Network packet capture and analysis method and device based on artificial intelligence

Abstract

The invention discloses a network packet capture and analysis method and device based on artificial intelligence. And constructing a dynamically updated normal traffic baseline by using a lightweight AI model, and extracting real-time traffic features to perform abnormal probability evaluation. And when the abnormal probability exceeds a risk threshold, triggering a precise packet capture strategy. Extracting multi-modal features from the captured abnormal traffic, and fusing the multi-modal features into a high-dimensional feature vector which retains behavior semantics through a deep neural network; and carrying out anomaly classification by using a special AI large model, and carrying out causal reasoning in combination with a knowledge graph to locate a root cause. And generating a disposal strategy based on the root cause, and performing risk grading according to the influence range and the service interruption probability to realize grading closed-loop disposal. According to the method, full-process automation from anomaly perception, intelligent analysis to adaptive disposal is realized, the traditional technical bottlenecks of encrypted traffic detection, unknown threat identification, root cause positioning and the like are effectively solved, and the efficiency and response speed of network security operation and maintenance are remarkably improved.

Description

Technical Field

[0001] This application relates to the field of network security, and in particular to a method and apparatus for network packet capture and analysis based on artificial intelligence. Background Technology

[0002] In today's increasingly complex network environment and with the widespread adoption of encrypted communication, traditional network packet capture and traffic analysis techniques face severe challenges. These techniques primarily rely on predefined rule matching, fixed threshold alerts, and static statistical feature detection. Traditional methods require constant manual updating and maintenance of numerous detection rules to address known threats, which is not only inefficient but also lacks effective detection capabilities against the ever-emerging unknown attacks, zero-day attacks, and internal anomalies. Furthermore, the full packet capture method results in massive data volumes, fundamentally contradicting the real-time requirements of security analysis and causing a huge waste of storage and computing resources.

[0003] Furthermore, traditional methods have significant technical blind spots when dealing with modern network protocols. With the rise of encryption protocols such as TLS and QUIC, traditional deep packet inspection (DPI) techniques have become ineffective, failing to reveal the underlying intent of encrypted traffic and creating a significant security detection blind spot. On the other hand, existing solutions generally lack automated root cause analysis and interpretable output capabilities, making it difficult to quickly and accurately pinpoint the root cause of problems after anomalies are detected, resulting in operational response times of several hours or even days. Summary of the Invention

[0004] This application provides a network packet capture and analysis method and apparatus based on artificial intelligence, which solves the problems of encrypted traffic detection blind spots, poor ability to identify unknown threats, high resource consumption and low efficiency of root cause location caused by traditional traffic analysis technology relying on fixed rules and full packet capture.

[0005] Firstly, this application provides a network packet capture and analysis method based on artificial intelligence, including: A lightweight AI model is used to perform semantic abstraction on network traffic data in order to construct a dynamically updated normal traffic baseline and extract corresponding real-time traffic features from the network traffic data. Real-time traffic characteristics are compared with normal traffic baselines to identify anomalies and determine the corresponding anomaly probability. When the anomaly probability exceeds a preset risk threshold, a packet capture strategy for the abnormal traffic data is generated and executed. Structured features, temporal features, and correlation features are extracted from abnormal traffic data captured by packet capture strategies. Deep neural networks are then used to fuse and map these features into high-dimensional feature vectors that preserve the semantics of behavioral patterns. High-dimensional feature vectors are input into a pre-defined dedicated AI model for anomaly classification. Based on the anomaly classification results, causal logic reasoning is performed using a general knowledge graph to determine the root cause of the abnormal traffic data. The corresponding handling strategy is generated based on the root cause; and the handling strategy is classified into risk levels based on the preset scope of impact of the strategy and the probability of business interruption, so as to execute the corresponding handling operation for the handling strategy with different risk levels.

[0006] Secondly, this application provides a network packet capture and analysis device based on artificial intelligence, comprising: The traffic awareness module is configured to use a lightweight AI model to perform semantic abstraction on network traffic data in order to build a dynamically updated normal traffic baseline and extract corresponding real-time traffic features from the network traffic data. The anomaly probability determination module is configured to compare real-time traffic characteristics with normal traffic baselines to determine anomalies and the corresponding anomaly probability; when the anomaly probability exceeds a preset risk threshold, a packet capture strategy for the abnormal traffic data is generated and executed. The high-dimensional feature vector mapping module is configured to extract structured features, temporal features, and correlation features from the abnormal traffic data captured by the packet capture strategy, and to use a deep neural network to fuse and map the structured features, temporal features, and correlation features into a high-dimensional feature vector that preserves the semantics of behavioral patterns. The root cause determination module is configured to input high-dimensional feature vectors into a pre-defined dedicated AI model for anomaly classification, and based on the anomaly classification results, combine a general knowledge graph to perform causal logic reasoning to determine the root cause corresponding to the abnormal traffic data. The handling strategy generation module is configured to generate corresponding handling strategies based on the root cause; and to classify the handling strategies into risk levels based on the preset policy impact range and business interruption probability, so as to execute corresponding handling operations for handling strategies with different risk levels.

[0007] Thirdly, this application provides a readable medium including executable instructions, which, when executed by a processor of an electronic device, cause the electronic device to perform any of the methods described in the first aspect.

[0008] Fourthly, this application provides an electronic device including a processor and a memory storing execution instructions, wherein when the processor executes the execution instructions stored in the memory, the processor performs the method as described in any of the first aspects.

[0009] This application provides an AI-based network packet capture and analysis method and apparatus. It employs a lightweight AI model to semantically abstract network traffic data, constructing a dynamically updated normal traffic baseline and extracting corresponding real-time traffic features from the network traffic data. The real-time traffic features are compared with the normal traffic baseline to determine anomalies and their probabilities. When the anomaly probability exceeds a preset risk threshold, a packet capture strategy for the abnormal traffic data is generated and executed. Structured features, temporal features, and correlation features are extracted from the abnormal traffic data captured by the packet capture strategy. A deep neural network is used to fuse these features into a high-dimensional feature vector that preserves the semantics of behavioral patterns. This high-dimensional feature vector is input into a preset dedicated AI model for anomaly classification. Based on the anomaly classification results, causal logic reasoning is performed using a general knowledge graph to determine the root cause of the abnormal traffic data. A corresponding handling strategy is generated based on the root cause. The handling strategy is risk-classified based on a preset impact range and business interruption probability, and corresponding handling operations are performed for handling strategies of different risk levels. It achieves full-process intelligent management from anomaly-driven precise packet capture, multimodal behavioral feature modeling, causal root cause reasoning to risk classification and closed-loop handling. It breaks through the technical bottlenecks of traditional methods in encrypted traffic detection, unknown threat identification, resource consumption control and root cause location efficiency, and significantly improves the automation level and anomaly response speed of network security operation and maintenance.

[0010] The further effects of the aforementioned non-conventional preferred method will be explained below in conjunction with specific embodiments. Attached Figure Description

[0011] To more clearly illustrate the embodiments of this application or the existing technical solutions, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart illustrating a network packet capture and analysis method based on artificial intelligence, provided as an embodiment of this application; Figure 2 A flowchart illustrating another AI-based network packet capture and analysis method provided in an embodiment of this application; Figure 3 A flowchart illustrating another AI-based network packet capture and analysis method provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of a network packet capture and analysis device based on artificial intelligence, provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0014] In today's increasingly complex network environment and with the widespread adoption of encrypted communication, traditional network packet capture and traffic analysis techniques face severe challenges. These techniques primarily rely on predefined rule matching, fixed threshold alerts, and static statistical feature detection. Traditional methods require constant manual updating and maintenance of numerous detection rules to address known threats, which is not only inefficient but also lacks effective detection capabilities against the ever-emerging unknown attacks, zero-day attacks, and internal anomalies. Furthermore, the full packet capture method results in massive data volumes, fundamentally contradicting the real-time requirements of security analysis and causing a huge waste of storage and computing resources.

[0015] Furthermore, traditional methods have significant technical blind spots when dealing with modern network protocols. With the rise of encryption protocols such as TLS and QUIC, traditional deep packet inspection (DPI) techniques have become ineffective, failing to reveal the underlying intent of encrypted traffic and creating a significant security detection blind spot. On the other hand, existing solutions generally lack automated root cause analysis and interpretable output capabilities, making it difficult to quickly and accurately pinpoint the root cause of problems after anomalies are detected, resulting in operational response times of several hours or even days.

[0016] To address this issue, this application proposes an artificial intelligence-based network packet capture and analysis method, aiming to solve the problems of encrypted traffic detection blind spots, poor unknown threat identification capabilities, high resource consumption, and low root cause localization efficiency caused by traditional traffic analysis techniques that rely on fixed rules and full packet capture. In this embodiment, the artificial intelligence-based network packet capture and analysis method includes: Step 101: Use a lightweight AI model to perform semantic abstraction on network traffic data in order to construct a dynamically updated normal traffic baseline and extract the corresponding real-time traffic features from the network traffic data.

[0017] In the intelligent perception phase of network traffic, the system first needs to establish a dynamic baseline model that can accurately describe "normal behavior." Traditional methods often rely on fixed thresholds or static rules, which are rigid and prone to generating a large number of false alarms when faced with fluctuations in business load, changes in network topology, and periodic traffic patterns.

[0018] This embodiment employs a lightweight AI model to perform semantic abstraction on network traffic data. Semantic abstraction refers to transforming raw network data packets into high-level representations with business meaning and behavioral characteristics. Specifically, the lightweight AI model can adopt a quantized version of the Transformer architecture. This architecture maintains strong feature extraction capabilities while significantly reducing computational resource consumption through model compression and parameter quantization techniques, enabling it to operate efficiently in real-time network environments.

[0019] The input data processed by lightweight AI models primarily consists of metadata about network traffic data, rather than the complete packet payload. Metadata includes information about the relationship between source and destination nodes, the types of protocols used, the timing characteristics of packet interactions, and the rate characteristics of traffic. Through deep learning of this metadata, the model can abstract behavioral patterns in the traffic, such as the communication frequency between specific node pairs within a certain time period, the periodicity of data transmission, and normal patterns of protocol switching. This semantic abstraction process allows the model to focus on the communication behavior itself, rather than the specific data content, thus protecting data privacy while effectively identifying abnormal behavior.

[0020] The constructed normal traffic baseline is not a static model that remains unchanged, but is dynamically updated according to the actual operating status of the network environment. The system continuously collects network traffic data and incrementally updates the baseline model periodically or based on triggering conditions. This dynamic update mechanism can adaptively reflect the periodic changes in network load, such as the traffic difference between weekdays and weekends, and the switching between peak and off-peak periods. The baseline model adopts a sliding window mechanism during updates, which preserves the long-term characteristics of historical behavior while quickly responding to recent changes in traffic patterns, thus achieving a balance between stability and sensitivity.

[0021] While establishing a baseline, the system also needs to extract current real-time traffic features from network traffic data. The extraction method for these real-time traffic features is consistent with the baseline construction process, ensuring comparability between the two in the feature space. Real-time traffic feature extraction is an ongoing process; the system analyzes traffic entering the network monitoring range in real time, generating feature vectors corresponding to the normal traffic baseline model, providing input data for subsequent anomaly detection.

[0022] Step 102: Compare the real-time traffic characteristics with the normal traffic baseline to make anomaly judgments and determine the corresponding anomaly probability; when the anomaly probability exceeds the preset risk threshold, generate and execute a packet capture strategy for the abnormal traffic data.

[0023] After obtaining real-time traffic characteristics and a normal traffic baseline, the system enters the anomaly detection phase. Traditional anomaly detection methods typically employ simple threshold comparisons, which are prone to high false positive rates or missed detections when facing complex and ever-changing network environments. This embodiment uses a more refined anomaly probability assessment mechanism, comprehensively considering information from multiple dimensions to generate more accurate anomaly judgments.

[0024] Calculate the deviation between real-time traffic characteristics and the normal traffic baseline; based on the deviation, combine the rarity of real-time traffic characteristics in historical behavior for a comprehensive evaluation to generate anomaly probability.

[0025] The system needs to calculate the deviation between real-time traffic characteristics and the normal traffic baseline. The deviation calculation is not a simple numerical difference, but rather a measurement of the semantic distance between the two in a multi-dimensional feature space. Since traffic characteristics have already undergone semantic abstraction, the deviation actually reflects the degree of difference in behavioral patterns. For example, if a node suddenly exhibits a communication pattern completely different from its historical behavior, even if the specific traffic values ​​may be within the normal range, the change in behavioral pattern will lead to a high deviation. The system can use metrics such as cosine similarity, Euclidean distance, or more complex Mahalanobis distance to calculate this deviation.

[0026] Judging solely by deviation may not be comprehensive enough, as some normal but rare business behaviors can also produce significant deviations. Therefore, the system also needs to combine the rarity of real-time traffic characteristics in historical behavior for a comprehensive evaluation. Rarity evaluation refers to analyzing the frequency of currently observed traffic behavior over a past period.

[0027] If a certain traffic pattern has never appeared in the historical records or occurs with extremely low frequency, it should raise concern even if the deviation is not particularly large, as it may indicate a new type of attack or anomaly. Conversely, if a deviation occurs periodically, such as during fixed business peaks each day, then even if the deviation is large, its low rarity allows the system to determine that it is a normal business fluctuation.

[0028] By weighting deviation and rarity, the system generates an anomaly probability value between 0 and 1. A higher probability value indicates that the current traffic behavior is more likely to be genuinely anomaly. The system compares this anomaly probability with a preset risk threshold, which can be configured according to the network's security policies. When the anomaly probability exceeds the risk threshold, the system determines that an anomaly requires further analysis, thus triggering targeted packet capture.

[0029] Traditional network monitoring often employs a full packet capture strategy, indiscriminately capturing all network traffic. This creates a massive storage and processing burden in modern large-scale network environments. This embodiment adopts an "anomaly-driven dynamic packet capture" strategy, capturing only traffic deemed potentially abnormal. The system intelligently generates differentiated packet capture strategies based on the specific dimensions of the anomaly characteristics, the network nodes involved, and the persistence trend of the anomaly.

[0030] Packet capture strategies include a clear target scope, i.e., which node pairs or links need to be captured; capture granularity, i.e., whether to perform full session-level capture or use sampling; and duration, i.e., the time window for continuous monitoring based on anomaly trends.

[0031] Step 103: Extract structured features, temporal features, and correlation features from the abnormal traffic data captured by the packet capture strategy, and use a deep neural network to fuse and map the structured features, temporal features, and correlation features into a high-dimensional feature vector that preserves the semantics of behavioral patterns.

[0032] Once the packet capture strategy successfully captures abnormal traffic data, the system enters the feature extraction and deep representation stage. The goal of this stage is to extract a high-dimensional vector representation from the captured raw abnormal traffic data that reflects its essential behavioral characteristics, providing informative and discriminative input for subsequent anomaly classification and root cause analysis.

[0033] A hybrid architecture based on Transformer and convolutional neural network is adopted to perform multimodal fusion of structured features, temporal features and correlation features to generate fused features; the fused features are then mapped into high-dimensional feature vectors.

[0034] Structured features primarily describe the statistical characteristics of traffic data, and these features can usually be calculated directly from the header information of data packets. Typical structured features include the distribution of packet sizes, such as average packet size, packet size variance, and the ratio of large to small packets, which reflect the content characteristics of data transmission; the number of retransmissions and the retransmission rate, which reflect the quality of network connections and potential congestion or attacks; and the frequency of connection establishment and termination, such as the completion rate of the TCP three-way handshake, the number of half-open connections, and the distribution of connection duration, which can reveal anomalies in connection behavior. The advantages of structured features are their simplicity of calculation, strong real-time performance, and independence from the specific content of the traffic, making them equally effective for encrypted traffic.

[0035] Network traffic exhibits a distinct time dimension, and the temporal patterns of traffic interactions often reveal underlying behavioral intentions. Temporal characteristics focus on the dynamic patterns of traffic changes over time, including the time intervals between packets, fluctuations in traffic rates over time, and patterns of sudden traffic bursts. For example, normal user access behavior typically exhibits a degree of randomness and intermittency, while automated malicious scanning or DDoS attacks may display highly regular time intervals and sustained high rates. By analyzing traffic time series, the system extracts features such as the mean and variance of time intervals, the autocorrelation of traffic rates, and the strength of periodic patterns. These temporal characteristics can capture the dynamic evolution of traffic behavior.

[0036] Devices and services in a network do not exist in isolation; they have complex interactions. Association characteristics describe the patterns of association between abnormal traffic and other entities in the network, including the frequency of interactions between nodes involved in the abnormal traffic and other nodes, their location within the overall network topology, and their share of link resources. For example, a node suddenly establishing connections with a large number of nodes it has never communicated with before, or a sudden surge in traffic usage on a link—these association-level anomalies often reveal deeper security threats or operational problems. Extracting association characteristics requires combining network topology information and historical interaction records, using graph theory or network analysis methods to quantify the strength and degree of anomalies between nodes.

[0037] The three extracted features each describe traffic behavior from different perspectives, but they are not independent of each other; rather, they are complexly interconnected. To fully utilize this multimodal information, the system employs a deep neural network to fuse and map the features. Specifically, the system uses a hybrid architecture based on Transformer and convolutional neural networks to achieve the fusion process.

[0038] The Transformer architecture excels at capturing long-range dependencies and global features, making it particularly suitable for handling long-term dependency patterns in temporal features; while convolutional neural networks excel at extracting local patterns and hierarchical features, making them suitable for handling statistical distribution patterns in structured features. The hybrid architecture combines the advantages of both: first, it extracts local patterns from structured features through convolutional layers; second, it handles long-term dependencies in temporal features through a self-attention mechanism; and third, it fuses related features through a cross-attention mechanism, ultimately generating a unified fused feature representation.

[0039] The fused features are then mapped into high-dimensional feature vectors. The key to this mapping process is preserving the behavioral pattern semantics of the traffic, rather than its specific data content. In other words, the resulting high-dimensional feature vectors should characterize "what this traffic is doing," rather than "what this traffic contains." For example, for encrypted traffic, although its payload content cannot be directly read, behavioral characteristics such as the handshake interaction pattern, the burstiness of data transmission, and the duration distribution of connection maintenance can be used to determine whether it is normal HTTPS access or suspicious command and control communication. Preserving behavioral semantics enables the system to effectively handle encrypted traffic and unknown types of traffic, overcoming the limitations of traditional content-based detection methods.

[0040] Step 104: Input the high-dimensional feature vector into the preset dedicated AI large model for anomaly classification, and based on the anomaly classification results, combine the general knowledge graph to perform causal logic reasoning to determine the root cause of the abnormal traffic data.

[0041] After obtaining the high-dimensional feature vectors, the system enters the anomaly classification and root cause reasoning stage. This stage not only accurately identifies the existence of anomalies but also delves into the root causes behind them, providing a reliable basis for subsequent decision-making. This embodiment employs a dedicated large-scale AI model to perform this complex task. This model has been pre-trained on a large amount of cybersecurity scenario data and possesses a deep understanding of various types of network anomalies.

[0042] High-dimensional feature vectors are input into a dedicated AI model, and anomaly classification is performed using a dual logic of known feature matching and unknown pattern recognition. Known feature matching is achieved by comparing and matching the high-dimensional feature vectors with a pre-trained threat feature database. Unknown pattern recognition uses an unsupervised algorithm to identify rare behaviors that deviate from normal patterns in the high-dimensional feature vectors.

[0043] After the high-dimensional feature vector is input into a dedicated AI model, the model first performs anomaly classification. The classification process employs a dual-logic mechanism of "known feature matching and unknown pattern recognition" to balance the rapid identification of known threats with the ability to detect unknown anomalies. For known feature matching, the model internally maintains a pre-trained threat feature library containing typical feature representations of various known network attacks, failure modes, and anomalous behaviors. When the input high-dimensional feature vector enters the model, the system compares and matches it with features in the threat feature library, calculating a similarity score.

[0044] If the characteristics of a known threat type are highly similar to the input vector, the system can quickly identify the specific type of anomaly, such as DDoS attacks, port scans, SQL injection attempts, and routing configuration conflicts. This matching based on known features enables efficient and accurate classification, significantly reducing the response time for anomaly identification.

[0045] However, a major challenge in cybersecurity lies in the ever-emerging new types of attacks and unknown anomalies, threats for which there are no corresponding feature representations in pre-trained feature libraries. To address this challenge, the system also implements unknown pattern recognition capabilities. This capability is achieved through unsupervised learning algorithms, typical methods including Isolation Forest, Autoencoders, and Single-Class Support Vector Machines. The core idea of ​​these algorithms is to learn the feature distribution of normal traffic behavior and then identify rare behaviors that significantly deviate from this distribution.

[0046] For example, the Isolation Forest algorithm isolates outliers by randomly constructing decision trees. Outlier samples are easier to isolate due to the rarity of their features, and therefore have a shorter average path length. On the other hand, the autoencoder learns a compressed representation of normal traffic, and its reconstruction error increases significantly for outlier traffic that deviates from the normal pattern.

[0047] When the system detects rare behaviors in high-dimensional feature vectors that are significantly different from normal patterns using these methods, it will mark them as "anomalies to be confirmed" even if it cannot be classified into a known threat type, prompting operations and maintenance personnel to pay further attention and analysis. This dual-logic mechanism ensures that the system has the ability to respond quickly to known threats, while also not ignoring unknown threats due to a fixed feature library.

[0048] After anomaly classification, the system needs to perform root cause reasoning to determine the underlying cause of the abnormal traffic data. Simply knowing that an anomaly exists is insufficient; it's also crucial to understand why this anomaly occurred and how to resolve it. Traditional analysis methods often remain at the phenomenological level, lacking in-depth exploration of causal relationships. This embodiment achieves root cause localization by combining a general knowledge graph with causal reasoning methods.

[0049] Based on the abnormal results, retrieve the related network entities and the relationships between them in the general knowledge graph; use counterfactual reasoning to simulate and adjust the network entities and / or their corresponding entity attributes, and infer the impact of the simulation on the abnormal results based on the relationships; if the inference results show that the abnormal results disappear, then the network entities and / or entity attributes are identified as the root cause.

[0050] The system first retrieves related network entities and their relationships from a pre-built general knowledge graph based on the anomaly classification results. The knowledge graph is a structured representation of various entities and their relationships within the network environment. Entities include network device nodes, protocol types, service types, and known anomaly threat types, while relationships describe the connections between these entities, such as "Device A runs protocol B," "Protocol B carries service C," and "Service C is susceptible to anomaly type D." This graph structure organizes dispersed domain knowledge into a computable form, providing a knowledge foundation for automated reasoning. When an anomaly is detected, the system retrieves entities related to that anomaly type from the graph, along with instances of these entities in the current network environment, thus mapping the abstract anomaly type to specific network elements.

[0051] After retrieving relevant entities and relationships, the system employs counterfactual reasoning to pinpoint the root cause. Specifically, the system simulates adjustments to a network entity or its attributes, then infers the impact of these adjustments on the abnormal results based on the relationships within the knowledge graph. For example, if the system detects a persistently high retransmission rate anomaly on a link, the knowledge graph suggests possible causes such as link congestion, device misconfiguration, or routing oscillations. The system then simulates the elimination of these possible causes one by one, such as assuming increased link bandwidth (eliminating congestion), correcting the configuration parameters of a device (eliminating configuration errors), or stabilizing the routing table (eliminating routing oscillations), and then infers whether the anomaly will disappear based on causal relationships.

[0052] If the deduction results show that the anomaly disappears only after adjusting a specific network entity or attribute, then the system can identify that entity or attribute as the root cause. This counterfactual reasoning method can quickly locate the root cause of a problem through logical deduction without actual intervention in the network, greatly improving the efficiency and accuracy of root cause analysis.

[0053] Step 105: Generate corresponding handling strategies based on the root cause; and classify the handling strategies according to the preset scope of impact of the strategies and the probability of business interruption, so as to perform corresponding handling operations on the handling strategies with different risk levels.

[0054] After identifying the root cause of the anomaly, the system enters the phase of generating and executing the handling strategy. The system first generates the corresponding handling strategy based on the root cause. Internally, the system maintains a general "anomaly-handling" mapping library, which summarizes various anomalies and their corresponding standard handling operation logic. For example, for attack-related anomalies, standard handling might include blocking suspicious communication, isolating affected nodes, and enabling traffic scrubbing; for configuration-related anomalies, handling might involve adjusting protocol parameters, correcting routing configurations, and updating access control lists; for congestion-related anomalies, handling might include optimizing resource allocation, enabling traffic rate limiting, and re-planning load balancing strategies.

[0055] Once root cause reasoning identifies the specific root cause, the system retrieves matching solutions from the mapping database and makes personalized adjustments based on the actual network environment to generate targeted handling strategies. These strategies describe key information such as the specific operations to be performed, the target objects of the operations, and the expected results.

[0056] After generating a response strategy, the system does not execute it immediately. Instead, it first performs a risk assessment and classification of the strategy. Different response operations have vastly different impacts on the network environment. Some operations may only affect a single service on an edge node, while others may affect multiple services on the core link. To prevent improper automated operations from causing wider service interruptions or business losses, the system performs a risk classification for each response strategy based on preset assessment dimensions.

[0057] The main dimensions of the assessment include the scope of policy impact and the probability of service interruption. The scope of impact examines which network entities will be involved in the action, whether it is limited to a single edge node or affects core service links, and the scale of affected users. The probability of service interruption assesses the risk of service disruption that might result from implementing the policy, which requires a comprehensive judgment considering factors such as current business load and system redundancy capabilities.

[0058] Based on the risk assessment results, the system categorizes response strategies into different risk levels, typically including low-risk and high-risk categories. For low-risk strategies, the system determines that they can be safely executed automatically. For high-risk strategies, the system generates detailed manual intervention plans and submits them for approval. For response strategies of different risk levels, the system executes corresponding actions to ensure that response efficiency is improved without introducing additional risks.

[0059] As can be seen from the above technical solutions, the beneficial effects of this embodiment are: This application provides an AI-based network packet capture and analysis method. It employs a lightweight AI model to semantically abstract network traffic data, constructing a dynamically updated normal traffic baseline and extracting corresponding real-time traffic features from the network traffic data. The real-time traffic features are compared with the normal traffic baseline to determine anomalies and their probabilities. When the anomaly probability exceeds a preset risk threshold, a packet capture strategy for the abnormal traffic data is generated and executed. Structured features, temporal features, and correlation features are extracted from the abnormal traffic data captured by the packet capture strategy. A deep neural network is used to fuse these features into a high-dimensional feature vector that preserves the semantics of behavioral patterns. This high-dimensional feature vector is input into a preset dedicated AI model for anomaly classification. Based on the anomaly classification results, causal logic reasoning is performed using a general knowledge graph to determine the root cause of the abnormal traffic data. A corresponding handling strategy is generated based on the root cause. The handling strategy is risk-classified based on a preset policy impact range and business interruption probability, and corresponding handling operations are performed for handling strategies of different risk levels. It achieves full-process intelligent management from anomaly-driven precise packet capture, multimodal behavioral feature modeling, causal root cause reasoning to risk classification and closed-loop handling. It breaks through the technical bottlenecks of traditional methods in encrypted traffic detection, unknown threat identification, resource consumption control and root cause location efficiency, and significantly improves the automation level and anomaly response speed of network security operation and maintenance.

[0060] Figure 1 The example shown is only a basic embodiment of a network packet capture and analysis method based on artificial intelligence according to this application. With certain optimizations and extensions, other preferred embodiments of a network packet capture and analysis method based on artificial intelligence can be obtained.

[0061] like Figure 2 The image shows another specific embodiment of a network packet capture and analysis method based on artificial intelligence according to this application.

[0062] In this embodiment, a network packet capture and analysis method based on artificial intelligence includes the following steps: Step 201: Use a lightweight AI model to perform semantic abstraction on network traffic data in order to construct a dynamically updated normal traffic baseline and extract the corresponding real-time traffic features from the network traffic data.

[0063] Step 202: Compare the real-time traffic characteristics with the normal traffic baseline to make anomaly judgments and determine the corresponding anomaly probability; when the anomaly probability exceeds the preset risk threshold, generate and execute a packet capture strategy for the abnormal traffic data.

[0064] Step 203: Extract structured features, temporal features, and correlation features from the abnormal traffic data captured by the packet capture strategy, and use a deep neural network to fuse and map the structured features, temporal features, and correlation features into a high-dimensional feature vector that preserves the semantics of behavioral patterns.

[0065] Step 204: Input the high-dimensional feature vector into the preset dedicated AI large model for anomaly classification, and based on the anomaly classification results, combine the general knowledge graph to perform causal logic reasoning to determine the root cause of the abnormal traffic data.

[0066] Step 205: Generate corresponding handling strategies based on the root cause; and classify the handling strategies according to the preset scope of impact of the strategies and the probability of business interruption, so as to perform corresponding handling operations on the handling strategies with different risk levels.

[0067] Step 206: If the scope of the strategy is limited to non-core nodes and the probability of business interruption is lower than the preset threshold, the handling strategy is determined to be a low-risk strategy.

[0068] After initially generating the response strategy, the system needs to conduct a detailed risk assessment to determine whether the strategy can be safely executed automatically. The first criterion for risk assessment is whether the impact of the strategy is limited to non-core nodes. Nodes in a network environment have different levels of importance. Core nodes typically carry critical business services, handle a large amount of traffic forwarding tasks, or occupy a pivotal position in the network topology. Any changes to these nodes can have a significant impact on the overall network service.

[0069] In contrast, non-core nodes are typically edge access devices, end-user devices, or nodes that only serve localized services. Operations on these nodes have a relatively limited impact. The system analyzes the target objects of the handling policy, combined with pre-maintained network topology information and node importance labels, to determine whether the policy operation only involves non-core nodes. If all the policy's operation targets are non-core nodes—for example, only requiring adjustments to the port configuration of an edge access switch or isolating a single end-user device—then the policy meets the basic condition of low risk in terms of its scope of impact.

[0070] The second dimension of risk assessment is the probability of business interruption. Even if the target of the operation is a non-core node, if the operation itself carries a high risk of business interruption, it should not be executed automatically. Assessing the probability of business interruption requires comprehensive consideration of multiple factors, including current business load, system redundancy, the nature of the operation, and the success rate of similar historical operations.

[0071] The system builds a business interruption probability assessment model based on these factors and quantifies and scores each handling strategy. For example, configuration adjustments performed during off-peak periods typically have a lower probability of business interruption than similar operations during peak periods; for services with redundant backups, the probability of single-node operation interruption is relatively low; while for certain critical business processes, even changes to edge nodes can lead to business interruption. The system compares the calculated business interruption probability with a preset threshold, which is configured according to the enterprise or organization's risk tolerance and is usually set at a low level to ensure security.

[0072] The system will only classify a response strategy as low-risk if it simultaneously meets two conditions: the impact is limited to non-core nodes and the probability of business interruption is below a preset threshold. This dual-verification mechanism ensures the security of automated execution and avoids misjudgments caused by insufficient evaluation from a single dimension.

[0073] Step 207: When the handling strategy is a low-risk strategy, the low-risk strategy is automatically executed through the standardized interface.

[0074] Once a handling strategy is determined to be low-risk, the system enters the automatic execution phase. The automatic execution mechanism is designed to minimize human intervention and improve the timeliness of anomaly response while ensuring operational accuracy and controllability. The system executes low-risk strategies through standardized interfaces, which serve as communication bridges between the system and various network devices, security devices, and the management platform.

[0075] Standardized interfaces are typically implemented based on industry-standard protocols and specifications, such as network management protocols like NETCONF, RESTCONF, SNMP, and SSH, or software-defined networking protocols like OpenFlow. The system selects the appropriate interface protocol and invocation method based on the specific content of the handling policy, translating the abstract operational logic in the policy into concrete commands or configuration changes that can be executed by the device. For example, if a policy requires blocking communication from a suspicious IP address, the system will issue the corresponding blocking rules to the firewall or access control device through a standard interface; if a policy requires adjusting the traffic rate limiting parameters of a certain port, the system will modify the configuration of the corresponding device through the network management interface.

[0076] Upon completion, the system immediately receives feedback on the execution results, including whether the operation was successful, whether the device status meets expectations, and whether there are any errors or warnings. This feedback is recorded in the system log for subsequent effect verification and auditing. If an anomaly is encountered during execution, such as device communication failure or command execution error, the system will automatically trigger an alarm and decide whether to retry or escalate the task to a high-risk task requiring manual intervention based on the preset anomaly handling strategy. Through this automated execution mechanism, low-risk strategies can be deployed within minutes or even seconds, significantly shortening anomaly response time and substantially improving network operation and maintenance efficiency.

[0077] Step 208: When the impact of the handling strategy involves core service links or the probability of business interruption is higher than a preset threshold, the handling strategy is determined to be a high-risk strategy.

[0078] When a handling strategy affects core service links, or when the probability of service interruption exceeds a preset threshold, the system will classify it as a high-risk strategy. Core service links are critical paths in the network, carrying a large amount of business traffic or data transmission of critical business operations. These links may connect backbone networks between data centers, communication channels supporting core business systems, or network paths on which multiple important services depend. Any changes to core links may affect a wide range of users and services, and may even lead to overall service interruption or performance degradation.

[0079] When assessing the impact of a policy, the system analyzes the location and role of the target object within the network topology. If the target object is a core router, core switch, backbone link, or critical load balancer node, the system identifies the policy as involving core service links. Furthermore, even if the target object itself is not a core device, if the operation indirectly affects traffic forwarding or service availability on core links, the system will still classify it as a policy involving core service links. This assessment considers not only the direct operational objective but also analyzes potential cascading effects based on network topology dependencies.

[0080] Some actions are inherently highly disruptive or uncertain, potentially leading to service interruptions. For example, actions such as restarting critical equipment, switching between primary and backup links, large-scale modifications to routing tables, or performing complex configuration changes that could impact business processes all carry a high risk of service disruption. The system calculates the probability of service disruption for each strategy based on multi-dimensional information, including historical data analysis, operational complexity assessment, and current business load. When this probability exceeds a preset threshold, the strategy is classified as high-risk, regardless of whether it involves core links.

[0081] A policy is deemed high-risk if it meets any condition that involves a core service link or the probability of business interruption exceeds a certain threshold. This conservative judgment strategy is for security reasons, ensuring that any operation that may have a significant impact on business is fully reviewed and controlled. Once a high-risk policy is identified, the system will prevent it from entering the automated execution process and instead move it to a handling path that requires manual approval and supervision, thereby establishing a necessary balance between automation efficiency and security controllability.

[0082] Step 209: When the handling strategy is a high-risk strategy, generate a plan to be reviewed that includes operational logic, expected effects and rollback mechanism, and execute the high-risk strategy after obtaining approval.

[0083] When a handling strategy is determined to be high-risk, the system will not execute it directly, but will instead initiate a manual intervention process. The core of this process is to generate a detailed plan for review, providing operations and maintenance personnel or managers with sufficient decision-making basis, ensuring that high-risk operations are only executed with appropriate authorization and supervision.

[0084] The proposed solution provides a detailed description of the operational logic, including the specific steps to be performed, the target objects, the sequence of operations, and the dependencies between steps. The description of the operational logic should be clear and unambiguous, enabling reviewers to accurately understand the system's suggested solutions. For example, if the solution involves adjusting the configuration of the core router, the system will detail which configuration items need to be modified, the specific parameter values ​​to be changed, and the order in which they should be modified. For complex operations involving multiple devices or multiple steps, the system will present them in the form of flowcharts or step lists to ensure the completeness and understandability of the operational logic.

[0085] Based on the results of root cause analysis and the design logic of the remediation strategy, the system will clearly explain the expected effects after implementing the solution. This includes the expected improvement in abnormal states, the expected recovery of network performance indicators, and the potential impact on business operations. The description of the expected effects helps reviewers assess the rationality and necessity of the solution and determine whether implementing it is worthwhile to bear the corresponding risks.

[0086] A key characteristic of high-risk operations is the potential for unexpected negative consequences; therefore, it is essential to be prepared to quickly restore the system to its pre-operation state in the event of failure or adverse consequences. The system designs a corresponding rollback mechanism for each high-risk strategy, including the rollback trigger conditions, the specific rollback steps, and the required rollback time window. For example, if the plan involves modifying routing configuration, the rollback mechanism would include saving a backup of the current configuration, defining which monitoring metrics are used to determine the success of the operation, and how to quickly restore to the backup configuration if an anomaly is detected.

[0087] After generating a complete proposal for review, the system submits it to a pre-defined approval process. This process typically involves authorized operations and maintenance personnel or security managers who will evaluate the proposal based on their expertise and understanding of the current business situation. Reviewers can approve the proposal, request modifications, or reject it. Only after the proposal is approved will the system implement high-risk strategies.

[0088] As can be seen from the above technical solution, the beneficial effects of this embodiment are as follows: By establishing a two-dimensional risk classification mechanism based on the scope of impact and the probability of business interruption, an optimal balance between the security of the handling operation and the efficiency of automation is achieved. This mechanism can accurately identify low-risk strategies and allow them to be executed automatically, reducing the anomaly response time from hours in traditional methods to minutes or even seconds, significantly improving the timeliness of network anomaly handling. At the same time, high-risk strategies are forced into a manual approval process, and a complete solution including operational logic, expected effects, and rollback mechanisms is provided, ensuring the controllability and security of critical operations and avoiding large-scale service interruptions or business losses that may be caused by the automated system.

[0089] like Figure 3 The image shows another specific embodiment of a network packet capture and analysis method based on artificial intelligence according to this application. This embodiment is further described based on the foregoing embodiments.

[0090] In this embodiment, a network packet capture and analysis method based on artificial intelligence includes the following steps: Step 301: Use a lightweight AI model to perform semantic abstraction on network traffic data in order to construct a dynamically updated normal traffic baseline and extract the corresponding real-time traffic features from the network traffic data.

[0091] Step 302: Compare the real-time traffic characteristics with the normal traffic baseline to make anomaly judgment and determine the corresponding anomaly probability; when the anomaly probability exceeds the preset risk threshold, generate and execute a packet capture strategy for the abnormal traffic data.

[0092] Step 303: Extract structured features, temporal features, and correlation features from the abnormal traffic data captured by the packet capture strategy, and use a deep neural network to fuse and map the structured features, temporal features, and correlation features into a high-dimensional feature vector that preserves the semantics of behavioral patterns.

[0093] Step 304: Input the high-dimensional feature vector into the preset dedicated AI large model for anomaly classification, and based on the anomaly classification results, combine the general knowledge graph to perform causal logic reasoning to determine the root cause of the abnormal traffic data.

[0094] Step 305: Generate corresponding handling strategies based on the root cause; and classify the handling strategies according to the preset scope of impact of the strategies and the probability of business interruption, so as to perform corresponding handling operations on the handling strategies with different risk levels.

[0095] Step 306: After performing the disposal operation, continuously monitor network traffic data to verify the disposal effect.

[0096] The execution of the handling action does not signify the end of the entire anomaly handling process; rather, it is merely an intermediate step in a closed-loop management mechanism. To ensure that the handling action truly achieves the expected results and eliminates or mitigates the network anomaly, the system needs to continuously monitor network traffic data after the action is executed to verify the handling effect. This verification mechanism is crucial for achieving closed-loop optimization, enabling timely detection of improper handling or incorrect root cause identification, thus preventing the persistence or worsening of anomalies.

[0097] After the handling operation is executed, the system will enter an observation period. The duration of this observation period is dynamically determined based on the type of anomaly and the nature of the handling strategy. For some handling operations that take effect immediately, such as blocking communication or limiting traffic, the observation period may only take a few minutes; while for some configuration adjustments or resource optimizations that require gradual implementation, the observation period may last for tens of minutes or even longer. During the observation period, the system will pay special attention to the network areas and traffic characteristics related to the anomaly, collecting real-time traffic data and network performance indicators.

[0098] The monitoring encompasses multiple levels. First, there's the monitoring of anomalies. The system checks whether previously detected anomalies still exist. For example, if a node was previously detected exhibiting abnormally high-frequency scanning behavior, the monitoring will check if that scanning behavior has ceased. If a link was previously detected to have an abnormally high retransmission rate, the monitoring will check if that link's retransmission rate has decreased to a normal level. Monitoring anomalies is the most direct means of verifying effectiveness, clearly reflecting whether the corrective actions have eliminated the anomalies.

[0099] Secondly, there's monitoring at the network link level. Even if the anomalies appear to disappear, if the overall network performance indicators don't return to normal, it may indicate that the problem wasn't fundamentally resolved or that the intervention introduced new issues. The system monitors a range of key network performance metrics, including link utilization, packet loss rate, latency, throughput, and connection success rate. These metrics reflect the network's health and service quality, serving as crucial indicators for evaluating the effectiveness of interventions. For example, if an intervention aims to resolve link congestion, monitoring will focus on whether link utilization has decreased to a reasonable range and whether latency and packet loss rates have returned to normal levels.

[0100] Step 307: When the monitoring results show that the abnormal characteristics corresponding to the abnormal traffic data have disappeared and the network link indicators have returned to normal, the handling operation is deemed effective.

[0101] When monitoring results show that the abnormal characteristics corresponding to the abnormal traffic data have disappeared and network link indicators have returned to normal, the system determines that the handling operation was effective, marking the successful completion of this anomaly handling process. This determination is based on a multi-dimensional comprehensive evaluation, ensuring the accuracy and reliability of the effect verification.

[0102] The system compares the currently monitored traffic behavior characteristics with previously identified anomaly characteristics to check if the anomalous features have disappeared. This comparison is not a simple numerical comparison, but rather a semantic-level behavioral pattern matching. For example, if the previously detected anomaly was a node initiating port scans on a large number of targets, the criteria for its disappearance are that the node's scanning frequency decreases to within the normal baseline range, the number of scanned targets returns to normal, and the scanning timing pattern no longer exhibits characteristics of automated tools. The system uses the same feature extraction and analysis methods as the anomaly detection phase to ensure consistency in the judgments made before and after the anomaly detection phase.

[0103] The system also evaluates whether various network link metrics have returned to normal ranges. The definition of normal ranges is based on dynamically updated normal traffic baselines, rather than fixed thresholds, thus adapting to network characteristics under different time periods and service conditions. For example, link utilization needs to return to the historical normal level for that link during the same time period, rather than simply falling below a fixed percentage; latency and packet loss rates need to recover to ranges close to the normal baseline, allowing for some fluctuations but not significant deviations. The system must simultaneously meet both the disappearance of abnormal characteristics and the return of network metrics to normal before determining whether the handling was effective.

[0104] Step 308: When the monitoring results show that the abnormal features have not disappeared or the network link indicators have not returned to normal, it is determined that the handling operation has not met expectations, and the process returns to the step of inputting the high-dimensional feature vector into the dedicated AI large model for anomaly classification in order to re-determine the root cause.

[0105] During continuous monitoring and effect verification, not all actions taken immediately achieve the desired results. When monitoring results show that abnormal characteristics have not disappeared, or network link indicators have not returned to normal, the system determines that the actions taken have not met expectations. This can occur for various reasons, including inaccurate root cause analysis leading to the action strategy failing to target the true root cause, flaws in the design of the action strategy or deviations during execution, or the complexity of the anomaly itself exceeding the scope of the initial analysis. In such cases, the system will not simply repeat the same actions but will initiate an iterative optimization mechanism to conduct a new in-depth analysis.

[0106] If the system determines that the handling did not meet expectations, it will analyze the possible reasons for the failure. The system will review the entire handling process, check whether the operation was fully executed according to the predetermined plan, whether technical obstacles or environmental changes were encountered during the execution, and whether the monitoring data showed any new abnormal characteristics or unexpected side effects.

[0107] The system then returns to the step of inputting the high-dimensional feature vector into a dedicated AI model for anomaly classification, restarting the root cause analysis process. After re-identifying the root cause, the system generates a new response strategy based on the new analysis results and re-enters the risk assessment and execution process. This iterative process can repeat multiple times until an effective solution is found or the preset maximum number of iterations is reached. To avoid infinite loops, the system typically sets an iteration limit. This iterative optimization mechanism reflects the system's adaptive learning capability; even when faced with complex or novel anomalies, it can find an effective solution through continuous trial and adjustment, significantly improving the system's ability to handle difficult problems.

[0108] As can be seen from the above technical solution, the beneficial effects of this embodiment are: by establishing a closed-loop verification mechanism of continuous monitoring and iterative optimization after handling, the verifiability of the anomaly handling effect and the continuous improvement of the handling strategy are achieved. This mechanism does not simply assume the problem is solved after the handling operation is executed, but rather objectively verifies the handling effect by continuously monitoring anomaly characteristics and network link indicators, avoiding situations where the problem is superficially solved while the underlying issue remains. When the handling is found to be unsatisfactory, the system can automatically return to the analysis stage to re-determine the root cause, rather than blindly repeating the same handling operations. This iterative mechanism significantly improves the ability to respond to complex anomalies and new threats.

[0109] like Figure 4 The image shown is a specific embodiment of a network packet capture and analysis device based on artificial intelligence, as described in this application. This embodiment describes a network packet capture and analysis device based on artificial intelligence, specifically used for executing... Figures 1-3 A physical device for network packet capture and analysis based on artificial intelligence is described. Its technical solution is essentially the same as the embodiments described above, and the corresponding descriptions in the embodiments above also apply to this embodiment. This embodiment of a network packet capture and analysis device based on artificial intelligence includes: Traffic awareness module 401 is configured to use a lightweight AI model to perform semantic abstraction on network traffic data in order to build a dynamically updated normal traffic baseline and extract corresponding real-time traffic features from the network traffic data. The anomaly probability determination module 402 is configured to compare real-time traffic characteristics with normal traffic baseline to make anomaly judgment and determine the corresponding anomaly probability; when the anomaly probability exceeds a preset risk threshold, a packet capture strategy for the abnormal traffic data is generated and executed. The high-dimensional feature vector mapping module 403 is configured to extract structured features, temporal features and correlation features from the abnormal traffic data captured by the packet capture strategy, and to use a deep neural network to fuse and map the structured features, temporal features and correlation features into a high-dimensional feature vector that preserves the semantics of the behavioral pattern. The root cause determination module 404 is configured to input high-dimensional feature vectors into a preset dedicated AI large model for anomaly classification, and based on the anomaly classification results, combine a general knowledge graph to perform causal logic reasoning to determine the root cause corresponding to the abnormal traffic data. The handling strategy generation module 405 is configured to generate corresponding handling strategies based on the root cause; and to classify the handling strategies according to the preset scope of impact of the strategies and the probability of business interruption, so as to perform corresponding handling operations on the handling strategies with different risk levels.

[0110] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. At the hardware level, the electronic device includes a processor, and optionally also includes an internal bus, a network interface, and a memory. The memory may include RAM, such as high-speed random-access memory (RAM), or non-volatile memory, such as at least one disk storage device. Of course, the electronic device may also include other hardware required for other services.

[0111] The processor, network interface, and memory can be interconnected via an internal bus, which can be an ISA (Industry Standard Architecture) bus, a PCI (Peripheral Component Interconnect) bus, or an EISA (Extended Industry Standard Architecture) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 5 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0112] Memory is used to store instructions for execution. Specifically, instructions for execution are computer programs that can be executed. Memory can include main memory and non-volatile memory, and it provides the processor with execution instructions and data.

[0113] In one possible implementation, the processor reads the corresponding execution instructions from non-volatile memory into main memory and then executes them. Alternatively, it may obtain the corresponding execution instructions from other devices to logically form an AI-based network packet capture and analysis device. The processor executes the execution instructions stored in the memory to implement the AI-based network packet capture and analysis method provided in any embodiment of this application.

[0114] The above is as stated in this application. Figure 4 The method for network packet capture and analysis based on artificial intelligence provided in the illustrated embodiment can be applied to a processor or implemented by a processor. The processor may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by integrated logic circuits in the processor's hardware or by instructions in software form. The processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0115] The steps of the method disclosed in the embodiments of this application can be directly manifested as being executed by a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. This storage medium is located in memory, and the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method.

[0116] This application also proposes a readable medium storing executable instructions. When these instructions are executed by the processor of an electronic device, the electronic device can perform an AI-based network packet capture and analysis method provided in any embodiment of this application, specifically for executing, for example... Figure 1 or Figure 2 or Figure 3 The method shown.

[0117] The electronic devices in the foregoing embodiments may be computers.

[0118] Those skilled in the art will understand that the embodiments of this application can be provided as methods or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or a combination of software and hardware.

[0119] The various embodiments in this application are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0120] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0121] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An artificial intelligence-based network packet capturing and analyzing method, characterized in that, The method comprises the following steps: adopting a lightweight AI model to perform semantic abstraction on network traffic data to construct a dynamically updated normal traffic baseline and extract corresponding real-time traffic features from the network traffic data; comparing the real-time traffic features with the normal traffic baseline to perform anomaly judgment and determine a corresponding anomaly probability; when the anomaly probability exceeds a preset risk threshold, generating and executing a packet capture strategy for abnormal traffic data; extracting structured features, time sequence features and correlation features from the abnormal traffic data captured by the packet capture strategy, and adopting a deep neural network to fuse and map the structured features, the time sequence features and the correlation features into a high-dimensional feature vector that retains the semantics of behavior patterns; inputting the high-dimensional feature vector into a preset special AI large model to perform anomaly classification, and based on the anomaly result of the anomaly classification, combining a general knowledge graph to perform causal logic reasoning to determine the root cause corresponding to the abnormal traffic data; generating a corresponding treatment strategy based on the root cause, and performing risk classification on the treatment strategy based on a preset strategy impact range and business interruption probability to perform corresponding treatment operations on the treatment strategies of different risk levels.

2. The method of claim 1, wherein, The comparison of the real-time traffic features with the normal traffic baseline to perform anomaly judgment and determine a corresponding anomaly probability comprises: calculating the deviation degree of the real-time traffic features and the normal traffic baseline; based on the deviation degree, combining the rarity of the real-time traffic features in historical behavior to perform comprehensive evaluation to generate the anomaly probability.

3. The method of claim 1, wherein, The deep neural network fusing and mapping the structured features, the time sequence features and the correlation features into a high-dimensional feature vector that retains the semantics of behavior patterns comprises: adopting a hybrid architecture based on Transformer and convolutional neural network to perform multi-modal fusion on the structured features, the time sequence features and the correlation features to generate fusion features; mapping the fusion features into the high-dimensional feature vector.

4. The method of claim 1, wherein, The inputting of the high-dimensional feature vector into a preset special AI large model to perform anomaly classification comprises: inputting the high-dimensional feature vector into the special AI large model, and adopting a dual logic of known feature matching and unknown pattern recognition to perform the anomaly classification; wherein, the known feature matching achieves recognition by comparing and matching the high-dimensional feature vector with a pre-trained threat feature library; the unknown pattern recognition identifies rare behaviors deviating from the normal pattern in the high-dimensional feature vector through an unsupervised algorithm.

5. The method of claim 4, wherein, The combination of a general knowledge graph based on the anomaly result of the anomaly classification to perform causal logic reasoning to determine the root cause corresponding to the abnormal traffic data comprises: according to the anomaly result, retrieving associated network entities and the correlation between each of the network entities in the general knowledge graph; adopting a counterfactual reasoning method to simulate adjusting the network entities and / or entity attributes corresponding to the network entities, and based on the correlation, deducing the influence of the simulation adjustment on the anomaly result; If the inference result shows that the abnormal result disappears, the network entity and / or the entity attribute are determined as the root cause.

6. The method of claim 1, wherein, The risk grading of the treatment strategy based on the preset policy influence range and business interruption probability comprises: When the policy influence range is limited to non-core nodes and the business interruption probability is lower than a preset threshold, the treatment strategy is determined as a low-risk strategy; When the treatment strategy is a low-risk strategy, the low-risk strategy is automatically executed through a standardized interface; When the influence range of the treatment strategy involves core service links or the business interruption probability is higher than the preset threshold, the treatment strategy is determined as a high-risk strategy; When the treatment strategy is a high-risk strategy, a to-be-reviewed scheme containing operation logic, expected effect and rollback mechanism is generated, and the high-risk strategy is executed after approval is obtained.

7. The method of claim 1, wherein, Further comprising: After the treatment operation is executed, the network traffic data is continuously monitored to verify the treatment effect of the treatment operation; When the monitoring result shows that the abnormal features corresponding to the abnormal traffic data disappear and the network link indicators return to normal, the treatment operation is determined as effective; When the monitoring result shows that the abnormal features do not disappear or the network link indicators do not return to normal, the treatment operation is determined as not expected, and the step of inputting the high-dimensional feature vector into the special AI large model for abnormal classification is returned to, so as to re-determine the root cause.

8. An artificial intelligence-based network packet capturing and analyzing apparatus, characterized by, Comprise: a traffic perception module configured to perform semantic abstraction on network traffic data by using a lightweight AI model, to construct a dynamically updated normal traffic baseline, and to extract corresponding real-time traffic features from the network traffic data; an abnormal probability determination module configured to compare the real-time traffic features with the normal traffic baseline to make an abnormality judgment and determine a corresponding abnormal probability; When the abnormal probability exceeds a preset risk threshold, a packet capture strategy for abnormal traffic data is generated and executed; a high-dimensional feature vector mapping module configured to extract structured features, time sequence features and correlation features from the abnormal traffic data captured by the packet capture strategy, and to fuse and map the structured features, the time sequence features and the correlation features into a high-dimensional feature vector that retains behavior pattern semantics by using a deep neural network; a root cause determination module configured to input the high-dimensional feature vector into a preset special AI large model for abnormal classification, and to perform causal logic reasoning based on abnormal results of the abnormal classification and in combination with a general knowledge graph, to determine a root cause corresponding to the abnormal traffic data; a treatment strategy generation module configured to generate a corresponding treatment strategy based on the root cause, and to perform risk grading of the treatment strategy based on a preset policy influence range and business interruption probability, to execute corresponding treatment operations on the treatment strategies of different risk levels.

9. A computer readable storage medium, the storage medium having stored thereon a computer program, characterized in that, The computer program is used to execute the network packet capture and analysis method based on artificial intelligence in the above claims 1-7.

10. An electronic device, comprising: The electronic device comprises: a processor; a memory for storing the processor-executable instructions; the processor is configured to read the executable instructions from the memory and execute the instructions to implement the method of any one of claims 1-7.

Images