Network security vulnerability detection method and system based on artificial intelligence

Abstract

The invention provides a network security vulnerability detection method and system based on artificial intelligence, and relates to the technical field of network security. The method comprises the following steps: identifying abnormal traffic characteristics, and obtaining a core interaction area of a target network and network security detection equipment; constructing a to-be-detected module set based on the core interaction area; determining a detection association score between any two adjacent sub-modules in the to-be-detected module set, and constructing a detection association graph; based on the detection association graph, determining an optimal path by adopting a graph theory algorithm, and determining a detection adjustment sequence of each sub-module in the to-be-detected module set according to the optimal path; and according to the detection adjustment sequence, constructing a feature parameter sequence, inputting an intelligent detection model to generate a detection strategy, and issuing the detection strategy to each sub-module for execution. According to the invention, through multi-module dynamic cooperation driven by artificial intelligence and optimal path planning, high efficiency and accuracy of network security vulnerability detection and rapid adaptation to a complex attack scene are realized.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a network security vulnerability detection method and system based on artificial intelligence. Background Technology

[0002] With the rapid development of internet technology, network application scenarios are becoming increasingly complex, and cybersecurity threats are exhibiting diversified, intelligent, and covert characteristics. Network attack methods have evolved from exploiting traditional single vulnerabilities to multi-dimensional, collaborative attack models, placing higher demands on vulnerability detection technologies.

[0003] Traditional methods utilize signature databases to match known vulnerabilities, with rule engines triggering detection operations based on preset conditions, such as issuing alerts for specific port traffic or abnormal login behavior. Some AI-based solutions optimize vulnerability identification accuracy by analyzing single data sources (such as network traffic) using machine learning algorithms, but they do not address the dynamic collaboration of multiple detection modules. In these solutions, the order in which detection modules are called is fixed; regardless of the attack scenario, detection is performed according to a preset process, without considering the correlation between modules or the specificity of the attack scenario.

[0004] Existing technologies have significant limitations: First, traditional methods rely on signature databases and fixed rules, resulting in a delayed response to new vulnerabilities and variant attacks, with signature database updates failing to keep pace with the emergence of vulnerabilities. Second, centralized architectures suffer from high detection latency and resource consumption when processing large-scale network data, making it difficult to meet real-time detection requirements. Third, the use of fixed detection processes ignores the correlation and synergy between modules in different attack scenarios, leading to resource waste or delays in the detection of critical modules. For example, in Web attack scenarios, all modules are still detected in a fixed order, reducing efficiency. Fourth, some AI solutions only optimize a single module, lacking multi-module collaborative scheduling and overall path optimization, making it difficult to leverage the advantages of AI in complex scenarios. The detection process contains redundant operations, limiting efficiency and accuracy. Summary of the Invention

[0005] To address the technical problems in existing network security vulnerability detection technologies, such as reliance on fixed rules, delayed response to new attacks, low efficiency of centralized architecture, lack of multi-module collaborative scheduling, and insufficient application of artificial intelligence technology, this invention provides a network security vulnerability detection method and system based on artificial intelligence. By dynamically dividing detection modules, optimizing the detection order, and collaborative scheduling, it improves the targeting, efficiency, and accuracy of vulnerability detection, and adapts to diverse attack scenarios in complex network environments.

[0006] To achieve the above objectives, the technical solution adopted by this invention is: a network security vulnerability detection method based on artificial intelligence, the method comprising: Identify abnormal traffic characteristics and obtain the core interaction area between the target network and network security detection equipment; Based on the core interaction area, construct a set of modules to be detected; Determine the detection association score between any two adjacent sub-modules in the set of modules to be detected, and construct a detection association graph; Based on the detection association graph, a graph theory algorithm is used to determine the optimal path, and the detection adjustment order of each sub-module in the set of modules to be detected is determined according to the optimal path; According to the detection and adjustment sequence, a sequence of feature parameters is constructed, input into the intelligent detection model to generate a detection strategy, and then distributed to each sub-module for execution.

[0007] On the other hand, the present invention also provides an artificial intelligence-based network security vulnerability detection system, which includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the system is triggered to execute the above-mentioned artificial intelligence-based network security vulnerability detection method.

[0008] Compared with the prior art, the beneficial effects of the present invention are: 1. Improve testing efficiency and resource utilization. By dynamically dividing the detection modules, constructing a detection association graph, and using Dijkstra's algorithm to optimize the detection path, this method achieves multi-module collaborative scheduling and overall path optimization. It avoids the high latency and resource consumption issues of traditional centralized architectures, while reducing redundant operations in fixed detection processes, significantly improving detection efficiency.

[0009] 2. Enhance real-time response capabilities to new types of attacks. Traditional methods rely on signature databases and fixed rules, resulting in delayed responses to new vulnerabilities and variant attacks. This invention uses artificial intelligence technology to analyze abnormal traffic characteristics in real time, combined with a dynamic detection strategy generation mechanism, enabling rapid adaptation to unknown attack scenarios and solving the problem that traditional solutions cannot keep up with the speed of vulnerability emergence.

[0010] 3. Improve the targeting and accuracy of detection strategies. This invention dynamically adjusts the calling order and coordination method of detection modules according to the attack scenario, and generates targeted strategies through an intelligent detection model, avoiding the limitations of some artificial intelligence solutions that only optimize a single module. This method ensures the priority detection of key modules while reducing interference from unnecessary modules, thereby improving overall detection accuracy.

[0011] 4. Supports diverse attack scenarios in complex network environments. Traditional methods are inadequate when facing multi-dimensional and collaborative attack patterns. However, this invention, through dynamic collaboration of multiple modules and path optimization, can flexibly respond to complex scenarios such as Web attacks and DDoS attacks, and solves the problem of fixed detection processes ignoring module correlation and the specificity of attack scenarios.

[0012] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0013] Figure 1 This is a flowchart of the artificial intelligence-based network security vulnerability detection method according to the present invention. Detailed Implementation

[0014] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings, so as to more clearly understand the purpose, features and advantages of this invention. It should be understood that the embodiments shown in the drawings are not intended to limit the scope of this invention, but are only for illustrating the essential spirit of the technical solutions of this invention. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0015] Unless the context requires otherwise, throughout the specification and claims, the word “comprising” and its variations, such as “including” and “having”, shall be understood to have an open, inclusive meaning, that is, to be interpreted as “including, but not limited to”.

[0016] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0017] The singular forms “a” and “the” used in this specification and the appended claims include plural references unless otherwise expressly stated herein. It should be noted that the term “or” is generally used to mean “and / or” unless otherwise expressly stated herein.

[0018] In the following description, in order to clearly demonstrate the structure and working method of the present invention, a number of directional terms will be used. However, terms such as "front", "back", "left", "right", "outside", "inside", "outward", "inward", "up", and "down" should be understood as convenient terms and not as limiting terms.

[0019] The implementation details of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. The following content is only for the convenience of understanding the implementation details and is not necessary for implementing this solution.

[0020] refer to Figure 1 This invention provides an artificial intelligence-based method for detecting cybersecurity vulnerabilities, which specifically includes: S1. Identify abnormal traffic characteristics and obtain the core interaction area between the target network and network security detection equipment.

[0021] In a network security protection system, accurately identifying the interaction area between the target network and network security detection equipment is crucial for effective vulnerability detection. Network security detection equipment, through its built-in traffic acquisition unit, captures all data packets from the target network in real time. Based on a pre-set attack signature database (such as a DDoS attack signature database), it uses traffic feature extraction algorithms to analyze the IP source address, connection frequency, and data exchange volume of these data packets to identify abnormal traffic characteristics. For example, in a Distributed Denial of Service (DDoS) attack scenario, detecting a large number of high-frequency TCP connection requests from different IP source addresses (a single IP connection frequency exceeding 500 times / second, with no effective data transmission after connection establishment) on the target network matches the typical characteristics of a DDoS attack.

[0022] Based on the identified abnormal traffic characteristics, the regions that interacted with the detection device within a specified time period are statistically recorded, including traffic access ports, data forwarding modules, and bandwidth monitoring modules. Simultaneously, data such as the interaction duration, total data transmission volume, and connection failure rate of each region are collected. These interaction regions are categorized into corresponding attack type interaction region sets. The categorization method involves the detection device calling pre-stored attack type standard intervals in a configuration file to locate the standard interval corresponding to the attack type (this interval includes core characteristic descriptions such as multi-source IP distribution dispersion ≥90%, high concurrent connection count ≥10,000 connections / minute, and bandwidth usage surge ≥80%). The statistically collected interaction region data is compared one by one with the characteristics of the attack type standard intervals. If the attack behavior within the interaction region fully matches the attack type characteristics, the interaction region is then assigned to the corresponding attack type interaction region set, completing the categorization operation.

[0023] Next, the scene identification module of the network security detection equipment, combined with real-time monitoring data (such as the current target network bandwidth utilization reaching 90%, the average latency for normal user access exceeding 3 seconds, and the connection failure rate reaching 65%), further confirms the attack scenario currently being suffered by the target network. From the categorized set of interaction areas, areas matching the current attack scenario are filtered out. For example, since the bandwidth monitoring module is only a data statistics area and does not directly bear the impact of attacks, this module is excluded. Finally, the interaction areas covered by the set (traffic access ports + data forwarding modules) are determined as the core interaction areas, providing a basis for subsequent sub-module division.

[0024] S2. Based on the core interaction area, construct a set of modules to be detected.

[0025] Based on the attack scenario of the target network, the detection sub-modules covered by the core interaction area are divided into detection primary sub-modules and detection secondary sub-modules. In the detection sub-modules not covered by the core interaction area, environmental detection sub-modules are identified. These sub-modules together constitute the set of modules to be detected.

[0026] Specifically, the scene recognition module of the network security detection equipment performs in-depth analysis of abnormal request data from the target network, such as detecting multiple requests containing... <script>恶意标签、onclick恶意事件的HTTP请求，结合请求来源、目标URL等信息，判定当前攻击场景。基于攻击场景的典型路径（攻击者注入恶意脚本→用户输入处理模块接收并传递→网页渲染引擎执行脚本），明确该攻击场景下的主导检测部位和次要检测部位，其中，主导检测部位是在特定攻击场景下，处于攻击核心环节所对应的检测区域或检测功能点。它是整个攻击路径中最关键、最能体现攻击意图和特征的部分，对准确识别和判定该攻击场景起着决定性作用；次要检测部位是在特定攻击场景下，相对于主导检测部位而言，处于攻击路径中非核心环节的检测区域或检测功能点。它虽然不是攻击的核心，但与攻击行为存在一定的关联，能够为全面、深入地了解攻击情况提供辅助信息。

[0027] 在确定的核心交互区域内，依据检测部位的功能辐射范围划定作用区间。其中，对应主导检测部位划定为第一作用区间，对应次要检测部位划定为第二作用区间。网络安全检测设备查询内置的子模块拓扑配置文件，根据作用区间与子模块的对应关系，将第一作用区间内的对应子模块判定为检测主导子模块；将第二作用区间内的对应子模块判定为检测次要子模块，形成初步的待检测模块子集。

[0028] 接下来，确定环境检测子模块，包括如下步骤：1）辅助数量设置：网络安全检测设备根据攻击场景的技术特性（如攻击多通过异常数据覆盖内存缓冲区，需结合内存状态、指令执行环境综合检测），参考历史检测数据中该类攻击的环境影响范围，为检测主导子模块设置第一辅助数量，为检测次要子模块设置第二辅助数量，辅助数量的设定确保环境检测能全面覆盖核心模块的运行环境。

[0029] 2）相邻模块筛选：网络安全检测设备调用子模块拓扑图，识别核心交互区域未覆盖的子模块，通过判断子模块间是否存在直接数据链路（单位时间内数据交互频次≥10次）确定相邻关系。在未覆盖子模块中，选取与检测主导子模块相邻的一或多个子模块，作为环境检测子模块；选取与检测次要子模块相邻的一或多个子模块，补充至环境检测子模块。

[0030] 3）集合构成：整合检测主导子模块、检测次要子模块及上述一或多个环境检测子模块，形成完整的待检测模块集合，同时记录各子模块的唯一标识符、功能描述及模块间的关联关系，存储至临时数据库供后续调用。

[0031] S3、确定待检测模块集合中任意两个相邻子模块之间的检测关联分值，构建检测关联图。

[0032] 通过提取相邻子模块的同一维度检测参数，计算参数差值，并根据中位数划分差值区间，查询预设分值表确定检测关联分值。以待检测模块集合中的子模块为顶点，检测关联分值为连接顶点之间的边，构建待检测模块集合的检测关联图，具体包括：1）模块类型识别：网络安全检测设备通过子模块类型查询接口，读取待检测模块集合中相邻的各个子模块的类型标识，明确各个子模块的类型属性；例如：输入过滤子模块的类型标签为"主导-输入处理”，判定为检测主导子模块；数据格式校验子模块的类型标签为"环境-格式校验”，判定为环境检测子模块。

[0033] 2）检测参数提取：检测设备的实时监控单元通过内部通信总线，向相邻子模块发送参数查询指令，获取同一维度的检测参数，以确保参数可比较性（如"输入过滤子模块”的检测参数为"每秒过滤请求数（800次 / 秒）”，反映模块处理输入请求的效率；"数据格式校验子模块”的检测参数为"每秒格式校验次数（750次 / 秒）”，反映模块校验数据格式的效率），检测参数提取后同步存储至参数缓存区。

[0034] 3）分值计算：第一步，计算相邻子模块检测参数的差值（如800次 / 秒-750次 / 秒=50次 / 秒）；第二步，收集待检测模块集合中所有同类检测参数（如其他子模块的"每秒处理请求数”），若有多组数据，排序后取中间值确定中位数；第三步，以中位数为基准，按预设规则划分差值区间，其中差值越小，对应分值越高；第四步，查询预设分值表，确定差值所处的差值区间对应分值。

[0035] S4、基于检测关联图，采用图论算法（如Dijkstra算法）确定最优路径，并根据最优路径在待检测模块集合中确定各个子模块的检测调节顺序。

[0036] 具体而言，首先，将检测关联图输入Dijkstra算法，能够计算出从检测主导子模块（即攻击场景中最关键、最能体现攻击意图和特征的检测部位对应的子模块）出发，经过检测次要子模块（非核心环节但提供辅助信息的检测部位对应的子模块），最终到达环境检测子模块（为核心模块提供运行环境支持的子模块）的最短路径。

[0037] 在一些实施例中，Dijkstra算法作为一种用于在加权图中找到单源最短路径的经典算法，具体步骤如下：1）Dijkstra算法的准备在应用该算法之前，需要完成以下准备工作：确定起点：选择检测主导子模块作为算法的起点。检测主导子模块是在特定攻击场景下，处于攻击核心环节的检测区域或功能点，对准确识别和判定攻击场景起着决定性作用。

[0038] 图的表示：将检测关联图表示为邻接矩阵或邻接表的形式，其中每个顶点代表一个子模块，每条边代表子模块间的关联，且边上标注有检测关联分值（即权重）。

[0039] 初始化距离数组：创建一个数组来记录从起点到图中每个顶点的最短距离。初始时，起点的距离设为0，其他顶点的距离设为无穷大。

[0040] 优先队列：使用优先队列（如最小堆）来存储待处理的顶点，优先处理当前距离起点最近的顶点。

[0041] 2）应用Dijkstra算法顶点处理：从优先队列中取出距离起点最近的顶点（设为当前顶点），并遍历其所有邻接顶点。

[0042] 距离更新：对于当前顶点的每一个邻接顶点，计算从起点经过当前顶点到达该邻接顶点的距离（即当前顶点的距离加上邻接边的权重）。

[0043] 如果这个距离小于之前记录的距离，则更新该邻接顶点的距离，并将其加入优先队列。

[0044] 重复处理：重复上述顶点处理和距离更新的步骤，直到优先队列为空，即所有顶点都已处理完毕。

[0045] 3）最优路径的提取路径回溯：在Dijkstra算法执行过程中，可以额外维护一个前驱数组来记录每个顶点在最短路径上的前驱顶点。

[0046] 这样，在算法结束后，可以从终点（环境检测子模块）开始，通过前驱数组回溯到起点（检测主导子模块），从而得到完整的最短路径。

[0047] 最优路径确定：根据回溯得到的路径信息，可以确定从检测主导子模块到检测次要子模块，再到环境检测子模块的最优检测路径。

[0048] 这条路径不仅考虑了子模块间的直接关联，还通过算法优化确保了检测资源的合理分配与高效利用。

[0049] 接下来，在最优路径被确定后，按照最优路径上的子模块顺序来安排检测任务。这种顺序安排确保了检测过程的有序性和高效性，避免了因固定检测流程而导致的资源浪费或关键模块检测延误问题。

[0050] 具体来说，检测任务将从检测主导子模块开始，逐步过渡到检测次要子模块，并最终覆盖至环境检测子模块，形成一个完整且高效的检测闭环。

[0051] 综上所述，步骤S4通过构建检测关联图、应用图论算法确定最优路径以及根据最优路径安排检测调节顺序，实现了对网络安全漏洞检测过程的全面优化与提升。这一创新性的方法不仅提高了检测效率与准确性，还为应对复杂多变的网络攻击场景提供了有力的技术支持。

[0052] S5、按照检测调节顺序，构建特征参数序列，输入智能检测模型生成针对性检测策略，并下发给各子模块执行，具体包括：1）特征参数序列构建：网络安全检测设备依据已确定的检测调节顺序（如恶意代码识别子模块→文件校验子模块→隔离控制子模块），通过参数采集接口逐一提取各子模块的特征参数；例如，恶意代码识别子模块，支持的病毒库版本（2025.06）、扫描协议（HTTP / HTTPS）、当前负载（60%）。按检测调节顺序将上述参数排列，形成特征参数序列，若存在缺失参数（如未提及的"扫描频率”），则以该子模块的历史平均参数值填充，确保序列完整性。

[0053] 2）模型输入与策略生成：将构建的特征参数序列输入部署在检测设备专用计算单元中的智能检测模型，该智能检测模型通过超过10万条恶意软件传播场景的案例数据训练，包含特征提取层、序列分析层、策略匹配层三层结构。智能检测模型通过卷积操作提取特征参数序列中的局部特征（如病毒库版本、校验算法），通过循环单元捕捉子模块间的顺序依赖关系（如恶意代码识别结果影响文件校验优先级），最后调用恶意软件传播场景对应的策略生成逻辑，输出子模块针对性检测策略（如恶意代码识别子模块：启用深度包检测，每2秒更新病毒库）。

[0054] 3）执行结果：检测设备的任务调度模块将生成的检测策略分解为具体操作指令，按检测调节顺序向各子模块下发。各子模块接收到指令后，启动内置执行引擎执行检测任务。执行过程中，各子模块实时向任务调度模块反馈运行状态（如扫描进度、校验结果、隔离状态）；检测结束后，设备汇总检测结果，同步将结果反馈至智能检测模型，用于模型参数优化，提升后续检测精度。

[0055] 本发明还提供一种基于人工智能的网络安全漏洞检测系统，该系统包括用于存储计算机程序指令的存储器和用于执行程序指令的处理器，其中，当该计算机程序指令被该处理器执行时，触发该系统执行上述的基于人工智能的网络安全漏洞检测方法。

[0056] 本发明提供的一种基于人工智能的网络安全漏洞检测方法及系统，旨在解决传统网络安全漏洞检测方法依赖固定规则、对新型攻击响应滞后、集中式架构效率低、缺乏多模块协同调度以及人工智能技术应用不充分的问题。

[0057] 该方法通过动态划分检测模块、优化检测顺序和协同调度，提升漏洞检测的针对性、效率和准确性，以适应复杂网络环境的多样化攻击场景。具体步骤包括：识别异常流量特征以确定核心交互区域，基于核心交互区域构建待检测模块集合，确定子模块间的检测关联分值并构建检测关联图，采用Dijkstra算法确定最优检测路径，并根据最优路径安排检测调节顺序，最后通过智能检测模型生成针对性检测策略并执行。该方法通过人工智能驱动的多模块动态协同与最优路径规划，实现了网络安全漏洞检测的高效性、精准性及对复杂攻击场景的快速适应。

[0058] 尽管通过参考附图并结合优选实施例的方式对本发明进行了详细描述，但本发明并不限于此。在不脱离本发明的精神和实质的前提下，本领域普通技术人员可以对本发明的实施例进行各种等效的修改或替换，而这些修改或替换都应在本发明的涵盖范围内或任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。< / script>

Claims

1. An artificial intelligence-based network security vulnerability detection method, characterized by, The method comprises: Identify abnormal traffic characteristics, obtain the core interaction area of the target network and the network security detection device; Based on the core interaction area, a set of detection modules to be detected is constructed; Determine the detection correlation score between any two adjacent sub-modules in the set of detection modules to be detected, and construct a detection correlation graph; Based on the detection correlation graph, the optimal path is determined by using the graph theory algorithm, and the detection adjustment order of each sub-module in the set of detection modules to be detected is determined according to the optimal path; According to the detection adjustment order, a feature parameter sequence is constructed, a detection strategy is generated by inputting an intelligent detection model, and each sub-module is executed.

2. The method of claim 1, wherein, The identification of abnormal traffic characteristics, obtaining the core interaction area of the target network and the network security detection device, specifically comprises: The network security detection device captures the full data packet of the target network in real time through the built-in traffic collection unit, analyzes the information of the full data packet based on the preset attack feature library, and identifies the abnormal traffic characteristics by using the traffic feature extraction algorithm; According to the identified abnormal traffic characteristics, the regions that interact with the network security detection device within a specified time period are counted and recorded, and the related data of each interaction region is synchronously collected; the interaction regions are classified into corresponding attack type interaction region sets, wherein the classification method is that the detection device calls the attack type standard interval pre-stored in the configuration file, locates the standard interval including the core feature description corresponding to the attack type, compares the collected interaction region related data with the features of the attack type standard interval one by one, confirms that the attack behavior in the interaction region completely matches the attack type characteristics, and then divides the interaction region into the corresponding attack type interaction region set, and completes the classification operation; Next, the scene recognition module of the network security detection device combines the real-time monitoring data to further confirm the attack scene currently suffered by the target network; in the classified interaction region set, the regions matching the current attack scene are screened; finally, the interaction regions covered by the interaction region set are determined as the core interaction area.

3. The method of claim 2, wherein, Based on the core interaction area, the set of detection modules to be detected is constructed, which comprises: based on the attack scene of the target network, the detection sub-modules covered by the core interaction area are divided into detection dominant sub-modules, detection secondary sub-modules, and environment detection sub-modules in the detection sub-modules not covered by the core interaction area, which together constitute the set of detection modules to be detected.

4. The method of claim 3, wherein, The core interaction area is used to build a set of modules to be detected, specifically including: a scene recognition module of the network security detection device determines the current attack scene of the target network, and based on the path of the attack scene, the dominant detection part and the secondary detection part in the attack scene are determined, wherein the dominant detection part is a detection area or a detection function point corresponding to the core link in the attack scene under a certain attack scene, which is the most critical part in the entire attack path and can best reflect the attack intention and characteristics; the secondary detection part is a detection area or a detection function point in the non-core link of the attack path relative to the dominant detection part under a certain attack scene, which is related to the attack behavior to some extent and provides auxiliary information for understanding the attack situation; In the determined core interaction area, the functional radiation range of the detection part is used to demarcate the action interval; wherein the first action interval is demarcated for the dominant detection part, and the second action interval is demarcated for the secondary detection part; the network security detection device queries the built-in submodule topology configuration file, and according to the correspondence between the action interval and the submodule, the corresponding submodule in the first action interval is determined as the detection dominant submodule; the corresponding submodule in the second action interval is determined as the detection secondary submodule, forming a preliminary set of modules to be detected.

5. The method of claim 4, wherein, The core interaction area is used to build a set of modules to be detected, further including determining an environmental detection submodule to form a complete set of modules to be detected, the steps being as follows: 1) Auxiliary quantity setting: the network security detection device sets a first auxiliary quantity for the detection dominant submodule and a second auxiliary quantity for the detection secondary submodule according to the technical characteristics of the attack scene and referring to the environmental influence range of the attack in the historical detection data, and the setting of the auxiliary quantity ensures that the environmental detection can comprehensively cover the running environment of the core module; 2) Adjacent module screening: the network security detection device calls the submodule topology graph to identify the submodules not covered by the core interaction area, and determines the adjacent relationship by judging whether there is a direct data link between the submodules; In the uncovered submodules, one or more submodules adjacent to the detection dominant submodule are selected as the environmental detection submodule; One or more submodules adjacent to the detection secondary submodule are selected and supplemented to the environmental detection submodule; 3) Set composition: the detection dominant submodule, the detection secondary submodule and the environmental detection submodule are integrated to form a complete set of modules to be detected, and the unique type identifier, the function description and the correlation between the modules of each submodule are recorded and stored in a temporary database.

6. The method of claim 5, wherein, The detection correlation score between any two adjacent submodules in the set of modules to be detected is determined to build a detection correlation graph, specifically including: 1) Module type identification: the network security detection device reads the type identifier of each adjacent submodule in the set of modules to be detected through a submodule type query interface to determine the type attribute of each submodule; 2) Detection parameter extraction: the real-time monitoring unit of the network security detection device sends a parameter query instruction to the adjacent sub-modules through an internal communication bus to obtain detection parameters of the same dimension to ensure parameter comparability, and synchronously stores the detection parameters to a parameter cache area after extraction; 3) Score calculation: first, the difference of detection parameters of adjacent sub-modules is calculated; second, all detection parameters of the same type in the set of modules to be detected are collected, and if there are multiple groups of data, the median is determined by sorting and taking the middle value; third, the median is taken as a reference to divide the difference value interval according to a preset rule, wherein the smaller the difference value, the higher the corresponding score; fourth, a preset score table is queried to determine the score corresponding to the difference value interval where the difference value is located; 4) Detection correlation graph construction: taking the sub-modules in the set of modules to be detected as vertices and the detection parameter correlation score as the edges between the vertices, a detection correlation graph of the set of modules to be detected is constructed.

7. The method of claim 6, wherein, Based on the detection correlation graph, the optimal path is determined by using a graph theory algorithm, and the detection adjustment order of each sub-module in the set of modules to be detected is determined according to the optimal path, specifically including: First, the detection correlation graph is input into the Dijkstra algorithm to calculate the optimal path from the detection dominant sub-module to the environmental detection sub-module through the detection secondary sub-module; Next, after the optimal path is determined, the detection adjustment order is arranged according to the order of the sub-modules in the set of modules to be detected on the optimal path.

8. The method of claim 7, wherein, The specific steps of the Dijkstra algorithm are as follows: 1) Preparation work before applying the Dijkstra algorithm Determine the starting point: select the detection dominant sub-module as the starting point of the algorithm; Representation of the graph: represent the detection correlation graph in the form of an adjacency matrix or an adjacency list, wherein each vertex represents a sub-module, each edge represents the correlation between sub-modules, and the detection correlation score is marked on the edge; Initialize the distance array: create an array to record the shortest distance from the starting point to each vertex in the detection correlation graph; initially, the distance of the starting point is set to 0, and the distances of other vertices are set to infinity; Priority queue: use a priority queue to store the vertices to be processed, and preferentially process the vertex closest to the starting point; 2) Apply the Dijkstra algorithm Vertex processing: take the vertex closest to the starting point from the priority queue as the current vertex, and traverse all adjacent vertices thereof; Distance update: for each adjacent vertex of the current vertex, calculate the distance from the starting point to the adjacent vertex through the current vertex; if the distance is smaller than the previously recorded distance, update the distance of the adjacent vertex and add it to the priority queue; Repeat the processing: repeat the above steps of vertex processing and distance updating until the priority queue is empty, at which time all vertices have been processed; 3) Extraction of the optimal path Path backtracking: during the execution of the Dijkstra algorithm, an ancestor array is additionally maintained to record the predecessor vertex of each vertex on the shortest path; after the algorithm ends, the complete shortest path can be obtained by backtracking from the terminal point to the starting point through the ancestor array; Optimal path determination: according to the shortest path information obtained by backtracking, the optimal detection path from the dominant detection submodule to the secondary detection submodule and then to the environment detection submodule is determined.

9. The method of claim 8, wherein, According to the detection adjustment sequence, the feature parameter sequence is constructed, the intelligent detection model is generated by inputting the intelligent detection model, and the detection strategy is distributed to each submodule for execution, which specifically includes: 1) Feature parameter sequence construction: the network security detection equipment extracts the feature parameters of each submodule one by one through the parameter acquisition interface according to the determined detection adjustment sequence; the feature parameters are arranged according to the detection adjustment sequence to form a feature parameter sequence, and if there are missing parameters, the historical average parameter value of the submodule is filled to ensure the integrity of the sequence; 2) Model input and strategy generation: input the constructed feature parameter sequence into the intelligent detection model deployed in the network security detection equipment special computing unit, the intelligent detection model is trained through more than 100,000 malicious software propagation scene case data, including feature extraction layer, sequence analysis layer, strategy matching layer three-layer structure; the intelligent detection model extracts local features in the feature parameter sequence through convolution operation, captures the sequential dependence relationship between submodules through the loop unit, finally calls the corresponding strategy generation logic of the malicious software propagation scene, and outputs the submodule targeted detection strategy; 3) Execution result: the task scheduling module of the network security detection equipment decomposes the generated detection strategy into specific operation instructions, and distributes them to each submodule according to the detection adjustment sequence; after receiving the instructions, each submodule starts the built-in execution engine to execute the detection task; during the execution process, each submodule feeds back the running state to the task scheduling module in real time; after the detection is completed, the network security detection equipment summarizes the detection results and synchronously feeds back the results to the intelligent detection model for intelligent detection model parameter optimization.

10. An artificial intelligence based cyber security vulnerability detection system, the system comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein, When the computer program instructions are executed by the processor, the system executes the network security vulnerability detection method based on artificial intelligence as claimed in any one of claims 1 to 9. When the computer program instructions are executed by the processor, the system executes the network security vulnerability detection method based on artificial intelligence as claimed in any one of claims 1 to 9.

Images