Data annotation agent network attack identification method based on artificial intelligence

Abstract

The invention discloses a data annotation agent network attack identification method based on artificial intelligence. The method comprises the following steps: collecting and preprocessing original network monitoring data; constructing a labeling task set; performing feature analysis, generating an initial category label and a corresponding confidence value, and outputting an agent labeling result; according to the confidence value of each agent, a preset weight parameter and an annotation consistency index, generating an annotation sample set; dividing the labeled sample set into a network attack identification training sample set and a network attack identification verification sample set; the improved HTAN model is trained, and a trained improved HTAN model is obtained; outputting an attack probability value and an attack category judgment result of the online detection sample; according to the method, efficient labeling, high-precision learning and real-time detection of network attack identification are realized, and the automation degree and attack identification capability of a network security protection system are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence. Background Technology

[0002] With the rapid development of information technology and network communication technology, the scale and operational complexity of network systems continue to increase. Network structures are constantly expanding, and multi-source business data is continuously growing. Potential security threats in the network environment are also showing characteristics such as diversification in number, intelligent attack methods, and complex attack chains. Faced with the increasingly severe network attack situation, traditional network attack detection methods based on rule matching, feature library matching, or manual experience judgment are no longer able to adapt to the rapid evolution of attack behavior in the modern network environment, exhibiting significant shortcomings such as detection lag, high false positive rates, and poor generalization ability. On the other hand, the development of deep learning technology has provided new directions and ideas for network attack detection. However, deep learning models are highly sensitive to the scale, quality, and labeling accuracy of training data, while a large amount of high-quality, refined network attack training data is extremely scarce. This makes deep learning-based network attack identification methods face problems such as insufficient training data, high labeling costs, and unstable model performance in practical deployments.

[0003] In existing technologies, the annotation of cyberattack data primarily relies on manual judgment and annotation by security analysts. However, in large-scale network monitoring environments, the daily volume of network monitoring data is extremely large. Manual annotation is not only time-consuming and labor-intensive but also heavily influenced by subjective judgment, easily leading to inconsistent annotations, annotation delays, and unstable annotation quality. Furthermore, manual annotation struggles to support continuous model updates, failing to meet the practical needs of modern cyberattack detection for high-frequency updates and high-precision identification. Although some research has begun to explore automated annotation methods to assist data processing, these often employ single models or simple heuristics, lacking effective annotation consistency mechanisms and annotation result fusion strategies. This can easily lead to the accumulation of annotation errors, further impacting the performance of the trained model. Summary of the Invention

[0004] One objective of this invention is to propose a data-annotated intelligent agent network attack identification method based on artificial intelligence. This invention fully utilizes a multi-data-annotating intelligent agent collaborative annotation mechanism, an annotation result fusion mechanism, and improved HTAN model training and online detection technology. This invention possesses advantages such as high annotation quality, high model recognition accuracy, strong adaptability to novel attacks, and high online detection efficiency, effectively enhancing the intelligence level and security protection capabilities of network attack identification systems.

[0005] A method for identifying network attacks by data-annotated intelligent agents based on artificial intelligence, according to an embodiment of the present invention, includes the following steps: Raw network monitoring data is collected from network monitoring nodes and preprocessed. A set of annotation tasks is constructed using the preprocessed raw network monitoring data and the samples to be annotated. Perform feature parsing on the annotation task set, generate initial category labels and corresponding confidence values, and output the agent annotation results; The annotation results of the agents are fused and processed to generate a set of annotated samples based on the confidence value of each agent, the preset weight parameters and the annotation consistency index. The labeled sample set is divided into a network attack identification training sample set and a network attack identification verification sample set. The improved HTAN model is trained by inputting the network attack identification training sample set and evaluated by the network attack identification verification sample set. Deploy the trained improved HTAN model in an online detection environment, collect real-time network monitoring data, obtain online detection samples, and output the attack probability value and attack category determination result of the online detection samples; The attack probability value is compared with the preset alarm threshold, and the attack category information is obtained by combining the attack category determination result to form the network attack detection result.

[0006] Optionally, the raw network monitoring data includes network traffic packet data, network traffic session data, system log data, application log data, network device logs, and traffic metadata. The preprocessing includes protocol field parsing, session connection reassembly, timestamp alignment, and feature normalization.

[0007] Optionally, the construction of the annotation task set specifically includes: The preprocessed raw network monitoring data is divided according to session identifier, source address, destination address and time window to generate a sample set to be labeled; For each sample to be labeled in the sample set, feature parameters are extracted. The feature parameters include network protocol fields, session statistics indicators, time behavior sequence indicators and traffic pattern attributes, and are combined in a preset order to form the sample feature vector of the sample to be labeled. For each sample to be labeled, extract contextual association attributes, including behavioral association attributes of temporally adjacent samples, security event attributes of the two communicating hosts, and interaction attributes related to the network topology, and combine them in a preset order to form a contextual association information vector of the sample to be labeled. A candidate set of attack categories is set, which consists of predefined attack category identifiers. The annotation task corresponding to the sample to be annotated is formed by the sample feature vector, the context association information vector and the candidate set of attack categories. All annotation tasks are compiled into an annotation task set according to the sample number order.

[0008] Optionally, the output of the agent annotation results specifically includes: The annotation task set is divided into annotation task subsets according to a preset task allocation strategy; For each annotation task in each subset of annotation tasks, the corresponding data annotation agent performs feature parsing on the sample feature vector and context association information vector in the annotation task to generate the feature representation vector corresponding to the annotation task. Based on the feature representation vector, the corresponding data labeling agent generates a score list corresponding to each attack category in the attack category candidate set. The score list consists of attack category scores arranged in order of attack category. The score list is converted into confidence values ​​to form a confidence list. The conversion process involves normalizing the scores of each attack category in the score list by dividing the score of each attack category by the sum of the scores of all attack categories. For each annotation task, the attack category with the highest confidence is selected from the confidence list as the initial category label, and the highest confidence is used as the initial confidence value. The sample number, the initial category label, and the initial confidence value are combined to form the agent annotation result.

[0009] Optionally, the generation of the labeled sample set specifically includes: Combine all the initial confidence values ​​in the agent labeling results to form the initial confidence value set corresponding to the sample number. Set preset weight parameters for each data labeling agent and form a preset weight parameter set for all preset weight parameters. For each sample number, the initial confidence values ​​in the initial confidence value set are multiplied by the corresponding preset weight parameters in the preset weight parameter set and weighted to obtain the weighted confidence value corresponding to the sample number. Based on the preset labeling consistency index, the initial category labels of the same sample number are analyzed for labeling consistency to obtain the final category labels corresponding to the sample number; The sample number, final category label, and weighted confidence value are combined to form a labeled sample set.

[0010] Optionally, the division of the network attack identification training sample set and the network attack identification verification sample set specifically includes: Assign a sample index to each labeled sample in the labeled sample set, and construct the labeled sample set into a partitioned sample sequence according to the sample index order; Set a preset partitioning ratio for the sample set, and obtain the sample size range of the network attack identification training sample set and the network attack identification verification sample set based on the preset partitioning ratio and the total number of samples in the labeled sample set. Based on the range of sample quantity, labeled samples that belong to the training sample quantity range in the divided sample sequence constitute the network attack identification training sample set, and labeled samples that do not belong to the training sample quantity range in the divided sample sequence constitute the network attack identification verification sample set.

[0011] Optionally, obtaining the improved HTAN model after training specifically includes: The network attack identification training sample set is input into the improved HTAN model for training. The improved HTAN model includes an input feature encoding module, a hierarchical temporal attention modeling module, a feature fusion and representation enhancement module, and an attack category discrimination and probability output module. The input feature encoding module refers to performing sequential embedding mapping and scale-aligned encoding on the sample feature vector and the context association information vector to generate an encoded feature vector. The hierarchical temporal attention modeling module refers to introducing a multi-granularity recursive adaptive temporal weight mechanism to obtain a hierarchical temporal attention feature vector. The feature fusion and representation enhancement module refers to using a context-gated residual fusion method to generate a fused and enhanced feature vector. The attack category discrimination and probability output module refers to performing category space mapping on the fused and enhanced feature vector to generate an output vector. In the input feature encoding module, sequential embedding mapping and scale-aligned encoding are performed on the sample feature vectors and context-related information vectors in the network attack identification training sample set to generate encoded feature vectors. In the hierarchical temporal attention modeling module, a multi-granularity recursive adaptive temporal weight mechanism is introduced to perform time series dependency modeling on the encoded feature vector to obtain the hierarchical temporal attention feature vector. In the feature fusion and representation enhancement module, the context-gated residual fusion method is used to perform path fusion on the hierarchical temporal attention feature vector. The corresponding fused and enhanced feature vector is generated by adjusting the gating weights and superimposing the residual features. In the attack category discrimination and probability output module, the fused enhanced feature vector is mapped to the category space to generate an output vector containing attack category output components, and a corresponding predicted probability list is generated according to the relative magnitude of each attack category output component in the output vector. Based on the category labels and corresponding predicted probability lists in the network attack identification training sample set, the overall loss value is calculated. The calculation process is to generate a single sample loss value for each training sample in the network attack identification training sample set, based on the true category label and its corresponding predicted probability list. All single sample loss values ​​are accumulated and averaged according to a preset loss aggregation method to obtain the overall loss value. Based on the overall loss value, the parameters of the improved HTAN model are updated using the gradient descent method. The network attack identification verification sample set is then input into the improved HTAN model for verification and evaluation. When the verification and evaluation index meets the preset convergence criteria, the trained improved HTAN model is obtained.

[0012] Optionally, the output of the attack probability value and the attack category determination result specifically includes: The trained improved HTAN model is loaded into the online detection environment, and a real-time data acquisition interface is established to continuously acquire real-time network monitoring data from the network monitoring nodes. Online detection samples are constructed from real-time network monitoring data according to a preset organization method. The online detection samples are composed of sample feature vectors and context association information vectors. The online detection sample pairs are input into the trained and improved HTAN model, and the internal calculations are performed sequentially according to the established forward inference process to obtain the model output results. The attack probability value is extracted from the model output, and the attack category determination result is obtained based on the category component with the highest probability in the model output. The extraction process is to take the probability component corresponding to each attack category in the model output as the attack probability value of the network attack category.

[0013] Optionally, the formation of the network attack detection result specifically includes: The attack probability value of each online detection sample is compared with a preset alarm threshold to generate a detection flag. When the attack probability value is greater than the preset alarm threshold, the detection flag is set as a network attack sample. When the attack probability value is less than the preset alarm threshold, the detection flag is set as a non-attack sample. The attack category information of the online detection sample is obtained based on the detection mark. The process is as follows: when the detection mark is a network attack sample, the attack category determination result is used as the attack category information; when the detection mark is a non-attack sample, the preset normal business category label is used as the attack category information. The network attack detection results are formed by combining the detection flags with attack category information to create online detection samples.

[0014] The beneficial effects of this invention are: This invention constructs a data annotation intelligent agent system for network monitoring data, achieving automated, standardized, and highly consistent annotation processing of large-scale network monitoring data. This effectively overcomes the shortcomings of existing technologies, such as low efficiency, high cost, strong subjectivity, and unstable annotation quality associated with manual annotation. By generating initial category labels and confidence values ​​in parallel through multiple data annotation intelligent agents, and by fusing the annotation results of multiple agents and introducing confidence values, preset weight parameters, and annotation consistency indicators, the generated annotation sample set exhibits higher accuracy and stability. This provides a reliable data foundation for subsequent model training and significantly improves the credibility and annotation quality of network attack identification training samples.

[0015] This invention utilizes an improved HTAN model to train a network attack identification training sample set. Through hierarchical time series modeling and feature enhancement mechanisms, the model can fully capture the temporal changes and contextual relationships of network behavior, thereby effectively improving the insufficient ability of traditional models to identify complex attack behaviors. The trained improved HTAN model exhibits stronger feature representation capabilities and higher identification accuracy in network attack identification tasks, and can adapt to diverse and highly covert network attack scenarios, significantly improving the accuracy and robustness of attack identification.

[0016] This invention deploys an improved HTAN model, trained in an online detection environment, to infer from real-time network monitoring data and output attack probability values ​​and attack category determination results. This enables real-time identification and rapid response to network attacks. By comparing the attack probability value with a preset alarm threshold to generate network attack detection results, and combining this with the attack category determination results to obtain attack category information, the network attack detection results are made more explicit and interpretable, facilitating timely response and policy execution by subsequent network security protection systems.

[0017] Furthermore, this invention constructs an incremental annotation task for false positives, false negatives, and low-confidence samples occurring during the online detection phase, and then generates updated annotation samples again by a data annotation agent, forming a closed-loop update mechanism. This enables the improved HTAN model to be dynamically updated and continuously optimized based on new data, thereby solving the shortcomings of existing technologies where models are statically trained and difficult to adapt to dynamic changes in the network environment. With this continuously iterative annotation-training-update mechanism, this invention enables the network attack identification system to maintain high sensitivity and adaptability to new attacks and changing characteristics, improving the system's long-term stability and security protection capabilities. Attached Figure Description

[0018] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0019] Figure 1 This is an overall flowchart of a data labeling intelligent agent network attack identification method based on artificial intelligence proposed in this invention; Figure 2 This is a schematic diagram illustrating the construction of the annotation task set for the data annotation intelligent agent network attack identification method based on artificial intelligence proposed in this invention; Figure 3 This is a schematic diagram of the structure of the improved HTAN model after training, which is a data labeling agent network attack identification method based on artificial intelligence proposed in this invention. Detailed Implementation

[0020] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0021] refer to Figures 1-3 A method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence includes the following steps: Raw network monitoring data is collected from network monitoring nodes and preprocessed. A set of annotation tasks is constructed using the preprocessed raw network monitoring data and the samples to be annotated. Perform feature parsing on the annotation task set, generate initial category labels and corresponding confidence values, and output the agent annotation results; The annotation results of the agents are fused and processed to generate a set of annotated samples based on the confidence value of each agent, the preset weight parameters and the annotation consistency index. The labeled sample set is divided into a network attack identification training sample set and a network attack identification verification sample set. The improved HTAN model is trained by inputting the network attack identification training sample set and evaluated by the network attack identification verification sample set. Deploy the trained improved HTAN model in an online detection environment, collect real-time network monitoring data, obtain online detection samples, and output the attack probability value and attack category determination result of the online detection samples; The attack probability value is compared with the preset alarm threshold, and the attack category information is obtained by combining the attack category determination result to form the network attack detection result.

[0022] In this embodiment, the raw network monitoring data includes network traffic packet data, network traffic session data, system log data, application log data, network device logs, and traffic metadata. The preprocessing includes protocol field parsing, session connection reassembly, timestamp alignment, and feature normalization.

[0023] In this embodiment, the construction of the annotation task set specifically includes: The preprocessed raw network monitoring data is divided according to session identifier, source address, destination address and time window to generate a sample set to be labeled; For each sample to be labeled in the sample set, feature parameters are extracted. The feature parameters include network protocol fields, session statistics indicators, time behavior sequence indicators and traffic pattern attributes, and are combined in a preset order to form the sample feature vector of the sample to be labeled. For each sample to be labeled, extract contextual association attributes, including behavioral association attributes of temporally adjacent samples, security event attributes of the two communicating hosts, and interaction attributes related to the network topology, and combine them in a preset order to form a contextual association information vector of the sample to be labeled. A candidate set of attack categories is set, which consists of predefined attack category identifiers. The annotation task corresponding to the sample to be annotated is formed by the sample feature vector, the context association information vector and the candidate set of attack categories. All annotation tasks are compiled into an annotation task set according to the sample number order.

[0024] In this embodiment, the output of the agent annotation result specifically includes: The annotation task set is divided into annotation task subsets according to a preset task allocation strategy; For each annotation task in each subset of annotation tasks, the corresponding data annotation agent performs feature parsing on the sample feature vector and context association information vector in the annotation task to generate the feature representation vector corresponding to the annotation task. Based on the feature representation vector, the corresponding data labeling agent generates a score list corresponding to each attack category in the attack category candidate set. The score list consists of attack category scores arranged in order of attack category. The score list is converted into confidence values ​​to form a confidence list. The conversion process involves normalizing the scores of each attack category in the score list by dividing the score of each attack category by the sum of the scores of all attack categories. For each annotation task, the attack category with the highest confidence is selected from the confidence list as the initial category label, and the highest confidence is used as the initial confidence value. The sample number, the initial category label, and the initial confidence value are combined to form the agent annotation result.

[0025] In this embodiment, the generation of the labeled sample set specifically includes: Combine all the initial confidence values ​​in the agent labeling results to form the initial confidence value set corresponding to the sample number. Set preset weight parameters for each data labeling agent and form a preset weight parameter set for all preset weight parameters. For each sample number, the initial confidence values ​​in the initial confidence value set are multiplied by the corresponding preset weight parameters in the preset weight parameter set and weighted to obtain the weighted confidence value corresponding to the sample number. Based on the preset labeling consistency index, the initial category labels of the same sample number are analyzed for labeling consistency to obtain the final category labels corresponding to the sample number; The sample number, final category label, and weighted confidence value are combined to form a labeled sample set.

[0026] In this embodiment, the division of the network attack identification training sample set and the network attack identification verification sample set specifically includes: Assign a sample index to each labeled sample in the labeled sample set, and construct the labeled sample set into a partitioned sample sequence according to the sample index order; Set a preset partitioning ratio for the sample set, and obtain the sample size range of the network attack identification training sample set and the network attack identification verification sample set based on the preset partitioning ratio and the total number of samples in the labeled sample set. Based on the range of sample quantity, labeled samples that belong to the training sample quantity range in the divided sample sequence constitute the network attack identification training sample set, and labeled samples that do not belong to the training sample quantity range in the divided sample sequence constitute the network attack identification verification sample set.

[0027] In this embodiment, obtaining the improved HTAN model after training specifically includes: The network attack identification training sample set is input into the improved HTAN model for training. The improved HTAN model includes an input feature encoding module, a hierarchical temporal attention modeling module, a feature fusion and representation enhancement module, and an attack category discrimination and probability output module. The input feature encoding module refers to performing sequential embedding mapping and scale-aligned encoding on the sample feature vector and the context association information vector to generate an encoded feature vector. The hierarchical temporal attention modeling module refers to introducing a multi-granularity recursive adaptive temporal weight mechanism to obtain a hierarchical temporal attention feature vector. The feature fusion and representation enhancement module refers to using a context-gated residual fusion method to generate a fused and enhanced feature vector. The attack category discrimination and probability output module refers to performing category space mapping on the fused and enhanced feature vector to generate an output vector. In the input feature encoding module, sequential embedding mapping and scale-aligned encoding are performed on the sample feature vectors and context-related information vectors in the network attack identification training sample set to generate encoded feature vectors. In the hierarchical temporal attention modeling module, a multi-granularity recursive adaptive temporal weight mechanism is introduced to perform time series dependency modeling on the encoded feature vector to obtain the hierarchical temporal attention feature vector. In the feature fusion and representation enhancement module, the context-gated residual fusion method is used to perform path fusion on the hierarchical temporal attention feature vector. The corresponding fused and enhanced feature vector is generated by adjusting the gating weights and superimposing the residual features. In the attack category discrimination and probability output module, the fused enhanced feature vector is mapped to the category space to generate an output vector containing attack category output components, and a corresponding predicted probability list is generated according to the relative magnitude of each attack category output component in the output vector. Based on the category labels and corresponding predicted probability lists in the network attack identification training sample set, the overall loss value is calculated. The calculation process is to generate a single sample loss value for each training sample in the network attack identification training sample set, based on the true category label and its corresponding predicted probability list. All single sample loss values ​​are accumulated and averaged according to a preset loss aggregation method to obtain the overall loss value. Based on the overall loss value, the parameters of the improved HTAN model are updated using the gradient descent method. The network attack identification verification sample set is then input into the improved HTAN model for verification and evaluation. When the verification and evaluation index meets the preset convergence criteria, the trained improved HTAN model is obtained.

[0028] In this embodiment, the output of the attack probability value and the attack category determination result specifically includes: The trained improved HTAN model is loaded into the online detection environment, and a real-time data acquisition interface is established to continuously acquire real-time network monitoring data from the network monitoring nodes. Online detection samples are constructed from real-time network monitoring data according to a preset organization method. The online detection samples are composed of sample feature vectors and context association information vectors. The online detection sample pairs are input into the trained and improved HTAN model, and the internal calculations are performed sequentially according to the established forward inference process to obtain the model output results. The attack probability value is extracted from the model output, and the attack category determination result is obtained based on the category component with the highest probability in the model output. The extraction process is to take the probability component corresponding to each attack category in the model output as the attack probability value of the network attack category.

[0029] In this embodiment, the formation of the network attack detection result specifically includes: The attack probability value of each online detection sample is compared with a preset alarm threshold to generate a detection flag. When the attack probability value is greater than the preset alarm threshold, the detection flag is set as a network attack sample. When the attack probability value is less than the preset alarm threshold, the detection flag is set as a non-attack sample. The attack category information of the online detection sample is obtained based on the detection mark. The process is as follows: when the detection mark is a network attack sample, the attack category determination result is used as the attack category information; when the detection mark is a non-attack sample, the preset normal business category label is used as the attack category information. The network attack detection results are formed by combining the detection flags with attack category information to create online detection samples.

[0030] Example 1: This embodiment uses the production network of a large energy company as an application scenario. This company has deployed multiple production control systems and office information systems nationwide, resulting in a complex network structure and a large number of devices. The network monitoring nodes collect approximately 5TB of raw network monitoring data daily. In recent years, this company has frequently suffered from various types of network attacks, including scanning probing, brute-force attacks, malicious command injection, lateral movement, and tunneling. Existing technologies mainly rely on manual annotation and rule-based detection methods, which are insufficient for stable, efficient, and real-time network attack identification in such a complex and large-scale environment. Manual annotation is not only time-consuming but also prone to inconsistencies due to varying analyst skill levels. Rule-based detection methods are also ill-suited to adapting to new attack behaviors, leading to high false negative and false positive rates, severely impacting the effectiveness of network security protection.

[0031] In this real-world business scenario, the AI-based data labeling agent network attack identification method proposed in this invention is deployed in an enterprise's monitoring center to process real-time network monitoring data. First, monitoring nodes continuously transmit raw network monitoring data to the center. This invention performs preprocessing operations such as cleaning, formatting, and feature construction on the data, ensuring the data samples have good usability. Previously, this required a dozen security analysts to manually review and label logs; this is now automated by the data labeling agent of this invention. Multiple agents independently label the same samples, each providing a category label and confidence value. These labeling results are then fused using preset weight parameters and a labeling consistency index, ultimately generating a high-quality set of labeled samples. Compared to manual labeling, agent labeling is not only faster but also exhibits stronger consistency in complex environments.

[0032] After generating the labeled sample set, the sample set is divided into a training sample set and a validation sample set, and then input into the improved HTAN model of this invention for training. The improved HTAN model can efficiently handle the time-series characteristics of network monitoring data, such as the time density of multiple failed login attempts from the same source IP, the burstiness of malicious command injection requests, and the distributed correlation characteristics of lateral movement. During model training, the validation sample set is used to continuously evaluate the model's performance. When the model performance reaches the preset convergence condition, the model training is complete.

[0033] After deployment, the system begins processing monitoring data from the production network in real time. When new network communication records are collected, this invention constructs online detection samples and inputs them into the trained improved HTAN model. The model immediately outputs attack probability values ​​and attack category determination results. The system compares the attack probability values ​​with preset alarm thresholds to generate the final network attack detection results and outputs attack category information. For example, when a terminal is repeatedly remotely logged in, the model can accurately identify it as a "brute-force attack," and when a production server frequently pushes abnormal commands, the model can identify it as "malicious control command injection."

[0034] After one month of actual operation, the system of this invention has processed a total of 120 million network monitoring records, and can reliably identify various types of attack behaviors such as scanning attacks, malicious command injection, brute-force attacks, and lateral movement. To verify the beneficial effects of this invention, a comparative test was conducted with existing traditional rule-based IDS and manually labeled traditional models. 5,000 real network samples were selected as the test set, with attack samples and non-attack samples distributed according to the actual business ratio. The table below shows the comparison results of the three methods in the test.

[0035] Table 1 Comparison of Network Attack Identification Results Based on Real Business Environments

[0036] As shown in Table 1, the existing IDS (Intrusion Detection System) relies on static rules, resulting in low detection accuracy, attack identification precision, and recall rates in the face of complex business environments and rapidly evolving attack methods. Furthermore, the false negative rate is relatively high, making it difficult to meet the security requirements of actual production environments. While manual annotation combined with traditional models offers some improvement, the subjective differences inherent in manual annotation and its inability to efficiently handle massive datasets lead to insufficient annotation consistency, limiting the effectiveness of model training. Consequently, the false positive and false negative rates remain difficult to reduce to an acceptable level.

[0037] In contrast, this invention provides highly consistent and stable labeled samples through a data labeling agent, significantly improving the quality of training data. Simultaneously, it improves the HTAN model to accurately capture time-series dependencies and contextual behavioral features in network monitoring data, resulting in attack identification accuracy and recall exceeding 95%. Test results show that the detection accuracy of this invention reaches 96.3%, the attack recall rate reaches 97.1%, and the false positive rate and false negative rate are significantly lower than other methods, fully demonstrating the superiority of this invention in real-world complex network environments.

[0038] Furthermore, the average latency of online detection in this invention is only 48ms, which can meet the real-time network security protection requirements of high concurrency and low latency. Regarding online updates, this invention can automatically collect false positive samples, false negative samples, and low-confidence samples, and re-label and update the training dataset through an intelligent agent, enabling the model to continuously learn new attack features and achieve minute-level rapid updates—a capability completely absent in traditional methods.

[0039] In summary, this embodiment demonstrates that the present invention has significant advantages in improving annotation quality, enhancing attack identification effectiveness, reducing false positives and false negatives, strengthening online detection capabilities, and enhancing model adaptability, thus meeting the actual needs of large-scale production networks for high-precision, high-efficiency, and continuously updated network attack identification solutions.

Claims

1. A method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence, characterized in that, Includes the following steps: Raw network monitoring data is collected from network monitoring nodes and preprocessed. A set of annotation tasks is constructed using the preprocessed raw network monitoring data and the samples to be annotated. Perform feature parsing on the annotation task set, generate initial category labels and corresponding confidence values, and output the agent annotation results; The annotation results of the agents are fused and processed to generate a set of annotated samples based on the confidence value of each agent, the preset weight parameters and the annotation consistency index. The labeled sample set is divided into a network attack identification training sample set and a network attack identification verification sample set. The improved HTAN model is trained by inputting the network attack identification training sample set and evaluated by the network attack identification verification sample set. Deploy the trained improved HTAN model in an online detection environment, collect real-time network monitoring data, obtain online detection samples, and output the attack probability value and attack category determination result of the online detection samples; The attack probability value is compared with the preset alarm threshold, and the attack category information is obtained by combining the attack category determination result to form the network attack detection result.

2. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The raw network monitoring data includes network traffic packet data, network traffic session data, system log data, application log data, network device logs, and traffic metadata. The preprocessing includes protocol field parsing, session connection reassembly, timestamp alignment, and feature normalization.

3. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The construction of the annotation task set specifically includes: The preprocessed raw network monitoring data is divided according to session identifier, source address, destination address and time window to generate a sample set to be labeled; For each sample to be labeled in the sample set, feature parameters are extracted. The feature parameters include network protocol fields, session statistics indicators, time behavior sequence indicators and traffic pattern attributes, and are combined in a preset order to form the sample feature vector of the sample to be labeled. For each sample to be labeled, extract contextual association attributes, including behavioral association attributes of temporally adjacent samples, security event attributes of the two communicating hosts, and interaction attributes related to the network topology, and combine them in a preset order to form a contextual association information vector of the sample to be labeled. A candidate set of attack categories is set, which consists of predefined attack category identifiers. The annotation task corresponding to the sample to be annotated is formed by the sample feature vector, the context association information vector and the candidate set of attack categories. All annotation tasks are compiled into an annotation task set according to the sample number order.

4. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The output of the agent annotation results specifically includes: The annotation task set is divided into annotation task subsets according to a preset task allocation strategy; For each annotation task in each subset of annotation tasks, the corresponding data annotation agent performs feature parsing on the sample feature vector and context association information vector in the annotation task to generate the feature representation vector corresponding to the annotation task. Based on the feature representation vector, the corresponding data labeling agent generates a score list corresponding to each attack category in the attack category candidate set. The score list consists of attack category scores arranged in order of attack category. The score list is converted into confidence values ​​to form a confidence list. The conversion process involves normalizing the scores of each attack category in the score list by dividing the score of each attack category by the sum of the scores of all attack categories. For each annotation task, the attack category with the highest confidence is selected from the confidence list as the initial category label, and the highest confidence is used as the initial confidence value. The sample number, the initial category label, and the initial confidence value are combined to form the agent annotation result.

5. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The generation of the labeled sample set specifically includes: Combine all the initial confidence values ​​in the agent labeling results to form the initial confidence value set corresponding to the sample number. Set preset weight parameters for each data labeling agent and form a preset weight parameter set for all preset weight parameters. For each sample number, the initial confidence values ​​in the initial confidence value set are multiplied by the corresponding preset weight parameters in the preset weight parameter set and weighted to obtain the weighted confidence value corresponding to the sample number. Based on the preset labeling consistency index, the initial category labels of the same sample number are analyzed for labeling consistency to obtain the final category labels corresponding to the sample number; The sample number, final category label, and weighted confidence value are combined to form a labeled sample set.

6. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The division of the network attack identification training sample set and the network attack identification verification sample set specifically includes: Assign a sample index to each labeled sample in the labeled sample set, and construct the labeled sample set into a partitioned sample sequence according to the sample index order; Set a preset partitioning ratio for the sample set, and obtain the sample size range of the network attack identification training sample set and the network attack identification verification sample set based on the preset partitioning ratio and the total number of samples in the labeled sample set. Based on the range of sample quantity, labeled samples that belong to the training sample quantity range in the divided sample sequence constitute the network attack identification training sample set, and labeled samples that do not belong to the training sample quantity range in the divided sample sequence constitute the network attack identification verification sample set.

7. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The improved HTAN model obtained after training specifically includes: The network attack identification training sample set is input into the improved HTAN model for training. The improved HTAN model includes an input feature encoding module, a hierarchical temporal attention modeling module, a feature fusion and representation enhancement module, and an attack category discrimination and probability output module. The input feature encoding module refers to performing sequential embedding mapping and scale-aligned encoding on the sample feature vector and the context association information vector to generate an encoded feature vector. The hierarchical temporal attention modeling module refers to introducing a multi-granularity recursive adaptive temporal weight mechanism to obtain a hierarchical temporal attention feature vector. The feature fusion and representation enhancement module refers to using a context-gated residual fusion method to generate a fused and enhanced feature vector. The attack category discrimination and probability output module refers to performing category space mapping on the fused and enhanced feature vector to generate an output vector. In the input feature encoding module, sequential embedding mapping and scale-aligned encoding are performed on the sample feature vectors and context-related information vectors in the network attack identification training sample set to generate encoded feature vectors. In the hierarchical temporal attention modeling module, a multi-granularity recursive adaptive temporal weight mechanism is introduced to perform time series dependency modeling on the encoded feature vector to obtain the hierarchical temporal attention feature vector. In the feature fusion and representation enhancement module, the context-gated residual fusion method is used to perform path fusion on the hierarchical temporal attention feature vector. The corresponding fused and enhanced feature vector is generated by adjusting the gating weights and superimposing the residual features. In the attack category discrimination and probability output module, the fused enhanced feature vector is mapped to the category space to generate an output vector containing attack category output components, and a corresponding predicted probability list is generated according to the relative magnitude of each attack category output component in the output vector. Based on the category labels and corresponding predicted probability lists in the network attack identification training sample set, the overall loss value is calculated. The calculation process is to generate a single sample loss value for each training sample in the network attack identification training sample set, based on the true category label and its corresponding predicted probability list. All single sample loss values ​​are accumulated and averaged according to a preset loss aggregation method to obtain the overall loss value. Based on the overall loss value, the parameters of the improved HTAN model are updated using the gradient descent method. The network attack identification verification sample set is then input into the improved HTAN model for verification and evaluation. When the verification and evaluation index meets the preset convergence criteria, the trained improved HTAN model is obtained.

8. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The output of the attack probability value and attack category determination result specifically includes: The trained improved HTAN model is loaded into the online detection environment, and a real-time data acquisition interface is established to continuously acquire real-time network monitoring data from the network monitoring nodes. Online detection samples are constructed from real-time network monitoring data according to a preset organization method. The online detection samples are composed of sample feature vectors and context association information vectors. The online detection sample pairs are input into the trained and improved HTAN model, and the internal calculations are performed sequentially according to the established forward inference process to obtain the model output results. The attack probability value is extracted from the model output, and the attack category determination result is obtained based on the category component with the highest probability in the model output. The extraction process is to take the probability component corresponding to each attack category in the model output as the attack probability value of the network attack category.

9. The method for identifying network attacks by data-labeled intelligent agents based on artificial intelligence according to claim 1, characterized in that, The formation of the network attack detection result specifically includes: The attack probability value of each online detection sample is compared with a preset alarm threshold to generate a detection flag. When the attack probability value is greater than the preset alarm threshold, the detection flag is set as a network attack sample. When the attack probability value is less than the preset alarm threshold, the detection flag is set as a non-attack sample. The attack category information of the online detection sample is obtained based on the detection mark. The process is as follows: when the detection mark is a network attack sample, the attack category determination result is used as the attack category information; when the detection mark is a non-attack sample, the preset normal business category label is used as the attack category information. The network attack detection results are formed by combining the detection flag with the attack category information to create online detection samples.

Images