Specific steps include:

[0044] Acquire historical data related to cybersecurity, sort it by timestamp to generate a time-series dataset, and mark each data type in a Cartesian coordinate system with the horizontal axis representing the time sequence number and the vertical axis representing the cybersecurity-related data value at the corresponding time. Connect adjacent data points to generate a historical security trend chart. For each historical security trend chart, identify the minimum and maximum values ​​of the cybersecurity-related data values, extract the time intervals between them, sort all time intervals from largest to smallest, and select the minimum value as the basic collection period.

[0045] Based on the basic data collection cycle, network traffic data and device status data related to network security are extracted using traffic monitoring software and system performance monitoring tools. The network traffic data includes the proportion of traffic from different source IPs in the total traffic, the proportion of traffic from TCP / UDP ports in the total traffic, the total number of bytes of traffic in a single basic data collection cycle, the average traffic rate in a single basic data collection cycle, and the number of traffic anomalies. The device status data includes the average CPU utilization and memory usage in a single basic data collection cycle. The collected multi-dimensional data is organized in chronological order into a time-series dataset X={x1,x2,...xn}, where x1,x2,...xn represent the 1st, 2nd,...,nth network security-related data points.

[0046] Specifically, historical network security data related to the enterprise over the past 30 days was collected, including network traffic data and device status data. The data was recorded with timestamps accurate to the minute, recording information such as traffic from different source IPs, TCP / UDP port traffic, CPU utilization, and memory usage every minute. The collected data was sorted by timestamp to generate a time-series dataset. Taking the total number of bytes in network traffic as an example, in a Cartesian coordinate system, the horizontal axis represents the time sequence number (one number per minute), and the vertical axis represents the total number of bytes of traffic at the corresponding moment. Adjacent data points were connected to generate a historical security trend chart. Each historical security trend chart was analyzed to identify the minimum and maximum values ​​of network security related data. In the trend chart of the total number of bytes of traffic on a certain day, the minimum value corresponds to the time 9:30, and the maximum value corresponds to the time 14:00. The time interval between the two was extracted as 4.5 hours. The same operation was performed on the historical security trend charts generated for all data types (such as the traffic share of different source IPs, the traffic share of TCP / UDP ports, the average CPU utilization, etc.) to obtain multiple time intervals. These time intervals were sorted from largest to smallest, and the minimum value was selected as the basic collection period.

[0047] According to the basic collection cycle, traffic monitoring software and system performance monitoring tools were used to collect data. Within one collection cycle, the collected network traffic data is as follows: the proportion of traffic from different source IPs in the total traffic, it was found that traffic from the 192.168.1.0 / 24 network segment in the office area accounted for 30% of the total traffic; the proportion of TCP / UDP port traffic in the total traffic, of which port 80 (HTTP service) traffic accounted for 20% of the total traffic and port 443 (HTTPS service) traffic accounted for 15% of the total traffic; the total number of bytes of traffic in a single basic collection cycle was 50GB; the average traffic rate in a single basic collection cycle was 139MB / s; there were 5 instances of traffic anomalies, mainly manifested as a certain IP sending more packets than the average number of packets sent over a period of time in a short period of time; within the same collection cycle, the collected device status data is as follows: the average CPU utilization rate in a single basic collection cycle was 40%, and the memory utilization rate was 60%; the collected multi-dimensional data was organized in chronological order into a time-series dataset X.

[0048] The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data. Specific steps include:

[0049] The acquired network security-related data is cleaned and preprocessed. When a data value is missing at a certain moment, a time series-based interpolation method is used to fill it in based on the data values ​​of the preceding and following moments. The data format is standardized and all data is stored in a unified database table structure.

[0050] The Min-Max normalization algorithm is used to process the acquired network security-related data, and the data is uniformly mapped to the [0,1] interval;

[0051] Key security features are extracted from the cleaned data to form a feature vector X'={x1',x2',...xe'}, where x1',x2',...xe' represent the normalized values ​​of the 1st, 2nd,...,eth extracted features.

[0052] A network security assessment model is constructed based on machine learning algorithms to identify network security risks. The characteristics of the identified network risks are analyzed, and usable models are determined through comparison. Based on a risk occurrence probability threshold, the characteristics of network risks are divided into first and second risk characteristics. Specific steps include:

[0053] A network security assessment model is constructed based on machine learning algorithms to identify network security risks. The constructed network security assessment model is denoted as (m,w), where m represents the m-th network security assessment model and w represents the network security risk identified by the model. By constructing z network security assessment models, the identification status of the constructed network security assessment models is recorded as {(m1,w1),(m2,w2),...,(mz,wz)}, where (m1,w1),(m2,w2),...,(mz,wz) represent the network security risks w1,w2,...,wz identified by the constructed network security assessment models m1,m2,...,mz, respectively, and z represents the total number of network security assessment models constructed.

[0054] For the cybersecurity risks identified through the cybersecurity assessment model, it was determined through analysis that the cybersecurity risk wa has q technical features. By comparing the constructed cybersecurity assessment model with each of the q technical features of the cybersecurity risk wa, it was determined that the constructed cybersecurity assessment models mi and mj can both be used to identify the cybersecurity risk wa. Here, q represents the number of technical features of the cybersecurity risk wa, wa represents the cybersecurity risk number, and mi and mj represent the i-th and j-th constructed cybersecurity assessment models, respectively.

[0055] The q features of cybersecurity risk wa are divided into first risk feature S1 and second risk feature S2. The first risk feature is defined as the probability of occurrence of some features of cybersecurity risk wa in historical data being greater than or equal to a set risk probability threshold. The second risk feature is defined as the probability of occurrence of some features of cybersecurity risk wa in historical data being less than a set risk probability threshold. S1 represents the set of first risk features and S2 represents the set of second risk features.

[0056] Specifically, 10 network security assessment models, denoted as {(m1,w1),(m2,w2),...,(m10,w10)}, were constructed based on machine learning algorithms (such as the random forest algorithm). After training and testing, these models showed varying degrees of success in identifying network security risks. For example, model m1 identified three network security risks, including port scanning risk, malware propagation risk, and data leakage risk; model m2 identified two network security risks, namely DDoS attack risk and account brute-force attack risk.

[0057] After analysis, it was determined that the current network security risk wa has 8 technical characteristics, such as abnormal traffic patterns, specific malware signatures, and the use of weak passwords. The 10 network security assessment models were compared with the 8 technical characteristics of network security risk wa one by one, and it was determined that the constructed network security assessment models m3 and m7 can be used to identify network security risk wa.

[0058] Based on historical data, the probability of occurrence of eight characteristics of network security risk wa was calculated. A risk probability threshold of 0.5 was set, and the risk characteristics were divided into first risk characteristic S1 and second risk characteristic S2. The probability of occurrence of characteristics 1, 3, and 5 were 0.7, 0.6, and 0.8, respectively, which were greater than the threshold and belonged to first risk characteristic S1. The probability of occurrence of characteristics 2, 4, 6, 7, and 8 were 0.3, 0.4, 0.2, 0.1, and 0.4, respectively, which were less than the threshold and belonged to second risk characteristic S2.

[0059] Calculate the coverage percentage of the risk features for the two selected models, and the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, derive a comprehensive evaluation score for each model. Compare the comprehensive evaluation scores of the two models, and select the model with the higher comprehensive score for cybersecurity assessment. Specific steps include:

[0060] Let Ti = {t1(i,j),t2(i,j),...,td(i,j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Ti = {t1(i),t2(i,j),...,tb(i)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Tj = {t1(j),t2(j),...,tc(j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. ), t2(i,j),...,td(i,j) represent the 1st, 2nd,...,dth features used in both network security assessment model mi and network security assessment model mj, respectively; Ti represents the feature set of network security risk wa used in network security assessment model mi; t1(i), t2(i),...,tb(i) represent the features of the 1st, 2nd,...,bth network security risk wa used in network security assessment model mi; Tj represents the feature set of network security risk wa used in network security assessment model mj; t1(j), t2(j),...,tc(j) represent the features of the 1st, 2nd,...,cth network security risk wa used in network security assessment model mj.

[0061] The coverage weight is calculated using the following formula: Ci = (b + d) / q; where Ci represents the proportion of the features specific to the network security assessment model mi in the features of network security risks, b represents the number of features specific to the network security assessment model mi, d represents the number of features used in both network security assessment model mi and network security assessment model mj, and q represents the total number of features of network security risks; similarly, the coverage weight Cj of the network security assessment model mj is calculated.

[0062] The priority weight is calculated using the following formula: Pi = |b∩S1| / b; where Pi represents the ratio of the number of first-risk features among the unique features of network security assessment model mi to the total number of unique features of network security assessment model mi, i.e., the priority weight of network security assessment model mi; similarly, the priority weight Pj of network security assessment model mj is calculated.

[0063] The comprehensive score is calculated by combining coverage weight and priority weight, as defined below: Ri=α*Ci+(1-α)*Pi; where Ri represents the comprehensive score of network security assessment model mi, α ​​represents the weight parameter, 0≤α≤1; similarly, the comprehensive score Rj of network security assessment model mj is calculated.

[0064] When Ri > Rj, select network security assessment model mi for network security risk assessment; when Ri < Rj, select network security assessment model mj for network security risk assessment; when Ri = Rj, select either network security assessment model mi or network security assessment model mj for network security risk assessment.

[0065] Specifically, the distribution sets of features in network security risk wa in models m3 and m7 are determined. The feature set T37={t1(3,7),t2(3,7),t3(3,7)} used for both network security assessment model m3 and network security assessment model m7 contains 3 features; the feature set T3={t1(3),t2(3),t3(3),t4(3),t5(3)} used for network security assessment model m3 contains 5 features; and the feature set T7={t1(7),t2(7),t3(7),t4(7)} used for network security assessment model m7 contains 4 features.

[0066] Calculate the coverage weights: The total number of features of cybersecurity risks is q=8, the coverage weight of model m3 is C3=(5+3) / 8=1; the coverage weight of model m7 is C7=(4+3) / 8=0.875;

[0067] If the number of features belonging to the first risk feature in model m3 is 1, then the priority weight P3 of model m3 is 0.2; if the number of features belonging to the first risk feature in model m7 is 3, then the priority weight P7 of model m7 is 0.75.

[0068] With the weight parameter α=0.6, the overall score R3 of model m3 is 0.68; the overall score R7 of model m7 is 0.825.

[0069] Comparing the overall scores of the two models, since R7 > R3, the network security assessment model m7 is selected for network security risk assessment.

[0070] An AI-based dynamic cybersecurity assessment system includes a data acquisition module, a data processing module, a risk assessment module, and a model selection module. The data acquisition module determines the basic data collection cycle based on historical cybersecurity data and extracts cybersecurity-related data according to the cycle. The data processing module cleans and preprocesses the acquired cybersecurity-related data, extracting features from the cleaned data. The risk assessment module constructs a cybersecurity assessment model based on machine learning algorithms to identify cybersecurity risks, analyzes the characteristics of the identified risks, and selects two cybersecurity assessment models through comparison. Based on a risk occurrence probability threshold, the network risk features are categorized into first and second risk features. The model selection module calculates the coverage percentage of the risk features for each of the two selected models, as well as the percentage of the first risk feature among the features involved in each model. Based on these percentages, a comprehensive assessment score is derived for each model. The comprehensive assessment scores of the two models are compared, and the model with the higher comprehensive score is selected for cybersecurity assessment.

[0071] The data acquisition module includes a period determination unit and a data collection unit. The period determination unit is used to acquire historical data related to network security, generate time-series datasets by sorting by timestamps, label the data in a Cartesian coordinate system, draw historical security trend charts, identify the time intervals corresponding to the minimum and maximum values ​​of the data, and select the minimum value as the basic collection period after sorting. The data collection unit is used to collect network traffic data and device status data according to the basic collection period, using traffic monitoring software and system performance monitoring tools.

[0072] The data processing module includes a preprocessing unit and a feature extraction unit. The preprocessing unit is used to clean and preprocess the collected data, and uses the Min-Max normalization algorithm to uniformly map the data to the [0,1] interval. The feature extraction unit is used to extract key security features from the cleaned data to form feature vectors.

[0073] The risk assessment module includes a model building unit and a risk analysis unit. The model building unit is used to build a cybersecurity assessment model based on machine learning algorithms and record the identification of cybersecurity risks by the constructed cybersecurity assessment model. The risk analysis unit is used to analyze the characteristics of the identified cybersecurity risks, determine the risk number and the number of technical features present, and classify the risk features into first risk features and second risk features based on the risk occurrence probability threshold.

[0074] The model selection module includes a weight calculation unit, a comprehensive scoring unit, and a model decision unit. The weight calculation unit is used to determine the distribution set of cybersecurity risk characteristics in the constructed cybersecurity assessment model and calculate the coverage weight and priority weight. The comprehensive scoring unit is used to combine the coverage weight and priority weight and calculate the comprehensive score of the constructed cybersecurity assessment model according to the set weight parameters. The model decision unit is used to compare the comprehensive scores of different models and select the model with the higher comprehensive score for cybersecurity assessment.

[0075] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A dynamic cybersecurity assessment method based on artificial intelligence, characterized in that: The method includes the following steps: Extract network security-related data based on the basic data collection cycle; The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data. A network security assessment model is built based on machine learning algorithms to identify network security risks. The characteristics of the identified network risks are analyzed, and two network security assessment models are selected by comparison. The characteristics of network risks are divided into first and second risk characteristics according to the probability threshold of risk occurrence. A network security assessment model is constructed based on machine learning algorithms to identify network security risks. The constructed network security assessment model is denoted as (m,w), where m represents the m-th network security assessment model and w represents the network security risk identified by the model. By constructing z network security assessment models, the identification status of the constructed network security assessment models is recorded as {(m1,w1),(m2,w2),...,(mz,wz)}, where (m1,w1),(m2,w2),...,(mz,wz) represent the network security risks w1,w2,...,wz identified by the constructed network security assessment models m1,m2,...,mz, respectively, and z represents the total number of network security assessment models constructed. For the cybersecurity risks identified through the cybersecurity assessment model, it was determined through analysis that the cybersecurity risk wa has q technical features. By comparing the constructed cybersecurity assessment model with each of the q technical features of the cybersecurity risk wa, it was determined that the constructed cybersecurity assessment models mi and mj can both be used to identify the cybersecurity risk wa. Here, q represents the number of technical features of the cybersecurity risk wa, wa represents the cybersecurity risk number, and mi and mj represent the i-th and j-th constructed cybersecurity assessment models, respectively. The q features of the network security risk wa are divided into first risk feature S1 and second risk feature S2. The first risk feature is defined as the probability of occurrence of some features of the network security risk wa in the historical data being greater than or equal to a set risk probability threshold. The second risk feature is defined as the probability of occurrence of some features of the network security risk wa in the historical data being less than a set risk probability threshold. S1 represents the set of first risk features and S2 represents the set of second risk features. The coverage percentage of risk features for the two selected models is calculated separately, as well as the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, a comprehensive evaluation score for each model is obtained. The comprehensive evaluation scores of the two models are compared, and the model with the higher comprehensive score is selected for cybersecurity evaluation.

2. The method for dynamic assessment of network security based on artificial intelligence according to claim 1, characterized in that: Based on historical data related to network security, a basic data collection period is determined. Network traffic data and device status data related to network security are then extracted according to this period. Specific steps include: Acquire historical data related to cybersecurity, sort it by timestamp to generate a time-series dataset, and mark each data type in a Cartesian coordinate system with the horizontal axis representing the time sequence number and the vertical axis representing the cybersecurity-related data value at the corresponding time. Connect adjacent data points to generate a historical security trend chart. For each historical security trend chart, identify the minimum and maximum values ​​of the cybersecurity-related data values, extract the time intervals between them, sort all time intervals from largest to smallest, and select the minimum value as the basic collection period. Based on the basic data collection cycle, network traffic data and device status data related to network security are extracted using traffic monitoring software and system performance monitoring tools. The network traffic data includes the proportion of traffic from different source IPs in the total traffic, the proportion of traffic from TCP / UDP ports in the total traffic, the total number of bytes of traffic in a single basic data collection cycle, the average traffic rate in a single basic data collection cycle, and the number of traffic anomalies. The device status data includes the average CPU utilization and memory usage in a single basic data collection cycle. The collected multi-dimensional data is organized in chronological order into a time-series dataset X={x1,x2,...xn}, where x1,x2,...xn represent the 1st, 2nd,...,nth network security-related data points.

3. The method for dynamic assessment of network security based on artificial intelligence according to claim 2, characterized in that: The acquired cybersecurity-related data is cleaned and preprocessed, and features are extracted from the cleaned data. Specific steps include: The acquired network security-related data is cleaned and preprocessed. When a data value is missing at a certain moment, a time series-based interpolation method is used to fill it in based on the data values ​​of the preceding and following moments. The data format is standardized and all data is stored in a unified database table structure. The Min-Max normalization algorithm is used to process the acquired network security-related data, and the data is uniformly mapped to the [0,1] interval; Key security features are extracted from the cleaned data to form a feature vector X'={x1',x2',...xe'}, where x1',x2',...xe' represent the normalized values ​​of the 1st, 2nd,...,eth extracted features.

4. The method for dynamic assessment of network security based on artificial intelligence according to claim 3, characterized in that: Calculate the coverage percentage of the risk features for the two selected models, and the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, derive a comprehensive evaluation score for each model. Compare the comprehensive evaluation scores of the two models, and select the model with the higher comprehensive score for cybersecurity assessment. Specific steps include: Let Ti = {t1(i,j),t2(i,j),...,td(i,j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Ti = {t1(i),t2(i,j),...,tb(i)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. Let Tj = {t1(j),t2(j),...,tc(j)} be the feature set of network security risk wa used in both network security assessment model mi and network security assessment model mj. ), t2(i,j),...,td(i,j) represent the 1st, 2nd,...,dth features used in both network security assessment model mi and network security assessment model mj, respectively; Ti represents the feature set of network security risk wa used in network security assessment model mi; t1(i), t2(i),...,tb(i) represent the features of the 1st, 2nd,...,bth network security risk wa used in network security assessment model mi; Tj represents the feature set of network security risk wa used in network security assessment model mj; t1(j), t2(j),...,tc(j) represent the features of the 1st, 2nd,...,cth network security risk wa used in network security assessment model mj. The coverage weight is calculated using the following formula: Ci = (b + d) / q; where Ci represents the proportion of the features specific to the network security assessment model mi in the features of network security risks, b represents the number of features specific to the network security assessment model mi, d represents the number of features used in both network security assessment model mi and network security assessment model mj, and q represents the total number of features of network security risks; similarly, the coverage weight Cj of the network security assessment model mj is calculated. The priority weight is calculated using the following formula: Pi = |b∩S1| / b; where Pi represents the ratio of the number of first-risk features among the unique features of network security assessment model mi to the total number of unique features of network security assessment model mi, i.e., the priority weight of network security assessment model mi; similarly, the priority weight Pj of network security assessment model mj is calculated. The comprehensive score is calculated by combining coverage weight and priority weight, as defined below: Ri=α*Ci+(1-α)*Pi; where Ri represents the comprehensive score of network security assessment model mi, α ​​represents the weight parameter, 0≤α≤1; similarly, the comprehensive score Rj of network security assessment model mj is calculated. When Ri > Rj, select network security assessment model mi for network security risk assessment; when Ri < Rj, select network security assessment model mj for network security risk assessment; when Ri = Rj, select either network security assessment model mi or network security assessment model mj for network security risk assessment.

5. An AI-based dynamic network security assessment system, applied to the AI-based dynamic network security assessment method described in any one of claims 1-4, characterized in that: The system includes a data acquisition module, a data processing module, a risk assessment module, and a model selection module. The data acquisition module determines a basic data collection cycle based on historical network security data and extracts network security-related data according to the basic collection cycle. The data processing module cleans and preprocesses the acquired network security-related data and extracts features from the cleaned data. The risk assessment module constructs a network security assessment model based on machine learning algorithms to identify network security risks, analyzes the characteristics of the identified network risks, and selects two network security assessment models through comparison. Based on a risk occurrence probability threshold, the network risk features are divided into first and second risk features. The model selection module calculates the coverage percentage of the risk features for each of the two selected models, as well as the percentage of the first risk feature among the features involved in each model. Based on the calculated percentages, a comprehensive assessment score for each model is obtained. The comprehensive assessment scores of the two models are compared, and the model with the higher comprehensive score is selected for network security assessment.

6. The AI-based dynamic network security assessment system according to claim 5, characterized in that: The data acquisition module includes a period determination unit and a data collection unit. The period determination unit is used to acquire historical data related to network security, generate a time series dataset by sorting by timestamp, mark the data in a Cartesian coordinate system, draw a historical security trend chart, identify the time intervals corresponding to the minimum and maximum values ​​of the data, and select the minimum value as the basic collection period after sorting. The data acquisition unit is used to collect network traffic data and device status data according to a basic acquisition cycle, using traffic monitoring software and system performance monitoring tools.

7. The AI-based dynamic network security assessment system according to claim 6, characterized in that: The data processing module includes a preprocessing unit and a feature extraction unit. The preprocessing unit is used to clean and preprocess the collected data, and uses the Min-Max normalization algorithm to uniformly map the data to the [0,1] interval. The feature extraction unit is used to extract key security features from the cleaned data to form a feature vector.

8. The AI-based dynamic network security assessment system according to claim 7, characterized in that: The risk assessment module includes a model building unit and a risk analysis unit. The model building unit is used to build a cybersecurity assessment model based on machine learning algorithms and record the identification of cybersecurity risks by the constructed cybersecurity assessment model. The risk analysis unit is used to analyze the characteristics of the identified cybersecurity risks. Determine the risk number and the number of technical features present, and classify the risk features into first risk features and second risk features based on the risk occurrence probability threshold.

9. The AI-based dynamic network security assessment system according to claim 8, characterized in that: The model selection module includes a weight calculation unit, a comprehensive scoring unit, and a model decision unit. The weight calculation unit is used to determine the distribution set of cybersecurity risk characteristics in the constructed cybersecurity assessment model and calculate the coverage weight and priority weight. The comprehensive scoring unit is used to combine the coverage weight and priority weight and calculate the comprehensive score of the constructed cybersecurity assessment model according to the set weight parameters. The model decision unit is used to compare the comprehensive scores of different models and select the model with the higher comprehensive score for cybersecurity assessment.

Images