An artificial intelligence-based network security vulnerability detection method and system

Abstract

The application provides a network security vulnerability detection method and system based on artificial intelligence, and relates to the technical field of network security.The method comprises the following steps: identifying abnormal traffic characteristics, obtaining the core interaction area of a target network and a network security detection device; based on the core interaction area, a set of to-be-detected modules is constructed; the detection correlation score between any two adjacent sub-modules in the set of to-be-detected modules is determined, and a detection correlation graph is constructed; based on the detection correlation graph, a graph theory algorithm is used to determine an optimal path, and the detection adjustment order of each sub-module in the set of to-be-detected modules is determined according to the optimal path; according to the detection adjustment order, a feature parameter sequence is constructed, a detection strategy is generated by inputting an intelligent detection model, and the detection strategy is issued to each sub-module for execution.The application realizes the efficiency, accuracy and rapid adaptation to complex attack scenarios of network security vulnerability detection through multi-module dynamic collaboration and optimal path planning driven by artificial intelligence.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network security vulnerability detection method and system based on artificial intelligence. BACKGROUND

[0002] With the rapid development of Internet technology, network application scenarios are becoming increasingly complex, and network security threats are showing diversification, intelligence and concealment. Network attack means has evolved from exploiting traditional single vulnerabilities to multi-dimensional and collaborative attack patterns, which puts higher requirements on vulnerability detection technology.

[0003] Traditional methods use feature libraries to match known vulnerabilities, and rule engines trigger detection operations based on preset conditions, such as alerting for specific port traffic or abnormal login behavior. Some artificial intelligence-based solutions use machine learning algorithms to analyze a single data source (such as network traffic) to optimize vulnerability recognition accuracy, but do not involve dynamic collaboration of multiple detection modules. In these solutions, the calling order of the detection modules is fixed, regardless of the attack scenario, and the detection is performed according to the preset process, without considering the relevance between modules and the specificity of the attack scenario.

[0004] The existing technology has obvious limitations: first, traditional methods rely on feature libraries and fixed rules, and respond slowly to new vulnerabilities and variant attacks, with feature library update speed unable to keep up with the emergence of vulnerabilities; second, centralized architecture has high detection delay and large resource consumption when processing large-scale network data, making it difficult to meet real-time detection requirements; third, fixed detection processes are used, ignoring the relevance and collaboration of modules in different attack scenarios, resulting in resource waste or delayed detection of key modules, such as still detecting all modules in a fixed order in a Web attack scenario, reducing efficiency; fourth, some artificial intelligence solutions only optimize a single module, lack multi-module collaborative scheduling and overall path optimization, making it difficult to take advantage of artificial intelligence in complex scenarios, and the detection process has redundant operations, limiting efficiency and accuracy. SUMMARY

[0005] To address the technical problems of existing network security vulnerability detection relying on fixed rules, responding slowly to new attacks, low efficiency of centralized architecture, lack of multi-module collaborative scheduling, and insufficient application of artificial intelligence technology, the present application provides a network security vulnerability detection method and system based on artificial intelligence, which dynamically divides detection modules, optimizes detection order and collaborative scheduling, improves the specificity, efficiency and accuracy of vulnerability detection, and adapts to diverse attack scenarios in complex network environments.

[0006] To achieve the above purposes, the technical solution adopted by the present application is: a network security vulnerability detection method based on artificial intelligence, the method comprising:

[0007] Identify abnormal traffic characteristics and obtain the core interaction area between the target network and network security detection equipment;

[0008] Based on the core interaction area, construct a set of modules to be detected;

[0009] Determine the detection association score between any two adjacent sub-modules in the set of modules to be detected, and construct a detection association graph;

[0010] Based on the detection association graph, a graph theory algorithm is used to determine the optimal path, and the detection adjustment order of each sub-module in the set of modules to be detected is determined according to the optimal path;

[0011] According to the detection and adjustment sequence, a sequence of feature parameters is constructed, input into the intelligent detection model to generate a detection strategy, and then distributed to each sub-module for execution.

[0012] On the other hand, the present invention also provides an artificial intelligence-based network security vulnerability detection system, which includes a memory for storing computer program instructions and a processor for executing the program instructions, wherein when the computer program instructions are executed by the processor, the system is triggered to execute the above-mentioned artificial intelligence-based network security vulnerability detection method.

[0013] Compared with the prior art, the beneficial effects of the present invention are:

[0014] 1. Improve testing efficiency and resource utilization.

[0015] By dynamically dividing the detection modules, constructing a detection association graph, and using Dijkstra's algorithm to optimize the detection path, this method achieves multi-module collaborative scheduling and overall path optimization. It avoids the high latency and resource consumption issues of traditional centralized architectures, while reducing redundant operations in fixed detection processes, significantly improving detection efficiency.

[0016] 2. Enhance real-time response capabilities to new types of attacks.

[0017] Traditional methods rely on signature databases and fixed rules, resulting in delayed responses to new vulnerabilities and variant attacks. This invention uses artificial intelligence technology to analyze abnormal traffic characteristics in real time, combined with a dynamic detection strategy generation mechanism, enabling rapid adaptation to unknown attack scenarios and solving the problem that traditional solutions cannot keep up with the speed of vulnerability emergence.

[0018] 3. Improve the targeting and accuracy of detection strategies.

[0019] This invention dynamically adjusts the calling order and coordination method of detection modules according to the attack scenario, and generates targeted strategies through an intelligent detection model, avoiding the limitations of some artificial intelligence solutions that only optimize a single module. This method ensures the priority detection of key modules while reducing interference from unnecessary modules, thereby improving overall detection accuracy.

[0020] 4. Supports diverse attack scenarios in complex network environments.

[0021] Traditional methods are inadequate when facing multi-dimensional and collaborative attack patterns. However, this invention, through dynamic collaboration of multiple modules and path optimization, can flexibly respond to complex scenarios such as Web attacks and DDoS attacks, and solves the problem of fixed detection processes ignoring module correlation and the specificity of attack scenarios.

[0022] Other features and advantages of the embodiments of the present invention will be described in detail in the following detailed description section. Attached Figure Description

[0023] Figure 1 This is a flowchart of the artificial intelligence-based network security vulnerability detection method according to the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings, so as to more clearly understand the purpose, features and advantages of this invention. It should be understood that the embodiments shown in the drawings are not intended to limit the scope of this invention, but are only for illustrating the essential spirit of the technical solutions of this invention. Obviously, the described embodiments are only a part of the embodiments of this invention, and not all of them. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0025] Unless the context requires otherwise, throughout the specification and claims, the word “comprising” and its variations, such as “including” and “having”, shall be understood to have an open, inclusive meaning, that is, to be interpreted as “including, but not limited to”.

[0026] Throughout this specification, references to "an embodiment" or "an embodiment" indicate that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment. Therefore, the appearance of "in an embodiment" or "an embodiment" in various places throughout the specification does not necessarily refer to the same embodiment. Furthermore, a particular feature, structure, or characteristic may be combined in any manner in one or more embodiments.

[0027] The singular forms “a” and “the” used in this specification and the appended claims include plural references unless otherwise expressly stated herein. It should be noted that the term “or” is generally used to mean “and / or” unless otherwise expressly stated herein.

[0028] In the following description, in order to clearly demonstrate the structure and working method of the present invention, a number of directional terms will be used. However, terms such as "front", "back", "left", "right", "outside", "inside", "outward", "inward", "up", and "down" should be understood as convenient terms and not as limiting terms.

[0029] The implementation details of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. The following content is only for the convenience of understanding the implementation details and is not necessary for implementing this solution.

[0030] refer to Figure 1 This invention provides an artificial intelligence-based method for detecting cybersecurity vulnerabilities, which specifically includes:

[0031] S1. Identify abnormal traffic characteristics and obtain the core interaction area between the target network and network security detection equipment.

[0032] In a network security protection system, accurately identifying the interaction area between the target network and network security detection equipment is crucial for effective vulnerability detection. Network security detection equipment, through its built-in traffic acquisition unit, captures all data packets from the target network in real time. Based on a pre-set attack signature database (such as a DDoS attack signature database), it uses traffic feature extraction algorithms to analyze the IP source address, connection frequency, and data exchange volume of these data packets to identify abnormal traffic characteristics. For example, in a Distributed Denial of Service (DDoS) attack scenario, detecting a large number of high-frequency TCP connection requests from different IP source addresses (a single IP connection frequency exceeding 500 times / second, with no effective data transmission after connection establishment) on the target network matches the typical characteristics of a DDoS attack.

[0033] Based on the identified abnormal traffic characteristics, the regions that interacted with the detection device within a specified time period are statistically recorded, including traffic access ports, data forwarding modules, and bandwidth monitoring modules. Simultaneously, data such as the interaction duration, total data transmission volume, and connection failure rate of each region are collected. These interaction regions are categorized into corresponding attack type interaction region sets. The categorization method involves the detection device calling pre-stored attack type standard intervals in a configuration file to locate the standard interval corresponding to the attack type (this interval includes core characteristic descriptions such as multi-source IP distribution dispersion ≥90%, high concurrent connection count ≥10,000 connections / minute, and bandwidth usage surge ≥80%). The statistically collected interaction region data is compared one by one with the characteristics of the attack type standard intervals. If the attack behavior within the interaction region fully matches the attack type characteristics, the interaction region is then assigned to the corresponding attack type interaction region set, completing the categorization operation.

[0034] Next, the scene identification module of the network security detection equipment, combined with real-time monitoring data (such as the current target network bandwidth utilization reaching 90%, the average latency for normal user access exceeding 3 seconds, and the connection failure rate reaching 65%), further confirms the attack scenario currently being suffered by the target network. From the categorized set of interaction areas, areas matching the current attack scenario are filtered out. For example, since the bandwidth monitoring module is only a data statistics area and does not directly bear the impact of attacks, this module is excluded. Finally, the interaction areas covered by the set (traffic access ports + data forwarding modules) are determined as the core interaction areas, providing a basis for subsequent sub-module division.

[0035] S2. Based on the core interaction area, construct a set of modules to be detected.

[0036] Based on the attack scenario of the target network, the detection sub-modules covered by the core interaction area are divided into detection primary sub-modules and detection secondary sub-modules. In the detection sub-modules not covered by the core interaction area, environmental detection sub-modules are identified. These sub-modules together constitute the set of modules to be detected.

[0037] Specifically, the scene recognition module of the network security detection equipment performs in-depth analysis of abnormal request data from the target network, such as detecting multiple requests containing... <script>恶意标签、onclick恶意事件的HTTP请求，结合请求来源、目标URL等信息，判定当前攻击场景。基于攻击场景的典型路径（攻击者注入恶意脚本→用户输入处理模块接收并传递→网页渲染引擎执行脚本），明确该攻击场景下的主导检测部位和次要检测部位，其中，主导检测部位是在特定攻击场景下，处于攻击核心环节所对应的检测区域或检测功能点。它是整个攻击路径中最关键、最能体现攻击意图和特征的部分，对准确识别和判定该攻击场景起着决定性作用；次要检测部位是在特定攻击场景下，相对于主导检测部位而言，处于攻击路径中非核心环节的检测区域或检测功能点。它虽然不是攻击的核心，但与攻击行为存在一定的关联，能够为全面、深入地了解攻击情况提供辅助信息。

[0038] 在确定的核心交互区域内，依据检测部位的功能辐射范围划定作用区间。其中，对应主导检测部位划定为第一作用区间，对应次要检测部位划定为第二作用区间。网络安全检测设备查询内置的子模块拓扑配置文件，根据作用区间与子模块的对应关系，将第一作用区间内的对应子模块判定为检测主导子模块；将第二作用区间内的对应子模块判定为检测次要子模块，形成初步的待检测模块子集。

[0039] 接下来，确定环境检测子模块，包括如下步骤：

[0040] 1）辅助数量设置：网络安全检测设备根据攻击场景的技术特性（如攻击多通过异常数据覆盖内存缓冲区，需结合内存状态、指令执行环境综合检测），参考历史检测数据中该类攻击的环境影响范围，为检测主导子模块设置第一辅助数量，为检测次要子模块设置第二辅助数量，辅助数量的设定确保环境检测能全面覆盖核心模块的运行环境。

[0041] 2）相邻模块筛选：网络安全检测设备调用子模块拓扑图，识别核心交互区域未覆盖的子模块，通过判断子模块间是否存在直接数据链路（单位时间内数据交互频次≥10次）确定相邻关系。在未覆盖子模块中，选取与检测主导子模块相邻的一或多个子模块，作为环境检测子模块；选取与检测次要子模块相邻的一或多个子模块，补充至环境检测子模块。

[0042] 3）集合构成：整合检测主导子模块、检测次要子模块及上述一或多个环境检测子模块，形成完整的待检测模块集合，同时记录各子模块的唯一标识符、功能描述及模块间的关联关系，存储至临时数据库供后续调用。

[0043] S3、确定待检测模块集合中任意两个相邻子模块之间的检测关联分值，构建检测关联图。

[0044] 通过提取相邻子模块的同一维度检测参数，计算参数差值，并根据中位数划分差值区间，查询预设分值表确定检测关联分值。以待检测模块集合中的子模块为顶点，检测关联分值为连接顶点之间的边，构建待检测模块集合的检测关联图，具体包括：

[0045] 1）模块类型识别：网络安全检测设备通过子模块类型查询接口，读取待检测模块集合中相邻的各个子模块的类型标识，明确各个子模块的类型属性；例如：输入过滤子模块的类型标签为"主导-输入处理”，判定为检测主导子模块；数据格式校验子模块的类型标签为"环境-格式校验”，判定为环境检测子模块。

[0046] 2）检测参数提取：检测设备的实时监控单元通过内部通信总线，向相邻子模块发送参数查询指令，获取同一维度的检测参数，以确保参数可比较性（如"输入过滤子模块”的检测参数为"每秒过滤请求数（800次 / 秒）”，反映模块处理输入请求的效率；"数据格式校验子模块”的检测参数为"每秒格式校验次数（750次 / 秒）”，反映模块校验数据格式的效率），检测参数提取后同步存储至参数缓存区。

[0047] 3）分值计算：第一步，计算相邻子模块检测参数的差值（如800次 / 秒-750次 / 秒=50次 / 秒）；第二步，收集待检测模块集合中所有同类检测参数（如其他子模块的"每秒处理请求数”），若有多组数据，排序后取中间值确定中位数；第三步，以中位数为基准，按预设规则划分差值区间，其中差值越小，对应分值越高；第四步，查询预设分值表，确定差值所处的差值区间对应分值。

[0048] S4、基于检测关联图，采用图论算法（如Dijkstra算法）确定最优路径，并根据最优路径在待检测模块集合中确定各个子模块的检测调节顺序。

[0049] 具体而言，首先，将检测关联图输入Dijkstra算法，能够计算出从检测主导子模块（即攻击场景中最关键、最能体现攻击意图和特征的检测部位对应的子模块）出发，经过检测次要子模块（非核心环节但提供辅助信息的检测部位对应的子模块），最终到达环境检测子模块（为核心模块提供运行环境支持的子模块）的最短路径。

[0050] 在一些实施例中，Dijkstra算法作为一种用于在加权图中找到单源最短路径的经典算法，具体步骤如下：

[0051] 1）Dijkstra算法的准备

[0052] 在应用该算法之前，需要完成以下准备工作：

[0053] 确定起点：选择检测主导子模块作为算法的起点。检测主导子模块是在特定攻击场景下，处于攻击核心环节的检测区域或功能点，对准确识别和判定攻击场景起着决定性作用。

[0054] 图的表示：将检测关联图表示为邻接矩阵或邻接表的形式，其中每个顶点代表一个子模块，每条边代表子模块间的关联，且边上标注有检测关联分值（即权重）。

[0055] 初始化距离数组：创建一个数组来记录从起点到图中每个顶点的最短距离。初始时，起点的距离设为0，其他顶点的距离设为无穷大。

[0056] 优先队列：使用优先队列（如最小堆）来存储待处理的顶点，优先处理当前距离起点最近的顶点。

[0057] 2）应用Dijkstra算法

[0058] 顶点处理：从优先队列中取出距离起点最近的顶点（设为当前顶点），并遍历其所有邻接顶点。

[0059] 距离更新：对于当前顶点的每一个邻接顶点，计算从起点经过当前顶点到达该邻接顶点的距离（即当前顶点的距离加上邻接边的权重）。

[0060] 如果这个距离小于之前记录的距离，则更新该邻接顶点的距离，并将其加入优先队列。

[0061] 重复处理：重复上述顶点处理和距离更新的步骤，直到优先队列为空，即所有顶点都已处理完毕。

[0062] 3）最优路径的提取

[0063] 路径回溯：在Dijkstra算法执行过程中，可以额外维护一个前驱数组来记录每个顶点在最短路径上的前驱顶点。

[0064] 这样，在算法结束后，可以从终点（环境检测子模块）开始，通过前驱数组回溯到起点（检测主导子模块），从而得到完整的最短路径。

[0065] 最优路径确定：根据回溯得到的路径信息，可以确定从检测主导子模块到检测次要子模块，再到环境检测子模块的最优检测路径。

[0066] 这条路径不仅考虑了子模块间的直接关联，还通过算法优化确保了检测资源的合理分配与高效利用。

[0067] 接下来，在最优路径被确定后，按照最优路径上的子模块顺序来安排检测任务。这种顺序安排确保了检测过程的有序性和高效性，避免了因固定检测流程而导致的资源浪费或关键模块检测延误问题。

[0068] 具体来说，检测任务将从检测主导子模块开始，逐步过渡到检测次要子模块，并最终覆盖至环境检测子模块，形成一个完整且高效的检测闭环。

[0069] 综上所述，步骤S4通过构建检测关联图、应用图论算法确定最优路径以及根据最优路径安排检测调节顺序，实现了对网络安全漏洞检测过程的全面优化与提升。这一创新性的方法不仅提高了检测效率与准确性，还为应对复杂多变的网络攻击场景提供了有力的技术支持。

[0070] S5、按照检测调节顺序，构建特征参数序列，输入智能检测模型生成针对性检测策略，并下发给各子模块执行，具体包括：

[0071] 1）特征参数序列构建：网络安全检测设备依据已确定的检测调节顺序（如恶意代码识别子模块→文件校验子模块→隔离控制子模块），通过参数采集接口逐一提取各子模块的特征参数；例如，恶意代码识别子模块，支持的病毒库版本（2025.06）、扫描协议（HTTP / HTTPS）、当前负载（60%）。按检测调节顺序将上述参数排列，形成特征参数序列，若存在缺失参数（如未提及的"扫描频率”），则以该子模块的历史平均参数值填充，确保序列完整性。

[0072] 2）模型输入与策略生成：将构建的特征参数序列输入部署在检测设备专用计算单元中的智能检测模型，该智能检测模型通过超过10万条恶意软件传播场景的案例数据训练，包含特征提取层、序列分析层、策略匹配层三层结构。智能检测模型通过卷积操作提取特征参数序列中的局部特征（如病毒库版本、校验算法），通过循环单元捕捉子模块间的顺序依赖关系（如恶意代码识别结果影响文件校验优先级），最后调用恶意软件传播场景对应的策略生成逻辑，输出子模块针对性检测策略（如恶意代码识别子模块：启用深度包检测，每2秒更新病毒库）。

[0073] 3）执行结果：检测设备的任务调度模块将生成的检测策略分解为具体操作指令，按检测调节顺序向各子模块下发。各子模块接收到指令后，启动内置执行引擎执行检测任务。执行过程中，各子模块实时向任务调度模块反馈运行状态（如扫描进度、校验结果、隔离状态）；检测结束后，设备汇总检测结果，同步将结果反馈至智能检测模型，用于模型参数优化，提升后续检测精度。

[0074] 本发明还提供一种基于人工智能的网络安全漏洞检测系统，该系统包括用于存储计算机程序指令的存储器和用于执行程序指令的处理器，其中，当该计算机程序指令被该处理器执行时，触发该系统执行上述的基于人工智能的网络安全漏洞检测方法。

[0075] 本发明提供的一种基于人工智能的网络安全漏洞检测方法及系统，旨在解决传统网络安全漏洞检测方法依赖固定规则、对新型攻击响应滞后、集中式架构效率低、缺乏多模块协同调度以及人工智能技术应用不充分的问题。

[0076] 该方法通过动态划分检测模块、优化检测顺序和协同调度，提升漏洞检测的针对性、效率和准确性，以适应复杂网络环境的多样化攻击场景。具体步骤包括：识别异常流量特征以确定核心交互区域，基于核心交互区域构建待检测模块集合，确定子模块间的检测关联分值并构建检测关联图，采用Dijkstra算法确定最优检测路径，并根据最优路径安排检测调节顺序，最后通过智能检测模型生成针对性检测策略并执行。该方法通过人工智能驱动的多模块动态协同与最优路径规划，实现了网络安全漏洞检测的高效性、精准性及对复杂攻击场景的快速适应。

[0077] 尽管通过参考附图并结合优选实施例的方式对本发明进行了详细描述，但本发明并不限于此。在不脱离本发明的精神和实质的前提下，本领域普通技术人员可以对本发明的实施例进行各种等效的修改或替换，而这些修改或替换都应在本发明的涵盖范围内或任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应以权利要求的保护范围为准。< / script>

Claims

1. A network security vulnerability detection method based on artificial intelligence, characterized in that, The method includes: Identify abnormal traffic characteristics and obtain the core interaction area between the target network and network security detection equipment; Based on the core interaction area, construct a set of modules to be detected; Determine the detection association score between any two adjacent sub-modules in the set of modules to be detected, and construct a detection association graph; Based on the detection association graph, a graph theory algorithm is used to determine the optimal path, and the detection adjustment order of each sub-module in the set of modules to be detected is determined according to the optimal path; According to the detection and adjustment sequence, a feature parameter sequence is constructed, input into the intelligent detection model to generate a detection strategy, and then distributed to each sub-module for execution; The process of constructing a set of modules to be detected based on the core interaction area specifically includes: a scene recognition module of the network security detection device determining the current attack scenario of the target network; and, based on the path of the attack scenario, identifying the dominant and secondary detection parts within the attack scenario. The dominant detection part is the detection area or functional point corresponding to the core attack stage in a given attack scenario; it is the most critical part of the entire attack path and best reflects the attack intent and characteristics. The secondary detection part is, relative to the dominant detection part, a detection area or functional point in a non-core stage of the attack path, which is related to the attack behavior and provides auxiliary information for understanding the attack situation. Within the defined core interaction area, the effective range is delineated based on the functional radiation range of the detection location. The primary detection location is designated as the first effective range, and the secondary detection location is designated as the second effective range. The network security detection equipment queries the built-in submodule topology configuration file and, based on the correspondence between the effective range and the submodule, determines the corresponding submodule within the first effective range as the primary detection submodule and the corresponding submodule within the second effective range as the secondary detection submodule, thus forming a preliminary subset of modules to be detected.

2. The method according to claim 1, characterized in that, The identification of abnormal traffic characteristics and the acquisition of the core interaction area between the target network and the network security detection equipment specifically include: Network security detection equipment uses a built-in traffic acquisition unit to capture the full data packets of the target network in real time. Based on a preset attack feature library, it uses a traffic feature extraction algorithm to analyze the information of the full data packets and identify abnormal traffic features. Based on the identified abnormal traffic characteristics, the regions that interact with the network security detection equipment within a specified time period are statistically recorded, and relevant data of each interaction region are collected synchronously. The interaction regions are then classified into the corresponding attack type interaction region set. The classification method involves the detection equipment calling the attack type standard intervals pre-stored in the configuration file, locating the standard intervals corresponding to the attack type that include core feature descriptions, comparing the collected interaction region data with the features of the attack type standard intervals one by one, confirming that the attack behavior in the interaction region fully matches the attack type features, and then classifying the interaction region into the corresponding attack type interaction region set to complete the classification operation. Next, the scene recognition module of the network security detection equipment, combined with real-time monitoring data, further confirms the attack scenario that the target network is currently suffering; in the already classified set of interaction areas, it filters out the areas that match the current attack scenario; and finally, it determines the interaction areas covered by the set of interaction areas as the core interaction areas.

3. The method according to claim 2, characterized in that, The step of constructing a set of modules to be detected based on the core interaction area includes: based on the attack scenario of the target network, dividing the detection sub-modules covered by the core interaction area into detection primary sub-modules and detection secondary sub-modules, and determining environmental detection sub-modules among the detection sub-modules not covered by the core interaction area. These sub-modules together constitute the set of modules to be detected.

4. The method according to claim 3, characterized in that, The step of constructing a set of modules to be detected based on the core interaction area further includes determining the environment detection sub-module to form a complete set of modules to be detected. The steps are as follows: 1) Auxiliary quantity setting: Based on the technical characteristics of the attack scenario and referring to the environmental impact range of this type of attack in historical detection data, the network security detection equipment sets a first auxiliary quantity for the main detection sub-module and a second auxiliary quantity for the secondary detection sub-module. The setting of the auxiliary quantity ensures that the environmental detection can fully cover the operating environment of the core module. 2) Adjacent module screening: The network security detection equipment calls the sub-module topology map to identify sub-modules not covered by the core interaction area, and determines the adjacency relationship by judging whether there is a direct data link between the sub-modules; In the uncovered sub-modules, select one or more sub-modules adjacent to the detection-leading sub-module as environmental detection sub-modules; Select one or more sub-modules adjacent to the secondary detection sub-module and add them to the environmental detection sub-module; 3) Assembly composition: Integrate the main detection sub-module, the secondary detection sub-module, and the environmental detection sub-module to form a complete set of modules to be detected. At the same time, record the unique type identifier, functional description, and inter-module relationship of each sub-module and store them in a temporary database.

5. The method according to claim 4, characterized in that, The process of determining the detection association score between any two adjacent sub-modules in the set of modules to be detected and constructing a detection association graph specifically includes: 1) Module type identification: The network security detection device reads the type identifiers of each adjacent sub-module in the set of modules to be detected through the sub-module type query interface, and clarifies the type attribute of each sub-module; 2) Detection parameter extraction: The real-time monitoring unit of the network security detection equipment sends parameter query instructions to adjacent sub-modules through the internal communication bus to obtain detection parameters of the same dimension to ensure parameter comparability. After the detection parameters are extracted, they are synchronously stored in the parameter cache area. 3) Score Calculation: First, calculate the difference between the detection parameters of adjacent sub-modules; second, collect all similar detection parameters in the set of modules to be detected. If there are multiple sets of data, sort them and take the median value to determine the median; third, based on the median, divide the difference interval according to preset rules, where the smaller the difference, the higher the corresponding score; fourth, query the preset score table to determine the score corresponding to the difference interval in which the difference is located. 4) Construction of detection association graph: Using the sub-modules in the set of modules to be detected as vertices and the detection parameter association score as the edge connecting the vertices, construct the detection association graph of the set of modules to be detected.

6. The method according to claim 5, characterized in that, The process involves using a graph theory algorithm to determine the optimal path based on the detection association graph, and then determining the detection adjustment order of each sub-module in the set of modules to be detected according to the optimal path. Specifically, this includes: First, the detection association graph is input into the Dijkstra algorithm to calculate the optimal path from the detection dominant submodule, through the detection secondary submodules, and finally to the environment detection submodule; Next, after the optimal path is determined, the detection and adjustment order is arranged according to the order of the sub-modules in the set of modules to be detected along the optimal path.

7. The method according to claim 6, characterized in that, The specific steps of the Dijkstra algorithm are as follows: 1) Preparatory work before applying Dijkstra's algorithm Determine the starting point: Select the detection-dominant submodule as the starting point of the algorithm; Graph Representation: The detection association graph is represented as an adjacency matrix or adjacency list, where each vertex represents a sub-module, each edge represents the association between sub-modules, and the edges are labeled with the detection association scores; Initialize the distance array: Create an array to record the shortest distance from the starting point to each vertex in the detection association graph; initially, the distance to the starting point is set to 0, and the distances to other vertices are set to infinity; Priority queue: Use a priority queue to store vertices to be processed, and process the vertex that is closest to the starting point first; 2) Applying Dijkstra's algorithm Vertex processing: Take the vertex closest to the starting point from the priority queue, set it as the current vertex, and traverse all its adjacent vertices; Distance update: For each adjacent vertex of the current vertex, calculate the distance from the starting point through the current vertex to the adjacent vertex; if the distance is less than the previously recorded distance, update the distance of the adjacent vertex and add it to the priority queue; Repeat the above vertex processing and distance update steps until the priority queue is empty, at which point all vertices have been processed; 3) Extraction of the optimal path Path backtracking: During the execution of Dijkstra's algorithm, an additional predecessor array is maintained to record the predecessor vertices of each vertex on the shortest path; after the algorithm ends, it is possible to backtrack from the end point to the starting point through the predecessor array, thereby obtaining the complete shortest path; Optimal path determination: Based on the shortest path information obtained from backtracking, determine the optimal detection path from the primary detection submodule to the secondary detection submodule, and then to the environmental detection submodule.

8. The method according to claim 7, characterized in that, The process of constructing a feature parameter sequence according to the detection adjustment order, inputting it into the intelligent detection model to generate a detection strategy, and then distributing it to each sub-module for execution includes: 1) Feature parameter sequence construction: The network security detection equipment extracts the feature parameters of each sub-module one by one through the parameter acquisition interface according to the determined detection and adjustment order; the feature parameters are arranged according to the detection and adjustment order to form a feature parameter sequence. If there are missing parameters, they are filled with the historical average parameter value of the sub-module to ensure the integrity of the sequence. 2) Model Input and Policy Generation: The constructed feature parameter sequence is input into the intelligent detection model deployed in the dedicated computing unit of the network security detection device. The intelligent detection model is trained with case data of more than 100,000 malware propagation scenarios and includes a three-layer structure: feature extraction layer, sequence analysis layer, and policy matching layer. The intelligent detection model extracts local features from the feature parameter sequence through convolution operations, captures the sequential dependencies between sub-modules through recurrent units, and finally calls the policy generation logic corresponding to the malware propagation scenario to output the targeted detection strategy of the sub-module. 3) Execution results: The task scheduling module of the network security detection equipment decomposes the generated detection strategy into specific operation instructions and sends them to each sub-module according to the detection adjustment order; after receiving the instructions, each sub-module starts the built-in execution engine to execute the detection task; during the execution process, each sub-module provides real-time feedback on the running status to the task scheduling module; after the detection is completed, the network security detection equipment summarizes the detection results and synchronously feeds the results back to the intelligent detection model for parameter optimization of the intelligent detection model.

9. An artificial intelligence-based network security vulnerability detection system, the system comprising a memory for storing computer program instructions and a processor for executing the program instructions, wherein, When the computer program instructions are executed by the processor, the system is triggered to execute the AI-based cybersecurity vulnerability detection method as described in any one of claims 1 to 8.

Images