Computer network security analysis method and system based on artificial intelligence

Abstract

The invention discloses a computer network security analysis method and system based on artificial intelligence, and the method comprises the following steps: 1, constructing a multi-source security data collection system, and collecting network terminal equipment operation data, network link transmission data, application system interaction data and user operation behavior data, the network terminal equipment operation data comprises a CPU utilization rate, a memory occupancy rate and a process starting log, and the network link transmission data comprises a data packet size, a transmission rate and a port access record; 2, preprocessing the multi-source security data acquired in the step 1; the method has the advantages that a multi-source data collection system covering terminal equipment, network links, application systems and user behaviors is constructed, cross-dimension data unified processing is achieved in combination with a weighted fusion algorithm, the problems that a traditional method is single in data dimension and one-sided in analysis are solved, and more complete data support is provided for threat recognition.

Description

Technical Field

[0001] This invention belongs to the field of computer network security analysis technology, specifically relating to a computer network security analysis method and system based on artificial intelligence. Background Technology

[0002] In the wave of digital transformation, the network has become the core support carrier for social operation and economic development. However, the security of cyberspace is facing unprecedented severe challenges. As a core means of ensuring cyberspace security, the technological upgrading and capability enhancement of network security analysis have become key issues that urgently need to be addressed.

[0003] From the perspective of changes in network architecture, the popularization of new technologies such as cloud computing, IoT, 5G, and edge computing has shifted network boundaries from "clear and controllable" to "fuzzy and dynamic." Traditional security analysis methods based on "boundary defense" are no longer suitable for the new network environment. On the one hand, the large-scale deployment of IoT devices has brought huge security risks. IoT devices such as smart cameras, industrial sensors, and smart home devices generally have problems such as untimely firmware updates, unmodified default passwords, and lack of security protection functions, becoming "weak entry points" for network attacks. From the perspective of the shortcomings of existing network security analysis technologies, current mainstream security analysis methods still have many limitations and are difficult to meet the security protection needs of complex network environments. Traditional threat detection methods based on signature codes rely on preset attack signature databases to identify threats, and their ability to identify unknown attacks and mutated attacks is extremely poor. Big data-based security analysis methods, such as the big data-based computer network security analysis method and system disclosed in patent publication number CN118555117B, involve: collecting user behavior data and interaction data; preprocessing the collected user dataset; using a federated learning architecture, using the preprocessed user dataset as training samples to train a machine learning model locally on the user's end for user state analysis; uploading the parameters of the trained machine learning model to a cloud server for global aggregation to obtain a global machine learning model; and using an unsupervised learning method based on anomaly detection to perform security analysis on the user's computer network behavior based on the global machine learning model and interaction data. Although this patent has achieved multi-node data collaborative training through a federated learning architecture and made some progress in user behavior analysis, this type of method still has three limitations. The core shortcomings are as follows: First, the focus is limited, only analyzing user status and failing to cover multi-dimensional security data such as network terminal devices, network links, and application systems. This makes it impossible to build a comprehensive threat identification system, for example, it cannot detect malicious program execution caused by abnormal processes on terminal devices, nor can it identify abnormal data packets hidden in network links. Second, it lacks dynamic attack chain analysis capabilities, only able to identify single attack behaviors and unable to correlate and analyze the entire process of attack initiation, propagation, and diffusion. It is difficult to determine the actual impact and potential risks of a threat. For example, when attackers launch attacks through multiple intermediate nodes, this method cannot trace the attack source or predict the next target of the attack's spread. Third, the defense strategy lacks adaptability, only able to execute fixed defense operations according to preset rules, unable to dynamically adjust the defense strategy based on attack severity, network load status, and business priority. For example, when facing low-severity attacks, executing a high-resource-consuming emergency defense strategy will cause network bandwidth to be occupied for normal business operations, affecting normal business operations; while when facing high-severity attacks, executing only a basic defense strategy will not effectively prevent the attack from spreading, leading to greater losses. Summary of the Invention The purpose of this invention is to provide a computer network security analysis method and system based on artificial intelligence, which significantly improves the accuracy of threat identification and defense response speed while ensuring data privacy and security, and effectively copes with complex and ever-changing network security threats.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a computer network security analysis method based on artificial intelligence, comprising the following steps: Step 1: Construct a multi-source security data collection system to collect network terminal device operation data, network link transmission data, application system interaction data, and user operation behavior data. Among them, network terminal device operation data includes CPU utilization, memory usage, and process startup logs, while network link transmission data includes data packet size, transmission rate, and port access records. Step 2: Preprocess the multi-source security data collected in Step 1 by sequentially performing data cleaning, data standardization, and data fusion operations; Step 3: Build a cross-domain data collaborative training model based on the federated learning framework, de-identify the pre-processed security data, and realize multi-node local model training through encrypted parameter transmission. Step 4: Construct a hierarchical AI analysis model, which includes an edge layer anomaly detection model, a network layer threat identification model, and an application layer risk assessment model. The edge layer anomaly detection model uses the isolated forest algorithm, the network layer threat identification model uses the improved YOLOv8 algorithm, and the application layer risk assessment model uses deep belief networks. Step 5: Input the local model parameters trained in Step 3 into the hierarchical artificial intelligence analysis model to perform real-time analysis on multi-source security data and output preliminary threat analysis results, including threat type, threat location and threat occurrence time. Step 6: Construct an attack chain graph based on the preliminary threat analysis results. The attack chain graph includes the attack entry node, the attack propagation path, and the attack target node. The attack chain graph is traversed and analyzed using a graph neural network algorithm to determine the threat propagation risk level. Step 7: Establish a defense strategy matching library based on the threat proliferation risk level. The defense strategy matching library includes basic defense strategies, enhanced defense strategies, and emergency defense strategies. Different defense strategies correspond to different risk levels. Step 8: Dynamically adjust the execution priority of defense strategies based on the severity of the attack. The severity of the attack is quantitatively assessed through the scope of threat impact, the degree of data leakage, and the duration of business interruption. The weight of each assessment indicator is determined by the analytic hierarchy process. Step 9: Monitor the effectiveness of the defense strategy in real time, collect network security data after the defense is completed, input the data into the hierarchical artificial intelligence analysis model for secondary evaluation, and determine whether the threat has been eliminated; Step 10: If the threat is not eliminated, return to Step 6 to re-optimize the attack chain graph and defense strategy; if the threat has been eliminated, store the analysis results, defense strategy and execution effect of this security incident in the security incident knowledge base for updating the parameters of the hierarchical artificial intelligence analysis model.

[0005] As a preferred technical solution of the present invention, in step one, the multi-source secure data acquisition system adopts a distributed acquisition architecture, including acquisition terminals deployed at network edge nodes, aggregation servers deployed at the core network, and a management platform deployed in the cloud. The acquisition terminals adopt a lightweight acquisition protocol, and the acquisition frequency can be dynamically adjusted according to the network load.

[0006] As a preferred technical solution of the present invention, in step three, the federated learning framework adopts a horizontal federated learning mode. During the multi-node local model training process, the model parameters are encrypted and transmitted through a secure aggregation algorithm. The secure aggregation algorithm adopts a homomorphic encryption algorithm, and the encryption key is dynamically generated by the cloud analysis node and distributed to the local server nodes of each enterprise.

[0007] As a preferred technical solution of the present invention, in step four, during the training process of the edge layer anomaly detection model, the sliding window technology is used to sample the network terminal device operation data in real time. The sampling window size is set to 5-10 data acquisition cycles. The anomaly score of each sampled data is calculated by the isolated forest algorithm. When the anomaly score exceeds the preset threshold, the network layer threat identification model is triggered to start.

[0008] As a preferred technical solution of the present invention, in step four, the improved YOLOv8 algorithm optimizes the network structure by introducing an attention mechanism module. The attention mechanism module adopts a hybrid attention mode that combines channel attention and spatial attention, and strengthens the extraction of key feature channels and target region features.

[0009] As a preferred technical solution of the present invention, in step six, during the attack chain graph construction process, entity recognition and relationship extraction technology is used to extract attack entities and attack relationships from the preliminary threat analysis results. Attack entities include attack source IP, attack target port and attack tools, and attack relationships include launching an attack, exploiting vulnerabilities and stealing data. The attack chain graph is stored in a graph database.

[0010] As a preferred technical solution of the present invention, in step seven, the basic defense strategy includes port filtering, access control list configuration and virus scanning, the enhanced defense strategy includes starting the intrusion prevention system, data encryption transmission and isolation of suspicious processes, and the emergency defense strategy includes network link disconnection, terminal device shutdown and data backup and recovery.

[0011] As a preferred technical solution of the present invention, in step eight, during the quantitative assessment of attack severity, the scope of threat impact is divided into three levels: local network impact, regional network impact, and network-wide impact, and the degree of data leakage is divided into three levels: no data leakage, non-sensitive data leakage, and sensitive data leakage.

[0012] This invention also discloses an artificial intelligence-based computer network security analysis system, including... Multi-source data acquisition module: Adopting a distributed architecture, it includes edge acquisition terminals, aggregation servers and cloud management units. The edge acquisition terminals are deployed at the network edge nodes and support MQTT and SNMP acquisition protocols. They are used to collect terminal device operation data, network link transmission data, application system interaction data and user operation behavior data. The aggregation server is used to receive data from the edge acquisition terminals and perform temporary storage. The cloud management unit is used to configure acquisition parameters and monitor the operating status of the acquisition terminals. The data preprocessing module includes a data cleaning unit, a data standardization unit, and a data fusion unit. The data cleaning unit removes outliers and uses the mean imputation method to handle missing values. The data standardization unit uses the Min-Max standardization algorithm to map the data to the [0,1] interval. The data fusion unit realizes multi-dimensional data fusion. Federated Collaborative Training Module: Includes data anonymization unit, local model training unit, and parameter aggregation unit; Layered AI analysis module: includes edge layer anomaly detection unit, network layer threat identification unit, and application layer risk assessment unit; Attack chain graph construction module: includes entity relationship extraction unit, graph storage unit and graph analysis unit; Defense strategy management module: includes strategy matching unit, priority adjustment unit and strategy execution unit. The strategy matching unit establishes a defense strategy matching library. Low risk level corresponds to basic defense strategy, medium risk level corresponds to enhanced defense strategy and high risk level corresponds to emergency defense strategy. The priority adjustment unit adopts the hierarchical analysis method to adjust the strategy execution priority based on the severity of the attack. The strategy execution unit supports two modes: automatic execution and manual triggering. The effectiveness evaluation module includes an evaluation indicator calculation unit, an effectiveness judgment unit, and a strategy optimization unit. The evaluation indicator calculation unit calculates the threat elimination rate, defense response time, and false alarm rate. The effectiveness judgment unit sets the judgment threshold. If the strategy optimization unit determines that the defense is ineffective, it outputs strategy adjustment suggestions. Security Knowledge Base Module: This module includes a local knowledge base unit, a cloud-based knowledge base unit, and a knowledge update unit. The local knowledge base unit stores local security event data for the enterprise, while the cloud-based knowledge base unit stores anonymized cross-enterprise data using a distributed storage architecture. The knowledge update unit uses knowledge graph technology to correlate and analyze security event data and update training samples for the hierarchical AI analysis module.

[0013] Compared with the prior art, the beneficial effects of the present invention are: By constructing a multi-source data collection system covering terminal devices, network links, application systems, and user behavior, and combining it with a weighted fusion algorithm to achieve unified cross-dimensional data processing, the system solves the problems of single data dimensions and one-sided analysis in traditional methods, providing more complete data support for threat identification. The edge layer isolated forest algorithm quickly detects terminal anomalies, the network layer improved YOLOv8 algorithm improves the identification rate of small attack packets, and the application layer deep belief network accurately assesses risks. The three-layer model works together to achieve an efficient analysis process of "rapid screening-accurate identification-deep assessment". By constructing an attack chain graph based on graph neural networks, the attack entry point, propagation path and target nodes are clearly presented. This can accurately determine the threat spread risk level and solve the shortcomings of existing technologies that can only identify single attack behaviors and cannot trace the attack chain, thus realizing the transformation from "passive defense" to "proactive prediction". Attached Figure Description

[0014] Figure 1 This is a flowchart of the computer network security analysis method of the present invention; Figure 2 This is a system configuration diagram of the present invention. Detailed Implementation

[0015] Example 1 Please see Figure 1 This is the first embodiment of the present invention, which provides a computer network security analysis method based on artificial intelligence, including the following steps: Step 1: Construct a multi-source security data acquisition system to collect network terminal device operation data, network link transmission data, application system interaction data, and user operation behavior data. Among them, network terminal device operation data includes CPU utilization, memory usage, and process startup logs, while network link transmission data includes data packet size, transmission rate, and port access records. The multi-source security data acquisition system adopts a distributed acquisition architecture, including acquisition terminals deployed at network edge nodes, aggregation servers deployed in the core network, and a management platform deployed in the cloud. The acquisition terminals use a lightweight acquisition protocol, and the acquisition frequency can be dynamically adjusted according to network load. Step 2: Preprocess the multi-source security data collected in Step 1 by performing data cleaning, data standardization, and data fusion operations in sequence. Data cleaning is achieved by removing outliers and missing values, and data fusion uses a weighted fusion algorithm to map data from different dimensions to a unified data space. Step 3: Build a cross-domain data collaborative training model based on the federated learning framework. De-identify the pre-processed secure data and achieve multi-node local model training through encrypted parameter transmission. The de-identification process uses differential privacy technology. The multiple nodes include enterprise local server nodes and cloud analysis nodes. The federated learning framework adopts a horizontal federated learning mode. During multi-node local model training, the model parameters are encrypted and transmitted through a secure aggregation algorithm. The secure aggregation algorithm uses a homomorphic encryption algorithm, and the encryption key is dynamically generated by the cloud analysis node and distributed to each enterprise local server node. Step 4: Construct a hierarchical AI analysis model, which includes an edge-layer anomaly detection model, a network-layer threat identification model, and an application-layer risk assessment model. The edge-layer anomaly detection model uses the Isolation Forest algorithm, the network-layer threat identification model uses an improved YOLOv8 algorithm, and the application-layer risk assessment model uses a deep belief network. During the training of the edge-layer anomaly detection model, a sliding window technique is used to sample network terminal device operation data in real time. The sampling window size is set to 5-10 data acquisition cycles. The anomaly score of each sampled data is calculated using the Isolation Forest algorithm. When the anomaly score exceeds a preset threshold, the network-layer threat identification model is triggered. The improved YOLOv8 algorithm optimizes the network structure by introducing an attention mechanism module. The attention mechanism module adopts a hybrid attention mode that combines channel attention and spatial attention. By strengthening the extraction of key feature channels and target area features, it improves the identification accuracy of small-sized network attack packets, with an accuracy rate 15%-20% higher than the original YOLOv8 algorithm. Step 5: Input the local model parameters trained in Step 3 into the hierarchical artificial intelligence analysis model to perform real-time analysis on multi-source security data and output preliminary threat analysis results, including threat type, threat location and threat occurrence time. Step Six: Construct an attack chain graph based on the preliminary threat analysis results. The attack chain graph includes attack entry nodes, attack propagation paths, and attack target nodes. A graph neural network algorithm is used to traverse and analyze the attack chain graph to determine the threat propagation risk level. During the construction of the attack chain graph, entity recognition and relationship extraction techniques are used to extract attack entities and attack relationships from the preliminary threat analysis results. Attack entities include the attack source IP, attack target port, and attack tools used. Attack relationships include initiating attacks, exploiting vulnerabilities, and data theft. The attack chain graph is stored in a graph database, specifically the Neo4j database. Step 7: Establish a defense strategy matching library based on the threat spread risk level. The defense strategy matching library includes basic defense strategies, enhanced defense strategies, and emergency defense strategies. Different defense strategies correspond to different risk levels. Basic defense strategies include port filtering, access control list configuration, and virus scanning. Enhanced defense strategies include starting the intrusion prevention system, encrypting data transmission, and isolating suspicious processes. Emergency defense strategies include disconnecting network links, taking terminal devices offline, and data backup and recovery. Different defense strategies correspond to different resource utilization rates. The resource utilization rate of basic defense strategies is less than 10%, the resource utilization rate of enhanced defense strategies is 10%-30%, and the resource utilization rate of emergency defense strategies is greater than 30%. Step 8: Dynamically adjust the execution priority of defense strategies based on attack severity. Attack severity is quantitatively assessed through threat impact scope, data leakage degree, and service interruption duration. The weight of each assessment indicator is determined using the analytic hierarchy process (AHP). During the quantitative assessment of attack severity, threat impact scope is divided into three levels: local network impact, regional network impact, and network-wide impact. Data leakage degree is divided into three levels: no data leakage, non-sensitive data leakage, and sensitive data leakage. Service interruption duration is divided into three levels: 0-1 hour, 1-4 hours, and more than 4 hours. The weights of threat impact scope, data leakage degree, and service interruption duration are determined to be 0.4, 0.3, and 0.3, respectively, using the AHP. Step Nine: Monitor the effectiveness of the defense strategy in real time, collect network security data after the defense, and input it into the hierarchical artificial intelligence analysis model for secondary evaluation to determine whether the threat has been eliminated. The evaluation of the effectiveness of the defense strategy adopts a multi-index comprehensive evaluation method. The evaluation indicators include threat elimination rate, defense response time and false alarm rate. The threat elimination rate is the ratio of the number of eliminated threats to the total number of threats. The defense response time is the time interval from threat identification to the activation of the defense strategy. The false alarm rate is the ratio of the number of falsely identified threats to the total number of identified threats. When the threat elimination rate is higher than 90%, the defense response time is lower than 30 seconds and the false alarm rate is lower than 5%, the defense strategy is considered to be effective. Step 10: If the threat is not eliminated, return to Step 6 to re-optimize the attack chain graph and defense strategy; if the threat has been eliminated, store the security incident analysis results, defense strategies, and execution effects in the security incident knowledge base for updating the parameters of the hierarchical artificial intelligence analysis model; the security incident knowledge base adopts a distributed storage architecture, including a local knowledge base and a cloud knowledge base. The local knowledge base stores the enterprise's security incident data, and the cloud knowledge base stores anonymized cross-enterprise security incident data. Knowledge graph technology is used to perform correlation analysis on the security incident data to update the training sample set of the hierarchical artificial intelligence analysis model. The update cycle is set to 7-14 days.

[0016] Example 2 Please see Figure 2This is a second embodiment of the present invention, which provides an artificial intelligence-based computer network security analysis system, including... Multi-source data acquisition module: Adopting a distributed architecture, it includes edge acquisition terminals, aggregation servers and cloud management units. The edge acquisition terminals are deployed at the network edge nodes and support MQTT and SNMP acquisition protocols. They are used to collect terminal device operation data, network link transmission data, application system interaction data and user operation behavior data. The aggregation server is used to receive data from the edge acquisition terminals and perform temporary storage. The cloud management unit is used to configure acquisition parameters and monitor the operating status of the acquisition terminals. The data preprocessing module includes a data cleaning unit, a data standardization unit, and a data fusion unit. The data cleaning unit removes outliers and uses the mean imputation method to handle missing values. The data standardization unit uses the Min-Max standardization algorithm to map the data to the [0,1] interval. The data fusion unit realizes multi-dimensional data fusion. Federated Collaborative Training Module: Includes data anonymization unit, local model training unit, and parameter aggregation unit; Layered AI analysis module: includes edge layer anomaly detection unit, network layer threat identification unit, and application layer risk assessment unit; Attack chain graph construction module: includes entity relationship extraction unit, graph storage unit and graph analysis unit; Defense strategy management module: includes strategy matching unit, priority adjustment unit and strategy execution unit. The strategy matching unit establishes a defense strategy matching library. Low risk level corresponds to basic defense strategy, medium risk level corresponds to enhanced defense strategy and high risk level corresponds to emergency defense strategy. The priority adjustment unit adopts the hierarchical analysis method to adjust the strategy execution priority based on the severity of the attack. The strategy execution unit supports two modes: automatic execution and manual triggering. The effectiveness evaluation module includes an evaluation indicator calculation unit, an effectiveness judgment unit, and a strategy optimization unit. The evaluation indicator calculation unit calculates the threat elimination rate, defense response time, and false alarm rate. The effectiveness judgment unit sets the judgment threshold. If the strategy optimization unit determines that the defense is ineffective, it outputs strategy adjustment suggestions. Security Knowledge Base Module: This module includes a local knowledge base unit, a cloud-based knowledge base unit, and a knowledge update unit. The local knowledge base unit stores local security event data for the enterprise, while the cloud-based knowledge base unit stores anonymized cross-enterprise data using a distributed storage architecture. The knowledge update unit uses knowledge graph technology to correlate and analyze security event data and update training samples for the hierarchical AI analysis module.

Claims

1. A computer network security analysis method based on artificial intelligence, characterized in that: Includes the following steps: Step 1: Construct a multi-source security data collection system to collect network terminal device operation data, network link transmission data, application system interaction data, and user operation behavior data. Among them, network terminal device operation data includes CPU utilization, memory usage, and process startup logs, while network link transmission data includes data packet size, transmission rate, and port access records. Step 2: Preprocess the multi-source security data collected in Step 1 by sequentially performing data cleaning, data standardization, and data fusion operations; Step 3: Build a cross-domain data collaborative training model based on the federated learning framework, de-identify the pre-processed security data, and realize multi-node local model training through encrypted parameter transmission. Step 4: Construct a hierarchical AI analysis model, which includes an edge layer anomaly detection model, a network layer threat identification model, and an application layer risk assessment model. The edge layer anomaly detection model uses the isolated forest algorithm, the network layer threat identification model uses the improved YOLOv8 algorithm, and the application layer risk assessment model uses deep belief networks. Step 5: Input the local model parameters trained in Step 3 into the hierarchical artificial intelligence analysis model to perform real-time analysis on multi-source security data and output preliminary threat analysis results, including threat type, threat location and threat occurrence time. Step 6: Construct an attack chain graph based on the preliminary threat analysis results. The attack chain graph includes the attack entry node, the attack propagation path, and the attack target node. The attack chain graph is traversed and analyzed using a graph neural network algorithm to determine the threat propagation risk level. Step 7: Establish a defense strategy matching library based on the threat proliferation risk level. The defense strategy matching library includes basic defense strategies, enhanced defense strategies, and emergency defense strategies. Different defense strategies correspond to different risk levels. Step 8: Dynamically adjust the execution priority of defense strategies based on the severity of the attack. The severity of the attack is quantitatively assessed through the scope of threat impact, the degree of data leakage, and the duration of business interruption. The weight of each assessment indicator is determined by the analytic hierarchy process. Step 9: Monitor the effectiveness of the defense strategy in real time, collect network security data after the defense is completed, input the data into the hierarchical artificial intelligence analysis model for secondary evaluation, and determine whether the threat has been eliminated; Step 10: If the threat is not eliminated, return to Step 6 to re-optimize the attack chain graph and defense strategy; if the threat has been eliminated, store the analysis results, defense strategy and execution effect of this security incident in the security incident knowledge base for updating the parameters of the hierarchical artificial intelligence analysis model.

2. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step one, the multi-source security data acquisition system adopts a distributed acquisition architecture, including acquisition terminals deployed at network edge nodes, aggregation servers deployed at the core network, and a management platform deployed in the cloud. The acquisition terminals adopt a lightweight acquisition protocol, and the acquisition frequency can be dynamically adjusted according to the network load.

3. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step three, the federated learning framework adopts a horizontal federated learning mode. During the multi-node local model training process, the model parameters are encrypted and transmitted through a secure aggregation algorithm. The secure aggregation algorithm adopts a homomorphic encryption algorithm, and the encryption key is dynamically generated by the cloud analysis node and distributed to the local server nodes of each enterprise.

4. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step four, during the training of the edge layer anomaly detection model, the sliding window technique is used to sample the network terminal device's operating data in real time. The sampling window size is set to 5-10 data acquisition cycles. The anomaly score of each sampled data is calculated using the isolated forest algorithm. When the anomaly score exceeds a preset threshold, the network layer threat identification model is triggered.

5. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step four, the improved YOLOv8 algorithm optimizes the network structure by introducing an attention mechanism module. The attention mechanism module adopts a hybrid attention mode that combines channel attention and spatial attention, thereby strengthening the extraction of key feature channels and target region features.

6. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step six, during the attack chain graph construction process, entity recognition and relationship extraction technologies are used to extract attack entities and attack relationships from the preliminary threat analysis results. Attack entities include attack source IP, attack target port, and attack tools. Attack relationships include launching attacks, exploiting vulnerabilities, and stealing data. The attack chain graph is stored in a graph database.

7. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step seven, the basic defense strategy includes port filtering, access control list configuration, and virus scanning; the enhanced defense strategy includes starting the intrusion prevention system, encrypting data transmission, and isolating suspicious processes; and the emergency defense strategy includes disconnecting network links, taking terminal devices offline, and data backup and recovery.

8. The computer network security analysis method based on artificial intelligence according to claim 1, characterized in that: In step eight, during the attack severity quantification assessment, the scope of threat impact is divided into three levels: local network impact, regional network impact, and network-wide impact. The degree of data leakage is divided into three levels: no data leakage, non-sensitive data leakage, and sensitive data leakage.

9. A computer network security analysis system based on artificial intelligence, characterized in that: Implementing the AI-based computer network security analysis method as described in any one of claims 1-8, comprising: Multi-source data acquisition module: Adopting a distributed architecture, it includes edge acquisition terminals, aggregation servers and cloud management units. The edge acquisition terminals are deployed at the network edge nodes and support MQTT and SNMP acquisition protocols. They are used to collect terminal device operation data, network link transmission data, application system interaction data and user operation behavior data. The aggregation server is used to receive data from the edge acquisition terminals and perform temporary storage. The cloud management unit is used to configure acquisition parameters and monitor the operating status of the acquisition terminals. The data preprocessing module includes a data cleaning unit, a data standardization unit, and a data fusion unit. The data cleaning unit removes outliers and uses the mean imputation method to handle missing values. The data standardization unit uses the Min-Max standardization algorithm to map the data to the [0,1] interval. The data fusion unit realizes multi-dimensional data fusion. Federated Collaborative Training Module: Includes data anonymization unit, local model training unit, and parameter aggregation unit; Layered AI analysis module: includes edge layer anomaly detection unit, network layer threat identification unit, and application layer risk assessment unit; Attack chain graph construction module: includes entity relationship extraction unit, graph storage unit and graph analysis unit; Defense strategy management module: includes strategy matching unit, priority adjustment unit and strategy execution unit. The strategy matching unit establishes a defense strategy matching library. Low risk level corresponds to basic defense strategy, medium risk level corresponds to enhanced defense strategy and high risk level corresponds to emergency defense strategy. The priority adjustment unit adopts the hierarchical analysis method to adjust the strategy execution priority based on the severity of the attack. The strategy execution unit supports two modes: automatic execution and manual triggering. The effectiveness evaluation module includes an evaluation indicator calculation unit, an effectiveness judgment unit, and a strategy optimization unit. The evaluation indicator calculation unit calculates the threat elimination rate, defense response time, and false alarm rate. The effectiveness judgment unit sets the judgment threshold. If the strategy optimization unit determines that the defense is ineffective, it outputs strategy adjustment suggestions. Security Knowledge Base Module: This module includes a local knowledge base unit, a cloud-based knowledge base unit, and a knowledge update unit. The local knowledge base unit stores local security event data for the enterprise, while the cloud-based knowledge base unit stores anonymized cross-enterprise data using a distributed storage architecture. The knowledge update unit uses knowledge graph technology to correlate and analyze security event data and update training samples for the hierarchical AI analysis module.

Images