An artificial intelligence-based computer network adaptive defense system
By constructing an AI-based adaptive defense system for computer networks, the system achieves correlation comparison between network behavior and terminal process behavior, solving the problem of identifying complex attacks in traditional defense systems and improving the accuracy of threat detection and the scientific nature of defense decisions.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NANJING SIRUILI TECHNOLOGY CO LTD
- Filing Date
- 2026-05-27
- Publication Date
- 2026-06-23
AI Technical Summary
Traditional cybersecurity defense systems are unable to effectively identify lateral movement and complex attacks initiated by legitimate processes, and lack the ability to analyze cross-domain attack chains, making advanced persistent threats difficult to detect and defend against.
An AI-based adaptive defense system for computer networks is adopted. The system acquires user access data and terminal process information through a data acquisition module, constructs multi-dimensional feature vectors using a behavior correlation module, compares network behavior with the behavior of terminal processes, and generates adaptive defense commands to defend against risks.
It enables the identification of deep coupling between network behavior and terminal processes, improves the accuracy of threat detection, avoids the problems of over-response or under-response in traditional defense systems, and significantly enhances the scientific nature and effectiveness of defense decisions.
Smart Images
Figure CN122268685A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the field of computer network security technology, and more specifically, to an artificial intelligence-based adaptive defense system for computer networks. Background Technology
[0002] Cybersecurity is the use of technical and managerial measures to protect the hardware, software, and data in computer network systems from accidental or malicious damage, alteration, or leakage, ensuring continuous and reliable system operation and uninterrupted network services. Its core objective is to maintain the confidentiality, integrity, and availability of information, prevent threats such as cyberattacks, virus propagation, and unauthorized intrusion, and build a secure and trustworthy network environment.
[0003] Traditional network security defense systems suffer from significant detection blind spots due to the limited analytical dimensions and lack of data correlation. Network layer devices such as firewalls and intrusion detection systems can only monitor packet-level transmission characteristics, while endpoint detection and response systems are limited to host-level process behavior monitoring. This prevents traditional network security defense systems from establishing a causal relationship between network connections and process creation, making it difficult to identify lateral movement initiated by legitimate processes. Furthermore, the lack of correlation analysis capabilities for cross-domain attack chains makes it impossible to spatially and temporally correlate abnormal network traffic with suspicious endpoint behavior. Detection rules based on feature matching from a single data source cannot identify complex attacks that require consideration of both network and endpoint context, allowing complex attacks such as advanced persistent threats to exploit these blind spots and remain dormant for extended periods. Therefore, how to achieve behavioral correlation comparison between network behavior and endpoint processes in computer network defense, thereby improving the accuracy of threat detection, has become a major challenge for the industry. Summary of the Invention
[0004] This application provides an artificial intelligence-based adaptive defense system for computer networks, which can compare the behavioral correlation between network behavior and terminal processes in computer network defense, thereby improving the accuracy of threat detection in computer network defense.
[0005] This application provides an artificial intelligence-based adaptive defense system for computer networks, the defense system comprising:
[0006] The data acquisition module is used to collect user access data and terminal process information in the computer network;
[0007] The behavior association module is used to associate network behavior features in the user access data with process call features in the terminal process information to construct a multi-dimensional feature vector of the current session context, and then determine the behavior association features between network behavior and terminal processes in the computer network based on the multi-dimensional feature vector.
[0008] The behavior comparison module is used to determine the user behavior baseline in the computer network based on the time-series statistical information of the application access habits and process scheduling information of network entities in the computer network within a historical period, and to jointly compare the user behavior baseline and the behavior-related features to obtain the feature dimensions and joint risk score of the computer network's behavior deviation in the current session environment.
[0009] The risk defense module is used to generate adaptive defense instructions for the computer network based on the feature dimensions of the behavioral deviation when the joint risk score is greater than the defense threshold of the computer network, and then use the adaptive defense instructions to perform risk defense on the computer network.
[0010] In this embodiment, the process of associating network behavior features in the user access data with process call features in the terminal process information to construct a multi-dimensional feature vector of the current session context specifically includes:
[0011] Obtain network behavior characteristics from the user access data and process call characteristics from the terminal process information;
[0012] By aligning the network behavior features and the process call features, multiple feature association chains between user access and terminal processes are obtained.
[0013] Extract the mapping relationship between network behavior features and process call features in each feature association chain;
[0014] The multidimensional feature vector of the current session context is determined by all mapping associations.
[0015] In this embodiment, determining the behavioral association features between network behavior and terminal processes in a computer network based on the multidimensional feature vector specifically includes:
[0016] Cross-calculation is performed on the network behavior features and process call features in the multi-dimensional feature vector to generate the interaction features between network behavior and terminal processes in each feature dimension.
[0017] Determine the attention weights of each feature dimension for computer network security;
[0018] By using various attention weights, all interaction features are fused into behavioral correlation features between network behavior and terminal processes in a computer network.
[0019] In this embodiment, the defense threshold of the computer network is a dynamic boundary value that defines normal business fluctuations and potential threat behaviors.
[0020] In this embodiment, determining the user behavior baseline in the computer network based on the time-series statistics of application access habits and process scheduling information of network entities in the computer network over a historical period specifically includes:
[0021] Time-window aggregation is performed on the application access habits and process scheduling information of network entities in the computer network within historical periods to obtain time-series statistics.
[0022] Extract historical behavior-related feature vectors from the time-series statistical information;
[0023] The baseline of user behavior in a computer network is determined by the historical behavior associated feature vector.
[0024] In this embodiment, the joint comparison of the user behavior baseline and the behavior-related features to obtain the feature dimensions and joint risk score of the computer network's behavior deviation in the current session environment specifically includes:
[0025] Supervised threat classification is performed on the behavioral association features to obtain the threat probability score of the computer network in the current session environment;
[0026] The baseline of user behavior and the associated features are compared to obtain the baseline deviation information of the computer network in the current session environment.
[0027] The baseline deviation information is used to extract the feature dimensions of the computer network’s behavioral deviation in the current session environment, and the baseline deviation information and the threat probability score are used to determine the joint risk score of the computer network’s behavioral deviation in the current session environment.
[0028] In this embodiment, generating adaptive defense instructions for the computer network based on the feature dimensions of the behavioral deviation specifically includes:
[0029] Map the feature dimensions of the behavioral deviations to the risk root cause categories of the computer network;
[0030] Based on the aforementioned risk root cause categories, defensive actions for the computer network are selected from the computer network defense strategy knowledge base.
[0031] The strength parameter of the defense action is limited by the score difference between the joint risk score and the defense threshold of the computer network;
[0032] The defensive actions after limiting the strength parameters are converted into adaptive defense instructions for the computer network.
[0033] In this embodiment, using the adaptive defense command to perform risk defense on the computer network specifically includes:
[0034] The adaptive defense command is used as a configuration command for security devices in a computer network to complete the risk defense of the computer network.
[0035] In this embodiment, the user access data includes request metadata, network flow records, and authentication log information.
[0036] In this embodiment, the terminal process information includes process creation chain information, process call sequence, and file and registry operation records.
[0037] The technical solutions provided by the embodiments disclosed in this application have the following beneficial effects:
[0038] The system collects user access data and terminal process information from the computer network; it then correlates network behavior features from the user access data with process call features from the terminal process information to construct a multi-dimensional feature vector for the current session context, and determines the behavioral correlation features between network behavior and terminal processes based on the multi-dimensional feature vector; it determines the user behavior baseline in the computer network based on the time-series statistics of application access habits and process scheduling information of network entities in the computer network over historical periods, and jointly compares the user behavior baseline and the behavioral correlation features to obtain the feature dimensions and joint risk score of the computer network's behavioral deviation in the current session environment; when the joint risk score is greater than the computer network's defense threshold, it generates an adaptive defense instruction for the computer network based on the feature dimensions of the behavioral deviation, and then uses the adaptive defense instruction to perform risk defense on the computer network.
[0039] Therefore, this application demonstrates that, firstly, determining behavioral correlation features reveals the deep coupling relationship between network and terminal behavior, thereby constructing cross-domain security analysis capabilities. Through the multi-dimensional feature vector constructed via feature correlation, the request patterns and access rules of network sessions are deeply integrated with the underlying behaviors of terminal processes, such as system calls and resource operations. This coupling relationship accurately reveals the essential correlation between network behavior and terminal process initiation. When attackers attempt lateral movement through legitimate processes, or when malware triggers abnormal network connections during terminal execution, this deep coupling relationship can identify hidden threats that traditional single-dimensional detection methods cannot detect. This allows computer networks to no longer rely on single-dimensional abnormal indicators, but instead establish a complete behavioral map from the collaborative perspective of the network and terminal. Secondly, determining the feature dimensions and joint risk scoring yields threat localization results based on quantitative assessment, enabling precise adaptive defense decisions. By comparing real-time behavioral correlation features with dynamic user behavior baselines across multiple dimensions, risk assessment results with clear semantic interpretations are generated. The joint risk score comprehensively reflects the degree of deviation of the current session from the historical normal pattern and its threat probability, while the feature dimension positioning precisely points out the specific behavioral characteristics that lead to the risk score. This enables the defense system to select a matching response strategy based on the severity and type of the threat, avoiding the over-response or under-response problems common in traditional defense systems, and significantly improving the scientific nature and effectiveness of defense decisions.
[0040] In summary, the technical solution adopted in this application can realize the behavioral correlation comparison between network behavior and terminal processes in computer network defense, thereby improving the accuracy of threat detection in computer network defense. Attached Figure Description
[0041] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only for this embodiment of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0042] Figure 1 This is a modular structure diagram of an AI-based adaptive defense system for computer networks provided in this application;
[0043] Figure 2 This is an exemplary flowchart for determining behavioral association features provided in this application;
[0044] Figure 3 This is an exemplary flowchart for determining a user behavior baseline according to the present application. Detailed Implementation
[0045] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0046] To better understand the above technical solutions, a detailed description of the technical solutions will be provided below in conjunction with the accompanying drawings and specific embodiments. (Refer to...) Figure 1 As shown in the figure, this is a modular structure diagram of an artificial intelligence-based adaptive defense system for computer networks according to this embodiment of the present application. The system includes: a data acquisition module 100, a behavior association module 200, a behavior comparison module 300, and a risk defense module 400, which are described below:
[0047] The data acquisition module 100 is used to collect user access data and terminal process information in the computer network.
[0048] It should be noted that, in this application, the user access data includes request metadata, network flow records, and authentication log information. Request metadata is a structured data set used to describe the basic attributes of user interaction with network applications; network flow records are standardized data records used to statistically describe the characteristics of network communication session traffic; and authentication log information is security audit data used to record the entire process of user authentication events. The terminal process information includes process creation chain information, process call sequences, and file and registry operation records. Process creation chain information is monitoring data used to describe the parent-child derivation relationship between processes and the process's own attributes; the process call sequence is a time-series operation sequence used to record the behavioral trajectory of a process requesting services from the operating system kernel; and file and registry operation records are security event data used to monitor processes' modifications to the file system and system configuration.
[0049] In practice, firstly, a log collection agent is deployed at the network boundary and core servers. This agent continuously extracts raw logs containing request metadata, network flow records, and authentication log information from web servers, network devices, and authentication systems. For request metadata, the agent parses fields such as the Uniform Resource Identifier, request method, and user agent from the Hypertext Transfer Protocol (HTTP) request header. For network flow records, the agent collects communication quintuples and byte count information from network devices via the NetFlow protocol. For authentication log information, the agent obtains information from the Remote Authentication Dial-In User Service (RADIUS). The system collects login time, username, and authentication results from RADIUS Service; it uses the collection of request metadata, network flow records, and authentication log information as user access data in the computer network; then, by installing a collection agent with system kernel-level access permissions on the user terminal, this agent continuously monitors all process activities, including process creation chain information, process call sequences, and file and registry operation records, by hooking into relevant system kernel interfaces; for process creation chain information, the agent records the process identifier, parent process identifier, and process image path when the operating system kernel generates a new process event; for process call sequences, the agent intercepts kernel system call interfaces and records the system call numbers and parameters executed by the process in chronological order; for file and registry operation records, the agent monitors file system filter drivers and registry callback functions to capture process read, write, and delete operations on files, as well as modification and query operations on registry keys; thus, the collection of process creation chain information, process call sequences, and file and registry operation records is used as terminal process information in the computer network.
[0050] The behavior association module 200 is used to associate network behavior features in the user access data with process call features in the terminal process information to construct a multi-dimensional feature vector of the current session context, and then determine the behavior association features between network behavior and terminal processes in the computer network based on the multi-dimensional feature vector.
[0051] In this embodiment, the following steps can be used to construct a multi-dimensional feature vector of the current session context by associating the network behavior features in the user access data and the process call features in the terminal process information:
[0052] Obtain network behavior characteristics from the user access data and process call characteristics from the terminal process information;
[0053] By aligning the network behavior features and the process call features, multiple feature association chains between user access and terminal processes are obtained.
[0054] Extract the mapping relationship between network behavior features and process call features in each feature association chain;
[0055] The multidimensional feature vector of the current session context is determined by all mapping associations.
[0056] It should be noted that in this application, the multidimensional feature vector is a numerical representation used to comprehensively characterize the overall security status of the current network session and its associated processes; the network behavior feature is a set of numerical indicators used to quantitatively describe the user's activity patterns at the network communication level; the process call feature is a set of numerical indicators used to quantitatively describe the terminal process's activity patterns at the operating system level; the feature association chain is a spatiotemporal association record used to establish the correspondence between a single network session and the terminal process activity that triggered the session; and the mapping association is a quantitative association model describing the cross-domain coupling and collaborative change relationship between the network behavior feature and the process call feature.
[0057] In specific implementation, firstly, request frequency is statistically analyzed from user access data. The average duration of all access processes in the user access data is taken as the session duration, and the standard deviation of the number of accesses to each access object in the user access data is taken as the access target concentration. Thus, the set of request frequency, access target concentration, and session duration is taken as the network behavior feature. Simultaneously, process call frequency, process tree depth, and number of loaded modules are statistically analyzed from terminal process information. The set of all process call frequencies, process tree depths, and number of loaded modules is taken as the process call feature. Secondly, using the start timestamp, source IP address, and destination port of the network session as the base key, within a preset time tolerance window (default 1 second), the process records with the same source IP address and whose network connection event timestamps fall within the window are searched in the terminal process information. By comparing the five-tuple information of the network session with the five-tuple information in the process network connection record, each successful match of a network session to a terminal process generates a record containing all network connections of that session. The system obtains a record corresponding to the network behavior features and all process call features of the process. This record is then used as a feature association chain to obtain multiple feature association chains between user access and terminal processes. For each feature association chain, the Pearson correlation coefficient between each network behavior feature and each process call feature is calculated as the significant correlation. When the significant correlation is greater than a preset feature correlation threshold (default 0.6), a significantly correlated feature pair is determined to exist in the feature association chain. A linear regression model is then used to fit the numerical relationship between the network behavior features and process call features to determine their slope and intercept. The significant correlation, slope, and intercept are used as a mapping relationship. All obtained mapping relationships are used as the mapping relationships between network behavior features and process call features in the feature association chain. This process yields the mapping relationships between network behavior features and process call features in each feature association chain. Finally, the set of all mapping relationships is used as the multidimensional feature vector of the current session context.
[0058] Preferably, in this embodiment, reference Figure 2 As shown, this diagram is an exemplary flowchart for determining behavioral association features in an embodiment of this application. In this embodiment, determining the behavioral association features between network behavior and terminal processes in a computer network based on the multidimensional feature vector can be achieved using the following steps:
[0059] In step S21, the network behavior features and process call features in the multidimensional feature vector are cross-calculated to generate the interaction features between network behavior and terminal processes in each feature dimension.
[0060] In step S22, the attention weight of each feature dimension for computer network security is determined;
[0061] In step S23, all interaction features are fused into behavioral correlation features between network behavior and terminal processes in the computer network by using each attention weight.
[0062] It should be noted that, in this application, behavioral association features are features used to comprehensively express the joint security posture between user behavior and terminal processes in a network session; interaction features are a set of derived features used to quantify the nonlinear synergistic effect between network behavior features and process call features; and attention weights are a set of weight coefficients used to identify the relative importance of different feature dimensions in judging the overall network security status.
[0063] In specific implementation, firstly, the multidimensional feature vector is traversed. For each value belonging to network behavior features and each value belonging to process call features in the multidimensional feature vector, a preset binary mathematical operation is performed. This binary mathematical operation includes, but is not limited to, calculating the product, ratio, difference, and absolute value difference of the corresponding values of the two sets of features. The result value of each binary mathematical operation is used as a new feature term. All newly generated feature terms together constitute the interaction features describing the deep coupling relationship between network activity and process activity. Then, the interaction features are concatenated with the original features in the multidimensional feature vector to form an extended feature set, which is then input into a feedforward neural network. This feedforward neural network performs a nonlinear transformation on the extended feature set through its hidden layers, ultimately... In the output layer, a probability distribution vector of the same length as the input feature dimension is generated through a Softmax activation function. Each value in this probability distribution vector represents the degree of attention given to the corresponding feature dimension in the comprehensive security assessment. Each value is used as an attention weight to obtain the attention weight of each feature dimension for computer network security. Finally, each attention weight is multiplied by the feature value at the corresponding position in the extended feature set to achieve weighting of all feature dimensions. All weighted feature values are concatenated in their original order to form a weighted extended feature vector. This weighted extended feature vector is input into a fully connected layer for dimensionality reduction and information compression. The output vector of this fully connected layer is used as the behavioral correlation feature between network behavior and terminal processes in the computer network.
[0064] The behavior comparison module 300 is used to determine the user behavior baseline in the computer network based on the time-series statistical information of the application access habits and process scheduling information of network entities in the computer network within a historical period, and to jointly compare the user behavior baseline and the behavior-related features to obtain the feature dimensions and joint risk score of the behavior deviation of the computer network in the current session environment.
[0065] Preferably, in this embodiment, reference Figure 3As shown, this diagram is an exemplary flowchart for determining the user behavior baseline in an embodiment of this application. In this embodiment, determining the user behavior baseline in a computer network based on the time-series statistics of application access habits and process scheduling information of network entities in a historical period can be achieved through the following steps:
[0066] In step S31, time window aggregation is performed on the application access habits and process scheduling information of network entities in the computer network within the historical period to obtain time-series statistics.
[0067] In step S32, historical behavior association feature vectors in the computer network are extracted from the time-series statistics;
[0068] In step S33, the baseline of user behavior in the computer network is determined by the historical behavior associated feature vector.
[0069] It should be noted that, in this application, the user behavior baseline is a behavior parameter used to define the range of normal behavior of network entities as a benchmark for subsequent anomaly comparison; the time series statistics information is a statistical sequence used to describe the distribution and change patterns of network entity behavior within a continuous time interval; and the historical behavior association feature vector is a set of feature vectors used to numerically represent historical normal behavior patterns in a unified feature space.
[0070] In practice, firstly, the historical period is divided into continuous time windows of fixed duration. For each network entity, its application access habits and process scheduling information are aggregated within each time window. For application access habits, the aggregation operation includes counting the number of different application types accessed and calculating the standard deviation of the access frequency. For process scheduling information, the aggregation operation includes counting the total number of processes initiated and calculating the average CPU time occupied by each process. All statistics within each time window are organized in chronological order, and the resulting time-sorted statistical sequence is used as time-series statistics. Then, the statistics related to application access habits and the statistics related to process scheduling information in the time-series statistics are combined. The values are concatenated to form an initial joint feature vector. Principal component analysis is then used to reduce the dimensionality of this initial joint feature vector set to eliminate redundancy and retain core variance. The resulting numerical vector, which represents the historical normal behavior pattern and has a fixed dimension, is then used as the historical behavior-related feature vector. Finally, the set of historical behavior-related feature vectors is used as training data and input into a support vector machine algorithm for unsupervised training. This unsupervised training can find a compact decision boundary that can enclose most of the normal historical behavior-related feature vectors. After training, the decision function and its internal parameters learned by this type of support vector machine algorithm are used as the user behavior baseline of the network entity.
[0071] In this embodiment, the joint comparison of the user behavior baseline and the behavior-related features to obtain the feature dimensions and joint risk score of the computer network's behavior deviation in the current session environment can be achieved through the following steps:
[0072] Supervised threat classification is performed on the behavioral association features to obtain the threat probability score of the computer network in the current session environment;
[0073] The baseline of user behavior and the associated features are compared to obtain the baseline deviation information of the computer network in the current session environment.
[0074] The baseline deviation information is used to extract the feature dimensions of the computer network’s behavioral deviation in the current session environment, and the baseline deviation information and the threat probability score are used to determine the joint risk score of the computer network’s behavioral deviation in the current session environment.
[0075] It should be noted that the joint risk score is a normalized numerical indicator used to comprehensively rate the security risk of the current session by combining external threat intelligence and internal behavioral anomalies; the feature dimension of behavioral deviation is a set of feature identifiers used to locate the specific feature attributes that cause the current session behavior to be judged as abnormal; the threat probability score is a probability value used to quantitatively assess the similarity between the current session behavior and known threat patterns; and the baseline deviation information is a set of feature contributions used to characterize the degree of difference between the current behavior-related features and the historical user behavior baseline.
[0076] In practice, firstly, the preprocessed behavioral association features are input into a pre-trained gradient boosting decision tree model. This model is trained on a dataset containing a large number of labeled normal and malicious behavior samples. The model performs layer-by-layer decision tree judgments on the input behavioral association features, and finally summarizes the results of all trees. The output layer of the gradient boosting decision tree model, after being transformed by the Sigmoid function, yields a value between zero and one, which is used as the threat probability score for the current session. Then, the behavioral association features of the current session are input into a support class corresponding to the established user behavior baseline. In the vector machine model, the symbolic distance from the position of the behavioral association feature in the high-dimensional feature space defined by the user behavior baseline model to its decision boundary is calculated. Simultaneously, the contribution of each feature dimension in the behavioral association feature to this symbolic distance value is calculated. The set of symbolic distance values and the contributions of each feature dimension is used as baseline deviation information. Finally, the contributions of each feature dimension in the baseline deviation information are ranked, and the top K (default 2) feature dimensions with the largest absolute contribution values are selected. The selected feature dimensions are then mapped back to their original semantics, which correspond to specific aspects of network behavior features and process call features, such as "concentration of access targets." The system call process frequency is used as a feature dimension for behavioral deviation; the symbol distance value in the baseline deviation information is processed by min-max normalization and mapped to the range of zero to one as the baseline deviation score; a weighted harmonic mean calculation method is used to fuse the baseline deviation score with the threat probability score, where the weight coefficients are pre-set according to the discriminative efficacy of each score on the historical validation set. Specifically, using the labeled normal or abnormal session samples in the historical validation set, the true positive rate and false positive rate of each score at different thresholds can be calculated, and ROC curves can be plotted to obtain the area under the curve (AUC) for each score. To measure discriminative effectiveness, the AUC values of the two scores are normalized by dividing each score by the sum of their AUCs to obtain their initial weights, ensuring that the sum of the two weights is 1. If a score exhibits higher discriminative power (larger AUC) on the validation set, it will receive a higher weight in the weighted harmonic mean, thus dominating the joint risk score. Conversely, scores with lower discriminative effectiveness are assigned smaller weights to reduce their interference with the fusion result. When the discriminative effectiveness of the two scores is comparable, the weights are equal, and the weighted harmonic mean degenerates into the standard harmonic mean. The result calculated using the weighted harmonic mean is used as the joint risk score for this session.
[0077] The risk defense module 400 is used to generate an adaptive defense instruction for the computer network based on the feature dimension of the behavioral deviation when the joint risk score is greater than the defense threshold of the computer network, and then use the adaptive defense instruction to perform risk defense on the computer network.
[0078] It should be noted that in this application, when the joint risk score exceeds the defense threshold of the computer network, it indicates that the current session behavior has exceeded the acceptable security boundary of the system, and its overall anomaly level has reached a level requiring proactive intervention. The joint risk score integrates anomaly detection based on internal behavioral baselines and maliciousness judgment based on external threat intelligence. When the joint risk score breaks through the defense threshold, it means that not only has a significant deviation from historical normal patterns been detected, but the behavior also exhibits characteristics highly correlated with known threats, forming a double confirmation of internal anomalies and external threats. Proactive defense measures must be taken to block the further development of potential attack chains and prevent security threats from escalating. The defense threshold of the computer network extends from the network layer or terminal layer to core assets. The defense threshold of the computer network is a dynamic boundary value that defines normal business fluctuations and potential threat behaviors. It can be calculated based on historical joint risk score samples accumulated during a clean and normal operation and maintenance cycle of the computer network. A statistical distribution analysis method is used to calculate a specified high quantile (default 99th percentile) of the normal sample score value, and this value, after calibration by security experts, is used as the initial defense threshold for the computer network. During the operation of the computer network, the distribution changes of the joint risk score are continuously monitored, and the high quantile value is periodically recalculated using a sliding window mechanism to achieve dynamic adaptive updates of the defense threshold.
[0079] In this embodiment, generating adaptive defense instructions for the computer network based on the feature dimensions of the behavioral deviation can be achieved through the following steps:
[0080] Map the feature dimensions of the behavioral deviations to the risk root cause categories of the computer network;
[0081] Based on the aforementioned risk root cause categories, defensive actions for the computer network are selected from the computer network defense strategy knowledge base.
[0082] The strength parameter of the defense action is limited by the score difference between the joint risk score and the defense threshold of the computer network;
[0083] The defensive actions after limiting the strength parameters are converted into adaptive defense instructions for the computer network.
[0084] It should be noted that adaptive defense commands are standardized command data used to drive downstream security devices to perform precise protection operations; risk root cause categories are standardized classification labels used to categorize abnormal security behaviors from the perspective of attack techniques and tactics; defense actions are a set of specific operations used to directly curb or mitigate specific risk root cause categories; and strength parameters are quantifiable configuration values used to control the strength of defense action execution.
[0085] In practical implementation, firstly, based on a predefined feature semantic-root cause mapping table, each feature dimension is mapped to its corresponding potential malicious behavior; for example, "abnormally high concentration of access targets" is mapped to "data infiltration attempt," and "abnormal frequency of system call processes" is mapped to "malicious code execution." When multiple feature dimensions point to the same type of malicious behavior, they are merged, and the threat nature exhibited by the current session is ultimately determined as one or more risk root cause categories, thus obtaining the risk root cause categories of the computer network. Secondly, a pre-built defense strategy knowledge base is accessed. This knowledge base stores a list of corresponding handling operations, with the risk root cause category as the primary key. All countermeasures related to risk root cause categories are retrieved from this knowledge base. For example, for "data..." The root cause of the "penetration attempt" was identified, and the actions retrieved included "network session rate limiting" and "initiating a data loss prevention scan." All countermeasures were considered as the defense actions for the computer network. Then, the numerical difference between the joint risk score and the defense threshold was calculated, and this difference was input into a predefined parameter mapping function. This parameter mapping function calculated the specific operational strength value for each defense action based on the magnitude of the difference. The difference value (ΔR) was input into the predefined parameter mapping function, which uses a piecewise linear mapping or a sigmoid function mapping to calculate the specific operational strength value for each defense action based on the magnitude of the difference. For defense actions requiring continuous strength values (e.g., network session rate limiting), a piecewise linear mapping function was used, with the specific calculation formula as follows:
[0086]
[0087] Where base is the minimum force base, k is the preset mapping slope, and ΔR max The upper limit threshold for the difference value is `max_value`, which is the maximum allowable strength value for this action. For defensive actions that require discrete decision output (e.g., process tree termination), a sigmoid probability mapping function is used to determine the probability of terminating the parent process.
[0088]
[0089] Where α is the sensitivity coefficient and β is the decision bias threshold; when P exceeds 0.5, the parent process terminates; otherwise, only the target child process is terminated; the larger the difference value ΔR, the higher the probability of terminating the parent process, achieving adaptive matching of risk and defense intensity; it should be noted that although the record mentions a predefined parameter mapping function and calculates the operational strength value based on the difference value, the specific calculation formula of this function is not recorded (e.g., the slope k of the piecewise linear mapping and the upper limit threshold ΔR). max(Sensitivity coefficients α and bias β of the S-shaped mapping, etc.) In actual implementation, they need to be configured separately based on the aggressiveness of the defense strategy and the tolerance of the business, combined with historical experience, which will not be elaborated here; Each operation strength value is used as the strength parameter of the corresponding defense action, which can complete the limitation of the strength parameter in the defense action; Finally, the defense action with the assigned strength parameter is encapsulated according to the predetermined instruction template; The instruction template contains the target device type, action type, strength parameter, execution object identifier, and instruction validity period; Finally, the encapsulated standardized data packet is sent to the policy execution layer as an adaptive defense instruction that can be parsed and executed by the network controller or terminal agent.
[0090] In this embodiment, the risk defense of the computer network using the adaptive defense command can be achieved through the following steps:
[0091] The adaptive defense command is used as a configuration command for security devices in a computer network to complete the risk defense of the computer network.
[0092] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.
[0093] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-Erasable Programmable Read-Only Memory (EEPROM), compactdisc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium capable of carrying or storing data.
[0094] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.
Claims
1. An adaptive defense system for computer networks based on artificial intelligence, characterized in that, The defense system includes: The data acquisition module is used to collect user access data and terminal process information in the computer network; The behavior association module is used to associate network behavior features in the user access data with process call features in the terminal process information to construct a multi-dimensional feature vector of the current session context, and then determine the behavior association features between network behavior and terminal processes in the computer network based on the multi-dimensional feature vector. The behavior comparison module is used to determine the user behavior baseline in the computer network based on the time-series statistical information of the application access habits and process scheduling information of network entities in the computer network within a historical period, and to jointly compare the user behavior baseline and the behavior-related features to obtain the feature dimensions and joint risk score of the computer network's behavior deviation in the current session environment. The risk defense module is used to generate adaptive defense instructions for the computer network based on the feature dimensions of the behavioral deviation when the joint risk score is greater than the defense threshold of the computer network, and then use the adaptive defense instructions to perform risk defense on the computer network.
2. The artificial intelligence-based adaptive defense system for computer networks as described in claim 1, characterized in that, The process of associating network behavior features from the user access data with process call features from the terminal process information to construct a multidimensional feature vector for the current session context specifically includes: Obtain network behavior characteristics from the user access data and process call characteristics from the terminal process information; By aligning the network behavior features and the process call features, multiple feature association chains between user access and terminal processes are obtained. Extract the mapping relationship between network behavior features and process call features in each feature association chain; The multidimensional feature vector of the current session context is determined by all mapping associations.
3. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, Determining the behavioral correlation features between network behavior and terminal processes in a computer network based on the multidimensional feature vector specifically includes: Cross-calculation is performed on the network behavior features and process call features in the multi-dimensional feature vector to generate the interaction features between network behavior and terminal processes in each feature dimension. Determine the attention weights of each feature dimension for computer network security; By using various attention weights, all interaction features are fused into behavioral correlation features between network behavior and terminal processes in a computer network.
4. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, The defense threshold of the computer network is a dynamic boundary value that defines normal business fluctuations and potential threat behaviors.
5. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, Determining the user behavior baseline in a computer network based on the time-series statistics of application access habits and process scheduling information of network entities within a historical period specifically includes: Time-window aggregation is performed on the application access habits and process scheduling information of network entities in the computer network within historical periods to obtain time-series statistics. Extract historical behavior-related feature vectors from the time-series statistical information; The baseline of user behavior in a computer network is determined by the historical behavior associated feature vector.
6. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, The user behavior baseline and the behavior-related features are jointly compared to obtain the feature dimensions and joint risk score of the computer network's behavioral deviation in the current session environment. Specifically, this includes: Supervised threat classification is performed on the behavioral association features to obtain the threat probability score of the computer network in the current session environment; The baseline of user behavior and the associated features are compared to obtain the baseline deviation information of the computer network in the current session environment. The baseline deviation information is used to extract the feature dimensions of the computer network’s behavioral deviation in the current session environment, and the baseline deviation information and the threat probability score are used to determine the joint risk score of the computer network’s behavioral deviation in the current session environment.
7. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, The adaptive defense instructions for computer networks generated based on the feature dimensions of the aforementioned behavioral deviations specifically include: Map the feature dimensions of the behavioral deviations to the risk root cause categories of the computer network; Based on the aforementioned risk root cause categories, defensive actions for the computer network are selected from the computer network defense strategy knowledge base. The strength parameter of the defense action is limited by the score difference between the joint risk score and the defense threshold of the computer network; The defensive actions after limiting the strength parameters are converted into adaptive defense instructions for the computer network.
8. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, Using the aforementioned adaptive defense instructions to perform risk defense on computer networks specifically includes: The adaptive defense command is used as a configuration command for security devices in a computer network to complete the risk defense of the computer network.
9. The adaptive defense system for computer networks based on artificial intelligence as described in claim 1, characterized in that, The user access data includes request metadata, network flow records, and authentication log information.
10. The artificial intelligence-based adaptive defense system for computer networks as described in claim 1, characterized in that, The terminal process information includes process creation chain information, process call sequence, and file and registry operation records.