Network security threat identification method based on artificial intelligence

Abstract

The invention relates to the technical field of network security, in particular to a network security threat identification method based on artificial intelligence, which comprises the following steps: dynamically sampling multi-source heterogeneous data based on threat risk level and timeliness; carrying out fusion preprocessing on the sampled data through mutual information redundancy elimination and cross-modal alignment; historical, real-time and interactive contribution degrees of the basic features are calculated, and multi-dimensional feature vectors are constructed through dynamic weight distribution; inputting the multi-dimensional feature vector into a hybrid neural network containing dynamic convolution kernel selection, time sequence residual connection and an attention layer, and predicting a threat probability; calculating an abnormal score, comparing the abnormal score with a preset threat threshold, and identifying a network security threat; and dynamically adjusting the preset threat baseline update frequency based on the threat severity and the type diversity. According to the method, through dynamic sampling and fusion preprocessing, dynamic feature vector and hybrid neural network construction, dynamic baseline adjustment and incremental learning, the data quality and prediction effect are improved, the threshold value is optimized, leakage and false alarm are reduced, and detection is stable.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity technology, and in particular to an artificial intelligence-based method for identifying cybersecurity threats. Background Technology

[0002] The development of cybersecurity threat identification technology exhibits significant technological iteration characteristics. In its early stages, threat detection primarily relied on static signature-based matching methods. This involved building signature databases of known attack patterns to identify malicious code such as viruses and worms, exemplified by Intrusion Detection Systems (IDS) and firewalls. As attack methods became more complex, single-signature matching proved insufficient to address unknown threats. The technological approach gradually shifted towards detection based on behavioral anomalies, identifying deviations by establishing baselines of normal behavior. Machine learning algorithms such as Support Vector Machines (SVMs) and Random Forests began to be applied to traffic analysis and log auditing. In recent years, the introduction of deep learning technology has further enhanced detection capabilities. Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) have been used to extract complex attack features. The widespread adoption of generative AI has ushered in an intelligent phase of attack and defense. Attackers utilize large language models to generate realistic phishing content, while defenders improve response efficiency through automated analysis tools. However, the overall approach has not yet broken through the technological framework of passive defense.

[0003] In practice, existing technological systems still have multi-dimensional limitations. At the data processing level, traditional static sampling strategies either over-collect data leading to resource waste or miss key threat data, making it difficult to balance completeness and efficiency. In the feature engineering stage, modal differences in multi-source heterogeneous data often lead to feature redundancy or information loss, and static weight allocation mechanisms cannot dynamically reflect the contribution of features under different threat scenarios. Regarding model construction, most detection models adopt fixed network structures, and the convolutional kernel size and attention allocation strategies lack adaptability, resulting in insufficient generalization ability when facing new threats such as encrypted traffic and zero-day vulnerabilities. In temporal modeling, single recurrent network structures are prone to gradient vanishing problems and do not fully consider the fusion and complementarity of spatial and temporal features. Furthermore, threat baseline updates rely on manual intervention, making it difficult to adapt to rapidly changing attack situations, resulting in consistently high false positive and false negative rates, especially in complex scenarios such as industrial control networks and cloud environments. These shortcomings directly restrict the real-time performance and accuracy of threat identification. Summary of the Invention

[0004] The purpose of this invention is to overcome the above-mentioned problems and provide a method for identifying cybersecurity threats based on artificial intelligence. To achieve the above objective, this invention adopts the following technical solution:

[0005] An artificial intelligence-based method for identifying cybersecurity threats includes the following steps:

[0006] Step S1: Perform dynamic sampling of multi-source heterogeneous data in the network environment based on threat risk level and data timeliness;

[0007] Step S2: Perform fusion preprocessing on the sampled data, including redundant feature removal based on mutual information and cross-modal data alignment;

[0008] Step S3: Construct a multidimensional feature vector by calculating the historical contribution, real-time importance, and feature interaction contribution of each basic feature using a dynamic weight allocation method;

[0009] Step S4: Input the multidimensional feature vector into a hybrid neural network model containing a dynamic convolution kernel selection mechanism, temporal residual connections, and attention layers to predict the threat probability. The dynamic convolution kernel selection mechanism dynamically matches the convolution kernel size according to the dimension and data type of the feature sub-vector.

[0010] Step S5: Calculate the anomaly score based on the output of the hybrid neural network model, and compare the anomaly score with a preset threat threshold to identify cybersecurity threats;

[0011] Step S6: Dynamically adjust the update frequency of the preset threat baseline based on the threat severity and threat type diversity in the threat identification results.

[0012] Furthermore, in step S1, dynamic sampling is achieved in the following way:

[0013] Multi-source heterogeneous data are classified according to preset threat risk levels, and each risk level corresponds to a basic sampling frequency. The preset threat risk levels are based on the potential impact range of the threat on the network system: the impact range covering the core business system is the high risk level, the impact range covering the non-core business system is the medium risk level, and the impact range having no direct business impact is the low risk level. The basic sampling frequency of the high, medium and low risk levels decreases in that order.

[0014] For data at each risk level, a data timeliness coefficient is calculated based on the time difference between the data generation time and the current time.

[0015] The data timeliness coefficient is calculated using the following formula:

[0016]

[0017] Where Δt is the time difference between the data generation time and the current time; τ is the data timeliness coefficient;

[0018] The dynamic sampling frequency is calculated using the following formula:

[0019] f s =f b ·(1+τ);

[0020] Among them, f b is the basic sampling frequency corresponding to the risk level; f s is the dynamic sampling frequency; τ is the data timeliness coefficient.

[0021] Furthermore, in step S3, when constructing the multi-dimensional feature vector, the dynamic weights of each basic feature are calculated by the following formula:

[0022] w i =α·h i +β·r i +(1-α-β)·c i ;

[0023] Among them, w i is the dynamic weight of the i-th basic feature; α is the historical contribution weight coefficient; β is the real-time importance weight coefficient; h i is the historical contribution of the i-th basic feature; r i is the real-time importance of the i-th basic feature; c i is the feature interaction contribution of the i-th basic feature; and α, β are constants greater than 0, and α + β < 1;

[0024] The relative relationship and dynamic allocation logic between α and β are dynamically adjusted by the threat environment stability index: The threat environment stability index is comprehensively determined based on the historical threat type change rate, the emergence frequency of new threats, and the threat feature distribution entropy value within a unit time. When the threat environment stability index is higher than the preset stability threshold, it is determined as a stable environment, and at this time α > β; when the threat environment stability index is lower than or equal to the preset stability threshold, it is determined as a fluctuating environment, and at this time β > α;

[0025] The specific values of α and β are dynamically allocated by the following formula:

[0026]

[0027] Among them, S is the normalized value of the threat environment stability index; T = 1 - S, which is the normalized value of the threat environment volatility index; k is the weight allocation coefficient (0 < k < 1); α is the historical contribution weight coefficient; β is the real-time importance weight coefficient.

[0028] Furthermore, h i , r i , c i are respectively the historical contribution, real-time importance, and feature interaction contribution of the i-th basic feature, and the specific calculation methods are as follows:

[0029] The historical contribution is calculated by the following formula:

[0030]

[0031] Where, N i,correct N represents the number of times this basic feature was correctly identified in historical threat samples. i,total h is the total number of times this basic feature appears in the historical threat sample; i The historical contribution of the i-th basic feature;

[0032] Real-time importance is calculated using the following formula:

[0033]

[0034] Where, x i This represents the current value of the basic feature; μ i This is the mean value of the normal range of values ​​for this basic characteristic; σ i r is the standard deviation of the normal range of values ​​for this basic feature. i The real-time importance of the i-th basic feature;

[0035] Feature interaction contribution is calculated using the following formula:

[0036]

[0037] Where M is the total number of basic features; I(f i ,f j f represents the mutual information between the i-th basic feature and the j-th basic feature; i The mutual information of the i-th basic feature; f i The mutual information of the i-th basic feature; f j c is the j-th basic feature; i The feature interaction contribution of the i-th basic feature; where P(f i ,f j ) is a feature f i with f j The joint probability distribution of P(f) i ) is a feature f i Marginal probability distribution; P(f j ) is a feature f j The marginal probability distribution; the i-th element in the multidimensional feature vector is the normalized value of the corresponding basic feature and the dynamic weight w of that basic feature. i The product of.

[0038] Furthermore, in step S4, the dynamic convolutional kernel selection mechanism is implemented in the following way:

[0039] Multidimensional feature vectors are categorized into numerical feature vectors and text feature vectors based on their data type. For numerical feature vectors, the convolution kernel size is calculated using the following formula:

[0040]

[0041] Where D is the dimension of the numerical feature vector; is the floor function; k is the kernel size of the numerical feature vectors;

[0042] For text-based feature vectors, the convolution kernel size is calculated using the following formula:

[0043] k text =k base +Δk;

[0044] Among them, D text k represents the dimension of the text-type feature vectors. base The size of the base convolution kernel for textual feature vectors is determined by the formula... Calculated; Δk is the text feature correction coefficient; k text The size of the convolution kernel for text-type feature vectors;

[0045] The text feature correction coefficient Δk is dynamically adjusted according to the semantic complexity level of the text feature sub-vectors. The semantic complexity level is determined by a combination of the text vocabulary size, sentence structure complexity, and domain terminology density.

[0046] The structure of the hybrid neural network model includes: a convolutional layer that performs convolution operations on each feature sub-vector using dynamically selected convolutional kernels to output spatial correlation features; a long short-term memory layer that performs temporal modeling on the spatial correlation features to output temporal correlation features; a temporal residual connection that adds the temporal correlation features and spatial correlation features element by element to obtain residual fusion features; an attention layer that assigns attention weights to the features at each time step in the residual fusion features, normalizes them using the softmax function, and then performs a weighted summation to output key features; and an output layer that outputs the predicted probability of cybersecurity threats based on the key features.

[0047] Furthermore, in step S2, the fusion preprocessing is achieved through the following steps:

[0048] Step S21: Calculate the mutual information I(f) between any two features in the sampled data. p ,f q ), will mutually inform I(f p ,f q Features with mutual information below a preset threshold are considered redundant and are removed.

[0049] Step S22: For the remaining non-redundant features, when the features belong to different data modalities, calculate the semantic association weights of the features of different modalities through the attention mechanism, convert the text features into a vector space of the same dimension as the numerical features, and perform cross-modal data alignment.

[0050] Further, in step S5, the anomaly score is calculated using the following formula:

[0051] S = p·(1+θ·d);

[0052] Where S is the anomaly score; p is the predicted probability of cybersecurity threats output by the hybrid neural network model; θ is the feature deviation influence coefficient; and d is the feature deviation of the multidimensional feature vector relative to the preset threat baseline.

[0053] The characteristic deviation is calculated using the following formula:

[0054]

[0055] Where v is the currently constructed multidimensional feature vector; v0 is the feature vector corresponding to the preset threat baseline; v·v0 is the inner product of vector v and vector v0; ||v|| is the magnitude of vector v; ||v0|| is the magnitude of vector v0; and d is the feature deviation.

[0056] Furthermore, in step S6, the update frequency of the preset threat baseline is dynamically adjusted and calculated using the following formula:

[0057] f=f0·(1+γ·t+δ·s·d t );

[0058] Where f is the adjusted preset threat baseline update frequency; f0 is the initial update frequency; γ is the threat quantity impact coefficient; δ is the threat quality impact coefficient, and γ and δ are constants greater than 0; t is the number of times network security threats are identified per unit time; s is the threat severity coefficient; d t Threat type diversity index;

[0059] The threat severity coefficient is quantified based on the potential damage level of a threat to the network system. The potential damage level includes system paralysis, data leakage, functional abnormality, and alarm disturbance. System paralysis corresponds to the highest severity coefficient, data leakage corresponds to the second highest severity coefficient, functional abnormality corresponds to the medium severity coefficient, and alarm disturbance corresponds to the lowest severity coefficient. The threat type diversity index is calculated by the ratio of the number of different threat types identified per unit time to the total number of threats. The update of the preset threat baseline is performed through an incremental learning method, using sample data determined to have no network security threats in the identification results to update the baseline model parameters.

[0060] The advantages of this invention are:

[0061] 1. This invention performs dynamic sampling on multi-source heterogeneous data in the network environment based on threat risk level and data timeliness, and combines mutual information redundant feature elimination and cross-modal data alignment fusion preprocessing to reduce redundant computational overhead while ensuring the integrity of key threat data. Compared with traditional static sampling methods, it improves data processing efficiency and feature quality, and provides a more reliable data foundation for threat prediction.

[0062] 2. This invention constructs a multi-dimensional feature vector by calculating the historical contribution, real-time importance, and feature interaction contribution of each basic feature using a dynamic weight allocation method. This vector is then input into a hybrid neural network model that includes a dynamic convolution kernel selection mechanism, temporal residual connections, and attention layers. This enables accurate capture and dynamic adaptation of threat features in complex networks. Compared with single-structure neural networks, this invention improves the accuracy and generalization ability of threat probability prediction, especially in the scenario of identifying novel and unknown threats.

[0063] 3. This invention dynamically adjusts the update frequency of the preset threat baseline based on the threat severity and threat type diversity in the threat identification results. By using incremental learning methods to update the baseline model parameters with non-threat sample data, it achieves adaptive optimization of the threat detection threshold, avoiding the false negatives and false alarms caused by traditional fixed baselines. This allows the system to maintain stable and efficient detection performance even when the network threat situation changes. Attached Figure Description

[0064] The accompanying drawings, which form part of this application, are used to provide a further understanding of the application and to make other features, objects, and advantages of the application more apparent. The illustrative embodiments and descriptions of this application are used to explain the application and do not constitute an undue limitation of the application.

[0065] In the attached diagram:

[0066] Figure 1 This is a flowchart of an artificial intelligence-based network security threat identification method in Example 1.

[0067] Figure 2 This is a detailed flowchart of the anomaly score calculation and threat identification process in an AI-based cybersecurity threat identification method, as shown in Example 1. Detailed Implementation

[0068] The present invention will now be described in detail and specifically through specific embodiments to enable a better understanding of the invention. However, the following embodiments do not limit the scope of protection of the present invention.

[0069] Example 1

[0070] like Figure 1-2 As shown, an artificial intelligence-based method for identifying cybersecurity threats includes the following steps:

[0071] Step S1: Perform dynamic sampling of multi-source heterogeneous data in the network environment based on threat risk level and data timeliness;

[0072] Step S2: Perform fusion preprocessing on the sampled data, including redundant feature removal based on mutual information and cross-modal data alignment;

[0073] Step S3: Construct a multidimensional feature vector by calculating the historical contribution, real-time importance, and feature interaction contribution of each basic feature using a dynamic weight allocation method;

[0074] Step S4: Input the multidimensional feature vector into a hybrid neural network model containing a dynamic convolution kernel selection mechanism, temporal residual connections, and attention layers to predict the threat probability. The dynamic convolution kernel selection mechanism dynamically matches the convolution kernel size according to the dimension and data type of the feature sub-vector.

[0075] Step S5: Calculate the anomaly score based on the output of the hybrid neural network model, and compare the anomaly score with a preset threat threshold to identify cybersecurity threats;

[0076] Step S6: Dynamically adjust the update frequency of the preset threat baseline based on the threat severity and threat type diversity in the threat identification results.

[0077] In a specific embodiment, this method addresses the problems of low efficiency in multi-source data processing, inaccurate feature representation, and insufficient model generalization ability in network security threat identification scenarios by designing a dynamic optimization scheme for the entire process.

[0078] First, data sampling step S1 is executed. Considering the diverse data types and significant differences in threat risk levels in the network environment, traditional static sampling often leads to the omission of high-risk data or the redundancy of low-value data. Therefore, dynamic adjustments are made based on threat risk level and data timeliness. Threat risk level is divided according to the potential impact scope to ensure that high-risk data related to core business is collected first. Data timeliness is quantified by the time difference between the generation time and the current time, with recent data given higher sampling priority. This dual-dimensional dynamic adjustment can both retain key threat information and avoid invalid data consuming computing resources.

[0079] Entering the fusion preprocessing stage in step S2, multi-source heterogeneous data suffers from feature redundancy and modal differences. Redundant features increase model complexity, while inconsistent cross-modal data formats affect feature fusion performance. Therefore, redundant features are first removed using mutual information calculation. Mutual information effectively measures dependencies between features; features below a threshold are deemed redundant and removed, reducing interference from invalid features. For different modalities, such as numerical traffic features and textual alarm features, an attention mechanism is used to calculate semantic association weights, converting textual features into a vector space of the same dimension as numerical features, achieving cross-modal alignment and ensuring consistency in subsequent feature processing.

[0080] Step S3 focuses on feature vector construction. Traditional fixed weight allocation cannot reflect the dynamic importance of features under different threat scenarios. Therefore, dynamic weights are calculated by combining historical contribution, real-time importance, and feature interaction contribution. Historical contribution reflects the stable role of features in past threat identification, real-time importance captures abnormal fluctuations of features in current data, and interaction contribution considers the interaction between features. The weighted fusion of these three factors enables the feature vector to adapt to changes in the threat environment and improves the ability to represent complex threats.

[0081] Step S4 employs a hybrid neural network model for threat probability prediction, as a single network structure is insufficient to adapt to multi-dimensional features and temporal characteristics. A dynamic kernel selection mechanism matches the kernel size to the feature vector dimension and data type; when the numerical feature dimension differs, the kernel size needs to be adjusted accordingly to fully extract local features. Temporal residual connections address the vanishing gradient problem in deep networks, enhancing the transmission of temporal features. The attention layer highlights features at key time steps, improving the model's sensitivity to important threat signals. This multi-mechanism fusion design makes the model more adaptable to handling complex attack patterns.

[0082] Step S5 determines the threat by anomaly score. Directly using the model output probability may ignore the degree of feature deviation from the baseline. Therefore, the anomaly score is calculated by combining the predicted probability and the feature deviation. The feature deviation is quantified by the inner product of the current feature vector and the preset baseline vector and the ratio of the magnitude. Combining the two can more comprehensively reflect the actual risk level of the threat.

[0083] Step S6 dynamically adjusts the threat baseline update frequency. A fixed baseline is prone to missed or false alarms when the threat landscape changes. Therefore, the update frequency is adjusted based on threat severity and type diversity. Severity is quantified according to the potential damage level, and type diversity is reflected by the proportion of different threat types. Incremental learning is used to update baseline parameters with threat-free samples, enabling the baseline to adapt to the dynamic evolution of network threats in real time and maintain the system's long-term stable detection performance.

[0084] Furthermore, in step S1, dynamic sampling is achieved in the following way:

[0085] Multi-source heterogeneous data are classified according to preset threat risk levels, and each risk level corresponds to a basic sampling frequency. The preset threat risk levels are based on the potential impact range of the threat on the network system: the impact range covering the core business system is the high risk level, the impact range covering the non-core business system is the medium risk level, and the impact range having no direct business impact is the low risk level. The basic sampling frequency of the high, medium and low risk levels decreases in that order.

[0086] For data at each risk level, a data timeliness coefficient is calculated based on the time difference between the data generation time and the current time.

[0087] The data timeliness coefficient is calculated using the following formula:

[0088]

[0089] Where Δt is the time difference between the data generation time and the current time; τ is the data timeliness coefficient;

[0090] The dynamic sampling frequency is calculated using the following formula:

[0091] f s =f b ·(1+τ);

[0092] Among them, f b The base sampling frequency corresponding to the risk level; f s τ is the dynamic sampling frequency; τ is the data timeliness coefficient.

[0093] In a specific embodiment, the dynamic sampling in step S1 is achieved by coupling risk level classification with a timeliness coefficient to solve the problem of unreasonable resource allocation in traditional sampling strategies. First, multi-source heterogeneous data is classified according to threat risk level. Data related to core business systems, including server traffic and database operation logs, is classified as high-risk; non-core business data, such as ordinary user access records, is classified as medium-risk; and data without direct business impact, such as redundant backup logs, is classified as low-risk. The basic sampling frequency f decreases progressively with each level. b This ensures higher collection density for high-risk data and avoids the loss of critical threat signals. Data timeliness is calculated using a time difference Δt, with a timeliness coefficient τ. The design of τ prioritizes recent data values, leading to a higher sampling frequency. This is because network attacks are highly time-sensitive; recent data contains more real-time threat characteristics, while older data has lower threat relevance and does not require high-frequency sampling. The dynamic sampling frequency f... s By the basic sampling frequency f b The product of f and the timeliness coefficient τ is used to calculate that when the data risk level is high and the generation time is recent, f s Increase the intensity of data collection; when the risk level is low or the data is outdated, fs Reduce to save resources, and this dual - adjustment mechanism achieves a balance between data acquisition efficiency and the integrity of key information.

[0094] Furthermore, in step S3, when constructing the multi - dimensional feature vector, the dynamic weights of each basic feature are calculated by the following formula:

[0095] w i =α·h i +β·r i +(1 - α - β)·c i ;

[0096] where, w i is the dynamic weight of the i - th basic feature; α is the historical contribution weight coefficient; β is the real - time importance weight coefficient; h i is the historical contribution of the i - th basic feature; r i is the real - time importance of the i - th basic feature; c i is the feature interaction contribution of the i - th basic feature; and α, β are constants greater than 0, and α + β < 1;

[0097] The relative relationship and dynamic allocation logic of α and β are dynamically adjusted by the threat environment stability index: The threat environment stability index is comprehensively determined based on the historical threat type change rate, the emergence frequency of new threats, and the threat feature distribution entropy value within a unit time. When the threat environment stability index is higher than the preset stability threshold, it is determined as a stable environment, and at this time, α > β; when the threat environment stability index is lower than or equal to the preset stability threshold, it is determined as a fluctuating environment, and at this time, β > α;

[0098] The specific values of α and β are dynamically allocated by the following formula:

[0099]

[0100] where, S is the normalized value of the threat environment stability index; T = 1 - S, is the normalized value of the threat environment volatility index; k is the weight allocation coefficient (0 < k < 1); α is the historical contribution weight coefficient; β is the real - time importance weight coefficient.

[0101] In a specific embodiment, the dynamic weight allocation in step S3 is achieved through multi - dimensional feature importance evaluation to solve the problem that traditional fixed weights cannot adapt to the dynamic changes of the threat environment. The dynamic weight w i is designed by integrating the historical contribution h i , the real - time importance r i and the feature interaction contribution c i , and the three respectively reflect the long - term stability, the current abnormal degree, and the interaction of features, avoiding the one - sidedness of single - dimension evaluation.

[0102] The weighting coefficients α and β are dynamically adjusted through a threat environment stability index, which is determined based on a comprehensive assessment of historical threat type change rates, the frequency of emerging threats, and characteristic distribution entropy values. When the environment is stable, historical threat patterns are highly repetitive, and α > β, thus increasing the historical contribution h. i With a larger proportion, mature feature experience is used to improve recognition stability; when the environment fluctuates and new threats frequently emerge, β>α enhances real-time importance. i The weights are used to capture sudden anomaly features. In the allocation formula of α and β, S is the normalized value of the stability index, T = 1 - S is the volatility index, and k is the weight allocation coefficient. This design allows α and β to transition smoothly with environmental changes, avoids model oscillations caused by sudden weight changes, and improves the adaptability of feature vectors to complex threat environments.

[0103] Furthermore, h i r i c i These represent the historical contribution, real-time importance, and feature interaction contribution of the i-th basic feature, respectively, calculated as follows:

[0104] Historical contribution is calculated using the following formula:

[0105]

[0106] Where, N i,correct N represents the number of times this basic feature was correctly identified in historical threat samples. i,total h is the total number of times this basic feature appears in the historical threat sample; i The historical contribution of the i-th basic feature;

[0107] Real-time importance is calculated using the following formula:

[0108]

[0109] Where, x i This represents the current value of the basic feature; μ i This is the mean value of the normal range of values ​​for this basic characteristic; σ i r is the standard deviation of the normal range of values ​​for this basic feature. i The real-time importance of the i-th basic feature;

[0110] Feature interaction contribution is calculated using the following formula:

[0111]

[0112] Where M is the total number of basic features; I(f i ,f j f represents the mutual information between the i-th basic feature and the j-th basic feature;i The mutual information of the i-th basic feature; f i The mutual information of the i-th basic feature; f j c is the j-th basic feature; i The feature interaction contribution of the i-th basic feature; where P(f i ,f j ) is a feature f i with f j The joint probability distribution of P(f) i ) is a feature f i Marginal probability distribution; P(f j ) is a feature f j The marginal probability distribution; the i-th element in the multidimensional feature vector is the normalized value of the corresponding basic feature and the dynamic weight w of that basic feature. i The product of.

[0113] In a specific embodiment, the feature contribution calculation in step S3 is carried out from three dimensions: historical, real-time, and interactive, to comprehensively characterize the role of features in threat identification. Historical contribution h i By correctly identifying the number N i,correct Total number of occurrences N i,total The ratio quantification reflects the stable contribution of a feature in past threat samples. For example, if an abnormal connection feature of a certain port is correctly identified multiple times in historical attacks, then h... i A high value indicates that it has a strong indicative role for traditional threat types.

[0114] Real-time importance r i Based on the current value x i Compared with the mean value of the normal range μ i Standard deviation σ i The deviation calculation is used to capture sudden abnormal characteristics, such as a certain traffic characteristic x. i Suddenly far exceeding μ i +3σ i The normal range, r i An increasing value suggests that the feature may be related to new types of attacks. Feature interaction contribution c i The interaction between features is reflected by calculating the mean of mutual information with other features. For example, when the mutual information between the features "abnormal login IP" and "sensitive file access" is high, the interaction contribution c between the two is high. i An increase indicates a higher probability of threat when they occur together. The elements of the multidimensional feature vector are determined by feature normalization values ​​and dynamic weights w. i The product of these features constitutes a weighted processing method that ensures that important features dominate the vector, reduces interference from irrelevant features, and provides a more accurate feature representation for the model input.

[0115] Furthermore, in step S4, the dynamic convolutional kernel selection mechanism is implemented in the following way:

[0116] Multidimensional feature vectors are categorized into numerical feature vectors and text feature vectors based on their data type. For numerical feature vectors, the convolution kernel size is calculated using the following formula:

[0117]

[0118] Where D is the dimension of the numerical feature vector; is the floor function; k is the kernel size of the numerical feature vectors;

[0119] For text-based feature vectors, the convolution kernel size is calculated using the following formula:

[0120] k text =k base +Δk;

[0121] Among them, D text k represents the dimension of the text-type feature vectors. base The size of the base convolution kernel for textual feature vectors is determined by the formula... Calculated; Δk is the text feature correction coefficient; k text The size of the convolution kernel for text-type feature vectors;

[0122] The text feature correction coefficient Δk is dynamically adjusted according to the semantic complexity level of the text feature sub-vectors. The semantic complexity level is determined by a combination of the text vocabulary size, sentence structure complexity, and domain terminology density.

[0123] The structure of the hybrid neural network model includes: a convolutional layer that performs convolution operations on each feature sub-vector using dynamically selected convolutional kernels to output spatial correlation features; a long short-term memory layer that performs temporal modeling on the spatial correlation features to output temporal correlation features; a temporal residual connection that adds the temporal correlation features and spatial correlation features element by element to obtain residual fusion features; an attention layer that assigns attention weights to the features at each time step in the residual fusion features, normalizes them using the softmax function, and then performs a weighted summation to output key features; and an output layer that outputs the predicted probability of cybersecurity threats based on the key features.

[0124] In a specific embodiment, the dynamic convolution kernel selection mechanism in step S4 is designed to address the dimensional differences of different types of features, thereby improving the convolutional layer's ability to extract features. After the multidimensional feature vector is divided into numerical and textual sub-vectors according to data type, the dimension D of the numerical feature sub-vector directly affects the convolution kernel size k. Calculations show that when the feature vector dimension D is 8, the convolution kernel size k is calculated as follows: That is, 4. Smaller convolutional kernels are adapted to low-dimensional features to avoid overfitting; when D is 32 and k is 6, larger convolutional kernels can capture the global correlation of high-dimensional features. This logarithmic relationship makes the size of the convolutional kernel increase non-linearly with the increase of dimension, balancing the extraction needs of local details and global features.

[0125] Textual feature vectors at basic convolution kernel size k base Based on this, add a text feature correction coefficient Δk to obtain k text Where the basic convolution kernel size k base pass Calculate, D text Δk represents the dimension of the text sub-vectors. Δk is adjusted according to the semantic complexity level. For text features with a large vocabulary, complex sentence structure, or high density of domain terms, Δk is increased to enhance the capture of deep semantic relationships, resolve the differences in representation methods between text features and numerical features, and improve the convolution processing effect of cross-type features.

[0126] In the hybrid neural network structure, the spatial correlation features output by the convolutional layer are temporally modeled by the long short-term memory layer and then added element-wise to the original spatial features through temporal residual connections. This alleviates the gradient vanishing problem in deep networks and enhances the transmission efficiency of temporal features. The attention layer assigns weights to each time step of the residual fusion features, and after softmax normalization, it highlights the threat signals at key time points. As a result, the key features output are more focused on the core patterns of attack behavior, improving the model's accuracy in identifying complex temporal threats.

[0127] Furthermore, in step S2, the fusion preprocessing is achieved through the following steps:

[0128] Step S21: Calculate the mutual information I(f) between any two features in the sampled data. p ,f q ), will mutually inform I(f p ,f q Features with mutual information below a preset threshold are considered redundant and are removed.

[0129] Step S22: For the remaining non-redundant features, when the features belong to different data modalities, calculate the semantic association weights of the features of different modalities through the attention mechanism, convert the text features into a vector space of the same dimension as the numerical features, and perform cross-modal data alignment.

[0130] In a specific embodiment, the fusion preprocessing in step S2 achieves efficient integration of multi-source data through two steps. In S21, the mutual information of any two features is calculated to eliminate redundant features. Mutual information, as an indicator of the correlation of random variables, can effectively identify feature pairs with overlapping information. For example, the features "port number" and "service type" are often highly correlated. When the mutual information is lower than the threshold, it is judged as redundant and eliminated, reducing feature dimensions while avoiding information duplication and reducing the computational complexity of the model.

[0131] S22 addresses the spatial inconsistency issue of features across different modalities, such as numerical traffic features and text-based alarm descriptions, by employing an attention mechanism to calculate semantic association weights. Text-based features are converted into vectors through a pre-trained language model and reside in the same vector space as numerical features. Attention weights are dynamically allocated based on the semantic similarity between features. For example, the text feature "abnormal login" has a higher semantic association weight than the numerical feature "number of failed logins." Weight adjustment aligns cross-modal features at the semantic level, resolving the fusion difficulties caused by differences in multimodal data structures and providing a consistent data foundation for feature vector construction.

[0132] Further, in step S5, the anomaly score is calculated using the following formula:

[0133] S = p·(1+θ·d);

[0134] Where S is the anomaly score; p is the predicted probability of cybersecurity threats output by the hybrid neural network model; θ is the feature deviation influence coefficient; and d is the feature deviation of the multidimensional feature vector relative to the preset threat baseline.

[0135] The characteristic deviation is calculated using the following formula:

[0136]

[0137] Where v is the currently constructed multidimensional feature vector; v0 is the feature vector corresponding to the preset threat baseline; v·v0 is the inner product of vector v and vector v0; ||v|| is the magnitude of vector v; ||v0|| is the magnitude of vector v0; and d is the feature deviation.

[0138] In a specific embodiment, the anomaly score calculation in step S5 combines the model prediction probability and the feature deviation to improve the reliability of threat determination. The anomaly score S is obtained by comprehensively calculating the prediction probability p and the feature deviation d, where p is the threat prediction probability output by the hybrid neural network, reflecting the degree of matching of the model with the attack pattern of the current feature; d is the feature deviation, which is calculated by the inner product of the current feature vector v and the preset threat baseline vector v0 and the magnitude, quantifying the degree of deviation between the current feature and the normal baseline.

[0139] When a sample has a high predicted probability p but a small feature deviation d (meaning the feature is close to the baseline), it may be a misjudgment due to benign fluctuations, and the S value will not be too high. Conversely, if p is moderate but d is large (meaning the feature deviates significantly from the baseline), the S value increases to indicate a potential new threat. θ, as the feature deviation influence coefficient, balances the weights of probability p and deviation d, allowing the anomaly score S to comprehensively consider both model confidence and the degree of feature anomaly, providing a more comprehensive assessment than a single probability judgment and reducing the risk of false alarms caused by feature fluctuations or model bias.

[0140] Furthermore, in step S6, the update frequency of the preset threat baseline is dynamically adjusted and calculated using the following formula:

[0141] f=f0·(1+γ·t+δ·s·d t );

[0142] Where f is the adjusted preset threat baseline update frequency; f0 is the initial update frequency; γ is the threat quantity impact coefficient; δ is the threat quality impact coefficient, and γ and δ are constants greater than 0; t is the number of times network security threats are identified per unit time; s is the threat severity coefficient; d t Threat type diversity index;

[0143] The threat severity coefficient is quantified based on the potential damage level of a threat to the network system. The potential damage level includes system paralysis, data leakage, functional abnormality, and alarm disturbance. System paralysis corresponds to the highest severity coefficient, data leakage corresponds to the second highest severity coefficient, functional abnormality corresponds to the medium severity coefficient, and alarm disturbance corresponds to the lowest severity coefficient. The threat type diversity index is calculated by the ratio of the number of different threat types identified per unit time to the total number of threats. The update of the preset threat baseline is performed through an incremental learning method, using sample data determined to have no network security threats in the identification results to update the baseline model parameters.

[0144] In a specific embodiment, the preset threat baseline update frequency dynamic adjustment mechanism in step S6 solves the problem that a fixed baseline cannot adapt to changes in the threat situation. The update frequency f is determined by the initial frequency f0, the number of threat identifications t per unit time, the threat severity coefficient s, and the threat type diversity index d. t The comprehensive calculation shows that t reflects the threat occurrence density, s is quantified according to the potential damage level such as system paralysis and data breach, and higher severity threats require higher baseline adaptability. t The more diverse the types of threats, the more drastic the changes in threat patterns, as calculated by the ratio of the number of different threat types to the total number of threats.

[0145] γ and δ, as positive coefficients, adjust the weights of the quantitative and qualitative impacts of threats, respectively. When the number of threats, their severity, or their types increase per unit time, f increases to accelerate baseline updates; conversely, the update frequency decreases to save resources. The baseline update employs an incremental learning method, adjusting parameters only using non-threat sample data to avoid polluting the baseline with attack samples. This dynamic update strategy enables the baseline to track normal behavior patterns in the network environment in real time, maintaining sensitive identification of abnormal behavior even when the threat landscape changes, and ensuring long-term stable detection performance of the system.

[0146] The specific embodiments of the present invention have been described in detail above, but they are merely examples, and the present invention is not equivalent to the specific embodiments described above. For those skilled in the art, any equivalent modifications and substitutions to the present invention are also within the scope of the present invention. Therefore, all equivalent transformations and modifications made without departing from the spirit and scope of the present invention should be covered within the scope of the present invention.

Claims

1. A method for identifying cybersecurity threats based on artificial intelligence, characterized in that, It includes the following steps: Step S1: Perform dynamic sampling on multi-source heterogeneous data in the network environment based on threat risk level and data timeliness; Step S2: Perform fusion preprocessing on the sampled data, including redundant feature elimination based on mutual information and cross-modal data alignment; Step S3: Construct a multi-dimensional feature vector in a dynamic weight allocation manner by calculating the historical contribution degree, real-time importance, and feature interaction contribution degree of each basic feature; Step S4: Input the multi-dimensional feature vector into a hybrid neural network model including a dynamic convolution kernel selection mechanism, a temporal residual connection, and an attention layer for threat probability prediction. The dynamic convolution kernel selection mechanism dynamically matches the convolution kernel size according to the dimension and data type of the feature sub-vector; Step S5: Calculate the anomaly score based on the output result of the hybrid neural network model, and compare the anomaly score with a preset threat threshold to identify network security threats; Step S6: Dynamically adjust the update frequency of the preset threat baseline based on the threat severity and threat type diversity in the threat recognition result.

2. The method for identifying cybersecurity threats based on artificial intelligence according to claim 1, characterized in that, In step S1, the dynamic sampling is implemented as follows: The multi-source heterogeneous data is divided according to the preset threat risk level, and each risk level corresponds to a basic sampling frequency. The preset threat risk level is divided based on the potential impact range of the threat on the network system: the high-risk level covers the core business system, the medium-risk level covers the non-core business system, and the low-risk level has no direct business impact. The basic sampling frequencies of the high, medium, and low risk levels decrease in sequence; For the data of each risk level, calculate the data timeliness coefficient according to the time difference between the data generation time and the current time. The data timeliness coefficient is calculated by the following formula: where, Δt is the time difference between the data generation time and the current time; τ is the data timeliness coefficient; The dynamic sampling frequency is calculated by the following formula: f s =f b ·(1+τ); Among them, f b The base sampling frequency corresponding to the risk level; f s τ is the dynamic sampling frequency; τ is the data timeliness coefficient.

3. The method for identifying cybersecurity threats based on artificial intelligence according to claim 2, characterized in that, In step S3, when constructing the multi-dimensional feature vector, the dynamic weight of each basic feature is calculated by the following formula: w i =a·h i +β·r i +(1-a-b)·c i ; Among them, w i The dynamic weight of the i-th basic feature; α is the historical contribution weight coefficient; β is the real-time importance weight coefficient; h i The historical contribution of the i-th basic feature; r i c represents the real-time importance of the i-th basic feature; i Let α be the feature interaction contribution of the i-th basic feature; and α and β are constants greater than 0, where α + β < 1. The relative relationship and dynamic allocation logic of α and β are dynamically adjusted by the threat environment stability index. The threat environment stability index is comprehensively determined based on the historical threat type change rate, the emergence frequency of new threats, and the threat feature distribution entropy value within a unit time. When the threat environment stability index is higher than the preset stability threshold, it is determined as a stable environment, and at this time α > β; when the threat environment stability index is lower than or equal to the preset stability threshold, it is determined as a fluctuating environment, and at this time β > α; The specific values of α and β are dynamically allocated by the following formula: where, S is the normalized value of the threat environment stability index; T = 1 - S, which is the normalized value of the threat environment volatility index; k is the weight allocation coefficient (0 < k < 1); α is the historical contribution degree weight coefficient; β is the real-time importance weight coefficient.

4. The method for identifying cybersecurity threats based on artificial intelligence according to claim 3, characterized in that, The h i r i c i These represent the historical contribution, real-time importance, and feature interaction contribution of the i-th basic feature, respectively, calculated as follows: The historical contribution degree is calculated by the following formula: Where, N i,correct N represents the number of times this basic feature was correctly identified in historical threat samples. i,total h is the total number of times this basic feature appears in the historical threat sample; i The historical contribution of the i-th basic feature; The real-time importance is calculated by the following formula: Where, x i This represents the current value of the basic feature; μ i This is the mean value of the normal range of values ​​for this basic characteristic; σ i r is the standard deviation of the normal range of values ​​for this basic feature. i The real-time importance of the i-th basic feature; The feature interaction contribution degree is calculated by the following formula: Where M is the total number of basic features; I(f i ,f j f represents the mutual information between the i-th basic feature and the j-th basic feature; i The mutual information of the i-th basic feature; f i The mutual information of the i-th basic feature; f j c is the j-th basic feature; i The feature interaction contribution of the i-th basic feature; where P(f i ,f j ) is a feature f i with f j The joint probability distribution of P(f) i ) is a feature f i Marginal probability distribution; P(f j ) is a feature f j The marginal probability distribution; the i-th element in the multidimensional feature vector is the normalized value of the corresponding basic feature and the dynamic weight w of that basic feature. i The product of.

5. The method for identifying cybersecurity threats based on artificial intelligence according to claim 4, characterized in that, In step S4, the dynamic convolution kernel selection mechanism is implemented as follows: Multidimensional feature vectors are categorized into numerical feature vectors and text feature vectors based on their data type. For numerical feature vectors, the convolution kernel size is calculated using the following formula: Where D is the dimension of the numerical feature vector; is the floor function; k is the kernel size of the numerical feature vectors; For text-based feature vectors, the convolution kernel size is calculated using the following formula: k text =k base +Δk; Among them, D text k represents the dimension of the text-type feature vectors. base The size of the base convolution kernel for textual feature vectors is determined by the formula... Calculated; Δk is the text feature correction coefficient; k text The size of the convolution kernel for text-type feature vectors; The text feature correction coefficient Δk is dynamically adjusted according to the semantic complexity level of the text feature sub-vectors. The semantic complexity level is determined based on a comprehensive assessment of the text vocabulary size, sentence structure complexity, and domain terminology density. The structure of the hybrid neural network model includes: a convolutional layer that performs convolution operations on each feature sub-vector using the dynamically selected convolutional kernel to output spatial correlation features; a long short-term memory layer that performs temporal modeling on the spatial correlation features to output temporal correlation features; a temporal residual connection that adds the temporal correlation features and spatial correlation features element by element to obtain residual fusion features; an attention layer that assigns attention weights to the features at each time step in the residual fusion features, normalizes them using the softmax function, and then performs a weighted summation to output key features; and an output layer that outputs the predicted probability of cybersecurity threats based on the key features.

6. The method for identifying cybersecurity threats based on artificial intelligence according to claim 5, characterized in that, In step S2, the fusion preprocessing is implemented through the following steps: Step S21: Calculate the mutual information I(f) between any two features in the sampled data. p ,f q ), will mutually inform I(f p ,f q Features with mutual information below a preset threshold are considered redundant and are removed. Step S22: For the remaining non-redundant features, when the features belong to different data modalities, calculate the semantic association weights of the features of different modalities through the attention mechanism, convert the text features into a vector space of the same dimension as the numerical features, and perform cross-modal data alignment.

7. The method for identifying cybersecurity threats based on artificial intelligence according to claim 6, characterized in that, In step S5, the anomaly score is calculated using the following formula: S = p·(1+θ·d); Where S is the anomaly score; p is the network security threat prediction probability output by the hybrid neural network model; θ is the feature deviation influence coefficient; and d is the feature deviation of the multidimensional feature vector relative to the preset threat baseline. The feature deviation is calculated using the following formula: Where v is the currently constructed multidimensional feature vector; v0 is the feature vector corresponding to the preset threat baseline; v·v0 is the inner product of vector v and vector v0; ||v|| is the magnitude of vector v; ||v0|| is the magnitude of vector v0; and d is the feature deviation.

8. The method for identifying cybersecurity threats based on artificial intelligence according to claim 7, characterized in that, In step S6, the update frequency of dynamically adjusting the preset threat baseline is calculated using the following formula: f=f0·(1+γ·t+δ·s·d t ); Where f is the adjusted preset threat baseline update frequency; f0 is the initial update frequency; γ is the threat quantity impact coefficient; δ is the threat quality impact coefficient, and γ and δ are constants greater than 0; t is the number of times network security threats are identified per unit time; s is the threat severity coefficient; d t Threat type diversity index; The threat severity coefficient is quantified based on the potential damage level of the threat to the network system. The potential damage level includes system paralysis, data leakage, functional abnormality, and alarm disturbance. System paralysis corresponds to the highest severity coefficient, data leakage corresponds to the second highest severity coefficient, functional abnormality corresponds to the medium severity coefficient, and alarm disturbance corresponds to the lowest severity coefficient. The threat type diversity index is calculated by the ratio of the number of different threat types identified per unit time to the total number of threats. The update of the preset threat baseline is performed through an incremental learning method, using sample data determined to have no network security threats in the identification results to update the baseline model parameters.

Images