Internet data security protection method and system based on artificial intelligence algorithm
By using time-series modeling and dynamic policy learning based on artificial intelligence algorithms, the problem of insufficient adaptability of traditional methods in Internet data security is solved, enabling efficient identification and response to network threats and improving the accuracy and adaptability of data security protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- QUZHOU UNIV
- Filing Date
- 2026-02-09
- Publication Date
- 2026-05-19
AI Technical Summary
In existing internet data security technologies, traditional methods are unable to cope with the rapid updates of data threats and the frequent changes in attack methods. Furthermore, static rules cannot adapt to complex network environments, resulting in decreased identification capabilities and a lack of policy adaptability.
By employing time-series modeling, dynamic policy learning, and link analysis methods based on artificial intelligence algorithms, and through the collection, time-series modeling, policy learning, and link analysis of network behavior data, time-series correlation features and source path indications are formed to achieve dynamic risk assessment.
It improves the accuracy and response speed of data security protection, enhances the system's adaptability and accuracy, and enables rapid identification and tracking of cybersecurity threats.
Smart Images
Figure CN122069080A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of internet data security technology, specifically to an internet data security protection method and system based on artificial intelligence algorithms. Background Technology
[0002] Currently, the scale of internet data continues to grow. Data flows across multiple platforms and business scenarios, with diverse transmission methods. Common security protection systems in the industry include encryption technology, access control, intrusion detection, identity authentication, and log auditing. Network security platforms rely on fixed rules to identify abnormal behavior. Network devices generally have data collection capabilities, recording access actions, traffic fluctuations, and critical events. Cloud computing platforms provide computing power support, enabling security applications to cover aspects such as link monitoring, protocol analysis, and behavior classification. Data security technologies are gradually forming a structure of encryption, protection, monitoring, and response layers, with relatively fixed operating processes. Distributed deployment is common in industry practice, with the front end collecting data and the back end making judgments. The interweaving of multiple types of data, with security systems searching for risk clues in logs, traffic, and session data, constitutes the current prevalent technical landscape.
[0003] However, existing technologies still have significant shortcomings. Data threats update rapidly, attack methods change frequently, and there are multiple sources and dispersed entry points. Traditional methods rely on static rules or fixed models, resulting in long update cycles. The system's ability to identify unknown attacks decreases, and judgments are constrained by existing experience. Data types are complex, static strategies lack adaptability, and model training content cannot cover all changing scenarios. The network environment generates a large amount of heterogeneous data, and a single rule cannot handle the changes brought about by the combination of multiple features. Without deep correlation analysis, the hidden features of new threats in log and traffic data are difficult to expose. Without dynamic learning mechanisms, security policies remain at the level of fixed thresholds. The system struggles to quickly adjust feature boundaries to form a stable risk identification process. Summary of the Invention
[0004] To address the shortcomings of existing technologies, this invention provides an internet data security protection method and system based on artificial intelligence algorithms. The technical problem this invention aims to solve is: how to address the issues of rapid data threat updates, frequent changes in attack methods, and the difficulty of traditional static rules in coping with complex network environments by using time-series modeling, dynamic policy learning, and link analysis methods based on artificial intelligence algorithms.
[0005] To achieve the above objectives, the present invention provides the following technical solution: an internet data security protection method based on artificial intelligence algorithms, comprising: S1. Collect network behavior data in the Internet environment to form heterogeneous data sequences; S2. Perform time-series modeling on the heterogeneous data sequence to form time-series correlation features, wherein the time-series modeling process adopts a time-series memory network model; S3. The temporal correlation features are subjected to policy learning to form a policy behavior space, wherein the policy learning adopts an online reinforcement learning policy structure; S4. Perform link analysis on the policy behavior space to form source path indication; S5. Perform risk assessment on the source path indication to form a security decision set.
[0006] Preferably, the network behavior data includes log data, traffic data, and session behavior data, and the collection includes time synchronization and format normalization.
[0007] Preferably, the temporal memory network model includes an input layer, a temporal memory structure layer, and an output feature layer. The input layer performs sequence encoding on the heterogeneous data sequence to form an initial temporal vector. The sequence encoding adopts the temporal data vectorization method, which converts the heterogeneous data sequence into a uniform format numerical sequence. The uniform format numerical sequence is then subjected to temporal data preprocessing to form the initial temporal vector.
[0008] Preferably, the temporal memory structure layer uses a long short-term memory network to update the state of the initial temporal vector, and forms a deep memory vector based on the state update. The state update includes information flow transmission and gating control. The output feature layer includes feature extraction and nonlinear transformation. The feature extraction transforms the deep memory vector into a high-dimensional feature representation. The nonlinear transformation performs nonlinear mapping on the high-dimensional feature representation through an activation function to form the temporal correlation feature.
[0009] Preferably, the online reinforcement learning strategy structure includes an action selection mechanism, a policy update mechanism, and a value evaluation mechanism. The action selection mechanism performs action candidate processing on the temporally related features to form an action candidate set. The policy update mechanism derives a policy from the action candidate set based on real-time feedback data to form an updated policy set. The value evaluation mechanism extracts value from the updated policy set to form the policy action space.
[0010] Preferably, the value extraction includes return estimation and strategy value extraction, and the behavior candidate processing includes the following steps: S31. The temporal correlation features are expressed in a state to form a state set; S32. Perform action inference on the state set to form an action set; S33. Perform behavior filtering on the set of actions to form the behavior candidate set.
[0011] Preferably, the strategy derivation employs a dynamic strategy drift adaptive algorithm, which includes strategy incremental update and drift correction. The strategy incremental update extracts strategy increments from the behavior candidate set based on the real-time feedback data, and forms intermediate strategy results based on the strategy incremental extraction. The drift correction corrects the drift offset of the intermediate strategy results to form the updated strategy set. The real-time feedback data is obtained through behavior output signal collection.
[0012] Preferably, the link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics, and forms the source path indication through the risk behavior link backtracking. The access path characteristics are obtained by sequential parsing of network access records, and the communication link characteristics are obtained by statistical measurement of link latency, link hop count and link error rate. The risk behavior link backtracking includes path start point determination and link hop-by-hop backtracking.
[0013] Preferably, the risk assessment adopts a risk scoring method, and the scoring method is based on the number of times the risk behavior occurs and the risk intensity of the nodes in the path. The security decision set includes a risk level field, a path record field, and a node identifier field.
[0014] Internet data security protection systems based on artificial intelligence algorithms include: Network behavior data acquisition module: The network behavior data acquisition module acquires network behavior data in the Internet environment. The network behavior data acquisition module forms a heterogeneous data sequence through the acquisition. The acquisition includes time synchronization and format normalization. Temporal feature modeling module: The temporal feature modeling module performs temporal modeling processing on the heterogeneous data sequence. The temporal feature modeling module forms temporal correlation features through the temporal modeling processing. The temporal modeling processing adopts a temporal memory network model. Strategy learning and updating module: The strategy learning and updating module performs strategy learning on the temporal correlation features. The strategy learning and updating module forms a strategy behavior space through the strategy learning. The strategy learning includes an action selection mechanism, a strategy updating mechanism, and a value evaluation mechanism. Link Analysis and Backtracking Module: The link analysis and backtracking module performs link analysis on the policy behavior space, and generates source path indications through the link analysis. The link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics. Judgment and Decision Module: The judgment and decision module performs risk assessment on the source path indication, and forms a safety decision set through the risk assessment. The risk assessment adopts a risk scoring method.
[0015] This invention provides a method and system for protecting internet data security based on artificial intelligence algorithms. It has the following beneficial effects: This method and system for protecting internet data security based on artificial intelligence algorithms collects network behavior data in the internet environment and performs time-series modeling to form time-series correlation features. It then uses online reinforcement learning algorithms to learn policies, dynamically optimizes security policies in a constantly changing network environment, and monitors and provides feedback on potential security risks in real time, thereby improving the accuracy and response speed of data security protection.
[0016] A link analysis backtracking module and a risk scoring method were employed for risk assessment. After analyzing the source path indications, potential cybersecurity threats were efficiently tracked and identified. By using real-time policy derivation and updates based on behavioral candidate sets, combined with the dynamic evaluation mechanism of the risk scoring method, the system's adaptability and accuracy were improved, resulting in stronger cybersecurity protection. Attached Figure Description
[0017] Figure 1 This is an overall flowchart of the method of the present invention; Figure 2 This is a schematic diagram of the timing modeling process of the present invention; Figure 3 This is a flowchart of the strategy learning mechanism of the present invention; Figure 4 This is a schematic diagram of the link analysis backtracking of the present invention; Figure 5 This is a schematic diagram of the system modules of the present invention. Detailed Implementation
[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0019] Example 1 like Figure 1-5 As shown, this embodiment of the invention provides an internet data security protection method based on artificial intelligence algorithms, including: S1. Collecting network behavior data in the internet environment to form a heterogeneous data sequence. The network behavior data includes log data, traffic data, and session behavior data; collection includes time synchronization and format normalization.
[0020] S2. Time-series modeling is performed on heterogeneous data sequences to form time-series correlation features. This time-series modeling employs a time-series memory network model. The time-series memory network model includes an input layer, a time-series memory structure layer, and an output feature layer. The input layer encodes the heterogeneous data sequences to form initial time-series vectors. Sequence encoding uses time-series data vectorization, which converts the heterogeneous data sequences into uniform-format numerical sequences. Time-series data preprocessing is then performed on the uniform-format numerical sequences to form the initial time-series vectors. The time-series memory structure layer uses a Long Short-Term Memory (LSTM) network to update the state of the initial time-series vectors. Based on these state updates, a deep memory vector is formed. State updates include information flow transmission and gating control. The output feature layer includes feature extraction and nonlinear transformation. Feature extraction transforms the deep memory vectors into high-dimensional feature representations. The nonlinear transformation uses an activation function to perform a nonlinear mapping on the high-dimensional feature representations to form time-series correlation features.
[0021] S3. A policy behavior space is formed by learning policies based on temporal correlation features. Policy learning employs an online reinforcement learning policy structure. This structure includes an action selection mechanism, a policy update mechanism, and a value evaluation mechanism. The action selection mechanism processes temporal correlation features to form a candidate action set. The policy update mechanism derives policies from the candidate action set based on real-time feedback data to form an updated policy set. The value evaluation mechanism extracts value from the updated policy set to form the policy behavior space. Policy derivation uses a dynamic policy drift adaptive algorithm, which includes incremental policy updates and drift correction. Incremental policy updates extract policy increments from the candidate action set based on real-time feedback data, forming intermediate policy results. Drift correction corrects the drift offset of the intermediate policy results to form an updated policy set. Real-time feedback data is obtained through behavior output signal collection. Value extraction includes reward estimation and policy value extraction. The behavior candidate processing includes the following steps: S31. State representation of temporal correlation features to form a state set.
[0022] S32. Perform action inference on the state set to form an action set.
[0023] S33. Perform behavior filtering on the action set to form a behavior candidate set.
[0024] S4. Perform link analysis on the policy behavior space to form source path indications. Link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics. Source path indications are formed through risk behavior link backtracking. Access path characteristics are obtained by sequential parsing of network access records, and communication link characteristics are obtained by statistical measurement of link latency, link hop count, and link error rate. Risk behavior link backtracking includes determining the path start point and hop-by-hop backtracking.
[0025] S5. Risk assessment is performed on the source path indication to form a security decision set. The risk assessment adopts a risk scoring method, which is based on the number of times the risky behavior occurs and the risk intensity of the nodes in the path. The security decision set includes a risk level field, a path record field, and a node identifier field.
[0026] Internet data security protection systems based on artificial intelligence algorithms include: Network Behavior Data Acquisition Module: The network behavior data acquisition module collects network behavior data in the Internet environment. The module forms heterogeneous data sequences through acquisition, which includes time synchronization and format normalization.
[0027] Temporal Feature Modeling Module: The temporal feature modeling module performs temporal modeling processing on heterogeneous data sequences. The temporal feature modeling module forms temporal correlation features through temporal modeling processing, which adopts a temporal memory network model.
[0028] The strategy learning and update module performs strategy learning on temporal correlation features. The strategy learning and update module forms a strategy behavior space through strategy learning. Strategy learning includes action selection mechanism, strategy update mechanism and value evaluation mechanism.
[0029] Link Analysis and Backtracking Module: The link analysis and backtracking module performs link analysis on the policy behavior space. The link analysis and backtracking module generates source path indications through link analysis. The link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics.
[0030] Judgment and Decision Module: The Judgment and Decision Module performs risk assessment on the source path indication. The Judgment and Decision Module forms a safety decision set through risk assessment, and the risk assessment adopts the risk scoring method.
[0031] Integrating online reinforcement learning algorithms enables the system to learn adaptively based on changes in network behavior, better identifying new and complex network attacks that traditional security methods may overlook.
[0032] The adaptive policy update mechanism based on real-time feedback data enables the system to continuously optimize security protection measures and flexibly respond to ever-changing attack patterns without human intervention.
[0033] The source path indication and risk behavior link backtracking mechanism provides comprehensive attack source tracing capabilities, helping security teams to gain a deep understanding of the entire attack landscape, take targeted preventative measures, and avoid similar incidents from happening again.
[0034] Online reinforcement learning optimizes the resource allocation for security behaviors, ensuring that protective measures are dynamically adjusted according to real-time needs, thus avoiding excessive consumption of system resources.
[0035] Risk scoring provides a basis for prioritizing security protection measures, ensuring that critical security threats are addressed first, which is of great significance for maintaining overall cybersecurity.
[0036] Example 2 This embodiment presents an internet data security protection method and system based on artificial intelligence algorithms. By collecting and processing network behavior data and extracting temporal correlation features using a temporal memory network model, it achieves the identification of potential network security threats. The specific implementation method is as follows: 1. Data Collection The enterprise network began collecting network behavior data at 10:15:00 on November 20, 2025. The following are the three types of heterogeneous data collected: Log data: The timestamp is November 20, 2025, 10:15:00, the source IP is 192.168.1.101, the request URL is / api / user / data, and the response time is 80 milliseconds.
[0037] Log data description: The logs record the time, source IP, requested URL, and response time of a specific API request. The log data provides basic information about the network request.
[0038] Traffic data: The timestamp is 10:15:00 on November 20, 2025, the traffic is 350KB, and the number of packets is 95.
[0039] Traffic data description: Traffic data records the network traffic and the number of data packets at a given moment, and is used to analyze network bandwidth usage and traffic distribution.
[0040] Session behavior data: The timestamp is 10:15:00 on November 20, 2025, the session ID is 6789, the duration is 10 minutes, and the actions are: clicking on page 1 and clicking on page 3.
[0041] Session data description: Session data records a user's activity during a session, including the session ID, session duration, and pages visited by the user. This data is used to analyze user network behavior and usage patterns.
[0042] 2. Data Preprocessing The collected heterogeneous data is synchronized in time and normalized in format to ensure data consistency.
[0043] Log data processing: The response time was converted from milliseconds to seconds, resulting in 0.08 seconds. The processed log data format is as follows: [2025-11-20-10:15:00,192.168.1.101, / api / user / data,0.08].
[0044] Traffic data processing: The 350KB traffic data is converted to bytes, i.e., 350,000 bytes. The processed traffic data format is: [2025-11-20-10:15:00,350000,95].
[0045] Session data processing: Convert the actions in the session, such as clicking on page 1 and clicking on page 3, into numerical form: 1 for a click and 0 for no click. The processed session data format is as follows: [2025-11-2010:15:00,6789,10,1,1].
[0046] 3. Time-series data encoding The processed data is encoded and converted into a unified numerical vector, which is then input into the time series model.
[0047] Log data encoding: The timestamp is converted to a digital representation using a standard time conversion method: November 20, 2025, 10:15:00 is converted to 1681347900.
[0048] The source IP address is hashed and converted into a numerical value, resulting in the encoded value 12345.
[0049] The request URL is hashed and converted into a numerical value, resulting in the encoded value 98765.
[0050] The processed log data is encoded into a uniformly formatted numerical vector containing information such as timestamp, source IP, request URL, and response time. The processed log data is encoded as: [1681347900,12345,98765].
[0051] Traffic data encoding: After the traffic data of 350,000 bytes and the number of data packets of 95 are converted into numerical format, they are encoded together with the timestamp as [1681347900,350000,95].
[0052] Session data encoding: Session IDs are converted numerically, and behavioral data is processed numerically. The duration of each session and user behavior are converted into data in a unified format, and the session data is encoded as: [1681347900,6789,10,1,1].
[0053] 4. Temporal memory network model The encoded data is input into a temporal memory network. The temporal memory network iteratively updates its internal state, extracts temporal features from the data, and generates deep memory vectors to capture the temporal relationships between various types of data within the network. After multiple iterations, the temporal memory network generates deep memory vectors reflecting the temporal dependencies between data, including potential associations between log data, traffic data, and session data.
[0054] 5. Feature Extraction and Nonlinear Transformation The feature extraction module extracts high-dimensional features from the deep memory vector. These high-dimensional features reveal important patterns in the data. Subsequently, a non-linear activation function is used to transform the high-dimensional features to obtain the final temporal correlation features.
[0055] 6. Output Results The extracted temporal correlation features are then output to the subsequent policy learning module. These features help the system identify anomalies in network behavior. Anomaly detection: If an IP address makes a large number of requests in a short period of time, or if the behavior of a session is inconsistent with the normal pattern, timing features can help identify potential abnormal network behavior.
[0056] Security strategy: Based on time-series characteristics, the system automatically identifies potential security threats and triggers defensive measures.
[0057] Temporal correlation features provide crucial data for cybersecurity decision-making, helping to improve the security and defense capabilities of enterprise networks.
[0058] Through the steps described above, temporally correlated features were extracted from network logs, traffic data, and session behavior data. These temporally correlated features reveal deep-seated relationships between data points, helping the system achieve efficient security threat detection. Based on these features, the system accurately identifies abnormal behavior in the network, promptly detects potential security risks, and takes corresponding defensive measures, significantly improving network security protection capabilities.
[0059] Example 3 This embodiment presents an internet data security protection method and system based on artificial intelligence algorithms. It utilizes temporal modeling and reinforcement learning algorithms to automatically optimize network traffic management strategies, thereby improving network performance and stability. The specific implementation method is as follows: A company has deployed a network traffic monitoring and management system in its data center. This system collects network traffic data in real time and dynamically adjusts bandwidth, limits traffic, and implements load balancing strategies based on the data to optimize network performance and prevent network overload. The network traffic monitoring and management system uses time series modeling and online reinforcement learning algorithms to intelligently select the most appropriate network management strategy based on different network traffic patterns.
[0060] 1. Data Preparation The system collected network traffic data at the following six time points, in Mbps: Table 1: Network Traffic Data Collection Table.
[0061]
[0062] The above data represents the network traffic status at different time points. To utilize network traffic data for temporal modeling, the system converts the traffic data at every four consecutive time points into a temporal vector, which is then used as the state input into the reinforcement learning model. The specific temporal vectors are as follows: State vector 1: [50,55,60,75], State vector 2: [55,60,75,80], State vector 3: [60,75,80,100].
[0063] 2. Generation of State Sets The system converts the collected network traffic data into time-series vectors, forming a state set. Each time-series vector represents network traffic information within a time period, as detailed below: State vector 1 is [50,55,60,75], state vector 2 is [55,60,75,80], and state vector 3 is [60,75,80,100].
[0064] The state set is generated as follows: State set: [[50,55,60,75],[55,60,75,80],[60,75,80,100]].
[0065] Time series data reflects the traffic change patterns at different points in time. The system models the network state through state sets and analyzes the changing trends of network traffic.
[0066] 3. Action inference Based on the generated set of states, the system infers a set of possible actions. In this embodiment, the changing trend of network traffic determines the following actions inferred by the system: Action 1: Increase bandwidth. When traffic increases, increase bandwidth to ensure network stability.
[0067] Action 2: Limit traffic. When traffic is overloaded, limit bandwidth to prevent network congestion.
[0068] Action 3: Enable load balancing to automatically distribute traffic to different servers when there is a sudden surge in traffic.
[0069] When traffic shows a rapid increase between time point 4 and time point 6, the system infers that it should take measures such as increasing bandwidth or enabling load balancing.
[0070] 4. Behavioral candidate set screening During the behavior screening phase, the system selects the most suitable set of behavior candidates based on real-time feedback data such as bandwidth usage, latency, and packet loss rate.
[0071] For time point 5: At time point 5, network traffic increased from 75Mbps to 80Mbps. The system assessed this as a significant increase in traffic and therefore selected the following candidate behaviors: Increase bandwidth: Increase the bandwidth from 80Mbps to 120Mbps to ensure network performance.
[0072] Enable load balancing: Distribute traffic evenly across multiple servers to avoid overloading a single server.
[0073] By monitoring traffic in real time, the system selects the most suitable set of candidate behaviors for optimization.
[0074] 5. Strategy Learning and Derivation The system uses an online reinforcement learning algorithm to learn policies from the selected set of candidate behaviors and updates the policies based on real-time feedback. In this embodiment, the system employs a dynamic policy drift adaptive algorithm to derive policies for the behaviors. The specific steps are as follows: Strategy 1: When the traffic exceeds 75Mbps but is less than 100Mbps, increase the bandwidth to 120Mbps.
[0075] Strategy 2: When the traffic exceeds 100Mbps, enable traffic limiting to ensure it does not exceed 100Mbps.
[0076] Strategy 3: When traffic surges rapidly, enable load balancing to reduce the load on a particular server.
[0077] The system adaptively adjusts its policies based on real-time feedback such as latency data and traffic usage, gradually updating the policy set. When traffic exceeds 100Mbps, the system will automatically enable traffic limiting to prevent excessive consumption of network resources.
[0078] 6. Formation of strategic behavior space Through strategy learning and derivation, the system ultimately forms a complete policy behavior space, including different network management policies to adapt to different traffic conditions. The policy behavior space is as follows: Strategy 1: When the traffic increases from 60Mbps to 80Mbps, increase the bandwidth to 120Mbps.
[0079] Strategy 2: When the traffic exceeds 100Mbps, enable the traffic limiting mechanism to ensure that the network bandwidth does not exceed 100Mbps.
[0080] Strategy 3: When a rapid increase in traffic is detected, enable load balancing to distribute traffic to multiple servers and prevent any one server from becoming overloaded.
[0081] In summary, this embodiment demonstrates a method for automatically deriving network traffic management strategies based on network traffic data through temporal modeling and online reinforcement learning algorithms. The system intelligently selects appropriate strategies to address network traffic fluctuations based on real-time collected network traffic data. Implementation results show that the network traffic management system based on temporal modeling and reinforcement learning algorithms avoids bandwidth shortages and network overload problems, improves network resource utilization efficiency, reduces manual intervention, and ensures efficient and stable network operation.
[0082] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A method for protecting internet data security based on artificial intelligence algorithms, characterized in that: include: S1. Collect network behavior data in the Internet environment to form heterogeneous data sequences; S2. Perform time-series modeling on the heterogeneous data sequence to form time-series correlation features, wherein the time-series modeling process adopts a time-series memory network model; S3. The temporal correlation features are subjected to policy learning to form a policy behavior space, wherein the policy learning adopts an online reinforcement learning policy structure; S4. Perform link analysis on the policy behavior space to form source path indication; S5. Perform risk assessment on the source path indication to form a security decision set.
2. The Internet data security protection method based on artificial intelligence algorithms according to claim 1, characterized in that: The network behavior data includes log data, traffic data, and session behavior data, and the collection includes time synchronization and format normalization.
3. The Internet data security protection method based on artificial intelligence algorithms according to claim 1, characterized in that: The temporal memory network model includes an input layer, a temporal memory structure layer, and an output feature layer. The input layer performs sequence encoding on the heterogeneous data sequence to form an initial temporal vector. The sequence encoding adopts the temporal data vectorization method, which converts the heterogeneous data sequence into a uniform format numerical sequence. The uniform format numerical sequence is then subjected to temporal data preprocessing to form the initial temporal vector.
4. The Internet data security protection method based on artificial intelligence algorithms according to claim 3, characterized in that: The temporal memory structure layer uses a long short-term memory network to update the state of the initial temporal vector, and forms a deep memory vector based on the state update. The state update includes information flow transmission and gating control. The output feature layer includes feature extraction and nonlinear transformation. The feature extraction transforms the deep memory vector into a high-dimensional feature representation. The nonlinear transformation performs nonlinear mapping on the high-dimensional feature representation through an activation function to form the temporal correlation feature.
5. The Internet data security protection method based on artificial intelligence algorithms according to claim 1, characterized in that: The online reinforcement learning strategy structure includes an action selection mechanism, a policy update mechanism, and a value evaluation mechanism. The action selection mechanism performs action candidate processing on the temporal correlation features to form an action candidate set. The policy update mechanism derives policies from the action candidate set based on real-time feedback data to form an updated policy set. The value evaluation mechanism extracts value from the updated policy set to form the policy action space.
6. The Internet data security protection method based on artificial intelligence algorithms according to claim 5, characterized in that: The value extraction includes return estimation and strategy value extraction, and the behavioral candidate processing includes the following steps: S31. The temporal correlation features are expressed in a state to form a state set; S32. Perform action inference on the state set to form an action set; S33. Perform behavior filtering on the set of actions to form the behavior candidate set.
7. The Internet data security protection method based on artificial intelligence algorithms according to claim 5, characterized in that: The strategy derivation employs a dynamic strategy drift adaptive algorithm, which includes strategy incremental update and drift correction. The strategy incremental update extracts strategy increments from the behavior candidate set based on the real-time feedback data, and forms intermediate strategy results based on the strategy incremental extraction. The drift correction corrects the drift offset of the intermediate strategy results to form the updated strategy set. The real-time feedback data is obtained through behavior output signal collection.
8. The Internet data security protection method based on artificial intelligence algorithms according to claim 1, characterized in that: The link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics. The source path indication is formed through the risk behavior link backtracking. The access path characteristics are obtained by sequential parsing of network access records. The communication link characteristics are obtained by statistical measurement of link latency, link hop count, and link error rate. The risk behavior link backtracking includes path start point determination and link hop-by-hop backtracking.
9. The Internet data security protection method based on artificial intelligence algorithms according to claim 1, characterized in that: The risk assessment adopts a risk scoring method, which is based on the number of times the risky behavior occurs and the risk intensity of the nodes in the path. The security decision set includes a risk level field, a path record field, and a node identifier field.
10. An Internet data security protection system based on artificial intelligence algorithms, characterized in that: Network behavior data acquisition module: used to collect network behavior data in the Internet environment. The network behavior data acquisition module forms a heterogeneous data sequence through the acquisition. The acquisition includes time synchronization and format normalization. Temporal feature modeling module: used to perform temporal modeling processing on the heterogeneous data sequence. The temporal feature modeling module forms temporal correlation features through the temporal modeling processing. The temporal modeling processing adopts a temporal memory network model. Policy learning and update module: used to learn policies from the temporal correlation features. The policy learning and update module forms a policy behavior space through the policy learning. The policy learning includes an action selection mechanism, a policy update mechanism, and a value evaluation mechanism. Link analysis and backtracking module: used to perform link analysis on the policy behavior space. The link analysis and backtracking module generates source path indication through the link analysis. The link analysis performs risk behavior link backtracking on the policy behavior space based on access path characteristics and communication link characteristics. Judgment and Decision Module: Used to make risk judgments on the source path indication. The judgment and decision module forms a security decision set through the risk judgment. The risk judgment adopts the risk scoring method.