A communication security early warning method and system based on artificial intelligence

Abstract

The embodiment of the application relates to the field of communication security, and provides a communication security early warning method and system based on artificial intelligence, which comprises the following steps: acquiring original communication data of each communication entity in a communication network; performing multi-granularity splitting and feature extraction on the original communication data, performing multi-dimensional fusion on an association feature vector and a protocol behavior semantic vector, and constructing a multi-source security representation of a target communication entity; performing trend analysis and adaptive threshold learning on the multi-source security representation in a plurality of continuous time periods, and generating a dynamic security threshold; performing cross-period time sequence association and abnormal mode inference on the multi-source security representation of the current time period and the corresponding dynamic security threshold, and generating a preliminary risk score; and when the preliminary risk score meets an early warning triggering condition, outputting security early warning information to a security management platform and / or a communication network protection device. The application can early warn low-frequency and hidden security risks, and improve the accuracy and timeliness of communication security early warning.

Description

Technical Field

[0001] This application relates to the field of communication security, and more specifically to a communication security early warning method and system based on artificial intelligence. Background Technology

[0002] With the continuous expansion of communication networks and the increasing sophistication and covertness of cyberattacks, communication security has become a core prerequisite for ensuring the integrity, confidentiality, and availability of information transmission. As a crucial upstream component of the communication security protection system, the technological level of communication security early warning directly determines the communication network's ability to resist new security threats. Currently, the mainstream technologies in the field of communication security early warning mainly include the following three categories: One is rule-based intrusion detection systems (such as the Snort system). Rule-based early warning technologies rely on manually built and updated attack signature databases. When faced with zero-day attacks, attack variants, and hidden threats in encrypted traffic, the early warning capabilities are limited because the signature database is outdated and cannot cover unknown attack patterns.

[0003] The second approach is based on traditional machine learning algorithms (such as support vector machines and random forests) for traffic anomaly analysis. While this method can mine anomaly patterns from historical data, it heavily relies on manual feature engineering and struggles to handle the high-dimensional, unstructured temporal features in raw communication data. This results in weak generalization ability of the early warning model and high false alarm and false negative rates.

[0004] Third, the traffic monitoring mechanism based on statistical thresholds primarily judges traffic anomalies based on preset fixed traffic thresholds. On the one hand, preset thresholds lack dynamic adaptability and cannot be optimized in real time according to fluctuations in communication network traffic (such as traffic differences between peak and off-peak hours), network topology adjustments, and changes in service types. False alarms are easily generated when normal service traffic approaches or exceeds the preset threshold, while false alarms occur when attack traffic does not reach the preset threshold (such as low-frequency, small-scale covert attacks). On the other hand, this mechanism only focuses on a single statistical indicator of traffic, without considering key information such as the temporal correlation of communication traffic and protocol interaction characteristics. Its detection dimension is singular, making it difficult to identify covert attacks (such as low-frequency probing behavior of advanced persistent threats) where traffic statistics are normal but interaction patterns are abnormal.

[0005] In conclusion, there is an urgent need for a completely new technical solution to address at least one technical problem existing in the current technology. Summary of the Invention

[0006] This application provides an artificial intelligence-based communication security early warning method and system, which can realize dynamic perception and anomaly identification of communication behavior, provide early warning of low-frequency and hidden security risks, and further improve the accuracy and timeliness of communication security early warning.

[0007] In a first aspect, embodiments of this application provide a communication security early warning method based on artificial intelligence, the method comprising: To obtain the raw communication data of each communication entity in the communication network; The original communication data is split into multiple granularities and features are extracted to obtain correlation feature vectors for cross-window time series analysis and protocol behavior semantic vectors for communication semantic modeling. The correlation feature vector and the protocol behavior semantic vector are fused in multiple dimensions to construct a multi-source security representation of the target communication entity; Trend analysis is performed on the multi-source security representation over multiple consecutive time periods, and adaptive threshold learning is performed on the changes in communication network service load, historical behavior patterns of entities, and global risk fluctuations obtained from the analysis to generate dynamic security thresholds that are dynamically updated with time periods. By performing cross-period time-series correlation and anomaly pattern inference between the multi-source security representations of the current time period and the corresponding dynamic security thresholds, a preliminary risk score for anomaly events is generated. When the preliminary risk score meets the early warning triggering conditions, the security early warning information associated with the abnormal event is output to the security management platform and / or communication network protection equipment to achieve early warning of communication security threats.

[0008] Secondly, embodiments of this application provide an artificial intelligence-based communication security early warning system, which has the function of implementing the artificial intelligence-based communication security early warning method provided in the first aspect above. The function can be implemented by hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above function, and the modules can be software and / or hardware.

[0009] In one embodiment, the AI-based communication security early warning system includes: The input / output module is configured to acquire raw communication data from various communication entities in the communication network. The processing module is configured to perform multi-granularity splitting and feature extraction on the original communication data to obtain a multi-source security representation of the target communication entity; perform trend analysis on the multi-source security representation over multiple consecutive time periods, and perform adaptive threshold learning on the analyzed communication network service load changes, entity historical behavior patterns, and global risk fluctuations to generate a dynamic security threshold that is dynamically updated over time periods; and perform cross-period time-series correlation and anomaly pattern inference on the multi-source security representation of the current time period and the corresponding dynamic security threshold to generate a preliminary risk score for the abnormal event. The input / output module is also configured to output security warning information associated with the abnormal event to the security management platform and / or communication network protection equipment when the preliminary risk score meets the warning triggering conditions, so as to realize early warning of communication security threats.

[0010] Thirdly, embodiments of this application provide a computer-readable storage medium including instructions that, when executed on a computer, cause the computer to perform the artificial intelligence-based communication security early warning method as described in the first aspect.

[0011] Fourthly, embodiments of this application provide a computing device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the artificial intelligence-based communication security early warning method described in the first aspect.

[0012] Fifthly, embodiments of this application provide a computer program product containing instructions that, when run on a computer, cause the computer to execute the artificial intelligence-based communication security early warning method provided in the first aspect.

[0013] Compared to existing technologies, in this embodiment, the original communication data of each communication entity in the communication network is acquired; the original communication data is split into multiple granularities and features are extracted to obtain a multi-source security representation of the target communication entity; trend analysis is performed on the multi-source security representation over multiple consecutive time periods, and adaptive threshold learning is performed on the analyzed communication network service load changes, entity historical behavior patterns, and global risk fluctuations to generate a dynamic security threshold that is dynamically updated with time periods; the multi-source security representation of the current time period is correlated with the corresponding dynamic security threshold across periods and anomaly pattern inference is performed to generate a preliminary risk score for anomaly events; when the preliminary risk score meets the early warning triggering conditions, the security early warning information associated with the anomaly event is output to the security management platform and / or communication network protection equipment to achieve early warning of communication security threats.

[0014] In this embodiment, communication data is jointly modeled, and an adaptive threshold learning mechanism based on multi-time-period trend analysis is introduced to achieve dynamic perception and anomaly identification of communication behavior. Since this embodiment is based on cross-period time-series correlation inference using multi-source security representations and dynamic security thresholds, rather than relying on fixed thresholds, single statistical indicators, or static models for anomaly judgment as in existing technologies, it can effectively adapt to fluctuations in communication network service load and changes in communication behavior patterns, reducing false alarms caused by peak service times or normal traffic fluctuations. It is evident that this embodiment, through the synergistic effect of multi-dimensional feature fusion and dynamic threshold self-learning, enables the anomaly detection process to adaptively adjust over time. Furthermore, the dynamic security threshold of this embodiment can be continuously updated based on historical behavior patterns and the global risk situation. Therefore, the anomaly risk score obtained by this embodiment more closely matches the security status in a real communication environment, enabling early warning of low-frequency and hidden security risks, further improving the accuracy and timeliness of communication security early warning. Attached Figure Description

[0015] Figure 1 This is a schematic diagram illustrating a scenario of the AI-based communication security early warning method in this application embodiment; Figure 2 This is a flowchart illustrating the communication security early warning method based on artificial intelligence, as described in an embodiment of this application. Figure 3 This is a schematic diagram of the structure of an artificial intelligence-based communication security early warning system according to an embodiment of this application. Detailed Implementation

[0016] This application provides an artificial intelligence-based communication security early warning method and system, which can be applied to communication security protection scenarios that require security monitoring, risk assessment and anomaly early warning of communication behavior in communication networks, such as communication security early warning systems in scenarios such as operator communication networks, enterprise private networks, cloud computing data center networks or Internet of Things communication networks.

[0017] The communication security early warning system may include a communication data acquisition device, a communication behavior analysis device, and a security early warning output device. These devices may be integrated into the same computing device or distributed across different network nodes.

[0018] The communication data acquisition device is used to acquire raw communication data of each communication entity from the communication network; the communication behavior analysis device is used to perform multi-granularity splitting, feature extraction, fusion modeling and anomaly inference on the acquired raw communication data; and the security early warning output device is used to output the corresponding security early warning information to the security management platform and / or communication network protection equipment when a communication security risk is detected.

[0019] The solutions provided in this application involve technologies such as artificial intelligence, communication data analysis, time series modeling, and anomaly detection. The technical solutions of this application will be described in detail below with reference to specific embodiments.

[0020] In existing technologies, communication security early warnings are typically based on fixed thresholds or single traffic statistics to determine communication anomalies. These thresholds rely on human experience and are ill-suited to adapt to the dynamic changes in communication network load. Furthermore, existing technologies often focus on traffic characteristic analysis within a single time window, failing to fully explore the temporal correlations and protocol interaction semantics of communication behavior across multiple time periods. This makes them prone to missed or false alarms when facing low-frequency, covert attacks.

[0021] Compared to existing technologies, in this embodiment, the original communication data of each communication entity in the communication network is obtained, and the original communication data is split into multiple granularities and features are extracted to obtain correlation feature vectors for cross-window time series analysis and protocol behavior semantic vectors for communication semantic modeling. Furthermore, the correlation feature vectors and the protocol behavior semantic vectors are fused in multiple dimensions to construct a multi-source security representation that can comprehensively reflect the behavioral characteristics of communication entities.

[0022] Based on this, the embodiments of this application perform trend analysis on the multi-source security characterization over multiple consecutive time periods, and combine the changes in communication network service load, the historical behavior patterns of communication entities, and global risk fluctuations to perform adaptive threshold learning, thereby generating a dynamic security threshold that is dynamically updated with the time period, thus avoiding misjudgment problems caused by fixed thresholds.

[0023] Furthermore, in this embodiment, the multi-source security representation of the current time period is correlated with the corresponding dynamic security threshold across time periods and anomaly pattern inference is performed to generate a preliminary risk score for the abnormal event. When the preliminary risk score meets the warning triggering conditions, the security warning information associated with the abnormal event is output to the security management platform and / or communication network protection equipment to achieve early warning of communication security threats, thereby improving the accuracy and timeliness of communication security warnings.

[0024] In some implementations, the aforementioned communication security early warning system is implemented using a distributed deployment approach. (Refer to...) Figure 1 The communication security early warning system may include server 01 and terminal device 02.

[0025] Among them, server 01 can be used as a communication behavior analysis device to deploy a communication data preprocessing module, a feature extraction module, a multi-dimensional fusion module, an adaptive threshold learning module, and an anomaly inference module.

[0026] Terminal device 02 can be used as a communication data acquisition device and / or a security warning output device to collect communication data and receive security warning information output by server 01.

[0027] Server 01 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server providing cloud computing, cloud storage, cloud communication, and artificial intelligence computing capabilities. Terminal device 02 can be a network switching device, gateway device, security probe device, or a network terminal device with communication data acquisition capabilities, used to upload communication data to server 01 or receive security alert results.

[0028] Through the above technical solutions, the embodiments of this application can dynamically perceive and provide early warning of communication security risks in complex and ever-changing communication network environments, thereby ensuring communication security.

[0029] Reference Figure 2 , Figure 2 This is a flowchart illustrating an artificial intelligence-based communication security early warning method provided in an embodiment of this application. The method includes steps 101-105: Step 101: Obtain the original communication data of each communication entity in the communication network.

[0030] In step 101, the communication security early warning system can obtain the original communication data of each communication entity through data acquisition nodes deployed in the communication network.

[0031] Optionally, communication entities may include network terminal devices, servers, network nodes, or communication session objects. Communication entities refer to various subjects and interaction carriers participating in data interaction and information transmission in a communication network. They are the producers, transmitters, or receivers of original communication data, and their behavioral characteristics directly reflect the operational status of the communication network. They are also the core monitoring objects for communication security early warning. Specifically, network terminal devices may include computers, smartphones, IoT terminals, etc.; servers may include application servers, database servers, etc.; network nodes may include network forwarding devices such as routers and switches; and communication session objects may include temporary data interaction links established between two or more communication entities and the interaction process itself.

[0032] Optionally, the raw communication data includes traffic metrics, protocol fields, interaction sequences, and statistical characteristics of encrypted messages. Traffic metrics may include data packet length, arrival time, session duration, and data transmission rate; protocol fields may include protocol type, port information, and connection status identifiers; interaction sequences may include the order of data interaction and command interaction between communication entities; and statistical characteristics of encrypted messages may include encrypted message length distribution, encryption algorithm identifier, and encryption interaction frequency. This raw communication data provides comprehensive foundational data support for subsequent multi-granularity segmentation and feature extraction.

[0033] In some implementations, the raw communication data may include, but is not limited to, communication traffic data, communication protocol field information, communication interaction sequence information, and communication timing information, such as data packet length, arrival time, session duration, protocol type, port information, and connection status changes.

[0034] By continuously collecting communication behavior data in the communication network, we can provide basic data support for subsequent communication behavior analysis.

[0035] Step 102: Perform multi-granularity splitting and feature extraction on the original communication data to obtain a multi-source security representation of the target communication entity.

[0036] In step 102, the raw communication data obtained in step 101 can be processed by multi-granularity splitting.

[0037] Further optionally, the multi-granularity splitting may include splitting methods based on packet level, stream level, and session level to obtain communication behavior characteristics at different time scales.

[0038] In some implementations, step 102 involves multi-granularity splitting and feature extraction of the original communication data to obtain a correlation feature vector for cross-window time-series analysis and a protocol behavior semantic vector for communication semantic modeling. Subsequently, the correlation feature vector and the protocol behavior semantic vector are fused in multiple dimensions to obtain a multi-source security representation of the target communication entity.

[0039] Among them, the correlation feature vector is used to represent the changing trends and correlations of communication behavior within multiple time windows. For example, the periodic changes in communication frequency, the fluctuation pattern of data packet size over time, and the similarity of communication behavior within different time windows.

[0040] Protocol behavior semantic vectors are used to characterize the sequence of protocol interactions and behavioral patterns during communication. Examples include protocol field combinations, request and response order, and abnormal protocol call behavior.

[0041] Multi-source security representation of a target communication entity is a vectorized representation used to comprehensively describe the security characteristics of the target communication entity's communication behavior across multiple time scales, communication layers, and behavioral dimensions. Multi-source security representation integrates at least the temporal variation characteristics of communication behavior and protocol interaction semantic features to represent the overall security state of the communication entity.

[0042] Optionally, when extracting the correlation feature vector and protocol behavior semantic vector, the original communication data is first split into packet-level, flow-level, and session-level segments to obtain a first feature segment adapted for cross-window timing analysis and a second feature segment adapted for communication semantic modeling. Packet-level splitting is used to extract the instantaneous features of a single data packet, flow-level splitting is used to extract the correlation features of consecutive data packets within the same session, and session-level splitting is used to extract the interaction features between different communication sessions.

[0043] For example, in packet-level segmentation, instantaneous features such as packet length and arrival time interval can be extracted. In flow-level segmentation, correlation features such as changes in the number of packets and transmission rate within the same session can be extracted. In session-level segmentation, interaction features such as establishment frequency, duration distribution, and protocol combination relationships between different sessions can be extracted.

[0044] Furthermore, when processing the first feature segment, cross-window temporal feature extraction is performed on the first feature segment to obtain the correlation feature vector. Specifically, temporal correlation features within multiple consecutive time windows are extracted, normalized, and dimensionality reduced, and then concatenated to form a correlation feature vector for cross-window temporal analysis.

[0045] When processing the second feature fragment, protocol fields are filtered based on the protocol type, retaining valid protocol fields related to communication semantics and removing redundant fields. Subsequently, the valid protocol fields and interaction logic are semantically encoded to obtain the protocol behavior semantic vector.

[0046] It is worth noting that when processing the second feature fragment, the protocol fields in the second feature fragment are filtered based on the protocol type corresponding to the communication data. Valid protocol fields related to communication semantics are retained, while redundant fields with low contribution to the semantics of communication behavior are removed, thereby reducing the complexity of semantic modeling and improving the accuracy of semantic representation.

[0047] For example, when the communication data corresponds to the TCP / IP protocol, fields such as source port number, destination port number, sequence number, acknowledgment number, flag bits, and window size can be retained as valid protocol fields, while fields with little impact on the semantics of communication behavior, such as checksums, can be discarded as redundant fields. By analyzing the combination relationships and changes of the above-mentioned valid protocol fields, the behavioral characteristics during the establishment of communication connections, data transmission, and connection release processes can be reflected.

[0048] For example, when the communication data corresponds to the HTTP protocol, fields such as request method, request path, host field, status code, and request-response order can be retained as valid protocol fields, while fields with low semantic relevance to the communication can be removed. By analyzing the correspondence between request methods and status codes, as well as the temporal interaction logic between requests and responses, the access behavior patterns of communication entities at the application layer can be characterized.

[0049] Furthermore, when the communication data corresponds to the DNS protocol, fields such as query type, query domain name, response code, and number of requests and responses can be retained to characterize the domain name resolution behavior of the communicating entity. Abnormal query frequency or abnormal domain name access patterns can be represented by semantic combinations of the aforementioned valid protocol fields.

[0050] After the protocol fields are filtered, semantic encoding processing can be performed on the valid protocol fields and their interaction logic. Specifically, the valid protocol fields can be encoded according to their order of appearance, combination relationship, and interaction mode in the communication process, converting discrete protocol field information into continuous vector representations, thereby obtaining protocol behavior semantic vectors used to characterize the semantic features of communication behavior.

[0051] For example, during semantic encoding, a protocol interaction sequence can be constructed based on the frequency and order of occurrence of protocol fields in different communication stages, and this sequence can be mapped to a corresponding vector representation. Thus, the protocol behavior semantic vector can reflect not only the information of a single protocol field, but also the temporal relationship and interaction logic between protocol fields.

[0052] By using the above-mentioned protocol field filtering and semantic encoding methods, we can reduce data redundancy and more accurately characterize the semantic features of communication behavior, providing effective semantic input for subsequent multi-source security representation construction and anomaly pattern inference.

[0053] Optionally, in the step of multidimensionally fusing the correlation feature vector and the protocol behavior semantic vector to obtain a multi-source security representation of the target communication entity, a cross-dimensional feature map is constructed using a graph attention mechanism. Then, the correlation feature vector, the protocol behavior semantic vector, and the historical behavior embedding vector of the target communication entity are uniformly mapped to the cross-dimensional feature map. Finally, graph convolution operations are performed on the cross-dimensional feature map to enhance the correlation between features of different dimensions, and the resulting fusion yields a multi-source security representation of the target communication entity.

[0054] It is worth noting that after mapping the correlation feature vector, the protocol behavior semantic vector, and the historical behavior embedding vector of the target communication entity to the cross-dimensional feature map, graph convolution operation can be performed on the cross-dimensional feature map to achieve information interaction and fusion between features of different dimensions.

[0055] Specifically, the nodes in the cross-dimensional feature graph represent communication features of different dimensions, and the edges between nodes represent the relationships between different feature dimensions. By performing graph convolution on the cross-dimensional feature graph, the interrelated feature information can be propagated and aggregated in the graph structure while preserving the original semantic information of each feature dimension, thereby enhancing the expressive ability of the relationships between features of different dimensions. In some embodiments, the graph convolution operation includes: based on the connection relationships between nodes in the cross-dimensional feature graph, weighted aggregation of the feature information of each feature node and the feature information of its neighboring nodes, and using the aggregated result as the updated feature representation of that feature node. By iterating the weighted aggregation process multiple times, each feature node can gradually integrate communication behavior information from different dimensions.

[0056] Furthermore, during graph convolution operations, the information transmission weights between nodes can be adaptively adjusted based on the importance of different feature nodes in communication security analysis. This allows feature dimensions that contribute significantly to communication anomaly identification to receive higher weights during the fusion process, thereby highlighting key communication behavior features. Through the aforementioned graph convolution operations, communication features of different dimensions can be deeply fused in the cross-dimensional feature graph, and the final fusion result is the multi-source security representation of the target communication entity.

[0057] The multi-source security representation can simultaneously reflect the temporal variation characteristics of communication behavior, the semantic characteristics of protocol interaction, and the characteristics of historical behavior, thereby providing a more accurate and stable input basis for subsequent dynamic threshold learning and abnormal pattern inference.

[0058] Through the above multi-dimensional fusion method, the multi-source security representation can simultaneously include the time-varying features of communication behavior, the semantic features of protocol interaction, and the features of historical behavior, thereby providing a more accurate input representation for subsequent dynamic threshold learning and abnormal pattern inference.

[0059] Step 103: Perform trend analysis on the multi-source security representation over multiple consecutive time periods, and perform adaptive threshold learning on the analyzed communication network service load changes, entity historical behavior patterns and global risk fluctuations to generate dynamic security thresholds that are dynamically updated with time periods.

[0060] In step 103, the communication behavior analysis device can perform trend analysis on the multi-source security characterization of the target communication entity over multiple consecutive time periods.

[0061] The trend analysis can be used to identify patterns of change in communication network service load, historical behavior patterns of communication entities, and changes in global communication security risks.

[0062] As an optional embodiment, trend analysis is performed on the multi-source security representation over multiple consecutive time periods, including: performing time-series alignment on the multi-source security representations of the target communication entity collected over multiple consecutive time periods to remove abnormal noise in the representation data; normalizing the aligned representation data to obtain a standardized time-series representation sequence; using a sliding window of a preset length, sequentially performing sliding sampling on the standardized time-series representation sequence to extract the time-series change features of the multi-source security representation within each sliding window, wherein the time-series change features include the representation fluctuation amplitude, change rate, and trend inflection point; and performing correlation analysis based on the time-series change features to obtain changes in communication network service load, entity historical behavior patterns, and global risk fluctuations.

[0063] For example, when performing trend analysis on the multi-source security representation over multiple consecutive time periods, a fixed time interval (e.g., 5 minutes, 10 minutes, or 30 minutes) can be used as the time period to align the multi-source security representations formed by the target communication entity in each time period. Further optionally, to ensure the timeliness of the warning, the time interval can be set according to the actual situation in the operating scenario, such as the network status, network type, number of communication devices, and time period. Further optionally, the time interval can also be dynamically adjusted.

[0064] For example, in the aligned and standardized time-series representation sequence, it can be identified that the overall value of the multi-source security representation of a certain communication entity increases during peak business hours and decreases during off-peak business hours. By analyzing the fluctuation amplitude and rate of change of the representation sequence, the changes in the service load of the communication network in different time periods can be identified.

[0065] Furthermore, by comparing and analyzing the multi-source security representations of the same communication entity over different time periods, the stable intervals and abnormal offset intervals of the communication entity's historical behavior patterns can be identified.

[0066] For example, when the changes in the multi-source security representation of a communication entity remain within a preset range over multiple consecutive time periods, its communication behavior can be determined to be within a historical normal behavior pattern. When its multi-source security representation shows a significant shift or trend inflection point within a short period of time, its communication behavior can be considered to have undergone abnormal changes.

[0067] Furthermore, by aggregating and analyzing the multi-source security representations of multiple communication entities, changes in global communication security risks can be identified. For example, when multiple communication entities simultaneously show an increase in representation values ​​or greater fluctuations within a similar time period, it can be determined that the overall risk level of the current communication network has increased.

[0068] Based on this, and combined with the trend analysis results above, adaptive threshold learning can be performed in step 103. This dynamically adjusts the security threshold according to the communication behavior characteristics within different time periods, thereby generating a dynamically updated security threshold that changes over time. This avoids the misjudgment problem caused by using a fixed threshold, allowing the threshold to better adapt to the dynamic changes in the communication network.

[0069] As an optional embodiment, adaptive threshold learning is performed on the analyzed communication network service load changes, entity historical behavior patterns, and global risk fluctuations to generate a dynamic security threshold that is dynamically updated over time. This includes: initializing a baseline security threshold for the target communication entity, which is calibrated based on the entity's historical normal behavior patterns and the network's normal service load; assigning corresponding influence weights to each item based on the fluctuation range of communication network service load changes, the deviation of the entity's historical behavior patterns, and the warning level of global risk fluctuations, with the influence weights dynamically adjusted over time; and inputting the communication network service load change data, entity historical behavior pattern data, and global risk fluctuation data obtained from each time period into the adaptive threshold learning model for online reinforcement learning, adapting to peak and trough fluctuations in service load, entity behavior iterations, and changes in global risk levels, generating a dynamic security threshold corresponding to the current time period, and synchronously updating it to the threshold learning baseline for the next time period.

[0070] For example, when performing adaptive threshold learning, a baseline security threshold can first be initialized based on the historical normal communication behavior of the target communication entity. This baseline security threshold can be obtained by analyzing the statistical distribution of historical multi-source security representations; for example, the upper limit of the historical normal behavior range can be used as the initial threshold.

[0071] Subsequently, within each time period, dynamic influence weights are assigned to the above three types of factors based on the fluctuation range of communication network service load changes, the degree of deviation of historical behavior patterns of communication entities, and the warning level corresponding to global risk fluctuations. For example, during peak service periods, the weight corresponding to service load changes can be appropriately reduced to avoid false alarms triggered by normal traffic increases. When the global risk level is high, the weight corresponding to global risk fluctuations can be increased to make the security threshold more sensitive.

[0072] Based on this, the communication network service load change data, entity historical behavior pattern data and global risk fluctuation data obtained from the current time period analysis can be input into the adaptive threshold learning model. Through online reinforcement learning, the security threshold of the current time period can be updated, and the updated security threshold can be used as the learning benchmark for the next time period.

[0073] This allows the generated dynamic security threshold to be continuously adjusted over time, thus better adapting to changes in the operating state of the communication network.

[0074] For example, in the above optional embodiments, the adaptive threshold learning model can be based on a reinforcement learning framework. It uses the dynamically changing operating state of the communication network as environmental feedback and continuously iterates to optimize the security threshold, ensuring that the threshold always aligns with fluctuations in business load, evolution of entity behavior, and the overall risk situation, thus avoiding the rigidity of fixed thresholds. The core logic of the adaptive threshold learning model is to treat threshold adjustment as an action choice in reinforcement learning, with the goal of reducing false positives and false negatives. It uses changes in business load, deviations in entity behavior, and the overall risk level as state inputs, and continuously optimizes the threshold update strategy through online learning.

[0075] For example, the adaptive threshold learning model is constructed using Temporal Differential Reinforcement Learning (TD Learning). Taking an enterprise office network scenario as an example (this scenario has business peaks from 9:00 AM to 11:00 AM and 3:00 PM to 5:00 PM on weekdays, and occasional abnormal access behavior from employees working remotely), the workflow of the adaptive threshold learning model is as follows: Based on normal office communication data from the past 30 days (no attacks, no abnormal access), the statistical distribution of multi-source security representations was calculated, and the 95th percentile was taken as the baseline security threshold T0=80 (assuming the multi-source security representation value range is 0-100). At 9 AM on Monday (peak business time), the state vector S1 = [L=0.3 (traffic 30% higher than historical average), D=0.8 (behavior similarity to historical normal pattern 80%), R=1 (global low risk)]. The adaptive threshold learning model, calculated using the Q function, selects action A=+10% (threshold adjusted to T1=80×1.1=88), which yields the highest reward R (avoiding false alarms triggered by normal peak traffic). Therefore, the adjustment is executed to adapt the threshold to the peak load. On Wednesday afternoon, an employee remotely accessed the system via a different IP address (deviation of entity behavior), and the state vector S2 = [L=0.1 (normal traffic), D=0.3 (behavioral similarity only 30%), R=2 (global medium risk)]. The model calculates action A = -8% (threshold adjusted to T2 = 88 × 0.92 ≈ 81). At this point, the employee's abnormal communication behavior corresponds to a multi-source security representation of 83, exceeding the threshold T2, triggering an alert. Simultaneously, no other normal office behavior is falsely reported, resulting in a positive reward R = +10. On Friday morning, network monitoring detects external scanning behavior (global high risk), with state vector S3 = [L = 0.2 (normal traffic), D = 0.7 (behavioral similarity 70%), R = 3 (global high risk)]. The adaptive threshold learning model selects action A = -12% (threshold adjusted to T3 = 81 × 0.88 ≈ 71) to make the threshold more sensitive, successfully capturing a low-frequency probing attack (representation value 75), avoiding false negatives, and receiving a reward R = +10. Subsequent attacks cease, and the state reverts to S = [0.1, 0.9, 1]. The adaptive threshold learning model gradually adjusts the threshold back to T4 = 76, maintaining a balanced state. The threshold learned through the adaptive threshold learning model is no longer a static value, but a dynamic security threshold that evolves with the network state. It automatically raises the threshold during peak traffic to avoid false alarms, and automatically lowers it during abnormal behavior or high-risk situations to improve detection sensitivity, perfectly adapting to complex and ever-changing communication network environments.

[0076] Step 104: Perform cross-period time-series correlation and anomaly pattern inference between the multi-source security representation of the current time period and the corresponding dynamic security threshold to generate a preliminary risk score for the abnormal event.

[0077] In step 104, the communication behavior analysis device can compare and analyze the multi-source security characterization obtained within the current time period with the dynamic security threshold generated in step 103. Through cross-period temporal correlation analysis, it jointly models the changes in communication behavior within different time periods and identifies potential abnormal communication behaviors based on anomaly pattern inference.

[0078] In some implementations, a preliminary risk score for the abnormal event can be generated based on the degree to which the communication behavior deviates from the normal behavior pattern, in order to quantify the security risk level of the communication behavior.

[0079] As an optional embodiment, in step 104, the following steps are taken: First, obtain the multi-source security representations and corresponding dynamic security thresholds for a previous preset number of time periods. Second, calculate the temporal correlation between the multi-source security representations of the current time period and those of the previous preset number of time periods. Third, calculate the deviation between the dynamic security thresholds of the current time period and those of the previous preset number of time periods. Fourth, based on the temporal correlation and the deviation, and in conjunction with preset anomaly determination rules, infer whether the behavioral pattern corresponding to the current multi-source security representation is an anomalous pattern. Fifth, perform a weighted scoring on the anomalous event based on the inference results to generate a preliminary risk score for the anomalous event, wherein the preliminary risk score is positively correlated with the risk level of the anomalous event.

[0080] For example, in step 104, multi-source security representations and corresponding dynamic security thresholds for the current time period and the previous preset number of time periods (e.g., the first 3 or the first 5 time periods) can be obtained to construct a cross-period time series dataset.

[0081] When performing correlation analysis on cross-period time-series datasets, the similarity change between the multi-source security representations of the current time period and the multi-source security representations of the previous preset number of time periods can be calculated. This is used to measure the continuity and consistency of communication behavior in the time dimension, thus obtaining the temporal correlation degree. When the temporal correlation degree decreases significantly, it indicates that there is a large difference between the current communication behavior and historical behavior patterns.

[0082] For example, a cosine similarity algorithm can be used to calculate the cosine similarity between the multi-source security representation vector of the current time period and the multi-source security representation vector of each of the previous preset number of time periods, obtaining multiple cosine similarity values. The average of these multiple cosine similarity values ​​is then taken as the final temporal correlation. The cosine similarity value ranges from [-1, 1]. The closer the value is to 1, the stronger the consistency between the current communication behavior and the corresponding historical period, and the higher the temporal correlation; conversely, the weaker the consistency and the lower the temporal correlation. Furthermore, the Pearson correlation coefficient can be used to assist in the calculation, further correcting the accuracy of the temporal correlation and reducing the bias of a single algorithm.

[0083] Simultaneously, based on the cross-period time-series dataset, the deviation between the dynamic security threshold of the current time period and the dynamic security threshold of the previous preset number of time periods is calculated. When the deviation continues to increase, it indicates that the risk level of the communication network environment or communication behavior is changing.

[0084] For example, a relative deviation rate algorithm can be used. First, the absolute deviation of the current dynamic security threshold from the dynamic security threshold of each preset number of previous time periods is calculated. Then, the ratio of each absolute deviation to the corresponding historical dynamic security threshold (i.e., the relative deviation) is calculated. The average of all relative deviations is taken to obtain the deviation degree. The deviation degree ranges from [0, +∞). A larger value indicates a greater deviation between the current dynamic security threshold and the historical threshold, and a greater change in the network environment or risk level. Alternatively, a standard deviation algorithm can be used. This calculates the standard deviation of the dataset consisting of the current threshold and the thresholds of each preset number of previous time periods. A larger standard deviation indicates more drastic threshold fluctuations and a higher deviation degree.

[0085] Furthermore, by combining the temporal correlation degree and the deviation degree, it is inferred whether the communication behavior pattern corresponding to the current multi-source security representation is an abnormal pattern based on the preset anomaly judgment rules.

[0086] For example, if the time sequence correlation is lower than the first threshold and the dynamic security threshold deviation is higher than the second threshold, the current communication behavior can be determined as abnormal behavior. Based on this, an abnormal event can be weighted and scored according to the duration, degree of deviation, and scope of impact of the abnormal behavior to generate a preliminary risk score that is positively correlated with the risk level of the abnormal event.

[0087] For example, when the temporal correlation is below the first threshold (e.g., 0.3) and the dynamic security threshold deviation is above the second threshold (e.g., 0.2), the current communication behavior can be determined as abnormal. The first and second thresholds can be calibrated based on historical normal communication data samples and can be dynamically adjusted over time to adapt to changes in the network environment. Based on this, a weighted score can be generated for abnormal events according to their duration, deviation, and impact range, resulting in a preliminary risk score positively correlated with the risk level of the abnormal event. For example, weights can be set for temporal correlation deviation, deviation, and abnormal duration, with corresponding weight coefficients (e.g., 0.4, 0.4, 0.2). After standardizing the temporal correlation deviation, deviation, and abnormal duration, these values ​​are substituted into a weighted summation formula to calculate the preliminary risk score. The score range is set from 0 to 100 points; a higher score indicates a higher risk level of the abnormal event.

[0088] Step 105: When the preliminary risk score meets the early warning triggering conditions, the security early warning information associated with the abnormal event is output to the security management platform and / or communication network protection equipment to achieve early warning of communication security threats.

[0089] In step 105, when the preliminary risk score generated in step 104 meets the preset warning triggering conditions, the communication security warning system can output the security warning information associated with the abnormal event to the security management platform and / or communication network protection equipment.

[0090] The setting method for early warning triggering conditions is as follows: The initial risk score is set to a range of 0 to 100 points, with preset thresholds of 50 points for low-risk, 70 points for medium-risk, and 85 points for high-risk. When the initial risk score is ≥50 and <70, a low-risk warning is triggered, and warning information is only output to the security management platform for monitoring by operations and maintenance personnel. When the initial risk score is ≥70 and <85, a medium-risk warning is triggered, simultaneously outputting warning information and preliminary handling suggestions to the security management platform, and outputting monitoring instructions to the communication network protection equipment. When the initial risk score is ≥85, a high-risk warning is triggered, immediately outputting emergency warning information, detailed abnormal characteristics, and handling plans to the security management platform, and simultaneously outputting emergency protection instructions such as interception and isolation to the communication network protection equipment to quickly block abnormal communication behavior and prevent risk spread. In addition, special triggering conditions can be preset, i.e., when the initial risk score is ≥30 for two or more consecutive time periods, and the score increase is ≥10%, an early warning reminder is triggered even if the current score has not reached the medium-risk threshold, preventing the risk from escalating.

[0091] As an optional embodiment, in step 105, the protocol behavior, interaction path, and abnormal feature data associated with the abnormal event are obtained from the abnormal pattern inference results; relational reasoning is performed on the protocol behavior, interaction path, and abnormal feature data to construct an abnormal semantic chain containing abnormal communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths; corresponding security warning information is generated based on the abnormal semantic chain; and the security warning information is synchronously output to the security management platform and / or communication network protection equipment.

[0092] Optionally, the security warning information may include the time of the anomaly, the abnormal communication entity, the risk level, and related communication characteristics to assist security personnel or protective equipment in taking timely and appropriate security measures, thereby achieving early warning of communication security threats.

[0093] For example, the security warning information can be output to the security management platform for operation and maintenance personnel to view and handle, or output to the communication network protection equipment to trigger the initial protection response, thereby achieving early warning of communication security threats.

[0094] Further optionally, the anomaly semantic chain includes suspicious communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths. The anomaly semantic chain refers to a structured representation used to describe the inherent relationships between various anomaly elements in an abnormal communication event, and the anomaly semantic chain at least includes suspicious communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths.

[0095] Suspicious communication entities refer to terminal devices, servers, or network nodes identified as exhibiting abnormal communication behavior during anomaly events. Suspicious protocol behavior refers to abnormal combinations of protocol fields, abnormal request / response sequences, or abnormal protocol invocation methods that occur during communication. Feature offset nodes refer to feature dimensions or feature nodes in multi-source security representations that have undergone significant changes relative to historical normal behavior patterns. Association paths refer to the temporal or logical relationships between the above-mentioned anomaly elements, used to describe the formation process of anomaly events. Anomaly semantic chains are used to organize scattered anomaly features into a chain of anomaly behaviors with semantic interpretability, thereby improving the interpretability of warning information.

[0096] Optionally, in step 105, relational reasoning is performed on protocol behavior, interaction path, and abnormal feature data to construct an abnormal semantic chain containing abnormal communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths. This includes: extracting core abnormal data from the protocol behavior, interaction path, and abnormal feature data associated with abnormal events, wherein the core abnormal data includes abnormal points of protocol behavior, abnormal segments of interaction paths, and feature offset nodes; using an attention enhancement mechanism, ranking the path importance of the core abnormal data, quantifying the association weight of each abnormal data node to the occurrence of the abnormal event, and screening out key abnormal nodes whose association weight is higher than a preset association weight threshold; performing relational reasoning based on the key abnormal nodes, identifying the suspicious communication entities corresponding to each key abnormal node, and obtaining the triggering logic of the suspicious protocol behavior, the cause of the feature offset node, and the association relationship between each key abnormal node to form an abnormal association link; and performing a rationality check on the abnormal association link, and using the abnormal association link that passes the check as the abnormal semantic chain.

[0097] For example, when constructing anomaly semantic chains, core anomaly data can be extracted from the protocol behaviors, interaction paths, and anomaly feature data associated with anomaly events. For instance, it can be identified that a certain communication entity frequently initiates abnormal protocol requests within a short period of time, and the corresponding traffic characteristics show a significant shift, thereby marking the communication entity as a suspicious communication entity and the corresponding protocol request behavior as suspicious protocol behavior.

[0098] Subsequently, an attention enhancement mechanism can be employed to rank the path importance of abnormal points in protocol behavior, abnormal segments of interaction paths, and feature offset nodes, and to quantify the association weight of each abnormal node with the occurrence of the abnormal event. For example, when an abnormal point in protocol behavior is simultaneously associated with multiple feature offset nodes, and its association weight is higher than a preset association weight threshold, it can be identified as a critical abnormal node.

[0099] Based on this, relational reasoning can be performed on key anomaly nodes to identify the temporal sequence and logical connections between them, forming anomaly correlation chains. For example, it can identify the causal relationship between abnormal protocol requests, sudden increases in traffic characteristics, and abnormal session behavior.

[0100] Finally, the abnormal association links are checked for reasonableness, and associations that lack logical consistency are eliminated. The abnormal association links that pass the check are regarded as abnormal semantic links.

[0101] By synchronously outputting the security warning information generated by the abnormal semantic chain to the security management platform and / or communication network protection equipment, it can be used for analysis and handling by operation and maintenance personnel and automatic response of protection equipment, thereby realizing early warning of communication security threats.

[0102] In this embodiment, by performing multi-granularity decomposition and multi-dimensional feature extraction on the original communication data in the communication network, a multi-source security representation integrating temporal correlation features and protocol behavior semantic features is constructed. Furthermore, an adaptive threshold learning mechanism based on trend analysis is introduced over multiple consecutive time periods to perform cross-period temporal correlation and anomaly pattern inference on communication behavior. This allows for a more accurate characterization of the dynamic changes in communication behavior and yields a more reasonable anomaly risk score. This reduces the false alarm and false negative rates caused by fixed thresholds or single feature analysis, providing users with a more stable and reliable communication security early warning experience, and reducing the manual intervention costs for security operations personnel and the ineffective consumption of network protection resources.

[0103] The above describes an artificial intelligence-based communication security early warning method in the embodiments of this application. The following describes an artificial intelligence-based communication security early warning system that implements the above method.

[0104] See Figure 3 ,like Figure 3 The diagram shows a structural schematic of an artificial intelligence-based communication security early warning system. The artificial intelligence-based communication security early warning system in this embodiment can achieve the aforementioned... Figure 2 The steps of the AI-based communication security early warning method executed in the corresponding embodiments are described above. The functions of the AI-based communication security early warning system can be implemented in hardware or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions, and these modules can be software and / or hardware. The AI-based communication security early warning system may include an input / output module 301 and a processing module 302. The functional implementation of the processing module 302 and the input / output module 301 can be found in [reference needed]. Figure 2The operations performed in the corresponding embodiments will not be described in detail here. For example, the processing module 302 can be used to control the sending, receiving, and acquiring operations of the input / output module 301.

[0105] The input / output module 301 is configured to acquire the original communication data of each communication entity in the communication network; when the preliminary risk score meets the early warning triggering conditions, it outputs the security early warning information associated with the abnormal event to the security management platform and / or communication network protection equipment, so as to realize early warning of communication security threats. The processing module 302 is configured to perform multi-granularity splitting and feature extraction on the original communication data to obtain a multi-source security representation of the target communication entity; perform trend analysis on the multi-source security representation over multiple consecutive time periods, and perform adaptive threshold learning on the analyzed communication network service load changes, entity historical behavior patterns, and global risk fluctuations to generate a dynamic security threshold that is dynamically updated with time periods; and perform cross-period time-series correlation and abnormal pattern inference on the multi-source security representation of the current time period and the corresponding dynamic security threshold to generate a preliminary risk score for abnormal events.

[0106] In this embodiment, dynamic perception and anomaly identification of communication behavior can be achieved, providing early warning of low-frequency and hidden security risks, and further improving the accuracy and timeliness of communication security early warning.

[0107] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0108] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0109] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0110] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0111] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product.

[0112] The computer program product includes one or more computer instructions. When the computer program is loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium may be any available medium that a computer can store or a data storage device such as a server or data center that integrates one or more available media. The available medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., a solid-state disk (SSD)).

[0113] The technical solutions provided in the embodiments of this application have been described in detail above. Specific examples have been used in the embodiments of this application to illustrate the principles and implementation methods of the embodiments of this application. The description of the above embodiments is only for the purpose of helping to understand the methods and core ideas of the embodiments of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the embodiments of this application. Therefore, the content of this specification should not be construed as a limitation on the embodiments of this application.

Claims

1. A communication security early warning method based on artificial intelligence, characterized in that, The method includes: To obtain the raw communication data of each communication entity in the communication network; The original communication data is split into multiple granularities and features are extracted to obtain a multi-source security representation of the target communication entity. This includes: splitting the original communication data into multiple granularities and extracting features to obtain a correlation feature vector for cross-window time series analysis and a protocol behavior semantic vector for communication semantic modeling; and fusing the correlation feature vector and the protocol behavior semantic vector in multiple dimensions to obtain a multi-source security representation of the target communication entity. The step of performing multi-granularity splitting and feature extraction on the original communication data to obtain a correlation feature vector for cross-window time series analysis and a protocol behavior semantic vector for communication semantic modeling includes: splitting the original communication data into packet-level, stream-level, and session-level segments to obtain a first feature segment adapted for cross-window time series analysis and a second feature segment adapted for communication semantic modeling; extracting cross-window time series features from the first feature segment to obtain the correlation feature vector; filtering protocol fields in the second feature segment based on protocol type, retaining valid protocol fields related to communication semantics, semantically encoding the valid protocol fields and interaction logic, and converting them to obtain the protocol behavior semantic vector. Trend analysis is performed on the multi-source security representation over multiple consecutive time periods, and adaptive threshold learning is performed on the changes in communication network service load, historical behavior patterns of entities, and global risk fluctuations obtained from the analysis to generate dynamic security thresholds that are dynamically updated with time periods. By performing cross-period time-series correlation and anomaly pattern inference between the multi-source security representations of the current time period and the corresponding dynamic security thresholds, a preliminary risk score for anomaly events is generated. When the preliminary risk score meets the early warning triggering conditions, the security early warning information associated with the abnormal event is output to the security management platform and / or communication network protection equipment to achieve early warning of communication security threats.

2. The communication security early warning method based on artificial intelligence according to claim 1, characterized in that, The process of adaptively learning thresholds based on the analyzed communication network service load changes, historical entity behavior patterns, and global risk fluctuations to generate dynamically updated security thresholds that change over time includes: Initialize a baseline security threshold for the target communication entity, which is calibrated based on the entity's historical normal behavior patterns and normal network service load; Based on the fluctuation range of communication network service load changes, the deviation of the entity's historical behavior pattern, and the early warning level of global risk fluctuations, the corresponding influence weights are assigned to each item, and the influence weights are dynamically adjusted over time. Based on the aforementioned influence weights, the communication network service load change data, entity historical behavior pattern data, and global risk fluctuation data obtained from each time period analysis are input into the adaptive threshold learning model to generate the dynamic security threshold corresponding to the current time period, and are synchronously updated to the threshold learning benchmark for the next time period.

3. The communication security early warning method based on artificial intelligence according to claim 1, characterized in that, The step of performing cross-period time-series correlation and anomaly pattern inference between the multi-source security representation of the current time period and the corresponding dynamic security threshold to generate a preliminary risk score for anomaly events includes: Acquire multi-source security characteristics and corresponding dynamic security thresholds for a preset number of time periods; Calculate the temporal correlation between the multi-source security representation in the current time period and the multi-source security representation in the previous preset number of time periods; Calculate the deviation between the dynamic safety threshold of the current time period and the dynamic safety threshold of the previous preset number of time periods; Based on the temporal correlation degree and the deviation degree, and combined with the preset anomaly judgment rule, it is inferred whether the behavior pattern corresponding to the current multi-source security representation is an abnormal pattern. Based on the inference results, a weighted score is applied to the abnormal event to generate a preliminary risk score for the abnormal event. The preliminary risk score is positively correlated with the degree of risk of the abnormal event.

4. The communication security early warning method based on artificial intelligence according to claim 1, characterized in that, The step of outputting security warning information associated with abnormal events to the security management platform and / or communication network protection equipment includes: From the results of abnormal pattern inference, obtain the protocol behavior, interaction path and abnormal feature data associated with the abnormal event; Relational reasoning is performed on protocol behavior, interaction paths, and abnormal feature data to construct an abnormal semantic chain containing abnormal communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths; Based on the aforementioned abnormal semantic chain, corresponding security warning information is generated; The security warning information is simultaneously output to the security management platform and / or communication network protection equipment.

5. The communication security early warning method based on artificial intelligence according to claim 4, characterized in that, The abnormal semantic chain includes suspicious communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths.

6. The communication security early warning method based on artificial intelligence according to claim 5, characterized in that, The process of performing relational reasoning on protocol behavior, interaction paths, and abnormal feature data to construct an abnormal semantic chain containing abnormal communication entities, suspicious protocol behaviors, feature offset nodes, and associated paths includes: Extract core abnormal data from the abnormal event-related protocol behavior, interaction path and abnormal feature data. The core abnormal data includes abnormal points of protocol behavior, abnormal segments of interaction path and feature offset nodes. An attention enhancement mechanism is used to sort the core abnormal data by path importance, quantify the association weight of each abnormal data node with the occurrence of the abnormal event, and screen out key abnormal nodes whose association weight is higher than a preset association weight threshold. Relationship reasoning is performed based on key abnormal nodes to identify suspicious communication entities corresponding to each key abnormal node, and to obtain the triggering logic of suspicious protocol behavior, the cause of the generation of feature offset nodes, and the correlation between each key abnormal node to form an abnormal correlation link. The abnormal association links are subjected to a rationality check, and the abnormal association links that pass the check are taken as the abnormal semantic chains.

7. The communication security early warning method based on artificial intelligence according to claim 1, characterized in that, The security warning information includes at least the warning level, preliminary risk score, suspicious communication entities, recommended actions, and the scope of related impact.

8. A communication security early warning system based on artificial intelligence, characterized in that, The system includes: The input / output module is configured to acquire raw communication data from various communication entities in the communication network. The processing module is configured to perform multi-granularity splitting and feature extraction on the original communication data to obtain a multi-source security representation of the target communication entity; perform trend analysis on the multi-source security representation over multiple consecutive time periods, and perform adaptive threshold learning on the analyzed communication network service load changes, entity historical behavior patterns, and global risk fluctuations to generate a dynamic security threshold that is dynamically updated over time periods; and perform cross-period time-series correlation and anomaly pattern inference on the multi-source security representation of the current time period and the corresponding dynamic security threshold to generate a preliminary risk score for the abnormal event. The processing module, when performing multi-granularity splitting and feature extraction on the original communication data to obtain a multi-source security representation of the target communication entity, is configured to perform multi-granularity splitting and feature extraction on the original communication data to obtain a correlation feature vector for cross-window time series analysis and a protocol behavior semantic vector for communication semantic modeling; and to perform multi-dimensional fusion of the correlation feature vector and the protocol behavior semantic vector to obtain a multi-source security representation of the target communication entity. The processing module, when performing multi-granularity splitting and feature extraction on the original communication data to obtain a correlation feature vector for cross-window timing analysis and a protocol behavior semantic vector for communication semantic modeling, is configured to perform packet-level splitting, stream-level splitting, and session-level splitting on the original communication data to obtain a first feature segment adapted for cross-window timing analysis and a second feature segment adapted for communication semantic modeling; perform cross-window timing feature extraction on the first feature segment to obtain the correlation feature vector; filter protocol fields on the second feature segment based on protocol type, retain valid protocol fields related to communication semantics, perform semantic encoding on the valid protocol fields and interaction logic, and convert them to obtain the protocol behavior semantic vector; The input / output module is also configured to output security warning information associated with abnormal events to the security management platform and / or communication network protection equipment when the preliminary risk score meets the warning triggering conditions, so as to realize early warning of communication security threats.

Images