Computer network security anomaly detection method and system applying artificial intelligence

Abstract

The invention belongs to the technical field of artificial intelligence, and particularly relates to a computer network security anomaly detection method and system applying artificial intelligence, and the system comprises a data collection module, a feature engineering module, an initial model deployment unit, an anomaly detection engine, a feedback verification interface, a model evolution controller and a security policy execution unit. An intelligent detection framework with closed-loop feedback and online learning capabilities is constructed; enabling the artificial intelligence model to continuously absorb verification information in a real environment after deployment through a closed-loop feedback mechanism and an online incremental learning process, and dynamically correcting cognition on a normal behavior boundary; by using the transfer learning base model and the feature space alignment technology, the generalization ability is reserved, and meanwhile, the flow distribution characteristics of a specific business scene are quickly adapted.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence technology, specifically a computer network security anomaly detection method and system that applies artificial intelligence. Background Technology

[0002] The rapid development of information technology and the widespread adoption of network infrastructure have made computer networks a key support for the operation of modern society. At the same time, network security issues have become increasingly prominent. Against this backdrop, anomaly detection technology based on artificial intelligence has become a research hotspot and practical direction in the field of network security. Current mainstream AI-driven network security anomaly detection solutions mostly employ supervised or unsupervised learning frameworks, combining algorithms such as deep neural networks and support vector machines to model and analyze network traffic feature vectors such as packet length and protocol type.

[0003] However, existing technologies suffer from deep-seated structural contradictions: the generalization ability of models is incompatible with the accuracy of scene adaptation; to improve generalization performance, existing methods rely on offline training on large-scale general datasets, but network environments are highly heterogeneous and time-varying, with significant differences in traffic characteristics across different scenarios. General models cannot accurately characterize the boundaries of real normal behavior in specific scenarios, and direct application can easily lead to a large number of false positives and false negatives; on the other hand, re-collecting data to fine-tune the model for specific scenarios faces bottlenecks such as high annotation costs, long training cycles, and iteration lagging behind attack evolution; the root of this contradiction lies in the static modeling paradigm of training first, then deploying, and being difficult to update. After the model is solidified, it lacks a mechanism for absorbing and adaptively adjusting dynamic feedback information from the environment, and has not established a feedback path from detection results to model cognition. It is in an open-loop operation state, unable to actively correct the definition of normal and abnormal, making it difficult to cope with new and low-frequency attacks, weakening detection accuracy and timeliness, and posing security risks to highly sensitive scenarios.

[0004] Therefore, the present invention provides a computer network security anomaly detection method and system that applies artificial intelligence. Summary of the Invention

[0005] To achieve the aforementioned objectives, this invention provides a computer network security anomaly detection method and system using artificial intelligence. By constructing an intelligent detection architecture with closed-loop feedback, online learning, and dynamic adaptation capabilities, it fundamentally resolves the structural contradiction between model generalization ability and scenario adaptation accuracy in existing technologies. After deployment, the system can continuously perceive real network behavior characteristics in the operating environment and adaptively correct the cognitive boundaries of the internal artificial intelligence model based on operation and maintenance feedback, alarm verification results, and environmental context information. This allows it to maintain the ability to generalize and identify unknown attacks while accurately depicting normal behavior patterns in specific business scenarios.

[0006] The system described in this invention includes a data acquisition module, a feature engineering module, an initial model deployment unit, an anomaly detection engine, a feedback verification interface, a model evolution controller, and a security policy execution unit. The modules are physically connected and logically coordinated through a standardized data bus and control signal channel, forming a complete and self-evolving closed-loop system for network security anomaly detection.

[0007] Preferably, the data acquisition module is deployed at key traffic nodes of the target network, including but not limited to mirror ports of core switches, bypass interfaces of border firewalls, or terminal host agents, to capture raw network communication data packets in real time. The module adopts an Ethernet listening mechanism compliant with the IEEE 802.3 standard, supports full-duplex traffic mirroring, and adds a high-precision local clock mark to each data packet through a timestamp injection unit to ensure the accuracy of subsequent timing analysis. The acquired raw data is temporarily stored in a secure isolation buffer and then sent to the feature engineering module via DMA direct transfer to avoid data pollution or delay accumulation in intermediate links.

[0008] Preferably, the feature engineering module incorporates a multi-dimensional feature extractor, whose hardware carrier is a hybrid architecture of a programmable logic array and a dedicated instruction set processor. This module first performs protocol parsing on the original data packets, peeling off header information layer by layer according to the OSI seven-layer model to extract basic feature vectors including transport layer port numbers, application layer protocol identifiers, session duration, byte throughput rate, packet interval entropy value, and flow direction asymmetry. Subsequently, it combines the topology metadata of the target network to generate context-enhanced features, such as the frequency of a certain IP address accessing database services during working hours or the calling patterns of a specific user group to internal APIs. After all features are normalized, they form structured input samples, which are then output to the anomaly detection engine in a pipeline manner through a double-buffered queue.

[0009] Preferably, the initial model deployment unit completes the loading and activation of the pre-built model before the system goes online for the first time. This pre-built model is not a static classifier trained on a general public dataset, but a transfer learning base model built by the central model factory based on cross-industry anonymized traffic samples. This transfer learning base model adopts a neural network structure that integrates a deep autoencoder and an attention mechanism, including an input embedding layer, a multi-head attention encoding layer, a bottleneck compression layer, and a reconstruction decoding layer. Its training process strictly follows the unsupervised paradigm, with the objective function being to minimize the mean square error between the input features and the reconstructed output. It is worth noting that this base model is embedded in a read-only secure storage chip at the time of manufacture and its integrity is verified by a hardware root of trust to ensure that it is not tampered with during deployment.

[0010] Preferably, the anomaly detection engine, as the core processing unit of this invention, is carried by an edge computing server, which integrates a trusted execution environment and a general-purpose operating system dual-partition architecture. The lightweight inference engine runs in the trusted execution environment, receives real-time feature samples from the feature engineering module, calls the base model loaded by the initial model deployment unit to perform forward inference, and outputs the reconstruction error value and potential anomaly score for each sample. When the score exceeds the initial threshold value set by the dynamic threshold judgment unit, a primary anomaly alarm event is triggered, and the complete context data packet, feature vector, and internal activation state of the model are packaged and pushed to the feedback verification interface through an encrypted channel.

[0011] Preferably, the feedback verification interface is open to network security operations and maintenance personnel, and adopts a role-based access control mechanism. Only authorized personnel can manually review primary alarms. The review operation includes three deterministic instructions: confirming it as a real attack, marking it as a false alarm, or requesting supplementary context. Each review result is accompanied by a digital signature and timestamp and written to an immutable distributed log ledger. This ledger also records auxiliary judgment information automatically generated by the system, including the network load status when the alarm occurred, the security level of the associated assets, and the handling records of similar alarms in the past, providing multi-dimensional decision-making basis for subsequent model evolution.

[0012] Preferably, the model evolution controller periodically polls the log ledger of the feedback verification interface and initiates the online learning process. The controller first extracts confirmed real attack samples and false positive samples from the ledger, constructing positive and negative sample pools respectively. Then, based on the statistical characteristics of the current network environment's feature distribution, it calculates the maximum mean difference between the sample pools and the online traffic feature space. If this difference is lower than a preset convergence criterion, the current environment is considered stable, and the fine-tuning phase can proceed directly. Otherwise, a feature space alignment subroutine is triggered, adjusting the parameters of the feature extractor through an adversarial domain adaptation mechanism to align the source domain (historical) with the target domain (current). The feature distributions of the model tend to be consistent. After alignment, the controller calls the incremental learning algorithm to update the parameters of the decoder part after the bottleneck layer and the anomaly scoring mapping layer while keeping the backbone structure of the base model unchanged. The update process adopts the mini-batch gradient descent method, and the learning rate is adaptively adjusted according to the degree of environmental change. After each update, the model stability is verified: the new model is run on the normal traffic replay test set of the most recent hour. If the false alarm rate does not exceed the allowable fluctuation range, the new model version is submitted to the anomaly detection engine; otherwise, it is rolled back to the previous stable version, and the reason for the evolution failure is recorded for subsequent analysis.

[0013] Preferably, the security policy execution unit interfaces with the enterprise's existing security orchestration, automation, and response platform, receives final confirmation alarms from the anomaly detection engine, and performs blocking, rate limiting, isolation, or forensic operations according to the preset response policy. This unit interacts with the SOAR platform through a RESTful API, and all instructions are transmitted using the TLS 1.3 protocol with two-way certificate authentication. In addition, this unit is also responsible for synchronizing the handling results back to the feedback verification interface to form a complete closed loop.

[0014] Furthermore, to ensure the security and reliability of the entire system, this invention sets up an independent security element chip at the hardware level to store model keys, device identity credentials, and hash anchors for the log ledger. All cross-module data transmissions are encrypted and authenticated by this security element to ensure data integrity and trustworthy source. At the same time, the system has a built-in health monitoring agent that continuously monitors the resource utilization, communication latency, and number of abnormal restarts of each module. Once abnormal behavior is detected, the security circuit breaker mechanism is immediately triggered, switching the system to a degraded operation mode and reporting it to the centralized management platform.

[0015] Preferably, the present invention provides a computer network security anomaly detection method using artificial intelligence, the specific steps of which are as follows: The first step is to capture raw network communication data packets in real time by deploying data acquisition modules at key network nodes and attach a high-precision local timestamp to each data packet; The second step is to send the original data packet into the feature engineering module, where protocol parsing, basic feature extraction, context enhancement and normalization are performed in sequence to generate structured feature samples. The third step, during the system initialization phase, is to load a pre-built transfer learning base model from the read-only secure storage chip and complete integrity verification through the hardware root of trust. The fourth step is to input the feature samples into the trusted execution environment of the anomaly detection engine, perform forward inference on the base model, and calculate the reconstruction error and anomaly score. The fifth step is to compare the anomaly score with the threshold value set by the dynamic threshold judgment unit. If the threshold is exceeded, a primary anomaly alarm is generated and the complete context information is encapsulated and pushed to the feedback verification interface. The sixth step involves authorized operations and maintenance personnel conducting a deterministic review of the primary alarms through the feedback verification interface. The review results, along with auxiliary context information, are written into an immutable distributed log ledger. Step 7: The model evolution controller periodically reads the log ledger, extracts confirmed samples, performs feature space alignment and incremental fine-tuning, and after passing stability verification, deploys the updated model to the anomaly detection engine. Step 8: The security policy execution unit receives the final confirmation alarm, calls the external SOAR platform to execute the preset response action, and synchronously sends the handling result back to the feedback verification interface to complete the closed-loop feedback.

[0016] In a preferred embodiment of the present invention, the threshold value of the dynamic threshold determination unit is not a fixed constant, but is dynamically adjusted according to the current network service cycle, asset sensitivity level and historical alarm density; the unit maintains a normal traffic characteristic statistical model within a sliding time window, and automatically recalculates the threshold benchmark when a service mode switch is detected, so as to avoid false alarms caused by normal fluctuations in the service.

[0017] Furthermore, the system described in this invention supports multi-tenant isolated deployment. In cloud environments or managed security service scenarios, the data collection, feature engineering, and model evolution processes of different customers are logically completely isolated, each having its own independent model instance and log ledger, but sharing the same base model provided by the central model factory. This architecture not only protects customer data privacy but also realizes the potential for cross-tenant knowledge transfer. When multiple tenants contribute high-quality false positive correction samples under anonymization, the central model factory can aggregate these samples, iteratively optimize the next generation of base models, and push them to each edge node through a secure OTA mechanism.

[0018] The beneficial effects of this invention are as follows: This invention discloses a computer network security anomaly detection method and system using artificial intelligence. Through a closed-loop feedback mechanism and an online incremental learning process, the AI ​​model continuously absorbs verification information from the real environment after deployment, dynamically correcting its perception of normal behavior boundaries. It leverages transfer learning base models and feature space alignment technology to quickly adapt to the traffic distribution characteristics of specific business scenarios while retaining generalization capabilities. It achieves deep coupling between the anomaly detection process and the security operation and maintenance process, transforming human expert judgment into effective supervisory signals for model evolution. It ensures stability constraints and security verification during model updates, preventing performance degradation or security vulnerabilities introduced by online learning. Furthermore, through the collaboration of hardware-level security elements and a trusted execution environment, it guarantees the integrity and confidentiality of data and models throughout the entire detection chain. Attached Figure Description

[0019] The invention will now be further described with reference to the accompanying drawings.

[0020] Figure 1 This is a structural block diagram of a computer network security anomaly detection system that applies artificial intelligence in this invention; Figure 2 This is a flowchart of a computer network security anomaly detection method that applies artificial intelligence, as described in this invention. Detailed Implementation

[0021] To make the technical means, creative features, objectives and effects of this invention easier to understand, the invention will be further described below in conjunction with specific embodiments.

[0022] like Figure 1 As shown in the embodiment of the present invention, a computer network security anomaly detection system applying artificial intelligence includes a data acquisition module. This module can be deployed on the mirror port of a core switch, the bypass listening interface of a border firewall, or a lightweight agent program on a terminal host. Its hardware platform is based on a gigabit / 10-gigabit Ethernet controller chip supporting the IEEE 802.3 standard, possessing full-duplex traffic mirroring capabilities and integrating a high-precision timestamp injection unit. This timestamp injection unit uses the IEEE 1588 Precision Time Protocol (PTP) synchronization mechanism to ensure that each captured data packet is accompanied by a nanosecond-level local clock mark, with time deviation controlled within ±50 nanoseconds. The raw data packets are directly written to a secure isolation buffer via a DMA channel. This buffer is located in a dedicated area of ​​physical memory protected by the IOMMU to prevent unauthorized access or tampering of data content by the operating system kernel or other processes. The buffer adopts a circular queue structure with a capacity of 64MB, supporting continuous writing at a maximum line speed of 10Gbps. Data remains in the buffer for no more than 200 milliseconds before being pushed to the feature engineering module in a zero-copy manner.

[0023] In this embodiment, the hardware carrier of the feature engineering module is a heterogeneous computing unit, which includes a Xilinx Zynq UltraScale+ MPSoC chip, which integrates an ARM Cortex-A53 multi-core processor and a programmable logic array. The module runs a customized Linux real-time operating system, and the scheduling strategy adopts a priority mechanism to ensure deterministic latency of the feature extraction task. Following the above, at the software level, the module has a built-in multi-dimensional feature extractor, whose execution process is divided into three stages: protocol parsing, basic feature generation, and context enhancement. In the protocol parsing stage, the module decapsulates the protocol layer by layer according to the OSI seven-layer model and uses the DPDK acceleration package to process it, supporting deep recognition of mainstream protocols such as TCP, UDP, HTTP, HTTPS, DNS, SSH, and RDP. For encrypted traffic, such as TLS 1.2 / 1.3, the module uses JA3 fingerprint extraction technology to obtain the encryption suite, extended fields, and version information in the client's Hello message, forming a distinguishable session identifier.

[0024] The basic feature vector includes, but is not limited to, the following 32-dimensional parameters: source / destination IP address, source / destination port number, transport layer protocol type, session duration, total number of bytes, total number of packets, uplink / downlink byte ratio, average packet interval, standard deviation of packet interval, packet size entropy (Shannon entropy, calculated in the window of the most recent 100 packets), flow direction asymmetry, TLS handshake success flag, and HTTP status code distribution histogram; such as the top 5 most frequent codes and DNS query type distribution; all numerical features are Z-score normalized. The above numerical features are standardized by performing a scaling transformation on the original feature values ​​based on the statistical mean and standard deviation of the feature within the sliding time window. Classification features are vectorized by mapping them into 8-dimensional dense vectors through an embedding layer.

[0025] In this implementation, the context enhancement phase introduces external metadata, including an asset list synchronized from the CMDB (Configuration Management Database), containing IP-MAC binding relationships, the business system to which it belongs, security level labels, user role information obtained from the IAM (Identity and Access Management System), and a list of API endpoints pulled from the service registry. For example, if an IP address belongs to the financial database server and the current time is a weekday from 9:00 to 18:00, the frequency of access to the financial database during the characteristic working hours is generated; if a user belongs to the developer role, the call pattern of their internal CI / CD API is recorded to see if it deviates from the historical baseline; such contextual features are dynamically generated by the rule engine, and the rule base supports hot updates in YAML format without restarting the service. Finally, all features are concatenated into a 128-dimensional structured vector, which is then output to the anomaly detection engine in a pipeline manner through a double-buffered queue with a queue depth of 1024 to ensure no packet loss occurs at 10Gbps traffic.

[0026] The initial model deployment unit is activated upon system startup. This unit contains a dedicated secure storage chip with a pre-built transfer learning pedestal model embedded within. This model is trained by the central model factory based on cross-industry anonymized traffic samples. The training data covers 2.3PB of anonymized NetFlow and PCAP data from six major industries, including finance, manufacturing, healthcare, and education. After aggregation using a federated learning framework, a general representation is generated. The model structure is a fusion of a deep autoencoder and a multi-head attention mechanism, specifically including: The input embedding layer maps 128-dimensional features to a 256-dimensional latent space; a four-layer multi-head attention encoder with eight heads per layer and a head dimension of 32; a bottleneck compression layer outputs a 64-dimensional latent representation; and a three-layer fully connected decoder progressively reconstructs the 128-dimensional output. The training objective function is to minimize the mean squared error between the input features and the reconstructed output. The model is trained with the goal of minimizing the mean squared error between the input features and the reconstructed output features. It is understandable that the norm square of the input features and the reconstructed output features of each sample in the batch is calculated, and then the average value of all samples in the batch is taken. During the training process, this average value is minimized. The model weights are stored in encrypted form in the non-volatile storage area of ​​the TPM chip and are verified by SHA-384 hash through a hardware root of trust to ensure that they are not tampered with during the loading process. As mentioned earlier, when the system starts, the model is loaded into the Trusted Execution Environment (TEE) of the anomaly detection engine, specifically the Intel SGXenclave or ARM TrustZone security world, with memory isolation strength reaching the page level.

[0027] The anomaly detection engine runs on an edge computing server and enables the SGX2 instruction set. The engine is internally divided into two logical partitions: a general operating system partition and a trusted execution environment partition. Feature samples are passed to the TEE through the SGX enclavecall mechanism, where the lightweight inference engine is invoked and forward propagation is performed based on a customized ONNXRuntime.

[0028] The inference process outputs two key metrics: reconstruction error and anomaly score. The latter is obtained by mapping the bottleneck layer activation values ​​through a single-layer perceptron. This single-layer perceptron takes a 64-dimensional bottleneck representation as input and contains a set of learnable parameters, including a parameter vector matching the 64-dimensional bottleneck representation and a scalar parameter. The calculation results are transformed through the Sigmoid function to finally obtain the anomaly score. In the initial state, the above-mentioned learnable parameters are initialized with the parameter results that perform best on the validation set at the end of the base model training.

[0029] In this embodiment, the dynamic threshold determination unit maintains a normal flow statistical model within a sliding time window (default length is 24 hours); the model uses a Gaussian mixture model (GMM) to estimate the density of the abnormal score s, and the threshold value t is set to the quantile covering 99.5% of the normal samples; It should be noted that when a business cycle switch is detected (by monitoring a sudden change in the average traffic value using the CUSUM algorithm, with a change exceeding 3σ and lasting for more than 5 minutes), a threshold recalibration is triggered. That is, clear the current window, collect normal flow data again for 1 hour, fit a new GMM, and update. ; If the current sample's s is greater than t, a primary anomaly alarm event is generated. The event payload includes the original PCAP fragment (maximum 10 seconds), a 128-dimensional feature vector, the bottleneck layer activation value Z, the reconstruction error e, the timestamp, and the device ID. After being encrypted with AES-256-GCM, it is pushed to the feedback verification interface via gRPCoverTLS1.3.

[0030] In this implementation, the feedback verification interface is deployed on a separate security operations and maintenance terminal, employing a role-based access control (RBAC) model. Users must log in via two-factor authentication (FIDO2 security key + dynamic token), and permissions are synchronized by the LDAP directory service. The interface displays a visual summary of the alarm context, including traffic time-series graphs, protocol distribution pie charts, associated asset topology diagrams, and a list of historical similar alarms. Operations and maintenance personnel can perform three operations: If a real attack is confirmed, it is marked as a positive sample, a false positive, or a negative sample, or additional context is requested, triggering additional data collection, such as full packet capture or process monitoring logs. Understandably, each operation record generates a JSON format log entry, which includes the operation type, operator digital certificate serial number, timestamp, IP address, and operation reason, such as optional text. After being signed by ECDSA-P256, it is written into the distributed log ledger. It should be noted that the ledger is built on the Hyperledger Fabric consortium blockchain, with consensus nodes consisting of three physical servers. It uses Kafka sorting service, with a block generation interval of 2 seconds. The ledger data is persisted through LevelDB and supports efficient querying by time range, asset ID, or alarm ID.

[0031] In this implementation, the model evolution controller runs as a daemon on the general operating system partition of the edge server, polling the log ledger every 30 minutes; its workflow is as follows: First, manually verified samples from the past 24 hours are extracted from the ledger. Positive and negative sample pools are stored in in-memory hash tables, with the sample ID as the key and the complete feature vector and label as the value. Then, the maximum mean difference between the current online traffic feature distribution and the historical training distribution is calculated. As mentioned earlier, the calculation method of this index is as follows: by using the feature mapping in the regenerating kernel Hilbert space, a Gaussian radial basis function with a bandwidth parameter of 0.1 is selected as the kernel function. After mapping the current sample (number denoted as n) and the historical sample (number denoted as m) respectively, the difference between the mean values ​​of the two types of sample mapping results is taken, and the norm of the difference in the RKHS space is calculated. As mentioned earlier, if the MMD result corresponding to this norm is less than 0.05 (empirical threshold), the environment is considered stable and the process directly enters the fine-tuning stage. Otherwise, initiate the feature space alignment subroutine: deploy a lightweight domain discriminator (two-layer fully connected network) in the programmable logic array of the feature engineering module, implement adversarial training through the gradient inversion layer, and adjust the parameters of the feature extractor to make the feature distributions of the source domain and the target domain indistinguishable.

[0032] After alignment is complete, the controller calls the incremental learning algorithm to update the model; the update only applies to the decoder part after the bottleneck layer and the anomaly scoring mapping layer (i.e., the corresponding parameters), while the backbone encoder parameters are frozen to preserve generalization ability; It should be noted that the optimizer used is AdamW, the batch size is 32, and the initial learning rate is adaptively adjusted based on the drastic changes in the environment: the initial learning rate is calculated as 1 × 10⁻⁶. -4 As the base learning rate, combined with a decay factor of 10, it is adjusted exponentially based on the currently calculated MMD value; after 10 training iterations, stability verification is performed. As mentioned earlier, the new model was run on a test set of normal traffic replay from the most recent hour (approximately 500,000 samples) to calculate the false positive rate (FPR). Understandably, if FPR ≤ 0.5% (the allowable fluctuation range is the baseline value ± 0.1%), the new model weights will be encrypted and written to the TPM chip, and bound to the current hardware platform through SGX's sealing mechanism. Then, the anomaly detection engine will be notified to load the new version. Otherwise, the model will be rolled back to the previous stable model, and the reason for failure (such as FPR exceeding the limit or training divergence) will be recorded in the system log.

[0033] The security policy enforcement unit interfaces with the enterprise SOAR platform via a RESTful API. Typical platforms include Palo Alto Cortex X SOAR or IBM Resilient. When the anomaly detection engine confirms the alarm (i.e., it is still determined to be an anomaly after model evolution, or it is manually forcibly upgraded to a high-risk event), this unit constructs a standardized event object that conforms to the STIX2.1 specification, including the attack type, such as lateral movement, data leakage, affected assets, confidence score, and suggested response actions; The response actions are defined by a pre-defined playbook, such as blocking the IP address suspected of C2 communication via firewall (calling the Cisco Firepower API), rate limiting the abnormal API calls (calling the API gateway policy engine), or isolating the suspicious host to the honeypot VLAN (calling the SDN controller OpenFlow command); all API calls use two-way TLS 1.3 authentication, and the client certificate is issued by an internal CA and is valid for 7 days; The results of the handling, such as successful blocking or effective flow restriction, are synchronized to the feedback verification interface through a callback mechanism, serving as an auxiliary monitoring signal for subsequent model evolution.

[0034] In this embodiment, the overall system security is ensured by an independent security element chip; this chip integrates a true random number generator, an ECC encryption engine, and a secure key storage area; all cross-module communication, such as from the feature engineering module to the anomaly detection engine, uses a chip-derived session key for AES-128-GCM encryption, and key negotiation adopts the ECDH protocol. The hash value of each block header in the log ledger is periodically anchored to the chip's tamper-proof register, forming a hardware-level integrity certificate; In addition, the health monitoring agent continuously collects CPU utilization, memory usage, network I / O latency, and process crash counts for each module. If any indicator exceeds the threshold for 5 consecutive minutes (e.g., CPU > 90%, latency > 500ms), a safety circuit breaker is triggered. That is, shut down unnecessary services, switch to degraded mode (only perform simple rule-based filtering), and report to the centralized management platform via SNMPtrap.

[0035] In one example, this system is deployed in the data center of a large commercial bank. The network environment comprises 2,000 servers and 5,000 terminals, with an average daily traffic of 8TB. ​​During the first week of system deployment, the initial model, based on a general-purpose platform, generated 12,450 primary alerts. After manual review, 327 actual attacks were confirmed (mainly brute-force attacks and SQL injection attempts), resulting in a false positive rate of 97.4%. On the 8th day, the model evolution controller initiated its first fine-tuning, using 298 positive samples and 11,800 negative samples. After feature alignment (MMD=0.08>0.05, alignment was performed), incremental training was completed. During the second week of operation after the update, the number of primary alerts decreased to 3,210, 295 actual attacks were detected, and the false positive rate dropped to 89.1%. In the third week, due to the sudden change in traffic patterns caused by the launch of nighttime batch processing jobs, the dynamic threshold unit automatically recalibrated the threshold, avoiding large-scale false positives. By the end of the fourth week, the system had detected a total of 12 APT lateral movement behaviors, with an average detection latency of 4.7 minutes and a false positive rate that remained stable below 5.2%.

[0036] In another example, the system is deployed in a multi-tenant mode on a cloud security service provider platform, serving 37 small and medium-sized enterprise customers. Each tenant has an independent feature engineering instance, model copy, and log ledger, but shares the same base model. Tenant A (an e-commerce platform) contributed a large number of corrected samples for false positives regarding crawler traffic, while tenant B (a SaaS vendor) provided negative samples for legitimate API burst calls. The central model factory aggregates anonymized high-quality samples from each tenant monthly (after differential privacy perturbation, ϵ=1.0, ϵ=1.0) and retrains the base model. The new base model is pushed to edge nodes via a secure OTA mechanism. After receiving the update, tenant C (an online education company) saw its false positive rate for video conferencing traffic decrease from 18% to 6%.

[0037] To verify the technical effects of the present invention, the following comparative examples are provided: Comparative Example 1: A static isolated forest model was used, which had no online learning capability and whose features only included basic network layer parameters (without context enhancement). After running for four weeks in the same banking environment, a total of 28,600 alerts were generated, 210 real attacks were detected, and the false alarm rate was 99.3%. Furthermore, it could not adapt to nighttime batch processing traffic and generated a large number of periodic false alarms.

[0038] Comparative Example 2: An LSTM classifier trained using a general public dataset was deployed without any updates. In a cloud multi-tenant scenario, due to the huge difference between the training data and the actual business distribution, the false positive rate in the first week was as high as 92%, and it was completely ineffective against new encrypted C2 traffic.

[0039] Comparative Example 3: An autoencoder model with online learning capabilities but no feature space alignment mechanism; when business models are switched, such as after the full implementation of remote work, the source domain and target domain distributions are severely offset, and the model fine-tuning leads to catastrophic forgetting, the false alarm rate of normal traffic soars, and manual rollback is forced.

[0040] The table below summarizes the key performance indicators of the embodiments and comparative examples:

[0041] The above data shows that the present invention significantly improves the accuracy, adaptability and robustness of anomaly detection through the synergistic effect of mechanisms such as closed-loop feedback, context enhancement, dynamic threshold, feature alignment and stability constraints.

[0042] like Figure 2 As shown, furthermore, at the method implementation level, the system strictly follows these steps: The first step is for the data acquisition module to capture the raw traffic at a line speed of 10Gbps and attach a PTP timestamp. The second step involves the feature engineering module completing protocol parsing, 32-dimensional basic feature extraction, context rule matching, and normalization within 200 milliseconds, outputting a 128-dimensional vector. The third step involves loading the initial model from the TPM chip and activating it after integrity verification by SGXenclave. The fourth step involves the anomaly detection engine performing inference within the TEE, calculating the reconstruction error and anomaly score. The fifth step involves the dynamic threshold unit determining whether an alarm should be triggered based on the GMM quantiles and encapsulating the context for push notifications. Step 6: Authorized personnel review the alarms and write the results into the Fabric ledger; Step 7: The model evolution controller performs MMD evaluation, feature alignment (if necessary), incremental fine-tuning, and stability verification every 30 minutes. Step 8: The security policy execution unit calls the SOAR platform to execute the response and synchronize the results. The entire process, protected by both hardware security elements and a trusted execution environment, ensures the confidentiality, integrity, and availability of data and models.

[0043] In summary, this invention, by deeply integrating artificial intelligence, edge computing, blockchain, and hardware security technologies, constructs a highly accurate and adaptable network security anomaly detection system that can autonomously evolve. Its technical solution has been verified as effective in multiple real production environments and has significant engineering practical value.

[0044] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A computer network security anomaly detection system applying artificial intelligence, characterized in that, include: The system includes a data acquisition module, a feature engineering module, an initial model deployment unit, an anomaly detection engine, a feedback verification interface, a model evolution controller, and a security policy execution unit. The data acquisition module is deployed at key traffic nodes of the target network to capture raw network communication data packets in real time and attach a local timestamp to each data packet. The feature engineering module is connected to the data acquisition module and is used to perform protocol parsing on the raw data packets, extract basic feature vectors, and generate context-enhanced features by combining network topology metadata. After normalization, structured feature samples are formed. The initial model deployment unit is used to load a pre-set transfer learning base model during the system initialization phase. The transfer learning base model is an unsupervised neural network that integrates a deep autoencoder trained on cross-industry traffic samples with an attention mechanism, and completes integrity verification through a hardware root of trust. The anomaly detection engine integrates a trusted execution environment, which is used to perform forward inference on the structured feature samples on the transfer learning base model, output reconstruction error and anomaly score, and compare the anomaly score with the threshold value set by the dynamic threshold judgment unit. If the threshold value is exceeded, a primary anomaly alarm event is generated and pushed to the feedback verification interface. The feedback verification interface is used to receive review instructions and write the review results along with auxiliary context information into the distributed log ledger. The model evolution controller reads the log ledger, extracts confirmed real attack samples and false positive samples, performs feature space alignment and incremental fine-tuning, and after passing stability verification, deploys the updated transfer learning base model to the anomaly detection engine. The security policy execution unit is connected to an external security orchestration, automation and response platform to receive final confirmation alarms and execute preset response actions, while synchronizing the handling results back to the feedback verification interface.

2. The computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, The dynamic threshold determination unit maintains a statistical model of normal traffic characteristics within a sliding time window and dynamically adjusts the threshold value based on business cycle switching, asset sensitivity level, or historical alarm density; when a sudden change in business mode is detected, the current sliding time window is cleared and the threshold benchmark is recalibrated.

3. The computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, The feature engineering module adopts a heterogeneous computing architecture, which includes a programmable logic array and a dedicated instruction set processor. It has the ability to extract protocol feature identification information of encrypted communication traffic and dynamically generate context enhancement features based on metadata provided by the configuration management database, identity and access management system and service registration center.

4. The computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, Before performing incremental fine-tuning, the model evolution controller calculates the maximum mean difference between the current online traffic feature distribution and the historical training distribution. If the maximum mean difference metric is higher than the preset convergence criterion, the feature space alignment subroutine is triggered first. The feature extractor parameters are adjusted through the adversarial domain adaptation mechanism to make the feature distributions of the source domain and the target domain more consistent.

5. A computer network security anomaly detection system applying artificial intelligence according to claim 4, characterized in that, The incremental fine-tuning only applies to the decoder part after the bottleneck compression layer and the anomaly scoring mapping layer of the transfer learning base model, while the backbone encoder parameters remain frozen. The update process uses mini-batch gradient descent with an adaptive learning rate, and after each update, the false alarm rate is verified on the test set of normal traffic replay in the most recent hour. If it exceeds the allowable fluctuation range, it is rolled back to the previous stable version.

6. A computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, The feedback verification interface adopts a role-based access control mechanism. The review operation includes confirming it as a real attack, marking it as a false alarm, or requesting supplementary context. Each review record is accompanied by a digital signature and timestamp and written to a distributed log ledger built on a consortium blockchain.

7. A computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, The security policy execution unit interfaces with an external security orchestration, automation and response platform. All instruction transmissions are encrypted and accompanied by two-way certificate authentication. Response actions include blocking, rate limiting, isolation or evidence collection, and the handling results are used as auxiliary monitoring signals to be synchronously transmitted back to the feedback verification interface.

8. A computer network security anomaly detection system applying artificial intelligence according to claim 1, characterized in that, The system supports multi-tenant isolated deployment. Each tenant has an independent feature engineering instance, model copy, and log ledger, while sharing the same transfer learning base model provided by the central model factory. The central model factory aggregates anonymized high-quality correction samples contributed by each tenant, iteratively optimizes the next generation base model, and pushes it to each edge node through a secure OTA mechanism.

9. A computer network security anomaly detection method using artificial intelligence, applicable to the implementation of a computer network security anomaly detection system using artificial intelligence as described in any one of claims 1 to 8, characterized in that, Includes the following steps: S1: The raw network communication data packets are captured in real time and timestamps are appended via the data acquisition module; S2: In the feature engineering module, protocol parsing, basic feature extraction, context enhancement, and normalization are performed to generate feature samples; S3: Load a pre-built transfer learning pedestal model from a read-only secure storage chip and verify its integrity through a hardware root of trust; S4: In the trusted execution environment of the anomaly detection engine, the transfer learning base model is invoked to perform forward inference on the feature samples, and the reconstruction error and anomaly score are calculated. S5: Compare the anomaly score with the threshold value set by the dynamic threshold determination unit. If the threshold is exceeded, generate a primary anomaly alarm and push it to the feedback verification interface. S6: Perform deterministic review of primary alarms and write the review results to the distributed log ledger; S7: The model evolution controller periodically reads the log ledger, extracts confirmed samples, performs feature space alignment and incremental fine-tuning, and deploys the updated transfer learning base model after passing stability verification. S8: The security policy execution unit receives the final confirmation alarm, calls the external security orchestration platform to execute the response action, and synchronously sends the handling result back to the feedback verification interface.

10. A computer network security anomaly detection method applying artificial intelligence according to claim 9, characterized in that, In S7, the feature space alignment is achieved through adversarial training by introducing a gradient reversal layer and a lightweight domain discriminator after the feature extractor, in order to minimize the maximum mean difference between the source and target domains in the regenerating kernel Hilbert space.

Images