An AI-driven network intrusion dynamic detection and adaptive defense method and device

Abstract

The application provides an AI-driven network intrusion dynamic detection and adaptive defense method and device, which comprises the following steps: collecting and converging network operation data of a target network; performing intelligent detection on the network operation data to output intrusion-related feature information; constructing an attack chain graph based on the intrusion-related feature information, identifying key breakpoints of the attack chain and completing priority evaluation; generating and executing a cross-node linkage defense strategy according to the type and priority of the key breakpoints, and collecting defense execution data; and based on the defense execution data and the intrusion-related feature information, dynamically iterating and optimizing the detection model, evaluation index and defense strategy. The application realizes high-precision real-time dynamic detection and response of network attack behavior, forms a closed-loop system of detection-response-optimization through attack chain key breakpoint identification and cross-node linkage defense, and significantly improves the active containment capability for multi-stage and cross-node attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an AI-driven method and apparatus for dynamic detection and adaptive defense of network intrusions. Background Technology

[0002] With the continuous evolution of cyberattack methods, new threats such as advanced persistent threats (APPTs), ransomware, and multi-stage phishing attacks are emerging in an endless stream, posing a severe challenge to cybersecurity defense systems. Attackers are constantly evolving their attack methods, employing techniques such as obfuscation, encryption, and time evasion to bypass detection mechanisms, making traditional protection methods based on static rules unable to adapt to the changing environment in a timely manner. Currently, cybersecurity defense technologies are mainly researched and applied in the following directions:

[0003] Intrusion detection systems (IDS), as the cornerstone of cybersecurity, have evolved from feature-based matching to machine learning-based approaches. Traditional IDS effectively identify known attacks by matching attack features using predefined rule bases, but their ability to detect unknown threats and variant attacks is limited. In recent years, deep learning technology has been introduced into the field of intrusion detection, demonstrating superior performance by detecting complex network traffic patterns and unknown attacks thanks to its powerful pattern-capturing capabilities. However, deep learning-based detection systems have significant limitations in practical applications: a semantic gap exists between detection results and actionable interpretations, making it difficult to support proactive intrusion response; the cost of errors is high, and black-box predictions are difficult for security operations personnel to trust, stemming from a lack of interpretability. Furthermore, static analysis methods are ineffective in identifying disguised polymorphic malware, while dynamic detection methods, although able to bypass code obfuscation and other protection mechanisms, face problems such as high computational overhead, high false positive rates, and difficulty in making decisions without analyzing complete business processing records.

[0004] Regarding the response to detected threats, existing research has proposed a collaborative defense mechanism linking Intrusion Detection Systems (IDS) and firewalls. This mechanism converts attack characteristics detected by the IDS into firewall rules in real time, forming a complete closed loop from threat identification to blocking. Its ability to instantly intercept attack behaviors has been verified in experimental environments. A typical collaborative system architecture includes a data acquisition layer, a rule conversion layer, and a policy enforcement layer, with an average response time reduced to the level of a few seconds. However, this collaborative mechanism still has limitations: first, the response actions are relatively simple, mainly relying on firewall blocking and lacking cross-node collaborative handling capabilities; second, rule conversion is based on predefined policy templates, making it difficult to adapt to the dynamic defense needs of complex attack scenarios; and third, it lacks an evaluation and feedback mechanism for the effectiveness of defense execution, making it impossible to adaptively adjust based on actual defense results.

[0005] In attack chain analysis and attribution, extended detection and response technologies integrate endpoint and network detection and response, combining cross-domain data from endpoints, identities, networks, and the cloud to disassemble and identify multi-stage attack chains. By using the ATT&CK framework to mark the tactical steps of the attack chain, fragmented threat information can be transformed into understandable attack scripts, achieving a closed loop from detection to attribution. However, existing solutions primarily focus on identifying and reconstructing attack behaviors, with insufficient research on identifying and prioritizing key breakpoints in the attack chain, making it difficult to guide the precise deployment of defense strategies under limited resources. Furthermore, attack behaviors often involve complex chains with multiple nodes and stages, while existing defenses mostly focus on single-point protection or local coordination, lacking situational awareness and coordinated control capabilities from a global network perspective. When attackers move laterally within the internal network, blocking a single node is insufficient to curb the spread of the attack.

[0006] In summary, how to construct a closed-loop defense system that integrates data collection, intelligent detection, attack chain analysis, cross-node collaborative defense, and dynamic optimization, and realize the transformation from passive response to proactive defense, has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0007] The present invention aims to at least partially solve one of the technical problems in the related art.

[0008] Therefore, the first objective of this invention is to propose an AI-driven method for dynamic detection and adaptive defense of network intrusions.

[0009] Another objective of this invention is to propose an AI-driven dynamic detection and adaptive defense device for network intrusion.

[0010] The third objective of this invention is to provide a computer device.

[0011] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0012] To achieve the above objectives, a first aspect of the present invention proposes an AI-driven dynamic detection and adaptive defense method for network intrusion, comprising: S1, collects and aggregates network operation data of the target network; S2, intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; S3, construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain and complete priority evaluation; S4. Generate and execute cross-node linkage defense strategies based on the type and priority of the key breakpoints, and collect defense execution data; S5. Based on the defense execution data and intrusion-related feature information, perform dynamic iterative optimization of the detection model, evaluation indicators, and defense strategies.

[0013] In one embodiment of the present invention, the collection and aggregation of network operation data of the target network includes: A distributed, non-intrusive data collection method is adopted. The collected network operation data includes network traffic data, node log data, port status data, and data packet characteristic data. After collection, the network operation data is encrypted during transmission and centrally stored.

[0014] In one embodiment of the present invention, the intelligent detection of intrusion behavior on the network operation data includes: Standardized feature data is obtained by preprocessing network operation data; Deep learning models are used to mine intrusion behavior-related features from standardized feature data and generate high-dimensional feature vectors. The high-dimensional feature vector is calculated based on the classification model, and the intrusion behavior judgment result, intrusion type identifier and corresponding intrusion-related feature information are output.

[0015] In one embodiment of the present invention, the step of constructing an attack chain graph based on the intrusion-related feature information, identifying key breakpoints in the attack chain, and completing priority evaluation includes: By combining network asset topology information, the attack transfer probability and attack path reachability between network nodes are calculated through attack path mining algorithms, effective attack paths are screened and integrated to generate an attack chain graph. The actual characteristics of each node in the attack chain graph are matched with the preset breakpoint standard characteristics to identify multiple types of key breakpoints. Then, the key breakpoints are quantitatively scored and prioritized using a multi-dimensional evaluation index system.

[0016] In one embodiment of the present invention, generating and executing a cross-node coordinated defense strategy based on the type and priority of the key breakpoints includes: Match differentiated defense strategies to critical breakpoints of different priorities; Based on the type of critical breakpoint, the corresponding execution node is determined. After binding the defense strategy with the execution node, a standardized cross-node linkage defense command is generated and sent to the corresponding execution node to complete the defense operation.

[0017] In one embodiment of the present invention, the dynamic iterative optimization of the detection model and defense strategy based on the defense execution data and intrusion-related feature information includes: Incremental training datasets are constructed by fusing defense execution data with intrusion-related feature information. Incremental training and parameter fine-tuning were performed on the deep learning model used for intrusion detection. Adjust the weights of breakpoint priority evaluation metrics based on the effectiveness of defense execution, and update and match the weights of the defense strategy library.

[0018] To achieve the above objectives, a second aspect of the present invention provides an AI-driven dynamic detection and adaptive defense device for network intrusion, comprising: The data acquisition and aggregation module is used to collect and aggregate network operation data of the target network. The intrusion detection module is used to intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; The attack chain analysis and evaluation module is used to construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain, and complete priority evaluation. The coordinated defense execution module is used to generate and execute cross-node coordinated defense strategies based on the type and priority of the key breakpoints, and to collect defense execution data. The dynamic iterative optimization module is used to perform dynamic iterative optimization of the detection model, evaluation indicators, and defense strategies based on the defense execution data and intrusion-related feature information.

[0019] This invention discloses an AI-driven dynamic detection and adaptive defense method and apparatus for network intrusion, which realizes high-precision real-time dynamic detection and response to network attack behavior, improves the system's defense reliability and strategy flexibility, and meets the needs of autonomous controllability and intelligent defense of information infrastructure.

[0020] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor reads executable program code stored in the memory to run a program corresponding to the executable program code, for implementing an AI-driven dynamic detection and adaptive defense method for network intrusion as described in the first aspect embodiment.

[0021] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an AI-driven dynamic detection and adaptive defense method for network intrusion as described in the first aspect.

[0022] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0023] Figure 1This is a flowchart of an AI-driven dynamic detection and adaptive defense method for network intrusion according to an embodiment of the present invention; Figure 2 This is a system flow chart according to an embodiment of the present invention; Figure 3 This is a system flowchart according to an embodiment of the present invention; Figure 4 This is an intrusion feature vector and network asset topology information diagram according to an embodiment of the present invention; Figure 5 This is a structural diagram of an AI-driven network intrusion dynamic detection and adaptive defense device according to an embodiment of the present invention; Figure 6 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0024] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0025] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0026] The following description, with reference to the accompanying drawings, describes an AI-driven dynamic detection and adaptive defense method and apparatus for network intrusion according to an embodiment of the present invention.

[0027] Figure 1 This is a flowchart of an AI-driven dynamic detection and adaptive defense method for network intrusion according to an embodiment of the present invention, such as... Figure 1 and Figure 2 As shown, it includes: S1, collects and aggregates network operation data of the target network; S2, intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; S3, construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain and complete priority evaluation; S4. Generate and execute cross-node linkage defense strategies based on the type and priority of the key breakpoints, and collect defense execution data; S5. Based on the defense execution data and intrusion-related feature information, perform dynamic iterative optimization of the detection model, evaluation indicators, and defense strategies.

[0028] like Figure 3 As shown, the complete workflow of the AI-driven network intrusion dynamic detection and adaptive defense system of the present invention is as follows: Data acquisition phase: Distributed acquisition terminals collect network traffic, node logs, port status, packet characteristics and other data in real time, and store the encrypted data in the distributed cache cluster of the regional data center. AI dynamic detection stage: The AI ​​dynamic detection module reads data from the cache cluster, and after normalization, noise reduction and dimensionality reduction preprocessing, it mines core features through the Transformer feature extraction model, and the multilayer perceptron classification model determines whether there is intrusion behavior, outputs intrusion type and feature vector and stores them. Attack chain analysis phase: The attack chain breakpoint identification and priority evaluation module, based on intrusion feature vectors and network asset topology maps, generates an attack chain node association map through attack path mining algorithms, identifies three types of key breakpoints, and uses the analytic hierarchy process (AHP) and fuzzy comprehensive evaluation method to complete the breakpoint priority ranking. Defense decision-making phase: The defense decision-making module matches the optimal defense strategy from the strategy library based on the breakpoint type and priority, determines the corresponding execution node, generates cross-node linkage defense instructions and issues them; Strategy execution phase: Each execution node receives instructions, performs defensive operations such as vulnerability patching, traffic filtering, and sandbox isolation, and collects and uploads execution data at the same time; Feedback optimization phase: The feedback optimization module uses execution data and intrusion feature vectors to construct an incremental dataset, optimize the deep learning detection model, adjust the weights of evaluation indicators, and update the defense strategy library, forming a closed-loop optimization mechanism.

[0029] This invention discloses an AI-driven dynamic detection and adaptive defense method and apparatus for network intrusion, aiming to solve the problems of traditional network defense systems such as lagging detection, rigid defense strategies, and weak cross-node collaboration capabilities. Through distributed data acquisition, AI intelligent detection, precise attack chain analysis, adaptive defense decision-making, and a closed-loop optimization mechanism, it achieves real-time identification, precise blocking, and dynamic optimization of network intrusion behavior. The system adopts a modular architecture design, such as... Figure 3 As shown, the system specifically includes a data acquisition module, an AI dynamic detection module, an attack chain breakpoint identification and priority assessment module, a defense decision module, a strategy execution module, and a feedback optimization module. Each module achieves data interaction and command transmission through standardized data interfaces to ensure the system's high efficiency and stability.

[0030] The data acquisition module adopts a distributed architecture design based on edge computing. Embedded acquisition terminals are deployed in different network locations, such as core network links, edge access nodes, and key server terminals. All acquisition terminals form a private acquisition network through industrial-grade switches to ensure the security and real-time performance of data transmission. The acquisition terminals use a non-intrusive acquisition method, acquiring network data through technologies such as port mirroring and traffic splitting, without directly connecting to business links to avoid affecting the normal operation of the network. The specific data collected includes: network traffic data, node log data, port status data, and packet characteristic data. Among them, network traffic data covers fields such as source IP, destination IP, port number, packet length, transmission rate, and session duration of TCP / UDP protocol packets; node log data includes system logs, application logs, and security logs of servers, switches, and terminal devices, recording events such as login behavior, process startup, file operations, and permission changes; port status data includes real-time monitoring of the port open status, number of connections, data transmission and reception volume, and error codes of each network node; packet characteristic data includes extracting key information such as packet header fields, payload characteristics, protocol identifiers, and encryption types of packets to form standardized characteristic records.

[0031] The data acquisition terminal aggregates the raw data collected to the regional data center via an encrypted transmission protocol. The data center uses a distributed cache cluster to temporarily store the aggregated data, ensuring that the AI ​​dynamic detection module can acquire data in real time.

[0032] The AI ​​dynamic detection module uses the Min-Max normalization algorithm. The original data of different dimensions are mapped to the interval [0, 1], where, For a single original data sample, The minimum value of all data in this dimension. The maximum value of all data in this dimension. For the normalized data, a wavelet denoising algorithm using wavelet basis functions is employed. This involves multi-level wavelet decomposition of the normalized data, followed by the removal of random noise using the db4 wavelet basis function. The core process involves: performing wavelet decomposition on the normalized data to obtain high-frequency and low-frequency coefficients, and then applying a threshold function... ( For data length, High-frequency coefficients are processed to obtain denoised data (using the noise standard deviation); dimensionality reduction is performed based on principal component analysis (PCA) algorithm, with the core formula being: ,in, After noise reduction Dimensional data matrix ( For the sample size, (as feature dimension), Covariance matrix The former The projection matrix consisting of the eigenvectors corresponding to the eigenvalues. For dimensionality reduction The dimensionality is standardized by calculating the covariance matrix of the preprocessed data, solving for the eigenvalues ​​and eigenvectors, and selecting the top N principal components with the required cumulative contribution rate as standardized feature data. This reduces the dimensionality of the original high-dimensional data and improves the efficiency of subsequent feature extraction.

[0033] Feature extraction employs a multi-layer Transformer encoder to construct the feature extraction model. Each encoder layer includes a multi-head attention mechanism and a feedforward neural network. The model uses the multi-head attention mechanism to deeply mine the correlation information of different dimensions and time series in the standardized feature data, capturing the temporal correlation and feature coupling of intrusion behavior. The feedforward neural network performs a non-linear transformation on the features after attention weighting, and optimizes gradient propagation through LayerNorm layers and residual connections, finally outputting a high-dimensional feature vector with a fixed dimension. This vector contains the core feature information of intrusion behavior.

[0034] The classification and judgment model employs a multilayer perceptron structure. The input layer dimension matches the dimension of the high-dimensional feature vector, and multiple hidden layers are set. The number of nodes in the output layer corresponds to the number of common intrusion types. The hidden layers use the ReLU activation function to complete multiple nonlinear mappings and dimensional transformations of the features, enhancing the discriminative power of intrusion behavior features. The output layer uses the Softmax function. A 3-layer MLP is used as the classification model, and the core formula of the output layer Softmax function is: where: For the first The raw output value of the intrusion behavior. Total number of intrusion types (including normal behavior) For the first The probability value of the class; when If an intrusion is detected, an intrusion type identifier and a high-dimensional intrusion feature vector are output. Otherwise, if the intrusion is detected as normal behavior, the probability of the input feature vector belonging to each type of intrusion is calculated, and only the feature vector is recorded. At the same time, a distributed database is used to store the output results in real time. The database table structure includes fields such as intrusion event identifier, intrusion feature vector, intrusion type identifier, determination probability, and collection time. The database cluster is deployed with master and slave nodes to support high-concurrency data reading and writing and disaster recovery backup.

[0035] The attack chain breakpoint identification and priority assessment module is deployed on a dedicated analysis node in a cloud server cluster, such as... Figure 4As shown, based on the intrusion feature vector and network asset topology information output by the AI ​​dynamic detection module, the attack chain graph is constructed, key breakpoints are identified, and priority is evaluated. Network asset topology information is acquired and updated in real time through two methods: Automatic data collection: The network is periodically scanned using SNMP protocol, ICMPping scan, and port scanning tools to obtain the IP address, subnet mask, device type, operating system version, open ports, and details of existing vulnerabilities for each node; Manual input: Administrators can input information such as the physical location, importance, business type, and person in charge of the device through the system backend.

[0036] All information is stored in a graph database to construct a network asset topology map. Node attributes in the map include device identifier, IP address, device type, vulnerability list, and importance. Edge attributes include communication link bandwidth, latency, packet loss rate, and connection status, ensuring the accuracy of the topology information. The attack chain node association map is generated based on the initial attack node identifier, attack behavior characteristics, and network asset topology map contained in the intrusion feature vector. An attack chain node association map is constructed using an attack path mining algorithm. The specific steps are: Based on the source IP address in the intrusion feature vector, locate the initial attack node in the network asset topology map, and extract information such as the vulnerability list, open ports, and communication links of that node; then, using the node transition probability formula... Calculate the attack transfer probability between adjacent nodes, where... This represents an attack starting from the current node. Successfully transferred to the target node The single transition probability, To attack the node To the target node The probability of successfully exploiting the vulnerability. For nodes With nodes The reachability probability of the communication link between them, and then through the attack path reachability formula. Calculate the overall reachability of the attack path to be verified, where To verify the attack path, we start from the initial attack node, match the node vulnerability exploitation probability based on the attack methods corresponding to the intrusion feature vector, and determine the subsequent attack nodes after successful vulnerability exploitation based on the calculation results. We then set a reachability threshold. When the threshold is reached, the attack path is determined to be a valid path. All valid attack transfer paths are integrated, and the attribute information, attack behavior type, attack transmission relationship between nodes, and attack success probability of each path are associated to generate a complete attack chain node association graph. A preset breakpoint feature library is stored in the database, containing standard feature vectors for three types of nodes: vulnerability exploitation nodes, data transmission nodes, and instruction execution nodes. Standard feature vector for vulnerability exploitation nodes: covering feature dimensions such as vulnerability identifier, privilege escalation actions, and vulnerability triggering parameters; Standard feature vector of data transmission node: includes feature dimensions such as traffic throughput characteristics, data encryption identifier, and communication protocol type; Standard feature vector of instruction execution node: It involves feature dimensions such as process creation identifier, remote instruction code features, and system resource call feature parameters.

[0037] The actual feature information of each node in the attack chain node association graph is extracted and standardized according to the feature dimensions of the breakpoint feature library, transforming it into a uniformly dimensional actual feature vector. A cosine similarity matching algorithm is then employed. Calculate the similarity between the actual feature vector of each node and the three types of standard feature vectors, where, These are standard feature vectors from the breakpoint feature library. This represents the actual feature vector of the attack chain node. When a node is identified as a critical breakpoint of the corresponding type, and the similarity between the actual feature vector of a node and the standard feature vector of a certain type reaches a threshold, the node is identified as a critical breakpoint of the corresponding type, thereby accurately identifying three types of critical breakpoints from the attack chain node association graph.

[0038] The breakpoint priority assessment constructs an evaluation index system with the impact of the attack chain and the difficulty of implementing protection as the core dimensions, and uses a combination of the analytic hierarchy process and fuzzy comprehensive evaluation method to complete the priority quantification and ranking: For the construction of the hierarchical model: the target layer is the breakpoint priority assessment, the criterion layer is the attack chain impact degree and the protection implementation difficulty, and the factor layer includes subordinate factors (attack chain impact degree dimension: the probability of attack chain failure after breakpoint blocking, the scope of impact on subsequent attack nodes, and the scale of security loss caused; protection implementation difficulty dimension: the complexity of vulnerability remediation technology, the cost of protection resource investment, and the strategy implementation cycle). By comparing the importance of each level of indicators pairwise, a judgment matrix is ​​constructed. After verifying the rationality of the matrix through consistency testing, the weights of each indicator in the criterion layer and factor layer are calculated using the eigenvector method to ensure that the weight allocation meets the actual evaluation needs. Establish a fuzzy evaluation set and define a quantitative scoring vector. Based on historical data, a fuzzy evaluation matrix is ​​constructed for each subordinate factor. Through fuzzy synthesis operation ,in This represents fuzzy matrix multiplication, yielding a comprehensive evaluation vector. Then, through a comprehensive quantitative scoring formula ,in A comprehensive quantitative score is given to each breakpoint. Quantify the scoring vector The transpose of the result is used to calculate the final quantitative score for each breakpoint; a fixed scoring range is pre-set, and the overall score is within the range of... The division of intervals has high priority. The interval division is of medium priority. The intervals are divided into low-priority intervals to complete the priority level division of the three types of key breakpoints.

[0039] The defense decision module is deployed on the decision nodes of the cloud server cluster. Based on the type and priority assessment results of the attack chain breakpoints, it completes defense strategy matching, execution node determination, and linked defense command generation. The specific implementation process is as follows: Defense strategy library construction and matching: The defense strategy library is stored in a distributed database, classifying and storing defense strategies according to breakpoint type (exploitation node, data transmission node, command execution node) and priority (high, medium, low). Each strategy includes fields such as strategy identifier, strategy name, applicable scenario, operation steps, parameter configuration, and performance cost. For example: Defense strategies for high-priority vulnerability exploitation nodes: emergency patch deployment, forced closure of the corresponding ports, and configuration of targeted protection rules; Defense strategies for medium-priority data transmission nodes: Access Control List (ACL) configuration, abnormal traffic rate limiting, malicious IP communication blocking, and enhanced data transmission encryption; Defense strategies for low-priority instruction execution nodes include: sandboxing suspicious programs for execution, restricting system resource access permissions, and monitoring and terminating abnormal processes.

[0040] The defense decision module matches the optimal defense strategy from the defense strategy library based on the type and priority of the breakpoints, ensuring the strategy's relevance and effectiveness. The execution node determination is based on the network node deployment involved in the attack chain, identifying the corresponding defense execution node according to the breakpoint type: vulnerability exploitation breakpoints correspond to edge detection nodes (i.e., embedded acquisition terminals deployed by the data acquisition module). These nodes are directly deployed at the network edge and can quickly respond to vulnerability patching needs; data transmission breakpoints correspond to core switches. Core switches, as key hubs for network data transmission, can filter and block all network traffic; command execution breakpoints correspond to terminal devices (such as servers and employee office computers), directly restricting malicious behavior at the source of command execution. After the execution node is determined, its online and operational status is verified through a network asset topology map to ensure that the execution node has the conditions for policy execution.

[0041] The coordinated defense command generation process binds the matched defense strategy with the identified execution nodes, generating standardized cross-node coordinated defense commands. These commands are encapsulated in a standardized format, with specific fields including: command identifier, breakpoint identifier, breakpoint type, priority, execution node identifier (multiple nodes are presented as an array), strategy identifier, strategy operation parameters, execution time limit, and feedback requirements (execution result, list of collected metrics). After generation, the commands are distributed to each execution node via an encrypted communication protocol.

[0042] The policy execution module is integrated into network nodes such as edge detection nodes, core switches, and terminal devices. It is responsible for receiving and executing coordinated defense commands, and collecting and executing relevant data. After receiving the command, it first queries the download address of the corresponding patch by the vulnerability identifier, verifies the integrity of the patch file, and then judges the patch compatibility based on the node's operating system version and hardware configuration. If compatible, the patch is automatically installed. After installation, the relevant services are restarted and the installation process log is recorded. It closes the open port corresponding to the vulnerability through firewall commands, and configures port blocking rules to prevent the port from being automatically opened in the future. It loads the protection rules in the command into the local firewall of the edge detection node to block data packets that match the intrusion characteristics in real time.

[0043] Log in to the core switch's management interface, create or update access control lists according to the ACL rule configuration items in the instructions, enable ACL rules and apply them to the corresponding port groups to achieve precise filtering of abnormal traffic; add malicious IP addresses in the instructions to the switch's blacklist, configure blacklist activation rules, and block all communication between blacklisted IPs and nodes within the network; configure traffic rate limiting parameters based on the characteristics of abnormal traffic to prevent abnormal traffic from consuming too many network resources.

[0044] The terminal device executes operations based on a lightweight sandbox environment built using container technology. Suspicious programs are imported into the sandbox, and resource restriction parameters are configured for the sandbox to prohibit the sandbox from accessing sensitive directories and key registry entries on the terminal device. The behavior of programs within the sandbox is monitored in real time. By leveraging the terminal device's operating system permission management functions, the running privileges of suspicious programs are reduced, prohibiting them from calling core system APIs or accessing network shared resources. A terminal security agent is enabled to monitor the process status of suspicious programs in real time. If a process exhibits malicious behavior, the process is immediately terminated and its behavior is logged.

[0045] During the execution of the data collection strategy, each execution node collects the strategy execution status (not executed, executing, executed successfully, executed unsuccessfully), execution time, number of blocking attacks, network resource utilization, and degree of business impact in real time. The collected data is classified and stored according to the instruction identifier and uploaded to the feedback optimization module in real time.

[0046] The feedback optimization module is deployed on the optimization nodes of the cloud server cluster. It receives defense execution data uploaded by the policy execution module and combines it with the intrusion feature vectors output by the AI ​​dynamic detection module to construct an incremental training dataset. This achieves closed-loop optimization of the model, evaluation metrics, and defense strategy library. Specifically, it fuses effective information from the defense execution data (such as successfully blocked intrusion features and misjudged normal behavior features) with the corresponding intrusion feature vectors to construct an incremental training dataset. The dataset is divided into an incremental training set and an incremental validation set proportionally. Using the transfer learning approach, it freezes some layer parameters of the Transformer feature extraction model in the AI ​​dynamic detection module and only fine-tunes the parameters of the remaining encoder layers and the multilayer perceptron classification model. It sets appropriate training optimizers, learning rates, training batch sizes, and training epochs. After each training epoch, the model performance is verified using the incremental validation set. When the model performance on the incremental validation set reaches the preset improvement standard, the fine-tuned model replaces the original model, and the AI ​​dynamic detection module in the cloud server cluster is updated to ensure the generalization ability and accuracy of the detection model.

[0047] The weight adjustment of breakpoint priority evaluation indicators is based on the strategy execution effect in the defense execution data. The influence of each evaluation indicator factor on the defense effect is analyzed. According to the analysis results, the weight of relevant factors is recalculated through the analytic hierarchy process, and their proportion in the evaluation system is appropriately adjusted. After the weight adjustment, the rationality of the adjustment is verified through simulation test, and then the evaluation indicator system of the attack chain breakpoint identification and priority evaluation module is updated.

[0048] Statistically analyze the execution data of each defense strategy, calculate the blocking success rate, resource consumption rate, and business impact of the strategy, and establish a strategy effectiveness scoring model; eliminate inefficient strategies, optimize medium-effective strategies, and add high-efficiency strategies; adjust the matching weight of each strategy in the strategy library according to the defense needs of different types and priority breakpoints to ensure that high-effective strategies are matched first, thereby improving the efficiency and accuracy of defense decisions.

[0049] This invention proposes an AI-driven dynamic detection and adaptive defense system for network intrusion, which includes: The data acquisition module adopts a distributed architecture and collects network traffic, node logs, port status, and data packet characteristics in a non-intrusive manner through acquisition terminals deployed on each network node. AI dynamic detection module: It has a built-in deep learning detection model, performs preprocessing on aggregated data to obtain standardized feature data, completes intrusion behavior feature extraction and classification based on the deep learning model, outputs intrusion-related information and stores feature vectors; Attack chain breakpoint identification and priority assessment module: Based on intrusion feature vectors and network asset topology information, the attack chain map is reconstructed, three types of key breakpoints are identified, and the breakpoint priority is quantitatively ranked by constructing an assessment index system. Defense decision module: Matches corresponding defense strategies based on breakpoint type and priority, determines execution nodes based on nodes involved in the attack chain, and binds strategies to nodes to generate cross-node linkage defense instructions; Policy execution module: Receives coordinated defense instructions, and the corresponding execution nodes execute the defense operations respectively. At the same time, it collects data such as policy execution efficiency, blocking success rate and network resource consumption in real time. Feedback optimization module: Collects defense execution data, uses it and intrusion feature vectors as incremental training data to optimize the deep learning model, adjusts the breakpoint priority evaluation index weights, and optimizes the policy matching weights and execution priorities of the defense policy library.

[0050] Furthermore, the AI ​​dynamic detection module receives the aggregated data transmitted by the data acquisition module and uses the Min-Max normalization algorithm. Map the data to the interval [0, 1], where, For a single original data sample, The minimum value of all data in this dimension. The maximum value of all data in this dimension. For the normalized data, a wavelet denoising algorithm is used to remove noise interference, and finally, principal component analysis is used to reduce the data dimensionality. After data preprocessing, the built-in Transformer-based feature extraction model uses a multi-head attention mechanism to deeply mine the correlation information of different dimensions and time series in the normalized feature data, capturing the hidden intrusion behavior correlation features behind the data. After feature fusion and nonlinear transformation, a high-dimensional feature vector with fixed dimensions is output. The classification and judgment model adopts a multilayer perceptron structure. After receiving the high-dimensional feature vector, the activation function of the hidden layer completes multiple nonlinear mappings and dimensional transformations of the features to enhance the discriminativeness of intrusion behavior features. Finally, the output layer Softmax function completes the multi-class probability calculation and outputs the judgment result of whether the intrusion behavior exists, the specific intrusion type identifier, and the corresponding intrusion feature vector. At the same time, a distributed cluster-deployed database is used to store the output intrusion feature vector and the matched intrusion type information in real time.

[0051] Furthermore, the attack chain breakpoint identification and priority evaluation module is based on the initial attack node identifier, attack behavior characteristics, and network asset topology information contained in the intrusion feature vector. The network asset topology information includes the IP address, device type, details of existing vulnerabilities, and communication connection relationships between nodes of each network node. Through attack path mining algorithms, calculation and analysis are carried out. Starting from the initial attack node, the module matches the node vulnerability exploitation probability based on the attack methods corresponding to the intrusion feature vector, determines the subsequent attack nodes after successful vulnerability exploitation, and constructs attack behavior transfer paths in combination with the communication link status between nodes. The module associates the node and behavior information corresponding to each attack step one by one, and finally integrates all effective attack transfer paths to generate a complete attack chain node association map containing node attributes, attack behavior types, attack transmission relationships between nodes, and attack success probability.

[0052] Furthermore, the attack chain breakpoint identification and priority evaluation module performs calculations and analysis using attack path mining algorithms, specifically through the node transition probability formula. Calculate the attack transfer probability between adjacent nodes, where... This represents an attack starting from the current node. Successfully transferred to the target node The single transition probability, To attack the node To the target node The probability of successfully exploiting the vulnerability. For nodes With nodes The reachability probability of the communication link between them, and then through the attack path reachability formula. Calculate the overall reachability of the attack path to be verified, where To determine the attack path to be verified, we start from the initial attack node, match the node vulnerability exploitability based on the attack methods corresponding to the intrusion feature vector, and combine the calculation results to determine the subsequent attack nodes after successful vulnerability exploitation.

[0053] Furthermore, the attack chain breakpoint identification and priority evaluation module stores standard feature vectors for three types of nodes in its preset breakpoint feature library: vulnerability exploitation nodes, data transmission nodes, and instruction execution nodes. The standard features for vulnerability exploitation nodes include vulnerability identifiers, privilege escalation actions, and vulnerability triggering parameters. The standard features for data transmission nodes include traffic throughput characteristics, data encryption identifiers, and communication protocol type dimensions. The standard features for instruction execution nodes involve process creation identifiers, remote instruction code characteristics, and system resource call characteristic parameters. The module extracts the actual feature information of each node in the attack chain node association graph and converts it into a feature vector with unified dimensions. Then, it uses a cosine similarity matching algorithm. Calculate the similarity between the actual feature vector of each node and the three types of standard feature vectors, where, These are standard feature vectors from the breakpoint feature library. This represents the actual feature vector of the attack chain node. When a node is identified as a critical breakpoint of the corresponding type, and the similarity between the actual feature vector of a node and the standard feature vector of a certain type is higher than a certain threshold, the node is identified as a critical breakpoint of the corresponding type. In this way, three types of critical breakpoints are identified from the attack chain node association graph: vulnerability exploitation nodes, data transmission nodes, and instruction execution nodes.

[0054] Furthermore, the attack chain breakpoint identification and priority assessment module constructs an assessment index system with the attack chain impact degree and protection implementation difficulty as core dimensions. The attack chain impact degree dimension includes factors such as the probability of attack chain failure after breakpoint interruption, the scope of impact on subsequent attack nodes, and the scale of security losses caused. The protection implementation difficulty dimension includes factors such as the complexity of vulnerability remediation technology, the cost of protection resource investment, and the strategy implementation cycle. A hierarchical structure model of target layer, criterion layer, and factor layer is constructed using the analytic hierarchy process (AHP). The importance of each level's indicators is compared pairwise, and a judgment matrix is ​​constructed. After verifying the rationality of the matrix through consistency checks, the weights of each core dimension and its subordinate factors are calculated using the eigenvector method to ensure that the weight allocation meets actual assessment needs. Combined with the fuzzy comprehensive evaluation method, a fuzzy evaluation set is established. Based on historical data, a fuzzy judgment matrix for each subordinate factor is constructed. The weights of each factor are synthesized with the corresponding fuzzy judgment matrix to obtain a comprehensive quantitative score for each breakpoint. A fixed scoring interval is pre-set to complete the priority level division of the three types of key breakpoints.

[0055] Furthermore, the attack chain breakpoint identification and priority evaluation module combines fuzzy comprehensive evaluation method to establish a fuzzy evaluation set and set a quantitative scoring vector. Based on historical data, a fuzzy evaluation matrix is ​​constructed for each subordinate factor. Through fuzzy synthesis operation ,in This represents fuzzy matrix multiplication, yielding a comprehensive evaluation vector. Then, through a comprehensive quantitative scoring formula ,in A comprehensive quantitative score is given to each breakpoint. Quantify the scoring vector The transpose of the result is used to calculate the final quantitative score for each breakpoint; a fixed scoring range is pre-set, and the overall score is within the range of... The division of intervals has high priority. The interval division is of medium priority. The intervals are divided into low-priority intervals to complete the priority level division of the three types of key breakpoints.

[0056] Furthermore, the defense decision module matches corresponding defense strategies from the defense strategy library based on the breakpoint type and priority results. High-priority breakpoints are matched with strategies that are highly targeted and have significant blocking effects, medium-priority breakpoints are matched with strategies that balance protection effectiveness and network performance, and low-priority breakpoints are matched with lightweight protection strategies. Subsequently, based on the network node deployment involved in the attack chain, the defense execution node corresponding to each breakpoint is determined, where vulnerability exploitation breakpoints correspond to edge detection nodes, data transmission breakpoints correspond to core switches, and instruction execution nodes correspond to terminal devices. The matched defense strategies are then bound to the execution nodes to generate standardized cross-node linkage defense instructions.

[0057] Furthermore, the policy execution module receives the issued joint defense instructions. The edge detection nodes target high-priority vulnerability exploitation breakpoints and block vulnerabilities by issuing vulnerability patches, closing the corresponding ports, and configuring protection rules. The core switch targets medium-priority data transmission breakpoints and filters abnormal traffic and blocks communication with malicious IPs by configuring access control lists. The terminal devices target low-priority instruction execution breakpoints and place suspicious programs in a sandbox environment to restrict their access to system resources.

[0058] The embodiments of this invention also have the following technical effects: This invention comprehensively collects multi-dimensional network operation data through a distributed architecture data acquisition module, laying a solid data foundation for accurate detection of intrusion behavior; the deep learning detection model built based on an advanced model architecture significantly enhances the ability to identify unknown intrusion behavior; with the help of the attack chain breakpoint identification and priority evaluation module, it achieves global analysis of the attack chain and accurate location of key breakpoints, effectively solving the problem of insufficient targeting in traditional defense strategies; the cross-node linkage defense mechanism built based on breakpoint priority can implement differentiated protection according to different breakpoint priorities, efficiently blocking the attack chain while minimizing the impact on normal network services; the closed-loop system built by the feedback optimization module can drive the model, evaluation mechanism, and strategy to continuously iterate and optimize with dynamic changes in the network environment, ensuring that the system's protection capabilities always keep pace with changes in the network environment and achieve continuous improvement.

[0059] To achieve the above embodiments, such as Figure 5 As shown, this embodiment also provides an AI-driven network intrusion dynamic detection and adaptive defense device 10, including: The data acquisition and aggregation module 100 is used to collect and aggregate network operation data of the target network. Intrusion detection module 200 is used to intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; The attack chain analysis and evaluation module 300 is used to construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain, and complete priority evaluation. The linkage defense execution module 400 is used to generate and execute cross-node linkage defense strategies according to the type and priority of the key breakpoints, and to collect defense execution data. The dynamic iterative optimization module 500 is used to perform dynamic iterative optimization of the detection model, evaluation indicators and defense strategies based on the defense execution data and intrusion-related feature information.

[0060] Furthermore, the data acquisition and aggregation module 100 is also used for: A distributed, non-intrusive data collection method is adopted. The collected network operation data includes network traffic data, node log data, port status data, and data packet characteristic data. After collection, the network operation data is encrypted during transmission and centrally stored.

[0061] This invention discloses an AI-driven network intrusion dynamic detection and adaptive defense device, which realizes high-precision real-time dynamic detection and response to network attack behavior, improves system defense reliability and strategy flexibility, and meets the needs of information infrastructure for autonomous control and intelligent defense.

[0062] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 6 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads the executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the AI-driven network intrusion dynamic detection and adaptive defense method described above.

[0063] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an AI-driven dynamic detection and adaptive defense method for network intrusion as described in the foregoing embodiments.

[0064] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0065] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. An AI-driven dynamic detection and adaptive defense method for network intrusion, characterized in that, include: S1, collects and aggregates network operation data of the target network; S2, intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; S3, construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain and complete priority evaluation; S4. Generate and execute cross-node linkage defense strategies based on the type and priority of the key breakpoints, and collect defense execution data; S5. Based on the defense execution data and intrusion-related feature information, perform dynamic iterative optimization of the detection model, evaluation indicators, and defense strategies.

2. The method according to claim 1, characterized in that, The network operation data collected and aggregated from the target network includes: A distributed, non-intrusive data collection method is adopted. The collected network operation data includes network traffic data, node log data, port status data, and data packet characteristic data. After collection, the network operation data is encrypted during transmission and centrally stored.

3. The method according to claim 1, characterized in that, The intelligent detection of intrusion behavior in the network operation data includes: Standardized feature data is obtained by preprocessing network operation data; Deep learning models are used to mine intrusion behavior-related features from standardized feature data and generate high-dimensional feature vectors. The high-dimensional feature vector is calculated based on the classification model, and the intrusion behavior judgment result, intrusion type identifier and corresponding intrusion-related feature information are output.

4. The method according to claim 1, characterized in that, The step of constructing an attack chain graph based on the intrusion-related feature information, identifying key breakpoints in the attack chain, and completing priority evaluation includes: By combining network asset topology information, the attack transfer probability and attack path reachability between network nodes are calculated through attack path mining algorithms, effective attack paths are screened and integrated to generate an attack chain graph. The actual characteristics of each node in the attack chain graph are matched with the preset breakpoint standard characteristics to identify multiple types of key breakpoints. Then, the key breakpoints are quantitatively scored and prioritized using a multi-dimensional evaluation index system.

5. The method according to claim 1, characterized in that, The step of generating and executing a cross-node coordinated defense strategy based on the type and priority of the key breakpoints includes: Match differentiated defense strategies to critical breakpoints of different priorities; Based on the type of critical breakpoint, the corresponding execution node is determined. After binding the defense strategy with the execution node, a standardized cross-node linkage defense command is generated and sent to the corresponding execution node to complete the defense operation.

6. The method according to claim 1, characterized in that, The dynamic iterative optimization of the detection model, evaluation indicators, and defense strategy based on the defense execution data and intrusion-related feature information includes: Incremental training datasets are constructed by fusing defense execution data with intrusion-related feature information. Incremental training and parameter fine-tuning were performed on the deep learning model used for intrusion detection. Adjust the weights of breakpoint priority evaluation metrics based on the effectiveness of defense execution, and update and match the weights of the defense strategy library.

7. An AI-driven dynamic detection and adaptive defense device for network intrusion, characterized in that, include: The data acquisition and aggregation module is used to collect and aggregate network operation data of the target network. The intrusion detection module is used to intelligently detect intrusion behavior in the network operation data and output intrusion-related feature information; The attack chain analysis and evaluation module is used to construct an attack chain map based on the intrusion-related feature information, identify key breakpoints in the attack chain, and complete priority evaluation. The coordinated defense execution module is used to generate and execute cross-node coordinated defense strategies based on the type and priority of the key breakpoints, and to collect defense execution data. The dynamic iterative optimization module is used to perform dynamic iterative optimization of the detection model, evaluation indicators, and defense strategies based on the defense execution data and intrusion-related feature information.

8. The apparatus according to claim 7, characterized in that, The data acquisition and aggregation module is also used for: A distributed, non-intrusive data collection method is adopted. The collected network operation data includes network traffic data, node log data, port status data, and data packet characteristic data. After collection, the network operation data is encrypted during transmission and centrally stored.

9. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement an AI-driven network intrusion dynamic detection and adaptive defense method as described in any one of claims 1-6.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements an AI-driven dynamic detection and adaptive defense method for network intrusion as described in any one of claims 1-6.

Images